From 9cbed7f34314aa72b4bee0ca4bd944bbb2b5670d Mon Sep 17 00:00:00 2001 From: Mike Grier Date: Thu, 22 Oct 2026 15:08:52 -0400 Subject: [PATCH] test(platform-probes): a build-identity test that cannot tell the two probe crates apart says so instead of failing this_crate_reads_its_own_stamps_not_the_placement_probes asserted that this crate's version and windows-placement-probe's differ, to be sure it could tell their stamps apart. Both are calendar-versioned, so a release of both on one day gives them one version, and the release pull request that bumped both on 2026-10-22 failed five CI jobs on it. The test now asks a pure function, whose_stamps, whether the versions can say whose stamps an identity carries: ours, the placement probe's, or not knowable when the versions coincide. In that last case it prints why and passes. whose_stamps is tested in both directions, including that equal versions answer neither way. The case that failed CI was reproduced by giving both crates one version, where the old test failed and the new one passes and prints the skip. What this leaves unchecked on a day both crates are released is this_build() being rewired to the placement probe's BuildIdentity::current(). That is recorded in the design notes with what would change the answer (a crate name in BuildIdentity, not chosen), and declared in the sabotage manifest's notCoveredHere, since an entry for it would be caught or missed by the date. Chosen by the engineer, 2026-10-22, from three options. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../windows-platform-probes/DESIGN-NOTES.md | 17 ++++- crates/windows-platform-probes/sabotage.json | 1 + .../src/build_identity/tests.rs | 75 ++++++++++++++++++- 3 files changed, 89 insertions(+), 4 deletions(-) diff --git a/crates/windows-platform-probes/DESIGN-NOTES.md b/crates/windows-platform-probes/DESIGN-NOTES.md index 78d1f6155..eb156e180 100644 --- a/crates/windows-platform-probes/DESIGN-NOTES.md +++ b/crates/windows-platform-probes/DESIGN-NOTES.md @@ -2574,7 +2574,22 @@ one commit agree while their sources may differ; the capture README is still the built for those, and for every capture taken before this. And the build identity does not replace the scripts' refusal of byte-identical runs: it names the build, which every run in a capture shares. -**Scheduled work:** none. +**A test cannot tell this crate's stamps from the placement probe's on a day both are released.** The +engineer, 2026-10-22, choosing the first of three options put to him. `this_build()` is stamped under this +crate's names and the placement probe's `BuildIdentity::current()` under its own, and the one test that +holds the two apart reads the crates' versions. Both crates are calendar-versioned, so a release of both +on one day gives them one version, and the release pull request of that day failed on it (the test +asserted the versions differ). The test now asks a pure function, `whose_stamps`, whether the versions +can say, and when they coincide it prints that it cannot tell and passes; `whose_stamps` is tested in +both directions. What this leaves unchecked on such a day is `this_build()` being rewired to the +placement probe's `BuildIdentity::current()`: the compiler already refuses the other crate's stamp +variables, so that rewiring is the one way left to read the wrong crate. The skip is visible only with +the test's output shown. **What would change the answer** is a crate name in `BuildIdentity`, so that +the check holds on every date; that is a change to `windows-placement-probe`'s public type and to what a +report renders, and was not chosen. No sabotage entry covers the rewiring, for the reason in +[sabotage.json](sabotage.json)'s `notCoveredHere`. + +**Scheduled work:** none; the crate name in `BuildIdentity` is not scheduled. ## Every probe's normal run emits a row of raw data diff --git a/crates/windows-platform-probes/sabotage.json b/crates/windows-platform-probes/sabotage.json index 316c3dd2b..294cc8dd4 100644 --- a/crates/windows-platform-probes/sabotage.json +++ b/crates/windows-platform-probes/sabotage.json @@ -1,6 +1,7 @@ { "description": "Sabotage manifest for windows-platform-probes. Each entry is a defect that was actually run by hand while building M3; the manifest exists so those one-off verifications stop being discarded. See CHECKLIST.md M2.14.1. Run with --all-features because the corpus target, tests/a_real_report_agrees_with_itself.rs, requires oracle-in-renderer: with default features it is not built, so an entry only that target catches -- a wrong arm in its codes_for, for one -- would be scored as surviving.", "package": "windows-platform-probes", + "notCoveredHere": "this_build() reading windows-placement-probe's stamps in place of this crate's has no entry here, because whether a test can see it depends on the date: the two crates are calendar-versioned, the version is all that tells their identities apart, and on a day both are released they carry one version, so the test that holds it (build_identity::tests::this_crate_reads_its_own_stamps_not_the_placement_probes) says it cannot tell and passes. An entry would be caught on most days and survive on those, so a sweep's result would follow the calendar and not the code. The compiler already refuses the wrong crate's stamp variables, which leaves the rewiring to the placement probe's BuildIdentity::current() as the one way to read it. What would close it is a crate name in BuildIdentity, which the design notes record.", "testArgs": ["-p", "windows-platform-probes", "--locked", "--all-features"], "sabotages": [ { diff --git a/crates/windows-platform-probes/src/build_identity/tests.rs b/crates/windows-platform-probes/src/build_identity/tests.rs index f233a9f00..dce23530f 100644 --- a/crates/windows-platform-probes/src/build_identity/tests.rs +++ b/crates/windows-platform-probes/src/build_identity/tests.rs @@ -33,16 +33,85 @@ fn the_build_script_stamped_a_commit_exactly_when_a_repository_was_there() { } } +/// Whose stamps a build identity read, as far as the crates' versions can say. +#[derive(Debug, PartialEq, Eq)] +enum Reading { + /// The identity carries this crate's version. + Ours, + /// The identity carries the placement probe's version, so it read the wrong crate's stamps. + Theirs, + /// The two crates' versions coincide, so the version cannot say whose stamps were read. + CannotTell, +} + +/// What `identity` says about whose stamps it is, given this crate's version and the placement +/// probe's. Both crates are calendar-versioned, so released on one day they carry the same version, +/// and then nothing in a `BuildIdentity` tells them apart. +fn whose_stamps(identity: &str, ours: &str, theirs: &str) -> Reading { + if ours == theirs { + Reading::CannotTell + } else if identity == ours { + Reading::Ours + } else if identity == theirs { + Reading::Theirs + } else { + panic!("an identity carrying neither crate's version: {identity}") + } +} + +#[test] +fn a_reading_is_ours_theirs_or_unknowable_by_the_two_versions() { + assert_eq!( + whose_stamps("2026.1022.0", "2026.1022.0", "2026.1021.0"), + Reading::Ours + ); + assert_eq!( + whose_stamps("2026.1021.0", "2026.1022.0", "2026.1021.0"), + Reading::Theirs + ); + // The two directions of the same fact: equal versions cannot be told apart whichever way the + // identity was read, so neither answer is given. + for identity in ["2026.1022.0", "2026.1021.0"] { + assert_eq!( + whose_stamps(identity, "2026.1022.0", "2026.1022.0"), + Reading::CannotTell, + "{identity}" + ); + } +} + +#[test] +#[should_panic(expected = "carrying neither crate's version")] +fn an_identity_carrying_neither_version_is_an_error_not_a_reading() { + whose_stamps("2026.1020.0", "2026.1022.0", "2026.1021.0"); +} + #[test] fn this_crate_reads_its_own_stamps_not_the_placement_probes() { // The two crates are stamped by the same code under different names, so // reading the wrong crate's stamp would compile and report a plausible - // identity. The version is what tells them apart. + // identity. The version is what tells them apart -- and only while they differ: + // both crates are calendar-versioned, so a release of both on one day gives + // them one version, and then this test cannot tell, which is a fact about the + // versions and not a failure of the build. It says so rather than failing, and + // the design notes record what that leaves unchecked. let placement = windows_placement_probe::build_identity::BuildIdentity::current(); - assert_ne!( + let reading = whose_stamps( this_build().crate_version, + env!("CARGO_PKG_VERSION"), placement.crate_version, - "the two crates' versions coincide, so this test cannot tell them apart" ); + match reading { + Reading::Ours => {} + Reading::Theirs => panic!( + "this crate's build identity carries the placement probe's version, so it read the \ + placement probe's stamps" + ), + Reading::CannotTell => eprintln!( + "the two probe crates share the version {}, so this test cannot tell whose stamps \ + this_build() read", + env!("CARGO_PKG_VERSION") + ), + } assert_eq!(this_build().crate_version, env!("CARGO_PKG_VERSION")); }