@synopackageland/cli 0.4.0 → 0.4.1

package/templates/native-go/backend/internal/helper/lifecycle.go

@@ -0,0 +1,234 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+// Lifecycle is deliberately unknown to old strict approval parsers. A separate
+// latch file alone would let an approved pre-M1g controller resurrect a helper.
+type Binding struct {
+	Entered uint64 `json:"entered"`
+	Boot    string `json:"boot"`
+	Install string `json:"install"`
+}
+type Lifecycle struct {
+	Schema     int     `json:"schema"`
+	Lease      *Lease  `json:"lease,omitempty"`
+	Epoch      string  `json:"epoch"`
+	Binding    Binding `json:"binding"`
+	Phase      string  `json:"phase"`
+	Reason     string  `json:"reason,omitempty"`
+	SubReason  string  `json:"subReason,omitempty"`
+	Completion string  `json:"completion,omitempty"`
+}
+
+func (l *Lifecycle) valid() bool {
+	if l == nil {
+		return true
+	} // legacy is diagnostic/cleanup only; never start/recover
+	if l.Schema != 2 || !digestPattern.MatchString(l.Epoch) || l.Binding.Boot == "" || l.Binding.Entered == 0 || !digestPattern.MatchString(l.Binding.Install) {
+		return false
+	}
+	if l.Lease != nil && l.Lease.Inode == 0 {
+		return false
+	}
+	if l.Phase != "running" && l.Phase != "fenced" && l.Phase != "stopped" {
+		return false
+	}
+	if l.Completion != "" {
+		return l.Phase == "stopped" && digestPattern.MatchString(l.Completion)
+	}
+	return true
+}
+
+var errBusy = errors.New("lifecycle busy")
+
+func policyUpdate(c Client, change func(*Record) error) error {
+	if err := protected(c.StateDir, c.Owner, true); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if err := protected(f.Name(), c.Owner, false); err != nil {
+		return err
+	}
+	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
+		return errBusy
+	}
+	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
+	r, err := readRecord(c.StateDir, c.Owner)
+	if errors.Is(err, fs.ErrNotExist) {
+		r = Record{Inventory: c.Expected}
+	} else if err != nil {
+		return err
+	}
+	if err := change(&r); err != nil {
+		return err
+	}
+	r.Schema = 2
+	return writeProtected(c.StateDir, "approval.json", r)
+}
+func fenceRecord(c Client, epoch, reason string, detail ...string) error {
+	return policyUpdate(c, func(r *Record) error {
+		if r.Lifecycle == nil || r.Lifecycle.Epoch != epoch || r.Inventory != c.Expected {
+			return errTrust
+		}
+		if r.Lifecycle.Phase == "stopped" {
+			return errTrust
+		}
+		r.Lifecycle.Phase = "fenced"
+		if r.Lifecycle.Reason == "" {
+			r.Lifecycle.Reason = reason
+			if len(detail) > 0 {
+				r.Lifecycle.SubReason = detail[0]
+			}
+		}
+		r.Lifecycle.Completion = ""
+		r.Residual = true
+		return nil
+	})
+}
+func runtimeAbsent(c Client) bool {
+	for _, name := range []string{"process.json", "helper.sock", "supervisor.sock"} {
+		if _, err := os.Lstat(filepath.Join(c.RunDir, name)); !errors.Is(err, fs.ErrNotExist) {
+			return false
+		}
+	}
+	return true
+}
+func completeRecord(c Client, epoch string, p Process, cohort ...*CohortCompletion) error {
+	var q *CohortCompletion
+	if len(cohort) > 1 {
+		return errTrust
+	}
+	if len(cohort) == 1 {
+		q = cohort[0]
+		if q != nil && !q.valid() {
+			return errTrust
+		}
+	}
+	return policyUpdate(c, func(r *Record) error {
+		if r.Lifecycle == nil || r.Lifecycle.Epoch != epoch || r.Inventory != c.Expected || r.Lifecycle.Phase != "fenced" || !runtimeAbsent(c) || p.Inventory != r.Inventory || p.Boot != r.Lifecycle.Binding.Boot || p.Mode != "supervised" || p.PID <= 1 || p.Start == "" || p.Inode == 0 {
+			return errTrust
+		}
+		r.Lifecycle.Phase = "stopped"
+		proof := Completion{Epoch: epoch, Process: p, Cohort: q}
+		return storeCompletion(c, r, proof)
+	})
+}
+
+// storeCompletion publishes the private artifact before the approval commit.
+// The caller holds policy.lock and has already established runtime quiescence.
+func storeCompletion(c Client, r *Record, proof Completion) error {
+	bytes, err := json.Marshal(proof)
+	if err != nil {
+		return err
+	}
+	if err := writeProtected(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json", proof); err != nil {
+		return err
+	}
+	sum := sha256.Sum256(bytes)
+	r.Lifecycle.Completion = hex.EncodeToString(sum[:])
+	r.Residual = false
+	return nil
+}
+
+func finalizeStart(c Client, epoch string) error {
+	return policyUpdate(c, func(r *Record) error {
+		if !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Epoch != epoch || r.Lifecycle.Phase != "running" {
+			return errTrust
+		}
+		r.Residual = false
+		return nil
+	})
+}
+func newLifecycle(b Binding) (*Lifecycle, error) {
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return nil, err
+	}
+	l := &Lifecycle{Schema: 2, Epoch: hex.EncodeToString(nonce[:]), Binding: b, Phase: "running"}
+	if !l.valid() {
+		return nil, errTrust
+	}
+	return l, nil
+}
+
+// Observe is injected only by tests. Production requires the fixed root bus
+// observer; nil cannot mean permission to start.
+type Observation func(context.Context, Inventory) (Binding, error)
+
+// The approval digest is the commit point. An orphan private proof cannot
+// authorize cleanup, and CGI status never needs access to private process IDs.
+type Completion struct {
+	Epoch   string            `json:"epoch"`
+	Process Process           `json:"process"`
+	Repair  *RepairCompletion `json:"repair,omitempty"`
+	Cohort  *CohortCompletion `json:"cohort,omitempty"`
+}
+
+func completionRecord(c Client, r Record) (Completion, error) {
+	var proof Completion
+	if r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" {
+		return proof, errTrust
+	}
+	path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+	if err := protected(c.StateDir, c.Owner, true); err != nil {
+		return proof, err
+	}
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return proof, err
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return proof, err
+	}
+	stat, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || stat.Uid != c.Owner || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 || st.Size() > 4096 {
+		return proof, errTrust
+	}
+	bytes, err := io.ReadAll(io.LimitReader(f, 4097))
+	if err != nil {
+		return proof, err
+	}
+	sum := sha256.Sum256(bytes)
+	if hex.EncodeToString(sum[:]) != r.Lifecycle.Completion {
+		return proof, errTrust
+	}
+	d := json.NewDecoder(strings.NewReader(string(bytes)))
+	d.DisallowUnknownFields()
+	if d.Decode(&proof) != nil || d.Decode(new(any)) != io.EOF {
+		return proof, errTrust
+	}
+	if proof.Cohort != nil && (!proof.Cohort.valid() || proof.Repair != nil) {
+		return proof, errTrust
+	}
+	if proof.Repair != nil {
+		q := proof.Repair
+		if proof.Epoch != r.Lifecycle.Epoch || proof.Process != (Process{}) || q.Inventory != r.Inventory || q.Boot != r.Lifecycle.Binding.Boot || r.Lifecycle.Lease == nil || q.Lease != *r.Lifecycle.Lease {
+			return proof, errTrust
+		}
+		return proof, nil
+	}
+	p := proof.Process
+	if proof.Epoch != r.Lifecycle.Epoch || p.Inventory != r.Inventory || p.Mode != "supervised" || p.Boot != r.Lifecycle.Binding.Boot || p.PID <= 1 || p.Start == "" || p.Inode == 0 {
+		return proof, errTrust
+	}
+	return proof, nil
+}

package/templates/native-go/backend/internal/helper/lifecycle_test.go

@@ -0,0 +1,473 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+)
+
+func testBinding() Binding {
+	return Binding{Boot: "fixture-boot", Entered: 7, Install: strings.Repeat("c", 64)}
+}
+func testLifecycle(phase string) *Lifecycle {
+	return &Lifecycle{Schema: 2, Epoch: strings.Repeat("d", 64), Binding: testBinding(), Phase: phase}
+}
+func TestLifecycleUnavailableRefusesBeforeStart(t *testing.T) {
+	c, f := controlFixture(t)
+	c.Observe = func(context.Context, Inventory) (Binding, error) { return Binding{}, errors.New("bus unavailable") }
+	if c.Control(context.Background(), "enable") == nil || f.started != 0 {
+		t.Fatal("unknown authority started helper")
+	}
+}
+func TestLifecycleStopLatchAndExplicitRecover(t *testing.T) {
+	c, f := controlFixture(t)
+	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+	record(t, c.Client, r)
+	if err := fenceRecord(c.Client, r.Lifecycle.Epoch, "unit-stopped"); err != nil {
+		t.Fatal(err)
+	}
+	s := c.Status(context.Background())
+	if s.State != "failed" || s.Cleanup != "required" {
+		t.Fatal(s)
+	}
+	r, _ = readRecord(c.StateDir, c.Owner)
+	if !r.Enabled || r.Lifecycle.Phase != "fenced" {
+		t.Fatal(r)
+	}
+	if err := c.Control(context.Background(), "teardown"); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.Control(context.Background(), "recover"); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := readRecord(c.StateDir, c.Owner)
+	if got.Lifecycle.Epoch == r.Lifecycle.Epoch || got.Lifecycle.Phase != "running" || f.started != 1 {
+		t.Fatal(got)
+	}
+}
+func TestLifecycleRecoverRejectsChangedInstallAndReboot(t *testing.T) {
+	for _, which := range []string{"install", "boot"} {
+		t.Run(which, func(t *testing.T) {
+			c, f := controlFixture(t)
+			record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("stopped")})
+			c.Observe = func(context.Context, Inventory) (Binding, error) {
+				b := testBinding()
+				if which == "boot" {
+					b.Boot = "reboot"
+				} else {
+					b.Install = strings.Repeat("e", 64)
+				}
+				return b, nil
+			}
+			if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+				t.Fatal("continuity changed")
+			}
+		})
+	}
+}
+func TestLifecycleOldStrictControllerCannotReplay(t *testing.T) {
+	c, _ := controlFixture(t)
+	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("stopped")})
+	b, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	var legacy struct {
+		Inventory Inventory `json:"inventory"`
+		Enabled   bool      `json:"enabled"`
+		Residual  bool      `json:"residual,omitempty"`
+	}
+	d := json.NewDecoder(strings.NewReader(string(b)))
+	d.DisallowUnknownFields()
+	if d.Decode(&legacy) == nil {
+		t.Fatal("old payload can ignore latch")
+	}
+}
+func TestLifecycleStartupFinalizationCannotOverwriteFence(t *testing.T) {
+	c, _ := controlFixture(t)
+	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+	record(t, c.Client, r)
+	if err := fenceRecord(c.Client, r.Lifecycle.Epoch, "unit-stopped"); err != nil {
+		t.Fatal(err)
+	}
+	if finalizeStart(c.Client, r.Lifecycle.Epoch) == nil {
+		t.Fatal("startup overwrote fence")
+	}
+	got, _ := readRecord(c.StateDir, c.Owner)
+	if got.Lifecycle.Phase != "fenced" || !got.Residual {
+		t.Fatal(got)
+	}
+}
+func TestLifecycleCompletionRequiresMatchingEpochAndIdentity(t *testing.T) {
+	c, f := controlFixture(t)
+	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true})
+	if completeRecord(c.Client, "wrong", f.current) == nil {
+		t.Fatal("wrong epoch completed")
+	}
+	if completeRecord(c.Client, strings.Repeat("d", 64), f.current) == nil {
+		t.Fatal("live runtime completed")
+	}
+	if err := c.teardown(); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, strings.Repeat("d", 64), f.current); err != nil {
+		t.Fatal(err)
+	}
+	r, _ := readRecord(c.StateDir, c.Owner)
+	proof, e := completionRecord(c.Client, r)
+	if e != nil {
+		t.Fatal(e)
+	}
+	if r.Residual || r.Lifecycle.Completion == "" || proof.Process != f.current {
+		t.Fatal(r)
+	}
+	if c.Status(context.Background()).State != "stopped" {
+		t.Fatal("completion not readable")
+	}
+}
+
+func TestLifecyclePolicyLockDoesNotBlockControllerStop(t *testing.T) {
+	c, _ := controlFixture(t)
+	lock, err := os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer lock.Close()
+	if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
+		t.Fatal(err)
+	}
+	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
+	if err := fenceRecord(c.Client, strings.Repeat("d", 64), "unit-stopped"); !errors.Is(err, errBusy) {
+		t.Fatal("fence blocked/replaced approval", err)
+	}
+}
+func TestLifecycleMalformedSchemaAndCompletionRefuse(t *testing.T) {
+	for _, which := range []string{"schema", "epoch", "phase", "identity", "entered"} {
+		t.Run(which, func(t *testing.T) {
+			c, _ := controlFixture(t)
+			l := testLifecycle("stopped")
+			switch which {
+			case "schema":
+				l.Schema = 1
+			case "epoch":
+				l.Epoch = "old"
+			case "phase":
+				l.Phase = "ready"
+			case "entered":
+				l.Binding.Entered = 0
+			case "identity":
+				l.Completion = "wrong"
+			}
+			record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: l})
+			if _, err := readRecord(c.StateDir, c.Owner); err == nil {
+				t.Fatal("malformed policy accepted")
+			}
+		})
+	}
+}
+
+func TestLifecycleControllerAcceptsOnlyExactAutonomousCompletion(t *testing.T) {
+	c, f := controlFixture(t)
+	f.stopHook = func(p Process) error {
+		if err := cleanRuntime(c.Client, true); err != nil {
+			return err
+		}
+		if err := completeRecord(c.Client, strings.Repeat("d", 64), p); err != nil {
+			return err
+		}
+		return errTrust // supervisor exited before the controller's socket dial
+	}
+	if err := c.Control(context.Background(), "teardown"); err != nil {
+		t.Fatal("valid autonomous completion refused", err)
+	}
+}
+
+func TestLifecyclePublicApprovalDoesNotDiscloseCompletionProcess(t *testing.T) {
+	c, f := controlFixture(t)
+	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true})
+	if err := c.teardown(); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, strings.Repeat("d", 64), f.current); err != nil {
+		t.Fatal(err)
+	}
+	b, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	if strings.Contains(string(b), `"pid"`) || strings.Contains(string(b), `"inode"`) {
+		t.Fatal("private process identity disclosed")
+	}
+}
+
+func TestLifecycleRecoverRejectsMissingCompletionProof(t *testing.T) {
+	c, f := controlFixture(t)
+	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true})
+	if err := c.teardown(); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, strings.Repeat("d", 64), f.current); err != nil {
+		t.Fatal(err)
+	}
+	os.Remove(filepath.Join(c.StateDir, "completion-"+strings.Repeat("d", 64)+".json"))
+	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+		t.Fatal("missing completion bypassed")
+	}
+}
+
+func TestLifecycleDisableUpgradesLegacyGateAgainstReplay(t *testing.T) {
+	c, _ := controlFixture(t)
+	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true})
+	if err := c.Control(context.Background(), "disable"); err != nil {
+		t.Fatal(err)
+	}
+	b, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	var old struct {
+		Inventory Inventory `json:"inventory"`
+		Enabled   bool      `json:"enabled"`
+		Residual  bool      `json:"residual,omitempty"`
+	}
+	d := json.NewDecoder(strings.NewReader(string(b)))
+	d.DisallowUnknownFields()
+	if d.Decode(&old) == nil {
+		t.Fatal("legacy enable can replay disabled gate")
+	}
+}
+
+func TestLifecycleCrashAfterUnlinkWithoutCommitKeepsCleanupRequired(t *testing.T) {
+	c, f := controlFixture(t)
+	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true}
+	record(t, c.Client, r)
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if c.Control(context.Background(), "teardown") == nil || f.stopped != 0 {
+		t.Fatal("unlink alone certified completion")
+	}
+	got, _ := readRecord(c.StateDir, c.Owner)
+	if !got.Residual || got.Lifecycle.Phase != "fenced" {
+		t.Fatal("crash intent erased")
+	}
+}
+func TestLifecycleExplicitRepairAfterVerifiedNewBoot(t *testing.T) {
+	c, _ := controlFixture(t)
+	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true})
+	os.Remove(filepath.Join(c.RunDir, "process.json"))
+	c.Boot = func() (string, error) { return "verified-new-boot", nil }
+	if err := c.Control(context.Background(), "disable"); err != nil {
+		t.Fatal(err)
+	}
+	r, _ := readRecord(c.StateDir, c.Owner)
+	if r.Enabled || r.Residual {
+		t.Fatal("post-reboot disable failed")
+	}
+}
+
+// The controller has read a fenced approval, but the owner finishes between
+// that read and the process-record read. No timing sleeps or fake syscall error.
+func TestLifecycleTeardownSnapshotAcceptsCommittedOwnerExit(t *testing.T) {
+	c, f := controlFixture(t)
+	if err := fenceRecord(c.Client, testLifecycle("running").Epoch, "admin-stop"); err != nil {
+		t.Fatal(err)
+	}
+	before, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, before.Lifecycle.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.teardownRecord(before, f.current); err != nil {
+		t.Fatal("exact committed completion rejected after approval snapshot", err)
+	}
+}
+
+func TestLifecycleTeardownCompletionRejectsChangedWitness(t *testing.T) {
+	for _, kind := range []string{"epoch", "inventory", "binding", "lease", "pid", "start", "inode", "device", "digest", "orphan", "missing", "mode", "symlink", "runtime"} {
+		t.Run(kind, func(t *testing.T) {
+			c, f := controlFixture(t)
+			if err := fenceRecord(c.Client, testLifecycle("running").Epoch, "admin-stop"); err != nil {
+				t.Fatal(err)
+			}
+			before, err := readRecord(c.StateDir, c.Owner)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := cleanRuntime(c.Client, true); err != nil {
+				t.Fatal(err)
+			}
+			if err := completeRecord(c.Client, before.Lifecycle.Epoch, f.current); err != nil {
+				t.Fatal(err)
+			}
+			r, err := readRecord(c.StateDir, c.Owner)
+			if err != nil {
+				t.Fatal(err)
+			}
+			proof, err := completionRecord(c.Client, r)
+			if err != nil {
+				t.Fatal(err)
+			}
+			path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+			switch kind {
+			case "epoch":
+				r.Lifecycle.Epoch = strings.Repeat("e", 64)
+				proof.Epoch = r.Lifecycle.Epoch
+			case "inventory":
+				r.Inventory.Version = "9.0.0-9999"
+				proof.Process.Inventory = r.Inventory
+			case "binding":
+				r.Lifecycle.Binding.Entered++
+			case "lease":
+				r.Lifecycle.Lease = &Lease{Device: 1, Inode: 999}
+			case "pid":
+				proof.Process.PID++
+			case "start":
+				proof.Process.Start = "101"
+			case "inode":
+				proof.Process.Inode++
+			case "device":
+				proof.Process.Device++
+			}
+			if err := storeCompletion(c.Client, &r, proof); err != nil {
+				t.Fatal(err)
+			}
+			switch kind {
+			case "digest":
+				r.Lifecycle.Completion = strings.Repeat("f", 64)
+			case "orphan":
+				r.Lifecycle.Phase = "fenced"
+				r.Lifecycle.Completion = ""
+				r.Residual = true
+			case "missing":
+				if err := os.Remove(path); err != nil {
+					t.Fatal(err)
+				}
+			case "mode":
+				if err := os.Chmod(path, 0644); err != nil {
+					t.Fatal(err)
+				}
+			case "symlink":
+				if err := os.Rename(path, path+".saved"); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.Symlink(path+".saved", path); err != nil {
+					t.Fatal(err)
+				}
+			case "runtime":
+				if err := os.WriteFile(filepath.Join(c.RunDir, "helper.sock"), []byte("foreign"), 0600); err != nil {
+					t.Fatal(err)
+				}
+			}
+			record(t, c.Client, r)
+			saved, err := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := c.teardownRecord(before, f.current); err == nil {
+				t.Fatal("changed/uncommitted completion accepted", kind)
+			}
+			after, err := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(saved) != string(after) || f.stopped != 0 || f.started != 0 {
+				t.Fatal("failed reconciliation changed evidence or touched process")
+			}
+		})
+	}
+}
+
+func TestLifecycleControlActionsAcceptExactOwnerCompletion(t *testing.T) {
+	for _, action := range []string{"teardown", "disable", "recover"} {
+		t.Run(action, func(t *testing.T) {
+			c, f := controlFixture(t)
+			f.stopHook = func(p Process) error {
+				if err := cleanRuntime(c.Client, true); err != nil {
+					return err
+				}
+				if err := completeRecord(c.Client, testLifecycle("running").Epoch, p); err != nil {
+					return err
+				}
+				return errTrust
+			}
+			if err := c.Control(context.Background(), action); err != nil {
+				t.Fatal(err)
+			}
+			r, err := readRecord(c.StateDir, c.Owner)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if r.Residual || r.Enabled != (action != "disable") {
+				t.Fatal(r)
+			}
+			if action == "recover" {
+				if f.started != 1 || r.Lifecycle.Epoch == testLifecycle("running").Epoch {
+					t.Fatal("Recover did not create new epoch")
+				}
+			} else if f.started != 0 {
+				t.Fatal("Stop operation started helper")
+			}
+		})
+	}
+}
+
+func TestLifecycleTeardownRefusesUnwitnessedConcurrentCompletion(t *testing.T) {
+	c, f := controlFixture(t)
+	before, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := fenceRecord(c.Client, before.Lifecycle.Epoch, "admin-stop"); err != nil {
+		t.Fatal(err)
+	}
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, before.Lifecycle.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	if c.teardownFor(before, Process{}) == nil {
+		t.Fatal("concurrent exit accepted without saved owned identity")
+	}
+}
+
+func TestLifecycleTeardownUnlinkRaceStillRequiresCommittedProof(t *testing.T) {
+	for _, committed := range []bool{false, true} {
+		c, f := controlFixture(t)
+		f.stopHook = func(p Process) error {
+			if err := cleanRuntime(c.Client, true); err != nil {
+				return err
+			}
+			if committed {
+				return completeRecord(c.Client, testLifecycle("running").Epoch, p)
+			}
+			return nil
+		}
+		err := c.Control(context.Background(), "teardown")
+		if (err == nil) != committed {
+			t.Fatalf("commit=%v err=%v", committed, err)
+		}
+	}
+}
+
+func TestLifecycleOwnedStopCannotUseRepairCompletion(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	before, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := policyUpdate(c.Client, func(r *Record) error {
+		r.Lifecycle.Phase = "stopped"
+		return storeCompletion(c.Client, r, Completion{Epoch: r.Lifecycle.Epoch, Repair: &RepairCompletion{Inventory: r.Inventory, Boot: r.Lifecycle.Binding.Boot, Lease: *r.Lifecycle.Lease}})
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if c.teardownRecord(before, f.current) == nil {
+		t.Fatal("repair artifact substituted for exact owned process proof")
+	}
+}