A unit test calls a function once. Most interesting state bugs are not in a call; they are in a sequence: write, checkpoint, crash, restart, replay, and only then does the corruption show. Writing such sequences by hand is exactly the work humans are bad at: we write the sequences we can already imagine, which are the ones the code already handles.
sequences, not calls
Consider the shape of a real durability bug. A journal commits a pin in two writes: rename, then directory sync. Kill the process between them, reopen, and the journal must decide whether the pin committed. A unit test can call commit and recover separately; the bug lives in calling them in the middle of each other. The space of "one call at a time" is linear; the space of interleaved sequences is where systems actually fail.
Stateful testing generates those sequences. Instead of writing a case per sequence, you write a model (the operations the system supports, plus crash/restart as an operation), a generator that draws sequences of operations, and assertions that run after every step. The test stops being a script and becomes a space of scripts.
what hegel does
Hegel is the Rust-native stateful testing library the workspace uses: property tests where each case is a sequence of operations against the real system, driven by a seeded generator inside the test loop. Because the seed is data, a failing sequence is reproducible exactly, and the shrinker can reduce it to the smallest sequence that still fails.
That last property is what makes the bug actionable. A failure that arrives as "somewhere in a 400-step random sequence the journal lost a pin" is a puzzle. The same failure shrunk to "rename, kill, recover, retry: pin applied twice" is a bug report with an address.
where it lives
vhalla's ledger tests are the clearest case. recovery_hegel.rs drives the ledger through appends, checkpoints, snapshots, restores, and replay attempts, with every choice drawn inside the loop from the seeded generator. Sixty-four generated sequences run in milliseconds because the ledger is a pure core: no sockets, no wall clock, no filesystem the test cannot control. The deterministic-core pattern (its own lesson) is what makes this cheap; Hegel is what makes it cover ground.
Gobstopper's vault surgery tests are the second case. Compaction, snapshot, and recovery are sequences over an on-disk vault, and the claims that matter ("the source is preserved", "a copy can be recovered", "protected output survives") are all sequence properties. The tests inject the crash at different steps of the same surgery and check the postcondition each time.