simloom 0.2.0__tar.gz → 0.4.0__tar.gz

{simloom-0.2.0 → simloom-0.4.0}/CHANGELOG.md

@@ -7,6 +7,86 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-07-06
+
+### Added
+- **World/fault-matrix fuzzer.** Generated distributed programs (hosts running
+  TCP echo servers and UDP endpoints, clients hitting random peers) while a
+  director executes a random fault script — partitions, heals, asymmetric
+  blocks, crashes, restarts, connection resets, latency/loss, datagram faults —
+  at random virtual times. Properties: run==run==replay byte-identical whatever
+  the faults, and errors are only ever user-level (a replay never misaligns).
+  2,000-case offline campaign, zero divergences.
+- **Adversarial API-misuse suite + hostile-input hardening.** Every misuse is a
+  clean, named error (nested `run()`, coroutine objects, bad bounds, raising
+  monitor predicates/protocol callbacks/`__repr__`s, double-completes), the CLI
+  reports unreadable logs instead of tracebacking, unhashable register values
+  get a clear message, and 100 failing/deadlocking runs leave zero residue.
+- **Unpinned-PYTHONHASHSEED CI job + shrinker properties.** The determinism-
+  critical suites now also run with hash randomization ON (any internal
+  hash-order dependence surfaces as a divergence), and the shrinker is
+  property-tested over fuzzer-generated failures: the minimized tape must still
+  fail with the same error class, deterministically (400-case sweep).
+- **Systematic-verifier cross-validation.** `proven_correct` — the most
+  dangerous claim simloom makes — is cross-checked against random exploration
+  on fuzzer-generated programs: a proof must never coexist with a random
+  failure, every reported witness must replay, and an exhaustive search must
+  find any bug random finds. 400-case offline campaign, zero contradictions.
+- **asyncio semantics-parity fuzzer.** Generated programs with interleaving-
+  independent results must produce exactly what the stock asyncio loop produces
+  — values, exception types, timeouts, shields, gathers, cancellation. Offline:
+  4,000 programs x 3 sim seeds vs `asyncio.run`, zero divergences.
+- **Random-program determinism fuzzer.** Arbitrary generated async programs
+  (queues, locks, events, sleeps, tape draws, task spawning, cancellation) must
+  satisfy run==run==replay byte-identically under both schedulers — deadlocking
+  programs must deadlock identically. Offline campaign: 20,000 programs
+  (~100,000 executions), zero divergences; a randomized slice runs in CI.
+
+### Fixed
+- **Serializability checker: four incompleteness bugs**, found by a
+  differential campaign against an independent brute-force reference (450k+
+  random histories). The checker was always *sound* (no false accusations) but
+  missed ~20% of real violations: (1) incompatible reads — two reads neither of
+  which is a prefix of the other; (2) intra-transaction inconsistencies — a
+  transaction reading its own future append, shrinking reads, or two different
+  pre-transaction states; (3) torn atomic append groups — a read observing part
+  of a transaction's appends; (4) rw anti-dependency edges were only generated
+  for values in the recovered version order, missing cross-key atomicity cycles
+  — now a read precedes the append of *every* value it did not observe. After
+  the fixes: zero disagreements over 450k serializability and 320k
+  linearizability cases; the differential suite is now part of CI.
+
+## [0.3.0] - 2026-07-06
+
+### Added
+- **Time-travel debugging v1.** `run(..., debug=True)` (implies `causal=True`)
+  installs a `sys.monitoring` recorder over *user code*: every line executed,
+  every local-variable change (`name = repr`, address-scrubbed and truncated),
+  and every call/return with arguments and values — all keyed to the scheduler
+  step that ran them. `simloom debug LOG` answers omniscient queries over the
+  recording: `--step N` (the code that ran during a step), `--var x` (the full
+  timeline of a variable — a lost update's double stale read is one query),
+  `--fn name` (calls/returns). Stdlib/site-packages/simloom are filtered out and
+  their monitoring locations disabled after first sight; debug runs are
+  deterministic and replay exactly.
+- **Stand-in services: sim-nats.** `world.run_service(SimNats(), host=, port=)`
+  starts an in-sim NATS broker an *unmodified* `nats-py` client speaks to —
+  publish/subscribe with subject wildcards (`*`/`>`), request/reply, and queue
+  groups. Which member of a queue group receives each message is a **tape
+  draw**, so exploration covers every delivery assignment a real broker could
+  make (measured: distinct worker assignments across seeds, exactly-once per
+  message on all of them). Wire faults (partition the broker away) surface as
+  deterministic, replayable timeouts.
+- **Wing-Gong linearizability checking.** `world.registers` records
+  read/write/cas operations (invoke/complete pairs, so real-time precedence is
+  exact); `world.check_linearizable()` / `assert_linearizable()` run Wing &
+  Gong's algorithm with memoisation. Stricter than serializability: the order
+  must respect real time, so a *stale read* is caught even when a serial order
+  could excuse it. Pending (crashed) operations are handled the Jepsen way —
+  they may or may not have taken effect, and both worlds are explored. Keys are
+  independent registers (linearizability is local), and a violation reports the
+  deepest valid prefix plus exactly which operation cannot take effect and why.
+
 ## [0.2.0] - 2026-06-25
 
 ### Added
@@ -180,6 +260,8 @@ explorer, shrinker, and pytest plugin are all present and exercised by a
   race (bpo-42130) reproduced deterministically from a seed; the modern stdlib
   survives the identical torture. Launch-post draft in `docs/launch-post.md`.
 
-[Unreleased]: https://github.com/mandipadk/simloom/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/mandipadk/simloom/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/mandipadk/simloom/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/mandipadk/simloom/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/mandipadk/simloom/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/mandipadk/simloom/releases/tag/v0.1.0

{simloom-0.2.0 → simloom-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simloom
-Version: 0.2.0
+Version: 0.4.0
 Summary: Deterministic simulation testing for asyncio: explore every schedule, inject faults, assert properties, prove correctness, and replay any failure from a seed.
 Project-URL: Homepage, https://github.com/mandipadk/simloom
 Project-URL: Repository, https://github.com/mandipadk/simloom
@@ -30,6 +30,7 @@ Requires-Dist: ruff>=0.9; extra == 'dev'
 Provides-Extra: spikes
 Requires-Dist: aiohttp>=3.11; extra == 'spikes'
 Requires-Dist: httpx>=0.28; extra == 'spikes'
+Requires-Dist: nats-py>=2.9; extra == 'spikes'
 Requires-Dist: redis>=5.0; extra == 'spikes'
 Description-Content-Type: text/markdown
 
@@ -197,8 +198,10 @@ faults injected, replayable byte-for-byte from a seed.
   (memory-BIO SSL, so aiohttp HTTPS just works).
 - **💥 Honest crashes & disk** — `host.crash()` is a power cut: tasks stop with no
   `finally` blocks, unsynced disk writes are lost or *torn*, peers see resets.
-- **🧩 Stand-in services** — `world.run_service(SimRedis(), …)` gives you an in-sim Redis
-  (SET/GET, WATCH/MULTI/EXEC) to test your logic against, with wire faults applied.
+- **🧩 Stand-in services** — `world.run_service(...)` gives you an in-sim **Redis**
+  (SET/GET, WATCH/MULTI/EXEC, for unmodified redis-py) and an in-sim **NATS** broker
+  (pub/sub, wildcards, queue groups, for unmodified nats-py) — with wire faults applied,
+  and queue-group delivery choices explored from the tape.
 
 **Break it.** Explore the schedules and faults your laptop never will.
 
@@ -218,8 +221,10 @@ faults injected, replayable byte-for-byte from a seed.
   *exhaustive* delay-bounded model checking: it finds a deep interleaving bug
   deterministically, or **passes as a bounded proof of correctness**.
 - **🧾 Find wrong answers** — an Elle-style serializability checker
-  (`world.check_serializable`) catches a store that returns a stale or impossible read —
-  not just one that crashes — and reports the cyclic read/write dependency.
+  (`world.check_serializable`) reports the cyclic read/write dependency behind a lost
+  update, and a Wing-Gong **linearizability** checker (`world.check_linearizable`)
+  catches the stale read serializability would excuse — including may-or-may-not-have-
+  applied writes from crashed clients.
 
 **Reproduce & debug it.**
 
@@ -227,9 +232,11 @@ faults injected, replayable byte-for-byte from a seed.
   replayable artifact on disk.
 - **🔁 Determinism guarantees** — a per-test self-check (run twice, locate the first
   diverging event), `PYTHONHASHSEED` auto-pin, and a queryable boundary registry.
-- **🕰 Causal trace** — record with `causal=True` and walk it: `simloom trace LOG --step N`
-  reconstructs state and the *happens-before stack* that woke it; `--changed x` is an
-  omniscient query; `simloom diff A B` finds the first divergence between two universes.
+- **🕰 Causal trace & time travel** — record with `causal=True` and walk it: `simloom trace
+  LOG --step N` reconstructs state and the *happens-before stack* that woke it; `simloom
+  diff A B` finds the first divergence between two universes. Record with `debug=True`
+  and query **everything**: `simloom debug LOG --var balance` prints every value a local
+  variable ever held — a lost update's double stale read is one query.
 - **🚨 Escape detection** — touch a real socket, signal, subprocess, or (un-patched) wall
   clock from inside the sim and you get an `EscapedSimulationError` at the exact call site
   instead of silent nondeterminism.
@@ -249,6 +256,23 @@ double-vote bug and exploration elects two leaders in one term in ~1 seed of 5;
 version survives, with coverage counters proving the faults actually fired.
 → `examples/toy_raft.py`
 
+## The harness is tested harder than your code
+
+A correctness tool's worst failure mode is *false confidence*, so simloom attacks itself
+the way it attacks your code. Beyond the 10,000-seed determinism torture, every CI run:
+
+- **differentially validates both consistency checkers** against independent brute-force
+  references (the offline campaign — 450k+ serializability and 320k+ linearizability
+  histories — found and fixed four checker incompleteness bugs before you ever saw them);
+- **fuzzes determinism with generated programs** — random workers, queues, locks,
+  cancellation, fault scripts against hosts and the network — every one must satisfy
+  `run == run == replay` byte-for-byte (20k programs + 2k fault-scripted worlds offline);
+- **checks semantics parity against stock asyncio** — programs with interleaving-
+  independent results must behave identically on the real loop (4k programs offline);
+- **cross-validates every `proven_correct` claim** against random exploration, runs the
+  determinism-critical suites with `PYTHONHASHSEED` *unpinned*, property-tests the
+  shrinker, and asserts every API misuse is a clean, named error.
+
 ## Honesty first
 
 A determinism claim is only as good as its disclosed limits. simloom raises a loud error

{simloom-0.2.0 → simloom-0.4.0}/README.md

@@ -162,8 +162,10 @@ faults injected, replayable byte-for-byte from a seed.
   (memory-BIO SSL, so aiohttp HTTPS just works).
 - **💥 Honest crashes & disk** — `host.crash()` is a power cut: tasks stop with no
   `finally` blocks, unsynced disk writes are lost or *torn*, peers see resets.
-- **🧩 Stand-in services** — `world.run_service(SimRedis(), …)` gives you an in-sim Redis
-  (SET/GET, WATCH/MULTI/EXEC) to test your logic against, with wire faults applied.
+- **🧩 Stand-in services** — `world.run_service(...)` gives you an in-sim **Redis**
+  (SET/GET, WATCH/MULTI/EXEC, for unmodified redis-py) and an in-sim **NATS** broker
+  (pub/sub, wildcards, queue groups, for unmodified nats-py) — with wire faults applied,
+  and queue-group delivery choices explored from the tape.
 
 **Break it.** Explore the schedules and faults your laptop never will.
 
@@ -183,8 +185,10 @@ faults injected, replayable byte-for-byte from a seed.
   *exhaustive* delay-bounded model checking: it finds a deep interleaving bug
   deterministically, or **passes as a bounded proof of correctness**.
 - **🧾 Find wrong answers** — an Elle-style serializability checker
-  (`world.check_serializable`) catches a store that returns a stale or impossible read —
-  not just one that crashes — and reports the cyclic read/write dependency.
+  (`world.check_serializable`) reports the cyclic read/write dependency behind a lost
+  update, and a Wing-Gong **linearizability** checker (`world.check_linearizable`)
+  catches the stale read serializability would excuse — including may-or-may-not-have-
+  applied writes from crashed clients.
 
 **Reproduce & debug it.**
 
@@ -192,9 +196,11 @@ faults injected, replayable byte-for-byte from a seed.
   replayable artifact on disk.
 - **🔁 Determinism guarantees** — a per-test self-check (run twice, locate the first
   diverging event), `PYTHONHASHSEED` auto-pin, and a queryable boundary registry.
-- **🕰 Causal trace** — record with `causal=True` and walk it: `simloom trace LOG --step N`
-  reconstructs state and the *happens-before stack* that woke it; `--changed x` is an
-  omniscient query; `simloom diff A B` finds the first divergence between two universes.
+- **🕰 Causal trace & time travel** — record with `causal=True` and walk it: `simloom trace
+  LOG --step N` reconstructs state and the *happens-before stack* that woke it; `simloom
+  diff A B` finds the first divergence between two universes. Record with `debug=True`
+  and query **everything**: `simloom debug LOG --var balance` prints every value a local
+  variable ever held — a lost update's double stale read is one query.
 - **🚨 Escape detection** — touch a real socket, signal, subprocess, or (un-patched) wall
   clock from inside the sim and you get an `EscapedSimulationError` at the exact call site
   instead of silent nondeterminism.
@@ -214,6 +220,23 @@ double-vote bug and exploration elects two leaders in one term in ~1 seed of 5;
 version survives, with coverage counters proving the faults actually fired.
 → `examples/toy_raft.py`
 
+## The harness is tested harder than your code
+
+A correctness tool's worst failure mode is *false confidence*, so simloom attacks itself
+the way it attacks your code. Beyond the 10,000-seed determinism torture, every CI run:
+
+- **differentially validates both consistency checkers** against independent brute-force
+  references (the offline campaign — 450k+ serializability and 320k+ linearizability
+  histories — found and fixed four checker incompleteness bugs before you ever saw them);
+- **fuzzes determinism with generated programs** — random workers, queues, locks,
+  cancellation, fault scripts against hosts and the network — every one must satisfy
+  `run == run == replay` byte-for-byte (20k programs + 2k fault-scripted worlds offline);
+- **checks semantics parity against stock asyncio** — programs with interleaving-
+  independent results must behave identically on the real loop (4k programs offline);
+- **cross-validates every `proven_correct` claim** against random exploration, runs the
+  determinism-critical suites with `PYTHONHASHSEED` *unpinned*, property-tests the
+  shrinker, and asserts every API misuse is a clean, named error.
+
 ## Honesty first
 
 A determinism claim is only as good as its disclosed limits. simloom raises a loud error

{simloom-0.2.0 → simloom-0.4.0}/pyproject.toml

@@ -51,6 +51,7 @@ spikes = [
     "aiohttp>=3.11",
     "httpx>=0.28",
     "redis>=5.0",
+    "nats-py>=2.9",
 ]
 
 [project.scripts]

{simloom-0.2.0 → simloom-0.4.0}/src/simloom/__init__.py

@@ -27,12 +27,18 @@ from ._eventlog import EVENT_LOG_FORMAT_VERSION, EventLog
 from ._explore import Exploration, Failure, explore
 from ._fingerprint import CorpusEntry, InterleavingCorpus, fingerprint, interleaving_edges
 from ._hashseed import is_pinned, pin_hashseed
+from ._linearizability import (
+    LinCall,
+    LinearizabilityResult,
+    RegisterHistory,
+    check_linearizable,
+)
 from ._loop import SimLoop
 from ._monitors import always, eventually, leads_to
 from ._net import SimDatagramTransport, SimNetwork, SimServer, SimTransport
 from ._run import RunResult, replay, run
 from ._sched import PCT, RandomWalk
-from ._services import SimRedis
+from ._services import SimNats, SimRedis
 from ._shrink import ShrinkResult, shrink
 from ._soak import SoakReport, soak
 from ._systematic import SystematicResult, explore_systematic
@@ -58,8 +64,11 @@ __all__ = [
     "Host",
     "InterleavingCorpus",
     "InvariantViolation",
+    "LinCall",
+    "LinearizabilityResult",
     "MisalignmentPolicy",
     "RandomWalk",
+    "RegisterHistory",
     "RunResult",
     "SerializabilityResult",
     "Settings",
@@ -69,6 +78,7 @@ __all__ = [
     "SimDisk",
     "SimLivelockError",
     "SimLoop",
+    "SimNats",
     "SimNetwork",
     "SimRedis",
     "SimServer",
@@ -85,6 +95,7 @@ __all__ = [
     "__version__",
     "always",
     "boundary",
+    "check_linearizable",
     "check_serializable",
     "draw",
     "eventually",

{simloom-0.2.0 → simloom-0.4.0}/src/simloom/_cli.py

@@ -139,6 +139,77 @@ def _cmd_diff(args: argparse.Namespace) -> int:
     return 1
 
 
+def var_timeline(events: Sequence[Event], name: str) -> list[Event]:
+    """Every point a local variable (debug mode) or observed value changed."""
+    out: list[Event] = []
+    for event in events:
+        if event.get("kind") == "trace" and name in (event.get("changed") or {}):
+            out.append(event)
+        elif event.get("kind") == "trace" and event.get("event") == "call":
+            if name in (event.get("args") or {}):
+                out.append(event)
+        elif event.get("kind") == "observe" and event.get("name") == name:
+            out.append(event)
+    return out
+
+
+def _format_trace(event: Event, name: str | None = None) -> str:
+    step = event.get("step")
+    prefix = f"step {step:>4}" if step is not None else "step    -"
+    kind = event.get("event")
+    if kind == "call":
+        args = ", ".join(f"{k}={v}" for k, v in (event.get("args") or {}).items())
+        return f"{prefix}  → {event.get('fn')}({args})"
+    if kind == "return":
+        return f"{prefix}  ← {event.get('fn')} returned {event.get('value')}"
+    if kind == "unwind":
+        return f"{prefix}  ✗ {event.get('fn')} raised {event.get('error')}"
+    location = f"{event.get('file', '?')}:{event.get('line', '?')}"
+    if name is not None:
+        value = (event.get("changed") or {}).get(name, (event.get("args") or {}).get(name))
+        return f"{prefix}  {location}  {name} = {value}"
+    changed = event.get("changed")
+    suffix = "  " + ", ".join(f"{k}={v}" for k, v in changed.items()) if changed else ""
+    return f"{prefix}  {location}{suffix}"
+
+
+def _cmd_debug(args: argparse.Namespace) -> int:
+    _header, events = load_log(args.log)
+    traces = [e for e in events if e.get("kind") == "trace"]
+    if not traces:
+        print("no trace events: record with run(..., debug=True)")
+        return 2
+    if args.var is not None:
+        for event in var_timeline(events, args.var):
+            if event.get("kind") == "observe":
+                print(f"step {event.get('step')!s:>4}  observe  {args.var} = {event.get('value')}")
+            else:
+                print(_format_trace(event, args.var))
+        return 0
+    if args.fn is not None:
+        for event in traces:
+            if event.get("event") in ("call", "return", "unwind") and args.fn in str(
+                event.get("fn", "")
+            ):
+                print(_format_trace(event))
+        return 0
+    if args.step is not None:
+        during = [e for e in traces if e.get("step") == args.step]
+        print(f"=== user code executed during step {args.step} ({len(during)} events) ===")
+        for event in during:
+            print(_format_trace(event))
+        return 0
+    kinds: dict[str, int] = {}
+    for event in traces:
+        kinds[str(event.get("event"))] = kinds.get(str(event.get("event")), 0) + 1
+    steps = {e.get("step") for e in traces if e.get("step") is not None}
+    print(
+        f"{len(traces)} trace events across {len(steps)} steps "
+        f"({', '.join(f'{k}: {v}' for k, v in sorted(kinds.items()))})"
+    )
+    return 0
+
+
 def main(argv: Sequence[str] | None = None) -> int:
     parser = argparse.ArgumentParser(prog="simloom", description="simloom debugging tools")
     sub = parser.add_subparsers(dest="command", required=True)
@@ -150,13 +221,24 @@ def main(argv: Sequence[str] | None = None) -> int:
     trace.add_argument("--changed", default=None, help="steps where an observed value changed")
     trace.set_defaults(func=_cmd_trace)
 
+    debug = sub.add_parser("debug", help="omniscient queries over a debug-mode log")
+    debug.add_argument("log", help="a JSONL event log recorded with debug=True")
+    debug.add_argument("--step", type=int, default=None, help="code executed during step N")
+    debug.add_argument("--var", default=None, help="full timeline of a local variable")
+    debug.add_argument("--fn", default=None, help="calls/returns of a function (substring)")
+    debug.set_defaults(func=_cmd_debug)
+
     diff = sub.add_parser("diff", help="first divergence between two event logs")
     diff.add_argument("a", help="first JSONL event log")
     diff.add_argument("b", help="second JSONL event log")
     diff.set_defaults(func=_cmd_diff)
 
     args = parser.parse_args(argv)
-    result: int = args.func(args)
+    try:
+        result: int = args.func(args)
+    except OSError as exc:
+        print(f"error: {exc}")
+        return 2
     return result
 
 

{simloom-0.2.0 → simloom-0.4.0}/src/simloom/_consistency.py

@@ -145,6 +145,103 @@ class _Graph:
             self.types[(u, v)] = kind
 
 
+def _is_prefix(shorter: list[Any], longer: list[Any]) -> bool:
+    return len(shorter) <= len(longer) and longer[: len(shorter)] == shorter
+
+
+def _intra_transaction_violation(txn: Transaction) -> str | None:
+    """In a serial order a transaction executes atomically: outside state is
+    frozen while it runs. So every read of key k must observe exactly
+    ``base + (this transaction's own prior appends to k)`` where ``base`` — the
+    pre-transaction state — is the same for all of the transaction's reads of k
+    and cannot contain the transaction's own (globally unique) values."""
+    own_values = {op.value for op in txn.ops if op.f == "append"}
+    appended_so_far: dict[str, list[Any]] = {}
+    base_of: dict[str, list[Any]] = {}
+    for op in txn.ops:
+        if op.f == "append":
+            appended_so_far.setdefault(op.key, []).append(op.value)
+            continue
+        observed = list(op.value)
+        own = appended_so_far.get(op.key, [])
+        if own and observed[len(observed) - len(own) :] != own:
+            return (
+                f"transaction {txn.index} read {observed!r} from {op.key!r}, which does "
+                f"not end with its own prior appends {own!r}"
+            )
+        base = observed[: len(observed) - len(own)] if own else observed
+        if any(value in own_values for value in base):
+            return (
+                f"transaction {txn.index} read {observed!r} from {op.key!r} containing "
+                f"a value it had not appended yet"
+            )
+        if op.key in base_of and base_of[op.key] != base:
+            return (
+                f"transaction {txn.index} observed two different pre-transaction states "
+                f"for {op.key!r}: {base_of[op.key]!r} and {base!r}"
+            )
+        base_of[op.key] = base
+    return None
+
+
+def _torn_transaction_violation(txns: tuple[Transaction, ...]) -> str | None:
+    """A transaction executes atomically, so its appends to a key land in the
+    serial sequence as one contiguous block — and states only exist at
+    transaction boundaries. A read observing *any* of a transaction's appends
+    to a key must therefore observe *all* of them, contiguously and in order.
+
+    An external read observing a torn slice of another transaction (or its
+    values out of order) can never be explained by any serial order. A
+    transaction's *own* mid-flight reads legitimately see a prefix of its own
+    appends; those are validated by ``_intra_transaction_violation`` instead.
+    """
+    appends_of: dict[tuple[int, str], list[Any]] = {}
+    appender: dict[tuple[str, Any], int] = {}
+    for txn in txns:
+        for op in txn.ops:
+            if op.f == "append":
+                appends_of.setdefault((txn.index, op.key), []).append(op.value)
+                appender[(op.key, op.value)] = txn.index
+    for txn in txns:
+        for op in txn.ops:
+            if op.f != "read":
+                continue
+            observed = list(op.value)
+            for writer in {appender.get((op.key, v)) for v in observed}:
+                if writer is None or writer == txn.index:
+                    continue  # unknown value, or an own-read (checked elsewhere)
+                block = appends_of[(writer, op.key)]
+                positions = [i for i, v in enumerate(observed) if v in set(block)]
+                if [observed[i] for i in positions] != block or positions != list(
+                    range(positions[0], positions[0] + len(block))
+                ):
+                    return (
+                        f"transaction {txn.index} read {observed!r} from {op.key!r}: it "
+                        f"observes a torn slice of transaction {writer}'s atomic appends "
+                        f"{block!r}"
+                    )
+    return None
+
+
+def _incompatible_reads_violation(txns: tuple[Transaction, ...]) -> str | None:
+    """A key's list only ever grows, so every read is a prefix of the final
+    sequence — any two reads of the same key must be prefix-related."""
+    reads_by_key: dict[str, list[list[Any]]] = {}
+    for txn in txns:
+        for op in txn.ops:
+            if op.f == "read":
+                reads_by_key.setdefault(op.key, []).append(list(op.value))
+    for key, reads in reads_by_key.items():
+        reads.sort(key=len)
+        for i in range(len(reads) - 1):
+            if not _is_prefix(reads[i], reads[i + 1]):
+                return (
+                    f"incompatible reads of {key!r}: {reads[i]!r} and {reads[i + 1]!r} "
+                    f"(neither is a prefix of the other, impossible for an append-only list)"
+                )
+    return None
+
+
 def check_serializable(history: History) -> SerializabilityResult:
     """Check a list-append history for serializability (Elle-style). Returns a
     result whose ``cycle`` (with per-edge ``edge_types``) witnesses any
@@ -153,40 +250,59 @@ def check_serializable(history: History) -> SerializabilityResult:
     if not txns:
         return SerializabilityResult(ok=True, message="empty history is serializable")
 
+    # 0. Sound structural pre-checks: reads that no serial order can explain,
+    #    regardless of transaction ordering (found by differential testing
+    #    against a brute-force reference — see tests/test_adversarial_checkers.py).
+    for txn in txns:
+        reason = _intra_transaction_violation(txn)
+        if reason is not None:
+            return SerializabilityResult(ok=False, message=f"serializability violation: {reason}")
+    reason = _incompatible_reads_violation(txns)
+    if reason is not None:
+        return SerializabilityResult(ok=False, message=f"serializability violation: {reason}")
+    reason = _torn_transaction_violation(txns)
+    if reason is not None:
+        return SerializabilityResult(ok=False, message=f"serializability violation: {reason}")
+
     # 1. Recover each key's version order from the longest read that observed it,
     #    and which transaction appended each (unique) value.
     version_order: dict[str, list[Any]] = {}
     appender: dict[Any, int] = {}
+    appends_by_key: dict[str, list[Any]] = {}
     for txn in txns:
         for op in txn.ops:
             if op.f == "append":
                 appender[op.value] = txn.index
+                appends_by_key.setdefault(op.key, []).append(op.value)
             elif op.f == "read":
                 observed = list(op.value)
                 if op.key not in version_order or len(observed) > len(version_order[op.key]):
                     version_order[op.key] = observed
 
     graph = _Graph()
-    for key, order in version_order.items():
-        index_of = {v: i for i, v in enumerate(order)}
+    for order in version_order.values():
         # 2. ww edges along the version order.
         for i in range(len(order) - 1):
             a, b = appender.get(order[i]), appender.get(order[i + 1])
             if a is not None and b is not None:
                 graph.add(a, b, "ww")
-        # 3. wr and rw edges from each read of this key.
-        for txn in txns:
-            for op in txn.ops:
-                if op.f != "read" or op.key != key:
-                    continue
-                observed = list(op.value)
-                for v in observed:  # wr: the writer of an observed value precedes us
-                    w = appender.get(v)
-                    if w is not None:
-                        graph.add(w, txn.index, "wr")
-                # rw: we precede the writer of every version we did NOT see
-                last_seen = index_of.get(observed[-1], -1) if observed else -1
-                for v in order[last_seen + 1 :]:
+    # 3. wr and rw edges from every read. The rw rule is deliberately broader
+    #    than the version order: an append is never un-observed (the list only
+    #    grows), so a read that does NOT contain value v must precede v's
+    #    append — even if v was never observed by any read. (The narrow
+    #    version-order-only rule missed cross-key atomicity cycles; found by
+    #    differential testing against a brute-force reference.)
+    for txn in txns:
+        for op in txn.ops:
+            if op.f != "read":
+                continue
+            observed_set = set(op.value)
+            for v in op.value:  # wr: the writer of an observed value precedes us
+                w = appender.get(v)
+                if w is not None:
+                    graph.add(w, txn.index, "wr")
+            for v in appends_by_key.get(op.key, ()):
+                if v not in observed_set:
                     w = appender.get(v)
                     if w is not None:
                         graph.add(txn.index, w, "rw")