schemurai 2.3.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 181bce310181bba515fd0b38021092300deda955ce8ef5cefb6b9e077a51995b
-  data.tar.gz: 506c85192a973967b9787637fb96c24d564ebf83bba7e02124f8fccf3de9de55
+  metadata.gz: 8fde4b5a2e6ccf979c4948fd13476c8250acf053346de28c4d62b32ed0c92e4f
+  data.tar.gz: 7e3a5fb2dfa17195b1a45cde045f7256a1c5f3687f19f8d2c7b821980ffe2ab1
 SHA512:
-  metadata.gz: b6b8663cd944bd3c439892a0ebbbaea1fbce229eabe208094e89f1999cc102b60a6b04a2626caafa2dc480a18e76c4c76aca75433f2509d84ab75f1766e14e0c
-  data.tar.gz: 4a80f08e3f35eb1edfab8d106d2967c4fdc686741b5e731f4bc7dc5c5946095a6e69272cc8257ad1d762746b78df73e932a9470a0815969c25ff54274e62631b
+  metadata.gz: 42c0e94ce30932d09c9f1617592338f2386076eca4d176f1e1a9461557ea723abf512f94d7c68fb52a392021e9b45cba4ab329ee3669754b6d0a996f0319a07f
+  data.tar.gz: 68b8c4e585cd40e11d4d7fbae8d9345f52a4bfca437704b86999eab79f219cf52e276b623faf0271cd49c4044c596f544399be77ba8a8fd36946f20524708cc2

data/README.md

@@ -185,9 +185,12 @@ validator = registry.validator_for("https://example.test/value")
 `ResolutionError` if a reference cannot be resolved. After it returns,
 `validator_for` is read-only and may be called concurrently, while `compile` is
 no longer available. A `Validator` contains per-validation mutable state and
-must not be shared between threads or Ractors. With the VM backend, the registry
-compiles and shares its bytecode before this transition, so those validators do
-not compile separate instruction streams in each Ractor.
+must not be shared between threads or Ractors. With the VM and native backends,
+the registry compiles and shares its bytecode before this transition. The native
+backend also prepares shared native instruction tables for all four combinations
+of `content` and `format`; `validator_for` does not recompile them in each Ractor.
+Native regex search caches and VM fallback evaluation state belong to each
+validator. Preparing these tables adds time and memory to `make_shareable`.
 
 ### Meta-schema validation
 
@@ -218,10 +221,70 @@ regardless of the registry option and reuse meta-schema graph data within that
 registry. The stateful validator used for a check is temporary; no global
 validator is retained.
 
+### Opt-in validation limits (experimental)
+
+`max_errors:` and `timeout:` are optional kwargs. Both default to `nil`
+(unlimited) and apply independently to each validation call. `max_errors` must
+be a nonnegative Integer; `timeout` must be finite nonnegative Integer or Float
+seconds. No settings object is needed.
+
+```ruby
+validator = Schemurai.compile(schema, max_errors: 100, timeout: 0.1)
+begin
+  result = validator.validate(order)
+rescue Schemurai::LimitExceeded => error
+  # Evaluation is incomplete; no partial result is returned.
+  warn "Validation stopped at #{error.limit}"
+end
+
+validator.validate(order, max_errors: 10) # retains the compiled timeout
+validator.validate(order, timeout: nil)  # retains the compiled error cap
+validator.validate(order, max_errors: nil, timeout: nil) # disables both
+validator.valid?(order) # applies the timeout, ignores max_errors
+```
+
+`SchemaRegistry#compile`, `#validator_for`, the convenience `validate` / `valid?`
+methods and explicit meta-schema checks also accept these kwargs. Overrides
+replace only the specified option. Settings belong to each compiled validator;
+a shareable registry retains no mutable invocation counters.
+
+The error cap checks before constructing the next emitted diagnostic. Exactly
+`max_errors` errors may be returned; attempting another raises `LimitExceeded`
+with `limit == :max_errors`, `maximum` and `attempted` counts. Suppressed
+applicator trials do not consume the cap. Boolean checks ignore the error cap
+and use the ordinary evaluator when no timeout is set.
+
+The timeout uses a monotonic elapsed-time deadline, including diagnostic
+rendering and native-to-VM fallback. It checks at entry, before returning and
+every 256 checkpoints in evaluation, container scans and structural traversal.
+Ruby string/content operations also check before and after expensive calls.
+Zero seconds stops even a trivial call. Expiry raises `LimitExceeded` with
+`limit == :timeout`; `maximum` and `attempted` are configured and elapsed seconds.
+Native returns an exhaustion status and releases Rust resources before Ruby
+raises. A limit hit is terminal and does not trigger fallback.
+
+This implementation never uses Ruby `Timeout`, timer threads, signals or
+asynchronous exception injection. It is cooperative: one regexp search, scalar
+operation, JSON decode, allocation or custom format callback may overrun until
+the next checkpoint. GC and descheduling count toward elapsed time; the polling
+interval bounds skipped checkpoints, not elapsed overrun. Compilation,
+registration and automatic compile-time meta-schema validation are outside the
+timeout. Explicit meta-schema checks can set their own timeout.
+
+Use the error cap to bound diagnostic count and the timeout to bound prolonged
+traversal. They protect different resources: a deadline does not bound the
+number of diagnostics, and an error cap cannot stop a long successful check.
+Input byte size and nesting depth belong at the parsing boundary. An error cap
+does not bound the size of an individual message. Preempting individual scalar
+operations requires operation-specific limits or a supervised worker process.
+The backends retain their respective Ruby, VM and native execution paths and
+native memoization. Timed native bulk pattern/format/content and Fixnum contains
+scans use per-item evaluation so successful scans can poll.
+
 ### Backend selection
 
 `Schemurai.backend`, `SchemaRegistry#backend`, and `Validator#backend` expose
-the actual backend. Pass `backend: :ruby` to force the Ruby oracle or
+the selected backend. Pass `backend: :ruby` to force the Ruby oracle or
 `backend: :vm` to ahead-of-time compile schemas for the validator virtual machine.
 Pass `backend: :native` to use the experimental Rust VM extension. Building the
 native extension requires a C toolchain, Ruby development headers, and Rust

data/ext/schemurai_native/Cargo.lock

@@ -82,7 +82,7 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "schemurai-native"
-version = "2.3.0"
+version = "3.0.0"
 dependencies = [
  "base64-simd",
  "base64-turbo",

data/ext/schemurai_native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "schemurai-native"
-version = "2.3.0"
+version = "3.0.0"
 edition = "2024"
 rust-version = "1.93"
 publish = false

data/ext/schemurai_native/glue.c

@@ -1,5 +1,6 @@
 #include <ruby.h>
 #include <ruby/encoding.h>
+#include <ruby/ractor.h>
 #include <ruby/st.h>
 #include <stdint.h>
 #include <stddef.h>
@@ -7,7 +8,7 @@
 #include "protocol.h"
 
 static ID id_resolve, id_schemurai, id_resolution_error;
-static ID id_root, id_compile, id_graph, id_dynamic_anchor;
+static ID id_root, id_compile, id_graph, id_dynamic_anchor, id_dynamic_anchor_names, id_dynamic_anchor_count;
 
 /* The C layer adapts CRuby APIs to Rust's opaque VALUEs. */
 #ifdef HAVE_RB_HASH_STLIKE_FOREACH
@@ -17,8 +18,15 @@ extern int rb_hash_stlike_foreach(VALUE, st_foreach_callback_func *, st_data_t);
 #endif
 typedef struct { void *engine; const void *roots; VALUE program; int compiling; } holder;
 extern void *sn_new(void);
-extern int sn_compile(void *, VALUE, VALUE, int, int, VALUE *);
-extern int sn_valid(const void *, VALUE);
+extern int sn_compile(void *, VALUE, VALUE, int, int, int, VALUE *);
+extern int sn_valid(const void *, const void *, size_t, VALUE);
+extern size_t sn_node_index(const void *, VALUE);
+extern size_t sn_root_index(const void *);
+extern size_t sn_root_count(const void *);
+extern VALUE sn_root_at(const void *, size_t);
+extern void *sn_caches_new(void);
+extern void sn_caches_free(void *);
+extern size_t sn_caches_size(const void *);
 extern void sn_free(void *);
 extern const void *sn_roots(const void *);
 extern void sn_roots_mark(const void *);
@@ -43,7 +51,7 @@ static size_t size(const void *ptr) {
 }
 static const rb_data_type_t engine_type = {
     "Schemurai::Native::Program", {mark, release, size, NULL, {NULL}},
-    NULL, NULL, RUBY_TYPED_FREE_IMMEDIATELY
+    NULL, NULL, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_FROZEN_SHAREABLE
 };
 static VALUE allocate(VALUE klass) {
     holder *h;
@@ -55,6 +63,7 @@ static VALUE allocate(VALUE klass) {
     return obj;
 }
 static VALUE initialize(VALUE self, VALUE program, VALUE compiler, VALUE format, VALUE content) {
+    rb_check_frozen(self);
     holder *h;
     TypedData_Get_Struct(self, holder, &engine_type, h);
     if (h->engine) rb_raise(rb_eRuntimeError, "native program is already initialized");
@@ -63,7 +72,8 @@ static VALUE initialize(VALUE self, VALUE program, VALUE compiler, VALUE format,
     h->roots = sn_roots(h->engine);
     h->compiling = 1;
     VALUE error = Qnil;
-    int status = sn_compile(h->engine, program, compiler, RTEST(format), RTEST(content), &error);
+    int status = sn_compile(h->engine, program, compiler, RTEST(format), RTEST(content),
+        RB_TYPE_P(program, T_ARRAY), &error);
     h->compiling = 0;
     if (status < 0) {
         sn_free(h->engine);
@@ -79,8 +89,92 @@ static VALUE valid(VALUE self, VALUE instance) {
     TypedData_Get_Struct(self, holder, &engine_type, h);
     if (!h->engine) rb_raise(rb_eRuntimeError, "uninitialized native program");
     if (h->compiling) rb_raise(rb_eRuntimeError, "native program is still compiling");
-    int status = sn_valid(h->engine, instance);
+    int status = sn_valid(h->engine, NULL, sn_root_index(h->engine), instance);
+    RB_GC_GUARD(instance);
+    if (status < 0) rb_raise(rb_eRuntimeError, "native evaluator panicked");
+    return status == SN_VERDICT_UNSUPPORTED ? Qnil : (status ? Qtrue : Qfalse);
+}
+/* Search caches and root selection belong to the owning validator. The Ruby
+ * owner keeps the shared engine and all its GC roots alive. */
+typedef struct { VALUE owner; void *caches; size_t root; } runner_holder;
+static void runner_mark(void *ptr) { rb_gc_mark(((runner_holder *)ptr)->owner); }
+static void runner_release(void *ptr) {
+    runner_holder *h = ptr;
+    if (h->caches) sn_caches_free(h->caches);
+    xfree(h);
+}
+static size_t runner_size(const void *ptr) {
+    const runner_holder *h = ptr;
+    return sizeof(*h) + (h->caches ? sn_caches_size(h->caches) : 0);
+}
+static const rb_data_type_t runner_type = {
+    "Schemurai::Native::Runner", {runner_mark, runner_release, runner_size, NULL, {NULL}},
+    NULL, NULL, RUBY_TYPED_FREE_IMMEDIATELY
+};
+static holder *ready_program(VALUE self) {
+    holder *h;
+    TypedData_Get_Struct(self, holder, &engine_type, h);
+    if (!h->engine) rb_raise(rb_eRuntimeError, "uninitialized native program");
+    if (h->compiling) rb_raise(rb_eRuntimeError, "native program is still compiling");
+    return h;
+}
+static VALUE make_shareable(VALUE self) {
+    holder *h = ready_program(self);
+    /* TypedData's hidden references must be shareable too. Freeze temporary
+     * compilation arrays as well as the VM programs/graph they retain. */
+    size_t count = sn_root_count(h->roots);
+    for (size_t i = 0; i < count; i++) rb_ractor_make_shareable(sn_root_at(h->roots, i));
+    rb_ractor_make_shareable(h->program);
+    return rb_ractor_make_shareable(self);
+}
+static VALUE runner(VALUE self, VALUE root) {
+    holder *h = ready_program(self);
+    size_t index = sn_node_index(h->engine, root);
+    if (index == SIZE_MAX) rb_raise(rb_eArgError, "root was not compiled in this native program");
+    VALUE klass = rb_const_get(rb_obj_class(self), rb_intern_const("Runner"));
+    runner_holder *r;
+    VALUE object = TypedData_Make_Struct(klass, runner_holder, &runner_type, r);
+    r->owner = self;
+    r->root = index;
+    r->caches = sn_caches_new();
+    RB_GC_GUARD(self);
+    return object;
+}
+typedef struct { size_t max_errors; uint32_t enabled; double timeout; } native_limits;
+typedef struct { uint32_t kind; size_t attempted; } native_outcome;
+extern int sn_valid_with_limits(const void *, const void *, size_t, VALUE, const native_limits *, native_outcome *);
+static native_limits read_limits(VALUE budget) {
+    native_limits limits = {0};
+    VALUE cap = rb_funcall(budget, rb_intern("native_max_errors"), 0);
+    if (!NIL_P(cap)) { limits.max_errors = NUM2SIZET(cap); limits.enabled |= 1; }
+    VALUE duration = rb_funcall(budget, rb_intern("native_duration"), 0);
+    if (!NIL_P(duration)) { limits.timeout = NUM2DBL(duration); limits.enabled |= 2; }
+    RB_GC_GUARD(cap);
+    return limits;
+}
+static void finish_budget(VALUE budget, const native_outcome *outcome) {
+    if (outcome->kind) rb_funcall(budget, rb_intern("raise_native_limit"), 2, UINT2NUM(outcome->kind), SIZET2NUM(outcome->attempted));
+}
+static VALUE runner_valid_with_budget(VALUE self, VALUE instance, VALUE budget) {
+    runner_holder *r;
+    TypedData_Get_Struct(self, runner_holder, &runner_type, r);
+    holder *h = ready_program(r->owner);
+    native_limits limits = read_limits(budget);
+    native_outcome outcome = {0};
+    int status = sn_valid_with_limits(h->engine, r->caches, r->root, instance, &limits, &outcome);
+    if (status < 0) rb_raise(rb_eRuntimeError, "native evaluator panicked");
+    finish_budget(budget, &outcome);
+    RB_GC_GUARD(instance);
+    RB_GC_GUARD(self);
+    return status == SN_VERDICT_UNSUPPORTED ? Qnil : (status ? Qtrue : Qfalse);
+}
+static VALUE runner_valid(VALUE self, VALUE instance) {
+    runner_holder *r;
+    TypedData_Get_Struct(self, runner_holder, &runner_type, r);
+    holder *h = ready_program(r->owner);
+    int status = sn_valid(h->engine, r->caches, r->root, instance);
     RB_GC_GUARD(instance);
+    RB_GC_GUARD(self);
     if (status < 0) rb_raise(rb_eRuntimeError, "native evaluator panicked");
     return status == SN_VERDICT_UNSUPPORTED ? Qnil : (status ? Qtrue : Qfalse);
 }
@@ -265,7 +359,6 @@ int sn_wide_integer_compare(VALUE value, VALUE bound) {
     if (FIXNUM_P(value)) return rb_big_sign(bound) ? -1 : 1;
     return FIX2INT(rb_big_cmp(value, bound));
 }
-size_t sn_integer_bytes(VALUE value) { return rb_absint_size(value, NULL); }
 int sn_integer1024(VALUE value, uint64_t *words) {
     return rb_integer_pack(value, words, 16, sizeof(uint64_t), 0,
         INTEGER_PACK_LSWORD_FIRST | INTEGER_PACK_NATIVE_BYTE_ORDER);
@@ -388,7 +481,8 @@ typedef struct {
     size_t detail;
 } diagnostic_record;
 typedef struct { void *report; } report_holder;
-extern void *sn_diagnose(const void *, VALUE, int *);
+extern void *sn_diagnose(const void *, const void *, size_t, VALUE, int *);
+extern void *sn_diagnose_with_limits(const void *, const void *, size_t, VALUE, int *, const native_limits *, native_outcome *);
 extern size_t sn_report_len(const void *);
 extern size_t sn_report_size(const void *);
 extern void sn_report_record(const void *, size_t, diagnostic_record *);
@@ -411,21 +505,25 @@ static const rb_data_type_t report_type = {
     "Schemurai::Native::Diagnostics", {report_mark, report_release, report_size, NULL, {NULL}},
     NULL, NULL, RUBY_TYPED_FREE_IMMEDIATELY
 };
-static VALUE diagnostics(VALUE self, VALUE instance) {
-    holder *engine;
-    TypedData_Get_Struct(self, holder, &engine_type, engine);
-    if (!engine->engine) rb_raise(rb_eRuntimeError, "uninitialized native program");
-    if (engine->compiling) rb_raise(rb_eRuntimeError, "native program is still compiling");
+static VALUE collect_diagnostics(VALUE self, VALUE instance, holder *engine, const void *caches, size_t root, VALUE budget) {
     report_holder *h;
     VALUE owner = TypedData_Make_Struct(rb_cObject, report_holder, &report_type, h);
     h->report = NULL;
     int status = 0;
-    h->report = sn_diagnose(engine->engine, instance, &status);
+    native_outcome outcome = {0};
+    if (NIL_P(budget)) {
+        h->report = sn_diagnose(engine->engine, caches, root, instance, &status);
+    } else {
+        native_limits limits = read_limits(budget);
+        h->report = sn_diagnose_with_limits(engine->engine, caches, root, instance, &status, &limits, &outcome);
+    }
     if (status < 0) rb_raise(rb_eRuntimeError, "native diagnostics panicked");
+    if (!NIL_P(budget)) finish_budget(budget, &outcome);
     if (status == SN_VERDICT_UNSUPPORTED) return Qnil;
     size_t count = sn_report_len(h->report);
     VALUE output = rb_ary_new_capa(count);
     for (size_t index = 0; index < count; index++) {
+        if (!NIL_P(budget) && index % 256 == 0) rb_funcall(budget, rb_intern("check_deadline!"), 0);
         diagnostic_record r;
         sn_report_record(h->report, index, &r);
         VALUE row = rb_ary_new_capa(7);
@@ -443,6 +541,22 @@ static VALUE diagnostics(VALUE self, VALUE instance) {
     RB_GC_GUARD(self);
     return output;
 }
+static VALUE diagnostics(VALUE self, VALUE instance) {
+    holder *h = ready_program(self);
+    return collect_diagnostics(self, instance, h, NULL, sn_root_index(h->engine), Qnil);
+}
+static VALUE runner_diagnostics(VALUE self, VALUE instance) {
+    runner_holder *r;
+    TypedData_Get_Struct(self, runner_holder, &runner_type, r);
+    holder *h = ready_program(r->owner);
+    return collect_diagnostics(self, instance, h, r->caches, r->root, Qnil);
+}
+static VALUE runner_diagnostics_with_budget(VALUE self, VALUE instance, VALUE budget) {
+    runner_holder *r;
+    TypedData_Get_Struct(self, runner_holder, &runner_type, r);
+    holder *h = ready_program(r->owner);
+    return collect_diagnostics(self, instance, h, r->caches, r->root, budget);
+}
 void Init_schemurai_native(void) {
     /* Cache fixed IDs explicitly, independent of compiler-specific macros. */
     id_resolve = rb_intern_const("resolve");
@@ -452,6 +566,8 @@ void Init_schemurai_native(void) {
     id_compile = rb_intern_const("compile");
     id_graph = rb_intern_const("@graph");
     id_dynamic_anchor = rb_intern_const("dynamic_anchor");
+    id_dynamic_anchor_names = rb_intern_const("dynamic_anchor_names");
+    id_dynamic_anchor_count = rb_intern_const("@dynamic_anchor_count");
     utf8_index = rb_utf8_encindex();
     ascii_index = rb_usascii_encindex();
     binary_index = rb_ascii8bit_encindex();
@@ -471,6 +587,14 @@ void Init_schemurai_native(void) {
     rb_define_method(klass, "initialize", initialize, 4);
     rb_define_method(klass, "valid?", valid, 1);
     rb_define_method(klass, "diagnostics", diagnostics, 1);
+    rb_define_method(klass, "make_shareable", make_shareable, 0);
+    rb_define_method(klass, "runner", runner, 1);
+    VALUE runner_class = rb_define_class_under(klass, "Runner", rb_cObject);
+    rb_undef_alloc_func(runner_class);
+    rb_define_method(runner_class, "valid?", runner_valid, 1);
+    rb_define_method(runner_class, "valid_with_budget", runner_valid_with_budget, 2);
+    rb_define_method(runner_class, "diagnostics", runner_diagnostics, 1);
+    rb_define_method(runner_class, "diagnostics_with_budget", runner_diagnostics_with_budget, 2);
 }
 
 extern int sn_object_entry(const void *, VALUE, VALUE);
@@ -623,6 +747,23 @@ static VALUE anchor_program(VALUE arg) {
     VALUE node = rb_funcall(graph, id_dynamic_anchor, 2, b->resource, b->name);
     return NIL_P(node) ? Qnil : rb_funcall(b->compiler, id_compile, 1, node);
 }
+/* Anchor counts fit immediate integers: the table cannot exceed memory.
+ * Reading metadata invokes no Ruby method or allocation. */
+size_t sn_anchor_count(VALUE resource) {
+    return (size_t)FIX2LONG(rb_ivar_get(resource, id_dynamic_anchor_count));
+}
+static VALUE anchor_names(VALUE arg) {
+    struct binding *b = (struct binding *)arg;
+    VALUE graph = rb_ivar_get(b->compiler, id_graph);
+    return rb_funcall(graph, id_dynamic_anchor_names, 1, b->resource);
+}
+int sn_anchor_names(VALUE compiler, VALUE resource, VALUE *result) {
+    struct binding b = {compiler, resource, Qnil};
+    int state = 0;
+    *result = rb_protect(anchor_names, (VALUE)&b, &state);
+    if (state) { *result = rb_errinfo(); rb_set_errinfo(Qnil); }
+    return state;
+}
 int sn_resource_program(VALUE compiler, VALUE resource, VALUE *result) {
     struct binding b = {compiler, resource, Qnil};
     int state = 0;

data/ext/schemurai_native/src/budget.rs

@@ -0,0 +1,101 @@
+//! Invocation-local native limits. Exhaustion is terminal, not VM delegation.
+use std::cell::Cell;
+use std::time::{Duration, Instant};
+
+#[repr(C)]
+#[derive(Clone, Copy, Default)]
+pub struct Limits {
+    pub max_errors: usize,
+    pub enabled: u32,
+    pub timeout: f64,
+}
+#[repr(C)]
+#[derive(Default)]
+pub struct Outcome {
+    pub kind: u32,
+    pub attempted: usize,
+}
+#[derive(Default)]
+pub(super) struct Budget {
+    pub limits: Limits,
+    pub hit: Cell<(u32, usize)>,
+    deadline: Option<Instant>,
+    checks: Cell<usize>,
+}
+impl Budget {
+    pub fn new(limits: Limits) -> Self {
+        Self {
+            limits,
+            deadline: if limits.enabled & 2 != 0 {
+                Duration::try_from_secs_f64(limits.timeout.max(0.0))
+                    .ok()
+                    .and_then(|duration| Instant::now().checked_add(duration))
+            } else {
+                None
+            },
+            ..Self::default()
+        }
+    }
+    pub fn timed(&self) -> bool {
+        self.limits.enabled & 2 != 0
+    }
+    pub fn check_deadline(&self) -> bool {
+        if self.hit.get().0 != 0 {
+            return false;
+        }
+        if self
+            .deadline
+            .is_some_and(|deadline| Instant::now() >= deadline)
+        {
+            self.hit.set((2, 0));
+            return false;
+        }
+        true
+    }
+    pub fn checkpoint(&self) -> bool {
+        if !self.timed() {
+            return true;
+        }
+        let checks = self.checks.get().wrapping_add(1);
+        self.checks.set(checks);
+        if checks & 255 == 0 {
+            self.check_deadline()
+        } else {
+            self.hit.get().0 == 0
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn deadline_is_sampled_and_exhaustion_is_sticky() {
+        let mut budget = Budget::new(Limits {
+            timeout: 10.0,
+            enabled: 2,
+            ..Limits::default()
+        });
+        assert!(budget.check_deadline());
+        budget.deadline = Some(Instant::now() - Duration::from_secs(1));
+        for _ in 0..255 {
+            assert!(budget.checkpoint());
+        }
+        assert!(!budget.checkpoint());
+        assert_eq!(budget.hit.get(), (2, 0));
+        assert!(!budget.checkpoint());
+    }
+
+    #[test]
+    fn huge_finite_deadlines_do_not_panic() {
+        assert!(
+            Budget::new(Limits {
+                timeout: f64::MAX,
+                enabled: 2,
+                ..Limits::default()
+            })
+            .check_deadline()
+        );
+    }
+}