Surfaced while closing verify-core's MC/DC gaps (#128 / REQ-25).
The scoped witness gate (witness-gate.sh) counts MC/DC gaps in decisions whose reported path starts with src/. But when <&[u8] as Read>::read_exact is inlined into get32, witness attributes the inlined std decision to get32's source line (src/wasm_module/varint.rs) via debug-line inheritance. So the "verify-core scoped" gap count includes an inlined-std decision that is NOT verify-core's own logic.
Concretely (REQ-25): after closing verify-core's one genuinely-coverable decision (the header compare, now full MC/DC), the residual 3 scoped gaps are all in that inlined read_exact decision — copy-path branches that vary only with buffer length (verify-core issues read_exact at lengths 1 and 8 only), so no honest verify-core input flips them. They're counted as "src/" purely by inlining.
Impact: SRC_BASELINE_GAP can't reach 0 for verify-core's own decisions because the heuristic can't distinguish inlined-std from verify-core-authored decisions. Baseline is honestly floored at 3 for now.
Fix options: (a) filter decisions by whether the instrumented function's demangled name is in wsc_verify_core:: (not just the debug source path); (b) exclude known std/core symbols (read_exact, memcmp) from the scoped count; (c) upstream ask to witness for decision provenance that distinguishes inlined callees. Until then the residual is documented in witness-gate.sh's calibration comment.
Not blocking — the gate is potent (verified: baseline 2 → red; deleting the header reads → gap 4>3 → red).
Surfaced while closing verify-core's MC/DC gaps (#128 / REQ-25).
The scoped witness gate (
witness-gate.sh) counts MC/DC gaps in decisions whose reported path starts withsrc/. But when<&[u8] as Read>::read_exactis inlined intoget32, witness attributes the inlined std decision toget32's source line (src/wasm_module/varint.rs) via debug-line inheritance. So the "verify-core scoped" gap count includes an inlined-std decision that is NOT verify-core's own logic.Concretely (REQ-25): after closing verify-core's one genuinely-coverable decision (the header compare, now full MC/DC), the residual 3 scoped gaps are all in that inlined
read_exactdecision — copy-path branches that vary only with buffer length (verify-core issuesread_exactat lengths 1 and 8 only), so no honest verify-core input flips them. They're counted as "src/" purely by inlining.Impact:
SRC_BASELINE_GAPcan't reach 0 for verify-core's own decisions because the heuristic can't distinguish inlined-std from verify-core-authored decisions. Baseline is honestly floored at 3 for now.Fix options: (a) filter decisions by whether the instrumented function's demangled name is in
wsc_verify_core::(not just the debug source path); (b) exclude known std/core symbols (read_exact, memcmp) from the scoped count; (c) upstream ask towitnessfor decision provenance that distinguishes inlined callees. Until then the residual is documented inwitness-gate.sh's calibration comment.Not blocking — the gate is potent (verified: baseline 2 → red; deleting the header reads → gap 4>3 → red).