Requires Python 3 and cc. Builds the actual src/web_session_store.c against its production headers; generated dependency stubs and binaries live only in an automatically removed temporary directory. Compilation and execution have finite timeouts. No ESP-IDF build, device, network, or general test framework is used.

The runner probes OpenSSL headers/linking and uses real SHA-256 when available. Otherwise it explicitly reports a deterministic non-cryptographic digest stub; that fallback verifies store behavior, not cryptography. RNG is always a deterministic test double, never a test of secure randomness. RNG/SHA/DB callbacks assert they run outside the simulated state lock. DB callbacks inject invalidate/user-invalidate/ stop operations to exercise revalidation, but do not model real concurrent threads.

Tests use only the public API: output wiping and record retirement are checked, but private record bytes, allocator failures, hardware locking, and timing under real concurrency are not inspected. Rejections without a specified error contract are checked as non-success; absent tokens, readiness, and capacity use exact errors. Counters are checked with deltas where lifecycle reset semantics are unspecified.