Publish feature-gated Rust crate with package-level MI_PPROF-off and DHAT proof

[zackees]

Problem

Published mimalloc-pprof 0.9.4 cannot compile sampled pprof out. Its package metadata has no features and packaged build.rs unconditionally defines MI_PPROF=1; default-features = false therefore does not produce MI_PPROF=OFF.

Issue #239 and PR #240 implement selection in the repository, but reld needs a published immutable version proven from the registry download. The current v0.9.4 tag was created after registry publication and points at later DHAT-containing source, so it cannot prove the old archive contents.

Required release

Publish 0.9.5 after #240 is merged and reconciled with current main.

• Keep pprof default for compatibility.
• Make default-features = false compile with MI_PPROF=0.
• Retain internal exact DHAT Rust/C APIs from feat: add exact DHAT-compatible heap profiling via memory-events callbacks #238/feat: add exact DHAT heap profiling #241/fix: harden DHAT lifecycle accounting #242 in both configurations.
• Preserve sampled-profiler no-op stubs when compiled out.
• Do not add a second allocator or restore external Rust dhat.

This is package/release correctness and makes no performance claim.

RED -> GREEN acceptance

RED, using the actual registry archive for exactly 0.9.4 in a clean environment:

1. Record checksum and extracted feature table.
2. Prove the feature table is empty.
3. Prove packaged build.rs defines MI_PPROF=1 despite disabling defaults.

Do not substitute a tag or checkout.

GREEN, after publishing exactly 0.9.5, download afresh through the registry and inspect/build that download, not a path or git dependency:

1. Prove metadata has default = ["pprof"] and pprof = [].
2. A clean consumer pinned to =0.9.5 with defaults disabled compiles native code with MI_PPROF=0.
3. There, prof::start(...) returns false and its public API links.
4. Default features compile with MI_PPROF=1 and sampled profiling starts in a smoke process.
5. Both builds retain internal DHAT: Rust API links, dhat::start() succeeds in isolation, exact stats observe a known allocation, and DHAT v2 JSON is emitted.
6. Package contents include DHAT implementation/bindings and feature-aware build script, reading nothing from the maintainer checkout.
7. Record exact version, checksum, release/tag commit, commands, and output in a closing comment.

Use fresh target/package caches or otherwise prove native configurations did not reuse stale cc artifacts.

Downstream gate

reld must not externalize to 0.9.4 while claiming pprof is compiled out. Wait for and pin exactly:

mimalloc-pprof = { version = "=0.9.5", default-features = false }

Retain the verified registry checksum in its lockfile.

Related: zackees/reld#92, zackees/reld#93, zackees/reld#94, #239, #240.

[zackees]

Published verification

Released mimalloc-pprof 0.9.5 from implementation merge cfc6a3940c96f23c925238b4ee3f7934e1939f86.

• crates.io: https://crates.io/crates/mimalloc-pprof/0.9.5
• GitHub release/tag: https://github.com/zackees/mimalloc-pprof/releases/tag/manual-cfc6a394
• implementation PR: feat(rust): make pprof hooks feature-selectable #240
• publication-record PR: docs: record mimalloc-pprof 0.9.5 publication #244
• crates.io checksum: 9143eb24178e618a9671d22074e2e64badd61454a1ae5c042325daf8238f5407
• registry metadata: non-yanked; default = ["pprof"]; pprof = []

RED evidence for 0.9.4 was recorded when this issue was opened: its published feature map is empty and packaged build.rs always defines MI_PPROF=1.

GREEN evidence used the downloaded crates.io 0.9.5 archive, not a checkout:

• downloaded archive SHA-256 exactly matched the registry checksum;
• ci/check_crate_package.py verified the published manifest, feature-aware build.rs, Rust DHAT bindings, and native DHAT implementation;
• fresh default-feature consumer compiled the registry crate in its own target directory, started sampled pprof, observed exact DHAT allocation stats, and wrote valid DHAT v2 JSON;
• fresh default-features = false consumer compiled the registry crate in a separate target directory, proved prof::start returns false and the stubs link, observed exact DHAT allocation stats, and wrote DHAT v2 JSON;
• each clean consumer downloaded mimalloc-pprof v0.9.5 from crates.io and compiled its native code independently.

Pre-publication gates:

• focused feature contract: default and no-default modes green;
• allocator crate suite: both modes green;
• clippy: both modes green;
• complete Rust workspace suite green;
• native Windows concurrency regression passed 10 consecutive runs;
• vendored amalgamation drift check green;
• publish dry-run and generated archive verification green;
• delegated pre-push review clean after fixes.

No performance claim is made by this release.