Mutation job reports survivors its own build excludes

[gaborbernat]

Problem

The nightly mutation job reports survivors that no test can ever kill.

cargo mutants --workspace --all-features parses with syn and does not evaluate cfg. It therefore finds mutants inside code the job's own feature selection excludes from the build, applies them to text that never compiles, observes a green test run, and reports them as survived.

peryx-web shows the shape clearly. Its pagination helpers are gated:

#[cfg(all(target_arch = "wasm32", not(feature = "ssr"), feature = "hydrate"))]
fn previous_disabled(state: AnalyticsState) -> bool { ... }

That gate fails twice over in the job: the runner is not wasm32, and --all-features turns ssr on, so not(feature = "ssr") is false. Confirmed by counterfactual in both directions — a compile_error! inside those functions compiles clean under --all-features --all-targets, while the same injection into the ssr variant of reactive_value fails with E0433.

Of that crate's 159 reported survivors:

count	group	status
71	not(ssr) gated, no arch gate	unbuildable in this job, killable under a hydrate-configured pass
57	wasm32 gated	unbuildable on any host runner
22	compiled today	genuinely untested
9	stale entries	—

So 137 of 159 are noise. --all-features is the direct cause: every not(feature = ...) gate in the workspace is falsified by it.

Why it matters now

The standing goal is that all mutations pass. That is unreachable while the job reports mutants which are unbuildable by construction, and the noise hides the real ones — here, 22 real gaps behind 137 that cannot be acted on.

It also wastes the run. Those mutants are built and tested on every shard.

Required change

Two parts, and the second needs a decision.

Add a second mutants pass for the hydrate build. Configured --no-default-features --features hydrate, it compiles the 71 not(ssr) functions on the host and mutates them for real. This is a job configuration change, not test writing, and it converts the largest group from noise into actionable findings.

Decide the disposition of the wasm32-gated 57. There is no wasm test suite in the repository — no wasm-bindgen-test anywhere in peryx-web, despite a wasm-coverage feature wired for minicov. Either add a wasm test target so they can be reached, or exclude them in .cargo/mutants.toml with the reason recorded. An undocumented exclusion is the wrong answer; a documented one is defensible until a wasm suite exists.

Whichever is chosen, the exclusion or the extra pass must be stated in the config rather than left for each reader to rediscover.

Acceptance criteria

• The nightly mutation job reports no mutant that its own build excludes.
• The 71 not(ssr) mutants are either mutated under a hydrate-configured pass or excluded with a stated reason.
• The wasm32 group has a decided disposition recorded in .cargo/mutants.toml or a wasm target.
• A reader can tell from the config which mutants are skipped and why.

Boundary

Job configuration and .cargo/mutants.toml only. Writing tests for the mutants this unblocks is #1893, not this issue. Do not change any cfg gate to make a mutant buildable — the gates are correct.

[gaborbernat]

Re-measured against nightly run 34340178817 (main @ 10:26Z 2026-09-09, which already contains #2210), working from 07dd9e8b7. Nothing has touched crates/peryx-web since that nightly's base, so the two lists describe the same source.

cargo mutants --list -p peryx-web generates 530 mutants. Evaluating every #[cfg(...)] in the crate at block level against the job's own configuration (--all-features, non-wasm32 host) puts 155 of them inside code the build strips.

One build checked both directions. I injected #[cfg(<that gate>)] compile_error!("...") beside all 191 non-cfg(test) gates in the crate and ran cargo check -p peryx-web --all-features --lib:

• 152 gates classified stripped: 0 fired.
• 39 gates classified compiled: 37 fired. The two silent ones are #[cfg(any(feature = "ssr", not(feature = "hydrate")))] blocks sitting inside #[cfg(all(target_arch = "wasm32", ...))] functions, so the outer gate strips them too.
• No other errors in the build.

Matching that against the nightly's 137 peryx-web survivors file by file, the stripped count meets or exceeds the survivor count in every file but one:

file	generated	stripped	nightly survivors
data/stats.rs	45	43	38
pages/analytics.rs	21	17	17
pages/trash.rs	20	16	13
pages/policy_decisions.rs	20	16	13
data/placement.rs	14	12	10
data/browse.rs	11	7	7
url.rs	29	7	7
data/operations.rs	10	9	6
data/topology.rs	6	5	5
pages/mod.rs	46	5	4
lib.rs	5	4	4
pages/stats.rs	16	2	2
pages/topology.rs	11	2	2
data/search.rs	4	3	2
data/status.rs	7	3	2
pages/placement.rs	5	2	2
pages/browse.rs	3	2	2
ssr/topology.rs	9	0	1

So 136 of the 137 are unkillable by construction, and one sits in compiled code. A local cargo mutants -p peryx-web --all-features run reproduced the mechanism: pages/topology.rs:47:5 and 313:5 came back MISSED, and both sit behind #[cfg(all(not(feature = "ssr"), feature = "hydrate"))]. They are the two the nightly reports for that file.

Two corrections to the original triage, both of which make the second decision easier.

The split is no longer 71 not(ssr) against 57 wasm32. Counting mutants rather than gate sites, an arch-free gate strips 95, and 60 more also carry target_arch = "wasm32". The arch-free group is the larger half, so the hydrate pass proposed above recovers most of the noise.

Five predicates account for every stripped mutant: all(not(feature = "ssr"), feature = "hydrate") (94 mutants), all(target_arch = "wasm32", not(feature = "ssr"), feature = "hydrate") (56), all(target_arch = "wasm32", feature = "wasm-coverage") (3), all(not(feature = "ssr"), feature = "hydrate", target_arch = "wasm32") (1), and not(feature = "ssr") (1). --all-features falsifies each one on its own, or the host architecture does.

#1893 closes the one real survivor, ssr/topology.rs:32:40. Writing tests cannot close anything else in peryx-web, so its shards stay red until this issue lands.