t27o: rust_convert.t27 function test coverage 9 % -> 100 % (32 of 360 functions named by a test) #10825

Goal

Every function of specs/tools/t27o/rust_convert.t27 is named by a direct test (t27c coverage), each test with real assertions and both sides of the boundary it checks. Option A of #10522 ("coverage to 100 %", owner 2026-10-18 / 2026-10-19). rust_std.t27 (#10553, #10764) and ledger / golden / install / service / zig_convert are already at 100 %.

Why this matters

t27c coverage on master (2026-10-19): rust_convert.t27 has 360 functions, 32 named by a test (9 %). Most are reached only through convert / body / oracle, so a regression in a helper (tok_end, skip_ws, a refusal kind) shows up, if at all, as a changed output text far from its cause. Three of tonight's defects lived in such helpers (#10534 integer !, #10544 rescans, the super:: hole in #10648).

Deliverable

Direct tests in rust_convert.t27, in batches by area (lexing, the name table, types and classes, expressions, statements, items, the oracle, the report), each batch its own commit: inputs at the edges (empty text, end of buffer, a token at the last byte), and for each predicate a true and a false case. A function that cannot be tested directly (it only writes into the state) gets its observable effect asserted instead.

Done when

t27c coverage specs/tools/t27o/rust_convert.t27 reports every function tested, or the PR lists each untested one with the reason; t27b test passes; t27c test-report 0 vacuous; no output of tri t27o changes (tests only).

Boundary

• May touch: specs/tools/t27o/rust_convert.t27 (tests only), gen/rust/tools/t27o/rust_convert.rs (regenerated; tests are not lowered, so it should not change), its seal, and the seals of specs that use it (zig_convert, spice_convert) if their closure hash moves.

Links

#10522, #10553, #10764.

User Scenarios

• Given the rust_convert.t27 spec with 360 functions and only 32 covered by direct tests, when a developer runs t27c coverage specs/tools/t27o/rust_convert.t27, then the report shows every function named by at least one test with real assertions on both sides of its boundary.
• Given a helper function such as tok_end or skip_ws that is only reached indirectly through convert or oracle, when a regression is introduced in that helper, then a direct test for that helper fails immediately rather than surfacing only as a changed output text far from the cause.
• Given the test batches for lexing, the name table, types and classes, expressions, statements, items, the oracle, and the report, when each batch is committed separately, then t27b test passes after every batch and t27c test-report shows zero vacuous tests.

Requirements

• FR-001: Every function in specs/tools/t27o/rust_convert.t27 MUST be named by at least one direct test invoked via t27c coverage.
• FR-002: Each direct test MUST contain real assertions that exercise both the true and false branch of every predicate in the function under test.
• FR-003: Tests MUST include inputs at edge boundaries: empty text, end of buffer, and a token at the last byte.
• FR-004: Functions that cannot be tested directly because they only write into state MUST have their observable effect asserted instead.
• FR-005: Tests MUST be added in batches by area (lexing, name table, types and classes, expressions, statements, items, oracle, report) with each batch in its own commit.
• FR-006: After all batches, t27b test MUST pass and t27c test-report MUST report zero vacuous tests.
• FR-007: The generated file gen/rust/tools/t27o/rust_convert.rs and its seal MUST not change (tests are not lowered).
• FR-008: Seals of specs that use rust_convert (zig_convert, spice_convert) MUST be updated only if their closure hash moves.