Testing

Lime Sync treats a green build as evidence only when the check can fail for the bug it claims to catch. The suite combines independent reference implementations, generated histories, injected faults, and known-bug patches. Each layer answers a different question.

The exact build ledger below stays unverified until every required CI job passes at one commit. Historical runs and local checks never become release evidence by implication.

Coverage model

Reference agreement

Seeded traces compare the Rust engine with the TypeScript reference core and stock Zero for the exercised query and mutation corpus.

State and history invariants

Generated workloads check atomic visibility, exactly-once mutation application, permission transitions, cookie ordering, and convergence.

Fault and lifecycle testing

Named transaction faults, transport outages, restarts, retention pruning, storage failures, and Durable Object eviction run through real host lanes.

Mutation testing

Known-bug patches prove the Rust and TypeScript suites go red when core guarantees are removed.

Known-bug matrix

The runnable corpus currently contains twelve patches. Nine mutate the Rust engine. Three mutate the TypeScript Durable Object host, where admission, change publication, and namespace backup behavior live.

Target	Known bugs exercised	Gate
Rust engine	9 query, mutation, retention, and watermark defects	Full matrix nightly; focused behavioral lanes on every change
TypeScript host	3 reader/writer admission, committed-change publication, and backup-session defects	All three patches on every pull request

The backup mutant earned its place by exposing a real hole. It bypassed the production worker’s read-session wiring and the complete host suite stayed green. The added wiring test now drives createOrezDataWorker with backups enabled and requires one read-only application SQL session for the whole scan. The lower-level test races an invariant-preserving account and ledger write against that scan. Together they make the same mutant fail for the reason the production bug mattered: a dump must represent a state that one transaction actually produced.

The pull-request gate stores the matrix result as a workflow artifact. The nightly run widens the matrix across the Rust system lanes. A mutant that compiles and survives every compatible lane is reported as an uncovered gap.

Exact build evidence

Verified at this exact build SHA.Every required CI job passed at fe1c07c6ad1e. v0.16.20 resolves to f80ad4f00d77, so this is a verified build rather than a verified release.

Build identity

Release: v0.16.20
Release SHA: f80ad4f00d77ba63d7025c58a2d19df3e87b79f8
Qualified build SHA: fe1c07c6ad1e1df05505f4b40c04e2f905c66344
Last green run: Run 38487254144

Zero: 1.9.0
Rust toolchain: 1.94.0
SQLite: 3.46.0 · rusqlite 0.32.1 · libsqlite3-sys 0.30.1
workerd / Wrangler: 1.20260617.1 / 4.103.0

Qualification summary

Qualified: Oct 14, 2026, 12:06 AM
Scenarios: 325
Seed: 38,487,254,144
Counted operations: 93
Restarts: 23
Wall duration: 9m 52s

recorded generated lifecycle steps from the state-machine trace artifacts; randomized sweep rounds, protocol-fuzz cases, push-soak operations, and SQLite statements are executed but not summed here

Per-host compatibility

Host	Status	Qualified contract
Native	pass	sync-native HTTP, SQLite transactions, wake, permissions, query lifecycle
WASM / workerd	pass	sync-wasm representation and the local Durable Object host boundary
Stock-Zero differential	pass	Named-query results and randomized incremental behavior against Zero 1.7.0

Suite ledger

Core / native SQLite

Deterministic Rust core

pass

Scenarios: 296
Seed: —
Operations: —
Restarts: 0
Duration: 4m 5s

What this run proves

This suite covers cookies, patches, mutation IDs, retention, query membership, permissions, and model invariants at the recorded SHA.

What this run does not prove

It does not prove HTTP host lifecycle, workerd behavior, production capacity, or application-specific schemas and policies.

Reproduce this suite

cargo test --workspace

Immutable logs Run artifacts

sync-native

Native host qualification

pass

Scenarios: 10
Seed: 38,487,254,144
Operations: —
Restarts: 0
Duration: 2m 38s

What this run proves

This suite exercises the release native binary through real Zero clients, concurrent clients, permissions, wake, and query lifecycle; validates recorded atomic-visibility and exactly-once histories with checkers that are themselves red-proofed; runs the pinned Elle list-append analysis on the recorded history; and cuts a mutation's row effects from its ack under a one-row diff cap.

What this run does not prove

It does not prove the Cloudflare host, multi-region behavior, unbounded namespace sizes, or a consumer's recovery objectives.

Reproduce this suite

cd harness && bun src/shapes.ts --against rust-local

cd harness && bun src/sweep.ts --against rust-local --rounds 10 --seed 38487254144

cd harness && bun src/queries.ts --against rust-local

cd harness && bun src/atomic-visibility-lane.ts --target rust-local --seed 38487254144

scripts/elle/check-history.sh

cd harness && bun src/capped-diff-lane.ts --target rust-local

Immutable logs Run artifacts

sync-wasm + local workerd

WASM / workerd qualification

pass

Scenarios: 9
Seed: 38,487,254,144
Operations: 42
Restarts: 11
Duration: 6m 56s

What this run proves

This suite covers WASM value boundaries, local Durable Object SQLite transactions, ingest, restart, push-memory soak, protocol fuzz, recovery faults, backup/restore, and generated lifecycle transitions under the pinned workerd.

What this run does not prove

Local workerd is not the Cloudflare production service and does not establish isolate memory, regional propagation, quota, or eviction behavior in a deployed account.

Reproduce this suite

cd packages/sync-cf-host && bun run test

cd harness && bun src/push-memory-soak.ts --target rust-cf --blocks 3 --ops 3000 --writers 12

cd harness && bun src/protocol-fuzz.ts --target rust-cf --cases 500 --seed 38487254144 --concurrency 20

cd harness && bun src/state-machine.ts --against rust-cf --seed 38487254144 --steps 24

Immutable logs Run artifacts

sync-native + stock-Zero oracle

Native fault and lifecycle qualification

pass

Scenarios: 8
Seed: 38,487,254,144
Operations: 51
Restarts: 12
Duration: 2m 13s

What this run proves

This suite covers pinned upstream corpus agreement, malformed protocol input, reconnect/retention (including a client offline past the retention floor), process eviction, transactional storage faults, backup/restore, and the composed nemesis state machine on the native host: receipted engine faults at named boundaries, a transport outage held open across a fault arm and a restart, and a full prune plus restart that must keep the served cookie monotonic.

What this run does not prove

Injected faults cover named boundaries and generated traces, not every operating-system, filesystem, hardware, or application failure mode.

Reproduce this suite

cd harness && bun src/corpus-check.ts

cd harness && bun src/upstream-corpus.ts --hosts stock-zero,sync-native

cd harness && bun src/protocol-fuzz.ts --target rust-local --cases 500 --seed 38487254144 --concurrency 20

cd harness && bun src/state-machine.ts --against rust-local --nemesis --seed 38487254144 --steps 24

Immutable logs Run artifacts

Zero 1.7.0 oracle

Stock-Zero differential

pass

Scenarios: 2
Seed: 38,487,254,144
Operations: —
Restarts: 0
Duration: 2m 56s

What this run proves

Named and seeded query scenarios produce the same observable results as the pinned stock Zero server for the exercised corpus.

What this run does not prove

Differential agreement is limited to the recorded corpus and Zero version; it is not a claim of internal implementation equivalence or future-version compatibility.

Reproduce this suite

cd harness && bun src/shapes.ts --against rust-local

cd harness && bun src/query-diff.ts

cd harness && bun src/sweep.ts --against rust-local --rounds 10 --seed 38487254144

Immutable logs Run artifacts

Reproduce the qualification

Environment

mise use node@24.3.0
bun install --frozen-lockfile
cd harness && bun install --frozen-lockfile

Core commands

cargo test --workspace
cd harness && bun src/shapes.ts --against rust-local
cd harness && bun src/sweep.ts --against rust-local --rounds 10 --seed 38487254144
cd harness && bun src/state-machine.ts --against rust-local --nemesis --seed 38487254144 --steps 24
cd packages/sync-cf-host && bun run test

Logs, artifacts, and regression traces

Qualification logs CI evidence JSON Minimized regression traces (4)

Links identify one immutable workflow run. GitHub retains its logs and artifacts for 90 days. An empty trace archive includes a manifest; seeded failures include their minimized JSON and exact replay command.

Known limitations

Build fe1c07c6ad1e1df05505f4b40c04e2f905c66344 passed the required CI jobs and is verified at that exact SHA. It is newer than release v0.16.20, which resolves to f80ad4f00d77ba63d7025c58a2d19df3e87b79f8, so it is not labeled as a verified release.
The workerd lane is local emulation; deployed Cloudflare isolate memory, quota, eviction, and regional propagation require a separate named deployment qualification.
The compatibility corpus is pinned to Zero 1.9.0 and does not imply compatibility with later Zero releases.
Scenario counts are the distinct harness lanes CI ran per host; the operation total counts only the recorded state-machine lifecycle steps, not every sweep round, protocol-fuzz case, soak push, internal assertion, HTTP request, or SQLite statement.
GitHub Actions logs and artifacts are immutable per run but retained for 90 days.

Unresolved red or fragile lanes

Release identity

awaiting

The build is CI-verified, but v0.16.20 names f80ad4f00d77ba63d7025c58a2d19df3e87b79f8 rather than fe1c07c6ad1e1df05505f4b40c04e2f905c66344.

Lane record

Deployed Cloudflare qualification

fragile

The deployed rust-cf query differential and platform-specific soak remain outside the standard CI gate.

Lane record

Release gate

CI publishes verified build evidence only after every required job succeeds at the exact build SHA. It labels that build a verified release only when the immutable release tag resolves to the same SHA.

Required jobs: test, harness, native-integration, rust, rust-local, rust-local-faults, sync-cf-host, sync-browser-host.

Previous← Operations

NextLimitations →