test: pin what a mutation audit could break in silence on the default wire #101

Merged

yuris merged 2 commits from wire-pins into main

2026-08-21 18:46:26 +00:00

yuris commented

2026-08-21 18:42:43 +00:00

Owner

module	mutations	caught
`stdb/bsatn.lua`	30	29, plus one verified equivalent mutant
`stdb/protocol_v2.lua`	23	22

What was actually wrong

f32 tie rounding was unpinned. Replacing round_even with round-half-up, or with a plain floor, passed the entire suite. IEEE 754 rounds half to even, and above 2^24 floats step by 2, so an odd integer sits exactly halfway between two representable values: 16777217 must land on 16777216 and 16777219 on 16777220, both even mantissas. Vectors derived from the format, not read back out of the codec — which is also this test file's stated rule.

A test that could not tell two failures apart. Removing the FixedSize(0) guard does not make that frame decode. It makes floor(#data / 0) the row count, and the loop appends an empty slice until Lua runs out of table: 23 seconds, then an overflow error, which the bare assert_error accepted as a pass. On a device that is a hung frame, not a rejected message. The case now asserts the guard's own text.

The hex writer's leading-zero strip. Without it a value padded wider than its type is rejected instead of accepted. The readers never emit that form; a hand-written literal does.

Not a gap

v = floor(v) in Writer:u64 is an equivalent mutant: string.char truncates a non-integer identically on 5.1 and LuaJIT, verified over 22 value/method pairs with zero byte differences. It gets a comment saying what it is for — a 5.3+ host raises instead — rather than a test that cannot fail.

Verification

Every new assertion proven failable by the mutation it targets, then reverted green. 11 passed, 0 failed; stylua --check stdb dev/test stdb/spacetimedb.editor_script clean. No production behaviour changed: two test files plus one comment.

The schema walker got a mutation audit when it landed; the two modules that actually decode every byte of the default wire had not. Fifty-three single-line bugs, applied one at a time, suite run after each, tree restored and md5-verified between. | module | mutations | caught | |---|---|---| | `stdb/bsatn.lua` | 30 | 29, plus one verified equivalent mutant | | `stdb/protocol_v2.lua` | 23 | 22 | ## What was actually wrong **f32 tie rounding was unpinned.** Replacing `round_even` with round-half-up, or with a plain floor, passed the entire suite. IEEE 754 rounds half to even, and above 2^24 floats step by 2, so an odd integer sits exactly halfway between two representable values: 16777217 must land on 16777216 and 16777219 on 16777220, both even mantissas. Vectors derived from the format, not read back out of the codec — which is also this test file's stated rule. **A test that could not tell two failures apart.** Removing the `FixedSize(0)` guard does not make that frame decode. It makes `floor(#data / 0)` the row count, and the loop appends an empty slice until Lua runs out of table: 23 seconds, then an overflow error, which the bare `assert_error` accepted as a pass. On a device that is a hung frame, not a rejected message. The case now asserts the guard's own text. **The hex writer's leading-zero strip.** Without it a value padded wider than its type is rejected instead of accepted. The readers never emit that form; a hand-written literal does. ## Not a gap `v = floor(v)` in `Writer:u64` is an equivalent mutant: `string.char` truncates a non-integer identically on 5.1 and LuaJIT, verified over 22 value/method pairs with zero byte differences. It gets a comment saying what it is for — a 5.3+ host raises instead — rather than a test that cannot fail. ## Verification Every new assertion proven failable by the mutation it targets, then reverted green. `11 passed, 0 failed`; `stylua --check stdb dev/test stdb/spacetimedb.editor_script` clean. No production behaviour changed: two test files plus one comment.

yuris added 2 commits

2026-08-21 18:42:43 +00:00

test: assert WHY a FixedSize(0) frame is rejected, not just that it is a67ebaa964

Twenty-three single-line bugs applied to stdb/protocol_v2.lua: 22 caught. The
one that got through was not a missing test, it was a test that could not tell
two very different failures apart.

Removing the FixedSize(0) guard does not make that frame decode. It makes
`floor(#data / 0)` the row count, and the loop appends an empty slice until
Lua runs out of table - 23 seconds, then an overflow error, which the bare
assert_error accepted as a pass. On a device that is a hung frame, not a
rejected message. The case now asserts the guard's own text, so the clean
rejection and the memory-exhausting one stop reading alike.

Also: with this and the BSATN pins, the default wire's two byte-layer modules
are audited the way the schema walker was - bsatn 29/30 with one verified
equivalent mutant, protocol_v2 22/23.

test: pin the three BSATN rules a mutation audit could break in silence

ci / ci (pull_request) Successful in 19s

Details

conformance / conformance (v1) (pull_request) Successful in 2m34s

Details

conformance / conformance (v2) (pull_request) Successful in 2m31s

Details

22b6579654

Thirty single-line bugs applied to stdb/bsatn.lua one at a time: 26 were
caught, and the four that were not are all on the default wire, where a wrong
byte decodes a row into garbage rather than failing.

f32 tie rounding was the real gap. IEEE 754 rounds half to EVEN, and nothing
noticed when round_even was replaced by round-half-up or by a plain floor -
both mutations passed the whole suite. Above 2^24 floats step by 2, so an odd
integer sits exactly halfway between two of them: 16777217 must land on
16777216 and 16777219 on 16777220, both even mantissas. Vectors derived from
the format, not read back out of the codec.

The hex writer's leading-zero strip was also unpinned: without it a value
padded wider than its type is rejected instead of accepted, which the readers
never produce but a hand-written literal does.

The floor in Writer:u64 is an equivalent mutant, not a gap - string.char
truncates a non-integer identically on 5.1 and LuaJIT, verified over 22
value/method pairs with zero byte differences. It earns a comment saying what
it is for (a 5.3+ host raises instead) rather than a test that cannot fail.

yuris merged commit 17db97c41e into main

2026-08-21 18:46:26 +00:00

yuris deleted branch wire-pins

2026-08-21 18:46:27 +00:00

yuris referenced this pull request from a commit

2026-08-21 18:46:28 +00:00

test: pin what a mutation audit could break in silence on the default wire (#101)