Every codegen-emitted statechart now contains a const block that
verifies the safety preconditions of every unsafe get_unchecked at
build time. Any future codegen change that produces an out-of-range
offset or a malformed (s, m, e) triple in __PATH_RANGE /
__TERMINATE_RANGE fails `cargo check` with a named diagnostic
instead of being deferred to runtime UB.
Checks performed (per chart):
- __PATH_RANGE[i] = (s, m, e) satisfies 0 <= s <= m <= e and
e <= __PATH_DATA.len()
- __TERMINATE_RANGE[i] = (s, e) satisfies 0 <= s <= e and
e <= __TERMINATE_DATA.len()
- Every state id stored in __PATH_DATA / __TERMINATE_DATA is
< N_STATES
- Every Some(t) in __DEFAULT_CHILD names a state id < N_STATES
The const block evaluates at type-check (cargo check), produces no
runtime code, and runs once per chart definition. Verified by
manually injecting a bad triple — rustc reports `E0080: evaluation
panicked: __PATH_RANGE: e past __PATH_DATA end`.
Combined with the runtime debug_assert! companions (this commit
chain) and miri (zero UB on 66 tests), the static and dynamic checks
together cover every safety predicate the unsafe blocks rely on.
swaits
98352b0e4d