fix: the promises the sealed core was not keeping - #65
Merged
Merged
Conversation
Seven lenses went over the sealed core. Three of them arrived at the same place on their own: the read deadline was decorative. `reading::within` received bytes that had *already* been read, so the 30 s hang happened before the clock existed. `OpenClipboard` is thread-affine, so the fix is not in that function: the whole capture now runs in a sacrificial thread under `capture_within`, and what does not come back in time is `TooSlow`. Asking for a size called `GetClipboardData`, which is precisely what triggers the deferred render it was meant to avoid. Only the costlier twin announces its size now, and that one is a format the source already hands over. macOS reported a paste it never made. `CGEventPost` drops the event silently without the accessibility permission and returns success, so the panel closed and nothing happened. `can_post_events` existed and was tested; production never asked. `EmptyClipboard` ran before knowing the write could succeed, which is the 2.x failure that left the user with neither what they had nor what they asked for. Every block is reserved first now. The 2.x needed a dozen tries to bring Office and Electron forward; this had three. `VerifyKeyboardFocus` was in the phase order and verified nothing: `SetFocus` returns the window that *had* focus. `GetFocus` on the attached queue is what answers. Pasting from history captured what it pasted: `Watcher::wrote` existed, but the watcher was sealed inside the polling thread's closure. And dropping the watcher waited for the whole period, so closing the application waited for the next poll. `secure_delete` does not reach the WAL: a deleted password stayed readable in `history.db-wal` until a checkpoint nobody forced. The test looks for the secret in the bytes of both files. The probe could disable itself. Skipped cases never touched the exit code, and the coverage gate leans on it. Three ids may be skipped, by name; the count of cases that must run is declared. 411 tests, 38 system cases, 95.38% lines with the harness.
One broken test explained three red jobs. The watcher test reached for the clipboard, which is a single global resource, so it belongs in the probe and not in `cargo test` — this project's own rule, which it broke. Coverage and mutants went down with it: neither ever got past the baseline. The Windows probe carried `#![cfg(target_os = "windows")]` at crate level, so on macOS the example compiled to an empty crate with no `main`. `cp-mac` already had the answer — body under `include!`, empty `main` for the other platform — and `cp-win` never got it. This one predates the change; it was already red on main. Three comments went out. The rule is SAFETY or nothing, and what they said is in the tests that cover it. Then the ones worth keeping. Two rules could not fail: they grep across `crates docs README.md`, and `docs` does not exist, so grep exits 2 with its findings on stdout and `if grep` reads that as nothing found. The peninsular check had been passing over a real hit for as long as it has existed. Piping through `grep -q .` makes the exit code mean what the rule meant, and the hit it was hiding is fixed. The mutants rule had never once run on Windows — it died in the baseline every time, so the zero it reported was a job that stopped before counting. Measured now: 462 mutants, 412 caught, 50 unviable, and the 37 that survived before were all in the four cp-win modules that talk to the clipboard. Those are declared in .cargo/mutants.toml with what to do instead of widening the list. 410 tests, 39 system cases, 96.56% lines with the harness.
Every comment is gone from the crates, the workflows and the toml files — SAFETY notes included. Keeping them meant keeping the lint that demanded them, so `undocumented_unsafe_blocks` goes too; `unsafe_code = "forbid"` workspace wide and `multiple_unsafe_ops_per_block` in the -sys crates still stand, and they constrain the code rather than describe it. The rule that guarded this could not do its job twice over. It exempted SAFETY, which no longer exists, and it only looked at lines starting with `//`, so a trailing comment or a block one walked straight past it. It is one rule now, it covers both forms, and it was verified to fail on a planted comment before being trusted. A test took the Windows pipeline down and it was not the one fixed earlier today. `permissions::this_process_is_ready_to_watch` calls `Readiness::probe`, which asks for the clipboard sequence number; a CI runner has no interactive window station, so it comes back zero and the assertion blows. It passes on a desktop and fails on the runner, which is why it shipped. The pure half of that logic is asserted directly now, and the probe already covers the real question in K1. 410 tests, 39 system cases, 96.57% lines with the harness.
A2, B1, B2 and B3 failed on the Windows runner because its clipboard is empty: nothing has ever been copied in that session, so the sequence number reads zero and there is nothing to enumerate. The probe is not wrong to fail there — it exists to ask the real system, and an empty clipboard is a real answer. Leaving one string on it before the run is what the question needs, in both the CI job and the coverage one. The formatting check only ever looked at the macOS probe body. `cp-win` moved to the same `include!` layout an hour ago, which took its body out of `cargo fmt --all` without putting it anywhere else, and it had drifted already. Both bodies are checked now, and the Windows one is formatted.
Every pull request ran all 462 mutants and took around 35 minutes to say what it already knew: this branch touches five of them, and the other 457 were already proven when their code entered main. The shape Tisty arrived at fits here too. A pull request now mutates only the lines it changed, off the merge-base with its own target, and skips the toolchain entirely when it touches no crate. The whole set moves to a sweep that runs on Sundays and on demand, split into four shards, and a final job turns them into the badge the README now carries. The score is computed in Python rather than jq. Not a preference: jq is absent from this machine, so that script could not be run before being trusted, and when jq is missing it does not stop — it carries on and writes a badge out of nothing. The Python one refuses a sweep that is missing a shard, a report that does not parse, and a run where no mutant was tested at all. All four paths were exercised before this was committed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Seven lenses went over the sealed core. Three of them arrived at the same place on their own: the read deadline was decorative.
reading::withinreceived bytes that had already been read, so the 30 s hang happened before the clock existed.OpenClipboardis thread-affine, so the fix is not in that function: the whole capture now runs in a sacrificial thread undercapture_within, and what does not come back in time isTooSlow.Asking for a size called
GetClipboardData, which is precisely what triggers the deferred render it was meant to avoid. Only the costlier twin announces its size now, and that one is a format the source already hands over.macOS reported a paste it never made.
CGEventPostdrops the event silently without the accessibility permission and returns success, so the panel closed and nothing happened.can_post_eventsexisted and was tested; production never asked.EmptyClipboardran before knowing the write could succeed, which is the 2.x failure that left the user with neither what they had nor what they asked for. Every block is reserved first now.The 2.x needed a dozen tries to bring Office and Electron forward; this had three.
VerifyKeyboardFocuswas in the phase order and verified nothing:SetFocusreturns the window that had focus.GetFocuson the attached queue is what answers.Pasting from history captured what it pasted:
Watcher::wroteexisted, but the watcher was sealed inside the polling thread's closure. And dropping the watcher waited for the whole period, so closing the application waited for the next poll.secure_deletedoes not reach the WAL: a deleted password stayed readable inhistory.db-waluntil a checkpoint nobody forced. The test looks for the secret in the bytes of both files.The probe could disable itself. Skipped cases never touched the exit code, and the coverage gate leans on it. Three ids may be skipped, by name; the count of cases that must run is declared.
411 tests, 38 system cases, 95.38% lines with the harness.