(12) test-clock - #1773

A destructor may run after Tokio's thread-local runtime context is
gone. If virtual time has been paused, reading the clock there panics
inside `Drop` and aborts the process without identifying the test.

Add an opengrep rule that rejects clock reads from `fn drop`. Match the
method itself because the Rust parser does not reliably constrain a
pattern to `impl Drop`.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Logs used wall time while expiry code used virtual time, so events
could not be correlated with the deadlines a test observed.

Stamp test logs with an offset from the routed clock. Use a checked
read so logging cannot panic when a thread lacks the active clock;
mark those records `off-clock` instead.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The pipeline property never aged its flows, so it could not detect a
flow that expired too early. Advancing time had previously been
meaningless because waits and deadlines read different clocks.

Draw waits as part of the generated schedule and advance between
rounds, where the driver can move time without measuring thread
scheduling. Keep waits within the flow lifetime and require delivered
flows to retain their disposition. Limit strict clock enforcement to
process-isolated nextest runs until clock ownership follows threads.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Clock enforcement was process-wide: concurrent `cargo test` cases
could trip each other's guard, while a worker spawned by the active
test could forget its runtime and fall back to wall time.

Use standard thread spawn hooks to inherit the active runtime and clock
membership through the thread tree. Enter the inherited runtime for
each read and keep the handle thread-local so later tests cannot reuse
an earlier clock. Probe hook support at build time; older toolchains
retain the check on the driving thread. Threads created outside
`std::thread` still fail rather than reading the wrong clock.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Bolero's synchronous case loop never yielded to the surrounding Tokio
test runtime. Flow timers therefore never ran, each retained its flow
table, and long fuzz runs grew until they exhausted memory. The same
properties also proved nothing about expiry.

Run each case through a driven runtime and poll spawned tasks before
moving on. This lets timer counts and memory settle instead of growing
with the corpus.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

None of the thirteen NAT properties could run under `cargo bolero`.
Their vacuity guards rejected Bolero's target-selection pass, and
their undriven timer runtime accumulated flow tables until the process
ran out of memory.

Bypass case assertions during target selection and drive the timer
runtime around every fuzz case.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

An empty `sanitize` setting still makes cargo-bolero use
AddressSanitizer. Treating it as no sanitizer allowed Rust and the
sysroot to use incompatible instrumentation, while the explicit
`NONE` setting was rejected even though it matched an uninstrumented
sysroot.

Resolve cargo-bolero's default before comparing the requested and
recorded sanitizer settings. Warn for the compatible legacy default
and reject explicit mismatches.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Eleven flow-info properties placed `check!()` inside a closure, so
Bolero registered them under `{{closure}}`. No command-line target name
could select them.

Put each check at its named test site and scope the paused clock to one
case so timer tasks settle between inputs.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Three packages built only because workspace feature unification exposed
`bolero_engine::any`. A package-only fuzz build lacked the `std` feature
that provides it and failed to compile.

Request Bolero's `std` feature in each affected package instead of
relying on an unrelated workspace dependency.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Twenty-four header shards delegated `check!()` to one helper. Bolero
registered the helper name repeatedly, leaving every shard impossible
to select.

Place the registration at each shard's test entry point while retaining
the shared property body.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The remaining shared property helpers registered one target under the
helper name instead of the ACL, concurrency, config, and stats tests
that called them. Those advertised targets could never run.

Register `check!()` at each test entry point and adapt the config census
helper to the macro's early return. All 596 listed workspace targets are
now selectable.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cargo-bolero sets `RUSTFLAGS`, causing Cargo to ignore the workspace
flags. Fuzz builds lost `tokio_unstable` and the registered cfg names.
Sanitizer coverage also instrumented non-Bolero test binaries that had
no runtime symbols, so package builds failed without a sanitizer.

Prepend the configured workspace flags and link the local no-main
libFuzzer runtime when available. This removes the cfg warnings and
allows every package to fuzz with `sanitize=NONE`.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Modeling fuzzing as a Cargo profile made it mutually exclusive with
coverage, although both are compiler instrumentation that should
compose with each other and with sanitizers. Instrumented containers
could also replace clean images because instrumentation is absent from
their version tags.

Represent instrumentation as a normalized set parallel to sanitizers,
retain a `checked` profile for compiler safety settings, and refuse
container builds that carry diagnostic instrumentation.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fuzz instrumentation broke the native-dependency sysroot. rdma-core's
build tools referenced sanitizer-coverage symbols without a runtime,
DPDK's ThinLTO discarded module constructors while retaining their
relocations, and the overlay could not see the selected instrumentation.

Allow unresolved symbols in throwaway rdma-core tools, disable LTO for
fuzz-instrumented C and C++, omit their fuzz link flags, and pass the
instrumentation set into the overlay.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Clock membership used a boolean even though one thread may hold nested
`Paused` drivers. Dropping the inner driver cleared the flag and let
off-runtime reads through for the rest of the outer driver's lifetime.

Count thread membership so the guard remains armed until the last
nested driver leaves. Update the module documentation to describe the
supported nesting behavior.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>

Moving the shared fuzz registrations removed the last uses of
`RefUnwindSafe` from two integration tests, leaving warnings that fail
the all-targets Clippy run. Remove the stale imports.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>

The process-wide fuzz runtime still used `std::sync::LazyLock` directly,
violating the workspace rule that shared synchronization goes through
the concurrency facade.

Route that runtime through the facade. Keep paused-clock bookkeeping on
`std::sync`: it belongs outside model-checker scheduling, and replacing
it makes virtual-time properties sleep in real time.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>