@ic-reactor/mcp 0.0.0-stage → 0.0.0

package/packages/core/tests/traps/unresolved-name.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Trap: a canister id taken from a cookie the page cannot trust.
+ *
+ * The mistake a hand-written integration makes: it reads `ic_env`, the cookie
+ * that tells a front end where its canisters are, wherever its code runs, and
+ * calls the id it finds under the canister's name. A cookie is not isolated
+ * to an origin: any sibling subdomain of the page's domain can write one. The
+ * id such a cookie names is a real canister, whose replies verify against the
+ * real root key, so no certificate check ever notices the substitution, and
+ * the user's transfer goes to the ledger the attacker chose. On a server there
+ * is no cookie at all, and a hand-written reader finds none and sends the call
+ * to an `undefined` id or to a default.
+ *
+ * The guarantee: a canister named `{ name }` resolves only on a page where the
+ * cookie is as trustworthy as the replica: the page and the replica are both
+ * local, or the app wrote `allowEnvConfig: true`. Anywhere else (a server, an
+ * ordinary web host) every call to it rejects `invalid_args` with the code
+ * `canister_id_unresolved` and `mayHaveExecuted: false`, sends nothing, and
+ * the read's key carries `$unresolved:<name>`, so no data is cached for a
+ * guess. The control cases show the same calls resolve, and are sent, where
+ * the cookie is trusted.
+ */
+import { afterAll, afterEach, describe, expect, it, vi } from "vitest"
+import * as icrc1 from "../fixtures/icrc1.js"
+import {
+  ALICE,
+  LEDGER,
+  SIGNED_CALLS_TIMEOUT_MS,
+  disposeAll,
+  rejection,
+  setupLedger,
+  transferArg,
+  type TestClientOptions,
+} from "./ledger.js"
+
+vi.setConfig({ testTimeout: SIGNED_CALLS_TIMEOUT_MS })
+afterAll(disposeAll)
+afterEach(() => vi.unstubAllGlobals())
+
+/**
+ * The `ic_env` cookie a sibling subdomain, or an asset canister, writes: the id
+ * `LEDGER` under the name `ledger`, and a root key (which the client never
+ * takes from a cookie, so any key of the right length stands for one).
+ */
+const COOKIE = `ic_env=${encodeURIComponent(
+  `ic_root_key=${"07".repeat(133)}&PUBLIC_CANISTER_ID:ledger=${LEDGER}`
+)}`
+
+/** Runs the code on a browser page at `origin` whose cookie jar holds {@link COOKIE}. */
+function onPage(origin: string): void {
+  vi.stubGlobal("window", {
+    location: { origin, protocol: new URL(origin).protocol },
+  })
+  vi.stubGlobal("document", { cookie: COOKIE })
+}
+
+/**
+ * A client whose ledger lives at `LEDGER` but whose app only knows it as
+ * `{ name: "ledger" }`, and what it calls: a read and an update.
+ */
+function namedLedger(options?: TestClientOptions) {
+  const l = setupLedger(options)
+  const named = l.client.canister<icrc1.Actor>(icrc1.actor, { name: "ledger" })
+  return { ...l, named }
+}
+
+const unresolved = {
+  kind: "invalid_args",
+  code: "canister_id_unresolved",
+  mayHaveExecuted: false,
+}
+
+describe("a canister named { name } where the cookie is not trusted", () => {
+  it("is unresolved on a server, which has no cookie: every call is refused and nothing is sent", async () => {
+    // Node: no window, and so no cookie jar.
+    const { named, sent } = namedLedger()
+
+    await expect(
+      rejection(named.icrc1_balance_of({ owner: ALICE, subaccount: null }))
+    ).resolves.toMatchObject(unresolved)
+    await expect(
+      rejection(named.icrc1_transfer(transferArg(500n)))
+    ).resolves.toMatchObject(unresolved)
+    expect(sent()).toEqual([])
+  })
+
+  it("is unresolved on an ordinary web page whose cookie names a real ledger, though the replica is local", async () => {
+    // The page is `app.example.com`; a sibling subdomain wrote the cookie. The
+    // replica the client talks to is a local one, which would be trusted on a
+    // local page, so the page alone decides.
+    onPage("https://app.example.com")
+    const { named, sent, executed } = namedLedger()
+
+    await expect(
+      rejection(named.icrc1_balance_of({ owner: ALICE, subaccount: null }))
+    ).resolves.toMatchObject(unresolved)
+    await expect(
+      rejection(named.icrc1_transfer(transferArg(500n)))
+    ).resolves.toMatchObject(unresolved)
+    expect(sent()).toEqual([])
+    expect(executed()).toBe(0)
+  })
+
+  it("is unresolved for a read through queryOptions, under a key that names the guess it did not make", async () => {
+    onPage("https://app.example.com")
+    const { client, named, sent } = namedLedger()
+
+    const options = client.queryOptions(named, "icrc1_balance_of", {
+      owner: ALICE,
+      subaccount: null,
+    })
+
+    expect(options.queryKey).toContain("$unresolved:ledger")
+    await expect(
+      client.queryClient.fetchQuery({ ...options, retry: false })
+    ).rejects.toMatchObject(unresolved)
+    expect(sent()).toEqual([])
+  })
+})
+
+describe("a canister named { name } where the cookie is trusted", () => {
+  it("is resolved on a local page with a local replica, and sent to the id the cookie names", async () => {
+    onPage("http://localhost:5173")
+    const { named, sent } = namedLedger()
+
+    await expect(
+      named.icrc1_balance_of({ owner: ALICE, subaccount: null })
+    ).resolves.toBe(1_000_000n)
+
+    expect(sent()).toMatchObject([{ endpoint: "query", canisterId: LEDGER }])
+  })
+
+  it("is resolved on an ordinary page when the app writes allowEnvConfig: true", async () => {
+    onPage("https://app.example.com")
+    const { named, sent } = namedLedger({ allowEnvConfig: true })
+
+    await expect(
+      named.icrc1_balance_of({ owner: ALICE, subaccount: null })
+    ).resolves.toBe(1_000_000n)
+
+    expect(sent()).toMatchObject([{ endpoint: "query", canisterId: LEDGER }])
+  })
+})
+
+it("never lets the cookie override a canister the app named by its id", async () => {
+  // The id is configuration, and it wins over whatever the page says.
+  onPage("http://localhost:5173")
+  const l = setupLedger()
+
+  await expect(
+    l.ledger.icrc1_balance_of({ owner: ALICE, subaccount: null })
+  ).resolves.toBe(1_000_000n)
+
+  expect(l.sent()).toMatchObject([{ canisterId: LEDGER }])
+})

package/packages/core/tests/traps/update-as-query.test.ts

@@ -0,0 +1,244 @@
+/**
+ * Trap: an update method read through a query.
+ *
+ * The mistake a hand-written integration makes: it wraps a canister call in
+ * `useQuery`, because that is how data is fetched, and the method it wraps is
+ * `icrc1_transfer`. TanStack Query runs a query function again whenever it
+ * refetches: when the window regains focus, when the network comes back, when
+ * a component mounts again, after an invalidation, when it retries. Each run
+ * is another transfer.
+ *
+ * The guarantee: for a generated `Actor`, which says each method's mode,
+ * `client.queryOptions` with an update (or oneway) method does not compile
+ * (`tests/traps.test-d.ts`). For an `Actor` written by hand, which does not,
+ * it throws a `TypeError` at the line that builds the read, which says to use
+ * `mutationOptions`, and sends nothing: that run-time check is what this file
+ * proves, through the ledger typed by hand. The one case where an update is a
+ * read, a method that answers the same however often it runs (ckBTC's
+ * `get_btc_address`), is a written-out opt-in, `{ update: "idempotent" }`,
+ * which is bounded: the read runs once per caller, and focus, reconnect and
+ * remount do not run it again.
+ */
+import {
+  QueryObserver,
+  focusManager,
+  onlineManager,
+} from "@tanstack/query-core"
+import { afterAll, afterEach, describe, expect, it, vi } from "vitest"
+import type { HandWritten } from "../canister-helpers.js"
+import * as icrc1 from "../fixtures/icrc1.js"
+import * as shapes from "../fixtures/shapes.js"
+import {
+  ALICE,
+  BOB,
+  LEDGER,
+  SIGNED_CALLS_TIMEOUT_MS,
+  disposeAll,
+  eventually,
+  setupLedger,
+  sleep,
+  transferArg,
+  type Ledger,
+} from "./ledger.js"
+
+vi.setConfig({ testTimeout: SIGNED_CALLS_TIMEOUT_MS })
+afterAll(disposeAll)
+afterEach(() => {
+  focusManager.setFocused(undefined)
+  onlineManager.setOnline(true)
+})
+
+/** Where the traps run a canister with an update method that is safe to read. */
+const BOOK = "qoctq-giaaa-aaaaa-aaaea-cai"
+
+/** A ledger, and next to it a canister whose `address` update answers the same every time. */
+function withAddressBook(options?: Parameters<typeof setupLedger>[0]) {
+  const l = setupLedger(options)
+  l.mock<shapes.Actor>(shapes.actor, BOOK, {
+    address: (seed, { caller }) => `${seed}:${caller}`,
+  })
+  return {
+    ...l,
+    book: l.client.canister<shapes.Actor>(shapes.actor, { id: BOOK }),
+  }
+}
+
+/**
+ * Waits until the client has nothing in flight: a refetch that a trigger made
+ * has been signed, sent, answered and certified, or has failed, however long
+ * that took. A fixed pause cannot say that: on a loaded machine a refetch that
+ * is sent can arrive after it, and the test would pass without the policy it
+ * checks. A refetch that focus or reconnect makes begins on a later turn of
+ * the event loop than the trigger, so the short pause lets it begin before
+ * the look at what is in flight.
+ */
+async function untilIdle(l: Ledger): Promise<void> {
+  await sleep(20)
+  await eventually(() => expect(l.client.queryClient.isFetching()).toBe(0))
+}
+
+/**
+ * Plays out what makes TanStack Query refetch: the window losing and regaining
+ * focus, the network dropping and coming back, and the component mounting
+ * again. After each, `settle` waits for whatever that is going to send.
+ */
+async function triggerRefetches(
+  l: Ledger,
+  mountAgain: () => () => void,
+  settle: () => Promise<void>
+) {
+  focusManager.setFocused(false)
+  focusManager.setFocused(true)
+  await settle()
+  onlineManager.setOnline(false)
+  onlineManager.setOnline(true)
+  await settle()
+  const unmount = mountAgain()
+  await settle()
+  unmount()
+  l.client.queryClient.unmount()
+}
+
+describe("a read built for an update method", () => {
+  it("is refused when it is built, and nothing is sent", () => {
+    const l = setupLedger()
+    // The same ledger, typed by an Actor written by hand: no mode says that
+    // icrc1_transfer is an update, so the read compiles and only the check at
+    // run time stands between it and a transfer on every refetch.
+    const ledger = l.client.canister<HandWritten<icrc1.Actor>>(icrc1.actor, {
+      id: LEDGER,
+    })
+
+    expect(() =>
+      l.client.queryOptions(ledger, "icrc1_transfer", transferArg(500n))
+    ).toThrow(TypeError)
+    expect(() =>
+      l.client.queryOptions(ledger, "icrc1_transfer", transferArg(500n))
+    ).toThrow(/mutationOptions/)
+    expect(l.sent()).toEqual([])
+    expect(l.executed()).toBe(0)
+  })
+
+  it("is sent again by a refetch when the method is a plain query, which is what the opt-in below must not be", async () => {
+    const l = setupLedger()
+    l.client.queryClient.mount()
+    const options = () => l.client.queryOptions(l.ledger, "icrc1_fee")
+    const observer = new QueryObserver(l.client.queryClient, options())
+    const stop = observer.subscribe(() => undefined)
+    await eventually(() =>
+      expect(observer.getCurrentResult().data).toBe(10_000n)
+    )
+
+    // Each trigger sends the read again: the log grows after every one.
+    let seen = l.sent().length
+    await triggerRefetches(
+      l,
+      () =>
+        new QueryObserver(l.client.queryClient, options()).subscribe(
+          () => undefined
+        ),
+      async () => {
+        await eventually(() => expect(l.sent().length).toBeGreaterThan(seen))
+        seen = l.sent().length
+      }
+    )
+    stop()
+
+    expect(l.sent().length).toBeGreaterThanOrEqual(4)
+  })
+})
+
+describe("an update read with { update: 'idempotent' }", () => {
+  it("runs once, and is not run again on focus, reconnect or remount", async () => {
+    const l = withAddressBook()
+    l.client.queryClient.mount()
+    const options = () =>
+      l.client.queryOptions(l.book, "address", "home", {
+        update: "idempotent",
+      })
+    const observer = new QueryObserver(l.client.queryClient, options())
+    const stop = observer.subscribe(() => undefined)
+    await eventually(() =>
+      expect(observer.getCurrentResult().data).toBe(`home:${ALICE}`)
+    )
+
+    // Each trigger is followed by the wait for whatever it sent to be over.
+    await triggerRefetches(
+      l,
+      () =>
+        new QueryObserver(l.client.queryClient, options()).subscribe(
+          () => undefined
+        ),
+      () => untilIdle(l)
+    )
+    stop()
+
+    // One call, as Alice; not one per trigger.
+    expect(l.calls()).toMatchObject([{ methodName: "address", caller: ALICE }])
+  })
+
+  it("is read once for each caller, and never as the new caller under the old key", async () => {
+    const l = withAddressBook()
+    const { queryClient } = l.client
+    queryClient.mount()
+    const options = () =>
+      l.client.queryOptions(l.book, "address", "home", {
+        update: "idempotent",
+      })
+    const aliceOptions = options()
+    const aliceObserver = new QueryObserver(queryClient, aliceOptions)
+    const stopAlice = aliceObserver.subscribe(() => undefined)
+    await eventually(() =>
+      expect(aliceObserver.getCurrentResult().data).toBe(`home:${ALICE}`)
+    )
+
+    // Bob signs in. The read an app builds from now on is Bob's: it has his
+    // own key, and runs once, as him, however often it is triggered.
+    l.auth.switchTo(2)
+    const bobOptions = options()
+    expect(bobOptions.queryKey).not.toEqual(aliceOptions.queryKey)
+    const bobObserver = new QueryObserver(queryClient, bobOptions)
+    const stopBob = bobObserver.subscribe(() => undefined)
+    await eventually(() =>
+      expect(bobObserver.getCurrentResult().data).toBe(`home:${BOB}`)
+    )
+    await triggerRefetches(
+      l,
+      () =>
+        new QueryObserver(queryClient, bobOptions).subscribe(() => undefined),
+      () => untilIdle(l)
+    )
+
+    // Alice's read, built before the switch, is fetched again now. It is made
+    // for Alice and is never sent as Bob, whose answer would sit under her key.
+    await queryClient
+      .fetchQuery({ ...aliceOptions, staleTime: 0, retry: false })
+      .catch((error: unknown) => error)
+    await untilIdle(l)
+    stopAlice()
+    stopBob()
+
+    expect(l.calls()).toMatchObject([
+      { methodName: "address", caller: ALICE },
+      { methodName: "address", caller: BOB },
+    ])
+    // Alice's reads left the cache when Bob became current, and the refused
+    // read put nothing under her key.
+    expect(queryClient.getQueryData(aliceOptions.queryKey)).toBeUndefined()
+    expect(queryClient.getQueryData(bobOptions.queryKey)).toBe(`home:${BOB}`)
+  })
+
+  it("is refused for a caller who is not signed in, like any update", async () => {
+    const l = withAddressBook({ signedIn: false })
+
+    await expect(
+      l.client.queryClient.fetchQuery({
+        ...l.client.queryOptions(l.book, "address", "home", {
+          update: "idempotent",
+        }),
+        retry: false,
+      })
+    ).rejects.toMatchObject({ kind: "unauthenticated", mayHaveExecuted: false })
+    expect(l.calls()).toEqual([])
+  })
+})

package/packages/core/tests/traps/update-not-resent.test.ts

@@ -0,0 +1,126 @@
+/**
+ * Trap: an update sent again after a failure that does not say it never ran.
+ *
+ * The mistake a hand-written integration makes: it wraps the call in a retry
+ * ("three attempts, back off"), or leaves the agent's own retries on. Every
+ * attempt of an update is a new request with a new id, so the Internet
+ * Computer cannot tell a retry from a second payment and runs both. A
+ * canister that rejected with code 4 keeps what it changed, one that trapped
+ * (code 5) may have committed some of it before the trap, a reply that was
+ * lost on its way back came from a canister that ran, and an HTTP 408 or 5xx
+ * may follow a delivery: re-sending after any of them can pay twice.
+ *
+ * The guarantee: after reject code 4, reject code 5, a lost reply, HTTP 408
+ * and HTTP 5xx, exactly one request was sent, however long the client waits
+ * (it waits past both of its re-send delays, 300 ms and 600 ms, before it
+ * looks), and the failure says `mayHaveExecuted: true` so the app reads the
+ * balance back before it offers to try again. The cases where a re-send is
+ * safe, and made, are in `update-resent-when-never-delivered.test.ts`.
+ */
+import { MutationObserver } from "@tanstack/query-core"
+import { afterAll, describe, expect, it, vi } from "vitest"
+import {
+  ALICE,
+  FEE,
+  SIGNED_CALLS_TIMEOUT_MS,
+  disposeAll,
+  pastResendDelays,
+  rejection,
+  setupLedger,
+  transferArg,
+} from "./ledger.js"
+
+vi.setConfig({ testTimeout: SIGNED_CALLS_TIMEOUT_MS })
+afterAll(disposeAll)
+
+// One flat suite, so that the waits of its tests overlap: each sits out the
+// client's re-send delays, and one after another they would take seconds.
+describe.concurrent("an update that may have run", () => {
+  it.each([
+    [4, "refused after the debit", false],
+    [5, "trapped after the debit", true],
+  ] as const)(
+    "is never re-sent after reject code %i, so the ledger debits once",
+    async (code, message, trap) => {
+      const l = setupLedger()
+      l.onTransfer((apply) => {
+        apply()
+        if (trap) throw new Error(message)
+        return l.reject(code, message)
+      })
+
+      const failure = await rejection(
+        l.ledger.icrc1_transfer(transferArg(500n))
+      )
+      await pastResendDelays()
+
+      expect(failure).toMatchObject({
+        kind: "rejected",
+        rejectCode: code,
+        mayHaveExecuted: true,
+      })
+      expect(l.calls()).toHaveLength(1)
+      expect(l.executed()).toBe(1)
+      expect(l.balances.get(ALICE)).toBe(1_000_000n - 500n - FEE)
+    }
+  )
+
+  it("is never re-sent after its reply was lost, so the ledger debits once", async () => {
+    const l = setupLedger()
+    l.dropNextReply()
+
+    const failure = await rejection(l.ledger.icrc1_transfer(transferArg(500n)))
+    await pastResendDelays()
+
+    // The ledger ran it: the reply was lost, not the call.
+    expect(failure).toMatchObject({
+      kind: "outcome_unknown",
+      mayHaveExecuted: true,
+    })
+    expect(l.calls()).toMatchObject([{ dropped: true }])
+    expect(l.executed()).toBe(1)
+    expect(l.balances.get(ALICE)).toBe(1_000_000n - 500n - FEE)
+  })
+
+  it("is never re-sent after a mutation lost its reply: retry is off", async () => {
+    const l = setupLedger()
+    l.dropNextReply()
+    const mutation = new MutationObserver(
+      l.client.queryClient,
+      l.client.mutationOptions(l.ledger, "icrc1_transfer")
+    )
+
+    await mutation.mutate(transferArg(500n)).catch(() => undefined)
+    await pastResendDelays()
+
+    expect(mutation.getCurrentResult()).toMatchObject({
+      status: "error",
+      failureCount: 1,
+      error: { kind: "outcome_unknown", mayHaveExecuted: true },
+    })
+    expect(l.calls()).toHaveLength(1)
+    expect(l.executed()).toBe(1)
+  })
+
+  it.each([408, 500, 502, 503])(
+    "is never re-sent after HTTP %i",
+    async (status) => {
+      const l = setupLedger()
+      l.refuseNext(status)
+
+      const failure = await rejection(
+        l.ledger.icrc1_transfer(transferArg(500n))
+      )
+      await pastResendDelays()
+
+      // The client cannot tell whether a timeout or a gateway error came
+      // before or after the call reached a canister, so it says "may have".
+      expect(failure).toMatchObject({
+        kind: "outcome_unknown",
+        httpStatus: status,
+        mayHaveExecuted: true,
+      })
+      expect(l.calls()).toHaveLength(1)
+    }
+  )
+})

package/packages/core/tests/traps/update-resent-when-never-delivered.test.ts

@@ -0,0 +1,159 @@
+/**
+ * Trap: an update that was never delivered, given up on, or sent again as
+ * someone else.
+ *
+ * The mistake a hand-written integration makes, in either direction. A cautious
+ * one never sends an update twice, so a transfer the replica turned away (it
+ * was rate limited, HTTP 429, or the subnet was busy, reject code 2) fails for
+ * the user although a moment later it would have gone through. A careless one
+ * sends again after anything, and its re-send goes out as whoever is signed in
+ * by then.
+ *
+ * The guarantee: after the two failures that prove the update never got in,
+ * reject code 2 (SYS_TRANSIENT) and HTTP 429, the client sends it again, at
+ * most twice (after 300 ms, then 600 ms), and resolves with the reply of the
+ * attempt that went through, with the ledger booking it once. Each re-send is
+ * made for the caller of the first attempt: a user who switched account in
+ * the meantime does not pay for it, the call is cancelled instead. To the
+ * management canister `aaaaa-aa`, whose rejects prove nothing about what ran,
+ * an update is never sent again. Failures that do not prove non-delivery are
+ * in `update-not-resent.test.ts`.
+ */
+import { principal } from "@meantjs/schema"
+import { MutationObserver } from "@tanstack/query-core"
+import { afterAll, describe, expect, it, vi } from "vitest"
+import * as management from "../fixtures/management.js"
+import {
+  ALICE,
+  BOB,
+  FEE,
+  SHOP,
+  SIGNED_CALLS_TIMEOUT_MS,
+  disposeAll,
+  eventually,
+  pastResendDelays,
+  rejection,
+  setupLedger,
+  transferArg,
+} from "./ledger.js"
+
+vi.setConfig({ testTimeout: SIGNED_CALLS_TIMEOUT_MS })
+afterAll(disposeAll)
+
+// One flat suite, so that the waits of its tests overlap.
+describe.concurrent("an update that was never delivered", () => {
+  it("is sent again once after reject code 2, and the ledger books it once", async () => {
+    const l = setupLedger()
+    let attempts = 0
+    l.onTransfer((apply) => {
+      attempts += 1
+      // The first attempt is turned away before any canister code ran.
+      return attempts === 1 ? l.reject(2, "the subnet is busy") : apply()
+    })
+
+    await expect(l.ledger.icrc1_transfer(transferArg(500n))).resolves.toBe(1n)
+
+    expect(attempts).toBe(2)
+    expect(l.calls()).toHaveLength(2)
+    expect(l.executed()).toBe(1)
+    expect(l.balances.get(ALICE)).toBe(1_000_000n - 500n - FEE)
+  })
+
+  it("is sent again once after HTTP 429, and the ledger books it once", async () => {
+    const l = setupLedger()
+    l.refuseNext(429)
+
+    await expect(l.ledger.icrc1_transfer(transferArg(500n))).resolves.toBe(1n)
+
+    expect(l.calls()).toMatchObject([
+      { refused: expect.stringContaining("429") },
+      { methodName: "icrc1_transfer", caller: ALICE },
+    ])
+    expect(l.executed()).toBe(1)
+    expect(l.balances.get(ALICE)).toBe(1_000_000n - 500n - FEE)
+  })
+
+  it("is sent again at most twice, and then fails as not delivered", async () => {
+    const l = setupLedger()
+    l.refuseNext(429, 5)
+
+    const failure = await rejection(l.ledger.icrc1_transfer(transferArg(500n)))
+    await pastResendDelays()
+
+    expect(failure).toMatchObject({
+      kind: "not_delivered",
+      httpStatus: 429,
+      mayHaveExecuted: false,
+    })
+    // The first attempt and two re-sends; nothing booked.
+    expect(l.calls()).toHaveLength(3)
+    expect(l.executed()).toBe(0)
+  })
+
+  it("is sent again by a mutation, which TanStack Query does not retry on top", async () => {
+    const l = setupLedger()
+    l.refuseNext(429)
+    const mutation = new MutationObserver(
+      l.client.queryClient,
+      l.client.mutationOptions(l.ledger, "icrc1_transfer")
+    )
+
+    await mutation.mutate(transferArg(500n))
+
+    // Two requests came from one attempt of the mutation: TanStack's retry is
+    // off, and the client's own re-send does not count as a failure.
+    expect(mutation.getCurrentResult()).toMatchObject({
+      status: "success",
+      data: 1n,
+      failureCount: 0,
+    })
+    expect(l.calls()).toHaveLength(2)
+    expect(l.executed()).toBe(1)
+  })
+
+  it("is not sent again as somebody else when the account is switched during the wait", async () => {
+    const l = setupLedger()
+    l.refuseNext(429)
+
+    const sending = rejection(l.ledger.icrc1_transfer(transferArg(500n)))
+    // The first attempt was refused; the client waits 300 ms to send again.
+    await eventually(() => expect(l.calls()).toHaveLength(1))
+    l.auth.switchTo(2)
+    const failure = await sending
+    await pastResendDelays()
+
+    expect(failure).toMatchObject({
+      kind: "cancelled",
+      mayHaveExecuted: false,
+    })
+    // Nothing was sent for Bob, who was signed in when the wait ended, and
+    // nothing again for Alice: the one request is the first, refused one.
+    expect(l.calls()).toMatchObject([
+      { refused: expect.stringContaining("429") },
+    ])
+    expect(l.calls().filter((call) => call.caller === BOB)).toEqual([])
+    expect(l.executed()).toBe(0)
+    expect(l.balances.get(BOB)).toBe(500_000n)
+    expect(l.balances.get(ALICE)).toBe(1_000_000n)
+  })
+
+  it("is never sent again to the management canister, where reject code 2 proves nothing", async () => {
+    const l = setupLedger()
+    l.mock<management.Actor>(management.actor, "aaaaa-aa", {
+      start_canister: () => l.reject(2, "the subnet is busy"),
+    })
+    const ic = l.client.canister<management.Actor>(management.actor, {
+      id: "aaaaa-aa",
+    })
+
+    const failure = await rejection(
+      ic.start_canister({ canister_id: principal(SHOP) })
+    )
+    await pastResendDelays()
+
+    // A stop_canister rejected with code 2 may have taken effect, so the call
+    // says "may have executed" and is left to the app.
+    expect(failure).toMatchObject({ kind: "rejected", mayHaveExecuted: true })
+    expect(l.calls()).toHaveLength(1)
+  })
+})