addr_class_inventory does not scan crates/perry-ext-* — 18 sites unaudited, including 11 that moved out of perry-stdlib #7272

scripts/addr_class_inventory.py scans only two roots:

SCAN_ROOTS = (
    "crates/perry-runtime/src",
    "crates/perry-stdlib/src",
)

crates/perry-ext-* is not covered. Its sibling gate gc_store_site_inventory.py does cover them — iter_scan_roots() globs crates/perry-ext-*/src explicitly — so the two audits disagree about what counts as first-party runtime code.

How it surfaced

While clearing #7259 the ratchet baseline reported a stale entry:

handle-floor | crates/perry-stdlib/src/http.rs: baseline says 11, found 0 — lower it to 0

crates/perry-stdlib/src/http.rs no longer exists: #6826 (refactor(http): merge server implementation into HTTP extension) moved it into crates/perry-ext-http/. The 11 sites were not fixed — they moved out of the gate's field of view. They are still there:

crates/perry-ext-http/src/agent.rs:355:    } else if upper == 0 && bits >= 0x10000 {
crates/perry-ext-http/src/agent.rs:370:    } else if upper == 0 && bits >= 0x10000 {
crates/perry-ext-http/src/agent.rs:1079:   } else if upper == 0 && bits >= 0x10000 {
crates/perry-ext-http/src/lib.rs:507:      } else if upper == 0 && bits >= 0x10000 {
crates/perry-ext-http/src/lib.rs:912:      } else if upper == 0 && bits >= 0x10000 {

This is the "the gate runs but its subject never did" failure mode from CLAUDE.md: the audit is green on those files because it never reads them.

Scope

Running the existing rules over crates/perry-ext-*/src (113 files) finds:

handle-floor is ratcheted, so those 10 can be recorded as known debt in one baseline regeneration. band-literal is not ratcheted — it is governed by the line-substring allowlist, so all 8 would hard-fail until each is individually audited and either rewritten through addr_class or given a justified allowlist entry.

That per-site audit is why this was not folded into #7259: mislabelling one is worse than leaving it uncovered, and #7259's job was to get lint green without weakening either gate.

Suggested fix

1. Audit the 8 band-literal sites in crates/perry-ext-* individually (rewrite through value::addr_class, or allowlist with a real justification).
2. Add crates/perry-ext-*/src to SCAN_ROOTS — ideally via the same glob shape gc_store_site_inventory.py already uses, so a NEW perry-ext- crate is covered automatically rather than needing a script edit.
3. Regenerate the ratchet baseline to record the 10 handle-floor sites.
4. Drop the now-dead handle-floor | crates/perry-stdlib/src/http.rs | 11 line (already removed in lint: addr_class_inventory fails on main — 2 real ratchet regressions plus a stale allowlist substring #7259's regeneration).

Related

• lint: addr_class_inventory fails on main — 2 real ratchet regressions plus a stale allowlist substring #7259 — the addr-class gate fixes that exposed this
• refactor(http): merge server implementation into HTTP extension #6826 — the refactor that moved the code out of scanned territory
• node:zlib: stream objects missing .on/.pipe/.write (Transform interface) + brotli fns + Z_* constants (43 radar runtime-fails) #1843, Handle-id collision: a fetch Request whose id matches a live node:http IncomingMessage gets .headers/.method/etc. routed to the IncomingMessage dispatcher #4004, fix(runtime): honor JSON reviver prototype lookups #4665, fix(runtime): for-of/spread over a Headers handle no longer segfaults #4800, fix(runtime): guard native-module deref against the small-handle band (Linux SIGSEGV in zlib streams) #6271 — the Linux-only handle-deref crash class these rules exist to prevent