@synopackageland/cli 0.4.0 → 0.4.1

package/dist/templates/native-go/backend/internal/helper/supervisor_linux_test.go

@@ -2,6 +2,7 @@ package helper
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"net"
 	"os"
@@ -25,18 +26,43 @@ func linuxFixture(t *testing.T) LinuxProcesses {
 	if os.Geteuid() != 0 {
 		t.Fatal("VM fixture requires root")
 	}
+	traces, _ := filepath.Glob("/tmp/m1h-trace-*")
+	for _, path := range traces {
+		if err := os.Remove(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if t.Name() == "TestLinuxHelperSelfExitIsReapedWithoutSignallingReusedPID" {
+		source = "/helper-self-exit"
+	}
+	if t.Name() == "TestLinuxControllerWaitsForRealCompletionPublisher" {
+		source = "/helper-held-completion"
+	}
 	digest, err := executableDigest(source)
 	if err != nil {
 		t.Fatal(err)
 	}
 	i := Inventory{Package: "root", Version: "1.0.0-0001", Protocol: 1, PayloadDigest: digest, RegistryDigest: strings.Repeat("b", 64)}
 	c := NewClient(i)
+
 	for _, dir := range []string{c.StateDir, c.RunDir} {
 		if err := os.Mkdir(dir, 0700); err != nil {
 			t.Fatal(err)
 		}
 		t.Cleanup(func() { os.RemoveAll(dir) })
 	}
+	t.Cleanup(func() {
+		r, e := readRecord(c.StateDir, 0)
+		b, _ := json.Marshal(r)
+		t.Logf("VM final lifecycle=%s readError=%v failed=%t", b, e, t.Failed())
+		if t.Failed() {
+			traces, _ := filepath.Glob("/tmp/m1h-trace-*")
+			for _, path := range traces {
+				b, _ := os.ReadFile(path)
+				t.Logf("VM trace %s: %s", path, b)
+			}
+		}
+	})
 	exe := filepath.Join(c.StateDir, "payload-"+digest)
 	b, err := os.ReadFile(source)
 	if err != nil {
@@ -45,11 +71,26 @@ func linuxFixture(t *testing.T) LinuxProcesses {
 	if err := os.WriteFile(exe, b, 0700); err != nil {
 		t.Fatal(err)
 	}
+	vmUnit(t, "start")
 	return LinuxProcesses{Client: c, Binary: exe}
 }
 func startVMHelper(t *testing.T, p LinuxProcesses) Process {
 	t.Helper()
-	ctl := Controller{Client: p.Client, Processes: p}
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
+	t.Cleanup(func() {
+		r, e := readRecord(p.StateDir, 0)
+		b, _ := json.Marshal(r)
+		t.Logf("VM pre-cleanup lifecycle=%s readError=%v failed=%t", b, e, t.Failed())
+		err := ctl.Control(context.Background(), "disable")
+		t.Logf("VM cleanup disable=%v", err)
+		if t.Failed() {
+			traces, _ := filepath.Glob("/tmp/m1h-trace-*")
+			for _, path := range traces {
+				b, _ := os.ReadFile(path)
+				t.Logf("VM trace %s: %s", path, b)
+			}
+		}
+	})
 	if err := ctl.Control(context.Background(), "enable"); err != nil {
 		t.Fatal(err)
 	}
@@ -57,7 +98,6 @@ func startVMHelper(t *testing.T, p LinuxProcesses) Process {
 	if err != nil {
 		t.Fatal(err)
 	}
-	t.Cleanup(func() { ctl.Control(context.Background(), "disable") })
 	return record
 }
 func supervisedPID(t *testing.T, pid int) int {
@@ -105,7 +145,7 @@ func TestLinuxActivationAlwaysUsesSupervisorAndNormalStop(t *testing.T) {
 			if p.Status(context.Background()).State != "ready" {
 				t.Fatal("missing live handshake")
 			}
-			if err := (Controller{Client: p.Client, Processes: p}).Control(context.Background(), "disable"); err != nil {
+			if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "disable"); err != nil {
 				t.Fatal(err)
 			}
 			waitPIDExit(t, child)
@@ -142,7 +182,7 @@ func TestLinuxHelperSelfExitIsReapedWithoutSignallingReusedPID(t *testing.T) {
 }
 func TestLinuxSupervisorDeathKillsHelperAndPreservesFailedCleanup(t *testing.T) {
 	p := linuxFixture(t)
-	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true})
+	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Lifecycle: vmLifecycle(t, p)})
 	// Keep the supervisor as our own unreaped child; only its parent signals it.
 	cmd := exec.Command(p.Binary, "supervise")
 	if err := cmd.Start(); err != nil {
@@ -166,7 +206,7 @@ func TestLinuxSupervisorDeathKillsHelperAndPreservesFailedCleanup(t *testing.T)
 	}
 	waitPIDExit(t, child)
 	waitPIDExit(t, proc.PID)
-	ctl := Controller{Client: p.Client, Processes: p}
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
 	if ctl.Control(context.Background(), "teardown") == nil {
 		t.Fatal("lost supervisor falsely cleaned")
 	}
@@ -197,7 +237,7 @@ func TestLinuxUnsupervisedRecordAndDirectServeRefuse(t *testing.T) {
 	}
 	// Remove stopped sockets before testing the retired action, so a bind
 	// conflict cannot masquerade as refusal of unsupervised startup.
-	if err := (Controller{Client: p.Client, Processes: p}).Control(context.Background(), "teardown"); err != nil {
+	if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); err != nil {
 		t.Fatal(err)
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
@@ -290,7 +330,7 @@ func TestLinuxSupervisorIdentityConflictsAndSocketSubstitutionRefuse(t *testing.
 }
 func TestLinuxReparentedChildRefusesBeforeSocket(t *testing.T) {
 	p := linuxFixture(t)
-	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true})
+	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Lifecycle: vmLifecycle(t, p)})
 	cmd := exec.Command(p.Binary, "serve-child")
 	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=1"}
 	if cmd.Run() == nil {
@@ -300,3 +340,574 @@ func TestLinuxReparentedChildRefusesBeforeSocket(t *testing.T) {
 		t.Fatal("unsafe child opened socket")
 	}
 }
+
+func vmUnit(t *testing.T, action string) {
+	t.Helper()
+	if out, err := exec.Command("/bin/systemctl", action, "pkgctl-root.service").CombinedOutput(); err != nil {
+		t.Fatalf("systemctl %s: %v %s", action, err, out)
+	}
+}
+
+// Run the generated M1f hook as an unprivileged user against the real M1g
+// helper. The VM models management ordering, not DSM Package Center itself.
+func TestLinuxPrestopRequiresAdminTeardownAndPrestartNeverRecovers(t *testing.T) {
+	p := linuxFixture(t)
+	for _, dir := range []string{p.StateDir, p.RunDir} {
+		if err := os.Chmod(dir, 0755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	proc := startVMHelper(t, p)
+	child := supervisedPID(t, proc.PID)
+	log := "/tmp/m1f-prestop-message"
+	if err := os.WriteFile(log, nil, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chown(log, 65534, 65534); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.Remove(log) })
+	hook := func(action string, allow bool) {
+		t.Helper()
+		before, err := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Truncate(log, 0); err != nil {
+			t.Fatal(err)
+		}
+		cmd := exec.Command("/var/packages/root/scripts/start-stop-status", action)
+		cmd.Env = append(os.Environ(), "SYNOPKG_TEMP_LOGFILE="+log)
+		cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
+		out, err := cmd.CombinedOutput()
+		if (err == nil) != allow {
+			t.Fatalf("%s allow=%v: %v %s", action, allow, err, out)
+		}
+		if !allow {
+			message, err := os.ReadFile(log)
+			if err != nil || string(message) != string(out) || !strings.Contains(string(out), "helper_teardown") {
+				t.Fatalf("missing DSM refusal message: %v %s %s", err, out, message)
+			}
+		}
+		after, err := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
+		if err != nil || string(before) != string(after) {
+			t.Fatal("nonprivileged hook changed lifecycle latch", err)
+		}
+	}
+	hook("prestop", false)
+	if _, err := observeLinux(context.Background(), p.Expected); err != nil {
+		t.Fatal("prestop refusal changed active unit", err)
+	}
+	current, err := readProcess(p.RunDir, 0)
+	if err != nil || current != proc || p.Status(context.Background()).State != "ready" {
+		t.Fatal("prestop refusal stopped helper", err)
+	}
+	hook("prestart", true)
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
+	if err := ctl.Control(context.Background(), "teardown"); err != nil {
+		t.Fatal(err)
+	}
+	waitPIDExit(t, child)
+	waitPIDExit(t, proc.PID)
+	hook("prestop", true)
+	vmUnit(t, "stop")
+	hook("stop", true)
+	vmUnit(t, "start")
+	hook("prestart", true)
+	hook("start", true)
+	if p.Status(context.Background()).State != "stopped" || !runtimeAbsent(p.Client) {
+		t.Fatal("package Start recovered integration")
+	}
+	stopped, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	incomplete := stopped
+	incomplete.Residual = true
+	record(t, p.Client, incomplete)
+	hook("prestop", false)
+	hook("prestart", true)
+	record(t, p.Client, stopped)
+	if err := ctl.Control(context.Background(), "recover"); err != nil {
+		t.Fatal(err)
+	}
+	recovered, err := readRecord(p.StateDir, 0)
+	if err != nil || recovered.Lifecycle.Epoch == stopped.Lifecycle.Epoch || p.Status(context.Background()).State != "ready" {
+		t.Fatal("explicit Recover failed", err)
+	}
+	if err := ctl.Control(context.Background(), "disable"); err != nil {
+		t.Fatal(err)
+	}
+	hook("prestop", true)
+	hook("prestart", true)
+	if p.Status(context.Background()).State != "not-enabled" || !runtimeAbsent(p.Client) {
+		t.Fatal("prestart cleared disabled gate")
+	}
+}
+
+func vmLifecycle(t *testing.T, p LinuxProcesses) *Lifecycle {
+	t.Helper()
+	b, err := observeLinux(context.Background(), p.Expected)
+	if err != nil {
+		t.Fatal(err)
+	}
+	l, err := newLifecycle(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := createLifetime(p.Client, l); err != nil {
+		t.Fatal(err)
+	}
+	return l
+}
+
+func TestLinuxUnitStopFencesBeforeLockAndPublishesCompletion(t *testing.T) {
+	p := linuxFixture(t)
+	proc := startVMHelper(t, p)
+	child := supervisedPID(t, proc.PID)
+	lock, err := os.OpenFile(filepath.Join(p.StateDir, "policy.lock"), os.O_RDWR, 0600)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer lock.Close()
+	if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
+		t.Fatal(err)
+	}
+	vmUnit(t, "stop")
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	err = waitHealthy(ctx, func(context.Context) bool {
+		s := p.Status(context.Background())
+		return s.State == "failed" && s.Cleanup == "required"
+	})
+	cancel()
+	syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
+	if err != nil {
+		t.Fatal("memory fence waited for policy lock", err)
+	}
+	ctx, cancel = context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && !r.Residual && r.Lifecycle.Phase == "stopped" && r.Lifecycle.Completion != ""
+	}) != nil {
+		t.Fatal("completion missing")
+	}
+	r, _ := readRecord(p.StateDir, 0)
+	proof, e := completionRecord(p.Client, r)
+	if e != nil {
+		t.Fatal(e)
+	}
+	if proof.Process != proc {
+		t.Fatal("wrong completion identity", r)
+	}
+	waitPIDExit(t, child)
+	waitPIDExit(t, proc.PID)
+	if err := p.CheckStopped(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
+	if ctl.Control(context.Background(), "recover") == nil {
+		t.Fatal("inactive unit recovered")
+	}
+	vmUnit(t, "start")
+	if p.Status(context.Background()).State != "stopped" {
+		t.Fatal("unit Start resurrected integration")
+	}
+	if err := ctl.Control(context.Background(), "recover"); err != nil {
+		t.Fatal(err)
+	}
+	next, _ := readRecord(p.StateDir, 0)
+	if next.Lifecycle.Epoch == r.Lifecycle.Epoch || p.Status(context.Background()).State != "ready" {
+		t.Fatal("explicit recovery failed")
+	}
+}
+func TestLinuxRapidUnitStopStartNeverClearsFence(t *testing.T) {
+	p := linuxFixture(t)
+	proc := startVMHelper(t, p)
+	vmUnit(t, "stop")
+	vmUnit(t, "start")
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped" && !r.Residual
+	}) != nil {
+		t.Fatal("rapid transition missed")
+	}
+	waitPIDExit(t, proc.PID)
+	if p.Status(context.Background()).State != "stopped" {
+		t.Fatal("rapid Start resurrected")
+	}
+}
+func TestLinuxBusUnavailableRefusesActivation(t *testing.T) {
+	p := linuxFixture(t)
+	socket := busPath
+	if err := os.Rename(socket, socket+".fixture"); err != nil {
+		t.Fatal(err)
+	}
+	defer os.Rename(socket+".fixture", socket)
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
+	if ctl.Control(context.Background(), "enable") == nil {
+		t.Fatal("activation without bus")
+	}
+	if !runtimeAbsent(p.Client) {
+		t.Fatal("unknown authority spawned runtime")
+	}
+}
+
+func TestLinuxRealOldPayloadReplayRefusesNewApproval(t *testing.T) {
+	p := linuxFixture(t)
+	_ = startVMHelper(t, p)
+	if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); err != nil {
+		t.Fatal(err)
+	}
+	before, err := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest, err := executableDigest("/helper-legacy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(p.StateDir, "payload-"+digest)
+	b, err := os.ReadFile("/helper-legacy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, b, 0700); err != nil {
+		t.Fatal(err)
+	}
+	for _, action := range []string{"enable", "recover", "supervise"} {
+		if out, err := exec.Command(path, action).CombinedOutput(); err == nil {
+			t.Fatalf("old payload replayed %s %s", action, out)
+		}
+	}
+	after, _ := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
+	if string(before) != string(after) || !runtimeAbsent(p.Client) {
+		t.Fatal("old payload changed latch")
+	}
+}
+func TestLinuxBusRestartFencesAndCompletesRuntime(t *testing.T) {
+	p := linuxFixture(t)
+	proc := startVMHelper(t, p)
+	if out, err := exec.Command("/bin/systemctl", "restart", "dbus.service").CombinedOutput(); err != nil {
+		t.Fatal(err, string(out))
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped" && !r.Residual && r.Lifecycle.Completion != ""
+	}) != nil {
+		t.Fatal("bus loss did not complete")
+	}
+	waitPIDExit(t, proc.PID)
+	if p.Status(context.Background()).State != "stopped" {
+		t.Fatal("bus reconnection revived helper")
+	}
+}
+
+func TestLinuxLostSupervisorRepairThenExplicitRecover(t *testing.T) {
+	p := linuxFixture(t)
+	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Lifecycle: vmLifecycle(t, p)})
+	cmd := exec.Command(p.Binary, "supervise")
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	owned := &ownedLinuxChild{process: cmd.Process}
+	t.Cleanup(func() { stopChild(context.Background(), owned, time.Millisecond) })
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	err := waitHealthy(ctx, func(ctx context.Context) bool { return p.Status(ctx).State == "ready" })
+	cancel()
+	if err != nil {
+		t.Fatal(err)
+	}
+	proc, err := readProcess(p.RunDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	child := supervisedPID(t, proc.PID)
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
+	if ctl.Control(context.Background(), "repair") == nil {
+		t.Fatal("repaired live supervisor")
+	}
+	if p.Status(context.Background()).State != "ready" {
+		t.Fatal("busy repair fenced active helper")
+	}
+	if err := owned.signal(syscall.SIGKILL); err != nil {
+		t.Fatal(err)
+	}
+	waitPIDExit(t, proc.PID)
+	waitPIDExit(t, child)
+	if ctl.Control(context.Background(), "recover") == nil {
+		t.Fatal("loss recovered without repair")
+	}
+	if err := ctl.Control(context.Background(), "repair"); err != nil {
+		t.Fatal(err)
+	}
+	repaired, err := readRecord(p.StateDir, 0)
+	if err != nil || repaired.Residual || repaired.Lifecycle.Completion == "" || p.Status(context.Background()).State != "stopped" {
+		t.Fatal("repair not committed", err)
+	}
+	proof, err := completionRecord(p.Client, repaired)
+	if err != nil || proof.Repair == nil || !runtimeAbsent(p.Client) {
+		t.Fatal("no repair proof", err)
+	}
+	if err := ctl.Control(context.Background(), "repair"); err != nil {
+		t.Fatal(err)
+	}
+	if err := ctl.Control(context.Background(), "recover"); err != nil {
+		t.Fatal(err)
+	}
+	next, _ := readRecord(p.StateDir, 0)
+	if next.Lifecycle.Epoch == repaired.Lifecycle.Epoch || p.Status(context.Background()).State != "ready" {
+		t.Fatal("explicit recovery did not start new epoch")
+	}
+	t.Cleanup(func() { ctl.Control(context.Background(), "disable") })
+	// A package/nonroot process cannot use the executable repair entry.
+	for _, dir := range []string{p.StateDir, p.RunDir} {
+		if err := os.Chmod(dir, 0755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.Chmod(p.Binary, 0755); err != nil {
+		t.Fatal(err)
+	}
+	denied := exec.Command(p.Binary, "repair")
+	denied.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
+	output, err := denied.CombinedOutput()
+	if err == nil || !strings.Contains(string(output), "helper lifecycle refused") {
+		t.Fatal("package user did not reach euid refusal", err, string(output))
+	}
+
+}
+
+func TestLinuxInheritedLifetimePinsLockUntilLastHolderExit(t *testing.T) {
+	p := linuxFixture(t)
+	l := vmLifecycle(t, p)
+	lease, err := acquireLifetime(p.Client, l)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cmd := exec.Command("/bin/sleep", "60")
+	cmd.ExtraFiles = []*os.File{lease}
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	child := &ownedLinuxChild{process: cmd.Process}
+	t.Cleanup(func() { stopChild(context.Background(), child, time.Millisecond) })
+	// Model supervisor loss while the inherited child is still alive. No
+	// LOCK_UN: closing that would release the shared flock prematurely.
+	lease.Close()
+	if got, err := acquireLifetime(p.Client, l); err == nil {
+		got.Close()
+		t.Fatal("parent close released live child's witness")
+	}
+	if err := stopChild(context.Background(), child, time.Millisecond); err != nil {
+		t.Fatal(err)
+	}
+	got, err := acquireLifetime(p.Client, l)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got.Close()
+}
+
+func TestLinuxPreR2PayloadReplayAndLateSupervisorRefuseRepairLatch(t *testing.T) {
+	p := linuxFixture(t)
+	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Residual: true, Lifecycle: vmLifecycle(t, p)})
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
+	// No process was started: the same lease also proves the startup crash gap.
+	if err := ctl.Control(context.Background(), "repair"); err != nil {
+		t.Fatal(err)
+	}
+	before, _ := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
+	if out, err := exec.Command(p.Binary, "supervise").CombinedOutput(); err == nil {
+		t.Fatal("late supervisor crossed repair latch", string(out))
+	}
+	for _, source := range []string{"/helper-pre-r2", "/helper-m1d"} {
+		digest, err := executableDigest(source)
+		if err != nil {
+			t.Fatal(err)
+		}
+		bytes, err := os.ReadFile(source)
+		if err != nil {
+			t.Fatal(err)
+		}
+		path := filepath.Join(p.StateDir, "payload-"+digest)
+		if err := os.WriteFile(path, bytes, 0700); err != nil {
+			t.Fatal(err)
+		}
+		for _, action := range []string{"enable", "recover", "supervise", "disable", "teardown"} {
+			if out, err := exec.Command(path, action).CombinedOutput(); err == nil {
+				t.Fatal("old payload crossed repair schema", source, action, string(out))
+			}
+		}
+	}
+	after, _ := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
+	if string(before) != string(after) || !runtimeAbsent(p.Client) {
+		t.Fatal("replay altered completion")
+	}
+}
+
+func TestLinuxActualM1dLostSupervisorResidueCannotGainRepairWitness(t *testing.T) {
+	p := linuxFixture(t)
+	digest, err := executableDigest("/helper-m1d")
+	if err != nil {
+		t.Fatal(err)
+	}
+	old := p
+	old.Expected.PayloadDigest = digest
+	old.Binary = filepath.Join(p.StateDir, "payload-"+digest)
+	bytes, err := os.ReadFile("/helper-m1d")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(old.Binary, bytes, 0700); err != nil {
+		t.Fatal(err)
+	}
+	record(t, p.Client, Record{Inventory: old.Expected, Enabled: true})
+	cmd := exec.Command(old.Binary, "supervise")
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	owned := &ownedLinuxChild{process: cmd.Process}
+	t.Cleanup(func() { stopChild(context.Background(), owned, time.Millisecond) })
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	err = waitHealthy(ctx, func(ctx context.Context) bool { return old.Status(ctx).State == "ready" })
+	cancel()
+	if err != nil {
+		t.Fatal(err)
+	}
+	proc, err := readProcess(p.RunDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	child := supervisedPID(t, proc.PID)
+	if err := owned.signal(syscall.SIGKILL); err != nil {
+		t.Fatal(err)
+	}
+	waitPIDExit(t, proc.PID)
+	waitPIDExit(t, child)
+	// Mimic an upgraded controller; it must not create a new lock as purported
+	// historical proof, even though both observed PIDs have exited in this VM.
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
+	if ctl.Control(context.Background(), "repair") == nil {
+		t.Fatal("upgraded helper repaired unwitnessed legacy residue")
+	}
+	for _, name := range []string{"helper.sock", "supervisor.sock", "process.json"} {
+		if _, err := os.Lstat(filepath.Join(p.RunDir, name)); err != nil {
+			t.Fatal("legacy evidence removed", name, err)
+		}
+	}
+	leases, _ := filepath.Glob(filepath.Join(p.StateDir, "lifetime-*.lock"))
+	if len(leases) != 0 {
+		t.Fatal("retroactively manufactured witness", leases)
+	}
+}
+
+func TestLinuxAdminTeardownSnapshotRace(t *testing.T) {
+	p := linuxFixture(t)
+	proc := startVMHelper(t, p)
+	child := supervisedPID(t, proc.PID)
+	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux, Boot: linuxBoot}
+	// Capture the fenced snapshot inside the policy transaction, before the
+	// owner can complete it. Then deliberately let the real owner win the race.
+	var before Record
+	if err := policyUpdate(p.Client, func(r *Record) error {
+		r.Lifecycle.Phase = "fenced"
+		r.Lifecycle.Reason = "admin-stop"
+		r.Residual = true
+		before = *r
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		if e != nil {
+			return false
+		}
+		proof, e := completionRecord(p.Client, r)
+		return e == nil && proof.Process == proc && runtimeAbsent(p.Client)
+	}) != nil {
+		t.Fatal("owner did not commit autonomous admin-stop")
+	}
+	waitPIDExit(t, child)
+	waitPIDExit(t, proc.PID)
+	if err := ctl.teardownRecord(before, proc); err != nil {
+		t.Fatal("exact committed completion rejected after approval snapshot", err)
+	}
+}
+
+type pausedCompletionProcesses struct {
+	LinuxProcesses
+	visible string
+}
+
+func (p pausedCompletionProcesses) Stop(proc Process) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if err := waitHealthy(ctx, func(context.Context) bool {
+		_, err := os.Stat(p.visible)
+		return err == nil
+	}); err != nil {
+		return err
+	}
+	// Exercise the real socket/identity path after autonomous runtime unlink.
+	return p.LinuxProcesses.Stop(proc)
+}
+
+func TestLinuxControllerWaitsForRealCompletionPublisher(t *testing.T) {
+	p := linuxFixture(t)
+	proc := startVMHelper(t, p)
+	child := supervisedPID(t, proc.PID)
+	hold := filepath.Join(p.StateDir, "fixture-hold-completion")
+	if err := os.WriteFile(hold, []byte("pause publisher after approval rename"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		os.Remove(hold) // disposable VM fixture only; never a NAS operation
+		waitPIDExit(t, child)
+		waitPIDExit(t, proc.PID)
+	}()
+	result := make(chan error, 1)
+	go func() {
+		processes := pausedCompletionProcesses{LinuxProcesses: p, visible: filepath.Join(p.StateDir, "fixture-completion-visible")}
+		result <- (Controller{Client: p.Client, Processes: processes, Observe: observeLinux, Boot: linuxBoot}).Control(context.Background(), "teardown")
+	}()
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		_, visible := os.Stat(filepath.Join(p.StateDir, "fixture-completion-visible"))
+		r, e := readRecord(p.StateDir, 0)
+		if visible != nil || e != nil {
+			return false
+		}
+		proof, e := completionRecord(p.Client, r)
+		return e == nil && proof.Process == proc && runtimeAbsent(p.Client)
+	}) != nil {
+		t.Fatal("real supervisor did not publish while holding policy.lock")
+	}
+	select {
+	case err := <-result:
+		t.Fatal("controller returned before publisher unlocked", err)
+	case <-time.After(100 * time.Millisecond):
+	}
+	if err := os.Remove(hold); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case err := <-result:
+		if err != nil {
+			t.Fatal("real committed completion refused after publisher unlock", err)
+		}
+	case <-ctx.Done():
+		t.Fatal("controller did not finish after publisher unlock")
+	}
+	if err := p.CheckStopped(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+}