Found by PR #773's independent reviewer at round 2, classed non-blocking and deliberately
left out of that PR's scope. #773 merged as 3d60bfd.
The reduction in models.rs that computes a loaded model's y_bottom is ungraded:
corrupting it leaves the whole eqoxide-renderer crate green.
Measured
The reviewer built the mutation as an evasion against #773's new source-text pin and ran it:
E2 — corrupt the loader: y_bottom = -y_min -> -y_min + (y_max - y_min)
result: GREEN 215 passed / 0 failed / 11 ignored
Nothing in the crate notices. Note what that number is: (y_max - y_min) is the model
extent, so this mutation reintroduces exactly the over-lift #768 was about — the same
magnitude, by a different route, one file upstream of where #773 fixed it.
Why #773 does not cover it
#773's guarantee is a source-text pin over the four static_placement call sites in
pass.rs. It constrains how those calls are spelled; it does not constrain what the names
in those spellings denote. That limit is now stated explicitly in the merged code at
crates/eqoxide-renderer/tests/floating_placement.rs:509-510 — "not that model.y_bottom
itself holds what the loader intended" — so this issue is the other side of a boundary the
repo already documents, not a surprise.
Shape of a fix
Grade the reduction directly: a test over the loader that asserts y_bottom equals the
intended quantity for a known input, so the mutation above goes RED. A fixture with hand-known
bounds is enough; this does not need a GPU or a real asset.
Verification
Mutation-check it both ways, per the repo's verification hierarchy — apply the -y_min + (y_max - y_min) corruption and confirm the new test fails, then restore and confirm it passes.
A test that passes both ways is worthless, and several have shipped that way here.
Refs #768, #773.
Found by PR #773's independent reviewer at round 2, classed non-blocking and deliberately
left out of that PR's scope. #773 merged as
3d60bfd.The reduction in
models.rsthat computes a loaded model'sy_bottomis ungraded:corrupting it leaves the whole
eqoxide-renderercrate green.Measured
The reviewer built the mutation as an evasion against #773's new source-text pin and ran it:
Nothing in the crate notices. Note what that number is:
(y_max - y_min)is the modelextent, so this mutation reintroduces exactly the over-lift #768 was about — the same
magnitude, by a different route, one file upstream of where #773 fixed it.
Why #773 does not cover it
#773's guarantee is a source-text pin over the four
static_placementcall sites inpass.rs. It constrains how those calls are spelled; it does not constrain what the namesin those spellings denote. That limit is now stated explicitly in the merged code at
crates/eqoxide-renderer/tests/floating_placement.rs:509-510— "not thatmodel.y_bottomitself holds what the loader intended" — so this issue is the other side of a boundary the
repo already documents, not a surprise.
Shape of a fix
Grade the reduction directly: a test over the loader that asserts
y_bottomequals theintended quantity for a known input, so the mutation above goes RED. A fixture with hand-known
bounds is enough; this does not need a GPU or a real asset.
Verification
Mutation-check it both ways, per the repo's verification hierarchy — apply the
-y_min + (y_max - y_min)corruption and confirm the new test fails, then restore and confirm it passes.A test that passes both ways is worthless, and several have shipped that way here.
Refs #768, #773.