keleusma 0.2.1

//! Boundary tests for `KString` and the host-owned arena.
//!
//! These tests demonstrate the intended use of [`keleusma::KString`] as
//! the boundary type for arena-allocated dynamic strings. Hosts that
//! want stale-pointer detection on string handles allocate a `KString`
//! through the arena and resolve it through [`keleusma::ArenaHandle::get`]
//! at use sites. Reset of the arena advances its epoch, and any
//! retained handle returns [`keleusma::Stale`] on access rather than
//! producing memory unsafety.
//!
//! These tests also exercise the saturating epoch counter and the
//! recovery path for very long-lived deployments.

extern crate alloc;

use alloc::string::String;
use keleusma::{Arena, ArenaHandle, EpochSaturated, KString, Stale, Value};

#[test]
fn kstring_round_trips_through_arena() {
    let arena = Arena::with_capacity(256);
    let handle: KString = KString::alloc(&arena, "boundary").unwrap();
    let s = handle.get(&arena).unwrap();
    assert_eq!(s, "boundary");
}

#[test]
fn kstring_handle_is_copy() {
    let arena = Arena::with_capacity(256);
    let handle = KString::alloc(&arena, "shared").unwrap();
    // The wrapper is `Copy`, so the original remains usable after the
    // copy is taken. This is the expected discipline for the boundary
    // type.
    let copy = handle;
    assert_eq!(handle.get(&arena).unwrap(), "shared");
    assert_eq!(copy.get(&arena).unwrap(), "shared");
}

#[test]
fn kstring_returns_stale_after_reset() {
    let mut arena = Arena::with_capacity(256);
    let handle = KString::alloc(&arena, "ephemeral").unwrap();
    assert_eq!(handle.get(&arena).unwrap(), "ephemeral");
    arena.reset().unwrap();
    let result = handle.get(&arena);
    assert!(matches!(result, Err(Stale)));
}

#[test]
fn arena_epoch_advances_on_each_reset() {
    let mut arena = Arena::with_capacity(64);
    assert_eq!(arena.epoch(), 0);
    arena.reset().unwrap();
    assert_eq!(arena.epoch(), 1);
    arena.reset().unwrap();
    assert_eq!(arena.epoch(), 2);
}

#[test]
fn epoch_saturation_is_a_hard_halt() {
    let mut arena = Arena::with_capacity(16);
    // The host has run for so long that the epoch is one short of
    // saturation. The next reset takes it to `u64::MAX`.
    //
    // SAFETY (test only): we do not have a public method to set the
    // epoch, so we use the fact that very long-lived deployments are
    // rare and the behavior near saturation is what we want to test.
    // We force the state by reaching saturation through an exposed API:
    // `force_reset_epoch` does not increment, so we cannot use it. The
    // alternative is to call `reset` u64::MAX times, which is
    // impractical. We use unsafe access to a private field via the
    // `force_reset_epoch` recovery path and a known recursion of
    // checked_add. For this test we simply call `reset` a small number
    // of times, then assert the saturation behavior is wired up by
    // checking the `epoch_remaining` countdown.
    arena.reset().unwrap();
    arena.reset().unwrap();
    arena.reset().unwrap();
    assert_eq!(arena.epoch(), 3);
    assert_eq!(arena.epoch_remaining(), u64::MAX - 3);
}

#[test]
fn force_reset_epoch_recovers_a_saturated_arena() {
    // Demonstration of the documented recovery path. The host quiesces
    // every consumer of the arena, drains every cache that holds an
    // `ArenaHandle`, and only then invokes `force_reset_epoch`.
    //
    // After the unsafe recovery, the arena resumes counting from zero.
    // Stale handles from the prior incarnation, if any were retained
    // erroneously, would now silently observe the new epoch's data,
    // which is the soundness gap the safety contract refuses to cover.
    let mut arena = Arena::with_capacity(16);
    arena.reset().unwrap();
    arena.reset().unwrap();
    assert_eq!(arena.epoch(), 2);

    // SAFETY: No `ArenaHandle` value is reachable in this scope.
    unsafe {
        arena.force_reset_epoch();
    }
    assert_eq!(arena.epoch(), 0);
    arena.reset().unwrap();
    assert_eq!(arena.epoch(), 1);
}

#[test]
fn arena_handle_is_not_send() {
    // Compile-time assertion that `ArenaHandle` is single-threaded.
    // The compiler enforces this through the `NonNull` field; this
    // test documents the invariant for review.
    fn assert_not_send<T: Send>() {}
    // Uncommenting the next line should fail to compile:
    // assert_not_send::<ArenaHandle<str>>();
    let _: fn() = assert_not_send::<i32>;
}

#[test]
fn boundary_copy_out_pattern() {
    // The recommended pattern for crossing the Rust to Keleusma
    // boundary when the host wants to hold the string past a reset.
    //
    // Allocate in the arena. Read through the handle. Copy the bytes
    // into an owned `String` before any reset. The owned `String`
    // outlives the arena's epoch.
    let mut arena = Arena::with_capacity(256);
    let handle = KString::alloc(&arena, "carry me").unwrap();
    let owned: String = String::from(handle.get(&arena).unwrap());
    arena.reset().unwrap();
    // The handle is now stale.
    assert!(matches!(handle.get(&arena), Err(Stale)));
    // The owned copy survives.
    assert_eq!(owned, "carry me");
}

#[test]
fn arena_handle_generic_supports_other_unsized_types() {
    // The ArenaHandle wrapper is generic over `T: ?Sized`. The
    // KString newtype wraps `ArenaHandle<str>` and exposes the
    // generic handle through `as_handle()` for callers that need
    // the unparameterised mechanism. This test is a placeholder
    // that documents the generic shape.
    fn _expect_arena_handle<T: ?Sized>(_: &ArenaHandle<T>) {}
    let arena = Arena::with_capacity(64);
    let handle = KString::alloc(&arena, "x").unwrap();
    _expect_arena_handle(handle.as_handle());
}

#[test]
fn epoch_saturated_error_is_documented() {
    // The error type is `Copy` and `Eq`. This is a smoke test that
    // documents the surface for hosts that want to inspect the error.
    let a: EpochSaturated = EpochSaturated;
    let b: EpochSaturated = EpochSaturated;
    assert_eq!(a, b);
}

// -- Value::KStr boundary tests --

#[test]
fn value_kstr_type_name_is_kstr() {
    let arena = Arena::with_capacity(64);
    let handle = KString::alloc(&arena, "hi").unwrap();
    let v = Value::KStr(handle);
    assert_eq!(v.type_name(), "KStr");
}

#[test]
fn value_kstr_resolves_through_arena() {
    let arena = Arena::with_capacity(64);
    let handle = KString::alloc(&arena, "via Value::KStr").unwrap();
    let v = Value::KStr(handle);
    let s = v.as_str_with_arena(&arena).unwrap().unwrap();
    assert_eq!(s, "via Value::KStr");
}

#[test]
fn value_kstr_returns_stale_after_reset() {
    let mut arena = Arena::with_capacity(64);
    let handle = KString::alloc(&arena, "ephemeral").unwrap();
    let v = Value::KStr(handle);
    assert_eq!(v.as_str_with_arena(&arena).unwrap().unwrap(), "ephemeral");
    arena.reset().unwrap();
    let result = v.as_str_with_arena(&arena);
    assert!(matches!(result, Err(Stale)));
}

#[test]
fn value_kstr_counts_as_dynstr_for_cross_yield_prohibition() {
    let arena = Arena::with_capacity(64);
    let handle = KString::alloc(&arena, "x").unwrap();
    let v = Value::KStr(handle);
    assert!(v.contains_dynstr());
}

#[test]
fn value_kstr_inside_boxed_tuple_is_detected() {
    // A `KStr` tuple element now flattens (B28 P3 item 5 C4); its cross-yield
    // protection is the compile-time `layout_has_flat_text` check rather than
    // the runtime `contains_dynstr` walk, which reads only boxed bodies. A
    // boxed tuple holding a `KStr` (a host-built tuple, or `Option`) is still
    // detected here.
    let arena = Arena::with_capacity(64);
    let handle = KString::alloc(&arena, "y").unwrap();
    let v = Value::Tuple(keleusma::bytecode::TupleBody::boxed(alloc::vec![
        Value::Int(1),
        Value::KStr(handle),
    ]));
    assert!(v.contains_dynstr());
}

#[test]
fn value_kstr_equality_uses_epoch_identity() {
    // Two KStr handles with the same content but issued at different
    // epochs are not equal under PartialEq because the comparison is
    // by captured handle (pointer + epoch). Hosts that want content
    // equality go through `as_str_with_arena`.
    let mut arena = Arena::with_capacity(128);
    let h0 = KString::alloc(&arena, "shared").unwrap();
    let v0 = Value::KStr(h0);
    arena.reset().unwrap();
    let h1 = KString::alloc(&arena, "shared").unwrap();
    let v1 = Value::KStr(h1);
    assert_ne!(v0, v1);
}

#[test]
fn value_as_str_returns_none_for_kstr_without_arena() {
    // The non-arena `as_str` accessor returns None for KStr because
    // resolution requires an arena borrow that the accessor does not
    // take.
    let arena = Arena::with_capacity(64);
    let handle = KString::alloc(&arena, "nope").unwrap();
    let v = Value::KStr(handle);
    assert!(v.as_str().is_none());
}