@mentra/acs-meeting 3.2.0-dev.221 → 3.2.0-dev.223

package/android/src/test/java/com/mentra/acsmeeting/audio/AudioUplinkChainTest.kt

@@ -0,0 +1,250 @@
+package com.mentra.acsmeeting.audio
+
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.Test
+
+/**
+ * The mute contract, stage by stage.
+ *
+ * These are not tests that mute sets a flag. They populate every stage that can hold the wearer's
+ * voice and then assert that nothing which was in them ever reaches the pacer — which is the only
+ * form of the guarantee that means anything to someone who pressed Mute mid-sentence.
+ */
+class AudioUplinkChainTest {
+  private val rate = 16_000
+  private val nativeRate = UplinkPacer.RATE
+  private val bytesPerMs = rate * 2 / 1000
+  private val nativeBytesPerMs = UplinkPacer.BYTES_PER_MS
+
+  /** 16 kHz mono PCM16 at a constant non-zero level, so silence is distinguishable from voice. */
+  private fun voice(ms: Int): ByteArray = ByteArray(ms * bytesPerMs) { 0x20 }
+
+  /**
+   * The same at ACS's own 48 kHz mono, which the bridge passes through untouched.
+   *
+   * The stage tests below assert on exact frame boundaries, and the 16 kHz interpolator cannot give
+   * them: it drops its last partial sample pair per call, so a 20 ms buffer resamples to slightly
+   * under a 20 ms frame. Feeding the native rate keeps the byte arithmetic exact so an assertion
+   * that fails means a stage held audio, not that the resampler rounded.
+   */
+  private fun nativeVoice(ms: Int): ByteArray = ByteArray(ms * nativeBytesPerMs) { 0x20 }
+
+  private fun bridge() = PcmBridge(null, false)
+
+  private class FakeClock(var nanos: Long = 0L) : () -> Long {
+    override fun invoke(): Long = nanos
+
+    fun advanceMs(ms: Long) {
+      nanos += ms * 1_000_000L
+    }
+  }
+
+  @Test
+  fun resamplesSixteenKilohertzMonoPreservingDuration() {
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer)
+
+    // A second of 16 kHz input is a second of 48 kHz output. The interpolator's tail leaves at most
+    // one partial 20 ms frame in the bridge, so the pacer holds a whole second bar that frame.
+    repeat(100) { chain.ingest(voice(10), rate, 1) }
+
+    assertThat(pacer.depthMs()).isBetween(980, 1_000)
+  }
+
+  @Test
+  fun mutedIngestNeverEntersAnyStage() {
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer)
+
+    chain.mute()
+    repeat(100) { chain.ingest(voice(10), rate, 1) }
+
+    assertThat(pacer.depthMs()).isEqualTo(0)
+  }
+
+  /**
+   * The failure this whole class exists for. Gating new input is not mute: at the moment the button
+   * is pressed the delay ring holds up to its full window, the resampler holds a partial 20 ms
+   * frame, and the pacer holds its target headroom. All three keep draining unless mute clears them.
+   */
+  @Test
+  fun muteClearsTheDelayRingTheBridgeRemainderAndThePacer() {
+    val clock = FakeClock()
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer, delayMs = 200, clock = clock)
+
+    // 400 ms of input against a 200 ms hold: 200 ms has reached the pacer, 200 ms is still held.
+    repeat(40) {
+      chain.ingest(nativeVoice(10), nativeRate, 1)
+      clock.advanceMs(10)
+    }
+    // One more releases a 21st 10 ms chunk, so the bridge is left holding half of a 20 ms frame.
+    chain.ingest(nativeVoice(10), nativeRate, 1)
+    assertThat(pacer.depthMs()).isGreaterThan(UplinkPacer.TARGET_MS)
+    assertThat(chain.delayedBytes()).isGreaterThan(0)
+
+    chain.mute()
+
+    assertThat(pacer.depthMs()).isEqualTo(0)
+    assertThat(chain.delayedBytes()).isEqualTo(0)
+
+    // And the bridge remainder is gone too. After unmute, the first 10 ms to clear the delay ring
+    // must not complete a 20 ms frame — it could only do so by pairing with the half-frame the
+    // wearer spoke before pressing Mute. It takes two fresh chunks to make the first whole frame.
+    chain.unmute()
+    chain.ingest(nativeVoice(10), nativeRate, 1)
+    clock.advanceMs(200)
+    chain.ingest(nativeVoice(10), nativeRate, 1)
+    assertThat(pacer.depthMs()).isEqualTo(0)
+    clock.advanceMs(200)
+    chain.ingest(nativeVoice(10), nativeRate, 1)
+    assertThat(pacer.depthMs()).isEqualTo(20)
+  }
+
+  @Test
+  fun unmuteAcceptsAudioAgain() {
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer)
+
+    chain.mute()
+    chain.ingest(nativeVoice(20), nativeRate, 1)
+    chain.unmute()
+    chain.ingest(nativeVoice(20), nativeRate, 1)
+
+    assertThat(chain.isMuted()).isFalse()
+    // Exactly one frame: the buffer ingested while muted was dropped, not deferred.
+    assertThat(pacer.depthMs()).isEqualTo(20)
+  }
+
+  @Test
+  fun resetDropsBufferedAudioWithoutMuting() {
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer)
+    chain.ingest(nativeVoice(100), nativeRate, 1)
+
+    chain.reset()
+
+    assertThat(pacer.depthMs()).isEqualTo(0)
+    assertThat(chain.isMuted()).isFalse()
+    chain.ingest(nativeVoice(20), nativeRate, 1)
+    assertThat(pacer.depthMs()).isEqualTo(20)
+  }
+
+  /**
+   * `ingest` runs on the BLE/JS thread and `mute` on the caller's. Without one lock across both,
+   * mute can clear the pacer while an ingest is midway through pushing into it, and the frames that
+   * land after the clear are voice from before the mute.
+   */
+  @Test
+  fun aMuteRacingIngestNeverLeavesVoiceBehind() {
+    repeat(200) {
+      val pacer = UplinkPacer()
+      val chain = AudioUplinkChain(bridge(), pacer)
+      val ready = CountDownLatch(2)
+      val go = CountDownLatch(1)
+
+      val producer = Thread {
+        ready.countDown()
+        go.await()
+        repeat(20) { chain.ingest(voice(20), rate, 1) }
+      }
+      val muter = Thread {
+        ready.countDown()
+        go.await()
+        chain.mute()
+      }
+      producer.start()
+      muter.start()
+      assertThat(ready.await(5, TimeUnit.SECONDS)).isTrue()
+      go.countDown()
+      producer.join(5_000)
+      muter.join(5_000)
+
+      assertThat(chain.isMuted()).isTrue()
+      // Whatever interleaving happened, the last thing to run under the lock was either the mute
+      // (which clears) or an ingest that saw `muted` and dropped. Neither leaves audio buffered.
+      assertThat(pacer.depthMs()).isEqualTo(0)
+    }
+  }
+
+  @Test
+  fun aZeroDelayIsPassthrough() {
+    val clock = FakeClock()
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer, delayMs = 0, clock = clock)
+
+    chain.ingest(nativeVoice(20), nativeRate, 1)
+
+    assertThat(chain.delayedBytes()).isEqualTo(0)
+    assertThat(pacer.depthMs()).isEqualTo(20)
+  }
+
+  @Test
+  fun aConfiguredDelayHoldsInputUntilItIsOldEnough() {
+    val clock = FakeClock()
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer, delayMs = 120, clock = clock)
+
+    // 100 ms of input, none of it yet 120 ms old.
+    repeat(10) {
+      chain.ingest(nativeVoice(10), nativeRate, 1)
+      clock.advanceMs(10)
+    }
+    assertThat(pacer.depthMs()).isEqualTo(0)
+    assertThat(chain.delayedBytes()).isEqualTo(100 * nativeBytesPerMs)
+
+    // Once the two oldest chunks are 120 ms old they come out together, in arrival order.
+    clock.advanceMs(30)
+    chain.ingest(nativeVoice(10), nativeRate, 1)
+    assertThat(pacer.depthMs()).isEqualTo(20)
+  }
+
+  @Test
+  fun aDelayBeyondTheCeilingIsClamped() {
+    val clock = FakeClock()
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer, delayMs = 5_000, clock = clock)
+
+    repeat(60) {
+      chain.ingest(voice(10), rate, 1)
+      clock.advanceMs(10)
+    }
+
+    // Clamped to 500 ms, so by 600 ms of input the first 100 ms have already been released.
+    assertThat(pacer.depthMs()).isGreaterThan(0)
+    assertThat(chain.delayedBytes()).isLessThanOrEqualTo(AudioUplinkChain.MAX_DELAY_MS * bytesPerMs)
+  }
+
+  /** A clock that does not advance must not turn a bounded hold into an unbounded one. */
+  @Test
+  fun aStoppedClockDoesNotGrowTheDelayRingWithoutBound() {
+    val pacer = UplinkPacer()
+    val chain = AudioUplinkChain(bridge(), pacer, delayMs = 100, clock = { 0L })
+
+    repeat(500) { chain.ingest(voice(10), rate, 1) }
+
+    assertThat(chain.delayedBytes()).isLessThanOrEqualTo(100 * AudioUplinkChain.MAX_BYTES_PER_MS)
+  }
+
+  @Test
+  fun ingestNotifiesBeforeTheDelayLineHolds() {
+    val clock = FakeClock(nanos = 40_000_000L)
+    val pacer = UplinkPacer()
+    val seen = mutableListOf<Pair<Int, Long>>()
+    val input = nativeVoice(20)
+    val chain = AudioUplinkChain(
+      bridge(),
+      pacer,
+      delayMs = 120,
+      clock = clock,
+      onIngest = { pcm, nowNs -> seen.add(pcm.size to nowNs) },
+    )
+
+    chain.ingest(input, nativeRate, 1)
+
+    assertThat(pacer.depthMs()).isEqualTo(0)
+    assertThat(seen).containsExactly(input.size to 40_000_000L)
+  }
+}

package/android/src/test/java/com/mentra/acsmeeting/audio/CapturePolicyTest.kt

@@ -10,3 +10,47 @@ class CapturePolicyTest {
     assertThat(CapturePolicy.captureGlassesMic(AudioSourceKind.PHONE)).isFalse()
   }
 }
+
+class GlassesPcmRoutingTest {
+  /**
+   * The double-audio case. Both sources carry the same room; enabling both is heard as an echo at
+   * the far end that no participant can mute, because neither copy is anyone's microphone.
+   */
+  @Test
+  fun exactlyOneSourceOfTheWearersVoiceIsEverOn() {
+    for (softap in listOf(true, false)) {
+      for (enabled in listOf(true, false)) {
+        val routing = GlassesPcmRouting.decide(softap, enabled)
+        assertThat(routing.relayPcm && routing.externalPcm).isFalse()
+      }
+    }
+  }
+
+  /**
+   * SoftAP publishes video only, so the wearer's voice can come from exactly one place: the BLE
+   * LC3 PCM the host pushes. Taking the relay here would be taking a track that carries no audio.
+   */
+  @Test
+  fun aSoftApCallTakesTheWearerFromTheHostsBleLc3Pcm() {
+    assertThat(GlassesPcmRouting.decide(softap = true, enabled = true))
+      .isEqualTo(GlassesPcmRouting(relayPcm = false, externalPcm = true))
+  }
+
+  @Test
+  fun aWhepCallKeepsTakingTheWearerFromTheRelayTrack() {
+    assertThat(GlassesPcmRouting.decide(softap = false, enabled = true))
+      .isEqualTo(GlassesPcmRouting(relayPcm = true, externalPcm = false))
+  }
+
+  /**
+   * Disabling has to close *both* gates whichever transport this call uses. A push that survives a
+   * mute or a source switch is the wearer heard when they asked not to be.
+   */
+  @Test
+  fun disablingClosesBothGatesOnEitherTransport() {
+    assertThat(GlassesPcmRouting.decide(softap = true, enabled = false))
+      .isEqualTo(GlassesPcmRouting(relayPcm = false, externalPcm = false))
+    assertThat(GlassesPcmRouting.decide(softap = false, enabled = false))
+      .isEqualTo(GlassesPcmRouting(relayPcm = false, externalPcm = false))
+  }
+}

package/android/src/test/java/com/mentra/acsmeeting/audio/UplinkPacerTest.kt

@@ -4,6 +4,21 @@ import org.assertj.core.api.Assertions.assertThat
 import org.junit.Test
 
 class UplinkPacerTest {
+  @Test
+  fun lc3HeadroomAbsorbsRepeated140msDeliveryBursts() {
+    val pacer = UplinkPacer()
+    pacer.configureTarget(UplinkPacer.LC3_TARGET_MS)
+    pacer.push(tone(UplinkPacer.LC3_TARGET_MS))
+    repeat(1500) { tick ->
+      if (tick > 0 && tick % 7 == 0) pacer.push(tone(140))
+      assertThat(pacer.tick(tick * 20_000_000L).silence)
+        .describedAs("tick %d of bursty LC3", tick).isFalse()
+    }
+    assertThat(pacer.snapshot(30_000_000_000L).overflowDroppedMs).isZero()
+    pacer.configureTarget(UplinkPacer.TARGET_MS)
+    assertThat(pacer.depthMs()).isZero()
+    assertThat(pacer.state()).isEqualTo(UplinkPacer.State.PREROLLING)
+  }
   private val frameBytes = UplinkPacer.FRAME_BYTES
   private val tickNanos = UplinkPacer.FRAME_MS * 1_000_000L
 
@@ -107,7 +122,7 @@ class UplinkPacerTest {
   }
 
   @Test
-  fun depthAboveEmergencyCapDropsOldestDownToTarget() {
+  fun depthAboveEmergencyCapShearsOnlyThePeak() {
     val pacer = UplinkPacer()
     var now = 0L
     pacer.push(tone(UplinkPacer.TARGET_MS))
@@ -116,10 +131,25 @@ class UplinkPacerTest {
 
     pacer.push(tone(500))
     assertThat(pacer.tick(now).silence).isFalse()
-    assertThat(pacer.controlDepthMs()).isEqualTo(UplinkPacer.TARGET_MS)
+    // Shears to the cap, not back to the 60 ms target — that hole is what the wearer heard.
+    assertThat(pacer.controlDepthMs()).isBetween(UplinkPacer.EMERGENCY_CAP_MS - 20, UplinkPacer.EMERGENCY_CAP_MS)
+    assertThat(pacer.controlDepthMs()).isGreaterThan(UplinkPacer.TARGET_MS)
     val stats = pacer.snapshot(now)
-    assertThat(stats.overflowDroppedMs).isEqualTo(480L)
-    assertThat(stats.driftCorrections).isEqualTo(0L)
+    assertThat(stats.overflowDroppedMs).isBetween(130L, 160L)
+  }
+
+  @Test
+  fun aDelaySizedBurstStaysInTheRing() {
+    val pacer = UplinkPacer()
+    var now = 0L
+    pacer.push(tone(UplinkPacer.TARGET_MS))
+    pacer.tick(now)
+    now += tickNanos
+
+    pacer.push(tone(170))
+    assertThat(pacer.tick(now).silence).isFalse()
+    assertThat(pacer.controlDepthMs()).isGreaterThan(150)
+    assertThat(pacer.snapshot(now).overflowDroppedMs).isEqualTo(0L)
   }
 
   @Test

package/android/src/test/java/com/mentra/acsmeeting/audio/UplinkSenderTest.kt

@@ -145,6 +145,102 @@ class UplinkSenderTest {
       .contains("skippedTicks=0")
       .contains("sendFailures=0")
       .contains("backpressureDrops=0")
+      .contains("pcmMeanAbs=-1")
+  }
+
+  /**
+   * The gate exists for the gap between `pacer.tick` and `transport.send`. A mute that lands in it
+   * would otherwise put the wearer's last word on the call after they asked not to be heard, and no
+   * amount of clearing upstream buffers can catch a frame that has already been popped.
+   */
+  @Test
+  fun aMuteBetweenTickAndSendIsStillHonoured() {
+    val pacer = UplinkPacer()
+    val transport = FakeTransport()
+    var muted = false
+    val sender = UplinkSender(pacer, transport, clock = { 0L }, muted = { muted }, log = {})
+    pacer.push(tone(UplinkPacer.TARGET_MS * 2))
+
+    sender.pumpOnce(0)
+    assertThat(transport.sent.last().any { it != 0.toByte() }).isTrue()
+
+    muted = true
+    sender.pumpOnce(UplinkSender.PERIOD_NANOS)
+
+    // Silence, not a gap: the cadence ACS reads as a healthy stream has to continue.
+    assertThat(transport.sent).hasSize(2)
+    assertThat(transport.sent.last()).hasSize(UplinkPacer.FRAME_BYTES)
+    assertThat(transport.sent.last().all { it == 0.toByte() }).isTrue()
+    assertThat(sender.stats().mutedFrames).isEqualTo(1L)
+  }
+
+  /**
+   * Silence the pacer produced itself is not the mute gate's work, and counting it as such would
+   * make `mutedFrames` read as suppressed speech during every preroll.
+   */
+  @Test
+  fun pacerSilenceIsNotCountedAsMutedVoice() {
+    val pacer = UplinkPacer()
+    val sender = UplinkSender(pacer, FakeTransport(), clock = { 0L }, muted = { true }, log = {})
+
+    // Nothing pushed, so the pacer is still prerolling and emits its own silence.
+    sender.pumpOnce(0)
+
+    assertThat(sender.stats().mutedFrames).isEqualTo(0L)
+  }
+
+  /**
+   * Mute is instantaneous at the gate and is not instantaneous at the far end: `sendRawAudioBuffer`
+   * cannot be recalled, so whatever ACS already accepted still plays out. That drain is the tail the
+   * wearer perceives, so it is measured rather than assumed.
+   */
+  @Test
+  fun muteTailIsMeasuredFromTheDrainOfAlreadySubmittedBuffers() {
+    val pacer = UplinkPacer()
+    val transport = FakeTransport().apply { autoComplete = false }
+    var muted = false
+    val logs = mutableListOf<String>()
+    val sender = UplinkSender(pacer, transport, clock = { 0L }, muted = { muted }, log = { logs.add(it) })
+    pacer.push(tone(UplinkPacer.TARGET_MS))
+
+    // Five frames ACS has accepted and not completed.
+    pump(sender, pacer, 5)
+    assertThat(sender.stats().inFlight).isEqualTo(5)
+    assertThat(sender.stats().muteTailMs).isNull()
+
+    muted = true
+    sender.pumpOnce(5 * UplinkSender.PERIOD_NANOS)
+    // Still in flight, so the tail is not over and must not be reported as zero.
+    assertThat(sender.stats().muteTailMs).isNull()
+
+    transport.completeAll()
+    sender.pumpOnce(8 * UplinkSender.PERIOD_NANOS)
+
+    assertThat(sender.stats().muteTailMs).isEqualTo(60L)
+    assertThat(sender.stats().muteTailMs!!).isLessThanOrEqualTo(UplinkSender.MAX_IN_FLIGHT * UplinkPacer.FRAME_MS.toLong())
+    assertThat(logs).anySatisfy { assertThat(it).contains("muteTailMs=60") }
+  }
+
+  @Test
+  fun unmutingArmsTheNextMuteTailMeasurement() {
+    val pacer = UplinkPacer()
+    val transport = FakeTransport()
+    var muted = false
+    val sender = UplinkSender(pacer, transport, clock = { 0L }, muted = { muted }, log = {})
+    pacer.push(tone(UplinkPacer.TARGET_MS))
+
+    muted = true
+    pump(sender, pacer, 2)
+    assertThat(sender.stats().muteTailMs).isEqualTo(20L)
+
+    muted = false
+    pump(sender, pacer, 2, from = 2)
+    muted = true
+    sender.pumpOnce(4 * UplinkSender.PERIOD_NANOS)
+    sender.pumpOnce(9 * UplinkSender.PERIOD_NANOS)
+
+    // Measured from the second mute, not carried over from the first.
+    assertThat(sender.stats().muteTailMs).isEqualTo(100L)
   }
 
   @Test

package/android/src/test/java/com/mentra/acsmeeting/network/InternetHoldLifecycleTest.kt

@@ -0,0 +1,102 @@
+package com.mentra.acsmeeting.network
+
+import android.content.Context
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+import android.net.NetworkRequest
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicReference
+import org.junit.Assert.*
+import org.junit.Test
+import org.mockito.ArgumentMatchers.*
+import org.mockito.Mockito.*
+
+/** Real request/close lifecycle with the Android service mocked; no radio or network required. */
+class InternetHoldLifecycleTest {
+    private class Fixture {
+        val context = mock(Context::class.java)
+        val manager = mock(ConnectivityManager::class.java)
+        val network = mock(Network::class.java)
+        val capabilities = mock(NetworkCapabilities::class.java)
+        val requested = CountDownLatch(1)
+        lateinit var callback: ConnectivityManager.NetworkCallback
+        val hold: InternetHold
+
+        init {
+            `when`(context.applicationContext).thenReturn(context)
+            `when`(context.getSystemService(ConnectivityManager::class.java)).thenReturn(manager)
+            `when`(manager.allNetworks).thenReturn(arrayOf(network))
+            `when`(manager.getNetworkCapabilities(network)).thenReturn(capabilities)
+            `when`(capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)).thenReturn(true)
+            `when`(capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)).thenReturn(true)
+            `when`(capabilities.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR)).thenReturn(true)
+            `when`(manager.bindProcessToNetwork(network)).thenReturn(true)
+            doAnswer {
+                callback = it.getArgument(1)
+                requested.countDown()
+                null
+            }.`when`(manager).requestNetwork(nullable(NetworkRequest::class.java), any(ConnectivityManager.NetworkCallback::class.java))
+            hold = InternetHold(context)
+        }
+
+        // The plain JVM android.jar has no implementation of Builder's fluent methods.
+        // Scope this stub to the caller thread, including the validation-wait worker test.
+        fun awaitCellular(timeoutMs: Long): InternetHold.CellularHold =
+            mockConstruction(NetworkRequest.Builder::class.java, withSettings().defaultAnswer(RETURNS_SELF)) { builder, _ ->
+                `when`(builder.build()).thenReturn(mock(NetworkRequest::class.java))
+            }.use { hold.awaitValidatedCellular(timeoutMs) }
+    }
+
+    @Test
+    fun `destroy with no default network drops pin and invalidates old callbacks`() {
+        val f = Fixture()
+        assertTrue(f.awaitCellular(0).validated)
+        assertFalse(f.hold.defaultNetwork().usable)
+        clearInvocations(f.manager)
+        f.hold.close()
+        verify(f.manager).unregisterNetworkCallback(f.callback)
+        verify(f.manager).bindProcessToNetwork(null)
+        clearInvocations(f.manager)
+        f.callback.onCapabilitiesChanged(mock(Network::class.java), f.capabilities)
+        f.callback.onLost(f.network)
+        f.hold.close()
+        assertFalse(f.hold.bindProcessToCellular())
+        assertFalse(f.awaitCellular(0).held)
+        verify(f.manager, never()).bindProcessToNetwork(nullable(Network::class.java))
+        verify(f.manager, never()).requestNetwork(nullable(NetworkRequest::class.java), any(ConnectivityManager.NetworkCallback::class.java))
+    }
+
+    @Test
+    fun `late validation cannot resurrect a hold destroyed during its wait`() {
+        val f = Fixture()
+        val result = AtomicReference<InternetHold.CellularHold>()
+        val worker = Thread { result.set(f.awaitCellular(2_000)) }
+        worker.start()
+        try {
+            assertTrue(f.requested.await(1, TimeUnit.SECONDS))
+            f.hold.close()
+            clearInvocations(f.manager)
+            f.callback.onCapabilitiesChanged(f.network, f.capabilities)
+            worker.join(1_000)
+            assertFalse(worker.isAlive)
+            assertFalse(result.get().held)
+            assertFalse(result.get().validated)
+            verify(f.manager, never()).bindProcessToNetwork(nullable(Network::class.java))
+        } finally {
+            worker.interrupt()
+            worker.join(2_000)
+        }
+    }
+
+    @Test
+    fun `ordinary release still permits reuse while close is permanent`() {
+        val f = Fixture()
+        assertTrue(f.awaitCellular(0).held)
+        f.hold.release()
+        assertTrue(f.awaitCellular(0).validated)
+        f.hold.close()
+        assertFalse(f.awaitCellular(0).held)
+    }
+}