test: add metamorphic, example-exec, JIT-edge, and cargo-fuzz harnesses

Close the four remaining gaps in the dynamic-testing plan.

#3 Metamorphic differential tests (tests/metamorphic.rs): for known-valid
   programs spanning the executable subset, apply semantics-preserving rewrites
   (reformat, trivia injection, unused local, top-level reorder, dead function)
   and require every backend still agrees AND produces the same output as the
   base; structure-preserving transforms must also leave the review
   classification unchanged.

#7 Example-corpus differential execution (tests/examples_exec.rs): the static
   sweep already checks+lowers examples/scripts; this runs the pure synchronous
   subset across all backends and asserts agreement. The skip predicate is
   derived from the source (I/O, timing, async, plus one documented VM
   capability gap: struct-typed Map/Set keys in uop_interning).

#5 JIT arithmetic-edge matrix (tests/jit_arithmetic_edges.rs): the edges the
   generative suite skips - i64 add/mul overflow, div/mod by zero, MIN/-1
   div+mod (all trap cleanly), shift wrap, NaN, signed zero, float infinity
   (all agree). Each op lives in a pure helper called with read-args so the JIT
   actually compiles and guards it.

#2 cargo-fuzz harness (fuzz/): a detached-workspace crate (never built by
   cargo build --workspace) with two libFuzzer targets - parse_check (front-end
   never-panics) and format_idempotent (format(format(x)) == format(x)).

Adds common::differential::backends_agreed_stdout for the new sweeps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

crates/rsscript/tests/common/differential.rs

@@ -155,13 +155,15 @@ pub fn assert_backends_all_fail(file: &str, source: &str, args: &[&str]) {
     }
 }
 
-/// Like [`assert_backends_agree`] but with an explicit backend set.
+/// Like [`assert_backends_agree`] but with an explicit backend set. Returns the
+/// stdout every backend agreed on (useful for comparing a program against a
+/// semantics-preserving variant of it).
 pub fn assert_backends_agree_on(
     file: &str,
     source: &str,
     args: &[&str],
     backends: &[Box<dyn Backend>],
-) {
+) -> String {
     let mut reference: Option<(&'static str, String)> = None;
     for backend in backends {
         let stdout = backend
@@ -182,4 +184,12 @@ pub fn assert_backends_agree_on(
             ),
         }
     }
+    reference.expect("at least one backend").1
+}
+
+/// Run `source` on every backend, assert they all agree, and return the agreed
+/// stdout. The metamorphic-test entry point: it both enforces N-way parity and
+/// hands back the value to compare across equivalent program variants.
+pub fn backends_agreed_stdout(file: &str, source: &str, args: &[&str]) -> String {
+    assert_backends_agree_on(file, source, args, &all_backends())
 }

crates/rsscript/tests/examples_exec.rs

@@ -0,0 +1,111 @@
+//! Differential execution of the example corpus.
+//!
+//! `checker_frontend::misc::examples_have_no_diagnostics_and_lower_to_runnable_packages`
+//! already proves every `examples/scripts/**/*.rss` type-checks and lowers to a
+//! `todo!`-free Rust package. That is the *static* half. This is the *dynamic*
+//! half: the synchronous, side-effect-free example scripts are run through every
+//! executable backend (VM interpreter, JIT, native tier when built, and the
+//! compiled-Rust path) and required to agree. It catches the "valid example,
+//! divergent backend" / doc-drift class without per-example expected-output
+//! files.
+//!
+//! Scripts that need real runtime resources (files, network, env, the clock) or
+//! that exercise the async scheduler are skipped here — they are non-trivial to
+//! run deterministically in a unit test and are covered by the dedicated
+//! `vm_eval_parity` fixtures (with temp dirs and local servers) and the static
+//! sweep above. The skip is decided from the source itself so a newly added pure
+//! example is picked up automatically.
+
+mod common;
+
+use common::differential::backends_agreed_stdout;
+
+/// Namespaces / constructs whose behavior depends on real runtime resources or
+/// on scheduler timing, which this in-process differential cannot reproduce
+/// deterministically. A script touching any of these is left to the static
+/// check+lower sweep and the resource-backed `vm_eval_parity` tests.
+const NON_DETERMINISTIC_MARKERS: &[&str] = &[
+    // Real I/O and host boundaries.
+    "File.",
+    "Directory.",
+    "Http.",
+    "WebSocket.",
+    "Socket.",
+    "Tcp",
+    "Net.",
+    "Process.",
+    "Env.",
+    "System.",
+    // Wall-clock / timing.
+    "Clock.",
+    "Deadline.",
+    "Instant.",
+    "Timer.",
+    "sleep",
+    // Non-determinism.
+    "Random.",
+    "Rng.",
+    // Async scheduler (ordering is covered by the async parity fixtures).
+    "spawn ",
+    "await ",
+    "async ",
+    "Channel",
+    "TaskGroup",
+    "Cancellation",
+    "Select",
+];
+
+fn needs_runtime_resources(source: &str) -> bool {
+    NON_DETERMINISTIC_MARKERS
+        .iter()
+        .any(|marker| source.contains(marker))
+}
+
+/// Example scripts that lower and run on the compiled backend but hit a known
+/// *capability* gap in the register VM (a clean `Runtime` error, not a crash),
+/// so they can't take part in the N-way agreement check. Each entry documents
+/// the specific gap. Path suffixes (matched with `ends_with`) to stay
+/// location-independent.
+const KNOWN_VM_UNSUPPORTED: &[&str] = &[
+    // The register VM does not support struct-typed Map/Set keys; the compiled
+    // backend does. This example interns `Uop` structs in a Map<Uop, _>/Set<Uop>.
+    "examples/scripts/core/uop_interning.rss",
+];
+
+fn known_vm_unsupported(name: &str) -> bool {
+    KNOWN_VM_UNSUPPORTED
+        .iter()
+        .any(|suffix| name.replace('\\', "/").ends_with(suffix))
+}
+
+#[test]
+fn example_scripts_agree_across_backends() {
+    let mut executed = Vec::new();
+    let mut skipped = Vec::new();
+
+    for path in common::recursive_paths_with_extension("examples/scripts", "rss") {
+        let source = common::read_fixture(&path);
+        let name = path.to_str().expect("utf-8 path");
+
+        if needs_runtime_resources(&source) || known_vm_unsupported(name) {
+            skipped.push(name.to_string());
+            continue;
+        }
+
+        // Panics (with the diverging backend pair and the source) on any
+        // failure or mismatch, so a divergence names the exact example.
+        let _ = backends_agreed_stdout(name, &source, &[]);
+        executed.push(name.to_string());
+    }
+
+    // Guard against the predicate silently excluding everything (which would
+    // turn this into a vacuous test): the pure `basic/` scripts alone exceed
+    // this floor, so dropping below it signals the corpus or predicate drifted.
+    assert!(
+        executed.len() >= 6,
+        "expected the differential sweep to execute several example scripts, \
+         ran {} (skipped {}): executed={executed:?}",
+        executed.len(),
+        skipped.len()
+    );
+}

crates/rsscript/tests/jit_arithmetic_edges.rs

@@ -0,0 +1,208 @@
+//! JIT arithmetic-edge differential matrix.
+//!
+//! The generative `backend_differential` suite deliberately *skips* the
+//! arithmetic edges (it `prop_assume!(oracle.is_some())`, dropping overflow, and
+//! its float strategy avoids division and NaN). Those edges are exactly where a
+//! JIT tier is most likely to diverge from the interpreter: native code that
+//! must trap on i64 overflow / divide-by-zero / `i64::MIN / -1`, mask an
+//! out-of-range shift, and reproduce IEEE-754 NaN / signed-zero semantics — or
+//! correctly bail to the interpreter at the guard.
+//!
+//! Each case runs through every backend (`vm-interpreter`, `vm-jit`, the native
+//! tier and its force-deopt twin when built, and `rust-compiled`) and asserts
+//! one of two contracts:
+//!
+//!   * **trap edges** — every backend fails with a clean RSScript runtime error
+//!     (no host panic, no garbage), via [`assert_backends_all_fail`]; and
+//!   * **value edges** — every backend returns the identical observable value,
+//!     via [`assert_backends_agree`].
+//!
+//! Each arithmetic operation lives in a small pure helper called with `read`
+//! arguments so the value is unknown at compile time and the JIT actually
+//! compiles (and guards) the operation rather than constant-folding it.
+
+mod common;
+
+use common::differential::{assert_backends_agree, assert_backends_all_fail};
+
+/// `i64::MAX` is expressible as a literal; `i64::MIN` is built as
+/// `(0 - i64::MAX) - 1` because the bare literal `9223372036854775808` would
+/// overflow the `Int` lexer. Shared prelude installed in `main` before each call.
+const MIN_PRELUDE: &str = "    let max = 9223372036854775807\n    \
+                           let min = 0 - max - 1\n    let neg_one = 0 - 1\n";
+
+// --- Trap edges: every backend must fail cleanly -------------------------
+
+#[test]
+fn jit_edge_integer_addition_overflow_traps_on_all_backends() {
+    let source = "\
+fn add(a: Int, b: Int) -> Int {
+    return a + b
+}
+
+fn main() -> Unit {
+    Log.write(message: read String.from_int(value: add(a: read 9223372036854775807, b: read 1)))
+    return Unit
+}
+";
+    assert_backends_all_fail("jit-edge-add-overflow.rss", source, &[]);
+}
+
+#[test]
+fn jit_edge_integer_multiplication_overflow_traps_on_all_backends() {
+    let source = "\
+fn mul(a: Int, b: Int) -> Int {
+    return a * b
+}
+
+fn main() -> Unit {
+    Log.write(message: read String.from_int(value: mul(a: read 3037000500, b: read 3037000500)))
+    return Unit
+}
+";
+    assert_backends_all_fail("jit-edge-mul-overflow.rss", source, &[]);
+}
+
+#[test]
+fn jit_edge_integer_division_by_zero_traps_on_all_backends() {
+    let source = "\
+fn div(a: Int, b: Int) -> Int {
+    return a / b
+}
+
+fn main() -> Unit {
+    Log.write(message: read String.from_int(value: div(a: read 10, b: read 0)))
+    return Unit
+}
+";
+    assert_backends_all_fail("jit-edge-div-zero.rss", source, &[]);
+}
+
+#[test]
+fn jit_edge_integer_modulo_by_zero_traps_on_all_backends() {
+    let source = "\
+fn rem(a: Int, b: Int) -> Int {
+    return a % b
+}
+
+fn main() -> Unit {
+    Log.write(message: read String.from_int(value: rem(a: read 10, b: read 0)))
+    return Unit
+}
+";
+    assert_backends_all_fail("jit-edge-mod-zero.rss", source, &[]);
+}
+
+#[test]
+fn jit_edge_int_min_divided_by_neg_one_traps_on_all_backends() {
+    let source = format!(
+        "\
+fn div(a: Int, b: Int) -> Int {{
+    return a / b
+}}
+
+fn main() -> Unit {{
+{MIN_PRELUDE}    Log.write(message: read String.from_int(value: div(a: read min, b: read neg_one)))
+    return Unit
+}}
+"
+    );
+    assert_backends_all_fail("jit-edge-min-div-neg1.rss", &source, &[]);
+}
+
+#[test]
+fn jit_edge_int_min_modulo_neg_one_traps_on_all_backends() {
+    let source = format!(
+        "\
+fn rem(a: Int, b: Int) -> Int {{
+    return a % b
+}}
+
+fn main() -> Unit {{
+{MIN_PRELUDE}    Log.write(message: read String.from_int(value: rem(a: read min, b: read neg_one)))
+    return Unit
+}}
+"
+    );
+    assert_backends_all_fail("jit-edge-min-mod-neg1.rss", &source, &[]);
+}
+
+// --- Value edges: every backend must agree -------------------------------
+
+#[test]
+fn jit_edge_shift_amount_wraps_consistently() {
+    // `wrapping_shl`/`wrapping_shr` mask the count to 0..63, so a shift of 64 is
+    // a shift of 0. Every backend must agree on this defined wrap rather than
+    // panic (debug `<<`) or produce a target-dependent value.
+    let source = "\
+fn shl(value: Int, bits: Int) -> Int {
+    return Int.shift_left(value: read value, bits: read bits)
+}
+
+fn shr(value: Int, bits: Int) -> Int {
+    return Int.shift_right(value: read value, bits: read bits)
+}
+
+fn main() -> Unit {
+    Log.write(message: read String.from_int(value: shl(value: read 1, bits: read 64)))
+    Log.write(message: read String.from_int(value: shl(value: read 1, bits: read 63)))
+    Log.write(message: read String.from_int(value: shr(value: read 256, bits: read 64)))
+    Log.write(message: read String.from_int(value: shr(value: read 256, bits: read 4)))
+    return Unit
+}
+";
+    assert_backends_agree("jit-edge-shift-wrap.rss", source, &[]);
+}
+
+#[test]
+fn jit_edge_float_nan_is_not_equal_to_itself() {
+    // `0.0 / 0.0` is NaN; `NaN == NaN` is false on every backend. Reduced to a
+    // Bool so float *formatting* (which is not under test here) can't diverge.
+    let source = "\
+fn nan(a: Float, b: Float) -> Float {
+    return a / b
+}
+
+fn main() -> Unit {
+    let value = nan(a: read 0.0, b: read 0.0)
+    Log.write(message: read String.from_bool(value: value == value))
+    return Unit
+}
+";
+    assert_backends_agree("jit-edge-float-nan.rss", source, &[]);
+}
+
+#[test]
+fn jit_edge_float_signed_zero_compares_equal() {
+    // `-0.0 == 0.0` is true under IEEE-754; every backend must agree.
+    let source = "\
+fn neg(value: Float) -> Float {
+    return 0.0 - value
+}
+
+fn main() -> Unit {
+    let negative_zero = neg(value: read 0.0)
+    Log.write(message: read String.from_bool(value: negative_zero == 0.0))
+    return Unit
+}
+";
+    assert_backends_agree("jit-edge-float-signed-zero.rss", source, &[]);
+}
+
+#[test]
+fn jit_edge_float_division_by_zero_yields_infinity() {
+    // `1.0 / 0.0` is +inf (no trap, unlike Int): every backend must agree it is
+    // greater than any finite value. Reduced to a Bool to avoid inf formatting.
+    let source = "\
+fn div(a: Float, b: Float) -> Float {
+    return a / b
+}
+
+fn main() -> Unit {
+    let infinity = div(a: read 1.0, b: read 0.0)
+    Log.write(message: read String.from_bool(value: infinity > 1000000.0))
+    return Unit
+}
+";
+    assert_backends_agree("jit-edge-float-inf.rss", source, &[]);
+}