@synopackageland/cli 0.4.0 → 0.4.1

package/dist/templates/native-go/backend/internal/helper/control.go

@@ -9,6 +9,7 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"syscall"
 	"time"
 )
@@ -32,6 +33,8 @@ type Processes interface {
 type Controller struct {
 	Client
 	Processes Processes
+	Observe   Observation
+	Boot      func() (string, error)
 }
 
 func waitHealthy(ctx context.Context, probe func(context.Context) bool) error {
@@ -61,7 +64,7 @@ func writeProtected(dir, name string, value any) error {
 	}
 	defer os.Remove(f.Name())
 	mode := fs.FileMode(0644)
-	if name == "process.json" {
+	if name == "observer-diagnostic.json" || name == "process.json" || strings.HasPrefix(name, "completion-") {
 		mode = 0600
 	}
 	if err := f.Chmod(mode); err != nil {
@@ -120,7 +123,7 @@ func (c Controller) Control(ctx context.Context, action string) error {
 	if ctx.Err() != nil {
 		return ctx.Err()
 	}
-	if action != "enable" && action != "recover" && action != "teardown" && action != "disable" {
+	if action != "enable" && action != "recover" && action != "teardown" && action != "disable" && action != "repair" {
 		return errors.New("unsupported lifecycle action")
 	}
 	if !c.Expected.Valid() || c.Processes == nil {
@@ -145,50 +148,252 @@ func (c Controller) Control(ctx context.Context, action string) error {
 	if err != nil && !errors.Is(err, fs.ErrNotExist) {
 		return err
 	}
-	if action == "recover" && (err != nil || !r.Enabled) {
+	if errors.Is(err, fs.ErrNotExist) {
+		r = Record{Inventory: c.Expected}
+	}
+	if action == "repair" {
+		if err != nil {
+			return err
+		}
+		return c.repair(r)
+	}
+	starting := action == "enable" || action == "recover"
+	if action == "recover" && (err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil) {
 		return errors.New("explicit enable approval required")
 	}
-	if err != nil {
-		r = Record{Inventory: c.Expected}
+	// A stopped approval referencing a completion must have the private,
+	// digest-bound proof; missing/corrupt artifacts are not completion.
+	if starting && r.Lifecycle != nil && r.Lifecycle.Completion != "" {
+		if _, e := completionRecord(c.Client, r); e != nil {
+			return e
+		}
 	}
-	if action == "disable" {
-		r.Enabled = false
+	var next *Lifecycle
+	if starting {
+		if c.Observe == nil {
+			return errTrust
+		}
+		binding, e := c.Observe(ctx, c.Expected)
+		if e != nil {
+			return e
+		}
+		if action == "recover" && (r.Lifecycle.Binding.Boot != binding.Boot || r.Lifecycle.Binding.Install != binding.Install) {
+			return errors.New("installation continuity changed; enable approval required")
+		}
+		next, err = newLifecycle(binding)
+		if err != nil {
+			return err
+		}
+		if err := createLifetime(c.Client, next); err != nil {
+			return err
+		}
 	}
-	// Publish the durable gate first. A crashed/failed disable still refuses
-	// requests and exposes required cleanup; never report cleanup as successful.
-	r.Residual = true
-	if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+	// Preserve the owned identity before fencing lets the supervisor unlink it.
+	owned, ownedErr := readProcess(c.RunDir, c.Owner)
+	// Never hold policy.lock across Stop/ACK. Autonomous fencing shares only
+	// this short lock, so a controller holding control.lock cannot deadlock it.
+	if err := policyUpdate(c.Client, func(r *Record) error {
+		if action == "disable" {
+			r.Enabled = false
+		}
+		r.Residual = true
+		if r.Lifecycle != nil && r.Lifecycle.Phase != "stopped" {
+			r.Lifecycle.Phase = "fenced"
+			r.Lifecycle.Completion = ""
+			if r.Lifecycle.Reason == "" {
+				r.Lifecycle.Reason = "admin-stop"
+			}
+		}
+		return nil
+	}); err != nil {
 		return err
 	}
-	if err := c.teardown(); err != nil {
+	if ownedErr != nil && !errors.Is(ownedErr, fs.ErrNotExist) {
+		return ownedErr
+	}
+	if err := c.teardownFor(r, owned); err != nil {
 		return err
 	}
-	if action == "enable" || action == "recover" {
-		r = Record{Inventory: c.Expected, Enabled: true, Residual: true}
-		if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
-			return err
-		}
+	if err := c.commitTeardown(r, owned, next); err != nil {
+		return err
+	}
+	if starting {
 		if err := c.Processes.Start(c.Expected); err != nil {
 			return err
 		}
+		return finalizeStart(c.Client, next.Epoch)
 	}
-	r.Residual = false
-	return writeProtected(c.StateDir, "approval.json", r)
+	return nil
+}
+
+// Keep the post-teardown policy commit separate from socket reconciliation.
+func (c Controller) commitTeardown(before Record, owned Process, next *Lifecycle) error {
+	observed, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		return err
+	}
+	if !sameTeardownEpoch(observed, before) {
+		return errTrust
+	}
+	published := ""
+	if observed.Lifecycle != nil {
+		published = observed.Lifecycle.Completion
+	}
+	// Rename makes completion visible before the owner's directory fsync and
+	// lock release. Wait only for that publisher; every other error is final.
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	last := errBusy
+	// A budget expiry keeps the last lock refusal; it never certifies success.
+	_ = waitHealthy(ctx, func(context.Context) bool {
+		last = policyUpdate(c.Client, func(r *Record) error {
+			if !sameTeardownEpoch(*r, before) || !runtimeAbsent(c.Client) {
+				return errTrust
+			}
+			if published != "" && (r.Lifecycle == nil || r.Lifecycle.Completion != published) {
+				return errTrust
+			}
+			if r.Lifecycle != nil && r.Lifecycle.Completion != "" {
+				proof, err := completionRecord(c.Client, *r)
+				if err != nil {
+					return err
+				}
+				if owned.PID > 1 {
+					if proof.Repair != nil || proof.Process != owned {
+						return errTrust
+					}
+				} else if before.Lifecycle == nil || before.Lifecycle.Phase != "stopped" {
+					return errTrust
+				}
+			}
+			if next != nil {
+				*r = Record{Inventory: c.Expected, Enabled: true, Residual: true, Lifecycle: next}
+			} else {
+				r.Residual = false
+				if r.Lifecycle != nil {
+					r.Lifecycle.Phase = "stopped"
+				}
+			}
+			return nil
+		})
+		return !errors.Is(last, errBusy)
+	})
+	return last
 }
 
 func (c Controller) teardown() error {
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	p, err := readProcess(c.RunDir, c.Owner)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	return c.teardownFor(r, p)
+}
+
+func (c Controller) teardownFor(before Record, owned Process) error {
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	if !sameTeardownEpoch(r, before) {
+		return errTrust
+	}
+	if r.Lifecycle != nil && r.Lifecycle.Completion != "" {
+		if owned.PID == 0 && before.Lifecycle != nil && before.Lifecycle.Phase != "stopped" {
+			return errTrust // no pre-fence process identity to reconcile this exit
+		}
+		if _, err := completionRecord(c.Client, r); err != nil {
+			return err
+		}
+	}
+	return c.teardownRecord(r, owned)
+}
+
+// Phase, completion and enabled/residual flags may change while the owning
+// supervisor exits; inventory, epoch, binding and optional lease must not.
+func sameTeardownEpoch(current, before Record) bool {
+	if current.Inventory != before.Inventory {
+		return false
+	}
+	a, b := current.Lifecycle, before.Lifecycle
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	if a.Epoch != b.Epoch || a.Binding != b.Binding {
+		return false
+	}
+	if a.Lease == nil || b.Lease == nil {
+		return a.Lease == nil && b.Lease == nil
+	}
+	return *a.Lease == *b.Lease
+}
+
+// Reconcile runtime against the approval and pre-fence owned process witness.
+func (c Controller) teardownRecord(r Record, owned Process) error {
 	p, err := readProcess(c.RunDir, c.Owner)
 	if err != nil && !errors.Is(err, fs.ErrNotExist) {
 		return err
 	}
 	if err == nil {
-		if p.Inventory.Package != c.Expected.Package {
+		if p != owned || p.Inventory.Package != c.Expected.Package {
 			return errTrust
 		}
 		if err := c.Processes.Stop(p); err != nil {
+			if c.waitTeardownCompletion(r, owned) == nil {
+				return nil
+			}
 			return err
 		}
+	} else if owned.PID > 1 {
+		// The owner can unlink after our approval snapshot but before this read.
+		// Absence alone is never success, including the artifact-before-commit gap.
+		if c.waitTeardownCompletion(r, owned) == nil {
+			return nil
+		}
+		return errTrust
+	}
+	if errors.Is(err, fs.ErrNotExist) && r.Lifecycle != nil && r.Lifecycle.Phase == "fenced" {
+		// Runtime unlink followed by a crash is not committed completion. Only
+		// a verified new boot + absent /run artifacts permits explicit repair.
+		if c.Boot == nil || !runtimeAbsent(c.Client) {
+			return errTrust
+		}
+		boot, e := c.Boot()
+		if e != nil || boot == "" || boot == r.Lifecycle.Binding.Boot {
+			return errTrust
+		}
+	}
+	if err := cleanRuntime(c.Client, err == nil); err != nil {
+		if c.waitTeardownCompletion(r, owned) == nil {
+			return nil
+		}
+		return err
 	}
+	return nil
+}
+
+func (c Controller) waitTeardownCompletion(before Record, owned Process) error {
+	if before.Lifecycle == nil || owned.PID <= 1 || owned.Inventory != before.Inventory || owned.Boot != before.Lifecycle.Binding.Boot {
+		return errTrust
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	return waitHealthy(ctx, func(context.Context) bool {
+		r, err := readRecord(c.StateDir, c.Owner)
+		if err != nil || !sameTeardownEpoch(r, before) {
+			return false
+		}
+		proof, err := completionRecord(c.Client, r)
+		return err == nil && proof.Process == owned && runtimeAbsent(c.Client)
+	})
+}
+
+// cleanRuntime is shared by verified controller and owned supervisor cleanup.
+// The caller must first prove child teardown; it never signals a recorded PID.
+func cleanRuntime(c Client, hasProcess bool) error {
 	for _, name := range []string{"helper.sock", "supervisor.sock"} {
 		path := filepath.Join(c.RunDir, name)
 		st, e := os.Lstat(path)
@@ -212,7 +417,7 @@ func (c Controller) teardown() error {
 			return e
 		}
 	}
-	if err == nil {
+	if hasProcess {
 		return os.Remove(filepath.Join(c.RunDir, "process.json"))
 	}
 	return nil

package/dist/templates/native-go/backend/internal/helper/control_test.go

@@ -23,9 +23,13 @@ type fakeProcesses struct {
 	current          Process
 	stopped, started int
 	stopErr          error
+	stopHook         func(Process) error
 }
 
 func (f *fakeProcesses) Stop(want Process) error {
+	if f.stopHook != nil {
+		return f.stopHook(want)
+	}
 	if f.stopErr != nil {
 		return f.stopErr
 	}
@@ -41,8 +45,8 @@ func controlFixture(t *testing.T) (Controller, *fakeProcesses) {
 	c := fixture(t)
 	p := Process{Inventory: c.Expected, Mode: "supervised", PID: 1234, Boot: "fixture-boot", Start: "100", Device: 1, Inode: 2}
 	f := &fakeProcesses{current: p}
-	ctl := Controller{Client: c, Processes: f}
-	record(t, c, Record{Inventory: c.Expected, Enabled: true})
+	ctl := Controller{Client: c, Processes: f, Observe: func(context.Context, Inventory) (Binding, error) { return testBinding(), nil }}
+	record(t, c, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")})
 	if err := writeProcess(c.RunDir, p); err != nil {
 		t.Fatal(err)
 	}
@@ -135,6 +139,10 @@ func TestSocketResidueCannotUnlinkForeignFilesOrLiveListeners(t *testing.T) {
 	for _, kind := range []string{"file", "symlink", "live", "stale"} {
 		t.Run(kind, func(t *testing.T) {
 			c, f := controlFixture(t)
+			// This test covers migration cleanup of pre-M1g owned stale sockets.
+			// A schema-2 incomplete transaction is tested separately and cannot use
+			// absent runtime alone as completion proof.
+			record(t, c.Client, Record{Inventory: c.Expected, Enabled: true})
 			os.Remove(filepath.Join(c.RunDir, "process.json"))
 			p := filepath.Join(c.RunDir, "helper.sock")
 			switch kind {

package/dist/templates/native-go/backend/internal/helper/data_contract.go

@@ -0,0 +1,242 @@
+package helper
+
+import "time"
+
+// These are S0 contracts only. No data operation is served by the M1 socket.
+const (
+	DataProtocol         = 2
+	GrantSchema          = 1
+	MaxHealthBytes       = 4096
+	MaxControlBytes      = 16 * 1024
+	MaxGrants            = 256 // includes revoked tombstones
+	MaxGrantStoreBytes   = 1 << 20
+	MaxPageEntries       = 200
+	MaxMetadataBytes     = 256 * 1024
+	MaxLiveIntents       = 8 // per native subject
+	MaxPathBytes         = 4096
+	MaxPathSegments      = 32
+	MaxSegmentBytes      = 255
+	MaxBoundedBytes      = 1 << 20
+	MaxTransferBytes     = 64 << 20
+	MaxChunkBytes        = 64 << 10
+	MaxOutstandingLeases = 1 // per transfer
+	MaxPackageOperations = 4
+	MaxSubjectOperations = 2
+	MaxReplayEntries     = 256 // per epoch/session window; full means busy, never eviction
+	ControlTimeout       = time.Second
+	MetadataTimeout      = 5 * time.Second
+	BoundedTimeout       = 10 * time.Second
+	CandidateTTL         = 60 * time.Second
+	IntentTTL            = 30 * time.Second
+	StreamIdleTimeout    = 10 * time.Second
+	StreamTotalTimeout   = 120 * time.Second
+	NativeProofFreshness = 2 * time.Second
+	RevokeDrainTimeout   = 2 * time.Second
+	TerminateGrace       = time.Second
+)
+
+type Action string
+
+const (
+	ActionList        Action = "nas.files.list"
+	ActionStat        Action = "nas.files.stat"
+	ActionRead        Action = "nas.files.read"
+	ActionReadStream  Action = "nas.files.read-stream"
+	ActionCreate      Action = "nas.files.create"
+	ActionWriteStream Action = "nas.files.write-stream"
+	ActionPublish     Action = "nas.files.publish"
+)
+
+func (a Action) ReadOnly() bool {
+	return a == ActionList || a == ActionStat || a == ActionRead || a == ActionReadStream
+}
+
+// Code deliberately has no underlying native error, path, credential or stderr.
+type Code string
+
+const (
+	ErrInvalid         Code = "invalid-request"
+	ErrIncompatible    Code = "incompatible"
+	ErrUnsupported     Code = "unsupported"
+	ErrReplay          Code = "replay"
+	ErrStale           Code = "stale"
+	ErrExpired         Code = "expired"
+	ErrDenied          Code = "denied"
+	ErrUnavailable     Code = "unavailable"
+	ErrSuspended       Code = "suspended"
+	ErrRevoked         Code = "revoked"
+	ErrFenced          Code = "fenced"
+	ErrBusy            Code = "busy"
+	ErrLimit           Code = "limit-exceeded"
+	ErrCanceled        Code = "canceled"
+	ErrTimeout         Code = "timeout"
+	ErrPartial         Code = "partial"
+	ErrCommitUncertain Code = "commit-uncertain"
+	ErrCleanupRequired Code = "cleanup-required"
+	ErrInternal        Code = "internal"
+)
+
+func (c Code) Error() string { return string(c) }
+func (c Code) Valid() bool {
+	switch c {
+	case ErrInvalid, ErrIncompatible, ErrUnsupported, ErrReplay, ErrStale, ErrExpired,
+		ErrDenied, ErrUnavailable, ErrSuspended, ErrRevoked, ErrFenced, ErrBusy, ErrLimit,
+		ErrCanceled, ErrTimeout, ErrPartial, ErrCommitUncertain, ErrCleanupRequired, ErrInternal:
+		return true
+	}
+	return false
+}
+
+type SafeError struct {
+	Code        Code   `json:"code"`
+	OperationID string `json:"operationId,omitempty"`
+}
+
+type ScopeKind string
+
+const (
+	ScopeShared   ScopeKind = "app-shared"
+	ScopePersonal ScopeKind = "user-personal"
+)
+
+// Principal and Scope are root-derived authority records, never caller claims.
+// Strict proof references require S1 validation; the opt-in managed pilot uses
+// a separately labeled SDK enrollment and the SAME S3 admission guard. It never
+// claims native incarnation. Name/UID/dev/inode are not continuity.
+type Principal struct {
+	Kind        string `json:"kind"` // local only
+	SubjectRef  string `json:"subjectRef"`
+	InstanceRef string `json:"instanceRef"`
+	// Explicit S1R discriminator. Omitted legacy fields remain strict/managed;
+	// no decoder may reinterpret their references as UID/username evidence.
+	IdentityBasis string `json:"identityBasis,omitempty"`
+	UID           uint32 `json:"uid,omitempty"`
+	Username      string `json:"username,omitempty"`
+}
+
+type Scope struct {
+	Kind       ScopeKind `json:"kind"`
+	TargetKind string    `json:"targetKind"` // directory only
+	AnchorRef  string    `json:"anchorRef"`  // trusted share or own-home anchor
+	Segments   []string  `json:"segments"`
+	ObjectRef  string    `json:"objectRef"`
+	MountRef   string    `json:"mountRef"` // validated local mount identity, not just st_dev
+}
+
+type ContinuityBinding struct {
+	Epoch        string `json:"epoch"`
+	SubjectProof string `json:"subjectProof"`
+	ScopeProof   string `json:"scopeProof"`
+}
+
+type GrantState string
+
+const (
+	GrantActive    GrantState = "active"
+	GrantSuspended GrantState = "suspended"
+	GrantRevoked   GrantState = "revoked"
+)
+
+type Grant struct {
+	Schema           int               `json:"grantSchema"`
+	ID               string            `json:"grantId"`
+	Revision         uint64            `json:"grantRevision"`
+	Inventory        Inventory         `json:"inventory"`
+	ApprovalBinding  string            `json:"approvalBinding"`
+	CapabilityDigest string            `json:"capabilityDigest"`
+	Owner            Principal         `json:"owner"`
+	Issuer           Principal         `json:"issuer"`
+	Scope            Scope             `json:"scope"`
+	Actions          []Action          `json:"actions"`
+	State            GrantState        `json:"state"`
+	CreatedAt        int64             `json:"createdAt"` // Unix milliseconds
+	RevokedAt        int64             `json:"revokedAt,omitempty"`
+	Reason           Code              `json:"reason,omitempty"`
+	LastValidated    ContinuityBinding `json:"lastValidatedBinding"`
+}
+
+// EffectiveState never restores a revoked or suspended grant. Restart callers
+// must pass continuous=false even if a restored epoch happens to match.
+func (g Grant) EffectiveState(current ContinuityBinding, continuous bool) GrantState {
+	if g.State == GrantRevoked {
+		return GrantRevoked
+	}
+	if g.State != GrantActive || !continuous || !validContinuity(current) || g.LastValidated != current {
+		return GrantSuspended
+	}
+	return GrantActive
+}
+
+type GrantStore struct {
+	Schema   int     `json:"grantSchema"`
+	Revision uint64  `json:"storeRevision"`
+	Grants   []Grant `json:"grants"`
+}
+
+// Intent is ephemeral and server-derived. Confirmation consumes it only after
+// fresh native identity/role/ACL and exact summary/epoch/candidate revalidation.
+type Intent struct {
+	ID            string    `json:"intentId"`
+	Inventory     Inventory `json:"inventory"`
+	Epoch         string    `json:"epoch"`
+	SubjectRef    string    `json:"subjectRef"`
+	SessionRef    string    `json:"sessionRef"`
+	CandidateID   string    `json:"candidateId"`
+	ScopeKind     ScopeKind `json:"scopeKind"`
+	Actions       []Action  `json:"actions"`
+	SummaryDigest string    `json:"summaryDigest"`
+	ExpiresAt     int64     `json:"expiresAt"` // Unix milliseconds; at most IntentTTL
+}
+
+type ListArgs struct {
+	Segments []string `json:"segments"`
+	Limit    uint32   `json:"limit"`
+	Cursor   string   `json:"cursor,omitempty"`
+}
+type StatArgs struct {
+	Segments []string `json:"segments"`
+}
+type ReadArgs struct {
+	Segments []string `json:"segments"`
+	MaxBytes uint64   `json:"maxBytes"` // no caller offsets/ranges/resume
+}
+type CreateArgs struct {
+	Segments  []string `json:"segments"`
+	Bytes     uint64   `json:"bytes"` // bulk data never carried in JSON
+	Exclusive bool     `json:"exclusive"`
+}
+type WriteStreamArgs struct {
+	Segments []string `json:"segments"`
+	MaxBytes uint64   `json:"maxBytes"`
+}
+type PublishArgs struct {
+	StageID     string `json:"stageId"`
+	NoOverwrite bool   `json:"noOverwrite"`
+}
+
+type Entry struct {
+	EntryID string `json:"entryId"`
+	Name    string `json:"name"` // visible only after actor ACL
+	Kind    string `json:"kind"` // directory or regular
+	Bytes   uint64 `json:"bytes"`
+}
+type ListResult struct {
+	Entries []Entry `json:"entries"`
+	Cursor  string  `json:"cursor,omitempty"` // opaque, bound to actor/grant/revision/epoch
+}
+type ReadResult struct {
+	Bytes uint64 `json:"bytes"`
+} // separate bounded binary relay
+type MutationReceipt struct {
+	EffectsUnknown bool   `json:"effectsUnknown,omitempty"`
+	Created        bool   `json:"created"`
+	Published      bool   `json:"published"`
+	BytesWritten   uint64 `json:"bytesWritten"`
+	Committed      bool   `json:"committed"`
+}
+type RevokeResult struct {
+	GrantID  string `json:"grantId"`
+	Revision uint64 `json:"grantRevision"`
+	Revoked  bool   `json:"revoked"` // R: durable tombstone, deny new admissions
+	Drained  bool   `json:"drained"` // Q: child/relay/lease/FD completion proof
+}

package/dist/templates/native-go/backend/internal/helper/data_contract_test.go

@@ -0,0 +1,51 @@
+package helper
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestDataContractTypes(t *testing.T) {
+	if DataProtocol != 2 || GrantSchema != 1 || MaxControlBytes != 16*1024 || MaxHealthBytes != 4096 || MaxBoundedBytes != 1<<20 {
+		t.Fatal("protocol/schema/transport ceilings changed")
+	}
+	if CandidateTTL != 60*time.Second || IntentTTL != 30*time.Second || MaxGrants != 256 || MaxPageEntries != 200 {
+		t.Fatal("consent and metadata ceilings changed")
+	}
+	if !ActionList.ReadOnly() || !ActionStat.ReadOnly() || !ActionRead.ReadOnly() || ActionCreate.ReadOnly() || ActionPublish.ReadOnly() || Action("shell").ReadOnly() {
+		t.Fatal("action classification must be closed")
+	}
+	b, err := json.Marshal(SafeError{Code: ErrDenied, OperationID: strings.Repeat("a", 64)})
+	if err != nil || strings.Contains(string(b), "path") || strings.Contains(string(b), "message") {
+		t.Fatalf("unsafe error shape: %s %v", b, err)
+	}
+	if ErrDenied.Error() != "denied" || Code("raw stderr").Valid() || Code("").Valid() {
+		t.Fatal("error set must be closed")
+	}
+}
+
+func TestGrantContinuityContract(t *testing.T) {
+	b := ContinuityBinding{Epoch: strings.Repeat("a", 64), SubjectProof: strings.Repeat("b", 64), ScopeProof: strings.Repeat("c", 64)}
+	g := Grant{State: GrantActive, LastValidated: b}
+	if g.EffectiveState(b, true) != GrantActive || g.EffectiveState(b, false) != GrantSuspended {
+		t.Fatal("unknown continuity must suspend")
+	}
+	changed := b
+	changed.Epoch = strings.Repeat("d", 64)
+	if g.EffectiveState(changed, true) != GrantSuspended {
+		t.Fatal("new epoch must suspend")
+	}
+	g.State = GrantRevoked
+	if g.EffectiveState(changed, false) != GrantRevoked {
+		t.Fatal("tombstone must remain revoked")
+	}
+	g.State = GrantSuspended
+	if g.EffectiveState(b, true) != GrantSuspended {
+		t.Fatal("continuity alone must not un-suspend")
+	}
+	if (Grant{State: GrantActive}).EffectiveState(ContinuityBinding{}, true) != GrantSuspended {
+		t.Fatal("empty proof cannot establish continuity")
+	}
+}