Overnight/test harness 2026 04 20

.gitignore

@@ -43,3 +43,4 @@ Thumbs.db
 /tests/torrent-test/peer*-data/
 /tests/torrent-test/peer*-index/
 /tests/torrent-test/results/
+.claude/

internal/companion/btree_encode_guards_test.go

@@ -49,6 +49,20 @@ func TestEncodeLeafEmptyRecords(t *testing.T) {
 	}
 }
 
+// TestEncodeLeafPropagatesEncodeRecordError covers EncodeLeaf's
+// `if err != nil { return nil, err }` arm inside the per-
+// record loop. Pass a record with an empty keyword so
+// EncodeRecord errors immediately, and verify EncodeLeaf
+// surfaces the error rather than producing a leaf with a
+// half-written payload.
+func TestEncodeLeafPropagatesEncodeRecordError(t *testing.T) {
+	t.Parallel()
+	bad := Record{Kw: ""} // EncodeRecord rejects empty keyword
+	if _, err := EncodeLeaf(0, []Record{bad}, MinPieceSize); err == nil {
+		t.Error("EncodeLeaf should propagate EncodeRecord errors")
+	}
+}
+
 // TestEncodeRecordOversizedKeyword — EncodeRecord rejects a
 // keyword longer than MaxKeywordBytes before attempting to
 // marshal. Same guard packLeaves uses, but exercised at the
@@ -61,3 +75,21 @@ func TestEncodeRecordOversizedKeyword(t *testing.T) {
 		t.Error("EncodeRecord should reject oversize keyword")
 	}
 }
+
+// TestEncodeRecordExceedsByteCap covers EncodeRecord's
+// `if len(out) > MaxRecordBytes { return error }` guard —
+// the post-marshal size check for records whose encoded form
+// pushes past the 256-byte cap. With Kw at the keyword limit
+// plus max-width Pow + T values, the bencoded form of a
+// recordWire crosses the boundary.
+func TestEncodeRecordExceedsByteCap(t *testing.T) {
+	t.Parallel()
+	r := Record{
+		Kw:  strings.Repeat("k", MaxKeywordBytes),
+		T:   1<<63 - 1,
+		Pow: 1<<64 - 1,
+	}
+	if _, err := EncodeRecord(r); err == nil {
+		t.Error("EncodeRecord should reject record whose encoded form exceeds MaxRecordBytes")
+	}
+}

internal/companion/build_btree_test.go

@@ -235,6 +235,27 @@ func TestBuildBTreeMultiLeafWalk(t *testing.T) {
 	}
 }
 
+// TestBuildBTreePropagatesPackLeavesError covers BuildBTree's
+// `if err != nil { return out, err }` arm after packLeaves.
+// Pass a record with empty keyword so packLeaves rejects;
+// BuildBTree must surface that error.
+func TestBuildBTreePropagatesPackLeavesError(t *testing.T) {
+	pub, priv, _ := ed25519.GenerateKey(rand.Reader)
+	var pk [32]byte
+	copy(pk[:], pub)
+	bad := Record{Kw: ""} // packLeaves rejects empty keyword
+	if _, err := BuildBTree(BuildBTreeInput{
+		Records:   []Record{bad},
+		PubKey:    pk,
+		PrivKey:   priv,
+		Seq:       1,
+		PieceSize: MinPieceSize,
+		CreatedTs: 1,
+	}); err == nil {
+		t.Error("BuildBTree should propagate packLeaves errors")
+	}
+}
+
 func TestBuildBTreeRejectsEmpty(t *testing.T) {
 	pub, priv, _ := ed25519.GenerateKey(rand.Reader)
 	var pk [32]byte

internal/companion/decode_leaf_errors_test.go

@@ -94,6 +94,38 @@ func TestEncodeTrailerBadVersion(t *testing.T) {
 	}
 }
 
+// TestDecodeTrailerBadKind — DecodeTrailer must reject a
+// page whose header decodes successfully but whose Kind is
+// not PageKindTrailer.
+func TestDecodeTrailerBadKind(t *testing.T) {
+	t.Parallel()
+	body := make([]byte, TrailerPayloadSize)
+	page := makeInteriorPage(t, PageKindLeaf, body, MinPieceSize)
+	if _, err := DecodeTrailer(page); err == nil {
+		t.Error("DecodeTrailer should reject leaf-kind page")
+	}
+}
+
+// TestDecodeTrailerWrongPayloadLength — a trailer whose
+// header.PayloadLength differs from TrailerPayloadSize must be
+// rejected before any body bytes are read.
+func TestDecodeTrailerWrongPayloadLength(t *testing.T) {
+	t.Parallel()
+	// Hand-build a page with PageKindTrailer but wrong payload
+	// length. encodeHeader clamps to uint16; pass a length
+	// smaller than TrailerPayloadSize.
+	page := make([]byte, MinPieceSize)
+	hdr := encodeHeader(PageHeader{
+		Version:       BTreeVersion,
+		Kind:          PageKindTrailer,
+		PayloadLength: 32, // not TrailerPayloadSize
+	})
+	copy(page, hdr)
+	if _, err := DecodeTrailer(page); err == nil {
+		t.Error("DecodeTrailer should reject mismatched PayloadLength")
+	}
+}
+
 // TestDecodeTrailerBadVersion — DecodeTrailer must reject a
 // trailer whose first payload byte (TrailerVersion) is not
 // 0x01. Hand-build the page since EncodeTrailer rejects bad

internal/companion/pack_leaves_internal_test.go

@@ -25,3 +25,18 @@ func TestPackLeavesRejectsOversizeKeyword(t *testing.T) {
 		t.Error("packLeaves should reject oversize keyword")
 	}
 }
+
+// TestPackLeavesSingleRecordTooLargeForPage covers the
+// `if len(cur) == 0 { return error }` arm of packLeaves.
+// Pass a tiny pieceSize so even a single normally-sized
+// record can't fit; packLeaves must surface the
+// "record too large" error rather than silently truncating.
+func TestPackLeavesSingleRecordTooLargeForPage(t *testing.T) {
+	t.Parallel()
+	r := Record{Kw: "ubuntu"}
+	// 100 bytes is well below the ~270 bytes a record encodes
+	// to, plus the 16-byte page header.
+	if _, err := packLeaves([]Record{r}, 100); err == nil {
+		t.Error("packLeaves should reject single oversized record")
+	}
+}

internal/companion/pow_test.go

@@ -91,6 +91,23 @@ func TestSignAndMineRecordRoundTrip(t *testing.T) {
 	}
 }
 
+// TestLeadingZeroBitsOfByteSliceEdgeCases covers the two
+// edge-case return arms of the pow.go-local copy of the
+// leading-zero-counter: the all-zero input (outer loop exits
+// without ever entering the inner mask loop) and the empty
+// input (outer loop never iterates).
+func TestLeadingZeroBitsOfByteSliceEdgeCases(t *testing.T) {
+	if got := leadingZeroBitsOfByteSlice(nil); got != 0 {
+		t.Errorf("leadingZeroBitsOfByteSlice(nil) = %d, want 0", got)
+	}
+	if got := leadingZeroBitsOfByteSlice([]byte{0x00, 0x00, 0x00}); got != 24 {
+		t.Errorf("leadingZeroBitsOfByteSlice(3 zeros) = %d, want 24", got)
+	}
+	if got := leadingZeroBitsOfByteSlice([]byte{0x00, 0x00, 0x40}); got != 17 {
+		t.Errorf("leadingZeroBitsOfByteSlice(2 zeros + 0x40) = %d, want 17", got)
+	}
+}
+
 func TestSignAndMineRecordRejectsBadPubLen(t *testing.T) {
 	_, priv, _ := ed25519.GenerateKey(rand.Reader)
 	var ih [20]byte
@@ -100,6 +117,26 @@ func TestSignAndMineRecordRejectsBadPubLen(t *testing.T) {
 	}
 }
 
+// TestSignAndMineRecordPropagatesPoWError covers the
+// `if err != nil` arm after MineRecordPoW. Pass bits=41 so
+// MineRecordPoW's "cost prohibitive" guard fires; the wrapped
+// error must surface from SignAndMineRecord without producing
+// a signed record.
+func TestSignAndMineRecordPropagatesPoWError(t *testing.T) {
+	pub, priv, _ := ed25519.GenerateKey(rand.Reader)
+	var ih [20]byte
+	r, err := SignAndMineRecord(priv, pub, "x", ih, 0, 41)
+	if err == nil {
+		t.Fatal("expected error for prohibitive bits=41")
+	}
+	// The returned record is the partial mined value; its Sig
+	// must remain zero since signing was skipped.
+	var zeroSig [64]byte
+	if r.Sig != zeroSig {
+		t.Error("Sig should be zero on PoW failure (signing skipped)")
+	}
+}
+
 // Sanity: recordPreimage and RecordSigMessage MUST produce
 // identical bytes — otherwise a miner would solve for one preimage
 // and a verifier would check a different one.