Code Analysis Rust Direct Calls

Rust direct source paths and known callers

Validated in Draft, not Labs: #1258, runtime bf147b0f58fad007e7aa464ad7edf90806aa9dfc, evidence/package head 9e41b7483. Native stack #1257: frozen baseline #1255 → Go #1256 → Rust #1258 on top of #1252. Original team authors, commits and PR ownership remain intact. No approval, merge, release or live installation.

A developer can follow one more source step

Before: normal --language rust selection returns extract/adapter-unknown, exit 2.

After: regex-syntax/src/lib.rs:369 → unicode::is_word_character → regex-syntax/src/unicode.rs:463. The fixed older source has lib.rs:252 → unicode.rs:400. Fresh paired investigation finds the verified caller on both sides. In the real workspace, root src/lib.rs:1345 → regex_syntax::escape → regex-syntax/src/lib.rs:201. regex-automata's function-local use-as write at special.rs:357 binds calls 364/365 to util/wire.rs:663; plain use calls at util/look.rs:1588/1603 reach regex-syntax/lib.rs:366.

The reserved serde_json investigation follows lexical/parse.rs:18 fast_path → algorithm.rs:18 through a wildcard use, at both fixed revisions, when float_roundtrip is selected. Default profiles exclude that module. F::exponent_limit at algorithm.rs:24 stays unknown: there is no trait/type evidence to select an implementation.

Both paired outputs remain partial / exit 1, because captured Cargo/crate/feature profiles differ across upstream versions. Direct callers are evidence, not equivalent builds or complete impact.

Fixed projects and replay

• regex 1.7.0 f871a8eb1d725a8aaa56e2ceea57c24fce74b5fd → 1.11.1 9870c06e6c772daaad7ab612faab29130753e41c.
• serde_json 1.0.100 d2fce19685bf0e3d493a9d785665137654c79e6d → 1.0.139 4d4f53c3b7de3259b6a8a15ef4d5f4edb47af32f.

Full evidence and commands · immutable original manifest · executed public CLI replay · source/ZIP parity.

Place the fixed checkouts in regex, regex-base, serde-json and serde-json-base under one directory. Run python3 benchmarks/code-analysis-go-rust/run-rust.py --cli archify/bin/archify.mjs --samples-root /path/to/samples --out /tmp/rust-source; repeat with the extracted ZIP entrypoint. The script uses offline helper builds, so cache the locked helper dependencies first. It asserts upstream revisions/source hashes and expected exit statuses.

Source and ZIP each give 9 correct / 0 wrong / 0 missed targets / 0 omitted selected calls / 2 reasonable unknowns. Five positive versioned observations were frozen originally; four plain/use-as observations are supplemental and exposed during development. serde_json was reserved from initial tuning but source-inspected to establish expectations. This is not a blind holdout, unique-site count or whole-repository accuracy claim.

Actual scope and remaining unknowns

Cargo metadata sees captured manifests and empty source inventory stubs, offline/locked/no-deps. syn 2.0.119 parses captured source bytes. No project build, build script, proc-macro, external source, .cargo config or rust-toolchain file is loaded. Explicit local workspace library names, editions, module path attributes, crate/self/super, use/use-as/globs and lexical bindings support direct free-function targets.

Actual profile: Rust/cargo 1.89.0, Darwin arm64 host cfg, local workspace lib/bin targets, tests excluded, defaults plus local path feature forwarding; serde float runs additionally enable float_roundtrip. This is not Cargo's full build/resolve graph. Unknown custom cfg/opaque attributes do not select arbitrary targets. Coverage lists actual selected files/crates, exclusions/regions/targets, parse errors, missing modules, conditional definitions, opaque macros and hashed Cargo inputs.

Methods/traits/associated functions, function values, local item targets, expanded/generated macros, type/field navigation, external crates and complete Cargo target/feature semantics remain unsupported. Structural dependency cycles do not establish runtime partial initialization. The first candidate's five misleading regex cycle claims are retained as rejected evidence and corrected before acceptance.

Cargo/rustc 1.71+ declared; only 1.89.0 exercised. Fresh helper dependency-cache build on an existing compiler: 9.90s, 7.38 MB Cargo cache, 99.92 MB build output. Full toolchain installation cost unmeasured. Missing rustc returns structured extract/rust-unavailable, exit 2. A real offline regex-syntax compiler comparison stopped at uncached workspace dependency lexopt; no compiler precision result or rust-analyzer benchmark is claimed.

Verification layers

Layer	Result
Local source	Ten Rust regressions pass; full module suite 359 pass / 1 inherited TS installed-config assertion failure / 0 skipped. Same assertion reproduced on fixed Go parent; cause unestablished.
Normal source / ZIP CLI	Six raw-facts outputs byte-identical; saved question + two paired questions agree after installation/output path normalization. Checks/saved question exit 0; paired questions partial/exit 1.
Package	Two canonical builds equal; all 167 tracked module files match. ZIP SHA-256 db5bd7ff103458f386ca1e5de6127abab638124bd3dbffe60066867d02f49a36. Ten Rust regressions pass from extracted ZIP.
Remote CI	Initial CI failed ten Rust tests because they forced offline helper startup with an empty cache. Isolated CARGO_HOME reproduced the failure; normal first-use dependency acquisition makes all ten pass. The rebuilt final package repeats CLI parity. Final head 9e41b7483 run 42390010956 completed: Code Analysis 360/360 pass, including ten Rust tests; full-regression shard1 passed. Overall CI failed: shard2 has parent-identical README Classic artifact drift (expected ca273484… / actual 7f68d730…); browser shard2 additionally fails compact automatic Sequence Reader Layout fit at test/reader-layout-browser.test.mjs:705. Browser cause is unestablished/unreproduced; this layer does not change its viewer/test sources. Aggregate test(22)/webm-artifact fail consequently. No all-green claim.
Integration	Draft only; not merged into Labs, approved, released or installed live.

Next: prioritize real wrong targets, missed deterministic references and interrupted investigations across Go, Rust, JS/TS, Python and Java. Preserve explicit semantic unknowns rather than filling them with plausible source paths.