@homeflare/alchemy 0.5.0 → 0.6.0

package/src/launchd/job-preflight.ts

@@ -0,0 +1,152 @@
+/**
+ * Everything LaunchdJob checks before it touches the host — split from job-lifecycle.ts so that a
+ * reconcile and a plan-time REPLACE run the very same checks.
+ *
+ * ★ WHY A REPLACE IS CHECKED AT PLAN TIME. A label or domain change is a delete-first replace, and
+ *   Alchemy runs `delete` on the old job BEFORE `reconcile` on the new one (Apply.ts,
+ *   deleteOldGenerations under `node.deleteFirst`; read in alchemy 2.0.0-beta.79 on 2026-09-21).
+ *   A refusal that fired only in reconcile would therefore arrive after the old job was already
+ *   booted out: nothing running, and a plan that had promised a clean swap.
+ * ★ EVERY CHECK HERE IS READ-ONLY: validation, a user lookup, `launchctl print` and
+ *   `print-disabled` — none of which needs root (measured, see launchctl.ts).
+ */
+import {
+  type LaunchdJobAttributes,
+  type LaunchdJobProps,
+  type ParsedDomain,
+  parseDomain,
+  plistPathFor,
+  serviceTarget,
+  sha256Hex,
+} from './job-form.ts';
+import { identityProblems, jobProblems } from './job-validate.ts';
+import { type ServiceStatus, isDisabled, printService } from './launchctl.ts';
+import { type HostRunner, canActAsRoot } from './runner.ts';
+
+export type Location = {
+  readonly domain: ParsedDomain;
+  readonly plistPath: string;
+  readonly target: string;
+};
+
+export type Identity = Pick<LaunchdJobProps, 'label' | 'domain'>;
+
+export const refuse = (label: string, message: string): Error =>
+  new Error(`Launchd.Job ${label}: ${message}`);
+
+/** Throw every refusal at once, so one plan shows the whole list. */
+export const assertValid = (props: LaunchdJobProps): void => {
+  const found = jobProblems(props);
+  if (found.length > 0) throw refuse(props.label, found.join('; '));
+};
+
+export const locate = async (runner: HostRunner, props: Identity): Promise<Location> => {
+  const domain = parseDomain(props.domain);
+  if (domain === undefined) throw refuse(props.label, `unknown domain ${props.domain}`);
+  const home =
+    domain.kind === 'gui' ? (await runner.lookupUser(String(domain.uid)))?.home : undefined;
+  return {
+    domain,
+    plistPath: plistPathFor(props.label, domain, home),
+    target: serviceTarget(props.label, props.domain),
+  };
+};
+
+/**
+ * ⛔ NO SILENT SUDO. The system domain, and another user's gui domain, need root. Refuse up front
+ *   with the two ways out, rather than let launchctl or rename(2) fail halfway through.
+ */
+export const assertMayWrite = (runner: HostRunner, label: string, domain: ParsedDomain): void => {
+  if (canActAsRoot(runner)) return;
+  if (domain.kind === 'system') {
+    throw refuse(
+      label,
+      'the system domain needs root. Run the deploy as root, or provide a HostRunner that is ' +
+        'deliberately privileged (privileged: true). This provider never calls sudo.',
+    );
+  }
+  if (domain.uid !== runner.effectiveUid()) {
+    throw refuse(
+      label,
+      `gui/${String(domain.uid)} belongs to another user; only root may write it. ` +
+        'Deploy as that user, as root, or through a privileged HostRunner.',
+    );
+  }
+};
+
+/** Where the job goes, whether we may write it there, and launchd's current view of it. */
+export const preflight = async (
+  runner: HostRunner,
+  props: Identity,
+): Promise<{ location: Location; status: ServiceStatus }> => {
+  const location = await locate(runner, props);
+  assertMayWrite(runner, props.label, location.domain);
+  const status = await printService(runner, location.target);
+  if (status.domainMissing === true) {
+    throw refuse(
+      props.label,
+      `${props.domain} does not exist: that user has no login session, and launchd creates a gui ` +
+        'domain only at login. Log the user in (or declare a system-domain job with userName), ' +
+        'then redeploy. Nothing was written.',
+    );
+  }
+  /**
+   * ⛔ A DISABLED LABEL IS SOMEONE'S DECISION, NOT DRIFT. `launchctl disable` persists across boots
+   *   and makes bootstrap fail; enabling it here would silently overrule whoever disabled it.
+   */
+  if (await isDisabled(runner, props.domain, props.label)) {
+    throw refuse(
+      props.label,
+      `${location.target} is disabled (launchctl print-disabled ${props.domain}). ` +
+        `If that is stale, run \`launchctl enable ${location.target}\` deliberately, then redeploy.`,
+    );
+  }
+  return { location, status };
+};
+
+/**
+ * ⛔ A JOB THIS RESOURCE DOES NOT OWN IS NEVER OVERWRITTEN. Alchemy's adoption probe guards a
+ *   create, but NOT the new label of a replace — the engine reads nothing there — so a rename onto
+ *   a label someone already loaded would boot their job out and write ours over its plist.
+ * ★ A plist byte-identical to our render is exempt: it is this declaration's own leftover (a
+ *   deploy that died between write and bootstrap), and rewriting it changes nothing.
+ */
+export const assertUnclaimed = async (
+  runner: HostRunner,
+  label: string,
+  location: Location,
+  status: ServiceStatus,
+  renderedSha256: string | undefined,
+): Promise<void> => {
+  const bytes = await runner.readFile(location.plistPath);
+  const foreignFile = bytes !== undefined && sha256Hex(bytes) !== renderedSha256;
+  if (foreignFile || (bytes === undefined && status.loaded)) {
+    throw refuse(
+      label,
+      `${location.target} is already on this host (${foreignFile ? location.plistPath : 'loaded'})` +
+        ' and is not this resource. Remove it, or declare it as a new resource and deploy with ' +
+        '--adopt.',
+    );
+  }
+};
+
+/**
+ * A rename, checked at plan time: the new identity must be valid, writable, bootstrappable and
+ * free, and the old one deletable — before the plan may promise a delete-first replace.
+ * `full` is the whole declaration when it is already resolved; otherwise only the identity is.
+ */
+export const assertReplaceable = async (
+  runner: HostRunner,
+  next: Identity,
+  full: LaunchdJobProps | undefined,
+  old: LaunchdJobAttributes,
+  renderedSha256: string | undefined,
+): Promise<void> => {
+  const found = full === undefined ? identityProblems(next.label, next.domain) : jobProblems(full);
+  if (found.length > 0) throw refuse(next.label, found.join('; '));
+  const oldDomain = parseDomain(old.domain);
+  if (oldDomain === undefined) throw refuse(old.label, `unknown domain ${old.domain}`);
+  assertMayWrite(runner, old.label, oldDomain);
+  const { location, status } = await preflight(runner, next);
+  await assertUnclaimed(runner, next.label, location, status, renderedSha256);
+};

package/src/launchd/job-validate.ts

@@ -0,0 +1,134 @@
+/**
+ * Everything LaunchdJob refuses before it touches the host. Run at plan time (diff) and again at
+ * reconcile, so a bad declaration fails the plan instead of half-applying.
+ *
+ * ★ REFUSE WHAT launchd WOULD SILENTLY IGNORE OR MISREAD. launchd loads a plist with an out-of-range
+ *   calendar field or a UserName on an agent without complaint and then simply never does what the
+ *   declaration says; a plan that fails is cheaper than a job that quietly does nothing.
+ */
+import {
+  type CalendarInterval,
+  type LaunchdJobProps,
+  OWNED_KEYS,
+  parseDomain,
+} from './job-form.ts';
+import { jobSecretProblems } from './secret-tripwire.ts';
+
+/** ★ Labels become file names: no `/`, no leading dot, nothing a path could re-interpret. */
+const LABEL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+
+/**
+ * ⛔ LABELS OTHER TOOLS OWN ARE NEVER DECLARED HERE. nix-darwin (`org.nixos.*`) rewrites its plists
+ *   on every activation and unloads any it no longer lists; macOS owns `com.apple.*`; `brew
+ *   services` owns `homebrew.mxcl.*`. Declaring one of those makes two tools fight over one file.
+ *   To move a job off such a tool, declare a NEW label and cut over (docs/launchd.md).
+ */
+export const RESERVED_LABEL_PREFIXES: readonly string[] = [
+  'org.nixos.',
+  'com.apple.',
+  'homebrew.mxcl.',
+];
+
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+const RANGES: ReadonlyArray<readonly [keyof CalendarInterval, number, number]> = [
+  ['minute', 0, 59],
+  ['hour', 0, 23],
+  ['day', 1, 31],
+  ['weekday', 0, 7],
+  ['month', 1, 12],
+];
+
+const isInt = (value: number, min: number, max = Number.MAX_SAFE_INTEGER) =>
+  Number.isSafeInteger(value) && value >= min && value <= max;
+
+const calendarProblems = (entries: readonly CalendarInterval[]): string[] => {
+  if (entries.length === 0) return ['startCalendarInterval is an empty list; omit it instead'];
+  const found: string[] = [];
+  for (const [index, entry] of entries.entries()) {
+    for (const [field, min, max] of RANGES) {
+      const value = entry[field];
+      if (value !== undefined && !isInt(value, min, max)) {
+        found.push(
+          `startCalendarInterval[${String(index)}].${field} must be ${String(min)}–${String(max)}`,
+        );
+      }
+    }
+  }
+  return found;
+};
+
+const absolute = (name: string, value: string | undefined): string[] =>
+  value === undefined || value.startsWith('/') ? [] : [`${name} must be an absolute path`];
+
+/**
+ * The label and domain alone — the job's identity. ★ Split out because a rename is a delete-first
+ *   replace, and it must be refusable at plan time even while other props are still unresolved
+ *   Outputs (see job.ts diff): otherwise the old job is deleted and only then is the new label
+ *   found to be invalid.
+ */
+export const identityProblems = (label: string, domainText: string): string[] => {
+  const found: string[] = [];
+  if (!LABEL.test(label)) {
+    found.push('label must be 1–200 of [A-Za-z0-9._-], starting with a letter or digit');
+  }
+  const reserved = RESERVED_LABEL_PREFIXES.find((prefix) => label.startsWith(prefix));
+  if (reserved !== undefined) {
+    found.push(`label ${label} is under ${reserved}, which another tool owns; declare a new label`);
+  }
+  if (parseDomain(domainText) === undefined)
+    found.push(`domain must be 'system' or 'gui/<uid>', not ${domainText}`);
+  return found;
+};
+
+export const jobProblems = (props: LaunchdJobProps): string[] => {
+  const found = identityProblems(props.label, props.domain);
+  const domain = parseDomain(props.domain);
+
+  const [program] = props.programArguments;
+  // ★ Absolute, because launchd's PATH for a job is not the deploying shell's PATH.
+  if (program === undefined) found.push('programArguments must name a program');
+  else if (!program.startsWith('/')) found.push('programArguments[0] must be an absolute path');
+
+  for (const name of Object.keys(props.environment ?? {})) {
+    if (!ENV_NAME.test(name))
+      found.push(`environment name ${JSON.stringify(name)} is not a valid variable name`);
+  }
+  found.push(...jobSecretProblems(props.environment, props.programArguments, props.extraKeys));
+
+  if (props.startInterval !== undefined && !isInt(props.startInterval, 1)) {
+    found.push('startInterval must be a positive whole number of seconds');
+  }
+  if (props.throttleInterval !== undefined && !isInt(props.throttleInterval, 0)) {
+    found.push('throttleInterval must be a non-negative whole number of seconds');
+  }
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    found.push(
+      ...calendarProblems(Array.isArray(calendar) ? calendar : [calendar as CalendarInterval]),
+    );
+  }
+  const keepAlive = props.keepAlive;
+  if (
+    typeof keepAlive === 'object' &&
+    keepAlive.successfulExit === undefined &&
+    keepAlive.crashed === undefined
+  ) {
+    found.push('keepAlive {} names no condition; use true, false, or a condition');
+  }
+
+  found.push(...absolute('standardOutPath', props.standardOutPath));
+  found.push(...absolute('standardErrorPath', props.standardErrorPath));
+  found.push(...absolute('workingDirectory', props.workingDirectory));
+
+  if (domain?.kind === 'gui' && (props.userName !== undefined || props.groupName !== undefined)) {
+    found.push(
+      'userName/groupName apply only to the system domain; launchd ignores them for agents',
+    );
+  }
+  for (const key of Object.keys(props.extraKeys ?? {})) {
+    if (OWNED_KEYS.includes(key))
+      found.push(`extraKeys.${key} is owned by a typed prop; use that instead`);
+  }
+  return found;
+};

package/src/launchd/job.ts

@@ -0,0 +1,96 @@
+/**
+ * `Launchd.Job` — one launchd job (a LaunchDaemon in `system`, a LaunchAgent in `gui/<uid>`),
+ * declared rather than hand-loaded.
+ *
+ * ★ launchd HAS NO SDK. The provider renders the plist (plist.ts), writes it where launchd looks
+ *   (job-form.ts plistPathFor), and drives `launchctl` (launchctl.ts) — all through the HostRunner
+ *   the stack provides (runner.ts), so none of it is reachable except through that seam.
+ *
+ * Lifecycle (job-lifecycle.ts has the reasoning for each step):
+ *   - create / update — write the plist atomically, boot out the old job if loaded, bootstrap.
+ *     An update is therefore a RESTART; a converged job is left alone.
+ *   - read — `launchctl print` (loaded? pid? last exit?) plus the plist's SHA-256.
+ *   - diff — the rendered plist's SHA-256 against the stored AND the on-disk digest.
+ *   - replace — only when `label` or `domain` changes, and DELETE FIRST (labels are unique); so
+ *     everything the new job would be refused for is refused at plan time (job-preflight.ts).
+ *   - delete — boot out, remove the plist.
+ *
+ * ⛔ ENVIRONMENT IS NON-SECRET ONLY — see the ⛔ on LaunchdJobProps.environment.
+ * ⛔ NO SILENT SUDO — see assertMayWrite in job-preflight.ts.
+ * ⚠️ NOTHING IS ADOPTED WITHOUT `--adopt`. A label already loaded, or a plist already on disk, reads
+ *   as `Unowned`, so Alchemy refuses to take it over unless asked. Labels under `org.nixos.`,
+ *   `com.apple.` and `homebrew.mxcl.` are refused outright (job-validate.ts) — declare a new label
+ *   and cut over instead (docs/launchd.md).
+ */
+import { Resource } from 'alchemy';
+import { Unowned } from 'alchemy/AdoptPolicy';
+import { isResolved } from 'alchemy/Diff';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { lift, resolvedString } from './host-effect.ts';
+import type { LaunchdJobAttributes, LaunchdJobProps } from './job-form.ts';
+import { deleteJob, diffJob, readJob, reconcileJob, replaceDiff } from './job-lifecycle.ts';
+import { HostRunnerService } from './runner.ts';
+
+export type {
+  CalendarInterval,
+  KeepAlive,
+  LaunchdDomain,
+  LaunchdJobAttributes,
+  LaunchdJobProps,
+} from './job-form.ts';
+
+export interface LaunchdJob extends Resource<
+  'Launchd.Job',
+  LaunchdJobProps,
+  LaunchdJobAttributes
+> {}
+
+export const LaunchdJob = Resource<LaunchdJob>('Launchd.Job');
+
+export const LaunchdJobProvider = () =>
+  Provider.effect(
+    LaunchdJob,
+    Effect.gen(function* () {
+      const runner = yield* HostRunnerService;
+      return LaunchdJob.Provider.of({
+        /**
+         * ⛔ launchd's job list is not a list of things this stack owns — it is every Apple, Nix
+         *   and hand-loaded job on the host. Returning them would invite a nuke to boot them out.
+         */
+        list: () => Effect.succeed([]),
+
+        read: ({ olds, output }) =>
+          lift(async () => {
+            const found = await readJob(runner, olds);
+            if (found === undefined) return undefined;
+            return output === undefined ? Unowned(found) : found;
+          }),
+
+        diff: ({ news, output }) => {
+          if (output === undefined) return Effect.succeed(undefined);
+          if (isResolved(news)) return lift(() => diffJob(runner, news, output));
+          /**
+           * ⛔ A RENAME MUST BE SEEN EVEN WHILE OTHER PROPS ARE UNRESOLVED. Returning undefined
+           *   hands the call to the engine's default — `update` for any prop change (Plan.ts,
+           *   havePropsChanged) — and an update under a new label bootstraps the new job and
+           *   orphans the old one, still running. `config.path` in programArguments (the pattern
+           *   docs/launchd.md recommends) is unresolved exactly when its HostFile changes in the
+           *   same deploy. reconcileJob also defends against this, for a label that is itself an
+           *   Output; seeing it here is what gets it planned as the replace it is.
+           */
+          const label = resolvedString(news, 'label');
+          const domain = resolvedString(news, 'domain') as LaunchdJobProps['domain'] | undefined;
+          return label !== undefined &&
+            domain !== undefined &&
+            (label !== output.label || domain !== output.domain)
+            ? lift(() => replaceDiff(runner, { domain, label }, undefined, output))
+            : Effect.succeed(undefined);
+        },
+
+        reconcile: ({ news, output }) => lift(() => reconcileJob(runner, news, output)),
+
+        delete: ({ output }) => lift(() => deleteJob(runner, output)),
+      });
+    }),
+  );

package/src/launchd/launchctl.test.ts

@@ -0,0 +1,181 @@
+/**
+ * The launchctl parsers against the shapes measured on macOS 27.2 (launchctl.ts header), and the
+ * bootout sequence against the fake launchd.
+ *
+ * ★ The fixture keeps the two traps from the real output: a multi-line shell argument that prints
+ *   raw (with a `}` in column 0), and nested blocks that repeat `state = ` two tabs deep.
+ */
+import { describe, expect, test } from 'bun:test';
+import { fakeRunner } from './fake-runner.ts';
+import {
+  LAUNCHCTL,
+  bootoutIfLoaded,
+  parseDisabled,
+  parsePrint,
+  printFields,
+  printService,
+} from './launchctl.ts';
+
+const RUNNING = [
+  'system/com.example.job = {',
+  '\tactive count = 1',
+  '\tpath = /Library/LaunchDaemons/com.example.job.plist',
+  '\ttype = LaunchDaemon',
+  '\tstate = running',
+  '',
+  '\tprogram = /bin/sh',
+  '\targuments = {',
+  '\t\t/bin/sh',
+  '\t\t-c',
+  '\t\tprog=/opt/example/bin/job',
+  '[ -x "$prog" ] || {',
+  '  pid = 99',
+  '}',
+  'exec "$prog"',
+  '',
+  '\t}',
+  '',
+  '\tstdout path = /var/log/example.log',
+  '\tresource coalition = {',
+  '\t\tID = 777',
+  '\t\ttype = resource',
+  '\t\tstate = active',
+  '\t}',
+  '',
+  '\tdomain = system',
+  '\truns = 1',
+  '\tpid = 1219',
+  '\tlast exit code = (never exited)',
+  '\tspawn type = daemon (3)',
+  '\tjob state = running',
+  '}',
+].join('\n');
+
+describe('printFields / parsePrint', () => {
+  test('reads the job block, not the nested blocks or the raw argument text', () => {
+    const fields = printFields(RUNNING);
+    expect(fields.get('state')).toBe('running');
+    expect(fields.get('pid')).toBe('1219');
+    expect(fields.get('type')).toBe('LaunchDaemon');
+    expect(fields.get('path')).toBe('/Library/LaunchDaemons/com.example.job.plist');
+    expect(fields.has('ID')).toBe(false);
+  });
+
+  test('a running job', () => {
+    expect(parsePrint(RUNNING)).toEqual({ loaded: true, pid: 1219, state: 'running' });
+  });
+
+  test('a stopped job with an exit code, and the newer "78: EX_CONFIG" form', () => {
+    const stopped = RUNNING.replace('\tstate = running', '\tstate = not running')
+      .replace('\tpid = 1219\n', '')
+      .replace('(never exited)', '78: EX_CONFIG');
+    expect(parsePrint(stopped)).toEqual({ lastExitCode: 78, loaded: true, state: 'not running' });
+    expect(parsePrint(stopped.replace('78: EX_CONFIG', '0')).lastExitCode).toBe(0);
+  });
+
+  test('empty output parses to loaded with no details (the caller decides loaded from the exit code)', () => {
+    expect(parsePrint('')).toEqual({ loaded: true });
+  });
+});
+
+describe('parseDisabled', () => {
+  test('the measured `=> enabled|disabled` form, and the older `=> true|false`', () => {
+    const out = [
+      '\tdisabled services = {',
+      '\t\t"com.example.on" => enabled',
+      '\t\t"com.example.off" => disabled',
+      '\t\t"com.example.legacy-off" => true',
+      '\t\t"com.example.legacy-on" => false',
+      '\t}',
+    ].join('\n');
+    expect([...parseDisabled(out)].sort()).toEqual(['com.example.legacy-off', 'com.example.off']);
+  });
+});
+
+describe('printService', () => {
+  test('exit 113 is "not loaded", not an error', async () => {
+    const fake = fakeRunner();
+    expect(await printService(fake.runner, 'system/com.example.none')).toEqual({ loaded: false });
+  });
+
+  test('exit 112 "Could not find domain" (a gui uid with no login session) is "not loaded"', async () => {
+    const fake = fakeRunner();
+    fake.state.loggedOut.add(502);
+    expect(await printService(fake.runner, 'gui/502/com.example.x')).toEqual({
+      domainMissing: true,
+      loaded: false,
+    });
+  });
+
+  test('exit 112 without that text stays an error', async () => {
+    const runner = {
+      ...fakeRunner().runner,
+      exec: async () => ({ exitCode: 112, stderr: 'Bad request.', stdout: '' }),
+    };
+    await expect(printService(runner, 'system/x')).rejects.toThrow('-> 112');
+  });
+
+  test('any other non-zero exit is an error carrying stderr, never stdout', async () => {
+    const runner = {
+      ...fakeRunner().runner,
+      exec: async () => ({ exitCode: 1, stderr: 'Bad request.', stdout: 'SECRET_ENV=leak' }),
+    };
+    const error = await printService(runner, 'system/x').then(
+      () => new Error('expected a rejection'),
+      (cause: unknown) => cause as Error,
+    );
+    expect(error.message).toContain('Bad request.');
+    expect(error.message).not.toContain('leak');
+  });
+});
+
+describe('bootoutIfLoaded', () => {
+  test('does nothing when the job is not loaded (bootout of an absent job exits non-zero)', async () => {
+    const fake = fakeRunner();
+    await bootoutIfLoaded(fake.runner, 'system/com.example.none');
+    expect(fake.calls.map((call) => call[1])).toEqual(['print']);
+  });
+
+  test('boots out, then polls until launchd lets go', async () => {
+    const fake = fakeRunner();
+    fake.loaded.set('system/com.example.job', 1);
+    fake.state.lingerPrints = 3;
+    await bootoutIfLoaded(fake.runner, 'system/com.example.job');
+    expect(fake.loaded.has('system/com.example.job')).toBe(false);
+    const subs = fake.calls.map((call) => call[1]);
+    expect(subs.slice(0, 2)).toEqual(['print', 'bootout']);
+    expect(subs.filter((sub) => sub === 'print').length).toBeGreaterThan(3);
+    expect(fake.calls.every((call) => call[0] === LAUNCHCTL)).toBe(true);
+  });
+
+  test('a non-zero bootout for a job that is still exiting (EINPROGRESS) waits, not fails', async () => {
+    const fake = fakeRunner();
+    fake.loaded.set('system/com.example.slow', 1);
+    fake.state.lingerPrints = 3;
+    fake.state.bootoutFailure = {
+      exitCode: 36,
+      stderr: 'Boot-out failed: 36: Operation now in progress',
+      stdout: '',
+    };
+    await bootoutIfLoaded(fake.runner, 'system/com.example.slow');
+    expect(fake.loaded.has('system/com.example.slow')).toBe(false);
+  });
+
+  test('a non-zero bootout for a job that never leaves fails with bootout’s own error', async () => {
+    const fake = fakeRunner();
+    fake.loaded.set('system/com.example.stuck', 1);
+    fake.state.bootoutKeepsJob = true;
+    await expect(bootoutIfLoaded(fake.runner, 'system/com.example.stuck')).rejects.toThrow(
+      /bootout system\/com\.example\.stuck -> 5: .*still loaded after waiting/,
+    );
+  });
+
+  test('gives up with a clear error when the job never goes away', async () => {
+    const fake = fakeRunner();
+    fake.loaded.set('system/com.example.stuck', 1);
+    fake.state.lingerPrints = 1_000;
+    await expect(bootoutIfLoaded(fake.runner, 'system/com.example.stuck')).rejects.toThrow(
+      'still loaded',
+    );
+  });
+});