Repository navigation
test(helpers): refuse unwitnessed doc-changing dispatches in withUnstarvedFrontier - #483
Merged
Merged
Conversation
…arvedFrontier The view form now wraps view.update for each attempt and judges at every gate entry (a new admitGate hook in runUnstarvedAttempts). It refuses more than one doc-changing transaction between two gates (or between mount and the first gate), and refuses a state that reached the view without passing through, or completing, view.update(). Both are plain Errors, so a refusal that observe() swallows is still convicted by the gate-entry conservation law. The state form has no view-owned seam, so its admitGate is a no-op. Mutation results (observed red sets, each reverted afterwards; the helper files were byte-identical to the snapshot and 80/80 passed again). They are recorded here because the implementation lives under test/, so revert-check classifies this commit as test-only and returns a vacuous ALL_PINNED (precedent: PR #392, same file): - (a) delete both admission throws -> 17 red (8 count + 9 bypass refusal tests) - (b) count every transaction, not only doc-changing ones -> 4 red: the selection-only, phrases-reconfiguration and listener-selection accept tests, plus the swallowed-refusal + throwing-destroy conviction test - (c) commit the count before original() -> red: does not count a transaction the view rejected - (d) drop the entry latch -> red: the 3 table rows plus the failed-update preservation test - (e) drop `bypassed` -> red: all 9 bypass tests - (f) record the expectation after original() -> 3 red: the listener-selection accept test, the listener doc-changing count test, the listener setState bypass test - (g) catch arm sets view.state instead of restoring -> red: both throw-after-advance tests - (h) eager read of the last transaction's .state -> red: rejected-transaction test - (i1) bypass throw as HelperRefusal -> red: only the bypass swallowed-sentinel test - (i2) count throw as HelperRefusal -> red: only the count swallowed-sentinel test No call site batches two doc changes per gate, so no call-site test changed; cm-block-widget-bounded.test.ts only notes that the helper now enforces that one item of its operating rule.
…e bypass-arm reset
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
withUnstarvedFrontier(the view form of the bounded ≡ full oracle helper) let two doc-changing dispatches through between two gates. The second one was never checked, so the oracle could go vacuous without anyone noticing. The helper now refuses that case. It also refuses a state that reached the view without going throughview.update(). This is ARCH-07 PR1. PR2 and PR3 are separate.Changes
test/webview/helpers/unstarved-frontier.tsrunUnstarvedAttemptsgains a requiredadmitGate(context)hook. It runs at every gate entry, afterassertHasLanguageand before the starvation check.view.updateonce per attempt.updatesucceeds.admitGaterefuses a bypassed state, and refuses more than one doc change since the last gate (or since mount).Errors, so a refusal thatobserve()swallows is still convicted by the gate-entry conservation law.admitGate.test/webview/helpers/unstarved-frontier.test.ts: 80 tests now. The new ones cover count and bypass refusals, listener re-entry, a rejected or throwingupdate, setup failure, and conviction of a swallowed refusal.test/webview/cm-block-widget-bounded.test.ts: comment only. It notes that the helper now enforces one item of its operating rule.The commit body has a mutation table, (a)–(i). The implementation lives under
test/, so revert-check would report a vacuous ALL_PINNED.Known residue, documented in the helper and not fixed here: reconfiguring a Compartment with effects only moves the frontier without being counted.
Related TODO
ARCH-07 PR1: bounded≡full oracle の空虚化を塞ぐ —
withUnstarvedFrontierが未検証の doc-changing dispatch を 2 つ通すのを拒否するTest plan
pnpm compilepnpm exec biome checkon changed filespnpm test:unit: 287 files / 6131 tests passedpnpm package(audit OK) and install