chore(symexec): fix CI (fmt, clippy, rustdoc)

- rustfmt: reflow long doc/string lines per nightly fmt
- clippy: make BranchTrace::{len,is_empty} const, allow too_many_arguments on SymBackend::propose trait method, remove redundant clones in regression tests
- rustdoc: replace broken intra-doc link to private super::corpus and wrap SaferMaker URL in angle brackets
- private_interfaces: demote 'pub mod symexec' to 'pub(crate)' since callers are all in-crate; trim re-exports to what's actually used (run_symexec_assist, SymExecState, SeedSnapshot)
- drop unused MAX_SEEDS_PER_CYCLE constant

Amp-Thread-ID: https://ampcode.com/threads/T-019e2bc9-ece8-718f-9279-971e3e982bec
Co-authored-by: Amp <amp@ampcode.com>

Author: figtracer

crates/evm/evm/src/executors/fuzz/mod.rs

@@ -507,8 +507,7 @@ impl<FEN: FoundryEvmNetwork> FuzzedExecutor<FEN> {
         // that flip an unseen branch, validates them via normal coverage,
         // and writes accepted candidates into its own `sync/` directory so
         // the existing corpus protocol distributes them.
-        let symexec_active =
-            worker_id == 0 && self.config.corpus.symexec_assist_active();
+        let symexec_active = worker_id == 0 && self.config.corpus.symexec_assist_active();
         let symexec_interval = self.config.corpus.symexec_assist_interval.max(1);
         let mut runs_since_symexec: u32 = 0;
         let mut symexec_state = SymExecState::default();

crates/evm/evm/src/executors/mod.rs

@@ -63,7 +63,7 @@ pub use invariant::InvariantExecutor;
 
 mod corpus;
 mod sancov;
-pub mod symexec;
+pub(crate) mod symexec;
 mod trace;
 
 pub use trace::TracingExecutor;

crates/evm/evm/src/executors/symexec/mod.rs

@@ -2,20 +2,20 @@
 //!
 //! Implements the *worker-side* of the architectural plan inspired by
 //! Echidna's `Echidna.SymExec.Exploration` and the SaferMaker writeup at
-//! https://hackmd.io/@SaferMaker/EVM-Sym-Exec.
+//! <https://hackmd.io/@SaferMaker/EVM-Sym-Exec>.
 //!
 //! It is *not* a full symbolic-execution engine; it is a directed mutation
 //! assistant that:
 //!
 //! 1. takes a corpus seed (`Vec<BasicTxDetails>`),
 //! 2. replays it concretely under a [`crate::inspectors::BranchTraceInspector`],
 //! 3. picks the deepest *unseen* opposite-side branch as the "frontier",
-//! 4. proposes ABI-aware calldata rewrites that — given the recovered
-//!    compare operands — would flip the frontier branch,
-//! 5. validates each candidate through the normal executor (requiring a real
-//!    new edge in coverage), and
-//! 6. writes accepted candidates to the master worker's `sync/` directory so
-//!    the existing corpus protocol distributes them.
+//! 4. proposes ABI-aware calldata rewrites that — given the recovered compare operands — would flip
+//!    the frontier branch,
+//! 5. validates each candidate through the normal executor (requiring a real new edge in coverage),
+//!    and
+//! 6. writes accepted candidates to the master worker's `sync/` directory so the existing corpus
+//!    protocol distributes them.
 //!
 //! v1 is intentionally minimal:
 //! - master worker only,
@@ -39,18 +39,18 @@ mod mutate;
 mod select;
 mod types;
 
-pub use mutate::propose_calldata_rewrites;
-pub use select::{SeedSnapshot, pick_frontier, pick_seed, score_seed, unseen_in_history};
-pub use types::{
-    Candidate, FrontierKey, FrontierStats, MAX_CANDIDATES_PER_FRONTIER, MAX_FRONTIER_ATTEMPTS,
-    MAX_SEEDS_PER_CYCLE, SymExecState,
-};
+use mutate::propose_calldata_rewrites;
+pub use select::SeedSnapshot;
+use select::pick_seed;
+pub use types::SymExecState;
+use types::{Candidate, FrontierKey};
 
 /// Backend abstraction so v2 can swap the heuristic engine for a real SMT
 /// solver (or external `hevm`) without touching the assist loop.
 pub trait SymBackend {
     /// Generate candidate sequences from a seed and its branch trace.
     /// `tx_index` identifies the call to mutate (the last one, in v1).
+    #[allow(clippy::too_many_arguments)]
     fn propose(
         &self,
         seed: &[BasicTxDetails],
@@ -181,9 +181,8 @@ pub fn run_symexec_assist<FEN: FoundryEvmNetwork>(
         return Ok(0);
     }
 
-    // 2. Resolve the ABI of the call slot we're allowed to mutate. For
-    //    invariant tests this is looked up from the targeted contracts;
-    //    for stateless fuzz the caller already supplied it.
+    // 2. Resolve the ABI of the call slot we're allowed to mutate. For invariant tests this is
+    //    looked up from the targeted contracts; for stateless fuzz the caller already supplied it.
     let resolved_function: Option<Function> = match (function, targeted_contracts) {
         (Some(f), _) => Some(f.clone()),
         (None, Some(targets)) => seed

crates/evm/evm/src/executors/symexec/select.rs

@@ -49,11 +49,11 @@ pub fn pick_seed(candidates: &[SeedSnapshot]) -> Option<&SeedSnapshot> {
 /// Pick a frontier from a replay trace.
 ///
 /// Strategy:
-/// - prefer the *deepest* observation whose opposite edge is currently unseen
-///   (the seed already satisfies all earlier guards),
+/// - prefer the *deepest* observation whose opposite edge is currently unseen (the seed already
+///   satisfies all earlier guards),
 /// - skip frontiers that have hit `MAX_FRONTIER_ATTEMPTS`,
-/// - skip frontiers without a recoverable compare (v1 has no symbolic
-///   reasoning beyond ABI rewrites of compare operands).
+/// - skip frontiers without a recoverable compare (v1 has no symbolic reasoning beyond ABI rewrites
+///   of compare operands).
 pub fn pick_frontier<F>(
     trace: &BranchTrace,
     tx_index: u32,

crates/evm/evm/src/executors/symexec/types.rs

@@ -30,7 +30,7 @@ pub struct FrontierKey {
     pub selector: [u8; 4],
 }
 
-/// Per-frontier attempt bookkeeping, kept separately from [`super::corpus`]
+/// Per-frontier attempt bookkeeping, kept separately from the corpus
 /// stats so the symbolic worker doesn't pollute the fuzzer's counters.
 #[derive(Clone, Debug, Default)]
 pub struct FrontierStats {
@@ -46,9 +46,6 @@ pub const MAX_FRONTIER_ATTEMPTS: u16 = 3;
 /// Hard cap on candidates evaluated per frontier per cycle.
 pub const MAX_CANDIDATES_PER_FRONTIER: usize = 8;
 
-/// Hard cap on seeds processed per assist cycle.
-pub const MAX_SEEDS_PER_CYCLE: usize = 1;
-
 /// In-process state for the symbolic worker. Owned by the master worker; not
 /// persisted to disk (regenerated fresh each campaign).
 #[derive(Clone, Debug, Default)]

crates/evm/evm/src/inspectors/branch_trace.rs

@@ -121,11 +121,11 @@ impl BranchTrace {
         self.branches.clear();
     }
 
-    pub fn len(&self) -> usize {
+    pub const fn len(&self) -> usize {
         self.branches.len()
     }
 
-    pub fn is_empty(&self) -> bool {
+    pub const fn is_empty(&self) -> bool {
         self.branches.is_empty()
     }
 }

crates/forge/tests/cli/test_cmd/fuzz.rs

@@ -1068,17 +1068,14 @@ contract SymExecAssistTest is Test {
     cmd.args(["test", "--mt", "testFuzz_FindMagic"]).assert_success();
 
     // Master corpus directory: `<corpus_dir>/<contract>/<test>/worker0/corpus/`.
-    let corpus_root = prj
-        .root()
-        .join("symexec_corpus")
-        .join("SymExecAssistTest")
-        .join("testFuzz_FindMagic");
+    let corpus_root =
+        prj.root().join("symexec_corpus").join("SymExecAssistTest").join("testFuzz_FindMagic");
     let master_corpus = corpus_root.join("worker0").join("corpus");
     let master_sync = corpus_root.join("worker0").join("sync");
 
     let magic_hex = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
 
-    let mut search_dirs = vec![master_corpus.clone(), master_sync.clone()];
+    let mut search_dirs = vec![master_corpus, master_sync];
     if let Ok(entries) = std::fs::read_dir(&corpus_root) {
         for entry in entries.flatten() {
             let p = entry.path();

crates/forge/tests/cli/test_cmd/invariant/mod.rs

@@ -1918,10 +1918,8 @@ contract SymExecAssistInvariantTest is Test {
 
     let magic_hex = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
 
-    let mut search_dirs = vec![
-        corpus_root.join("worker0").join("corpus"),
-        corpus_root.join("worker0").join("sync"),
-    ];
+    let mut search_dirs =
+        vec![corpus_root.join("worker0").join("corpus"), corpus_root.join("worker0").join("sync")];
     if let Ok(entries) = std::fs::read_dir(&corpus_root) {
         for entry in entries.flatten() {
             let p = entry.path();