Silent corruption is the worst thing an embedded store can do — it fails the one promise that makes embedding acceptable. This subsystem gets disproportionate testing relative to the traversal algorithms, because the algorithms fail visibly and this fails invisibly.
Done when
- Reader fuzzing: no malformed or truncated input can crash, hang, or read out of bounds.
- Truncation sweep: cut a valid file at every offset; every result is a clean refusal.
- Crash consistency: interrupt a write at every offset, reopen, assert old-state-or-new-state.
- Runs under ASan + UBSan (
bin/dev asan), and the long fuzz lane is separable from the fast suite.
Depends on the persistence format issue.
Silent corruption is the worst thing an embedded store can do — it fails the one promise that makes embedding acceptable. This subsystem gets disproportionate testing relative to the traversal algorithms, because the algorithms fail visibly and this fails invisibly.
Done when
bin/dev asan), and the long fuzz lane is separable from the fast suite.Depends on the persistence format issue.