@fairfox/polly 0.85.1 → 0.86.0

package/dist/tools/verify/specs/README.md

@@ -38,6 +38,24 @@ cd tools/verify/specs/tla
 tlc MessageRouter.tla -config MessageRouter.cfg
 ```
 
+**Cost.** `MessageRouter.cfg` declares `MaxMessages = 4` over three contexts and
+three tabs, and `SendMessage` quantifies over every non-empty subset of
+contexts, so the model runs to over a million distinct states and takes minutes.
+To check the properties quickly, drop the constants:
+
+```
+CONSTANTS
+    Contexts = {background, popup}
+    MaxMessages = 1
+    Tabs = {0}
+    TimeoutLimit = 2
+```
+
+That completes in under a second (308 distinct states) and still exercises both
+temporal properties. Removing the `\A i \in 1..MaxMessages : WF_vars(RouteMessage(i))`
+conjunct from `Spec` makes TLC report a violation, so the fairness is
+load-bearing rather than decorative (polly#172).
+
 ## See Also
 - [Verify Package Documentation](../README.md)
 - [TLA+ Specifications](./tla/README.md)

package/dist/tools/verify/specs/tla/MeshState.cfg

@@ -18,4 +18,4 @@ PROPERTIES
     RevocationBlocksFutureOps
 
 CONSTRAINT
-    Len(messages) <= MaxOps * 4
+    BoundedOps

package/dist/tools/verify/specs/tla/MeshState.tla

@@ -170,6 +170,13 @@ Next ==
 
 Spec == Init /\ [][Next]_vars /\ WF_vars(Next)
 
+(* State constraint. Named rather than inline because TLC's CONSTRAINT clause
+   takes a defined operator; an inline expression is rejected with "The
+   constraint of Len is equal to <Java Method ...>" before exploration begins,
+   so the checked-in .cfg could not be run at all (polly#172). *)
+BoundedOps == Len(messages) <= MaxOps * 4
+
+
 -----------------------------------------------------------------------------
 
 (* Invariants *)

package/dist/tools/verify/specs/tla/MessageRouter.cfg

@@ -19,6 +19,8 @@ PROPERTIES
     EventualResolution
     ConnectedEventuallyDelivers
 
-\* State constraint (keep state space manageable)
+\* State constraint (keep state space manageable).
+\* polly#172: TLC's CONSTRAINT clause takes a defined operator, not an inline
+\* expression — an inline one stops the run before it reaches the properties.
 CONSTRAINT
-    Len(messages) <= MaxMessages
+    BoundedMessages

package/dist/tools/verify/specs/tla/MessageRouter.tla

@@ -172,7 +172,16 @@ Next ==
     \/ CompleteRouting
     \/ \E i \in 1..Len(messages) : TimeoutMessage(i)
 
-Spec == Init /\ [][Next]_vars /\ WF_vars(Next)
+(* polly#172: WF_vars(Next) alone asks only that SOME step happen, which a port
+   connecting and disconnecting for ever satisfies while a message sits pending.
+   The temporal properties below need per-message routing fairness to be
+   checkable, and the range must be the CONSTANT 1..MaxMessages — TLC refuses a
+   temporal formula whose quantifier ranges over a VARIABLE. *)
+Spec ==
+    /\ Init
+    /\ [][Next]_vars
+    /\ WF_vars(Next)
+    /\ \A i \in 1..MaxMessages : WF_vars(RouteMessage(i))
 
 -----------------------------------------------------------------------------
 
@@ -214,19 +223,45 @@ TypeOK ==
 
 -----------------------------------------------------------------------------
 
+(* State constraint. Named rather than inline because TLC's CONSTRAINT clause
+   takes a defined operator (polly#172). *)
+BoundedMessages == Len(messages) <= MaxMessages
+
+-----------------------------------------------------------------------------
+
 (* Temporal properties *)
 
+(* polly#172: both properties are quantified over the CONSTANT 1..MaxMessages.
+   Written as 1..Len(messages) they ranged over a VARIABLE, and TLC refuses that
+   with "In evaluation, the identifier messages is either undefined or not an
+   operator" — so neither had ever been checkable. Each side is guarded with
+   Len(messages) >= i because TLC evaluates the property in states reached
+   before message i exists. *)
+
 (* Eventually, all messages resolve (deliver, fail, or timeout) *)
 EventualResolution ==
-    \A i \in 1..Len(messages) :
-        messages[i].status = "pending"
-        ~> messages[i].status \in {"delivered", "failed", "timeout"}
-
-(* If ports are connected and message is sent to them, message eventually delivers *)
+    \A i \in 1..MaxMessages :
+        (Len(messages) >= i /\ messages[i].status = "pending")
+        ~> (Len(messages) >= i
+            /\ messages[i].status \in {"delivered", "failed", "timeout"})
+
+(* A pending message whose targets are all connected is eventually delivered --
+   UNLESS one of those targets stops being connected first, in which case
+   RouteMessage takes its ELSE arm and the message fails.
+
+   polly#172: as originally written this demanded delivery outright, and TLC
+   finds a two-step counter-example: the target disconnects between the send and
+   the route. The property had never been run, so that was never seen. The
+   disjunct below is what is actually true, and it still has teeth -- it forbids
+   a message sitting pending for ever while its ports stay up, which is the
+   routing wedge polly#171 is about. *)
 ConnectedEventuallyDelivers ==
-    \A i \in 1..Len(messages) :
-        LET msg == messages[i]
-        IN (msg.status = "pending" /\ \A target \in msg.targets : ports[target] = "connected")
-           ~> (msg.status = "delivered")
+    \A i \in 1..MaxMessages :
+        (/\ Len(messages) >= i
+         /\ messages[i].status = "pending"
+         /\ \A target \in messages[i].targets : ports[target] = "connected")
+        ~> (/\ Len(messages) >= i
+            /\ \/ messages[i].status = "delivered"
+               \/ \E target \in messages[i].targets : ports[target] # "connected")
 
 =============================================================================

package/dist/tools/verify/specs/tla/PeerState.cfg

@@ -24,4 +24,4 @@ PROPERTIES
 \* The Next action can fire indefinitely via SendSyncMessage; this cap
 \* prevents runaway exploration.
 CONSTRAINT
-    Len(messages) <= MaxOps * 4
+    BoundedOps

package/dist/tools/verify/specs/tla/PeerState.tla

@@ -165,6 +165,13 @@ Next ==
 
 Spec == Init /\ [][Next]_vars /\ WF_vars(Next)
 
+(* State constraint. Named rather than inline because TLC's CONSTRAINT clause
+   takes a defined operator; an inline expression is rejected with "The
+   constraint of Len is equal to <Java Method ...>" before exploration begins,
+   so the checked-in .cfg could not be run at all (polly#172). *)
+BoundedOps == Len(messages) <= MaxOps * 4
+
+
 -----------------------------------------------------------------------------
 
 (* Invariants *)

package/dist/tools/verify/specs/tla/README.md

@@ -84,7 +84,7 @@ bun run tla:down     # Stop container
 docker-compose -f specs/docker-compose.yml up -d
 
 # Run the model checker against each spec
-docker-compose -f specs/docker-compose.yml exec tla tlc MessageRouter.tla
+docker-compose -f specs/docker-compose.yml exec tla tlc MessageRouter.tla -config MessageRouter.cfg
 docker-compose -f specs/docker-compose.yml exec tla tlc PeerState.tla
 docker-compose -f specs/docker-compose.yml exec tla tlc MeshState.tla