Two more census heuristics, both verified by bisecting the candidate count so a "fix" that widened the queue could not slip through:
- any `assert*!` macro counts as verification, not just the three built-ins — `assert_fields_bound!` in `protos` was being missed. The pattern deliberately stays a substring match: an earlier attempt anchored it with `\b`, which silently stopped matching prefixed macros like `const_assert!` and pushed the queue from 32 to 55 before the count caught it.
- `let _ = Type::<T>::method;` is a signature guard, the same as the already-recognised nested-fn form. That is `iam`'s deprecated-API test.
Tree-wide candidates go 32 to 30 from the script alone, then to 26 with the four tests below.
`detect_storage_media`'s two tests only checked that the call did not panic, over a `match` whose arms were all empty. What the machine reports depends on the machine, but two rules do not: an override wins over probing, including when probing is disabled, and disabled probing reports `Unknown` rather than guessing. A third test keeps the platform call and asserts it returns a known variant *and* the same one twice — a probe that flapped would make the scheduler's profile depend on when it asked.
`runtime_facade_stops_empty_replay_workers` called the stop path and asserted nothing. It now checks the worker list is empty afterwards and that a second call stays harmless, which is what shutdown paths actually do.
`test_mask_never_recurses_for_any_variant` discarded every mask. Termination is still the property under test — a regression overflows the stack rather than failing an assertion — but the masks are now collected and checked, so the loop cannot fold away and a variant that starts returning an empty mask is caught too.
Two known false positives are left in the queue rather than chased: `utils/src/string.rs:942` does assert, but its input string `"{1...2}}"` unbalances the scanner's brace counter and truncates the body before the assertion. Making the counter literal-aware needs a lexer that understands raw strings — a first attempt desynchronised on `r#"{"invalid": json}"#` and pushed the queue to 120, so it was backed out. `s3select-api:379` declares a nested exhaustive-match fn and never calls it; recognising that shape without hiding genuinely empty bodies needs more care than it is worth today.
Refs backlog#1836
The census listed 17 candidates in ecstore. Sixteen were false positives of three shapes, and reading them showed the heuristics rather than the tests were wrong:
- `#[should_panic(expected = "...")]` (5). `should_panic` was already in the verification signals, but the check only ever ran against the function body — the attribute block was collected and then ignored, so the expected panic message, which *is* the assertion, was invisible.
- Bodies that are a single call into a shared harness (9), like `run(DurabilityMode::Strict).await` and `aborting_encode_drops_blocked_producer(EncodePipeline::Vec).await`. The delegation rule keyed off callee names (`assert_`/`verify_`/`run_`/`_harness`), which these do not match, though a body that is nothing but one call delegates by construction whatever the callee is called.
- Compile-time contracts (2): a turbofish between the callee and its parens (`assert_replication_config_ext::<T>()`) broke the delegation regex, and a nested `fn` that is only bound and discarded is the same signature guard as the already-recognised `fn _name()` form.
The script now folds the attribute block into the verification text, allows a turbofish in the delegation patterns, and recognises both a single-call body and a discarded nested-fn binding. Tree-wide candidates drop from 53 to 33, ecstore from 17 to 1.
The one that survives was real: `test_error_conversions` performed two conversions and discarded both results. It now pins what each conversion must produce — a plain `io::Error` stays `DiskError::Io` rather than being guessed at from its `NotFound` kind, a typed error boxed through `io::Error` round-trips back to itself instead of degrading to `Io`, and a serde_json error folds into `other` with its message intact.
Refs backlog#1836
* test(io-metrics): assert lib.rs record helper emissions
The 29 assertion-less record_* smoke tests in io-metrics/src/lib.rs called
their helpers and checked nothing; because METRICS_ENABLED defaults to
false they did not even reach the emission bodies. Replace them with six
DebuggingRecorder tests that enable the gate, pin every metric name the
helpers own, and pin the derived values, branch selection and label
mapping (rustfs/backlog#1836).
* test(tooling): anchor assertless-census delegation tokens to name segments
overtrue