@ultimat3/testing 30.5.0 → 30.7.0

package/src/exercise-sweeps.ts

@@ -1,6 +1,7 @@
 // What runs after every primitive's own call: the scale sweep (each reached one again, at 2 and at 8
 // rows a table) and the plan sweep (every statement the pass sent, planned on the migrated
-// database). Both verdicts land on the record of the primitive that sent the statements.
+// database). Both verdicts land on the record of the primitive that sent the statements, and each
+// sweep's time on the pass.
 
 import type { Actor } from '@ultimat3/core';
 import type { ExerciseOverrides } from './define-exercise';
@@ -9,11 +10,11 @@ import { asSeededRow, chooseActor } from './exercise-actor';
 import type { Sampler } from './exercise-input';
 import { bindIds, drawInput, seededIds } from './exercise-input';
 import { overrideInput } from './exercise-override-input';
-import type { ExerciseRecord } from './exercise-report';
+import type { ExercisePhaseMs, ExerciseRecord } from './exercise-report';
 import type { Subject } from './exercise-subjects';
 import { seatIn } from './exercise-subjects';
 import { sweepPlans } from './plan-sweep';
-import type { ScaleSweepOptions } from './scale-sweep-run';
+import type { ScaleSubject, ScaleSweepOptions } from './scale-sweep-run';
 import { scaleSweep } from './scale-sweep-run';
 import type { SeedGraph } from './seed-graph-plan';
 import type { SeedEntity } from './seed-graph-shape';
@@ -30,7 +31,12 @@ export const actorRowsOf = (options: CallOptions, graph: SeedGraph): ActorRows |
   const name = options.overrides?.actorEntity;
   const entity = options.entities.find((one) => one.$name === name);
   if (entity === undefined) return undefined;
-  return { entity, rows: graph.inserts.filter((row) => row.entity === entity.$name) };
+  const column = options.overrides?.actorColumn;
+  return {
+    entity,
+    rows: graph.inserts.filter((row) => row.entity === entity.$name),
+    ...(column === undefined ? {} : { column }),
+  };
 };
 
 /** The actor of `chosen`, seated as a row of the app's actor entity in `tenant` when it names one. */
@@ -66,6 +72,25 @@ export async function sizedCall(
   return { actor, input: seatIn(subject, given, tenant) };
 }
 
+/** The records with both sweeps' verdicts and scale time on them, and each sweep's whole time. */
+export interface Swept {
+  readonly records: readonly ExerciseRecord[];
+  readonly ms: Pick<ExercisePhaseMs, 'scale' | 'plans'>;
+}
+
+/** `subject`'s calls, each timed into `spent` under its name: the sweep calls it once per size. */
+const timed = (subject: ScaleSubject, spent: Map<string, number>): ScaleSubject => ({
+  ...subject,
+  call: async (...args) => {
+    const started = performance.now();
+    try {
+      return await subject.call(...args);
+    } finally {
+      spent.set(subject.name, (spent.get(subject.name) ?? 0) + performance.now() - started);
+    }
+  },
+});
+
 /**
  * The scale sweep inside the room, the room closed, then the plan sweep — on the installed client
  * only: with none, the pass ran on a driver that sends no SQL and there is no plan to read.
@@ -73,24 +98,41 @@ export async function sizedCall(
 export async function attachSweeps(
   records: readonly ExerciseRecord[],
   options: ScaleSweepOptions,
-): Promise<readonly ExerciseRecord[]> {
+): Promise<Swept> {
+  const spent = new Map<string, number>();
   let scale: Awaited<ReturnType<typeof scaleSweep>>;
+  const scaleStarted = performance.now();
   try {
-    scale = await scaleSweep(options);
+    scale = await scaleSweep({
+      ...options,
+      subjects: options.subjects.map((subject) => timed(subject, spent)),
+    });
   } finally {
     await options.room[Symbol.asyncDispose]();
   }
+  const plansStarted = performance.now();
   const db = await import('@ultimat3/db');
   const plans = db.dbClientInstalled()
     ? await sweepPlans(db.db(), options.room.sent(), options.entities)
     : new Map();
-  return records.map((record) => {
+  const ms = {
+    scale: Math.round(plansStarted - scaleStarted),
+    plans: Math.round(performance.now() - plansStarted),
+  };
+  const swept = records.map((record) => {
     const proof = plans.get(record.name);
     const sized = scale.get(record.name);
+    const scaleMs = spent.get(record.name);
+    const proofMs = {
+      ...record.proofMs,
+      ...(scaleMs === undefined ? {} : { scale: Math.round(scaleMs) }),
+    };
     return {
       ...record,
       ...(proof === undefined ? {} : { plans: proof }),
       ...(sized === undefined ? {} : { scale: sized }),
+      ...(Object.keys(proofMs).length === 0 ? {} : { proofMs }),
     };
   });
+  return { records: swept, ms };
 }

package/src/exercise.ts

@@ -8,14 +8,15 @@
 
 import type { Actor, ExerciseAttempt, ExerciseVerdict } from '@ultimat3/core';
 import { isUltimateError, renderThrowable, runExercise } from '@ultimat3/core';
-import type { JobExecution, JobRecord } from '@ultimat3/jobs';
 import { registeredJobs } from '@ultimat3/jobs';
 import type { ExerciseOverride, ExerciseOverrides } from './define-exercise';
 import { assertOverridesKnown, unknownDeclaration } from './define-exercise';
 import type { RoleGrants } from './exercise-actor';
 import { chooseActor } from './exercise-actor';
+import { seatActorUsers } from './exercise-actor-user';
 import { proveCrash } from './exercise-crash';
 import { defectDetail } from './exercise-defect';
+import { driftOverrideLine } from './exercise-drift-hint';
 import type { IdLookup, Sampler } from './exercise-input';
 import {
   bindIds,
@@ -25,11 +26,13 @@ import {
   namesActorEntity,
   seededIds,
 } from './exercise-input';
+import { ambientJobRows } from './exercise-job-run';
 import type { OverrideInput } from './exercise-override-input';
 import { overrideInput } from './exercise-override-input';
 import type {
   EffectPayload,
   ExerciseEffect,
+  ExercisePhaseMs,
   ExerciseRecord,
   ExerciseRoom,
   Observed,
@@ -61,6 +64,8 @@ export interface ExercisePassOptions {
   /** One primitive by name; unknown is `X_DECLARATION_UNKNOWN`. */
   readonly only?: string;
   readonly roles: RoleGrants;
+  /** Told once, as the pass returns: how long each phase took, so a slow pass names its slow part. */
+  readonly onPhases?: (ms: ExercisePhaseMs) => void;
 }
 
 const isOff = (overrides: ExerciseOverrides | undefined, name: string): boolean => {
@@ -76,13 +81,15 @@ const codeOf = (error: unknown): string | undefined => {
 const reasonOf = (error: unknown): string =>
   isUltimateError(error) ? error.cause : typeof error === 'string' ? error : renderThrowable(error);
 
-/** Jobs queued or run by the primitive, the primitive's own job excepted. */
-async function enqueued(subject: Subject, jobs: RunJobs, runs: readonly JobExecution[]) {
+/**
+ * Jobs the primitive queued, its own job excepted. Never run: a job's children are left queued as
+ * an action's are (`exercise-job-run.ts`), so their statements are theirs, never this record's.
+ */
+async function enqueued(subject: Subject, jobs: RunJobs) {
   const effects: ExerciseEffect[] = [];
   for (const handle of registeredJobs()) {
     if (subject.kind === 'job' && handle.name === subject.name) continue;
-    const ran = new Set(runs.filter((run) => run.job === handle.name).map((r) => r.jobId)).size;
-    const count = ran + (await jobs.depth(handle));
+    const count = await jobs.depth(handle);
     if (count > 0) effects.push({ kind: 'enqueue', job: handle.name, count });
   }
   return effects;
@@ -93,21 +100,7 @@ async function enqueued(subject: Subject, jobs: RunJobs, runs: readonly JobExecu
  * input is what B was handed. Read off the leg's own queue, page by page.
  */
 async function queuedPayloads(subject: Subject): Promise<readonly EffectPayload[]> {
-  const jobs = await import('@ultimat3/jobs');
-  const introspect = jobs.jobDriver()?.introspect;
-  if (introspect === undefined) return [];
-  const records: JobRecord[] = [];
-  for (let after: string | undefined; ; ) {
-    const page = await introspect.list({
-      limit: jobs.MAX_JOB_PAGE,
-      ...(after === undefined ? {} : { after }),
-    });
-    records.push(...page);
-    const last = page[page.length - 1];
-    if (last === undefined || page.length < jobs.MAX_JOB_PAGE) break;
-    after = jobs.jobCursor(last);
-  }
-  return records
+  return (await ambientJobRows())
     .filter((record) => !(subject.kind === 'job' && record.name === subject.name))
     .map((record, i) => ({
       path: `effect.enqueue[${i}]`,
@@ -122,7 +115,7 @@ interface Run {
   readonly lastInput: unknown;
 }
 
-function judged(subject: Subject, run: Run, observed: Observed) {
+function judged(subject: Subject, run: Run, observed: Observed, sampler: Sampler) {
   const idFields = (input: unknown): readonly string[] =>
     typeof input === 'object' && input !== null
       ? Object.keys(input).filter((key) => idStem(key) !== undefined)
@@ -140,7 +133,12 @@ function judged(subject: Subject, run: Run, observed: Observed) {
   }
   if (run.verdict.kind === 'pass' && run.answered) return { outcome: 'reached' as const };
   if (run.verdict.kind === 'drift') {
-    return unreached('X_CONTRACT_DRIFT', 'its input schema refused every generated value');
+    // The field no draw can fill, named: `...drawn` alone told the author nothing to write.
+    const fields = idFields(run.lastInput);
+    return {
+      ...unreached('X_CONTRACT_DRIFT', 'its input schema refused every generated value'),
+      override: driftOverrideLine(subject.name, subject.input, sampler, fields),
+    };
   }
   if (run.verdict.kind === 'defect') {
     return unreached(codeOf(run.verdict.error) ?? 'X_CONTRACT_DEFECT', run.verdict.defect);
@@ -174,7 +172,6 @@ async function control(
   let lastError: unknown;
   let lastInput: unknown;
   let output: unknown;
-  let executions: readonly JobExecution[] = [];
   room.begin(name);
   const started = performance.now();
   const verdict = await runExercise({
@@ -209,10 +206,9 @@ async function control(
     statusOf: (await import('@ultimat3/http')).statusFor,
   });
   const ms = Math.round(performance.now() - started);
-  if (kind === 'job') executions = (await jobs.drain()).executions;
   const observed = room.end();
-  const effects = [...observed.effects, ...(await enqueued(subject, jobs, executions))];
-  const verdictOf = judged(subject, { verdict, answered, lastError, lastInput }, observed);
+  const effects = [...observed.effects, ...(await enqueued(subject, jobs))];
+  const verdictOf = judged(subject, { verdict, answered, lastError, lastInput }, observed, sampler);
   // A 5xx's cause, statement and fields: the code alone sent the author to reproduce it by hand.
   const defect =
     verdict.kind === 'defect' && verdictOf.outcome === 'unreached'
@@ -286,10 +282,13 @@ async function exerciseOne(
   const intruder = withoutCrossTenant(
     theirs.kind === 'actor' ? seated(theirs.actor, other, rows) : null,
   );
+  // Both are users, as a request's actor always is: their `x_users` rows, before any call.
+  await seatActorUsers([actor, intruder]);
 
   const scope = { tenant, actorId: actor?.id, subject: name, actorEntity: rows?.entity.$name };
   const bindInput = overrideInput(name, override);
-  const declaredRuns = override !== undefined && 'actor' in override ? override.runs : undefined;
+  // `off` returned above: any other entry's `runs` is declared, with or without an `actor`.
+  const declaredRuns = override === undefined || 'off' in override ? undefined : override.runs;
   // A field naming the actor entity is tried as the actor's own row, then as somebody else's:
   // both readings are legitimate and only the handler knows which it meant. Same minimal draw.
   const twoWay =
@@ -325,12 +324,14 @@ async function exerciseOne(
   }
   const input = seat === undefined ? given : seat.input;
   let reachedWith: unknown;
+  const tenantStarted = performance.now();
   const record = await proveTenant({
     taint: tenantTaint(graph, tenant),
     input,
     public: publicReason(subject.policy),
     read: kind === 'query',
     sweep: kind === 'job',
+    tenantless: seat?.kind === 'none',
     attack: () => attack(subject, input, intruder, other, room),
     control: async () => {
       const done = await control(run, room, sampler);
@@ -339,10 +340,16 @@ async function exerciseOne(
     },
     snapshot: (seeded) => options.writer.snapshot(seeded),
   });
+  // The control's own call is `ms`: the tenant proof's time is everything around it.
+  const tenantMs = Math.max(0, Math.round(performance.now() - tenantStarted) - record.ms);
   // After the tenant proof, outside the room's begin/end: the crash runs' effects are their own.
-  return subject.handle === undefined || record.outcome !== 'reached'
-    ? record
-    : { ...record, crash: await proveCrash(subject.handle, reachedWith, actor) };
+  if (subject.handle === undefined || record.outcome !== 'reached') {
+    return { ...record, proofMs: { tenant: tenantMs } };
+  }
+  const crashStarted = performance.now();
+  const crash = await proveCrash(subject.handle, reachedWith, actor);
+  const proofMs = { tenant: tenantMs, crash: Math.round(performance.now() - crashStarted) };
+  return { ...record, crash, proofMs };
 }
 
 export async function runExercisePass(
@@ -363,6 +370,8 @@ export async function runExercisePass(
   const live = chosen.filter((subject) => !isOff(options.overrides, subject.name));
   const records: ExerciseRecord[] = [];
   let graph: SeedGraph;
+  const seedStarted = performance.now();
+  let primitivesStarted = seedStarted;
   try {
     // Seeded before the first primitive runs: a failure here is the pass's, never one primitive's.
     graph = await seedPass(options.entities, options.writer, {
@@ -372,6 +381,7 @@ export async function runExercisePass(
         ? {}
         : { factories: options.overrides.factories }),
     });
+    primitivesStarted = performance.now();
     // In order, one at a time: the seams the room installs are the process's, not the primitive's.
     for (const subject of chosen) {
       const index = live.indexOf(subject);
@@ -383,9 +393,11 @@ export async function runExercisePass(
     await room[Symbol.asyncDispose]();
     throw error;
   }
+  const seed = Math.round(primitivesStarted - seedStarted);
+  const primitives = Math.round(performance.now() - primitivesStarted);
   // The sweeps: every reached primitive again at two sizes, then every statement planned.
   const reached = new Set(records.filter((r) => r.outcome === 'reached').map((r) => r.name));
-  return attachSweeps(records, {
+  const swept = await attachSweeps(records, {
     subjects: chosen.filter((subject) => reached.has(subject.name)),
     entities: options.entities,
     // The sized graphs close their cycles as the pass's did: a refused deferred key stays null.
@@ -396,9 +408,13 @@ export async function runExercisePass(
     factories: options.overrides?.factories,
     setup: async (subject, sized, tenant, self) => {
       const full = chosen.find((one) => one.name === subject.name);
-      return full === undefined
-        ? undefined
-        : await sizedCall(full, options, sampler, { graph: sized, tenant, self });
+      if (full === undefined) return undefined;
+      const call = await sizedCall(full, options, sampler, { graph: sized, tenant, self });
+      // Before the sweep's room opens: the sized tenant's actor is a user too.
+      if (call !== undefined) await seatActorUsers([call.actor]);
+      return call;
     },
   });
+  options.onPhases?.({ seed, primitives, ...swept.ms });
+  return swept.records;
 }

package/src/fixture-jobs.ts

@@ -69,6 +69,11 @@ export interface RunJobs extends AsyncDisposable {
   enqueue<I>(handle: JobHandle<I>, input: I, options?: JobEnqueueAs): Promise<EnqueueResult>;
   /** Claim and execute everything due at the current instant, until nothing is. */
   drain(options?: JobDrainAs): Promise<JobRunTrace>;
+  /**
+   * ONE worker pass: what is due now runs, and what those runs enqueue waits for the next pass —
+   * "it queued one child per row" asserted without running a child.
+   */
+  tick(options?: JobDrainAs): Promise<JobRunTrace>;
   /** Live jobs — ready, delayed, running or suspended — optionally for one job only. */
   depth(handle?: AnyJobHandle): Promise<number>;
   /** Live jobs claimable right now. `clock.advance()` is what turns delayed into due. */
@@ -194,14 +199,20 @@ export async function testJobs(): Promise<RunJobs> {
   /** Every execution this fixture has driven, because the trace is cumulative. */
   const history: JobExecution[] = [];
 
+  const ctxFor = (options: JobDrainAs): Ctx =>
+    options.actor === undefined ? anonymousWorker : ctxOf({ role: 'worker', actor: options.actor });
+  const traced = (): JobRunTrace => ({ executions: [...history], steps: tallyOf(history) });
+
+  const tick = async (options: JobDrainAs = {}): Promise<JobRunTrace> => {
+    history.push(...(await round(ctxFor(options))));
+    return traced();
+  };
+
   const drain = async (options: JobDrainAs = {}): Promise<JobRunTrace> => {
-    const ctx =
-      options.actor === undefined
-        ? anonymousWorker
-        : ctxOf({ role: 'worker', actor: options.actor });
+    const ctx = ctxFor(options);
     for (let rounds = 0; rounds < MAX_ROUNDS; rounds += 1) {
       const batch = await round(ctx);
-      if (batch.length === 0) return { executions: [...history], steps: tallyOf(history) };
+      if (batch.length === 0) return traced();
       history.push(...batch);
     }
     assert(
@@ -239,6 +250,7 @@ export async function testJobs(): Promise<RunJobs> {
   return Object.assign(enqueueThenDrain, {
     enqueue,
     drain,
+    tick,
     depth: async (handle?: AnyJobHandle) => (await live(handle?.name)).length,
     due: async () =>
       (await live()).filter(

package/src/index.ts

@@ -207,7 +207,9 @@ export type {
   EffectPayload,
   ExerciseEffect,
   ExerciseOutcome,
+  ExercisePhaseMs,
   ExerciseRecord,
+  ProofMs,
   TenantFinding,
   TenantLeg,
   TenantProof,
@@ -366,6 +368,7 @@ export {
   normalizeIslandName,
 } from './island-states-resolve';
 export { ISOLATED_ENV, releasePluginsAfterIsolatedFile } from './isolated-plugins';
+export { CRASH_POINT_BOUND } from './job-crash-points';
 export type {
   CrashBoundary,
   CrashDivergence,
@@ -379,6 +382,7 @@ export type { SimEffect } from './job-sim-effects';
 export {
   crashEffectPlace,
   JobCrashDivergedError,
+  JobCrashUnboundedError,
   JobSimInvariantError,
   JobSimNondeterministicError,
 } from './job-sim-errors';

package/src/job-crash-points.ts

@@ -0,0 +1,36 @@
+// Which boundaries a crash proof kills at. A loop's steps named by row id are one point of the
+// code, not one per row: each boundary shape is killed at its first and its last occurrence, so the
+// proof costs what the job's code has, never what the database holds. Pure: labels in, indexes out.
+
+/** Kill points one mode of a proof may cost; past it the proof refuses, `X_JOB_CRASH_UNBOUNDED`. */
+export const CRASH_POINT_BOUND = 32;
+
+const UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi;
+/** A ULID, a hex digest, a cuid: eight or more letters and digits with a digit among them. */
+const TOKEN = /\b(?=[A-Za-z]*\d)[A-Za-z0-9]{8,}\b/g;
+const DIGITS = /\d+/g;
+
+/** `fanout:<id>`, `page-<n>`, `sleep:<n>h (sleeping)`: a boundary label with its ids taken out. */
+export const boundaryShape = (label: string): string =>
+  label.replace(UUID, '<id>').replace(TOKEN, '<id>').replace(DIGITS, '<n>');
+
+/**
+ * The 1-based positions to kill at, in order: the first and the last boundary of every shape.
+ * The first proves the code before the loop and the loop's own body; the last, every row before it
+ * replayed and the code after it — an effect between any two rows is made again at the last.
+ */
+export function crashPoints(labels: readonly string[]): readonly number[] {
+  const first = new Map<string, number>();
+  const last = new Map<string, number>();
+  labels.forEach((label, i) => {
+    const shape = boundaryShape(label);
+    if (!first.has(shape)) first.set(shape, i + 1);
+    last.set(shape, i + 1);
+  });
+  return [...new Set([...first.values(), ...last.values()])].sort((a, b) => a - b);
+}
+
+/** The distinct shapes of `labels`, first seen first — what an unbounded refusal names. */
+export const boundaryShapes = (labels: readonly string[]): readonly string[] => [
+  ...new Set(labels.map(boundaryShape)),
+];

package/src/job-crash-proof.ts

@@ -1,6 +1,6 @@
-// `crashProof(handle, input)`: one clean run, then one run killed at each boundary the clean run
-// crossed — every step write landing, every settle — and one more where that write's answer is
-// lost. Judged by the effect log: a killed run that makes an effect more often than the clean one
+// `crashProof(handle, input)`: one clean run, then one run killed at each distinct boundary the
+// clean run crossed — a step write landing, a settle; a loop's rows one point (`job-crash-points.ts`)
+// — and one more where that write's answer is lost. Judged by the effect log: a killed run that makes an effect more often than the clean one
 // is `X_JOB_CRASH_DIVERGED`; a lost answer rerunning a step is at-least-once, reported, never red.
 
 import type { Ctx } from '@ultimat3/core';
@@ -8,11 +8,12 @@ import { finiteCount } from '@ultimat3/core';
 import type { JobHandle } from '@ultimat3/jobs';
 import { COMPENSATE_PREFIX, UNWINDING_STEP } from '@ultimat3/jobs';
 import { advanceClock, frozenNow } from './determinism';
+import { boundaryShapes, CRASH_POINT_BOUND, crashPoints } from './job-crash-points';
 import type { SimDecision, SimOp } from './job-sim-driver';
 import { SEND_AND_ANSWER } from './job-sim-driver';
 import type { SimEffect } from './job-sim-effects';
 import { effectCounts } from './job-sim-effects';
-import { JobCrashDivergedError } from './job-sim-errors';
+import { JobCrashDivergedError, JobCrashUnboundedError } from './job-sim-errors';
 import type { SimWorld } from './job-sim-world';
 import { openSimWorld } from './job-sim-world';
 
@@ -47,7 +48,10 @@ export interface CrashRerun {
 }
 
 export interface CrashReport {
+  /** The boundaries killed at: each distinct one the clean run crossed, a loop's rows as one. */
   readonly boundaries: readonly CrashBoundary[];
+  /** Every boundary the clean run crossed, the forced-fail run's included: what the kills stand for. */
+  readonly crossed: number;
   readonly divergences: readonly CrashDivergence[];
   readonly reruns: readonly CrashRerun[];
 }
@@ -134,7 +138,10 @@ async function runOnce<I>(
     if (op.step.startsWith(COMPENSATE_PREFIX)) compensated.push(op.step);
     else if (op.step !== UNWINDING_STEP) forward.add(op.step);
   };
+  // Alone: a child the job queues is its enqueue effect, never run — the clean run that ran it
+  // first wrote its rows, and every killed run after found them there (0× against 6×).
   await using world = await openSimWorld({
+    alone: true,
     seed: finiteCount('crashProof', 'seed', options.seed ?? 1),
     decide,
     landed,
@@ -209,6 +216,7 @@ export async function crashProof<I>(
   const boundaries: CrashBoundary[] = [];
   const divergences: CrashDivergence[] = [];
   const reruns: CrashRerun[] = [];
+  let crossed = 0;
   const modes: readonly CrashBoundary['mode'][] = handle.compensates
     ? ['clean', 'forced-fail']
     : ['clean'];
@@ -225,7 +233,19 @@ export async function crashProof<I>(
         : await runOnce(handle, input, { forceFail }, options);
     const afterOf = (key: string): string | undefined =>
       clean.effects.find((effect) => effect.key === key)?.after;
-    for (let at = 1; at <= clean.boundaries.length; at += 1) {
+    // Judged before the first kill: a proof past its bound costs one clean run, then refuses.
+    const points = crashPoints(clean.boundaries);
+    crossed += clean.boundaries.length;
+    if (points.length > CRASH_POINT_BOUND) {
+      throw new JobCrashUnboundedError({
+        job: handle.name,
+        points: points.length,
+        bound: CRASH_POINT_BOUND,
+        crossed: clean.boundaries.length,
+        shapes: boundaryShapes(clean.boundaries),
+      });
+    }
+    for (const at of points) {
       const label = clean.boundaries[at - 1] ?? '?';
       const killed = await runOnce(handle, input, { at, fault: 'kill', forceFail }, options);
       boundaries.push({
@@ -269,5 +289,5 @@ export async function crashProof<I>(
       }
     }
   }
-  return { boundaries, divergences, reruns };
+  return { boundaries, crossed, divergences, reruns };
 }

package/src/job-sim-errors.ts

@@ -101,3 +101,27 @@ export class JobSimNondeterministicError extends UltimateError {
     });
   }
 }
+
+export interface CrashUnboundedInput {
+  readonly job: string;
+  /** Kill points the clean run's boundaries asked for, after a loop's rows were taken as one. */
+  readonly points: number;
+  readonly bound: number;
+  /** Boundaries the clean run crossed. */
+  readonly crossed: number;
+  /** The first distinct boundary shapes, in order: where the names that did not collapse are. */
+  readonly shapes: readonly string[];
+}
+
+/** Refused before the first kill: a proof that grows with the rows is one no gate can wait for. */
+export class JobCrashUnboundedError extends UltimateError {
+  constructor(input: CrashUnboundedInput) {
+    const shown = input.shapes.slice(0, 5).join(', ');
+    super({
+      code: 'X_JOB_CRASH_UNBOUNDED',
+      cause: `job ${renderCauseValue(input.job)} crossed ${input.crossed} step boundaries, ${input.points} distinct kill points against a bound of ${input.bound} — its steps are named so a loop's rows do not read as one point (first: ${renderCauseValue(shown)})`,
+      fix: `step.run(\`<name>:\${row.id}\`, async () => …)   # in job(${renderFixLiteral(input.job, '<job>')}): name a per-row step by the row's id, so its loop is one kill point; then: x test job --filter <the test file>`,
+      meta: { ...input, shapes: [...input.shapes] },
+    });
+  }
+}

package/src/job-sim-world.ts

@@ -31,6 +31,8 @@ export const SIM_VISIBILITY_MS = 30_000;
 const RENEW_MS = 1;
 const CLAIM_LIMIT = 64;
 const LIVE: ReadonlySet<string> = new Set(['ready', 'delayed', 'running', 'suspended']);
+/** Where an `alone` world files the harness's row: no body enqueues here, so no worker claims theirs. */
+const HARNESS_QUEUE = 'x-sim-harness';
 
 export interface SimWorldOptions {
   /** Seeds `Math.random` for the run: a body's jitter and draws are the seed's. */
@@ -40,6 +42,11 @@ export interface SimWorldOptions {
   decide(op: SimOp): SimDecision | Promise<SimDecision>;
   /** Told every landed call, after the world has read it. */
   landed?(op: SimOp, answer: unknown): void;
+  /**
+   * Only the row the harness filed is ever claimed: what a body enqueues lands, dedupes and is an
+   * `enqueue:` effect, and never runs — its effects are its own job's, not this run's.
+   */
+  readonly alone?: boolean;
 }
 
 export interface SimWorld extends AsyncDisposable {
@@ -115,9 +122,11 @@ export async function openSimWorld(options: SimWorldOptions): Promise<SimWorld>
   const anonymous = ctxOf({ role: 'worker' });
   const context = options.context ?? (() => anonymous);
 
-  const queues = (): readonly string[] => [
-    ...new Set([jobs.DEFAULT_QUEUE, ...jobs.registeredJobs().map((handle) => handle.queue)]),
-  ];
+  const queues = (): readonly string[] =>
+    options.alone === true
+      ? [HARNESS_QUEUE]
+      : [...new Set([jobs.DEFAULT_QUEUE, ...jobs.registeredJobs().map((handle) => handle.queue)])];
+  const claimable = new Set(queues());
 
   const rows = async (): Promise<readonly JobRecord[]> => {
     const all: JobRecord[] = [];
@@ -146,7 +155,7 @@ export async function openSimWorld(options: SimWorldOptions): Promise<SimWorld>
     enqueue: async (handle, input) => {
       const result = await base.enqueue({
         name: handle.name,
-        queue: handle.queue,
+        queue: options.alone === true ? HARNESS_QUEUE : handle.queue,
         input,
         idempotencyKey: handle.idempotencyKeyFor(input),
         maxAttempts: jobs.enqueuedAttempts(handle.retry, handle.compensates),
@@ -179,7 +188,9 @@ export async function openSimWorld(options: SimWorldOptions): Promise<SimWorld>
     rows,
     nextDue: async () => {
       const due = (await rows())
-        .filter((row) => LIVE.has(row.state))
+        .filter(
+          (row) => LIVE.has(row.state) && (options.alone !== true || claimable.has(row.queue)),
+        )
         .map((row) => (row.state === 'running' ? (row.visibleAt ?? row.runAt) : row.runAt));
       return due.length === 0 ? undefined : Math.min(...due);
     },