Crate choir_guards 

Source-scanning tripwires over the whole workspace (D77).

Two invariants here hold by the absence of something — an edge in the dependency graph, a type named in the wrong crate — and an absence is what no ordinary test can assert. Both are checked by reading other crates as text: quarantine for D40, invariant_3 for the canonical-serialization rule.

Why they live in a crate of their own. A test’s inputs decide two things in gate: whether the touched lane selects it, and whether a cached green verdict is still valid. Both are computed from the crate the test lives in — its own files, plus the dependency closure cargo reports. A scanner’s inputs are neither. quarantine sat in choir-view and read choir-node, which choir-view does not depend on and must not; so editing choir-node neither selected the test nor invalidated its verdict, and a green could stand over a tree that broke it. Moving the scanners to the crate they scan is not open either: choir-hash is depended on by everything, so widening its inputs to the whole of crates/ would invalidate every verdict in the workspace on every edit.

This crate is the shape that works, and D77 is its row. It is a leaf — nothing depends on it, and it depends on nothing — so the gate-inputs file beside its manifest can name the whole of crates/ and the cost lands on this crate alone. That file is one line and cannot rot, because the scanners read the same directory it names.

The helpers below are shared by both suites and public so that both can reach them. They are text predicates, not analysis: read the stated limits in each before trusting a green.

Examples

use choir_guards::{mentions, strip_comments};

// A type named only in a doc link is not a use of that type.
assert_eq!(strip_comments("/// see [`TreeEntry`]").trim(), "");
// Whole-word, so a longer name is not a hit.
assert!(mentions("let e: TreeEntry = x;", "TreeEntry"));
assert!(!mentions("struct TreeEntryId;", "TreeEntry"));

Functions

mentions

Whether text names ident as a whole word rather than as a substring, so Commit does not match CommitId.

strip_comments

Everything after // on a line, gone.