[jyviko]

Fixes the nightly fuzz's offset.offset_executive_p2 fuzz00175 timeout: the offset now refuses, before building anything, a distance below the input's B-rep tolerance, and fuzz cases are seeded by fixture name so adding a fixture no longer reshuffles every case. fuzz00167 (the C++ SIGSEGV with a negative approximation tolerance) is left to #2733.

Units: offset.offset_executive_p2 (kernel, shim, runner), difftest fuzz driver.

What changes

1. Kernel refusal (fuzz00175). offset_brep, do_solid_offset and do_extended_offset refuse an offset distance that is not a finite length of at least the input B-rep's tolerance: OffsetFailure::DistanceUnresolved { distance, resolution }, kind ErrorKind::InvalidInput, message naming both values. Bound: the input B-rep's tolerance, the distance below which the model does not tell two points apart, so an offset that close lies within tolerance of its own face. (SolidError::InvalidInput carries only a &'static str, so the refusal is a structured Errors: report solidcore-specific, descriptive errors instead of bare SMLib statuses and SMLib names #2615 Failure of kind InvalidInput, which can name the values.) The shells already refuse below twice the tolerance (upstream's guard), so they never reach it. A member distance of 1e-300 took 31.5 s in Rust and 21 s in C++, in SubdivideToTolerances; recorded as HANG-53.
   • The p2 shim refuses the same inputs before the C++ runs ([-2] → Outcome::Refused → a rejected case), using the built source's GetTolerance(), so the two sides stay aligned, including file sources and nonpositive fixture tolerances.
   • Test: crates/solidcore/tests/offset_negative_approximation_tolerance.rs. 1e-300 is refused, naming it and the tolerance, with the input unchanged. tolerance * (1 + ε) still builds, both extended and rounded.
2. C++ extended-offset calls in a child process. Generalises the existing UB-241 crash trap: every p2 C++ call that reaches DoExtendedOffset (the extended operation, or any operation with extend_convex) runs through eval_in_child / the new eval_measured_in_child. A C++ crash there is a rejected case, not a dead nightly. The mechanism is general and is not keyed to fuzz00167.
3. Fuzz cases are seeded by fixture name. Each base case b seeds fnv1a64("fuzz:" + unit + ":" + b) + i, and the largest first draw wins (rendezvous hashing). Adding a fixture changes only the ~1/(n+1) cases it wins. The nightly's case inputs change once because of this, so every unit's fuzzNNNNN names map to new inputs from this PR on. A test checks that inserting a base leaves every case it doesn't win unchanged.

Results that change

• Static/API/member offsets with |distance| < B-rep tolerance (including 0) are now refused on both sides. In the fixtures that is fuzz00087 (tolerance 1e300, distance 0.5, which was compared) plus generated static-offset cases with distance ±0. Under the baseline ratchet these show as pass → rejected.
• fuzz00167: with the child trap its crash becomes a rejected case. The crash record, parking and Rust-side result are in fix: an offset refuses an effectively zero approximation tolerance; the nightly's C++ crash is UB-291 (#2393) #2733.

Evidence

• cargo clippy -p solidcore -p difftest -p solidcore-ffi --features difftest/cpp --all-targets -D warnings: clean (aarch64 box).
• cargo test -p solidcore --test offset_negative_approximation_tolerance: 4 passed.
• Not run yet: the fuzz00175 / fuzz00167 replays, the unit difftest against a baseline, the unit's --fuzz 300, and the difftest crate's unit tests (including the new fuzz-seed test). The owner asked to wrap up first; these come before ready-for-review.

Status: draft.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts