{
"package": "win-durable-ioring",
"testArgs": ["-p", "win-durable-ioring", "--no-fail-fast"],
"whyTestArgs": "--no-fail-fast, so the doctests run even when the unit tests have already failed. README.md's worked examples are compiled as doctests and claim to break the build when a change invalidates them (DI-3.2.4); without this flag cargo stops at the first failing target, the doctests never run under any sabotage the unit tests catch, and nothing shows that claim is true.",
"description": "Sabotages for win-durable-ioring, the Windows driver (DI-8.2); the portable core's are in ../durable-ioring/sabotage.json. Run with tools/run-sabotage.ps1; see tools/README-sabotage.md for the format and for why the results are read the way they are.",
"notCoveredHere": "A ring without the registration op is absent as a cause of a construction failure: its path is the refused build's, which tests reach (DI-7.2), and the capability probe is outside the ring crate's seam (its D-60), so nothing can make the probe refuse. Also absent -- no test can produce the failure: creating the readiness event and pool delivery at construction. What would cover these creation failures, here and below, is a fault seam in win-sync-sys and windows-threadpool-sys of the kind the ring crate has (its kernel-seam), which neither has: the failure is the process running out of handles or memory, which a test cannot cause without breaking its own harness. EntryDelivery::new's failures after the readiness signal is duplicated -- creating the thread-pool wait, and setting the signal -- and a delivery ended by a failed pop, are absent for the same reason; delivery.rs says so. The Windows path's turning of a short write count into a fault (windows_backend.rs's transfer) is reached only by its unit tests: the I/O ring does not complete a file or volume write short (DI-D-50). Also absent from the Windows backend (windows_backend.rs), as no test can produce them: a registration left in flight when the ring is sealed (only a raw push makes one, which is unsafe, which this crate forbids; a completion the ring held nothing for is not a case at all, since the ring is an owned one, the ring crate's D-91); a notification that cannot be duplicated, which also ends a pumped instance's construction (the delivery's handing the engine back is reached over the in-memory backend, in durable-ioring's pump/tests.rs); and an owned buffer the ring refuses, which needs one longer than a u32. The Windows notification's wait ending as abandoned (windows_backend/wait.rs) is absent: only a mutex is abandoned, and making one needs unsafe, which this crate forbids; what would cover it is a safe Mutex in win-sync-sys (its WS-1+.3). Its survives entry is named DI-7.3: blind spot. The notification's wait failing, and Dioring::pump reporting that error, are covered, by a duplicate of an event with no SYNCHRONIZE access, which win-sync-sys makes without unsafe. SignalledDelivery::new's failures (making or duplicating its event, and the ring crate's wake, as the pool's) are absent for the same reason as the pool's. Which pool a delivery's callback runs on is covered, for the pool's delivery and the signalled one's, by holding the named pool's only thread (held_pool.rs).",
"sabotages": [
{
"name": "DI-3.2.1: a duplicate file key is not refused",
"file": "src/dioring.rs",
"expect": "caught",
"why": "Two files under one key would make every report naming that key ambiguous, and the second would silently replace the first in the instance's records while the ring still holds both.",
"find": [" if let Some(key) = first_repeat(files.iter().map(|f| f.key)) {"],
"replace": [" if let Some(key) = first_repeat(std::iter::empty::<IoTargetKey>()) {"]
},
{
"name": "DI-3.2.1: a provider naming a domain twice is not refused",
"file": "src/dioring.rs",
"expect": "caught",
"why": "DI-D-27 refuses it at construction, because a domain served twice would be answered twice for one seal.",
"find": [" if let Some(domain) = first_repeat(provider_domains.iter().cloned()) {"],
"replace": [" if let Some(domain) = first_repeat(std::iter::empty::<FlushDomain>()) {"]
},
{
"name": "DI-3.2.1: construction files are not registered",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A file given at construction must be held by the ring for its life (D-81); without the registration nothing holds it once the consumer's clone is gone.",
"find": [" if handles.is_empty() {"],
"replace": [" if handles.is_empty() || !handles.is_empty() {"]
},
{
"name": "DI-3.2.2.1: the readiness event is never set",
"file": "src/dioring/hub.rs",
"expect": "caught",
"why": "DI-D-28: a waiter would sleep through every entry. Only the readiness check sees it -- the other tests poll -- which is why that check exists beside the oracle.",
"find": [" let set = self.readiness.set();\n"],
"replace": [" let set: io::Result<()> = Ok(());\n"]
},
{
"name": "DI-3.2.2.1: a completion reports no bytes transferred",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "The count is the ring's, and a read may come back short for the consumer to handle; reporting zero hides what happened.",
"find": [" Ok(transferred)\n"],
"replace": [" Ok(0)\n"]
},
{
"name": "DI-3.2.2.1: a failed operation is reported as a transfer",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A write the kernel refused, reported as written, is a lost write the consumer cannot see. Caught by the read-only-handle test and by the caching test.",
"find": [" Err(error) => Err(windows_fault(error)),\n"],
"replace": [" Err(_) => Ok(0),\n"]
},
{
"name": "DI-3.2.2.1: a span operation without a registration is not refused",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A span operation with no registration is refused by the backend as Unsupported before it reaches the ring, handing the context back; without it the push reaches a registration that does not exist.",
"find": [" if self.registered.is_none() {\n return Err(RefusalCause::Unsupported);\n"],
"replace": [" if false {\n return Err(RefusalCause::Unsupported);\n"]
},
{
"name": "DI-3.2.2.1: the write-through choice is dropped",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "DI-2.6: dioring hides no knob the platform offers. Caught because the platform answers differently: a write-through write fails on a cached handle, so a dropped flag turns that failure into a success.",
"find": [" WriteCaching::WriteThrough => windows_ioring_sys::WriteCaching::WriteThrough,\n"],
"replace": [" WriteCaching::WriteThrough => windows_ioring_sys::WriteCaching::Cached,\n"]
},
{
"name": "DI-3.2.2.1: add_target accepts a key already in use",
"file": "src/dioring.rs",
"expect": "caught",
"why": "Two files under one key would make every report naming it ambiguous; the refusal hands the file back.",
"find": [" if engine.core.target(key).is_some() || engine.backend.target(key).is_some() {\n"],
"replace": [" if false {\n"]
},
{
"name": "DI-3.2.2.2: the handover does not set the signal",
"file": "src/delivery.rs",
"expect": "caught",
"why": "DI-D-31's handover guarantee: entries queued before the front end took the instance, whose wake was already consumed, are stranded without it. Caught by the backlog test, which consumes that wake first.",
"find": [" if let Err(error) = kick.set() {\n"],
"replace": [" if let Err(error) = Ok::<(), std::io::Error>(()) {\n"]
},
{
"name": "DI-3.2.2.2: a wake delivers one entry and stops",
"file": "src/delivery.rs",
"expect": "caught",
"why": "DI-D-28: a waiter pops to None after every wake. Stopping early leaves entries that no later wake announces.",
"find": [" (*handler)(event, &inner.handle);\n"],
"replace": [" (*handler)(event, &inner.handle);\n break;\n"]
},
{
"name": "DI-3.2.2.2: the handler runs with the instance's lock held",
"file": "src/delivery.rs",
"expect": "caught",
"why": "DI-2.3 point 3: the handler runs with no lock held, so it may call back in. Held, its own push waits on a lock its thread holds. Caught by the push-from-the-handler test, which leaks the front end on failure so the deadlocked callback fails the test instead of hanging its drop. Measured: the sweep scores this one as a hang past its limit, not as a failed suite, so what catches it is the harness's timeout.",
"find": [" let mut handler = lock(&inner.handler);\n (*handler)(event, &inner.handle);\n"],
"replace": [" let mut handler = lock(&inner.handler);\n inner.handle.with(|_| (*handler)(event, &inner.handle));\n"]
},
{
"name": "DI-3.2.4: a failed flush is reported as a success",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "The flush's answer is the whole basis of durability. Caught by every test that arms the seam, which also shows the seam reaches dioring's decision rather than only the ring's.",
"find": [" Kind::Commit => completion.result().map(|_| 0).map_err(windows_fault),\n"],
"replace": [" Kind::Commit => Ok(0),\n"]
},
{
"name": "CONTROL: the registration timeout's message is reworded",
"file": "src/dioring.rs",
"expect": "survives",
"why": "The manifest checking itself. The tests assert on the bound the message names (DI-7.2) and not on the wording around it, so a rewording that keeps the bound must survive; if it comes back caught, something is matching incidental text.",
"find": [" format!(\"the ring did not complete a registration within {bound:?}\"),"],
"replace": [" format!(\"no registration completion arrived within {bound:?}\"),"]
},
{
"name": "DI-3.9.2: a kernel failure's code is lost on the way to the core",
"file": "src/error_code.rs",
"expect": "caught",
"why": "The ring reports every failure with its code, and the Windows path relays it in each IoFault (DI-D-47, DI-D-50); dropping it records that an operation failed but not how. The Windows backend's unit tests and the ring test reading a failed commit's code both see it missing.",
"find": [" code: error_code_of(&error),\n"],
"replace": [" code: None,\n"]
},
{
"name": "DI-9.7.11: a Win32 code is wrapped as the number it is",
"file": "src/error_code.rs",
"expect": "caught",
"why": "The wrapping is HRESULT_FROM_WIN32's, owned by win-error-codes; passing the code through unwrapped would report 1117 where 0x8007045D is meant, and every Win32 code a fault carries would be misnumbered.",
"find": [" ErrorCode::from_hresult(HResult::from_win32(Win32Error::from_code(code)).raw())\n"],
"replace": [" ErrorCode::from_hresult(code.cast_signed())\n"]
},
{
"name": "DI-9.7.11: a wrapped Win32 code is never read back",
"file": "src/error_code.rs",
"expect": "caught",
"why": "The reading is how a consumer asks which Win32 error a fault was; answering none for all of them removes the question.",
"find": [" .map(Win32Error::code)\n"],
"replace": [" .and(None)\n"]
},
{
"name": "DI-9.7.11: an OS error's code is taken as an HRESULT already",
"file": "src/error_code.rs",
"expect": "caught",
"why": "An error carrying a Win32 code, as io::Error::from_raw_os_error makes, is wrapped; taking its number as the HRESULT would name a different, unrelated code.",
"find": [" .map(|code| error_code_from_win32(code.cast_unsigned()))\n"],
"replace": [" .map(|code| ErrorCode::from_hresult(code))\n"]
},
{
"name": "CONTROL: the Win32 code is read back through a closure",
"file": "src/error_code.rs",
"expect": "survives",
"why": "The manifest checking itself. A closure that calls the same method names the same function, so the file changes and no behaviour.",
"find": [" .map(Win32Error::code)\n"],
"replace": [" .map(|error| error.code())\n"]
},
{
"name": "DI-3.10.3.2: a short write is reported as transferred",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A target completes a write in full or with a fault (DI-D-50); passing a short count through as a transfer lets the core cover bytes that were never written.",
"find": [" if write && transferred < requested {\n"],
"replace": [" if write && transferred > requested {\n"]
},
{
"name": "DI-3.10.3.2: a full write is reported as a fault",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "The other direction of the same guard: a write that transferred every byte it asked for completed, and turning it into a fault would nullify every write.",
"find": [" if write && transferred < requested {\n"],
"replace": [" if write && transferred <= requested {\n"]
},
{
"name": "DI-3.10.3.2: a short read is reported as a fault",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "The obligation is a write's: a read may come back short, and the consumer handles its count.",
"find": [" if write && transferred < requested {\n"],
"replace": [" if transferred < requested {\n"]
},
{
"name": "DI-3.2.5.1: releasing a lineage's last handle does not end it",
"file": "src/dioring/hub.rs",
"expect": "caught",
"why": "DI-D-40: the last handle's release is how a holder that will not finish a lineage ends it. Ignored, the lineage would live on with nothing able to seal it, its epochs neither durable nor abandoned. Caught by the ring test that drops the last copy and waits for LineageEnded.",
"find": [" self.reach(|engine| match engine.core.end_lineage(lineage) {\n"],
"replace": [" self.reach(|engine| match Some(lineage)\n .filter(|_| false)\n .map_or(Err(EndLineageRefusal::Default), |lineage| engine.core.end_lineage(lineage))\n {\n"]
},
{
"name": "DI-3.2.5.1: the default lineage can be ended",
"file": "src/dioring.rs",
"expect": "caught",
"why": "DI-D-40: the default lineage cannot be ended, and the refusal says why. Without the check the instance's own copy makes the handle shared, so the refusal names the wrong reason. Caught by the ring test of end_lineage's refusals.",
"find": [" } else if lineage == self.default.lineage() {\n EndLineageRefusal::Default\n"],
"replace": [" } else if false {\n EndLineageRefusal::Default\n"]
},
{
"name": "DI-3.2.5.1: a shared handle is retired",
"file": "src/dioring.rs",
"expect": "caught",
"why": "DI-D-40: retire succeeds only through the lineage's last handle, so no surviving copy names a retired lineage. Caught by the ring test that offers a copy.",
"find": [" } else if !handle.is_last() {\n RetireLineageRefusal::Shared\n"],
"replace": [" } else if false {\n RetireLineageRefusal::Shared\n"]
},
{
"name": "DI-3.2.6: the provider's answer is never recorded",
"file": "src/dioring/hub.rs",
"expect": "caught",
"why": "DI-D-27: an answer records the outcome. Dropping it leaves every provider-served seal pending.",
"find": [" self.reach(|engine| {\n let actions = engine\n .core\n .provided(call.lineage, call.seal, &call.name, outcome);\n engine.act(actions)\n });\n"],
"replace": [" let _ = outcome;\n"]
},
{
"name": "DI-3.2.6: the provider is never called",
"file": "src/dioring.rs",
"expect": "caught",
"why": "DI-D-27: one request per seal. A request queued and never made leaves its seal pending with no answer ever coming.",
"find": [" provider.make_durable(request);\n"],
"replace": [" std::mem::forget(request);\n"]
},
{
"name": "DI-3.2.6: the provider is called with the lock held",
"file": "src/dioring.rs",
"expect": "caught",
"why": "DI-D-44: the provider may answer inside its call, and the answer takes the engine's lock. Calling it with the lock held -- reached through the slot pool delivery shares, the one path the borrow checker does not refuse -- deadlocks the synchronous answer test, which a timeout counts as caught.",
"find": [" for request in requests {\n provider.make_durable(request);\n"],
"replace": [" let shared = self.delivery.as_ref().expect(\"live\").shared();\n let _held = durable_ioring::driver::lock(&shared);\n for request in requests {\n provider.make_durable(request);\n"]
},
{
"name": "DI-3.2.7: ending does not wait for the provider",
"file": "src/dioring.rs",
"expect": "caught",
"why": "DI-D-25: ending waits for every provider call in flight, which may still be using what the instance owns.",
"find": [" self.hub.wait_for_answers();\n"],
"replace": [""]
},
{
"name": "DI-3.2.7: ending keeps the provider while it waits",
"file": "src/dioring.rs",
"expect": "caught",
"why": "DI-D-45: a provider that keeps completions in itself answers them only when dropped, so a wait before the drop never ends. The test closes on another thread and calls a missed bound a hang.",
"find": [" self.provider = None;\n"],
"replace": [""]
},
{
"name": "DI-3.2.7: an answer does not count its completion down",
"file": "src/dioring/hub.rs",
"expect": "caught",
"why": "DI-D-45: every answer counts down, after the end included. Without it ending waits forever.",
"find": [" *unanswered = left;\n"],
"replace": [""]
},
{
"name": "DI-3.2.7: the last answer wakes no one",
"file": "src/dioring/hub.rs",
"expect": "caught",
"why": "The wait sleeps until notified; an answer that reaches zero without notifying leaves ending asleep.",
"find": [" self.answered.notify_all();\n"],
"replace": [""]
},
{
"name": "DI-9.6.3: a release of a lineage the core finds not live is ignored",
"file": "src/dioring/hub.rs",
"expect": "caught",
"why": "A handle releases only when no explicit end or retire disarmed it, so its lineage is live; a refusal means the bookkeeping is wrong, and ignoring it hides that. The explicit end reports the same state.",
"find": [" None | Some(EndLineageRefusal::Default) => {}\n"],
"replace": [" _ => {}\n"]
},
{
"name": "DI-9.6.3: a release of the default lineage is reported",
"file": "src/dioring/hub.rs",
"expect": "caught",
"why": "The default lineage never ends; its last handle is the instance's own, released as the instance ends, and the core refuses it as Default. Reporting that would panic every instance as it ends.",
"find": [" None | Some(EndLineageRefusal::Default) => {}\n"],
"replace": [" None => {}\n"]
},
{
"name": "DI-3.10.3.5.5: a full submission queue is reported as needing a drain",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "DI-D-52: the cause is what lets the caller act without probing; a full submission queue is cleared by a submit.",
"find": [" Some(RingCondition::SubmissionQueueFull) => RefusalCause::SubmitNeeded,\n"],
"replace": [" Some(RingCondition::SubmissionQueueFull) => RefusalCause::DrainNeeded,\n"]
},
{
"name": "DI-3.10.3.5.5: a full completion queue is reported as needing a submit",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "DI-D-52: a full completion queue is cleared by draining completions, not by submitting more.",
"find": [" Some(RingCondition::CompletionQueueTooFull) => RefusalCause::DrainNeeded,\n"],
"replace": [" Some(RingCondition::CompletionQueueTooFull) => RefusalCause::SubmitNeeded,\n"]
},
{
"name": "DI-3.10.3.5.5: a corrupt ring is reported as of unknown cause",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "DI-D-52: a corrupt ring takes no more submissions, ever; saying so stops a caller retrying.",
"find": [" Some(RingCondition::Corrupt) => RefusalCause::Unusable(windows_fault(error)),\n"],
"replace": [" Some(RingCondition::Corrupt) => RefusalCause::Unknown(windows_fault(error)),\n"]
},
{
"name": "DI-3.10.3.5.5: a malformed submission is reported as of unknown cause",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "DI-D-52: a malformed submission is Invalid, which retrying never clears; Unknown hides that.",
"find": [" io::ErrorKind::InvalidInput => RefusalCause::Invalid,\n"],
"replace": [""]
},
{
"name": "DI-3.10.3.5.5: a target's geometry is not enforced",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A target states the alignment its operations need (DI-D-50 P2); the backend refuses what it does not admit rather than let the kernel fail it.",
"find": [" if admitted {\n Ok(())\n"],
"replace": [" if true || admitted {\n Ok(())\n"]
},
{
"name": "DI-3.10.3.5.5: an armed commit failure lands on another target",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "The fault seam fails the named target's next commit and nothing else.",
"find": [" .position(|(target, _)| *target == sidecar.target)\n"],
"replace": [" .position(|(target, _)| *target != sidecar.target)\n"]
},
{
"name": "DI-3.10.3.5.5: detach does not hand the target back",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A detached target goes back to its owner, as a refused attach hands it back.",
"find": [" self.targets.remove(&key).map(|slot| slot.target)\n"],
"replace": [" self.targets.remove(&key).and(None)\n"]
},
{
"name": "DI-3.10.3.5.5: the backend reports no registered buffers",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A registered region names a buffer by position; the count is how a caller knows which positions exist.",
"find": [" self.registered.as_ref().map_or(0, RegisteredBuffers::len)\n"],
"replace": [" 0\n"]
},
{
"name": "CONTROL: the Windows backend tests its submit flag by comparison",
"file": "src/windows_backend.rs",
"expect": "survives",
"why": "The manifest checking itself on the backend: negating a bool and comparing it with false are the same test. If it comes back caught, something is reacting to more than behaviour.",
"find": [" if !self.queued {\n"],
"replace": [" if self.queued == false {\n"]
},
{
"name": "DI-3.10.3.5.6.1: pool delivery never tells the driver",
"file": "src/windows_backend/pool.rs",
"expect": "caught",
"why": "DI-D-28: a drain that made entries poppable tells the driver, after releasing the engine's lock.",
"find": [" if deliver {\n"],
"replace": [" if false {\n"]
},
{
"name": "DI-9.8.1: the backend's wake ignores its pool",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "DI-D-52: an optional callback environment binds pool delivery to a pool, a NUMA node's for one; dropping it puts delivery on the default pool. Which pool ran a callback is not visible from the callback, so this was a declared blind spot until the tests held the named pool's only thread: a delivery bound to it must wait, and one on the default pool does not.",
"find": [" windows_ioring_sys::CompletionWake::new(&mut self.ring, on_wake, env)\n"],
"replace": [" let _ = env;\n windows_ioring_sys::CompletionWake::new(&mut self.ring, on_wake, None)\n"]
},
{
"name": "DI-9.8.1: pool delivery does not pass its environment to the wake",
"file": "src/windows_backend/pool.rs",
"expect": "caught",
"why": "The pool delivery's own path to the same binding: only the test of pool delivery sees it, because the signalled delivery reaches the wake by its own call.",
"find": ["backend.wake(on_wake, env);"],
"replace": ["backend.wake(on_wake, { let _ = env; None });"]
},
{
"name": "DI-9.8.1: signalled delivery does not pass its environment to the wake",
"file": "src/windows_backend/signalled.rs",
"expect": "caught",
"why": "Signalled delivery's own path to the binding: the signal is set from the wake's callback, so only the test that holds the named pool's thread sees which pool ran it.",
"find": ["engine.backend.wake(on_wake, env)"],
"replace": ["engine.backend.wake(on_wake, { let _ = env; None })"]
},
{
"name": "DI-3.10.3.5.6.2.1: the Windows backend's check does not ask the registration",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A push leaves a region's bounds to the ring; check must ask the ring's own span check, or a gated region outside the registration is held and fails only once released.",
"find": [" Some(registered) => registered.check_span(span(region)).map_err(refusal_cause),\n"],
"replace": [" Some(_) => Ok(()),\n"]
},
{
"name": "DI-3.10.3.5.6.2.1: the Windows backend's check skips its pre-ring refusals",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "check is the push's refusals before the ring is asked, then the ring's span check; skipping the first admits an unknown target or a misaligned operation.",
"find": [" self.admits(target, op)?;\n"],
"replace": [" let _ = self.admits(target, op);\n"]
},
{
"name": "DI-3.10.3.5.6.2.4: the backend's trait impl demands IoBufMut",
"file": "src/windows_backend.rs",
"expect": "refused-by-build",
"buildError": "the trait bound `B: IoBufMut` is not satisfied",
"why": "DI-D-17: owned writes keep write-only buffer types. The library itself refuses the narrower bound: pool delivery is declared over B: IoBuf and drains the backend as an IoBackend, so the build fails there, before the tests' Arc<[u8]> backend -- which pins the same bound from the consumer's side -- is compiled.",
"find": ["impl<B: IoBuf, R: IoBufMut> IoBackend for WindowsBackend<B, R> {\n"],
"replace": ["impl<B: IoBufMut, R: IoBufMut> IoBackend for WindowsBackend<B, R> {\n"]
},
{
"name": "DI-3.10.3.5.6.2.4: an owned read without a read push is not refused",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A backend built without owned reads must refuse one as Unsupported, at check and at push, rather than reach a push it does not have.",
"find": [" if self.owned_read.is_none()\n"],
"replace": [" if false && self.owned_read.is_none()\n"]
},
{
"name": "DI-3.10.3.5.6.2.4: new makes no owned-read push",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "new is the constructor for a buffer type that is IoBufMut; without the push it makes, every owned read is refused.",
"find": [" backend.enable_owned_reads();\n"],
"replace": [" let _ = &mut backend;\n"]
},
{
"name": "DI-3.10.3.5.6.2.5: a registered buffer is lent without asking the registration",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The accessor lends the registration's own bytes, and only when the registration admits it: refused, f is not called.",
"find": [" self.engine().backend.registered_buffer(i).map(f)\n"],
"replace": [" Ok(f(&[]))\n"]
},
{
"name": "DI-3.10.3.5.6.2.5: a registered buffer is lent mutably without asking the registration",
"file": "src/dioring.rs",
"expect": "caught",
"why": "As for the shared accessor: refused while in use, out of range, or with no registration, f is not called.",
"find": [" self.engine().backend.registered_buffer_mut(i).map(f)\n"],
"replace": [" Ok(f(&mut []))\n"]
},
{
"name": "DI-3.10.3.5.6.2.6: an answer to a completion never made is counted down",
"file": "src/dioring/hub.rs",
"expect": "caught",
"why": "DI-D-45: every completion made is counted, and an answer beyond them is the provider breaking its contract, reported as an inconsistency. Counted down instead, it vanishes, and a later ending can stop waiting while a real completion is still unanswered.",
"find": [" let Some(left) = unanswered.checked_sub(1) else {\n"],
"replace": [" let Some(left) = Some(unanswered.saturating_sub(1)) else {\n"]
},
{
"name": "DI-3.10.3.5.6.2.6: a pop makes no provider request",
"file": "src/dioring.rs",
"expect": "caught",
"why": "DI-D-44: a request a drain makes -- a seal's, once the writes it waited for complete -- waits for the consumer's next call. A consumer waiting on Durable only pops, so a pop that does not make it leaves the seal pending forever.",
"find": [" self.call_provider();\n popped\n"],
"replace": [" popped\n"]
},
{
"name": "DI-7.1: a pop hides a failed submit",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A failed submission is reported by the pop that finds no entry to return instead, with its cause, so the consumer is not left polling for work that was never issued. Reached through the ring crate's safe submit-fault responder registered for the instance's ring (its D-85 and M37.1), which fails the submits pool threads make as well as the consumer's. Caught by the test that pops while submits fail and recovers the cause from the error.",
"find": [" (None, Err(cause)) => Err(io::Error::other(cause)),\n"],
"replace": [" (None, Err(_)) => Ok(None),\n"]
},
{
"name": "DI-7.1: a pop's report wins over an entry",
"file": "src/dioring.rs",
"expect": "caught",
"why": "An entry is progress, and a pop that has one returns it even when the submit it also made failed: the failure is reported only when there is nothing to return instead. Reporting it first drops the entry the pop had already taken, so the consumer loses a completion. Caught by the drain test, which needs the first read's entry to arrive while submits fail.",
"find": [" Some(entry) => Ok(Some(entry)),"],
"replace": [" Some(_) if submitted.is_err() => Err(io::Error::other(submitted.expect_err(\"checked\"))),", " Some(entry) => Ok(Some(entry)),"]
},
{
"name": "DI-7+.2: a push does not remember that it queued",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A push leaves its entry queued in the ring and the backend owes a submit. Forgotten, the doorbell is never asked of the ring, and the entry stays queued: nothing is ever issued. Caught at once by every backend test that pushes and submits.",
"find": [" self.queued = true;"],
"replace": [""]
},
{
"name": "DI-7.1: a successful reissue leaves the submit owed",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "Once a reissue succeeds nothing is owed, and the ring is not asked again. Left owed, every later submit asks the ring for nothing, and fails when the ring's submits fail.",
"find": [" self.queued = false;"],
"replace": [""]
},
{
"name": "DI-7.1: a failed reissue forgets what is owed",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A reissue that fails leaves the entries queued, so the submit is still owed. Forgotten, the next submit returns success without asking the ring, and the work is never issued: the consumer waits for a completion that cannot come.",
"find": [" Err(error) => Err(refusal_cause(error)),"],
"replace": [" Err(error) => {", " self.queued = false;", " Err(refusal_cause(error))", " }"]
},
{
"name": "DI-7.1: a failed reissue is reported as a success",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "The consumer's only way to learn its work was not issued is the failure a reissue reports.",
"find": [" Err(error) => Err(refusal_cause(error)),"],
"replace": [" Err(_) => Ok(()),"]
},
{
"name": "DI-7.1: a failed reissue loses its cause",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A reissue's failure is reported as the cause the ring gave, mapped as every other refusal is, so the caller can act on it without probing.",
"find": [" Err(error) => Err(refusal_cause(error)),"],
"replace": [" Err(_) => Err(RefusalCause::Invalid),"]
},
{
"name": "DI-7.2: a refused file-registration build loses its cause",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A registration the ring refuses to build ends construction as the ring's own error, so a consumer can act on the cause rather than a placeholder.",
"find": [" .map_err(PushRefused::into_error)?;"],
"replace": [" .map_err(|_| io::Error::from(io::ErrorKind::Other))?;"]
},
{
"name": "DI-7.2: a file registration's failed submit is swallowed",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A registration that was not submitted can never complete: the failure is the answer, and swallowing it turns it into a wait for the bound.",
"find": [" batch.submit()?;"],
"replace": [" let _ = batch.submit();"]
},
{
"name": "DI-7.2: a failed file-registration completion is taken for success",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A registration the kernel failed is not a registration made: reporting success hands the engine files the ring does not hold.",
"find": [" Ok(result) => result.map(Some),"],
"replace": [" Ok(_) => Ok(None),"]
},
{
"name": "DI-7.2: a refused buffer-registration build keeps the buffers",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A build the ring refused never gave the kernel the buffers, so they go back to the caller; dropping them loses what the caller handed in.",
"find": [" .map_err(|refused| (refused.error, refused.payload))?;"],
"replace": [" .map_err(|refused| (refused.error, None))?;"]
},
{
"name": "DI-7.2: a failed buffer-registration completion is taken for success",
"file": "src/dioring.rs",
"expect": "caught",
"why": "As for files: a buffer registration the kernel failed is not one made.",
"find": [" Ok(result) => result.map(Some).map_err(|error| (error, None)),"],
"replace": [" Ok(_) => Ok(None),"]
},
{
"name": "DI-7.2: a registration waits the default bound, not the one construction was given",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The bound is a property of the construction, so a test can shorten one wait rather than the constant for every test. Ignoring it makes the stalled-registration tests wait the default 30s, and the stall ends first.",
"find": [" match ring.pop_within(bound)? {"],
"replace": [" match ring.pop_within(REGISTRATION_BOUND)? {"]
},
{
"name": "DI-7.2: a registration that times out is not reported as a timeout",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A completion that did not arrive is a timeout, and says so.",
"find": [" io::ErrorKind::TimedOut,"],
"replace": [" io::ErrorKind::Other,"]
},
{
"name": "DI-7.2: a registration's timeout does not name the bound it waited",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The message states what construction waited, so a reader is not told 30s of a 50ms wait.",
"find": [" format!(\"the ring did not complete a registration within {bound:?}\"),"],
"replace": [" \"the ring did not complete a registration within 30s\".to_string(),"]
},
{
"name": "DI-7.2: a construction failure loses the ring's error",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The instance's refusal carries the ring's own error, with its HRESULT, not just a kind.",
"find": [" WindowsBackendRefusal::Ring(error) => SetupRefusal::Ring(error),"],
"replace": [" WindowsBackendRefusal::Ring(error) => SetupRefusal::Ring(io::Error::from(error.kind())),"]
},
{
"name": "DI-7.2: a construction failure does not hand the buffers back",
"file": "src/dioring.rs",
"expect": "caught",
"why": "What the backend hands back, the instance hands back: the buffers while the kernel was not given them.",
"find": [" files: setups(targets),", " buffers,", " provider,"],
"replace": [" files: setups(targets),", " buffers: None,", " provider,"]
},
{
"name": "DI-7.2: the files' registration waits the default bound",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "Construction's bound reaches the files' registration.",
"find": [" let files = match register_files(&mut ring, handles, registration_bound) {"],
"replace": [" let files = match register_files(&mut ring, handles, crate::dioring::REGISTRATION_BOUND) {"]
},
{
"name": "DI-7.2: the buffers' registration waits the default bound",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "Construction's bound reaches the buffers' registration too, which only a stall with no files to register first can show.",
"find": [" let registered = match register_buffers(&mut ring, buffers, registration_bound) {"],
"replace": [" let registered = match register_buffers(&mut ring, buffers, crate::dioring::REGISTRATION_BOUND) {"]
},
{
"name": "DI-7.2: a failed completion-event attach loses the targets",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "Whatever fails, the targets come back: they were the caller's.",
"find": [" Err(error) => return Err(fail(error, targets, None)),"],
"replace": [" Err(error) => return Err(fail(error, Vec::new(), None)),"]
},
{
"name": "DI-7.2: the construction hook runs after the files are registered",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "The hook is the only moment a responder can answer the registration calls: called after the first of them it has missed it, and a refused file-registration build is never seen.",
"find": [" #[cfg(test)]", " if let Some(on_ring) = on_ring {", " on_ring(&ring);", " }", " let handles = targets", " .iter()", " .map(|(_, target)| target.handle().clone())", " .collect();", " let files = match register_files(&mut ring, handles, registration_bound) {", " Ok(files) => files,", " Err(error) => return Err(fail(error, targets, Some(buffers))),", " };"],
"replace": [" let handles = targets", " .iter()", " .map(|(_, target)| target.handle().clone())", " .collect();", " let files = match register_files(&mut ring, handles, registration_bound) {", " Ok(files) => files,", " Err(error) => return Err(fail(error, targets, Some(buffers))),", " };", " #[cfg(test)]", " if let Some(on_ring) = on_ring {", " on_ring(&ring);", " }"]
},
{
"name": "CONTROL: DI-7.2: the construction hook is called through an identity",
"file": "src/windows_backend.rs",
"expect": "survives",
"why": "The manifest checking itself on construction: a reborrow changes nothing, so this must survive; if it comes back caught, something is matching incidental text.",
"find": [" on_ring(&ring);"],
"replace": [" on_ring(&*&ring);"]
},
{
"name": "DI-7.3: a signalled ring event is reported as not raised",
"file": "src/windows_backend/wait.rs",
"expect": "caught",
"why": "The ring's completion event is the Windows backend's notification: its being set is the raising.",
"find": [" WaitOutcome::Signalled => Ok(true),"],
"replace": [" WaitOutcome::Signalled => Ok(false),"]
},
{
"name": "DI-7.3: a timed-out ring event wait is reported as raised",
"file": "src/windows_backend/wait.rs",
"expect": "caught",
"why": "The other direction: a wait that timed out saw nothing raised.",
"find": [" WaitOutcome::TimedOut => Ok(false),"],
"replace": [" WaitOutcome::TimedOut => Ok(true),"]
},
{
"name": "DI-9.8.1: a wait on the ring's event that fails is taken for a timeout",
"file": "src/windows_backend/wait.rs",
"expect": "caught",
"why": "A notification that cannot be waited on stops an instance delivering, so the failure is the wait's error and not a timeout the caller retries for ever. This was a declared blind spot (DI-7.3) until win-sync-sys' duplicate_handle_with_access made a handle without SYNCHRONIZE access without unsafe.",
"find": [" match wait_for_single_object(&self.0, timeout)? {"],
"replace": [" match wait_for_single_object(&self.0, timeout).unwrap_or(WaitOutcome::TimedOut) {"]
},
{
"name": "DI-3.2.2.1: the readiness check does not require a second wake",
"file": "src/readiness.rs",
"expect": "caught",
"why": "The second half of DI-D-28's check: a signal set once and never again. Caught by the fake that sets only once.",
"find": [" .map_err(|_| ReadinessFailure::NotSetAgain)?;\n"],
"replace": [" .ok();\n"]
},
{
"name": "DI-7.3: blind spot: an abandoned ending of the ring's event wait is taken for a timeout",
"file": "src/windows_backend/wait.rs",
"expect": "survives",
"why": "Declared, not caught: only a mutex is abandoned, an event never is, and a test would need a mutex, which needs unsafe to make. What would cover it is a safe Mutex in win-sync-sys (its WS-1+.3), whose wait can end abandoned: a thread that ends holding one, then this wait on it. win-sync-sys' tests reach the abandoned ending in the function this calls.",
"find": [" WaitOutcome::TimedOut => Ok(false),"],
"replace": [" WaitOutcome::TimedOut | WaitOutcome::Abandoned => Ok(false),"]
},
{
"name": "DI-7.3: pumping an instance built with a pool is not refused as unsupported",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The pool drains the instance, and a consumer that pumps it has misread how it was built; the refusal says so by its kind.",
"find": [" return Err(io::Error::new(\n io::ErrorKind::Unsupported,\n \"the instance was built with pool delivery"],
"replace": [" return Err(io::Error::new(\n io::ErrorKind::Other,\n \"the instance was built with pool delivery"]
},
{
"name": "DI-7.3: a pump does not settle what it drained",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The pump is the consumer call after which the readiness event is set and the provider's requests are made, as for every other path that makes entries poppable.",
"find": [" self.settled(pumped.ready);"],
"replace": [" let _ = pumped.ready;"]
},
{
"name": "DI-7+.1: a signalled instance offers the ring's own event",
"file": "src/dioring/delivery.rs",
"expect": "caught",
"why": "The ring's event belongs to the wake that tees it in a signalled instance; a consumer's wait on it would take wakes the wake needs, which the ring crate's D-21 forbids.",
"find": [" Self::Pool(_) | Self::Signalled(_) => None,\n"],
"replace": [" Self::Pool(_) => None,\n Self::Signalled(signalled) => Some(signalled.engine().backend.completion_wait_handle()),\n"]
},
{
"name": "DI-7+.1: a pool-built instance offers the ring's own event",
"file": "src/dioring/delivery.rs",
"expect": "caught",
"why": "As for a signalled instance: the pool's wake owns the ring's event.",
"find": [" Self::Pool(_) | Self::Signalled(_) => None,\n"],
"replace": [" Self::Signalled(_) => None,\n Self::Pool(pool) => Some(pool.engine().backend.completion_wait_handle()),\n"]
},
{
"name": "DI-7+.1: the refusal of an instance that does not offer the event is another kind",
"file": "src/dioring.rs",
"expect": "caught",
"why": "Unsupported is how every accessor of a mode the instance was not built with refuses, and what a consumer matches on.",
"find": [" io::ErrorKind::Unsupported,\n \"only an instance built with DeliveryMode::Pumped offers"],
"replace": [" io::ErrorKind::InvalidInput,\n \"only an instance built with DeliveryMode::Pumped offers"]
},
{
"name": "DI-7+.1: BLIND SPOT: the handle offered can also set and reset the ring's event",
"file": "src/windows_backend.rs",
"expect": "survives",
"why": "Declared blind spot, not a control. The handle is meant to carry SYNCHRONIZE access alone, so the kernel refuses a set or a reset through it, and no test here can show that: setting an event is unsafe, which this crate forbids. win-sync-sys tests the same function with the same access, where the kernel's refusal is asserted. What would cover it here is a safe way to set an event given only a handle, which win-sync-sys does not offer and, by its WS-D-4, deliberately does not.",
"find": [" duplicate_handle_with_access(&self.event, Access::SYNCHRONIZE)\n"],
"replace": [" duplicate_handle_with_access(&self.event, Access::SYNCHRONIZE | Access::EVENT_MODIFY_STATE)\n"]
},
{
"name": "PR-126: a buffer longer than a u32 is admitted by check",
"file": "src/windows_backend.rs",
"expect": "survives",
"why": "DECLARED BLIND SPOT. The ring carries a length of u32 and no more, and check refuses beyond it so a gated operation is refused at the call that gave it. The test that shows it needs a buffer of more than 4 GiB, which a machine without that commit available cannot make, so it is #[ignore]d and run on request (a_buffer_the_ring_cannot_carry_is_refused_by_check_and_by_push); this sweep does not run it. Shown by hand: without the length check that test fails at its check assertion. A buffer type of the test's own that reports a length without having it needs unsafe, which this crate forbids.",
"find": [" u32::try_from(length).is_ok()\n && geometry.admits(offset, length)"],
"replace": [" geometry.admits(offset, length)"]
},
{
"name": "PR-126: any handle is made into a completion event by safe code",
"file": "src/windows_backend/wait.rs",
"expect": "caught",
"why": "A mutex handle made into a CompletionEvent would be acquired by its wait and never released. The doctest on the type pins E0624 for the call from outside the crate.",
"find": [" pub(crate) fn new(handle: OwnedHandle) -> Self {"],
"replace": [" pub fn new(handle: OwnedHandle) -> Self {"]
},
{
"name": "DI-7+.2: a consumer's push whose doorbell failed does not wake it",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A push whose doorbell failed leaves work queued with nothing in flight, so no completion will raise the readiness signal: the driver raises it once, and the consumer's pop rings the doorbell again and reports the cause.",
"find": [" if attention {\n self.hub.signal();\n }\n"],
"replace": [" let _ = attention;\n"]
},
{
"name": "DI-7+.2: a pop does not report a fault the ring could not be read with",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A ring that cannot be read is told to the consumer by the pop that finds nothing to return, so the consumer is not left waiting for completions that cannot be read.",
"find": [" (Some(fault), _) => Err(io::Error::other(fault)),\n"],
"replace": [" (Some(_), _) => Ok(None),\n"]
},
{
"name": "DI-7+.2: a push submits as its batch drops",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A push only queues; the doorbell is the engine's to ring, once for a batch, and a failure of it is seen by the one who rang it. A batch dropped submits, and reports nothing.",
"find": [" batch.leave_queued();\n self.queued = true;\n"],
"replace": [" drop(batch);\n self.queued = true;\n"]
},
{
"name": "DI-7+.2: a refused push submits what an earlier push queued",
"file": "src/windows_backend.rs",
"expect": "caught",
"why": "A refused push queued nothing, but its batch dropped submits whatever an earlier push left, in a call that cannot report on it.",
"find": [" batch.leave_queued();\n let PushRefused"],
"replace": [" drop(batch);\n let PushRefused"]
}, {
"name": "DI-7+.4: a Model A handler is not told of a failed pop",
"file": "src/delivery.rs",
"expect": "caught",
"why": "The wake that took the readiness edge is the only thing that told the consumer of a failure of the instance's pop (DI-D-58); collapsed into an empty queue, an accepted operation can stay queued with neither an entry nor an error reaching the handler. Caught by the test whose fake pop fails.",
"find": [" (*handler)(DeliveryEvent::Failure(error), &inner.handle);\n"],
"replace": [" let _ = (&mut *handler, error);\n"]
},
{
"name": "DI-7+.4: a Model A wake loops on a failed pop",
"file": "src/delivery.rs",
"expect": "caught",
"why": "A failure is told once per wake: the pop that failed would fail again, with nothing to stop the loop, so the wake ends. Caught by the test that expects the failure once and then quiet (or by the suite hanging, which the sweep reads as caught).",
"find": [" (*handler)(DeliveryEvent::Failure(error), &inner.handle);\n break;\n"],
"replace": [" (*handler)(DeliveryEvent::Failure(error), &inner.handle);\n continue;\n"]
}, {
"name": "DI-9.8.1: a pump's failed wait is reported as success",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The pump says why the wait could not be made. This was a declared blind spot (DI-7.3) until the test gave an instance a notification that cannot be waited on, a duplicate of an event that may only set and reset. The delivery's reporting of a failed wait is also caught over the in-memory backend, in pump/tests.rs.",
"find": [" pumped.waited.map(|_| pumped.ready)"],
"replace": [" Ok(pumped.ready)"]
},
{
"name": "DI-7.3: an instance set up for pumping is built with a pool",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The delivery chosen at construction is the one the instance has: a pool drains an instance nothing is meant to drain.",
"find": [" DeliveryMode::Pumped => PumpedDelivery::new(engine).map(Delivery::Pumped),"],
"replace": [" DeliveryMode::Pumped => PoolDelivery::new(engine, on_ready, None).map(Delivery::Pool),"]
},
{
"name": "DI-7.3: an instance set up with a pool is built for pumping",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The other direction: an instance given a pool that nothing drains delivers nothing, to every consumer that waits for its readiness.",
"find": [" PoolDelivery::new(engine, on_ready, environment).map(Delivery::Pool)"],
"replace": [" PumpedDelivery::new(engine).map(Delivery::Pumped)"]
},
{
"name": "DI-7.5: the pool's callback sets nothing",
"file": "src/windows_backend/signalled.rs",
"expect": "caught",
"why": "The wake exists to set the consumer's event; a callback that does not leaves a consumer waiting beside its other handles for a completion nothing tells it of.",
"find": [" let set = waker.set();"],
"replace": [" let set: io::Result<()> = Ok(());"]
},
{
"name": "DI-7.5: each call for the signal makes a new event",
"file": "src/windows_backend/signalled.rs",
"expect": "caught",
"why": "Every duplicate is a handle to the one event the pool sets; a fresh event is never set, and the consumer waits on it for ever.",
"find": [" self.signal.try_clone()"],
"replace": [" Event::new(ResetMode::Auto, false)"]
},
{
"name": "DI-7.5: the signal is made manual-reset",
"file": "src/windows_backend/signalled.rs",
"expect": "caught",
"why": "Auto-reset, so a wait takes the signal and a consumer's loop does not spin: manual-reset stays set until someone resets it, and a pump's wait on it returns at once for ever.",
"find": [" let made = Event::new(ResetMode::Auto, false).and_then(|signal| {"],
"replace": [" let made = Event::new(ResetMode::Manual, false).and_then(|signal| {"]
},
{
"name": "DI-7.5: a signalled instance is built pumped",
"file": "src/dioring.rs",
"expect": "caught",
"why": "The delivery chosen at construction is the one the instance has: a pumped instance has no pool wake, so nothing sets a signal for the consumer.",
"find": [" SignalledDelivery::new(engine, environment).map(Delivery::Signalled)"],
"replace": [" PumpedDelivery::new(engine).map(Delivery::Pumped)"]
},
{
"name": "DI-7.5: a signalled instance has no completion signal",
"file": "src/dioring/delivery.rs",
"expect": "caught",
"why": "The signal is the mode's point: the consumer reaches it through the instance.",
"find": [" Self::Signalled(signalled) => Some(signalled.signal()),"],
"replace": [" Self::Signalled(_) => None,"]
},
{
"name": "DI-7.5: a signalled instance cannot be pumped",
"file": "src/dioring/delivery.rs",
"expect": "caught",
"why": "Nothing else drains a signalled instance: a consumer woken by the signal drains it with pump.",
"find": [" Self::Signalled(signalled) => Some(signalled.pump(timeout)),"],
"replace": [" Self::Signalled(_) => None,"]
},
{
"name": "CONTROL: DI-7.5: the wake is dropped at the end of into_engine instead of its start",
"file": "src/windows_backend/signalled.rs",
"expect": "survives",
"why": "The manifest checking itself on the new module: the wake's callback holds only a duplicate of the event and never the engine, so when it stops relative to the engine's coming out of its slot changes nothing observable; if this comes back caught, something is matching incidental text.",
"find": [" drop(wake);"],
"replace": [" let _later = &wake;"]
},
{
"name": "DI-7.4: the blocking push retries a refusal that cannot clear",
"file": "examples/blocking_push/main.rs",
"expect": "caught",
"why": "Only a refusal waiting clears is waited out; the rest -- no such file, a sealed epoch -- is returned at once with the buffer, so a caller is not held for its patience over a push that can never succeed.",
"find": [" if !clears || refused.buffer.is_none() {"],
"replace": [" if refused.buffer.is_none() {"]
},
{
"name": "DI-7.4: the blocking push never gives up",
"file": "examples/blocking_push/main.rs",
"expect": "caught",
"why": "The patience is the helper's whole bound; without it a ring that never makes room blocks its caller for ever.",
"find": [" if left.is_zero() {"],
"replace": [" if false {"]
},
{
"name": "DI-7.4: the blocking push's patience is counted in the wrong unit",
"file": "examples/blocking_push/main.rs",
"expect": "caught",
"why": "A push that gives up must have waited the patience it was given, not a thousandth of it.",
"find": [" let deadline = Instant::now() + patience;"],
"replace": [" let deadline = Instant::now() + patience / 1000;"]
},
{
"name": "DI-7.4: the blocking push swallows a failure to make room",
"file": "examples/blocking_push/main.rs",
"expect": "caught",
"why": "A make_room that fails is reported with the push handed back, rather than retried until the patience is spent and reported as a timeout, which names the wrong cause.",
"find": [" if let Err(error) = make_room(ring, left.min(SLICE)) {"],
"replace": [" if let Err(error) = make_room(ring, left.min(SLICE)).or(Ok::<(), io::Error>(())) {"]
},
{
"name": "DI-7.4: making room for a pumped instance does not pump it",
"file": "examples/blocking_push/main.rs",
"expect": "caught",
"why": "Nothing else drains a pumped or signalled instance, so a blocking push that does not pump waits for room that never comes.",
"find": [" Self::Pumped | Self::Signalled => ring.pump(Some(slice)).map(|_| ()),"],
"replace": [" Self::Pumped | Self::Signalled => Ok(()),"]
},
{
"name": "PR-126: a handle the instance did not mint is taken for its own",
"file": "src/dioring.rs",
"expect": "caught",
"why": "A handle for a live lineage that something else made has a count of one, so ending or retiring through it abandons epochs while the genuine handles are live, and the genuine last release then finds the lineage gone.",
"find": [" handle.is_homed_at(&self.hub)"],
"replace": [" handle.lineage().instance == self.default.lineage().instance"]
},
{
"name": "DI-10.1: an unbuffered file is opened without the flag that makes it so",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "The class an unbuffered file claims is only true if the kernel treats it as unbuffered; the test that writes unaligned through it and sees the kernel refuse does not read this crate's own record.",
"find": [" const FLAGS: u32 = FILE_FLAG_NO_BUFFERING;"],
"replace": [" const FLAGS: u32 = 0;"]
},
{
"name": "DI-10.1: a cached file is opened unbuffered",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "The opposite error: a file that claims BestEffort and no alignment but that the kernel holds to a sector would refuse the operations its target accepts.",
"find": [" const FLAGS: u32 = 0;"],
"replace": [" const FLAGS: u32 = FILE_FLAG_NO_BUFFERING;"]
},
{
"name": "DI-10.1: an unbuffered file claims no more than best effort",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "The class is what the type exists to carry; an unbuffered file understating itself is the safe direction, and still wrong.",
"find": [" const WARRANTY: WarrantyClass = WarrantyClass::SharedDevice;"],
"replace": [" const WARRANTY: WarrantyClass = WarrantyClass::BestEffort;"]
},
{
"name": "DI-10.1: an unbuffered file is allowed on a remote device",
"file": "src/windows_backend/opened_file.rs",
"expect": "refused-by-build",
"buildError": "assertion failed: Unbuffered::LOCAL_DEVICE_ONLY",
"why": "A remote file cannot keep the claim that makes a file unbuffered. The behavioural test that opens one over the administrative share is ignored by default, so the constant that gates the check is what a default run holds: the unit tests assert it in a const block, so the test build fails on the patch and no test runs.",
"find": [" const LOCAL_DEVICE_ONLY: bool = true;"],
"replace": [" const LOCAL_DEVICE_ONLY: bool = false;"]
},
{
"name": "DI-10.1: the default sector size is the smaller one",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "4096 is chosen because every smaller sector size divides it and so no device refuses it; 512 would be refused by a 4096-sector device on the first transfer.",
"find": [" pub const DEFAULT_SECTOR_SIZE: u32 = 4096;"],
"replace": [" pub const DEFAULT_SECTOR_SIZE: u32 = 512;"]
},
{
"name": "DI-10.1: a stated sector size is ignored",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "The caller's sector size is the only way to be offered less alignment than the default, and a size that is not a power of two must be refused.",
"find": [" self.geometry = Geometry::uniform(sector_size)?;"],
"replace": [" self.geometry = Geometry::uniform(Unbuffered::DEFAULT_SECTOR_SIZE)?;"]
},
{
"name": "DI-10.1: the verbatim form of a share is read as local",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "canonicalize returns a share in its verbatim form, \\\\?\\UNC\\..., which is the form the check sees in practice; only matching the plain form would miss every real one.",
"find": [" if matches!(prefix.kind(), Prefix::UNC(..) | Prefix::VerbatimUNC(..))"],
"replace": [" if matches!(prefix.kind(), Prefix::UNC(..))"]
},
{
"name": "DI-10.1: a new file's remote check is skipped by looking nowhere",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "A path that does not exist yet is judged by the directory it would be created in; without that, creating an unbuffered file fails or goes unchecked.",
"find": [" Err(error) if error.kind() == io::ErrorKind::NotFound => {"],
"replace": [" Err(error) if error.kind() == io::ErrorKind::OutOfMemory => {"]
},
{
"name": "DI-10.1: a target takes its class from a declaration instead of its file",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "The class must come from how the file was opened, never from the target.",
"find": [" domains: Vec::new(),\n warranty: B::WARRANTY,\n"],
"replace": [" domains: Vec::new(),\n warranty: WarrantyClass::Complete,\n"]
},
{
"name": "DI-10.1: a target drops what its file offers",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "An unbuffered file's write-through capability is what lets a consumer ask for it; the kernel refuses it on a cached file.",
"find": [" domains: Vec::new(),\n warranty: B::WARRANTY,\n capabilities: B::CAPABILITIES,\n"],
"replace": [" domains: Vec::new(),\n warranty: B::WARRANTY,\n capabilities: Capabilities::NONE,\n"]
},
{
"name": "DI-10.1: a target takes no alignment from its file",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "The alignment the backend enforces is the file's; without it an unbuffered file's operations reach the kernel unaligned.",
"find": [" geometry: file.geometry(),"],
"replace": [" geometry: Geometry::UNALIGNED,"]
},
{
"name": "DI-10.2: a volume's disks are counted once each per extent",
"file": "src/windows_backend/opened_volume.rs",
"expect": "caught",
"why": "A volume with two runs on one disk has one flush domain; a domain repeated is a domain a consumer would see twice.",
"find": [" disks.dedup();"],
"replace": [" disks.len();"]
},
{
"name": "DI-10.2: a volume's domains are left in the order the device gave",
"file": "src/windows_backend/opened_volume.rs",
"expect": "caught",
"why": "Two volumes on the same disks report the same domains in the same order, which a comparison of them relies on.",
"find": [" disks.sort_unstable();"],
"replace": [" disks.len();"]
},
{
"name": "DI-10.2: a disk is named some other way than a file's declaration would name it",
"file": "src/windows_backend/opened_volume.rs",
"expect": "caught",
"why": "Two targets share a domain exactly when their bytes agree, so a volume and a file on the same disk fail together only if both name it as \\\\.\\PhysicalDriveN.",
"find": [" FlushDomain::new(format!(r\"\\\\.\\PhysicalDrive{disk_number}\").into_bytes())"],
"replace": [" FlushDomain::new(format!(r\"\\\\.\\Disk{disk_number}\").into_bytes())"]
},
{
"name": "DI-10.2: a digit is taken for a drive letter",
"file": "src/windows_backend/opened_volume.rs",
"expect": "caught",
"why": "Only the forms that name a volume are accepted; \\\\.\\1: names nothing.",
"find": [" if letter.is_ascii_alphabetic() {"],
"replace": [" if letter.is_ascii_alphanumeric() {"]
},
{
"name": "DI-10.2: a GUID group of any shorter length is accepted",
"file": "src/windows_backend/opened_volume.rs",
"expect": "caught",
"why": "A volume GUID path is opened as given, so a malformed one must be refused here rather than opened as whatever it names.",
"find": [" group.len() == length && group.chars().all(|c| c.is_ascii_hexdigit())"],
"replace": [" group.len() <= length && group.chars().all(|c| c.is_ascii_hexdigit())"]
},
{
"name": "DI-10.2: an unbuffered volume needs its sector in the buffer's address only as one byte",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "An unbuffered transfer's buffer must start on a sector; a geometry that says otherwise lets a misaligned buffer reach the kernel.",
"find": [" Geometry::uniform(sector_size)\n }\n"],
"replace": [" Geometry::new(sector_size, sector_size, 1)\n }\n"]
},
{
"name": "DI-10.2: a cached volume needs its sector in the buffer's address too",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "The cache is what lets a cached transfer start anywhere; requiring more only refuses what the kernel would take.",
"find": [" Geometry::new(sector_size, sector_size, 1)\n }\n"],
"replace": [" Geometry::uniform(sector_size)\n }\n"]
},
{
"name": "DI-10.2: declaring domains on a volume removes the ones its disks gave",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "A backing that finds its own domains makes that its own obligation; a consumer's declaration adds to them and never takes one away, or a missing domain would leave a failure unreported.",
"find": [" self.domains = self.found.clone();"],
"replace": [" self.domains = Vec::new();"]
},
{
"name": "DI-10.2: a volume's target reports no domains of its own finding",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "The disks the volume sits on are what a commit failure can reach; a target that finds none shares fate with no one it should.",
"find": [" let found = volume.flush_domains();"],
"replace": [" let found: Vec<FlushDomain> = Vec::new();"]
},
{
"name": "DI-10.2: a volume's target claims the class of a complete device",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "A lock keeps other handles off the volume, not other writers off its disks, so a volume is never Complete.",
"find": [" geometry: volume.geometry(),\n handle: volume.handle().clone(),\n domains: found.clone(),\n found,\n declared: Vec::new(),\n warranty: B::WARRANTY,\n"],
"replace": [" geometry: volume.geometry(),\n handle: volume.handle().clone(),\n domains: found.clone(),\n found,\n declared: Vec::new(),\n warranty: WarrantyClass::Complete,\n"]
},
{
"name": "DI-10.2: the lock is asked for and not taken",
"file": "src/windows_backend/opened_volume.rs",
"expect": "survives",
"why": "A declared blind spot of the default run: only the elevated raw-volume tests, which need an administrator and are ignored by default, can tell a lock that was taken from one that was not, since the volume's flag is set from the options either way.",
"find": [" if options.lock {\n lock_volume(&file)?;\n }\n"],
"replace": [" if options.lock {\n let _ = &file;\n }\n"]
},
{
"name": "DI-10.4: a disk is named by some other form than the one that names a disk",
"file": "src/windows_backend/opened_disk.rs",
"expect": "caught",
"why": "The path is the one form that names a physical disk; any other opens something else with the write access a disk is opened with.",
"find": [" format!(r\"\\\\.\\PhysicalDrive{}\", self.0)"],
"replace": [" format!(r\"\\\\.\\Disk{}\", self.0)"]
},
{
"name": "DI-10.4: a disk's target reports no flush domain",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "The disk is the domain a commit failure on it can reach; a target that reports none shares fate with every target, which over-reports, and with no domain of its own, so a consumer cannot declare a file on the same disk against it.",
"find": [" let found = vec![disk.flush_domain()];"],
"replace": [" let found: Vec<FlushDomain> = Vec::new();"]
},
{
"name": "DI-10.4: a disk's target claims the class of a complete device",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "Opening a whole disk directly keeps no other writer off it, so a disk is never Complete, as a volume is not.",
"find": [" geometry: disk.geometry(),\n handle: disk.handle().clone(),\n domains: found.clone(),\n found,\n declared: Vec::new(),\n warranty: B::WARRANTY,\n"],
"replace": [" geometry: disk.geometry(),\n handle: disk.handle().clone(),\n domains: found.clone(),\n found,\n declared: Vec::new(),\n warranty: WarrantyClass::Complete,\n"]
},
{
"name": "DI-10.4: a disk's target takes no alignment from its disk",
"file": "src/windows_backend/file_target.rs",
"expect": "caught",
"why": "The alignment the backend enforces is the disk's sector; without it an unbuffered transfer reaches the kernel unaligned.",
"find": [" geometry: disk.geometry(),\n"],
"replace": [" geometry: Geometry::UNALIGNED,\n"]
},
{
"name": "DI-10.4: an opened disk ignores the sector size the device reported",
"file": "src/windows_backend/opened_disk.rs",
"expect": "survives",
"why": "A declared blind spot of the default run: only the elevated raw-disk tests open a real disk and read its sector size, so a geometry that ignores it is seen there and not here.",
"find": [" let geometry = B::sector_geometry(sector)\n"],
"replace": [" let geometry = B::sector_geometry(sector.max(1) * 0 + 4096)\n"]
},
{
"name": "DI-10.4: the scratch disk helper takes the output for any file",
"file": "src/scratch_volume.rs",
"expect": "caught",
"why": "This is what keeps a test that writes to a disk from writing to one it did not make: the number must come from output that names the file the test created.",
"find": [" if !name.eq_ignore_ascii_case(&vhd.display().to_string()) {\n"],
"replace": [" if false {\n"]
},
{
"name": "DI-10.4: the scratch disk helper accepts disk 0",
"file": "src/scratch_volume.rs",
"expect": "caught",
"why": "Disk 0 is the one a machine starts from; a scratch disk is never it, whatever diskpart prints.",
"find": [" Ok(0) => Err(\"the associated disk is disk 0, which is never a scratch disk\".to_owned()),\n"],
"replace": [" Ok(0) => Ok(0),\n"]
},
{
"name": "DI-13.2: a created-and-truncated file is not emptied",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "With CREATE_ALWAYS avoided, OPEN_ALWAYS plus an emptying call is the whole of create-and-truncate; without the call an existing file keeps its content.",
"find": [" (true, true, false) => (OPEN_ALWAYS, true),\n"],
"replace": [" (true, true, false) => (OPEN_ALWAYS, false),\n"]
},
{
"name": "DI-13.2: a new file is created through a link that is already there",
"file": "src/windows_backend/opened_file.rs",
"expect": "caught",
"why": "std added FILE_FLAG_OPEN_REPARSE_POINT for a new file, so CREATE_NEW does not follow a link; the open moved off std and keeps that.",
"find": [" let reparse = if self.create_new {\n FILE_FLAG_OPEN_REPARSE_POINT\n"],
"replace": [" let reparse = if self.create_new {\n 0\n"]
},
{
"name": "DI-13.2: the emptying step is skipped",
"file": "src/windows_backend/opened_file/open_request.rs",
"expect": "caught",
"why": "The emptying happens after the open, so it is tried on the call itself and not only on the parameters that ask for it.",
"find": [" if !parameters.truncate_after {\n"],
"replace": [" if true {\n"]
},
{
"name": "DI-13.2: a path longer than an ordinary one is handed over as it was",
"file": "src/windows_backend/opened_file/open_request.rs",
"expect": "caught",
"why": "The request crate refuses a path past MAX_PATH by design, and std did not, so the verbatim form is what keeps a long path opening.",
"find": [" Ok(verbatim(&absolute))\n"],
"replace": [" Ok(path.to_path_buf())\n"]
},
{
"name": "DI-13.2: a file is no longer shared for deletion",
"file": "src/windows_backend/opened_file/open_request.rs",
"expect": "caught",
"why": "std shared every file for reading, writing and deletion, and the share mode is the open's own to state now that std no longer does.",
"find": [" .with_share_mode(FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE)\n"],
"replace": [" .with_share_mode(FILE_SHARE_READ | FILE_SHARE_WRITE)\n"]
}
]
}