scripts/gc_store_site_inventory.py matches raw-pointer writes only in their free-function spelling. The equivalent method spelling on a raw pointer is invisible to it, so the same store audited in one form is unaudited in the other.
The patterns
The scanner carries these (among others):
r"\b(?:std::)?ptr::write(?:_unaligned)?\s*\("
r"\b(?:std::)?ptr::copy(?:_nonoverlapping)?\s*\("
r"\*(?P<target>[A-Za-z_][A-Za-z0-9_]*)(?:\.add\([^)]*\))?\s*=(?!=)"ptr::write_unaligned(dst, v) matches. dst.write_unaligned(v) does not — same operation, same raw pointer, different surface syntax.
Demonstrated in one function
While auditing #9118 the scanner flagged exactly one line of concat.rs's byte-copy helper:
} else if len >= 8 {
dst.cast::<u64>().write_unaligned(head); // NOT flagged
dst.add(len - 8).cast::<u64>().write_unaligned(tail); // NOT flagged
} else if len >= 4 {
dst.cast::<u32>().write_unaligned(head); // NOT flagged
...
} else if len == 1 {
*dst = *src; // flagged
}Five stores, one detected. All five are the same POINTER_FREE payload copy, so nothing is wrong here — but the detection ratio is the point, not this instance.
Scale
In crates/perry-runtime/src: 7 method-form .write_unaligned( sites against 136 ptr::write and 153 ptr::copy free-function sites. Small today, which is the good time to close it — the ratio is what changes silently as new code is written in whichever style the author prefers.
Why this class matters more than its size
The failure direction is green. A gate that under-matches reports success on the code it cannot see, so the absence of findings is not evidence of absence — and this repo has a standing rule that a mode nobody exercises is a configuration nobody has verified. CLAUDE.md's "four ways a gate can be unable to fail" is about jobs; this is the same hazard one level down, inside a gate that does run.
Suggested fix
Extend the pattern to the method form, e.g. \.\s*(?:write|write_unaligned|copy_to|copy_from|copy_to_nonoverlapping|copy_from_nonoverlapping)\s*\(, then re-run and audit whatever the 7 sites turn out to need. Worth pairing with a --self-test case per spelling, so a future regex narrowing fails loudly rather than quietly shrinking coverage.
scripts/gc_store_site_inventory.pymatches raw-pointer writes only in their free-function spelling. The equivalent method spelling on a raw pointer is invisible to it, so the same store audited in one form is unaudited in the other.The patterns
The scanner carries these (among others):
ptr::write_unaligned(dst, v)matches.dst.write_unaligned(v)does not — same operation, same raw pointer, different surface syntax.Demonstrated in one function
While auditing #9118 the scanner flagged exactly one line of
concat.rs's byte-copy helper:Five stores, one detected. All five are the same
POINTER_FREEpayload copy, so nothing is wrong here — but the detection ratio is the point, not this instance.Scale
In
crates/perry-runtime/src: 7 method-form.write_unaligned(sites against 136ptr::writeand 153ptr::copyfree-function sites. Small today, which is the good time to close it — the ratio is what changes silently as new code is written in whichever style the author prefers.Why this class matters more than its size
The failure direction is green. A gate that under-matches reports success on the code it cannot see, so the absence of findings is not evidence of absence — and this repo has a standing rule that a mode nobody exercises is a configuration nobody has verified. CLAUDE.md's "four ways a gate can be unable to fail" is about jobs; this is the same hazard one level down, inside a gate that does run.
Suggested fix
Extend the pattern to the method form, e.g.
\.\s*(?:write|write_unaligned|copy_to|copy_from|copy_to_nonoverlapping|copy_from_nonoverlapping)\s*\(, then re-run and audit whatever the 7 sites turn out to need. Worth pairing with a--self-testcase per spelling, so a future regex narrowing fails loudly rather than quietly shrinking coverage.