Section 6: Production
The runtime works. This section decides whether anyone should depend on it.
"Production-ready" is not a feeling and it is not "the tests pass". It is a checklist plus a scope statement, and this section builds both: diagnostics a human can act on, tooling that makes the runtime inspectable, a test matrix with six distinct kinds of test, metrics a service can alert on, a benchmark suite with a committed baseline, and an honest limitations document.
It completes Milestone M13 and the first half of M14.
What You Build
| Deliverable | Chapter | Lab |
|---|---|---|
| Source spans, carets, tracebacks, error recovery | Diagnostics | 24 |
ember run/repl/tokens/ast/disassemble/trace/compile | The CLI and the REPL | 25 |
| Unit, golden, differential, property, fuzz, compatibility | Testing Strategy | 26 |
Stats, tracing spans, the heap census, GC pause histograms | Observability | 27 |
| Criterion benchmarks, a committed baseline, the measurement protocol | Performance Engineering | 27 |
The audit: panics, unsafe, dependencies, semver, CI | The Hardening Checklist | 24–27 |
The Labs
| Lab | Title |
|---|---|
| 24 | Diagnostics |
| 25 | The CLI and REPL |
| 26 | The Test Matrix |
| 27 | Benchmarks |
The Production-Readiness Bar
From the introduction, made concrete. Every row is a checkbox with a place it lives.
| # | Requirement | Where |
|---|---|---|
| 1 | Documented public API | #![deny(missing_docs)], cargo doc, doc examples run in CI |
| 2 | Strong error handling | Seven ErrorKinds, each routed differently by a host |
| 3 | Source-level diagnostics | Lab 24: file, line, column, caret, traceback |
| 4 | No panics from ordinary script input | Lab 26: fuzzing, and a #[deny] on unwrap in the VM |
| 5 | Bytecode validation | Lab 9's validator, exercised by Lab 22's cache |
| 6 | Instruction, memory, recursion limits | Lab 23, fifteen tests |
| 7 | Safe default capabilities | Lab 21, golden surface file |
| 8 | Fuzz testing | Lab 26, five targets, corpora committed |
| 9 | Deterministic tests | No clock, no RNG, no hash-order dependence |
| 10 | Benchmarks with a baseline | Lab 27, committed and diffed in CI |
| 11 | Dependency audit | cargo audit, cargo deny, and an empty default [dependencies] |
| 12 | unsafe audit | #![forbid(unsafe_code)] in the default build |
| 13 | Documented threat model | Lab 23, docs/sandboxing.md |
| 14 | Explicit compatibility scope | appendix/lua-differences.md |
| 15 | Documented limitations | docs/limitations.md |
| 16 | Examples | examples/, each one a test |
| 17 | CI | fmt, clippy -D warnings, test, doc, audit, deny, boundary audit |
| 18 | Semver policy | docs/releasing.md, and cargo semver-checks in CI |
| 19 | Release documentation | CHANGELOG.md, and a release checklist |
| 20 | A stated production profile | README, above the fold |
Row 20 is not the last row; it is the first one. Everything above it is only meaningful relative to a stated scope. A runtime that says "production-ready" without saying for what has made a claim nobody can check.
The Command That Gates the Section
cargo fmt --check \
&& cargo clippy --workspace --all-targets --all-features -- -D warnings \
&& cargo test --workspace --all-features \
&& cargo test --doc \
&& cargo doc --workspace --no-deps \
&& cargo audit \
&& cargo deny check \
&& ./scripts/boundary-audit.sh \
&& cargo bench -- --save-baseline current \
&& cargo criterion --baseline main
Nine commands. If any of them is not in your CI by the end of Lab 27, that row of the table is aspirational.
Common Mistakes in This Section
| Mistake | Symptom | Correction |
|---|---|---|
| "Production-ready because it works" | A claim nobody can evaluate | The bar is a checklist plus a scope statement. Both. |
| Diagnostics added at the end | A rewrite, because spans were not threaded | They were threaded, from Lab 1. Lab 24 is rendering, not retrofitting. |
| A REPL that can panic | One bad input kills the session | The REPL is the most hostile input source you have; it is Results all the way. |
| Benchmarks without a committed baseline | "It feels faster" | git show the baseline or you do not have one. |
| Fuzzing without committed corpora | Every CI run starts from zero | Commit the corpus; a crash reproducer is a regression test. |
unwrap() in the VM | A host process aborts on malformed input | #[deny(clippy::unwrap_used)] on vm.rs, heap.rs, table.rs. |
| Metrics that only report failures | You cannot tune what you cannot see | Report utilization, not just violations. Alert at 80%. |
| A limitations document written last | It reads like an apology | Write it as you go. Each lab adds a line. |
Section Profile: What a Section 6 Graduate Can Do
- Render a diagnostic with a source span and a caret, and explain which earlier decision made each part possible.
- Build a REPL that cannot be crashed by its user.
- Name six kinds of test, say what each catches that the others do not, and build all six.
- Instrument a runtime so a service can alert on it before it fails, not after.
- Run a benchmark suite with a committed baseline and refuse an optimization without one.
- Audit a crate for panics,
unsafe, dependencies, and API stability. - Write a limitations document that a reader trusts, and explain why the honesty is the point.
Next: Diagnostics.