Files
hsmc/hsmc/tests/det_timers_parent.rs
T
swaits e183cdd95e feat(verify): discharge Creusot VCs end-to-end
Make `just verify` actually invoke Why3 + alt-ergo + z3 against every
Pearlite VC, and fix the mutant + miri pipelines along the way.

Verification crate
  - Drop the const-generic CAP types for EventQueue / TimerTable.
    Mirror with std::vec::Vec, whose creusot-std specs carry the
    proof burden. Capacity behavior is exercised by the runtime's
    own unit tests + correspondence tests.
  - View impls are #[logic(open)] over a pub field so contracts on
    push/pop/etc. can see the link to the inner Vec's @ view.
  - 14/14 VCs discharge: EventQueue {new, push, pop, is_empty, len,
    clear, Default}; TimerTable {new, len, is_empty, Default};
    Entry derives.
  - `cargo creusot prove --no-cache` always runs the SMT solvers;
    `time` shows ~7s CPU on ~1.2s wall-clock = real parallel work.

Tooling
  - verification/mise.toml pins nightly-2025-11-13 + rust-src,
    rustc-dev, llvm-tools-preview, rustfmt; declares opam, python,
    uv, and the project-local .venv. Inherits root mise.toml's just
    + cargo-* tools.
  - just verify clones creusot v0.9.0 to ~/.local/share/hsmc-verify/
    and runs the canonical ./INSTALL — that's the only way the
    bundled prelude-generator + creusot-rustc actually build.
  - just verify --no-cache forces SMT re-runs every time.
  - Drop bespoke pin/install of cargo-creusot from mise.toml; the
    cargo backend goes through cargo-binstall which can't pin a
    multi-bin git workspace at a tag.

Mutants — was missing every JournalSink mutant
  - Recipe runs with --features tokio,journal so journal_* and det_*
    tests (gated on both) actually execute.
  - Add clear_journal_empties_the_journal test in journal_smoke.rs
    to kill the JournalSink::clear with-() mutant.
  - Remove dead JournalSink::len + is_empty (called nowhere; only
    existed as mutation-bait).
  Result: 0 missed, 42 caught, 211 unviable (proc-macro emitted
  code that mutants can't standalone-compile).

Miri — was hitting the trybuild glob isolation issue
  - --exclude hsmc-macros (trybuild ui test isn't UB-relevant)
  - --exclude hsmc-verification (different pinned toolchain)
  - 66 tests pass under Miri, 0 UB.

Gitignore
  - /verif/, /why3find.json, /.why3find/, **/.venv/ — all
    regenerated by `just verify`. Repo stays clean of per-machine
    prover timings + venv artifacts.

Misc
  - Fix root-state targetability: `on(Trig) => <ChartName>;` resolves
    to root id 0 in both ir.rs::resolve_transitions and
    validate.rs's separate name_map.
  - `set shell` and `set script-interpreter` route every justfile
    recipe through `mise exec`, so all subshells see the right
    Rust + opam + cargo-* tools regardless of how `just` was
    invoked. No shebangs anywhere.
2026-04-27 21:22:44 -06:00

136 lines
3.9 KiB
Rust

#![allow(dead_code)]
//! Deterministic-flow tests for parent-vs-child timer interaction.
//!
//! Spec: "Descending into a child state is not an exit — the parent's
//! timers keep running."
#![cfg(all(feature = "tokio", feature = "journal"))]
#![allow(unexpected_cfgs)]
use core::time::Duration;
use hsmc::{statechart, TraceEvent};
#[derive(Default)]
pub struct Ctx;
#[derive(Debug, Clone)]
pub enum Ev {
Halt,
}
// Parent has a 100ms timer. Default-descend into ChildA. ChildA has no timer.
statechart! {
Pt {
context: Ctx;
events: Ev;
default(Parent);
terminate(Halt);
state Parent {
entry: p_in;
exit: p_out;
default(ChildA);
on(after Duration::from_millis(100)) => Done;
state ChildA {
entry: ca_in;
exit: ca_out;
}
}
state Done {
entry: d_in;
}
}
}
impl PtActions for PtActionContext<'_> {
async fn p_in(&mut self) {}
async fn p_out(&mut self) {}
async fn ca_in(&mut self) {}
async fn ca_out(&mut self) {}
async fn d_in(&mut self) {}
}
const SP: u16 = 1;
const T_PARENT: u16 = 0;
#[tokio::test(flavor = "current_thread")]
async fn det_parent_timer_armed_before_child_entered() {
// Parent's timer arms during Parent's entry; THEN default-descends into ChildA.
// So the order is: TimerArmed(Parent) before Entered(ChildA).
tokio::task::LocalSet::new()
.run_until(async {
let mut m = Pt::new(Ctx);
let _ = m.dispatch(Ev::Halt).await;
let j = m.take_journal();
let armed_idx = j
.iter()
.position(|e| matches!(e, TraceEvent::TimerArmed { state: SP, .. }))
.unwrap();
let child_entered_idx = j
.iter()
.position(|e| {
matches!(
e,
TraceEvent::Entered { state: 2 } // ChildA = id 2
)
})
.unwrap();
assert!(
armed_idx < child_entered_idx,
"TimerArmed (Parent) at {} must precede Entered (ChildA) at {}",
armed_idx,
child_entered_idx
);
})
.await;
}
#[tokio::test(flavor = "current_thread")]
async fn det_parent_timer_only_one_arm_in_initial_descent() {
// Only Parent has a timer. ChildA has none.
tokio::task::LocalSet::new()
.run_until(async {
let mut m = Pt::new(Ctx);
let _ = m.dispatch(Ev::Halt).await;
let armed: Vec<u16> = m
.journal()
.iter()
.filter_map(|e| match e {
TraceEvent::TimerArmed { state, .. } => Some(*state),
_ => None,
})
.collect();
assert_eq!(armed, vec![SP]);
})
.await;
}
#[tokio::test(flavor = "current_thread")]
async fn det_parent_timer_cancelled_on_termination() {
tokio::task::LocalSet::new()
.run_until(async {
let mut m = Pt::new(Ctx);
let _ = m.dispatch(Ev::Halt).await;
let cancels: Vec<&TraceEvent> = m
.journal()
.iter()
.filter(|e| matches!(e, TraceEvent::TimerCancelled { .. }))
.collect();
// Termination unwinds all states. Parent's timer is cancelled when Parent exits.
assert_eq!(
cancels.len(),
1,
"expected exactly 1 TimerCancelled (Parent's), got {:?}",
cancels
);
assert!(matches!(
cancels[0],
TraceEvent::TimerCancelled {
state: SP,
timer: T_PARENT
}
));
})
.await;
}