v3.34.0 — gates reporting on what they could not see

Minor rather than patch for the third release running, and for the same reason: this changes what pmat reports on unchanged code. analyze reachability moves 82 files out of reachable on an unchanged tree, and CB-1700 changes its verdict on any repository that gates merges with CI rather than approvals. Read the notes before upgrading a gate.

3.33.0's theme was a gate that could not measure reporting there was nothing to find. This release is one layer down: three gates reporting on a population, a posture, or a database they could not see — and two of them are gates 3.33.0 had just repaired. Repairing a gate's logic and stopping is how "we added a check for that" becomes true and useless at the same time.

analyze reachability counted the quarantine as reachable

A module behind #[cfg(all(test, feature = "broken-tests"))] was followed by the walker and left the report as reachable. The declaration exists — but the feature is in no bundle and the code behind it does not compile, so those tests ran in no build at all.

82 files · 35,856 lines · 2,021 #[test] fns

all previously folded silently into reachable, and far more than the 49 declaration sites the issue counted.

A third state, not a longer orphan list. An orphan is declared by nothing; a quarantined module is declared by something that does not compile. Report gains quarantined, and the JSON gains quarantined{,_count,_lines,_tests} as new keys — old consumers read exactly what they read before.

cargo check --all-features --tests builds, for the first time ever

error: this file contains an unclosed delimiter        # before
    Finished `dev` profile                             # after

broken-tests was a Cargo feature, and --all-features reaches every feature. Five separate workarounds existed in this repository alone to route around that. The quarantine is now the cfg flag pmat_broken_tests, which --all-features cannot reach. --features broken-tests is no longer accepted.

CB-1700 asserted human review as the only valid posture

Requiring an approving review here made every merge an admin bypass — GitHub does not let an author approve their own PR, and the repository has one active human. An override exercised on every merge is not a control.

CB-1700 now passes on either posture: ≥ 1 approving review, or CI-gated (a required status check, strict true, force pushes and deletions disabled). The rule is not weaker — zero reviews without those properties still fails, and a test drives all three ways to fall out of it.

cargo deny cannot see GitHub's advisory database, and says nothing about it

Same Cargo.lock, two answers, and the blocking one was wrong:

cargo deny check advisories    → "advisories ok", exit 0
dependabot/alerts?state=open   → #66 medium thrift GHSA-2f9f-gq7v-9h6m

advisories ok prints identically whether the database is comprehensive, stale, or empty. scripts/dependabot-alerts-gate.sh runs beside cargo-deny, paginates properly, fails when it cannot measure, and supports acknowledgements with a mandatory expiry. It proves it can fail on every run: five falsification arms execute before the live check.

Also

• The quality proxy's clippy budget is 10 minutes under cfg(test) — the 60s bound is wall-clock, and a saturated test run starves the child rather than slowing it. The shipped bound is unchanged at 60s.
• The swc ecosystem moves as a unit — three individually-unbuildable dependabot PRs resolved as one lockstep bump.
• ring is not linked into the binary. The reported "~1.3 MiB duplicated crypto backend" does not reproduce: ring_core_ appears zero times in the stripped release binary.

A mistake this release records rather than drops

Seven deny.toml ignores were pruned as stale and the prune was reverted. The verification confirmed the warnings about those lines were gone — trivially true once the lines are deleted — instead of checking that no error had appeared, and CI failed on paste/RUSTSEC-2024-0436. Local and CI still disagree about which advisories match the same lockfile, so the CI assertion that would have encoded the local answer is not shipped until that is explained.

It is this release's own defect, committed while fixing that exact class.

---

Full detail, with the measurement behind each claim, in CHANGELOG.md.