LTplus-AG
diff --git a/‎rust/processing/tests/common/mod.rs‎
Lines changed: 46 additions & 0 deletions b/‎rust/processing/tests/common/mod.rs‎
Lines changed: 46 additions & 0 deletions
diff --git a/‎rust/processing/tests/module_size_ratchet.rs‎
Lines changed: 89 additions & 6 deletions b/‎rust/processing/tests/module_size_ratchet.rs‎
Lines changed: 89 additions & 6 deletions
@@ -0,0 +1,46 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+//! Shared helper for the source-walking CI gates in this crate
+//! (`module_size_ratchet`, `styling_parity`).
+//!
+//! Lives here rather than being copied into each test binary so the rule has
+//! ONE implementation: two copies of a gate's escape hatch are two chances to
+//! loosen one of them and not the other.
+
+/// Refuse to skip a source-walking gate when running under CI.
+///
+/// Both gates begin `let Some(root) = repo_root() else { eprintln!(…); return; }`.
+/// That early return is the widest hole the #3200 hardening left open: it
+/// happens BEFORE the walk, so it bypasses the missing-root panic, the
+/// unreadable-file panic and the scan floor all at once. Reproduced with
+/// `repo_root` stubbed to `None` — `no_module_grows_past_its_ratchet_budget`,
+/// `no_duplicate_default_color_tables` and
+/// `no_duplicate_surface_style_color_extraction` each report
+/// `ok … finished in 0.00s`: three green gates over a tree never opened.
+///
+/// It cannot simply become a panic. `tests/` is packaged into the published
+/// `.crate` (there is no `exclude` in `rust/processing/Cargo.toml`), so a
+/// downstream `cargo test` on `ifc-lite-processing` runs these files with no
+/// `rust/` or `apps/` above them, and skipping is correct there. Nor can the
+/// two situations be told apart by looking for the repo — its absence is the
+/// thing being explained.
+///
+/// `CI` is the discriminator: GitHub Actions sets it on every run, and a
+/// packaged consumer's machine does not have it. The truthiness test follows
+/// the form already used by `rust/geometry/tests/triangulation_invariance.rs`
+/// rather than inventing a second convention for the same variable.
+pub fn refuse_to_skip_in_ci(gate: &str) {
+    let ci = std::env::var_os("CI").is_some_and(|v| !v.is_empty() && v != "0" && v != "false");
+    assert!(
+        !ci,
+        "{gate}: no repo root above CARGO_MANIFEST_DIR ({}), but CI is set. Under CI \
+         this gate must scan the tree, not skip it — skipping bypasses the \
+         missing-root panic, the unreadable-file panic AND the scan floor at once, \
+         and reports success over a tree that was never opened (#3200). Either the \
+         checkout is incomplete or the walk roots are wrong; both block a release, \
+         and neither of them means 'no offenders'.",
+        env!("CARGO_MANIFEST_DIR")
+    );
+}
@@ -20,6 +20,19 @@
 //!
 //! This runs in the required `rust-tests` lane (`cargo test --workspace`), so a
 //! violation blocks merge. Cross-crate file walking mirrors `styling_parity`.
+//!
+//! ANTI-VACUITY (#3200): every offender this gate reports is produced by
+//! iterating the walked file list, so an empty walk produced an empty message
+//! and a green test - success reported over a tree that was never opened. Four
+//! guards now stand between an empty walk and that pass: a missing or unreadable
+//! scan root is a hard error instead of an empty result (and the two are told
+//! apart, because they call for different fixes), a file that cannot be read is
+//! a hard error instead of 0 lines, the walk must reach at least `FILE_FLOOR`
+//! non-exempt files before any verdict below it counts, and under CI the
+//! no-repo-root skip is refused outright (`common::refuse_to_skip_in_ci`) - that
+//! skip returns before the walk, so it bypassed all three of the others at once.
+
+mod common;
 
 const LIMIT: usize = 400;
 const ALLOWLIST: &str = include_str!("module_size_allowlist.txt");
@@ -43,6 +56,24 @@ const ALLOWLIST: &str = include_str!("module_size_allowlist.txt");
 /// would rewrite the digest and fail CI for no reason.
 const ALLOWLIST_DIGEST: u64 = 2635552733029908705;
 
+/// Lower bound on how many non-exempt `.rs` files the walk must reach before
+/// its verdict means anything. Every offender this gate can report is pushed
+/// inside `for (rel, lines) in files`, so an empty `files` produces an empty
+/// message and a green test - a pass over a region the gate never examined
+/// (#3200).
+///
+/// MEASURED, not guessed: the walk over `rust/` + `apps/` reaches 362
+/// non-exempt files on a healthy tree (raise the floor and run the test to see
+/// the real figure in the failure message). The floor below sits at roughly two
+/// thirds of that, which is the right shape of
+/// headroom here: this number only has to separate "the walk works" from "the
+/// walk went blind", and every way it can go blind - a wrong scan root, a
+/// `read_dir` that fails, a crate tree that moved - takes the count to zero or
+/// to a handful, never to a plausible-looking fraction. Deleting a whole crate
+/// is the only ordinary event that would approach it, and that is a change
+/// worth editing this line for.
+const FILE_FLOOR: usize = 240;
+
 /// Repo root = first ancestor holding both `rust/` and `apps/`. `None` in a
 /// packaged/standalone context (the test then skips, like `styling_parity`).
 fn repo_root() -> Option<std::path::PathBuf> {
@@ -57,11 +88,39 @@ fn repo_root() -> Option<std::path::PathBuf> {
     }
 }
 
+/// Walk `dir`, collecting every `.rs` file underneath it.
+///
+/// A directory this cannot list is a hard error, and the two reasons are told
+/// apart. The previous `let Ok(entries) = read_dir(dir) else { return; };`
+/// collapsed "the scan root is not there" and "the scan root cannot be opened"
+/// into the same result as "this directory holds no Rust files" - which is how
+/// this ratchet could report success over a tree it never opened (#3200). A
+/// missing directory means the walk roots are wrong; an unreadable one means
+/// the environment is. Neither means there are no offenders.
 fn collect_rs_files(dir: &std::path::Path, out: &mut Vec<std::path::PathBuf>) {
-    let Ok(entries) = std::fs::read_dir(dir) else {
-        return;
+    let entries = match std::fs::read_dir(dir) {
+        Ok(entries) => entries,
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => panic!(
+            "module-size ratchet: {} does not exist. Refusing to treat a missing \
+             directory as one holding no .rs files - a walk root that is not \
+             there means this gate is looking in the wrong place, not that the \
+             tree is clean.",
+            dir.display()
+        ),
+        Err(err) => panic!(
+            "module-size ratchet: {} could not be read ({err}). Refusing to treat \
+             an unreadable directory as one holding no .rs files.",
+            dir.display()
+        ),
     };
-    for entry in entries.flatten() {
+    for entry in entries {
+        let entry = entry.unwrap_or_else(|err| {
+            panic!(
+                "module-size ratchet: an entry of {} could not be read ({err}). \
+                 Refusing to walk past a file this gate could not classify.",
+                dir.display()
+            )
+        });
         let path = entry.path();
         if path.is_dir() {
             let skip = matches!(
@@ -114,10 +173,19 @@ fn parse_allowlist() -> std::collections::HashMap<String, usize> {
     map
 }
 
+/// Line count for one file. An unreadable file is a hard error, not zero: 0 is
+/// under LIMIT and under every allowlist budget, so `unwrap_or(0)` made a file
+/// this gate could not open indistinguishable from a file that passes it.
 fn line_count(path: &std::path::Path) -> usize {
-    std::fs::read_to_string(path)
-        .map(|s| s.lines().count())
-        .unwrap_or(0)
+    match std::fs::read_to_string(path) {
+        Ok(s) => s.lines().count(),
+        Err(err) => panic!(
+            "module-size ratchet: {} could not be read ({err}). Refusing to count \
+             an unreadable file as 0 lines - 0 is under every budget, so the file \
+             would pass the ratchet without ever being measured.",
+            path.display()
+        ),
+    }
 }
 
 /// Pure ratchet decision: given `(relpath, line_count)` for every non-exempt
@@ -148,6 +216,7 @@ fn evaluate(
 #[test]
 fn no_module_grows_past_its_ratchet_budget() {
     let Some(root) = repo_root() else {
+        common::refuse_to_skip_in_ci("module-size ratchet");
         eprintln!("repo root not found (packaged context) - skipping module-size ratchet");
         return;
     };
@@ -169,6 +238,20 @@ fn no_module_grows_past_its_ratchet_budget() {
         .filter(|(rel, _)| !is_exempt(rel))
         .collect();
 
+    // Anti-vacuity (#3200). Placed above every verdict below, because all of
+    // them are computed by iterating `files`: zero files gives zero offenders
+    // gives a green test, which is this gate reporting success over a tree it
+    // never looked at.
+    assert!(
+        files.len() >= FILE_FLOOR,
+        "module-size ratchet walked rust/ and apps/ and reached only {} non-exempt \
+         .rs file(s); the floor is {FILE_FLOOR}. Refusing a vacuous pass: every \
+         check below iterates this list, so a count this low means the walk \
+         stopped working, not that the modules went away. If crates were \
+         genuinely removed, lower FILE_FLOOR in the same commit.",
+        files.len()
+    );
+
     // Advisory only (never fails the build, to avoid merge-order coupling): an
     // allowlisted file that dropped to <= LIMIT or vanished should have its row
     // removed so the list keeps trending down.