TryGetOtherEndpoint's bool return was dead control flow: when a mutant
flipped its `return false` guard to `return true`, `other` stayed a clone
of `coord` (only one component would have been incremented on the true
path that never runs for that guard), so the caller compared a sample
against itself and behaved identically either way. That produced the
equivalent survivors at Extract's :92 continue and the guard's :198
return.
Bound the edge loop with the same condition (coord[axis] < cellCounts[axis])
directly, computing `other` inline once the bound holds. One path instead
of two that happened to agree; the helper is gone, and so is the `continue`
that used to depend on it. Behaviour is unchanged: verified with a
before/after run of the existing suite plus a temporary harness comparing
Extract's Positions/Quads/QuadEdges against ca220a5's code on sphere,
non-cubic, open-plane (each axis), checkerboard, and minimal 2x2x2
fixtures - all byte-for-byte identical.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Mutating obj is CultGeometryGridEdge other && Equals(other) to && true
passed the suite: nothing exercised object.Equals directly with a mismatched
X/Y/Z/Axis, null, or an unrelated type. Add a behavioural test that checks
each component independently, rejects null and other types, and agrees with
the typed Equals and GetHashCode.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The provenance doc still described the deleted geometric winding rule
(diagonal cross product must have a positive dot product with the
inside->outside direction) as the spec. That rule was replaced by the
inside-flag times per-axis handedness table (OrientationSign: +1, -1, +1;
axis 1's perpendicular pair (X, Z) is left-handed) when the geometric
fallback was deleted. State that as the actual rule, with the
outward-cross-product property following only on non-degenerate quads.
Also record that non-finite isoValue/origin are rejected.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The `==`->`!=` and `< 0`->`> 0` mutants on Extract's orientation check are
both Killed. The one survivor, `OrientationSign[axis] <= 0`, is an
equivalent mutant, not a coverage gap: OrientationSign only ever holds ±1,
so `< 0` and `<= 0` agree on every value it can produce. No vstest
coverage-based false survivor has actually been confirmed for
GameCult.Geometry; remove the withdrawn claim and keep the correct notes
about full-SHA --since, safe.directory, and config-change scope fan-out.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Stryker's diff-scoped run against this cut reported CultGeometrySurfaceNets
.Extract's `if (inside == (OrientationSign[axis] < 0))` - the sole authority
for quad winding after F4's fix deleted the geometric cross-product fallback
- as a Survived Equality mutation (== -> !=). Hand-mutating it and running
dotnet test directly failed 4 of 38 SurfaceNetsTests (the three per-axis
corner-order tests and the outward-winding test), confirming it is a real
vstest coverage-based test-selection miss, not a genuine gap. Recorded this
as a second confirmed case alongside the mtp/static-readonly-initializer
caveat, per this cut's verification requirement to hand-confirm any survivor
that looks like it must be covered.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The three TryGetOtherEndpoint survivors were triaged as a vstest coverage
false-survivor, mirroring the confirmed mtp/static-readonly caveat above.
That triage was wrong: the actual mutant is `return false` -> `return true`
inside each per-axis guard, which is equivalent (it makes the method report
an edge going nowhere, so the caller compares a sample against itself and
skips it exactly as it would with a correct `false`). Rewrote the paragraph
to say so, and removed the unsupported claim that this project has a
confirmed vstest false-survivor case. Also recorded, per this cut's
verification requirements, that `--since` needs a full commit SHA and that
`safe.directory` must be set in a container.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Fixed An_extremely_small_edge_delta_falls_back_to_the_edge_midpoint (renamed
A_tiny_but_normal_edge_delta_...): it pinned the wrong value (1/6) for the
fallback that F3's production commit deleted; now asserts the exact
interpolated value, hand-derived in double precision independently of
Interpolate. Added a genuinely subnormal-delta sibling test.
- Added two more vertex-placement fixtures (crossing counts 4 and 6) to kill
the sum/count -> sum/3 mutant, each with a hand-derived expected mean.
Counts of 1 and 2 from the finding are not used: a single cell's 12 edges
form the cube graph Q3 (3-regular, 8 vertices), whose edge-cut size for any
corner sign pattern is never 1 or 2 for any nonzero cut (minimum nonzero
cut is 3, already covered by the existing symmetric/unequal fixtures) -
see the fork note in this cut's report.
- Added three corner-order pinning tests (one per axis), each asserting the
exact welded vertex at each of Quads[0..3] for a chosen edge against a
hand-computed position, including the axis-1 v1/v3 swap that F4's fixed
OrientationSign now performs. These kill the axis-0-mirrored, c0/c2-swapped
and equivalent per-axis corner-order mutants.
- Added four degenerate-quad orientation tests (sample exactly at iso,
large-origin/tiny-cellSize sphere, octahedron at iso, tiny-tolerance
sphere) asserting every shared undirected edge is traversed in opposite
directions (net zero), via a new AssertEdgeDirectionsBalance helper that
also covers the 4-use case. Restricted the existing
Every_quad_winds_outward_from_inside_to_outside test's geometric check to
non-degenerate (non-zero cross product) quads, per spec.
- Added Grid_edge_inequality_is_the_negation_of_equality (F6: != is compiler-
mandated alongside ==, and needed its own direct test) and
A_non_finite_sample_is_rejected (F7: NaN and +-Infinity samples).
All 38 SurfaceNetsTests pass; the 7 pre-existing GeometryDocumentTests
failures from CultLib commit e420410 are untouched.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
F1: Extract's locals (position, v0..v3) were assigned through pattern-match
and short-circuited out-var chains whose definite-assignment analysis breaks
under a single mutated operator, so Stryker's Safe Mode dropped all 98
mutants in Extract as compile errors. Restructured to plain null checks and
a for-loop over a uint[4] so every local is unconditionally assigned; no
mutation of a boolean operator can make it fail to compile.
F3: deleted the `<= 1e-20f` fallback in Interpolate. A straddling edge always
has delta > 0 (.NET preserves subnormals), so the guard only ever replaced a
correct interpolated value with a wrong 0.5 midpoint.
F4: deleted the per-quad geometric cross-product winding test. Orientation
now comes only from the topological inside/outside flag plus a fixed
per-axis handedness sign (OrientationSign; axis 1's (X, Z) perpendicular
pairing is the one left-handed case, X x Z == -Y). This is now determined
purely by which endpoint of the crossing edge is inside and the axis, never
by quad geometry, so degenerate (zero-area) quads orient consistently with
their neighbours instead of falling back to an unstable dot-product sign.
F7: Extract now rejects any non-finite sample (NaN or +-Infinity) with
ArgumentException, in the same style as the existing shape/cellSize checks.
F8: collapsed three duplicated (edge, axis) mappings - TryGetOtherEndpoint's
per-axis switch, the three Axis*EdgeStarts tables plus the axis==0?1:0
ternaries in AccumulateAxisEdges, and TryGetQuadCells' three axis-specific
corner blocks - into one PerpAxes/PerimeterLoop table pair, used by all
three. Replaced the three duplicated `<= isoValue` inside tests with one
IsInside predicate. Deleted the per-axis trailing `InRange(x, cellsX)` /
`InRange(y, cellsY)` / `InRange(z, cellsZ)` checks (provably always true,
since TryGetOtherEndpoint already guarantees the edge's own-axis coordinate
indexes a valid cell) and the explicit TryGetValue+throw invariant guard
(the four cells around a crossing edge are proven to always have a vertex;
a direct dictionary index now fails loudly via KeyNotFoundException if that
invariant is ever actually violated, with no reachable branch to maintain).
F6: deleted CultGeometryGridEdge's <, >, <=, >= operators (CultGeometryQuadMesh.cs).
Nothing in production or tests used them; ordering goes through CompareTo.
!= is kept only because C# requires it whenever == is defined (CS0216).
Builds clean; does not touch CultGeometryIsoSurface.cs, CultGeometryDocuments.cs,
or ISOSURFACE-PROVENANCE.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Three TryGetOtherEndpoint boundary-guard mutants (per-axis "if (x + 1 >=
sizeX) return false;" forced to "if (true) return false;") were reported
Survived despite being exercised by the X/Y/Z open-boundary tests. Hand-
mutating all three and running dotnet test directly failed 11 of 24
SurfaceNetsTests, confirming a vstest-runner coverage-attribution false
survivor (same class of caveat already recorded for CultMath's mtp runner,
here under the default runner). Recorded under Known tool caveat.
Separately, adding stryker-config.json in the same cut that first uses it
defeats --since line scoping: Stryker fell back to mutating the whole
GameCult.Geometry.csproj glob ("Non-CSharp files in test project were
changed"), not just the new files, which is why the run's survivor list
includes CultGeometryIsoSurface.cs, CultGeometryDocuments.cs, and
CultGeometryPrimitives.cs. Recorded under Follow-ups so a later diff-only
cut isn't surprised by the difference.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A --since:29e50ad Stryker pass found real gaps, all inside this cut's own
files:
- vertex-placement and normals fixtures anchored a vertex at the world
origin, so a mutated (+ instead of -) or dropped cellSize multiply was
invisible against a zero operand; moved them off the origin;
- the cube normals test only checked length, and three orthogonal
+-2-length face contributions summed to the same length no matter which
one a mutant negated; now checks the exact expected direction per vertex;
- the open-boundary rule only had an X-axis test, leaving TryGetQuadCells's
Y- and Z-axis guards (and TryGetOtherEndpoint's Y/Z cases) uncovered;
added the Y- and Z-axis twins of the existing plane test;
- the 1e-20 near-zero-delta fallback in Interpolate was never exercised;
added a fixture with an edge delta of ~3e-21;
- CultGeometryGridEdge's Equals and ToString had no direct test.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The 4x4x4 pure-checkerboard field had no fully-interior cell: every active
cell bordered the array edge, so some crossing edges lost a quad to the open-
boundary rule and edge usage came out odd (observed: all-3) for reasons
unrelated to the ambiguity the test means to exercise. Wrapped the
checkerboard in a one-sample uniform-outside margin (5x5x5 grid, checkerboard
only on samples 1..3) so every crossing edge under test keeps all four
surrounding cells in range, isolating the even-but-not-2 claim from
open-boundary effects.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Two spots failed to build: a method-group reference to float.IsFinite and an
`is 1 or 2` pattern inside a lambda that FluentAssertions compiles as an
Expression<Func<T, bool>>; expression trees can't contain pattern-matching
`is`, and a method group isn't implicitly convertible to an expression tree
either. Rewritten as explicit lambdas with `==`/`||`.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds SurfaceNetsTests.cs and QuadNormalsTests.cs covering the sign
convention, edge naming, outward winding, vertex placement (midpoint and
unequal-crossing means, origin/cellSize), closed-sphere welding and
Euler characteristic, an ambiguous checkerboard cell's even-but-not-2 edge
usage, open-boundary quad suppression, determinism/ordering, and
face-weighted normals (sliver-vs-large-quad area weighting, unit cube
normals, zero-area/untouched-vertex degenerate case). Adds
stryker-config.json (vstest runner; this project is NUnit 4, not xunit.v3)
and records GameCult.Geometry as scoped, diff-only, in
docs/mutation-testing.md's follow-ups.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Implements CultGeometrySurfaceNets.Extract (welded CultGeometryQuadMesh, one
quad per interior crossing grid edge, outward-oriented winding) and
CultGeometryQuadNormals.FaceWeighted (unnormalized diagonal-cross-product
area weighting, matching CultGeometryIsoSurface's sign convention and
degenerate-normal rule). Fresh implementation per SURFACE-NETS-PROVENANCE.md;
no code or tables copied from the cited literature.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Stryker.NET becomes CultLib's mutation tool (CultMath config, baseline 2243
mutants, 350 survived). Behavioural tests close the three areas Aetheria
leans on: the BatchMath SIMD body, first_order_intercept's branches, and
equality and comparison across the vector types. 350 -> 264 survivors;
Soul passed the cut after one accumulation test was added.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul's pass on 41440cb found BatchMath.cs:115
(AddRadialFalloffAcceleration2D(ReadOnlySpan<float2>, ...)) accumulates
onto the caller's acceleration buffer, but no test ever seeded that
buffer with nonzero values: mutating += to = passed all 133 tests. The
float-array overload already had this guard
(RadialFalloffAccumulatesOntoExistingAcceleration); add the float2
equivalent, with a nonzero, per-element-distinct starting buffer, mixing
in-range and out-of-range particles so both the accumulated and
unchanged-seed cases are checked.
Checked every other += site in BatchMath.cs for the same gap: the
array-overload's scalar tail and vector body, and both
IntegrateSemiImplicitEuler2D overloads, all already seed their
accumulator buffers (vx/vy/px/py, velocity/position) with nonzero,
per-element values in their existing tests. Only this one site was bare.
Verified by hand-mutating BatchMath.cs:115 (+= to =): the new test fails
(expected 6.78, actual 0.48); reverted the source byte-exactly after.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The vector-vector self-tie added in the previous commit does not cover
float2/float3/float4's vector-scalar and scalar-vector overloads: their
existing no-tie fixture (a distinct vector against a single scalar) never
had a component equal to that scalar, so their boundary-flip mutants
(< to <=, > to >=) kept surviving. Add a uniform vector (every component
the same value) against a scalar equal to that value, tying every
component of both scalar overloads at once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The no-tie fixture in each *ComparisonOperatorsDifferPerComponent test
correctly kills direction mutations (< swapped for >) but leaves every
strict/non-strict boundary swap (< to <=, > to >=) surviving, since with
no equal component the two behave identically. That default is
appropriate for a float-threshold epsilon check, but these are
general-purpose vector comparison operators (CultMath's own
RectIntersectionTreatsTouchingEdgesAsContact test compares literal
endpoints), and for the int types an exact tie is the routine case, not
the rare one. Add a complementary "compared against itself" call per type
(vector-vector for double2/double3/int2/int3/int4, plus vector-scalar and
scalar-vector for float2/float3/float4) so every component ties and the
boundary swaps are actually exercised.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`Precision` was declared `const float`, so `Assert.Equal(a, b, Precision)`
bound to xunit's absolute-tolerance overload (allowing any two values
within 4.0 of each other) instead of the intended 4-decimal-place
overload. Hand-mutating the `t2 > 0 ? min(t1, t2) : t1` ternary to always
return `t1` (math.cs:287) exposed it: the assertion silently accepted a
result almost 0.27 away from the expected value. Declaring it `const int`
selects the correct overload; confirmed the same hand mutation now fails.
Also add the float2-overload euler-integration length-validation test the
mutation report showed missing (BatchMath.cs:208's ValidateEqualLengths
call had no test at all).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul-style self-check against the actual mutation report (not just green
tests) found several fixtures whose values coincidentally produced the
same output on the buggy path as on the correct one:
- BatchMath's scalar-tail fixtures put the one remainder particle/step
either outside the falloff radius or mask-frozen, so the y-axis
arithmetic a mutation would touch was never reached with an observable
effect. Pin the remainder particle in range (radial falloff) and dynamic
(Euler integration) so the scalar tail's own math is exercised, not just
the vector body's.
- The float2-overload of AddRadialFalloffAcceleration2D had no no-op
(radius <= 0 / strength == 0) test at all.
- first_order_intercept_time's negative-determinant test used a
perpendicular relative velocity, making b = 2*dot(vel, pos) exactly
zero; a mutant that drops the "no solution" branch entirely and falls
through to the linear fallback coincidentally computes 0 too. Use a
non-perpendicular fixture so the fallback's nonzero value is
distinguishable from the correct zero.
- No fixture ever reached the `t1 > 0` branch at all (a > 0, both
quadratic roots real and positive), so the boundary/negate checks
guarding it and the `t2 > 0 ? min(t1, t2) : t1` line were never
covered. Add that case.
- bool2.@false/@true, bool3.@true and bool4.@false have no consumer
anywhere in the suite (bool3.@false and bool4.@true are read by
HlslSemanticsTests); pin all six vector constants directly.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul: a git-URL package lands read-only in Unity's cache, where a file with
no meta is warned about and ignored on every import.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Hand-verified that weakening float3.Equals from && to || passes the whole
suite. The same shape recurs with no shared base type across float2/3/4,
double2/3, int2/3/4, bool2/3/4, quaternion, float2x2 and float3x3. Add
data-driven tests, per component position, that a value differing at
exactly one component is unequal under Equals/==/!=, that GetHashCode
stays consistent with Equals, and that </>/<=/>= (including the
vector-scalar and scalar-vector overloads on the float types) each report
a different result per component. float2x2/float3x3 are covered at row
granularity since they have no == operator; quaternion and bool2/3/4 have
no ordering operators and are covered for equality only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
math.first_order_intercept_time had a single closing-target test. Add
coverage for zero relative velocity, the a-approx-zero linear fallback, a
target that outruns the projectile (negative determinant), a receding
target with both quadratic roots non-positive, and a closing case with
off-origin, off-axis shooter and target state. The closing cases assert
that the projectile (inheriting the shooter's velocity) and the target
actually coincide at the returned time; the no-solution branches pin the
value the source's own contract specifies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both existing BatchMath tests used 2-3 particles while LaneCount >= 4, so
only the scalar tail ever ran, and both held y at 0 for every particle, so
every y-axis mutation was invisible. Add fixtures sized LaneCount * 3 + 1
with distinct nonzero x/y per particle, pinned against a scalar reference
computed independently in the test, plus explicit coverage of the early
return, negative deltaTime, length-mismatch, and empty-span guards on all
four BatchMath overloads.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
math.erf/math.erfinv (source, tests, README) already landed on main via
87b95ae, b688cb2, fc9ce97, 4cdc02b, 6e8362b, cc71f17. This is the release
step 0.2.3 skipped needing: bump the package version, rebuild the tracked
Unity DLL/pdb deterministically, and add the CHANGELOG.md this package
never had (docs/semver-policy.md names this exact gap).
- packages/cultmath/src/CultMath/CultMath.csproj: Version 0.2.3 -> 0.2.4.
- packages/cultmath/unity/org.gamecult.cultmath/package.json: 0.2.3 -> 0.2.4.
- packages/cultmath/unity/org.gamecult.cultmath/CHANGELOG.md: new, [0.2.4]
entry only (Added: erf, erfinv). Earlier versions are not backfilled, per
the semver policy's own ruling on this package's pre-existing gap.
- packages/cultmath/unity/org.gamecult.cultmath/Runtime/Plugins/CultMath.dll
and .pdb: rebuilt via packages/cultmath/scripts/build-unity-package.ps1
(dotnet build, netstandard2.1, Release, --no-incremental, no Source Link).
Built on Windows; the assembly is platform-neutral IL. The script's own
determinism check (fresh build hash == tracked hash) and its version-parity
check (package.json version == assembly FileVersion) both pass.
- No HLSL mirror change: erf/erfinv are C#-only, and
packages/cultmath/shaders/CultMath.hlsl already matches the copy under
unity/org.gamecult.cultmath/Shaders/CultMath.hlsl byte for byte.
Verified independent of build-unity-package.ps1's own checks: a scratch
console app loaded the tagged cultmath-unity-v0.2.3 DLL and this build's
fresh DLL into separate AssemblyLoadContexts and diffed their public
surface. Only two members were added (math.erf(float), math.erfinv(float)),
none removed; AssemblyVersion/FileVersion/InformationalVersion match apart
from the 0.2.3 -> 0.2.4 bump; TargetFrameworkAttribute is unchanged
(.NETStandard,Version=v2.1). erf/erfinv round-trip and domain-edge behavior
(erfinv(+-1) = +-Infinity, erfinv(1.5) = NaN) verified by invoking the
loaded methods directly.
dotnet test packages/cultmath/tests/CultMath.Tests -c Release: 102 passed,
0 failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
What lands:
- Cut 3: the native MsQuic bridge, with the Windows release leg and F5
closed on both platforms, and the closerace fixture fix.
- Cut 4: the koffi Node binding, consumer, session manager and trust.
- Cut 5: the TS provider. It reaches the C# native connector, which is
the Unity overlay's path, on Windows.
- Fix batches 1-4: use-after-free, handler isolation, the
handshake-timer eviction, the koffi allocation leak, one C#-shaped
inbox, encode-once, advertisedHost, publish-only
(acceptClientFrames: false), and maxConnections.
- Retention: the provider seeds late joiners with the newest
latest-only frame per (channel, body), in TS and C#.
- Cut 6, narrowed: native binaries committed under
packages/cultmesh-ts/native, built by Actions. A second from-scratch
build reproduced them byte for byte.
Gates: four Opus Soul passes on the runtime and one Sonnet pass on the
packaging. The last runtime pass found that the connection death under
load was the old handshake eviction, which fix 3a had removed, and it
confirmed StreamPixels' load (60 Hz latest-only for 10 minutes) with
flat memory.
Also carried, per the operator's ruling: CultMath erf/erfinv (Cut 12.0
and its fix batch) from the branch base.
Map conflicts were resolved in favour of main, which owns the maps. The
only branch-side lines main lacked were a Cut 3 "still outstanding"
block that main's closure supersedes.
Open follow-ups, recorded on the map: IPv6-literal endpoints cannot be
dialled; consumer-side native queues are unbounded while Unity is not
polling; a client can see connect() resolve past maxConnections before
the refusal arrives; subtraction (about -130, mostly comments) is
deferred.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul found that on a Windows clone (core.autocrlf=true) SHA256SUMS and
MANIFEST.txt were written with CRLF, so the documented
`sha256sum -c SHA256SUMS` failed on every line: each filename ended in
\r. CI stayed green only because it checks out on Linux. After this
rule and a fresh checkout, the check passes on Starfire for all four
binaries.
Provenance, recorded here because verify-committed only checks the
committed files against the committed sums: run 35912901846 rebuilt
all four binaries from scratch after they were committed, and every
artifact is byte-identical to the committed file (libmsquic.so.2
c09a72f9..., libgamecult_mesh_quic_native.so 0ee3d283..., msquic.dll
c17c6581..., gamecult_mesh_quic_native.dll 9dae391a...). Two
independent CI builds produce the same bytes, which shows both where
they came from and that the build is reproducible.
Self edited this one-line config directly instead of dispatching Hands.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`cultmesh-quic-native-{win32-x64,linux-x64}.tar.gz` collided by substring
with the negative grep for the parked `@gamecult/cultmesh-quic-native-*`
platform package names (11.9, not built in this campaign). Rename to
`quic-native-{win32-x64,linux-x64}.tar.gz`, matching the upload-artifact
names already used. The release job has not run (no tag pushed), so this
has no runtime effect yet.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The binaries are committed and verify-committed went green on the trigger's
own run (https://github.com/GameCult/CultLib/actions/runs/35912901846).
Reverts quic-native.yml to the triggers named in cut 6 (docs/typescript-
quic-realtime-cut.md:2153-2156): push to main and pull_request run
verify-committed only, workflow_dispatch runs the two builds, a
cultmesh-quic-native-v* tag runs all four. Diff against 4d75d90 (the file
before the temporary trigger was added) is empty.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Downloaded from the TEMPORARY push-triggered run
https://github.com/GameCult/CultLib/actions/runs/35912386052 (commit
e5bf1c9), built by build-win32-x64 and build-linux-x64 in quic-native.yml.
Every file's digest was verified against the job logs before this commit
(win32-x64/msquic.dll's also matches build-quic-native.ps1's own pinned
expectedRuntimeSha256, confirming it is the pinned MsQuic 2.5.9 runtime).
win32-x64/gamecult_mesh_quic_native.dll 9dae391a44d59f12e19baa08a44d86c7e8b4916ca5d40007a42d65913ce0896f
win32-x64/msquic.dll c17c65813fe007eb486a5270d244f3659261355795b27abb99bd19ff77539263
linux-x64/libgamecult_mesh_quic_native.so 0ee3d28324c79a5b0135368187e7bd75c1969ad94fc6985755e81de4ec96e430
linux-x64/libmsquic.so.2 c09a72f9b3bfd9119044b305c6064731c1e1879411e6f54276474fb58b524b68
SHA256SUMS is generated sha256sum output over exactly these four relative
paths, committed verbatim. MANIFEST.txt records the pinned MsQuic sources,
the bridge commit, the run URL, and each build job's printed host/compiler
line; build.release notes this run used the TEMPORARY push trigger rather
than a tag, since no release exists yet.
Cut 6 (packaging), 11.5/11.7, Q8 Option 1: the operator (via this session)
downloads, verifies and commits; no workflow writes to the tree.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
workflow_dispatch cannot be dispatched against quic-cut6 until this workflow
file is registered from the default branch (a GitHub constraint, not a
permissions gap: `gh workflow run` and a raw dispatch API call both 404).
Rather than touch main or push a tag, add push: branches: [quic-cut6] and
extend verify-committed's and both build jobs' `if:` guards with a
`refs/heads/quic-cut6` arm, so this push itself runs the three jobs. The
release job's guard is untouched: it still matches only a
cultmesh-quic-native-v* tag, so this push does not create a release.
Every added line is marked TEMPORARY and paired with its match; both are
removed in one commit once the binaries are committed and verify-committed
goes green on that push.
Cut 6 (packaging).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Four jobs: verify-committed checks packages/cultmesh-ts/native/SHA256SUMS
against the tree on every push to main and every pull request; build-win32-x64
and build-linux-x64 run scripts/build-quic-native.{ps1,sh} on
workflow_dispatch or a cultmesh-quic-native-v* tag and upload their output as
artifacts; release, needing both builds and gated to the tag push, is the
only job with write permission and attaches the two platform archives plus a
committed-format SHA256SUMS and a draft MANIFEST.txt to a GitHub Release.
build-linux-x64 runs inside the pinned debian:13@sha256:f324c7ff… container
per Q6 A: the Actions container is the only permitted Linux release builder,
because the artifact links against that image's glibc and the deploy host
(Yggdrasil) runs the same OS. No release or tag has been pushed by this
commit; the release job exists but has not run.
Cut 6 (packaging), docs/typescript-quic-realtime-cut.md:2131-2156, narrowed
per StreamPixels cut map section 4.3.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The package directory must be self-contained once copied out of the repo
(pnpm materialises only `files`), so the licence text already committed
beside the Unity plugin binaries is copied here rather than referenced.
Same MIT text for both platforms. Cut 6 (packaging), 11.4.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The closure smoke already asserted dist/index.js and dist/index.d.ts for
every workspace package; extend it for cultmesh-ts to assert the four
committed native binaries plus SHA256SUMS, MANIFEST.txt and
MSQUIC-LICENSE.txt are in the packed file list, on every host. The tarball
carries both platforms; the host only decides which one loads. Cut 6
(packaging), 11.5/11.6.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
`* text=auto` already autodetects them by content, but that is a heuristic.
Say explicitly that packages/cultmesh-ts/native/**/*.dll and *.so(.N) are
binary so no future text-processing rule can apply EOL conversion and poison
the digests SHA256SUMS pins. Cut 6 (packaging).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The committed QUIC native binaries only reach a consumer if `files` carries
them: pnpm materialises a file: dependency from `files` alone, and the same
allowlist gates `npm pack` and the deploy `git archive`. Cut 6 (packaging).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The fixture fix (44ab376) lived only on quic-cut3-winrel. Cut 4 branched
from cc71f17 before it, so the QUIC line never carried it. This merges it
into quic-cut6 before packaging, so the release line runs the closerace
fixture whose poll timeout outlasts its own settle budget.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The synthetic connection P17 drives directly at acceptConnection() never
reaches CONNECTED (it was never dialed anywhere), so it never joins `peers`
either way — connectionCount alone couldn't tell "refused" apart from
"attached but still handshaking". Manually restoring the disposed-check's
removal and rerunning showed the original assertion passing regardless.
retain() is synchronous and only the attach path calls it, so comparing
CultMeshQuicNativeRuntime.refCount immediately around the acceptConnection()
call is what actually distinguishes the two: confirmed by hand that the
mutation now fails this test by assertion (2 !== 1) before restoring it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
P3 ("a latest-only send failure evicts the peer...") raced wall-clock
against a tight while-loop that does no real I/O per iteration (broadcast()
never awaits a latest-only peer's send), so it spun encoding and enqueueing
frames fast enough to starve the event-loop turns the native pump needs to
notice the dead connection — a self-inflicted race that any extra load in
the test process (mutation testing included, regardless of which line was
mutated) could push past the 2s bound with nothing to do with the mutant
under test. Fixed by decoupling how many attempts to seed (a small fixed
count, each with a real yield) from how long to wait for the result (one
waitUntil afterward).
New tests for mutants Soul found surviving by assertion:
- I1: an inbox key keeps its first-arrival queue position when a later
publish overwrites its value.
- L1: the outbox keeps one send in flight per peer, proven by
prototype-patching sendEncodedFrame to track concurrency (the provider
builds its peer transports internally, so this is the only vantage point
from outside the module).
- P15: broadcast() after dispose rejects.
- P17: an accept arriving after dispose is refused, not attached, driven
directly at acceptConnection() with a real (but otherwise unused) native
connection handle rather than a fabricated pointer.
Plus coverage for the new options: a publish-only provider faults a client
that sends to it and never queues anything, and a connection beyond
maxConnections is refused without disturbing existing peers.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Soul's probe proved a client can grow the provider's memory without limit
(20k reliable frames plus 20k distinct latest-only keys took
receiveQueueSize to 40000 and RSS from 97 to 318 MB) because StreamPixels
never calls receive() to drain it, and there was no cap on connections
either. The pinned certificate only authenticates the server, so any
internet client can dial in.
Add acceptClientFrames (default true, unchanged for existing callers and
interop peers, which all use receive()): when false, any inbound stream a
peer opens faults that connection at STREAM_STARTED, before a frame can be
decoded or queued, so no inbox or generation-map entry is ever created for
client data, and receive() itself rejects clearly.
Add maxConnections (default 1024): a connection beyond the cap is refused
at accept, shut down before any transport, outbox, or retained-frame
seeding is allocated for it. Existing peers are unaffected.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This brings fix batch 3c (per-runtime out-buffers, freed on the last
release, plus a steady-state RSS test in its own child process) onto
the branch carrying fix batches 3a and 3b and retention.
The merge was automatic. Checked by hand: release() frees the reused
buffers only after the reference count reaches zero and the pump has
exited. retain() (from 3a) is called only while the provider already
holds a reference, so it cannot resurrect a runtime that is closing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Hand-mutating CultMeshRealtimeInbox.receive() to check `completed`
before the ready queue (so dispose() rejects an already-queued frame
instead of draining it first) found no existing test that dies for it.
Add one: two reliable-ordered frames sit in the provider's receive
queue, the provider is disposed, and both frames must still come back
from receive() before the next call rejects.
Verified by hand against the final code and restored, per the fix
batch's mutation list; not committed as a harness.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Reproduces Soul's probe directly: 20,000 client-sent latest-only frames
on one key, none ever drained by receive(), leave exactly 1 pending
frame in the provider's receive queue, and that frame carries the
newest sequence sent. A second test sends 20 frames across 50 distinct
keys and checks the queue holds exactly 50 (bounded by key count, not
frame count). A third proves reliable-ordered client frames are never
coalesced and stay in order at the provider.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Soul's probe found readyFrames growing without limit: a publish-only
consumer of CultMeshQuicRealtimeProvider.receive() (StreamPixels' Node
service) let a single unauthenticated client key grow the provider's
receive queue by one entry per frame sent, forever.
Replace CultMeshRealtimeLatestOnlyCoalescer plus the three separate
ready-queue/waiter implementations built around it (the transport's
inbound path, the provider's outbox pump, and the provider's own
readyFrames array) with one CultMeshRealtimeInbox<T>, shaped like the
C# reference's CultMeshRealtimeInbox: latest-only entries coalesce to
at most one pending value per (channel, body) key, keeping that key's
first-arrival queue position; reliable-ordered entries always queue,
unbounded; receive() drains whatever is queued before a complete(error)
rejects further calls.
The provider's pumpReceivedFrom now publishes into this inbox under the
frame's (channel, body) key instead of pushing onto an unbounded array,
so a slow or absent receive() caller backs up to at most one pending
frame per distinct key. Added provider.receiveQueueSize (test-visible,
mirrors the existing trackedStreamCount precedent) to make that bound
observable.
realtime-quic.ts: 1298 -> 1273 lines (HEAD 1b0c71d), -16 against the
275010a anchor. Soul estimated -90 to -120 from unifying four ~209-line
sites into one ~80-line class; the actual saving is smaller because two
of those sites already need their own promise/waiter/AbortSignal
plumbing in TypeScript (no Channel with native CancellationToken
support), so consolidating them removes duplication but the surviving
single copy of that plumbing is not itself small. No further
correctness-neutral cut was found without code-golfing working logic.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Without sendOnStream's disposed guard, the queued send never settles (no
event or sweep is left to reject it), so a bare assert.rejects(send, ...)
would hang the whole file instead of failing this one test. Race the send
against a 3s timeout that rejects with a different message, so the mutant
is a loud assertion mismatch either way the native layer happens to fail
first.
Verified by hand: reverted sendOnStream's `if (this.disposed)` guard to
`if (false)` locally, rebuilt, and ran P8 alone — it died by assertion in
81ms (a native stream-send error on the already-shut-down connection,
still not matching /disposed/i), not a timeout. Restored the guard before
committing. Also hand-verified fix 1 the same way: commenting out the
`clearTimeout(handshakeTimer)` on CONNECTED reproduces the original
handshake-timer eviction, and the new fix-1 test dies by assertion
(0 !== 1) rather than a hang.
Full Windows pass on Starfire after restoring: 158/158 cultmesh-ts tests
and all 5 QUIC interop tests (including the native-connector and
late-join lanes), msquic.dll confirmed as the pinned build (4,181,856
bytes, SHA-256 C17C6581...).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
By the time the memory test ran in-process, ~150 earlier tests in the
suite had already grown and partly freed the glibc heap, so a real
per-call native leak could land in already-mapped free space and never
show up as RSS growth in that process: confirmed by hand, the
in-process version of this test kept passing even with `nextEvent`
mutated back to allocating fresh koffi buffers every call, once it ran
inside the full suite rather than alone.
Spawn a dedicated `node --expose-gc` child process for the measurement
instead. A fresh process has no such history, matching the ~8 MiB
(fixed) vs ~30 MiB (pre-fix) split measured in isolation. Confirmed by
hand again with the same mutation: the child-process version now fails
reliably (~28.7 MiB growth) inside the full 150-test suite, not just
standalone.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The prior version opened connection B only after A had already faulted,
then asserted a boolean flag set by B's own CONNECTED event. That flag
never flipped on Linux: something about accepting a second connection
right after the first one's forced shutdown made the assertion
unreliable, even though A's fault itself isolated correctly (visible in
the log: the onFault throw fired once, promptly).
Rewritten to establish B as a normal, fully connected loopback pair
first, fault A only afterward, then prove B's handler is still live by
sending an actual frame on B and confirming the server side still
receives it — a stronger assertion than a connected flag, and one that
does not depend on a second connection's accept timing relative to a
fault that just tore another one down.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
P8's test opened a fresh reliable stream on the first send, so disposing
before its microtask ran hit streamOpen() against an already-shut-down
connection (its own native error) instead of ever reaching sendOnStream's
disposed guard. Prime the stream with an awaited first send so the second,
raced send chains straight onto sendOnStream with no streamOpen call in
between.
P10b's test registered connection A's and B's server-side listeners after
an `await`, the exact async-registration gap fix 1 exists to close: a
connection's next native event can be dispatched, and silently dropped
(no listener registered yet), before that await's continuation runs.
Register both listeners synchronously inside their LISTENER_NEW_CONNECTION
callback instead.
The IPv6 fix 3 test asserted the wrong expectation: WHATWG URL's own
`hostname` keeps the brackets for an IPv6 literal, so the round trip
through parseQuicRealtimeEndpoint correctly returns "[::1]", not "::1".
Confirmed via a Linux verify run (cultlib-quic-native-dev image): before
this commit, exactly these three new tests failed and every other test
(155) passed, including every other fix/P3 test added alongside them.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The 5 MiB bound was a guess and false-failed on the fixed code: 200k
direct `nextEvent` calls carry their own ~8 MiB RSS noise floor from
thread-pool marshaling and promise bookkeeping, even with zero
`koffi.alloc` calls in the loop. Measured on Yggdrasil, same build and
host, same 200k-call loop:
fixed code (0 koffi.alloc calls in the loop): ~8.0 MiB RSS growth
pre-fix code (400k koffi.alloc calls, unfreed): ~29.9 MiB RSS growth
18 MiB sits well above the fixed baseline and well below the leaking
one, so the test stays robust to ordinary run-to-run noise while still
catching the regression.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
