Skip to content

docs(reports): land cycle 18, withdraw a wrong correction, fix its finding - #285

Merged
emrecdr merged 3 commits into
mainfrom
docs/hardening-cycle-18
Aug 18, 2026
Merged

docs(reports): land cycle 18, withdraw a wrong correction, fix its finding#285
emrecdr merged 3 commits into
mainfrom
docs/hardening-cycle-18

Conversation

@emrecdr

@emrecdr emrecdr commented Aug 18, 2026

Copy link
Copy Markdown
Owner

Lands cycle 18 and settles two corrections in opposite directions — both by running a command rather than reading text.

1. My cycle-17 correction is withdrawn

Cycle 18 rejected it, and the rejection is upheld:

$ git branch -vv
gh-pages 7e21ef5 [origin/gh-pages: behind 13]

[behind N] never compares to main — it compares a branch to its own upstream. gh-pages tracks origin/gh-pages, and git rev-list --count gh-pages..origin/gh-pages is 13. Cycle 17's "13 behind locally, which is the publishing job" was correct and standard.

My correction measured gh-pages..main (807) — a comparison the report never made — and generalised from it to "behind is not a meaningful measure of it at all", which is false on its face. I also checked the figure was accurate when written, not just now: origin/gh-pages last moved at 07:30 and 07:50 that day, before the anchor.

That wrong correction shipped in #283. This PR retracts it in place and restores the original wording.

2. Cycle 18's own finding is corrected

It listed three unused dependencies in codelore-rca. Proven by build, only two are removable:

Dependency Claimed Proven
serde_json unused ✅ removed, cargo check --all-targets → 0 errors
rayon unused ✅ same run, 0 errors
num-traits unused requirederror[E0463]: can't find crate for num_traits

codelore-rca derives FromPrimitive in six generated language_*.rs files. num-derive's documentation states its macros "assume that the num_traits crate is a direct dependency" unless the #[num_traits = "…"] helper names another path — which this crate does not use. The derive emits bare num_traits:: paths that must resolve in this crate's own extern prelude, so a transitive copy does not help.

Three claims fall with it:

  • "all three unreferenced" — one is required, invisibly
  • "removing all three changes the build by nothing" — it breaks compilation
  • the tooling note's "cargo-machete would find these three" — it would flag num-traits as a false positive

The cargo-machete recommendation now carries the qualifier that any such step must list num-traits in package.metadata.cargo-machete.ignored and be read as a candidate list, not a verdict. A gate that is wrong about this crate on day one — and whose wrongness compiles cleanly until someone acts on it — would manufacture exactly the confident-and-wrong claim these cycles keep catching.

What survives, and the better lesson

The finding stands as two removable dependencies, with a sharper point than it started with: "absent from the source text" and "safe to remove" are different predicates, and only the second is checkable by building.

Everything else in cycle 18 verified against source: the #284 roadmap-merge validation, both accepted corrections (aho-corasick and iana-time-zone-haiku each at 1 lockfile entry), the dependency tabulation (18+2 / 32+1+3 / 14+5, all exact), and cargo-machete being absent from CI.

Docs only. The manifest change removing serde_json and rayon follows separately.

…orrection rejected

Anchor 19a00ec; baseline 9811bd8 (v0.28.0). Delta 2 commits (#283, #284),
both consequences of cycle 17.

#284 VALIDATED. The roadmap merge implements cycle 17's finding F
faithfully: one row, the three options ranked rather than listed, and
build-once-and-cache marked as the only one closing both outcomes. It
also absorbs the correction #283 made to that same finding — the row
says libduckdb-sys is the only C++-compiling dependency "that builds on
any target we ship", repairing my flat claim rather than leaving the fix
in a report.

CORRECTIONS: two accepted, one rejected.

Accepted — aho-corasick is still in Cargo.lock (pulled by globset,
regex, regex-automata). Cycle 17 said petgraph and aho-corasick were
"both now absent"; only petgraph left. Removing it from codelore-rca's
manifest deleted an unused DIRECT dependency, not the crate from the
build. #283's framing is fair: written without opening the lockfile, in
the paragraph claiming credit for finding dead dependencies.

Accepted — iana-time-zone-haiku also ships a scanner, so calling
libduckdb-sys "the only C++-compiling dependency" was incomplete; it
sits behind cfg(target_os = "haiku") and builds on no target we ship, so
the finding stands.

REJECTED, with evidence — "gh-pages is an orphan branch, so 'behind'
does not measure anything there." The orphan fact is correct and new to
me (git merge-base main gh-pages is empty). The conclusion is not:
git branch -v's [behind N] never compares to main, it compares a branch
to its own upstream. gh-pages tracks origin/gh-pages, and
`git rev-list --count gh-pages..origin/gh-pages` is 13 — exactly what
cycle 17 §6 said ("13 behind locally, which is the publishing job"), a
phrasing that already encodes cycle 9's E1 lesson. Recorded as rejected
rather than quietly accepted, because deferring to a correction without
verifying it is the same failure as accepting a finding without
verifying it. The underlying observation — that this figure invites
misreading, twice now — stands.

F (LOW, new) — codelore-rca declares three more dependencies it does not
use: serde_json, num-traits, rayon. Zero occurrences anywhere in its
src/, no aliased imports that could hide them; the same vendoring
residue class as petgraph and aho-corasick. Found by finally running the
sweep properly — all three crates, all dependency tables, all source
roots including build.rs, with - to _ normalisation. Cycle 16's version
covered two crates with a crude method and skipped the one the finding
was about.

Bounded before claiming, per the aho-corasick lesson: removing all three
changes the build by NOTHING. serde_json is a direct dep of both lib and
cli; rayon of lib; num-traits is pulled by the whole arrow stack, chrono,
criterion and the num-* family. This is manifest hygiene only — the
value is that a vendored crate's manifest overstates what the vendored
code needs, which misleads whoever is working out what the fork still
depends on.

Complementary to #278's note that unused-dependency tooling would not
have found the grammars: it would find these three. The classes are
disjoint — unreferenced-declared (tooling catches) vs
referenced-but-unreachable (reachability analysis catches) — and the
project has now hit one of each. cargo-machete is the natural guard for
the first.
…nding

Two corrections in opposite directions, both settled by running a
command rather than by reading text.

Cycle 17's gh-pages correction is WITHDRAWN. It claimed "13 behind" was
meaningless because gh-pages is an orphan branch with no common
ancestor with main. The orphan fact is true and irrelevant: [behind N]
never compares to main, it compares a branch to its own upstream.
gh-pages tracks origin/gh-pages, `git rev-list --count
gh-pages..origin/gh-pages` is 13, and `git branch -vv` prints
"[origin/gh-pages: behind 13]" verbatim. The original figure was
correct and standard. The correction measured gh-pages..main (807) --
a comparison the report never made -- and generalised from it. Cycle
18 section 2.3 rejected it with that evidence; the rejection is upheld
and the retraction lands here.

Cycle 18's own finding is CORRECTED. It listed three unused
dependencies in codelore-rca. Only two are removable:

  serde_json + rayon removed -> cargo check --all-targets: 0 errors
  num-traits removed         -> error[E0463]: can't find crate for
                                `num_traits` in six language_*.rs files

codelore-rca derives FromPrimitive in six generated files, and
num-derive's documentation states its macros assume num_traits is a
direct dependency unless the #[num_traits = "..."] helper names
another path -- which this crate does not use. The derive emits bare
num_traits:: paths that must resolve in this crate's own extern
prelude, so a transitive copy does not help.

Three claims fall with it: "all three unreferenced", the "removing all
three changes the build by nothing" bound, and the tooling note's
assertion that cargo-machete would find all three. It would flag
num-traits as a false positive, so the recommendation now carries the
qualifier that any such step must ignore num-traits and be read as a
candidate list.

The finding survives as two removable dependencies, and gains a better
lesson than it started with: "absent from the source text" and "safe
to remove" are different predicates, and only the second is checkable
by building.
…tion

The header still listed the gh-pages figure among the corrections made
in place. That correction is withdrawn in the same PR, so the summary
now counts two surviving corrections and points at the retraction.
@emrecdr
emrecdr merged commit d0570d5 into main Aug 18, 2026
14 checks passed
@emrecdr
emrecdr deleted the docs/hardening-cycle-18 branch August 18, 2026 23:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants