---
name: cfg-gated-code-is-invisible-to-the-other-platform-gate
description: "A #[cfg(unix)] arm or test is not compiled, linted, or run by any Windows gate — green Windows gates are silence about it, never evidence."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: e85925aa-e501-498f-855b-550e75112265
  modified: 2026-08-25T00:59:04.362Z
---

Code and tests behind `#[cfg(unix)]` are **not compiled** on Windows, so `cargo clippy
--all-targets`, the full lib suite, and a mutation battery on HFENDULEAM all return green
while saying **nothing at all** about that arm. A `cfg(unix)` test with a compile error or a
dead assertion passes every Windows gate by not existing. The reverse holds for
`#[cfg(windows)]` on Linux.

**Why:** IR-16 (2026-08-03) fixed `DetachedChild::kill_tree` on BOTH arms. Windows gave
clippy 0, 821/821, battery 4/4 — and had zero exposure to the unix ESRCH whitelist. Proving
it needed kitsubito: clippy 0, 815/815, and its own 2-row battery. Same class as
[[opt-in-ci-legs-skip-silently]] — a leg that did not run is silence, not a pass — but worse,
because here the *local* gate looks complete.

**RULING-SIDE FACE (2026-08-23, #212 r2/r3):** the class bites RULINGS, not only gates. My
gate's clippy 0 on Windows was structurally silent about a `#[cfg(not(windows))] { return; }`
tail that Linux clippy -D denies as unreachable (found only when the golden's Linux leg first
REACHED its clippy step). Then my ruled fix shape — a runtime `cfg!` skip — exposed a SECOND
boundary: the tail calls a symbol that is `#[cfg(windows)]`-only upstream, E0425 on Linux.
**A ruled fix shape that names exact code is a claim compiled on zero platforms** — either
compile the shape on the target platform before ruling it, or rule the PROPERTY and let the
builder (who will compile it) pick the spelling. The builder's stop-and-refer on the
unauthorized-but-necessary helper was the protocol working.

**THIRD FACE — THE INVERSE DIRECTION (2026-08-24, SIGNET #218 golden `5a9f9bdc`): the danger is
not only gated code the other gate cannot see; it is UNGATED code the other gate CAN see, where
being unused is itself the red.** `authseam.rs:45` declared `pub(crate) const
BACKEND_KIND_HELLO_RS256` with **no cfg**, while its sibling `KEY_NAME` at `:56` carried
`#[cfg(windows)]`. Every use sat inside `#[cfg(windows)] mod hello` (`:81`/`:83`/`:189`/`:290`) and
a windows-gated test (`:481`–`:485`). On Windows the const is live and clippy is silent; on Linux it
is **dead by construction** and `-D warnings` denies `dead-code`, failing `bin "spt"` AND
`bin "spt" test`. Both clippy arms ran at one sha and split — **Linux failure, Windows success** — so
the platform split was measured, not inferred.

The gate that passed it was not wrong, it was **narrow**: a cold `clippy -D warnings` on Windows
only, where `mod hello` compiles. **A one-OS clippy leg is blind to the cfg-asymmetry dead-code class
by construction** — the item exists on both platforms, so no "this wasn't compiled" reasoning fires;
it is compiled on both, and *unused* on exactly one. The tell in review is a **cfg attribute on one
declaration and not on its immediate neighbour** — reach for the sibling's form (`#[cfg(windows)]`),
never `allow(dead_code)`, which keeps dead code alive and lingers past the day the other backend
lands. The cross-OS clippy arm joined the gate battery as a result.

Rider on the doc-links half, and it is a lesson about stopping too early: gating the const raised a
plausible `broken_intra_doc_links` worry, because module docs at `:14`/`:26` link to it. I confirmed
the links exist and inherited the conclusion. **Presence of a link is not exposure to a lint** — the
deciding question is *which gate evaluates rustdoc*, and at that sha **none does** (docs drift =
`xtask check`, rustdoc `///` explicitly unscanned; docs bundle = mdbook over `docs-site`; every xtask
cargo call is `build`, never `doc`; clippy does not evaluate rustdoc lints). Verifying the stated
property while never checking the arm that decides is the same miss as
[[dont-take-a-diagnosis-as-measured]], one level shallower than it needed to be.

**How to apply:** when a change touches a cfg-gated arm, name the platform each piece of
evidence covers and get the other platform before claiming the change is proven. `ssh
reavus@kitsubito` is authorized; ship the tree with `tar | ssh` into a scratch dir (~21MB
excluding `.git`/`target`) rather than touching their checkout, use a separate
`CARGO_TARGET_DIR`, and reap the scratch after. ⭐⭐ The mutation that matters on the second
platform is the one proving the row **reaches** the gated branch — re-key the condition
(ESRCH→EPERM) and confirm the row dies; a row that never enters the arm survives that and
looks identical to a passing one. See [[make-a-new-rig-red-on-purpose]] and
[[verdict-from-probe-competence]].