@remnic/core 9.54.5 → 9.54.6

package/src/support-passport/grant-service.test.ts

@@ -1,6 +1,16 @@
 import assert from "node:assert/strict";
 import { renameSync, symlinkSync } from "node:fs";
-import { lstat, mkdir, mkdtemp, open, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
+import {
+  lstat,
+  mkdir,
+  mkdtemp,
+  open,
+  readFile,
+  readdir,
+  rm,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { test } from "node:test";
@@ -27,16 +37,24 @@ async function makeSubject() {
   const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grants-"));
   const aliceStorage = new StorageManager(path.join(root, "alice"));
   const bobStorage = new StorageManager(path.join(root, "bob"));
-  await Promise.all([aliceStorage.ensureDirectories(), bobStorage.ensureDirectories()]);
+  await Promise.all([
+    aliceStorage.ensureDirectories(),
+    bobStorage.ensureDirectories(),
+  ]);
   let currentTime = Date.parse("2026-08-11T12:00:00.000Z");
   const now = () => new Date(currentTime);
   const resolveOwner = async (principal: string) => {
-    if (principal === "owner:alice") return { principal, namespace: "alice", storage: aliceStorage };
-    if (principal === "owner:bob") return { principal, namespace: "bob", storage: bobStorage };
+    if (principal === "owner:alice")
+      return { principal, namespace: "alice", storage: aliceStorage };
+    if (principal === "owner:bob")
+      return { principal, namespace: "bob", storage: bobStorage };
     throw new Error("unknown test principal");
   };
   const cardService = new SupportPassportCardService({ resolveOwner, now });
-  const grantStore = new SupportPassportGrantStore({ memoryDir: path.join(root, "shared"), now });
+  const grantStore = new SupportPassportGrantStore({
+    memoryDir: path.join(root, "shared"),
+    now,
+  });
   const grantService = new SupportPassportGrantService({
     grantStore,
     resolveOwner,
@@ -65,7 +83,10 @@ async function makeSubject() {
   };
 }
 
-async function createActiveCard(subject: Awaited<ReturnType<typeof makeSubject>>, title = "Quiet space") {
+async function createActiveCard(
+  subject: Awaited<ReturnType<typeof makeSubject>>,
+  title = "Quiet space",
+) {
   const draft = await subject.cardService.createManualDraft({
     principal: "owner:alice",
     title,
@@ -80,7 +101,10 @@ async function createActiveCard(subject: Awaited<ReturnType<typeof makeSubject>>
   });
 }
 
-function expiryAfter(subject: Awaited<ReturnType<typeof makeSubject>>, milliseconds: number): string {
+function expiryAfter(
+  subject: Awaited<ReturnType<typeof makeSubject>>,
+  milliseconds: number,
+): string {
   return new Date(subject.now().getTime() + milliseconds).toISOString();
 }
 
@@ -103,7 +127,7 @@ test("a grant stores only hashed credentials with private file permissions", asy
       "state",
       "support-passport",
       "grants",
-      `${created.grant.grantId}.json`
+      `${created.grant.grantId}.json`,
     );
     const body = await readFile(filePath, "utf8");
     const state = JSON.parse(body);
@@ -122,14 +146,52 @@ test("a grant stores only hashed credentials with private file permissions", asy
   }
 });
 
+test("grant creation stops the new link when its owner request is cancelled after persistence", async () => {
+  const subject = await makeSubject();
+  const controller = new AbortController();
+  const create = subject.grantStore.create.bind(subject.grantStore);
+  subject.grantStore.create = async (...args) => {
+    const created = await create(...args);
+    controller.abort(new Error("simulated owner request timeout"));
+    return created;
+  };
+  try {
+    const card = await createActiveCard(subject);
+    await assert.rejects(
+      subject.grantService.createGrant(
+        {
+          principal: "owner:alice",
+          cards: [{ cardId: card.cardId, revision: card.revision }],
+          expiresAt: expiryAfter(subject, 3_600_000),
+        },
+        { signal: controller.signal },
+      ),
+      /simulated owner request timeout/,
+    );
+    const grants = await subject.grantService.listGrants({
+      principal: "owner:alice",
+    });
+    assert.equal(grants.length, 1);
+    assert.equal(grants[0]?.status, "revoked");
+  } finally {
+    await subject.cleanup();
+  }
+});
+
 test("owner grant listings read only the indexed owner grants", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-index-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-index-"),
+  );
   try {
-    const grantIds = ["00000000-0000-4000-8000-000000000001", "00000000-0000-4000-8000-000000000002"];
+    const grantIds = [
+      "00000000-0000-4000-8000-000000000001",
+      "00000000-0000-4000-8000-000000000002",
+    ];
     const now = new Date("2026-08-11T12:00:00.000Z");
     const store = new SupportPassportGrantStore({
       memoryDir: root,
-      makeGrantId: () => grantIds.shift() ?? "00000000-0000-4000-8000-000000000003",
+      makeGrantId: () =>
+        grantIds.shift() ?? "00000000-0000-4000-8000-000000000003",
       now: () => now,
     });
     const common = {
@@ -153,7 +215,7 @@ test("owner grant listings read only the indexed owner grants", async () => {
 
     assert.deepEqual(
       listed.map((state) => state.grantId),
-      [alice.state.grantId]
+      [alice.state.grantId],
     );
     assert.deepEqual(readGrantIds, [alice.state.grantId]);
     assert.notEqual(alice.state.grantId, bob.state.grantId);
@@ -163,25 +225,34 @@ test("owner grant listings read only the indexed owner grants", async () => {
 });
 
 test("owner grant listings propagate indexed grant read failures", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-list-error-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-list-error-"),
+  );
   try {
     const now = new Date("2026-08-11T12:00:00.000Z");
-    const store = new SupportPassportGrantStore({ memoryDir: root, now: () => now });
+    const store = new SupportPassportGrantStore({
+      memoryDir: root,
+      now: () => now,
+    });
     const created = await store.create({
       namespace: "alice",
       principal: "owner:alice",
       cards: [{ cardId: "card-1", revision: "a".repeat(64) }],
       expiresAt: new Date(now.getTime() + 3_600_000).toISOString(),
     });
-    const inspected = store as unknown as { readState(grantId: string): Promise<unknown> };
+    const inspected = store as unknown as {
+      readState(grantId: string): Promise<unknown>;
+    };
     inspected.readState = async (grantId) => {
       assert.equal(grantId, created.state.grantId);
-      throw Object.assign(new Error("simulated grant read failure"), { code: "EIO" });
+      throw Object.assign(new Error("simulated grant read failure"), {
+        code: "EIO",
+      });
     };
 
     await assert.rejects(
       store.listForOwner("alice", "owner:alice"),
-      (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO"
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO",
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -189,13 +260,16 @@ test("owner grant listings propagate indexed grant read failures", async () => {
 });
 
 test("owner grant listings put active links before inactive history", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-list-order-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-list-order-"),
+  );
   try {
     let currentTime = Date.parse("2026-08-11T12:00:00.000Z");
     let nextGrantId = 1;
     const store = new SupportPassportGrantStore({
       memoryDir: root,
-      makeGrantId: () => `00000000-0000-4000-8000-${String(nextGrantId++).padStart(12, "0")}`,
+      makeGrantId: () =>
+        `00000000-0000-4000-8000-${String(nextGrantId++).padStart(12, "0")}`,
       now: () => new Date(currentTime),
     });
     const input = {
@@ -206,7 +280,10 @@ test("owner grant listings put active links before inactive history", async () =
     };
     const inactive = await store.create(input);
     currentTime += 1_000;
-    const active = await store.create({ ...input, expiresAt: new Date(currentTime + 3_600_000).toISOString() });
+    const active = await store.create({
+      ...input,
+      expiresAt: new Date(currentTime + 3_600_000).toISOString(),
+    });
     await store.revoke({
       grantId: inactive.state.grantId,
       namespace: input.namespace,
@@ -217,7 +294,7 @@ test("owner grant listings put active links before inactive history", async () =
 
     assert.deepEqual(
       listed.map((state) => state.grantId),
-      [active.state.grantId, inactive.state.grantId]
+      [active.state.grantId, inactive.state.grantId],
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -225,10 +302,15 @@ test("owner grant listings put active links before inactive history", async () =
 });
 
 test("owner grant operations reject a noncanonical namespace and trim the principal", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-namespace-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-namespace-"),
+  );
   try {
     const now = new Date("2026-08-11T12:00:00.000Z");
-    const store = new SupportPassportGrantStore({ memoryDir: root, now: () => now });
+    const store = new SupportPassportGrantStore({
+      memoryDir: root,
+      now: () => now,
+    });
     await assert.rejects(
       store.create({
         namespace: " alice ",
@@ -236,7 +318,8 @@ test("owner grant operations reject a noncanonical namespace and trim the princi
         cards: [{ cardId: "card-1", revision: "a".repeat(64) }],
         expiresAt: new Date(now.getTime() + 3_600_000).toISOString(),
       }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "invalid_input"
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "invalid_input",
     );
     const created = await store.create({
       namespace: "alice",
@@ -246,8 +329,10 @@ test("owner grant operations reject a noncanonical namespace and trim the princi
     });
 
     assert.deepEqual(
-      (await store.listForOwner("alice", "owner:alice")).map((state) => state.grantId),
-      [created.state.grantId]
+      (await store.listForOwner("alice", "owner:alice")).map(
+        (state) => state.grantId,
+      ),
+      [created.state.grantId],
     );
     const revoked = await store.revoke({
       grantId: created.state.grantId,
@@ -262,13 +347,16 @@ test("owner grant operations reject a noncanonical namespace and trim the princi
 });
 
 test("owner grant history stays bounded while an inactive link frees capacity", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-history-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-history-"),
+  );
   try {
     const now = new Date("2026-08-11T12:00:00.000Z");
     let nextGrantId = 1;
     const store = new SupportPassportGrantStore({
       memoryDir: root,
-      makeGrantId: () => `00000000-0000-4000-8000-${String(nextGrantId++).padStart(12, "0")}`,
+      makeGrantId: () =>
+        `00000000-0000-4000-8000-${String(nextGrantId++).padStart(12, "0")}`,
       now: () => now,
     });
     const input = {
@@ -282,7 +370,8 @@ test("owner grant history stays bounded while an inactive link frees capacity",
 
     await assert.rejects(
       store.create(input),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "invalid_input"
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "invalid_input",
     );
     await store.revoke({
       grantId: first.state.grantId,
@@ -290,7 +379,13 @@ test("owner grant history stays bounded while an inactive link frees capacity",
       principal: input.principal,
       expectedStateVersion: first.state.stateVersion,
     });
-    const firstGrantPath = path.join(root, "state", "support-passport", "grants", `${first.state.grantId}.json`);
+    const firstGrantPath = path.join(
+      root,
+      "state",
+      "support-passport",
+      "grants",
+      `${first.state.grantId}.json`,
+    );
     const inspected = store as unknown as {
       readState(grantId: string): Promise<unknown>;
       writeOwnerIndex(ownerHash: string, grantIds: string[]): Promise<void>;
@@ -298,25 +393,44 @@ test("owner grant history stays bounded while an inactive link frees capacity",
     const readState = inspected.readState.bind(store);
     const writeOwnerIndex = inspected.writeOwnerIndex.bind(store);
     inspected.writeOwnerIndex = async () => {
-      throw Object.assign(new Error("simulated owner index write failure"), { code: "EIO" });
+      throw Object.assign(new Error("simulated owner index write failure"), {
+        code: "EIO",
+      });
     };
-    await assert.rejects(store.create(input), (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO");
+    await assert.rejects(
+      store.create(input),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO",
+    );
     inspected.writeOwnerIndex = writeOwnerIndex;
     assert.equal((await lstat(firstGrantPath)).isFile(), true);
-    assert.equal((await store.listForOwner(input.namespace, input.principal)).length, 100);
+    assert.equal(
+      (await store.listForOwner(input.namespace, input.principal)).length,
+      100,
+    );
 
     inspected.readState = async (grantId) => {
       if (grantId === first.state.grantId) {
-        throw Object.assign(new Error("simulated indexed grant read failure"), { code: "EIO" });
+        throw Object.assign(new Error("simulated indexed grant read failure"), {
+          code: "EIO",
+        });
       }
       return await readState(grantId);
     };
-    await assert.rejects(store.create(input), (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO");
+    await assert.rejects(
+      store.create(input),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO",
+    );
     inspected.readState = readState;
-    assert.equal((await store.listForOwner(input.namespace, input.principal)).length, 100);
+    assert.equal(
+      (await store.listForOwner(input.namespace, input.principal)).length,
+      100,
+    );
     const evictedGrantLocks: string[] = [];
     const lockAwareStore = store as unknown as {
-      withGrantLock<T>(grantId: string, task: (lock: { refresh(): Promise<boolean> }) => Promise<T>): Promise<T>;
+      withGrantLock<T>(
+        grantId: string,
+        task: (lock: { refresh(): Promise<boolean> }) => Promise<T>,
+      ): Promise<T>;
     };
     const withGrantLock = lockAwareStore.withGrantLock.bind(store);
     lockAwareStore.withGrantLock = async (grantId, task) => {
@@ -328,21 +442,26 @@ test("owner grant history stays bounded while an inactive link frees capacity",
     assert.equal(listed.length, 100);
     assert.equal(
       listed.some((state) => state.grantId === first.state.grantId),
-      false
+      false,
     );
     assert.equal(
       listed.some((state) => state.grantId === replacement.state.grantId),
-      true
+      true,
     );
     assert.deepEqual(evictedGrantLocks, [first.state.grantId]);
-    await assert.rejects(lstat(firstGrantPath), (error: unknown) => (error as NodeJS.ErrnoException).code === "ENOENT");
+    await assert.rejects(
+      lstat(firstGrantPath),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "ENOENT",
+    );
   } finally {
     await rm(root, { recursive: true, force: true });
   }
 });
 
 test("grant creation accepts a state write that committed before its durability error", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-state-commit-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-state-commit-"),
+  );
   try {
     const grantId = "00000000-0000-4000-8000-000000000001";
     const now = new Date("2026-08-11T12:00:00.000Z");
@@ -362,7 +481,9 @@ test("grant creation accepts a state write that committed before its durability
     const writeState = inspected.writeState.bind(store);
     inspected.writeState = async (state, requireAbsent) => {
       await writeState(state, requireAbsent);
-      throw Object.assign(new Error("simulated post-commit state error"), { code: "EIO" });
+      throw Object.assign(new Error("simulated post-commit state error"), {
+        code: "EIO",
+      });
     };
 
     const created = await store.create({
@@ -374,8 +495,10 @@ test("grant creation accepts a state write that committed before its durability
 
     assert.equal(created.state.grantId, grantId);
     assert.deepEqual(
-      (await store.listForOwner("alice", "owner:alice")).map((state) => state.grantId),
-      [grantId]
+      (await store.listForOwner("alice", "owner:alice")).map(
+        (state) => state.grantId,
+      ),
+      [grantId],
     );
     assert.deepEqual(
       directorySyncs.map((directory) => path.basename(directory)),
@@ -427,18 +550,26 @@ test("grant creation fails closed when a committed state cannot be re-synced", a
 });
 
 test("grant creation re-syncs an owner index write that committed before its durability error", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-index-commit-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-index-commit-"),
+  );
   try {
     const grantId = "00000000-0000-4000-8000-000000000001";
     const now = new Date("2026-08-11T12:00:00.000Z");
-    const store = new SupportPassportGrantStore({ memoryDir: root, makeGrantId: () => grantId, now: () => now });
+    const store = new SupportPassportGrantStore({
+      memoryDir: root,
+      makeGrantId: () => grantId,
+      now: () => now,
+    });
     const inspected = store as unknown as {
       writeOwnerIndex(ownerHash: string, grantIds: string[]): Promise<void>;
     };
     const writeOwnerIndex = inspected.writeOwnerIndex.bind(store);
     inspected.writeOwnerIndex = async (ownerHash, grantIds) => {
       await writeOwnerIndex(ownerHash, grantIds);
-      throw Object.assign(new Error("simulated post-commit index error"), { code: "EIO" });
+      throw Object.assign(new Error("simulated post-commit index error"), {
+        code: "EIO",
+      });
     };
 
     const created = await store.create({
@@ -450,8 +581,10 @@ test("grant creation re-syncs an owner index write that committed before its dur
 
     assert.equal(created.state.grantId, grantId);
     assert.deepEqual(
-      (await store.listForOwner("alice", "owner:alice")).map((state) => state.grantId),
-      [grantId]
+      (await store.listForOwner("alice", "owner:alice")).map(
+        (state) => state.grantId,
+      ),
+      [grantId],
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -514,7 +647,8 @@ test("owner grant rollover ignores a foreign derived-index entry", async () => {
     let nextGrantId = 1;
     const store = new SupportPassportGrantStore({
       memoryDir: root,
-      makeGrantId: () => `00000000-0000-4000-8000-${String(nextGrantId++).padStart(12, "0")}`,
+      makeGrantId: () =>
+        `00000000-0000-4000-8000-${String(nextGrantId++).padStart(12, "0")}`,
       now: () => now,
     });
     const common = {
@@ -524,7 +658,9 @@ test("owner grant rollover ignores a foreign derived-index entry", async () => {
     };
     const aliceGrants = [];
     for (let index = 0; index < 99; index += 1) {
-      aliceGrants.push(await store.create({ ...common, principal: "owner:alice" }));
+      aliceGrants.push(
+        await store.create({ ...common, principal: "owner:alice" }),
+      );
     }
     const bob = await store.create({ ...common, principal: "owner:bob" });
     await store.revoke({
@@ -538,12 +674,21 @@ test("owner grant rollover ignores a foreign derived-index entry", async () => {
     };
     const firstAliceGrant = aliceGrants[0];
     assert.ok(firstAliceGrant);
-    const aliceOwnerHash = inspected.ownerHash(common.namespace, firstAliceGrant.state.principalHash);
+    const aliceOwnerHash = inspected.ownerHash(
+      common.namespace,
+      firstAliceGrant.state.principalHash,
+    );
     await inspected.writeOwnerIndex(aliceOwnerHash, [
       ...aliceGrants.map((grant) => grant.state.grantId),
       bob.state.grantId,
     ]);
-    const bobGrantPath = path.join(root, "state", "support-passport", "grants", `${bob.state.grantId}.json`);
+    const bobGrantPath = path.join(
+      root,
+      "state",
+      "support-passport",
+      "grants",
+      `${bob.state.grantId}.json`,
+    );
 
     const replacement = await store.create({ ...common, principal: "owner:alice" });
 
@@ -556,7 +701,9 @@ test("owner grant rollover ignores a foreign derived-index entry", async () => {
 });
 
 test("owner grant history uses one expiry cutoff while it prunes old links", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-cutoff-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-cutoff-"),
+  );
   try {
     const initialTime = Date.parse("2026-08-11T12:00:00.000Z");
     let currentTime = initialTime;
@@ -565,10 +712,13 @@ test("owner grant history uses one expiry cutoff while it prunes old links", asy
     let nextGrantId = 1;
     const store = new SupportPassportGrantStore({
       memoryDir: root,
-      makeGrantId: () => `00000000-0000-4000-8000-${String(nextGrantId++).padStart(12, "0")}`,
+      makeGrantId: () =>
+        `00000000-0000-4000-8000-${String(nextGrantId++).padStart(12, "0")}`,
       now: () => {
         partitionCalls += 1;
-        return new Date(currentTime + (crossExpiry && partitionCalls > 101 ? 1 : 0));
+        return new Date(
+          currentTime + (crossExpiry && partitionCalls > 101 ? 1 : 0),
+        );
       },
     });
     const common = {
@@ -610,11 +760,11 @@ test("owner grant history uses one expiry cutoff while it prunes old links", asy
     assert.equal(new Set(listed.map((state) => state.grantId)).size, 100);
     assert.equal(
       listed.some((state) => state.grantId === crossing.state.grantId),
-      true
+      true,
     );
     assert.equal(
       listed.some((state) => state.grantId === created.state.grantId),
-      true
+      true,
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -626,7 +776,10 @@ test("grant mutations report a storage conflict when the file lock is busy", asy
   try {
     const now = new Date("2026-08-11T12:00:00.000Z");
     const rejectLock = (async (_lockPath, _options, task) =>
-      await task(false, { refresh: async () => false, failure: "timeout" })) as typeof withHeldFileLock;
+      await task(false, {
+        refresh: async () => false,
+        failure: "timeout",
+      })) as typeof withHeldFileLock;
     const store = new SupportPassportGrantStore({
       memoryDir: root,
       now: () => now,
@@ -641,7 +794,9 @@ test("grant mutations report a storage conflict when the file lock is busy", asy
         expiresAt: new Date(now.getTime() + 300_000).toISOString(),
       }),
       (error: unknown) =>
-        error instanceof SupportPassportError && error.code === "storage_conflict" && error.status === 409
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict" &&
+        error.status === 409,
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -652,7 +807,9 @@ test("grant creation rechecks the owner lock immediately before commit", async (
   const subject = await makeSubject();
   try {
     const card = await createActiveCard(subject);
-    const originalRead = subject.aliceStorage.readAllMemories.bind(subject.aliceStorage);
+    const originalRead = subject.aliceStorage.readAllMemories.bind(
+      subject.aliceStorage,
+    );
     let replacedLock = false;
     subject.aliceStorage.readAllMemories = async (...args) => {
       const memories = await originalRead(...args);
@@ -662,7 +819,10 @@ test("grant creation rechecks the owner lock immediately before commit", async (
           namespace: "alice",
           principal: "owner:alice",
         });
-        await writeFile(lockPath, `${process.pid} 00000000-0000-4000-8000-000000000000 peer\n`);
+        await writeFile(
+          lockPath,
+          `${process.pid} 00000000-0000-4000-8000-000000000000 peer\n`,
+        );
       }
       return memories;
     };
@@ -674,9 +834,53 @@ test("grant creation rechecks the owner lock immediately before commit", async (
         expiresAt: expiryAfter(subject, 300_000),
       }),
       (error: unknown) =>
-        error instanceof SupportPassportError && error.code === "storage_conflict" && error.status === 409
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict" &&
+        error.status === 409,
+    );
+    assert.deepEqual(
+      await subject.grantService.listGrants({ principal: "owner:alice" }),
+      [],
+    );
+  } finally {
+    await subject.cleanup();
+  }
+});
+
+test("grant creation does not report a commit before owner indexing completes", async () => {
+  const subject = await makeSubject();
+  try {
+    const active = await createActiveCard(subject);
+    const inspected = subject.grantStore as unknown as {
+      addToOwnerIndex(): Promise<void>;
+    };
+    inspected.addToOwnerIndex = async () => {
+      throw new Error("simulated owner index failure");
+    };
+    let committed = 0;
+
+    await assert.rejects(
+      subject.grantService.createGrant(
+        {
+          principal: "owner:alice",
+          cards: [{ cardId: active.cardId, revision: active.revision }],
+          expiresAt: new Date(
+            subject.now().getTime() + 3_600_000,
+          ).toISOString(),
+        },
+        {
+          onCommitted: () => {
+            committed += 1;
+          },
+        },
+      ),
+      /simulated owner index failure/,
+    );
+    assert.equal(committed, 0);
+    assert.deepEqual(
+      await subject.grantService.listGrants({ principal: "owner:alice" }),
+      [],
     );
-    assert.deepEqual(await subject.grantService.listGrants({ principal: "owner:alice" }), []);
   } finally {
     await subject.cleanup();
   }
@@ -798,7 +1002,9 @@ test("grant creation measures its minimum lifetime from request receipt", async
   try {
     const card = await createActiveCard(subject);
     const expiresAt = expiryAfter(subject, 300_000);
-    const readAllMemories = subject.aliceStorage.readAllMemories.bind(subject.aliceStorage);
+    const readAllMemories = subject.aliceStorage.readAllMemories.bind(
+      subject.aliceStorage,
+    );
     let delayed = false;
     subject.aliceStorage.readAllMemories = async (...args) => {
       const memories = await readAllMemories(...args);
@@ -883,19 +1089,25 @@ test("directory sync ignores only explicit unsupported errors", async () => {
 
   await assert.rejects(
     syncDirectoryForDurability("/unused", failingOpen("EIO")),
-    (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO"
+    (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO",
   );
   await syncDirectoryForDurability("/unused", failingOpen("EINVAL"));
 });
 
 test("grant creation aborts before replacing an owner index after lock ownership is lost", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-lock-loss-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-lock-loss-"),
+  );
   try {
-    const grantIds = ["00000000-0000-4000-8000-000000000001", "00000000-0000-4000-8000-000000000002"];
+    const grantIds = [
+      "00000000-0000-4000-8000-000000000001",
+      "00000000-0000-4000-8000-000000000002",
+    ];
     const now = new Date("2026-08-11T12:00:00.000Z");
     const store = new SupportPassportGrantStore({
       memoryDir: root,
-      makeGrantId: () => grantIds.shift() ?? "00000000-0000-4000-8000-000000000003",
+      makeGrantId: () =>
+        grantIds.shift() ?? "00000000-0000-4000-8000-000000000003",
       now: () => now,
     });
     const input = {
@@ -907,7 +1119,9 @@ test("grant creation aborts before replacing an owner index after lock ownership
     const first = await store.create(input);
     let refreshes = 0;
     const inspected = store as unknown as {
-      withMutationLock<T>(task: (lock: { refresh(): Promise<boolean> }) => Promise<T>): Promise<T>;
+      withMutationLock<T>(
+        task: (lock: { refresh(): Promise<boolean> }) => Promise<T>,
+      ): Promise<T>;
     };
     inspected.withMutationLock = async (task) =>
       await task({
@@ -919,12 +1133,16 @@ test("grant creation aborts before replacing an owner index after lock ownership
 
     await assert.rejects(
       store.create(input),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "storage_conflict"
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict",
     );
     assert.equal(refreshes, 2);
     assert.deepEqual(
-      (await store.listForOwner("alice", "owner:alice")).map((state) => state.grantId),
-      [first.state.grantId]
+      (await store.listForOwner("alice", "owner:alice")).map(
+        (state) => state.grantId,
+      ),
+      [first.state.grantId],
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -1332,13 +1550,20 @@ test("one owner's index transaction does not block another owner", async () => {
 });
 
 test("grant creation rechecks its mutation lock after the commit callback", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-callback-lock-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-callback-lock-"),
+  );
   try {
     const now = new Date("2026-08-11T12:00:00.000Z");
-    const store = new SupportPassportGrantStore({ memoryDir: root, now: () => now });
+    const store = new SupportPassportGrantStore({
+      memoryDir: root,
+      now: () => now,
+    });
     let refreshes = 0;
     const inspected = store as unknown as {
-      withMutationLock<T>(task: (lock: { refresh(): Promise<boolean> }) => Promise<T>): Promise<T>;
+      withMutationLock<T>(
+        task: (lock: { refresh(): Promise<boolean> }) => Promise<T>,
+      ): Promise<T>;
     };
     inspected.withMutationLock = async (task) =>
       await task({
@@ -1356,9 +1581,11 @@ test("grant creation rechecks its mutation lock after the commit callback", asyn
           cards: [{ cardId: "card-1", revision: "a".repeat(64) }],
           expiresAt: new Date(now.getTime() + 300_000).toISOString(),
         },
-        async () => undefined
+        async () => undefined,
       ),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "storage_conflict"
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict",
     );
     assert.equal(refreshes, 2);
     assert.deepEqual(await readdir(path.join(root, "state", "support-passport", "grants")), ["owners"]);
@@ -1368,10 +1595,15 @@ test("grant creation rechecks its mutation lock after the commit callback", asyn
 });
 
 test("grant revocation rechecks its mutation lock after the commit callback", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-revoke-callback-lock-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-revoke-callback-lock-"),
+  );
   try {
     const now = new Date("2026-08-11T12:00:00.000Z");
-    const store = new SupportPassportGrantStore({ memoryDir: root, now: () => now });
+    const store = new SupportPassportGrantStore({
+      memoryDir: root,
+      now: () => now,
+    });
     const created = await store.create({
       namespace: "alice",
       principal: "owner:alice",
@@ -1380,7 +1612,10 @@ test("grant revocation rechecks its mutation lock after the commit callback", as
     });
     let refreshes = 0;
     const inspected = store as unknown as {
-      withGrantLock<T>(grantId: string, task: (lock: { refresh(): Promise<boolean> }) => Promise<T>): Promise<T>;
+      withGrantLock<T>(
+        grantId: string,
+        task: (lock: { refresh(): Promise<boolean> }) => Promise<T>,
+      ): Promise<T>;
     };
     inspected.withGrantLock = async (_grantId, task) =>
       await task({
@@ -1392,13 +1627,23 @@ test("grant revocation rechecks its mutation lock after the commit callback", as
 
     await assert.rejects(
       store.revoke(
-        { grantId: created.state.grantId, namespace: "alice", principal: "owner:alice" },
-        async () => undefined
+        {
+          grantId: created.state.grantId,
+          namespace: "alice",
+          principal: "owner:alice",
+        },
+        { beforeCommit: async () => undefined },
       ),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "storage_conflict"
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict",
     );
     assert.equal(refreshes, 2);
-    assert.equal((await store.authenticate(created.state.grantId, created.secret)).revokedAt, undefined);
+    assert.equal(
+      (await store.authenticate(created.state.grantId, created.secret))
+        .revokedAt,
+      undefined,
+    );
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -1439,7 +1684,9 @@ test("a helper sees only the selected active card through a valid secret", async
 
 test("grants reject cards owned by another namespace in shared storage", async () => {
   StorageManager.clearAllStaticCaches();
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-card-scope-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-card-scope-"),
+  );
   try {
     const storage = new StorageManager(path.join(root, "shared-storage"));
     await storage.ensureDirectories();
@@ -1450,7 +1697,10 @@ test("grants reject cards owned by another namespace in shared storage", async (
       storage,
     });
     const cardService = new SupportPassportCardService({ resolveOwner, now });
-    const grantStore = new SupportPassportGrantStore({ memoryDir: path.join(root, "grants"), now });
+    const grantStore = new SupportPassportGrantStore({
+      memoryDir: path.join(root, "grants"),
+      now,
+    });
     const grantService = new SupportPassportGrantService({
       grantStore,
       resolveOwner,
@@ -1476,7 +1726,9 @@ test("grants reject cards owned by another namespace in shared storage", async (
         cards: [{ cardId: aliceCard.cardId, revision: aliceCard.revision }],
         expiresAt: "2026-08-11T13:00:00.000Z",
       }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "invalid_card_status"
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "invalid_card_status",
     );
     const forged = await grantStore.create({
       namespace: "bob",
@@ -1485,8 +1737,12 @@ test("grants reject cards owned by another namespace in shared storage", async (
       expiresAt: "2026-08-11T13:00:00.000Z",
     });
     await assert.rejects(
-      grantService.readGrant({ grantId: forged.state.grantId, secret: forged.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_stale"
+      grantService.readGrant({
+        grantId: forged.state.grantId,
+        secret: forged.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "grant_stale",
     );
   } finally {
     StorageManager.clearAllStaticCaches();
@@ -1496,14 +1752,23 @@ test("grants reject cards owned by another namespace in shared storage", async (
 
 test("grants reject cards owned by another principal inside a shared namespace", async () => {
   StorageManager.clearAllStaticCaches();
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-owner-scope-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-owner-scope-"),
+  );
   try {
     const storage = new StorageManager(path.join(root, "shared-storage"));
     await storage.ensureDirectories();
     const now = () => new Date("2026-08-11T12:00:00.000Z");
-    const resolveOwner = async (principal: string) => ({ principal, namespace: "team", storage });
+    const resolveOwner = async (principal: string) => ({
+      principal,
+      namespace: "team",
+      storage,
+    });
     const cardService = new SupportPassportCardService({ resolveOwner, now });
-    const grantStore = new SupportPassportGrantStore({ memoryDir: path.join(root, "grants"), now });
+    const grantStore = new SupportPassportGrantStore({
+      memoryDir: path.join(root, "grants"),
+      now,
+    });
     const grantService = new SupportPassportGrantService({
       grantStore,
       resolveOwner,
@@ -1529,7 +1794,9 @@ test("grants reject cards owned by another principal inside a shared namespace",
         cards: [{ cardId: aliceCard.cardId, revision: aliceCard.revision }],
         expiresAt: "2026-08-11T13:00:00.000Z",
       }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "invalid_card_status"
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "invalid_card_status",
     );
     const forged = await grantStore.create({
       namespace: "team",
@@ -1538,8 +1805,12 @@ test("grants reject cards owned by another principal inside a shared namespace",
       expiresAt: "2026-08-11T13:00:00.000Z",
     });
     await assert.rejects(
-      grantService.readGrant({ grantId: forged.state.grantId, secret: forged.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_stale"
+      grantService.readGrant({
+        grantId: forged.state.grantId,
+        secret: forged.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "grant_stale",
     );
   } finally {
     StorageManager.clearAllStaticCaches();
@@ -1581,6 +1852,10 @@ test("helper snapshots ignore colliding card IDs from other owners and reject ow
       expiresAt: "2026-08-11T13:00:00.000Z",
     });
     const originalMemories = await storage.readAllMemories();
+    const getCorpusScanVersion = storage.getCorpusScanVersion.bind(storage);
+    let testCorpusVersion = 0;
+    storage.getCorpusScanVersion = () =>
+      `${getCorpusScanVersion()}:test-${testCorpusVersion}`;
     const aliceMemory = originalMemories.find((memory) => memory.frontmatter.id === card.cardId);
     assert.ok(aliceMemory);
     const foreignCollision = {
@@ -1607,6 +1882,7 @@ test("helper snapshots ignore colliding card IDs from other owners and reject ow
       path: path.join(storage.dir, "preferences", "owned-duplicate.md"),
     };
     storage.readAllMemories = async () => [...originalMemories, foreignCollision, ownedDuplicate];
+    testCorpusVersion += 1;
     await assert.rejects(
       grantService.readGrant({ grantId: created.grant.grantId, secret: created.secret }),
       (error: unknown) => error instanceof SupportPassportError && error.code === "card_data_invalid",
@@ -1621,7 +1897,9 @@ test("grant creation and card withdrawal cannot interleave", async () => {
   const subject = await makeSubject();
   try {
     const card = await createActiveCard(subject);
-    const readAllMemories = subject.aliceStorage.readAllMemories.bind(subject.aliceStorage);
+    const readAllMemories = subject.aliceStorage.readAllMemories.bind(
+      subject.aliceStorage,
+    );
     let releaseRead!: () => void;
     let markReadStarted!: () => void;
     const readStarted = new Promise<void>((resolve) => {
@@ -1681,9 +1959,14 @@ test("bad secrets return not found, while valid revoked and expired grants revea
     });
 
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: created.grant.grantId, secret: "x".repeat(43) }),
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: "x".repeat(43),
+      }),
       (error: unknown) =>
-        error instanceof SupportPassportError && error.code === "grant_not_found" && error.status === 404
+        error instanceof SupportPassportError &&
+        error.code === "grant_not_found" &&
+        error.status === 404,
     );
 
     await assert.rejects(
@@ -1694,10 +1977,15 @@ test("bad secrets return not found, while valid revoked and expired grants revea
         expectedStateVersion: created.grant.stateVersion + 1,
       }),
       (error: unknown) =>
-        error instanceof SupportPassportError && error.code === "state_conflict" && error.status === 409
+        error instanceof SupportPassportError &&
+        error.code === "state_conflict" &&
+        error.status === 409,
     );
 
-    const peerStore = new SupportPassportGrantStore({ memoryDir: path.join(subject.root, "shared"), now: subject.now });
+    const peerStore = new SupportPassportGrantStore({
+      memoryDir: path.join(subject.root, "shared"),
+      now: subject.now,
+    });
     const peerRevoked = await peerStore.revoke({
       namespace: "alice",
       principal: "owner:alice",
@@ -1713,8 +2001,14 @@ test("bad secrets return not found, while valid revoked and expired grants revea
     assert.equal(repeated.stateVersion, peerRevoked.stateVersion);
     assert.equal(repeated.revokedAt, peerRevoked.revokedAt);
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: created.grant.grantId, secret: created.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_gone" && error.status === 410
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: created.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "grant_gone" &&
+        error.status === 410,
     );
 
     const second = await subject.grantService.createGrant({
@@ -1724,9 +2018,14 @@ test("bad secrets return not found, while valid revoked and expired grants revea
     });
     subject.advance(300_000);
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: second.grant.grantId, secret: second.secret }),
+      subject.grantService.readGrant({
+        grantId: second.grant.grantId,
+        secret: second.secret,
+      }),
       (error: unknown) =>
-        error instanceof SupportPassportError && error.code === "grant_expired" && error.status === 410
+        error instanceof SupportPassportError &&
+        error.code === "grant_expired" &&
+        error.status === 410,
     );
   } finally {
     await subject.cleanup();
@@ -1742,20 +2041,26 @@ test("a grant that expires during guide assembly does not return a guide", async
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 300_000),
     });
-    const readAllMemories = subject.aliceStorage.readAllMemories.bind(subject.aliceStorage);
+    const authenticate = subject.grantStore.authenticate.bind(
+      subject.grantStore,
+    );
     let advanced = false;
-    subject.aliceStorage.readAllMemories = async (...args) => {
-      const memories = await readAllMemories(...args);
+    subject.grantStore.authenticate = async (grantId, secret) => {
+      const state = await authenticate(grantId, secret);
       if (!advanced) {
         advanced = true;
         subject.advance(300_000);
       }
-      return memories;
+      return state;
     };
 
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: created.grant.grantId, secret: created.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_expired"
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: created.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "grant_expired",
     );
   } finally {
     await subject.cleanup();
@@ -1773,17 +2078,22 @@ test("revocation wins while an optimistic helper card read is still pending", as
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 3_600_000),
     });
-    const peerStore = new SupportPassportGrantStore({ memoryDir: path.join(subject.root, "shared"), now: subject.now });
-    const readAllMemories = subject.aliceStorage.readAllMemories.bind(subject.aliceStorage);
-    let paused = false;
-    subject.aliceStorage.readAllMemories = async (...args) => {
-      const memories = await readAllMemories(...args);
-      if (!paused) {
-        paused = true;
+    const peerStore = new SupportPassportGrantStore({
+      memoryDir: path.join(subject.root, "shared"),
+      now: subject.now,
+    });
+    const authenticate = subject.grantStore.authenticate.bind(
+      subject.grantStore,
+    );
+    let authentications = 0;
+    subject.grantStore.authenticate = async (grantId, secret) => {
+      const state = await authenticate(grantId, secret);
+      authentications += 1;
+      if (authentications === 1) {
         cardReadStarted.resolve();
         await releaseCardRead.promise;
       }
-      return memories;
+      return state;
     };
 
     const readPromise = subject.grantService.readGrant({
@@ -1802,7 +2112,8 @@ test("revocation wins while an optimistic helper card read is still pending", as
     releaseCardRead.resolve();
     await assert.rejects(
       readPromise,
-      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_gone"
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "grant_gone",
     );
   } finally {
     releaseCardRead.resolve();
@@ -1827,7 +2138,9 @@ test("helper reads for different grants do not block each other", async () => {
       expiresAt: expiryAfter(subject, 3_600_000),
     });
     const firstStarted = Promise.withResolvers<void>();
-    const authenticate = subject.grantStore.authenticate.bind(subject.grantStore);
+    const authenticate = subject.grantStore.authenticate.bind(
+      subject.grantStore,
+    );
     subject.grantStore.authenticate = async (grantId, secret) => {
       const state = await authenticate(grantId, secret);
       if (grantId === first.grant.grantId) {
@@ -1836,7 +2149,10 @@ test("helper reads for different grants do not block each other", async () => {
       }
       return state;
     };
-    const firstRead = subject.grantService.readGrant({ grantId: first.grant.grantId, secret: first.secret });
+    const firstRead = subject.grantService.readGrant({
+      grantId: first.grant.grantId,
+      secret: first.secret,
+    });
     await firstStarted.promise;
     const secondGuide = await subject.grantService.readGrant({
       grantId: second.grant.grantId,
@@ -1877,7 +2193,7 @@ test("helper guide snapshots reuse selected cards from the corpus snapshot", asy
 
     assert.deepEqual(
       guide.cards.map((card) => card.cardId),
-      [firstCard.cardId, secondCard.cardId]
+      [firstCard.cardId, secondCard.cardId],
     );
   } finally {
     await subject.cleanup();
@@ -1895,7 +2211,9 @@ test("final helper guide assembly blocks card withdrawal", async () => {
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 3_600_000),
     });
-    const authenticate = subject.grantStore.authenticate.bind(subject.grantStore);
+    const authenticate = subject.grantStore.authenticate.bind(
+      subject.grantStore,
+    );
     let authentications = 0;
     subject.grantStore.authenticate = async (grantId, secret) => {
       const state = await authenticate(grantId, secret);
@@ -1947,7 +2265,9 @@ test("final helper guide assembly blocks owner revocation", async () => {
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 3_600_000),
     });
-    const authenticate = subject.grantStore.authenticate.bind(subject.grantStore);
+    const authenticate = subject.grantStore.authenticate.bind(
+      subject.grantStore,
+    );
     let authentications = 0;
     subject.grantStore.authenticate = async (grantId, secret) => {
       const state = await authenticate(grantId, secret);
@@ -1997,7 +2317,9 @@ test("helper guide assembly fails when owner-lock ownership is lost", async () =
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 3_600_000),
     });
-    const authenticate = subject.grantStore.authenticate.bind(subject.grantStore);
+    const authenticate = subject.grantStore.authenticate.bind(
+      subject.grantStore,
+    );
     let authentications = 0;
     subject.grantStore.authenticate = async (grantId, secret) => {
       const state = await authenticate(grantId, secret);
@@ -2007,14 +2329,22 @@ test("helper guide assembly fails when owner-lock ownership is lost", async () =
           namespace: "alice",
           principal: "owner:alice",
         });
-        await writeFile(lockPath, `${process.pid} 00000000-0000-4000-8000-000000000000 peer\n`);
+        await writeFile(
+          lockPath,
+          `${process.pid} 00000000-0000-4000-8000-000000000000 peer\n`,
+        );
       }
       return state;
     };
 
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: created.grant.grantId, secret: created.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "storage_conflict"
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: created.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict",
     );
   } finally {
     await subject.cleanup();
@@ -2030,7 +2360,9 @@ test("helper guide assembly rechecks the owner lock after grant reauthentication
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 3_600_000),
     });
-    const authenticate = subject.grantStore.authenticate.bind(subject.grantStore);
+    const authenticate = subject.grantStore.authenticate.bind(
+      subject.grantStore,
+    );
     let authentications = 0;
     subject.grantStore.authenticate = async (grantId, secret) => {
       const state = await authenticate(grantId, secret);
@@ -2040,14 +2372,22 @@ test("helper guide assembly rechecks the owner lock after grant reauthentication
           namespace: "alice",
           principal: "owner:alice",
         });
-        await writeFile(lockPath, `${process.pid} 00000000-0000-4000-8000-000000000000 peer\n`);
+        await writeFile(
+          lockPath,
+          `${process.pid} 00000000-0000-4000-8000-000000000000 peer\n`,
+        );
       }
       return state;
     };
 
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: created.grant.grantId, secret: created.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "storage_conflict"
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: created.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict",
     );
     assert.equal(authentications, 3);
   } finally {
@@ -2064,7 +2404,14 @@ test("helper guide assembly refreshes the owner lock after its final snapshot re
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 3_600_000),
     });
-    const readAllMemories = subject.aliceStorage.readAllMemories.bind(subject.aliceStorage);
+    await subject.aliceStorage.writeMemory(
+      "fact",
+      "An unrelated memory invalidates the cached card snapshot.",
+      { source: "support-passport-test" },
+    );
+    const readAllMemories = subject.aliceStorage.readAllMemories.bind(
+      subject.aliceStorage,
+    );
     let reads = 0;
     subject.aliceStorage.readAllMemories = async (...args) => {
       const memories = await readAllMemories(...args);
@@ -2074,14 +2421,22 @@ test("helper guide assembly refreshes the owner lock after its final snapshot re
           namespace: "alice",
           principal: "owner:alice",
         });
-        await writeFile(lockPath, `${process.pid} 00000000-0000-4000-8000-000000000000 peer\n`);
+        await writeFile(
+          lockPath,
+          `${process.pid} 00000000-0000-4000-8000-000000000000 peer\n`,
+        );
       }
       return memories;
     };
 
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: created.grant.grantId, secret: created.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "storage_conflict"
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: created.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict",
     );
     assert.equal(reads, 1);
   } finally {
@@ -2098,16 +2453,26 @@ test("helper guide assembly rechecks expiry after its final owner-lock refresh",
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 300_000),
     });
-    const withAuthenticatedGrant = subject.grantStore.withAuthenticatedGrant.bind(subject.grantStore);
-    subject.grantStore.withAuthenticatedGrant = async (grantId, secret, task, beforeReturn) =>
+    const withAuthenticatedGrant =
+      subject.grantStore.withAuthenticatedGrant.bind(subject.grantStore);
+    subject.grantStore.withAuthenticatedGrant = async (
+      grantId,
+      secret,
+      task,
+      beforeReturn,
+    ) =>
       await withAuthenticatedGrant(grantId, secret, task, async (state) => {
         subject.advance(300_000);
         await beforeReturn?.(state);
       });
 
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: created.grant.grantId, secret: created.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_expired"
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: created.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "grant_expired",
     );
   } finally {
     await subject.cleanup();
@@ -2134,8 +2499,89 @@ test("a changed card makes the whole grant stale without a partial guide", async
     });
 
     await assert.rejects(
-      subject.grantService.readGrant({ grantId: created.grant.grantId, secret: created.secret }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_stale" && error.status === 410
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: created.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "grant_stale" &&
+        error.status === 410,
+    );
+  } finally {
+    await subject.cleanup();
+  }
+});
+
+test("an active replacement makes predecessor shares stale before retirement finishes", async () => {
+  const subject = await makeSubject();
+  try {
+    const active = await createActiveCard(subject, "Plan changes");
+    const created = await subject.grantService.createGrant({
+      principal: "owner:alice",
+      cards: [{ cardId: active.cardId, revision: active.revision }],
+      expiresAt: expiryAfter(subject, 3_600_000),
+    });
+    const replacement = await subject.cardService.replaceCard({
+      principal: "owner:alice",
+      cardId: active.cardId,
+      expectedRevision: active.revision,
+      title: "Plan changes",
+      statement: "Tell me early when plans change.",
+      category: "transitions",
+      reviewBy: "2026-09-01T12:00:00.000Z",
+    });
+    const writeFrontmatter =
+      subject.aliceStorage.writeMemoryFrontmatterIfUnchanged.bind(
+        subject.aliceStorage,
+      );
+    subject.aliceStorage.writeMemoryFrontmatterIfUnchanged = async (
+      memory,
+      patch,
+      lifecycle,
+    ) => {
+      if (lifecycle?.reasonCode === "support-passport-replacement-pending") {
+        throw new Error("simulated interruption before predecessor retirement");
+      }
+      return await writeFrontmatter(memory, patch, lifecycle);
+    };
+    const approved = await subject.cardService.approveCard({
+      principal: "owner:alice",
+      cardId: replacement.cardId,
+      expectedRevision: replacement.revision,
+    });
+
+    await assert.rejects(
+      subject.grantService.readGrant({
+        grantId: created.grant.grantId,
+        secret: created.secret,
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "grant_stale",
+    );
+    await assert.rejects(
+      subject.grantService.createGrant({
+        principal: "owner:alice",
+        cards: [{ cardId: active.cardId, revision: active.revision }],
+        expiresAt: expiryAfter(subject, 3_600_000),
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "invalid_card_status",
+    );
+    const replacementGrant = await subject.grantService.createGrant({
+      principal: "owner:alice",
+      cards: [{ cardId: approved.cardId, revision: approved.revision }],
+      expiresAt: expiryAfter(subject, 3_600_000),
+    });
+    assert.equal(
+      (
+        await subject.grantService.readGrant({
+          grantId: replacementGrant.grant.grantId,
+          secret: replacementGrant.secret,
+        })
+      ).cards[0]?.cardId,
+      approved.cardId,
     );
   } finally {
     await subject.cleanup();
@@ -2183,15 +2629,21 @@ test("unrelated memory writes do not invalidate an unchanged shared guide", asyn
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 3_600_000),
     });
-    const readAllMemories = subject.aliceStorage.readAllMemories.bind(subject.aliceStorage);
+    const readAllMemories = subject.aliceStorage.readAllMemories.bind(
+      subject.aliceStorage,
+    );
     let wroteUnrelated = false;
     subject.aliceStorage.readAllMemories = async (...args) => {
       const memories = await readAllMemories(...args);
       if (!wroteUnrelated) {
         wroteUnrelated = true;
-        await subject.aliceStorage.writeMemory("fact", "An unrelated memory write.", {
-          source: "support-passport-test",
-        });
+        await subject.aliceStorage.writeMemory(
+          "fact",
+          "An unrelated memory write.",
+          {
+            source: "support-passport-test",
+          },
+        );
       }
       return memories;
     };
@@ -2207,7 +2659,7 @@ test("unrelated memory writes do not invalidate an unchanged shared guide", asyn
   }
 });
 
-test("one unchanged guide read validates a fresh final corpus snapshot", async () => {
+test("one unchanged guide read reuses one fresh corpus snapshot", async () => {
   const subject = await makeSubject();
   try {
     const card = await createActiveCard(subject);
@@ -2216,7 +2668,14 @@ test("one unchanged guide read validates a fresh final corpus snapshot", async (
       cards: [{ cardId: card.cardId, revision: card.revision }],
       expiresAt: expiryAfter(subject, 3_600_000),
     });
-    const readAllMemories = subject.aliceStorage.readAllMemories.bind(subject.aliceStorage);
+    await subject.aliceStorage.writeMemory(
+      "fact",
+      "An unrelated memory invalidates the cached card snapshot.",
+      { source: "support-passport-test" },
+    );
+    const readAllMemories = subject.aliceStorage.readAllMemories.bind(
+      subject.aliceStorage,
+    );
     let corpusReads = 0;
     subject.aliceStorage.readAllMemories = async (...args) => {
       corpusReads += 1;
@@ -2232,7 +2691,7 @@ test("one unchanged guide read validates a fresh final corpus snapshot", async (
     });
 
     assert.equal(guide.cards[0]?.cardId, card.cardId);
-    assert.equal(corpusReads, 2);
+    assert.equal(corpusReads, 1);
   } finally {
     await subject.cleanup();
   }
@@ -2248,9 +2707,12 @@ test("grant creation rejects an approved card with an invalid update timestamp",
       await subject.aliceStorage.writeMemoryFrontmatterIfUnchanged(memory, {
         updated: "2026-08-11T12:00:00+99:99",
       }),
-      true
+      true,
+    );
+    assert.deepEqual(
+      await subject.cardService.listCards({ principal: "owner:alice" }),
+      [],
     );
-    assert.deepEqual(await subject.cardService.listCards({ principal: "owner:alice" }), []);
 
     await assert.rejects(
       subject.grantService.createGrant({
@@ -2258,9 +2720,14 @@ test("grant creation rejects an approved card with an invalid update timestamp",
         cards: [{ cardId: card.cardId, revision: card.revision }],
         expiresAt: expiryAfter(subject, 3_600_000),
       }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "invalid_card_status"
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "invalid_card_status",
+    );
+    assert.deepEqual(
+      await subject.grantService.listGrants({ principal: "owner:alice" }),
+      [],
     );
-    assert.deepEqual(await subject.grantService.listGrants({ principal: "owner:alice" }), []);
   } finally {
     await subject.cleanup();
   }
@@ -2272,25 +2739,38 @@ test("public guides compare card update timestamps as instants", async () => {
     const first = await createActiveCard(subject, "Earlier card");
     const second = await createActiveCard(subject, "Later card");
     const firstMemory = await subject.aliceStorage.getMemoryById(first.cardId);
-    const secondMemory = await subject.aliceStorage.getMemoryById(second.cardId);
+    const secondMemory = await subject.aliceStorage.getMemoryById(
+      second.cardId,
+    );
     assert.ok(firstMemory);
     assert.ok(secondMemory);
     assert.equal(
-      await subject.aliceStorage.writeMemoryFrontmatterIfUnchanged(firstMemory, {
-        updated: "2026-08-11T12:00:00+05:00",
-      }),
-      true
+      await subject.aliceStorage.writeMemoryFrontmatterIfUnchanged(
+        firstMemory,
+        {
+          updated: "2026-08-11T12:00:00+05:00",
+        },
+      ),
+      true,
     );
     assert.equal(
-      await subject.aliceStorage.writeMemoryFrontmatterIfUnchanged(secondMemory, {
-        updated: "2026-08-11T10:00:00Z",
-      }),
-      true
+      await subject.aliceStorage.writeMemoryFrontmatterIfUnchanged(
+        secondMemory,
+        {
+          updated: "2026-08-11T10:00:00Z",
+        },
+      ),
+      true,
     );
-    const cards = await subject.cardService.listCards({ principal: "owner:alice" });
+    const cards = await subject.cardService.listCards({
+      principal: "owner:alice",
+    });
     const created = await subject.grantService.createGrant({
       principal: "owner:alice",
-      cards: cards.map((card) => ({ cardId: card.cardId, revision: card.revision })),
+      cards: cards.map((card) => ({
+        cardId: card.cardId,
+        revision: card.revision,
+      })),
       expiresAt: expiryAfter(subject, 3_600_000),
     });
 
@@ -2318,7 +2798,10 @@ test("grant creation rejects drafts, duplicate cards, and unsafe durations", asy
     const active = await createActiveCard(subject);
 
     for (const input of [
-      { cards: [{ cardId: draft.cardId, revision: draft.revision }], expiresAt: expiryAfter(subject, 3_600_000) },
+      {
+        cards: [{ cardId: draft.cardId, revision: draft.revision }],
+        expiresAt: expiryAfter(subject, 3_600_000),
+      },
       {
         cards: [
           { cardId: active.cardId, revision: active.revision },
@@ -2326,7 +2809,10 @@ test("grant creation rejects drafts, duplicate cards, and unsafe durations", asy
         ],
         expiresAt: expiryAfter(subject, 3_600_000),
       },
-      { cards: [{ cardId: active.cardId, revision: active.revision }], expiresAt: expiryAfter(subject, 299_999) },
+      {
+        cards: [{ cardId: active.cardId, revision: active.revision }],
+        expiresAt: expiryAfter(subject, 299_999),
+      },
       {
         cards: [{ cardId: active.cardId, revision: active.revision }],
         expiresAt: expiryAfter(subject, 604_800_001),
@@ -2337,8 +2823,11 @@ test("grant creation rejects drafts, duplicate cards, and unsafe durations", asy
       },
     ]) {
       await assert.rejects(
-        subject.grantService.createGrant({ principal: "owner:alice", ...input }),
-        (error: unknown) => error instanceof SupportPassportError
+        subject.grantService.createGrant({
+          principal: "owner:alice",
+          ...input,
+        }),
+        (error: unknown) => error instanceof SupportPassportError,
       );
     }
   } finally {
@@ -2351,9 +2840,14 @@ test("the grant store rejects a symlinked grant directory", async () => {
   try {
     const memoryDir = path.join(root, "memory");
     const outside = path.join(root, "outside");
-    await mkdir(path.join(memoryDir, "state", "support-passport"), { recursive: true });
+    await mkdir(path.join(memoryDir, "state", "support-passport"), {
+      recursive: true,
+    });
     await mkdir(outside);
-    await symlink(outside, path.join(memoryDir, "state", "support-passport", "grants"));
+    await symlink(
+      outside,
+      path.join(memoryDir, "state", "support-passport", "grants"),
+    );
     const now = new Date("2026-08-11T12:00:00.000Z");
     const store = new SupportPassportGrantStore({ memoryDir, now: () => now });
 
@@ -2364,7 +2858,7 @@ test("the grant store rejects a symlinked grant directory", async () => {
         cards: [{ cardId: "card-1", revision: "a".repeat(64) }],
         expiresAt: new Date(now.getTime() + 300_000).toISOString(),
       }),
-      /must remain inside the memory directory/
+      /must remain inside the memory directory/,
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -2373,15 +2867,27 @@ test("the grant store rejects a symlinked grant directory", async () => {
 
 test("private file operations select supported directory access strategies", () => {
   assert.throws(
-    () => requirePrivateFileDescriptorRoot("win32", "private file directory cannot be pinned"),
-    /private file directory cannot be pinned/
+    () =>
+      requirePrivateFileDescriptorRoot(
+        "win32",
+        "private file directory cannot be pinned",
+      ),
+    /private file directory cannot be pinned/,
+  );
+  assert.equal(
+    requirePrivateFileDescriptorRoot("linux", "unreachable"),
+    "/proc/self/fd",
+  );
+  assert.equal(
+    requirePrivateFileDescriptorRoot("darwin", "unreachable"),
+    "/dev/fd",
   );
-  assert.equal(requirePrivateFileDescriptorRoot("linux", "unreachable"), "/proc/self/fd");
-  assert.equal(requirePrivateFileDescriptorRoot("darwin", "unreachable"), "/dev/fd");
 });
 
 test("private directory creation syncs every verified parent entry", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-private-directory-sync-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-private-directory-sync-"),
+  );
   try {
     const target = path.join(root, "state", "support-passport", "grants");
     let syncs = 0;
@@ -2389,9 +2895,19 @@ test("private directory creation syncs every verified parent entry", async () =>
       syncs += 1;
     };
 
-    await ensurePrivateDirectoryNoFollow(root, target, "private directory creation failed", syncVerifiedParent);
+    await ensurePrivateDirectoryNoFollow(
+      root,
+      target,
+      "private directory creation failed",
+      syncVerifiedParent,
+    );
     assert.equal(syncs, 3);
-    await ensurePrivateDirectoryNoFollow(root, target, "private directory creation failed", syncVerifiedParent);
+    await ensurePrivateDirectoryNoFollow(
+      root,
+      target,
+      "private directory creation failed",
+      syncVerifiedParent,
+    );
     assert.equal(syncs, 6);
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -2399,21 +2915,35 @@ test("private directory creation syncs every verified parent entry", async () =>
 });
 
 test("private directory creation retries a failed parent sync", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-private-directory-sync-retry-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-private-directory-sync-retry-"),
+  );
   try {
     const target = path.join(root, "state", "support-passport", "grants");
     await assert.rejects(
-      ensurePrivateDirectoryNoFollow(root, target, "private directory creation failed", async () => {
-        throw Object.assign(new Error("simulated directory sync failure"), { code: "EIO" });
-      }),
-      (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO"
+      ensurePrivateDirectoryNoFollow(
+        root,
+        target,
+        "private directory creation failed",
+        async () => {
+          throw Object.assign(new Error("simulated directory sync failure"), {
+            code: "EIO",
+          });
+        },
+      ),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO",
     );
     assert.equal((await lstat(path.join(root, "state"))).isDirectory(), true);
 
     let retrySyncs = 0;
-    await ensurePrivateDirectoryNoFollow(root, target, "private directory creation failed", async () => {
-      retrySyncs += 1;
-    });
+    await ensurePrivateDirectoryNoFollow(
+      root,
+      target,
+      "private directory creation failed",
+      async () => {
+        retrySyncs += 1;
+      },
+    );
     assert.equal(retrySyncs, 3);
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -2421,24 +2951,38 @@ test("private directory creation retries a failed parent sync", async () => {
 });
 
 test("private directory creation retries parent sync when rollback cannot remove the child", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-private-directory-sync-populated-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-private-directory-sync-populated-"),
+  );
   try {
     const target = path.join(root, "state");
     let failed = false;
     await assert.rejects(
-      ensurePrivateDirectoryNoFollow(root, target, "private directory creation failed", async () => {
-        if (failed) return;
-        failed = true;
-        await writeFile(path.join(target, "peer-entry"), "peer");
-        throw Object.assign(new Error("simulated directory sync failure"), { code: "EIO" });
-      }),
-      (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO"
+      ensurePrivateDirectoryNoFollow(
+        root,
+        target,
+        "private directory creation failed",
+        async () => {
+          if (failed) return;
+          failed = true;
+          await writeFile(path.join(target, "peer-entry"), "peer");
+          throw Object.assign(new Error("simulated directory sync failure"), {
+            code: "EIO",
+          });
+        },
+      ),
+      (error: unknown) => (error as NodeJS.ErrnoException).code === "EIO",
     );
 
     let retrySyncs = 0;
-    await ensurePrivateDirectoryNoFollow(root, target, "private directory creation failed", async () => {
-      retrySyncs += 1;
-    });
+    await ensurePrivateDirectoryNoFollow(
+      root,
+      target,
+      "private directory creation failed",
+      async () => {
+        retrySyncs += 1;
+      },
+    );
     assert.equal(retrySyncs, 1);
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -2469,14 +3013,20 @@ test("a failed parent sync never unlinks a directory opened by a concurrent setu
 });
 
 test("private directory tree creation syncs missing memory-root ancestors", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-private-root-sync-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-private-root-sync-"),
+  );
   try {
     const target = path.join(root, "new-parent", "memory");
     let syncs = 0;
 
-    await ensurePrivateDirectoryTreeNoFollow(target, "private directory creation failed", async () => {
-      syncs += 1;
-    });
+    await ensurePrivateDirectoryTreeNoFollow(
+      target,
+      "private directory creation failed",
+      async () => {
+        syncs += 1;
+      },
+    );
 
     const expectedSyncs = path.relative(path.parse(target).root, target).split(path.sep).filter(Boolean).length;
     assert.equal(syncs, expectedSyncs);
@@ -2504,7 +3054,9 @@ test("private directory tree ignores a read-only filesystem-root sync", async ()
 });
 
 test("private directory tree creation rejects a symlink in the ancestor chain", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-private-root-link-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-private-root-link-"),
+  );
   try {
     const outside = path.join(root, "outside");
     const linked = path.join(root, "linked");
@@ -2513,8 +3065,11 @@ test("private directory tree creation rejects a symlink in the ancestor chain",
     await symlink(outside, linked);
 
     await assert.rejects(
-      ensurePrivateDirectoryTreeNoFollow(target, "private directory creation failed"),
-      /private directory creation failed/
+      ensurePrivateDirectoryTreeNoFollow(
+        target,
+        "private directory creation failed",
+      ),
+      /private directory creation failed/,
     );
     assert.deepEqual(await readdir(outside), []);
   } finally {
@@ -2580,7 +3135,9 @@ test("Windows private-file operations fail before mutation", async () => {
 });
 
 test("grant cleanup never follows a swapped grant directory", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-cleanup-swap-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-cleanup-swap-"),
+  );
   try {
     const grantId = "00000000-0000-4000-8000-000000000001";
     const now = new Date("2026-08-11T12:00:00.000Z");
@@ -2600,15 +3157,23 @@ test("grant cleanup never follows a swapped grant directory", async () => {
     const outsideDir = path.join(root, "outside");
     const fileName = `${grantId}.json`;
     await mkdir(outsideDir);
-    await writeFile(path.join(outsideDir, fileName), "outside must remain", { mode: 0o600 });
+    await writeFile(path.join(outsideDir, fileName), "outside must remain", {
+      mode: 0o600,
+    });
     renameSync(grantsDir, parkedDir);
     symlinkSync(outsideDir, grantsDir, "dir");
     const inspected = store as unknown as {
       removeGrantStates(grantIds: string[]): Promise<void>;
     };
 
-    await assert.rejects(inspected.removeGrantStates([grantId]), /regular files in a stable directory/);
-    assert.equal(await readFile(path.join(outsideDir, fileName), "utf8"), "outside must remain");
+    await assert.rejects(
+      inspected.removeGrantStates([grantId]),
+      /regular files in a stable directory/,
+    );
+    assert.equal(
+      await readFile(path.join(outsideDir, fileName), "utf8"),
+      "outside must remain",
+    );
     assert.equal((await lstat(path.join(parkedDir, fileName))).isFile(), true);
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -2620,7 +3185,12 @@ test("grant writes reject a directory swapped after the initial safety check", a
   try {
     const memoryDir = path.join(root, "memory");
     const outside = path.join(root, "outside");
-    const grantsDir = path.join(memoryDir, "state", "support-passport", "grants");
+    const grantsDir = path.join(
+      memoryDir,
+      "state",
+      "support-passport",
+      "grants",
+    );
     const parkedDir = path.join(root, "parked-grants");
     await mkdir(outside, { recursive: true });
     const now = new Date("2026-08-11T12:00:00.000Z");
@@ -2637,12 +3207,14 @@ test("grant writes reject a directory swapped after the initial safety check", a
           cards: [{ cardId: "card-1", revision: "a".repeat(64) }],
           expiresAt: new Date(now.getTime() + 300_000).toISOString(),
         },
-        async () => {
-          renameSync(grantsDir, parkedDir);
-          symlinkSync(outside, grantsDir, "dir");
-        }
+        {
+          beforeCommit: async () => {
+            renameSync(grantsDir, parkedDir);
+            symlinkSync(outside, grantsDir, "dir");
+          },
+        },
       ),
-      /regular files in a stable directory/
+      /regular files in a stable directory/,
     );
     assert.deepEqual(await readdir(outside), []);
   } finally {
@@ -2651,7 +3223,9 @@ test("grant writes reject a directory swapped after the initial safety check", a
 });
 
 test("grant writes reject an ancestor swapped after the initial safety check", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-ancestor-swap-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-ancestor-swap-"),
+  );
   try {
     const memoryDir = path.join(root, "memory");
     const passportDir = path.join(memoryDir, "state", "support-passport");
@@ -2659,7 +3233,9 @@ test("grant writes reject an ancestor swapped after the initial safety check", a
     const outside = path.join(root, "outside-support-passport");
     await mkdir(path.join(outside, "grants", "owners"), { recursive: true });
     const acceptLock = (async (_lockPath, _options, task) =>
-      await task(true, { refresh: async () => true })) as typeof withHeldFileLock;
+      await task(true, {
+        refresh: async () => true,
+      })) as typeof withHeldFileLock;
     const now = new Date("2026-08-11T12:00:00.000Z");
     const store = new SupportPassportGrantStore({
       memoryDir,
@@ -2677,12 +3253,14 @@ test("grant writes reject an ancestor swapped after the initial safety check", a
           cards: [{ cardId: "card-1", revision: "a".repeat(64) }],
           expiresAt: new Date(now.getTime() + 300_000).toISOString(),
         },
-        async () => {
-          renameSync(passportDir, parkedDir);
-          symlinkSync(outside, passportDir, "dir");
-        }
+        {
+          beforeCommit: async () => {
+            renameSync(passportDir, parkedDir);
+            symlinkSync(outside, passportDir, "dir");
+          },
+        },
       ),
-      /regular files in a stable directory/
+      /regular files in a stable directory/,
     );
     assert.deepEqual(await readdir(path.join(outside, "grants")), ["owners"]);
   } finally {
@@ -2724,7 +3302,9 @@ test("grant reads reject a memory-root ancestor swapped after a completed operat
 });
 
 test("the grant store fails closed for corrupt and symlinked grant files", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-state-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-state-"),
+  );
   try {
     const firstGrantId = "00000000-0000-4000-8000-000000000001";
     const secondGrantId = "00000000-0000-4000-8000-000000000002";
@@ -2753,15 +3333,20 @@ test("the grant store fails closed for corrupt and symlinked grant files", async
     await writeFile(outsidePath, await readFile(linkedPath), { mode: 0o600 });
     await rm(linkedPath);
     await symlink(outsidePath, linkedPath);
-    await assert.rejects(store.authenticate(secondGrantId, linked.secret), /must be regular files/);
+    await assert.rejects(
+      store.authenticate(secondGrantId, linked.secret),
+      /must be regular files/,
+    );
     await assert.rejects(store.listForOwner("alice", "owner:alice"));
   } finally {
     await rm(root, { recursive: true, force: true });
   }
 });
 
-test("the grant store rejects a state file whose grant ID does not match its file name", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-identity-"));
+test("the grant store omits a state file whose grant ID does not match its file name", async () => {
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-identity-"),
+  );
   try {
     const firstGrantId = "00000000-0000-4000-8000-000000000001";
     const secondGrantId = "00000000-0000-4000-8000-000000000002";
@@ -2784,7 +3369,7 @@ test("the grant store rejects a state file whose grant ID does not match its fil
     await writeFile(
       path.join(grantDir, `${secondGrantId}.json`),
       await readFile(path.join(grantDir, `${firstGrantId}.json`)),
-      { mode: 0o600 }
+      { mode: 0o600 },
     );
 
     await assert.rejects(store.authenticate(secondGrantId, second.secret), /grant ID must match its file name/);
@@ -2799,11 +3384,17 @@ test("the grant store rejects a state file whose grant ID does not match its fil
 });
 
 test("the grant store rejects unsafe durations and grant ID collisions", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-collision-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-collision-"),
+  );
   try {
     const grantId = "00000000-0000-4000-8000-000000000001";
     const now = new Date("2026-08-11T12:00:00.000Z");
-    const store = new SupportPassportGrantStore({ memoryDir: root, makeGrantId: () => grantId, now: () => now });
+    const store = new SupportPassportGrantStore({
+      memoryDir: root,
+      makeGrantId: () => grantId,
+      now: () => now,
+    });
     const input = {
       namespace: "alice",
       principal: "owner:alice",
@@ -2813,11 +3404,17 @@ test("the grant store rejects unsafe durations and grant ID collisions", async (
     await store.create(input);
     await assert.rejects(
       store.create(input),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "storage_conflict"
+      (error: unknown) =>
+        error instanceof SupportPassportError &&
+        error.code === "storage_conflict",
     );
     await assert.rejects(
-      store.create({ ...input, expiresAt: new Date(now.getTime() + 299_999).toISOString() }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "invalid_input"
+      store.create({
+        ...input,
+        expiresAt: new Date(now.getTime() + 299_999).toISOString(),
+      }),
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "invalid_input",
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -2825,7 +3422,9 @@ test("the grant store rejects unsafe durations and grant ID collisions", async (
 });
 
 test("the grant store canonicalizes UUID letter case", async () => {
-  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-id-case-"));
+  const root = await mkdtemp(
+    path.join(tmpdir(), "remnic-support-grant-id-case-"),
+  );
   try {
     const uppercaseGrantId = "AAAAAAAA-AAAA-4AAA-8AAA-AAAAAAAAAAAA";
     const lowercaseGrantId = uppercaseGrantId.toLowerCase();
@@ -2843,10 +3442,19 @@ test("the grant store canonicalizes UUID letter case", async () => {
     });
 
     assert.equal(created.state.grantId, lowercaseGrantId);
-    assert.equal((await store.authenticate(uppercaseGrantId, created.secret)).grantId, lowercaseGrantId);
     assert.equal(
-      (await store.revoke({ grantId: uppercaseGrantId, namespace: "alice", principal: "owner:alice" })).grantId,
-      lowercaseGrantId
+      (await store.authenticate(uppercaseGrantId, created.secret)).grantId,
+      lowercaseGrantId,
+    );
+    assert.equal(
+      (
+        await store.revoke({
+          grantId: uppercaseGrantId,
+          namespace: "alice",
+          principal: "owner:alice",
+        })
+      ).grantId,
+      lowercaseGrantId,
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -2857,7 +3465,10 @@ test("the grant store rejects invalid calendar dates", async () => {
   const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-date-"));
   try {
     const now = new Date("2026-02-28T12:00:00.000Z");
-    const store = new SupportPassportGrantStore({ memoryDir: root, now: () => now });
+    const store = new SupportPassportGrantStore({
+      memoryDir: root,
+      now: () => now,
+    });
 
     await assert.rejects(
       store.create({
@@ -2866,7 +3477,8 @@ test("the grant store rejects invalid calendar dates", async () => {
         cards: [{ cardId: "card-1", revision: "a".repeat(64) }],
         expiresAt: "2026-02-31T12:00:00.000Z",
       }),
-      (error: unknown) => error instanceof SupportPassportError && error.code === "invalid_input"
+      (error: unknown) =>
+        error instanceof SupportPassportError && error.code === "invalid_input",
     );
   } finally {
     await rm(root, { recursive: true, force: true });
@@ -2874,7 +3486,9 @@ test("the grant store rejects invalid calendar dates", async () => {
 });
 
 test("the grant store expands a leading tilde in its memory directory", () => {
-  const store = new SupportPassportGrantStore({ memoryDir: "~/support-passport-path-test" });
+  const store = new SupportPassportGrantStore({
+    memoryDir: "~/support-passport-path-test",
+  });
   const memoryDir = (store as unknown as { memoryDir: string }).memoryDir;
   assert.equal(memoryDir.includes(`${path.sep}~${path.sep}`), false);
   assert.equal(path.basename(memoryDir), "support-passport-path-test");