@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/write_admission.go

@@ -0,0 +1,260 @@
+package helper
+
+import (
+	"context"
+	"slices"
+)
+
+type writeIntentStore interface {
+	// Reserve durably burns ID before any filesystem effect. Interrupted records
+	// are deliberately retained; restart cannot replay or claim rollback.
+	Reserve(operationBinding, Principal, writeWork) Code
+	Record(operationBinding, MutationReceipt, Code) Code
+}
+type writeMutationProcess interface {
+	operationProcess
+	commitWithActor(NativeActor) error
+	mutationResult() (MutationReceipt, Code, bool)
+}
+
+func writeRequestWork(r DataRequest, root readOnlyRootWitness) (*writeWork, Code) {
+	if root == nil {
+		return nil, ErrUnavailable
+	}
+	w := &writeWork{RootPath: root.readOnlyRootPath(), Action: r.Op}
+	switch r.Op {
+	case ActionCreate:
+		var a CreateArgs
+		if c := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); c != "" {
+			return nil, c
+		}
+		w.Segments = slices.Clone(a.Segments)
+		w.MaxBytes = a.Bytes
+	case ActionWriteStream:
+		var a WriteStreamArgs
+		if c := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); c != "" {
+			return nil, c
+		}
+		w.Segments = slices.Clone(a.Segments)
+		w.MaxBytes = a.MaxBytes
+		w.Staged = true
+	default:
+		return nil, ErrUnsupported
+	}
+	if c := w.validate(); c != "" {
+		return nil, c
+	}
+	return w, ""
+}
+func sameWriteRequest(op *cohortOperation, w *writeWork, root readOnlyRootWitness, exact bool) bool {
+	return op.writeWork != nil && w.Action == op.writeWork.Action && slices.Equal(w.Segments, op.writeWork.Segments) && op.root != nil && root != nil && op.root.sameReadOnlyRoot(root) && (!exact || w.MaxBytes == op.writeWork.MaxBytes)
+}
+func (s *supervisorGrants) startWrite(ctx context.Context, peer operationPeer, carriers SessionCarriers, r DataRequest) Code {
+	if !s.cohort.peerAllowed(peer) {
+		return ErrDenied
+	}
+	actor, proof, c := s.validate(ctx, carriers, r, nil)
+	if c != "" {
+		return c
+	}
+	w, c := writeRequestWork(r, proof.root)
+	if c != "" {
+		return c
+	}
+	if s.services.writeIntents == nil {
+		return ErrUnavailable
+	}
+	b := operationBinding{r.Inventory, r.Epoch, r.OperationID, r.Nonce, r.GrantID, r.GrantRevision}
+	// Root protected metadata IO is outside admission locks. Even if later
+	// admission loses a revoke race, this ID remains burned, never auto retried.
+	if c := s.services.writeIntents.Reserve(b, actor.Principal(), *w); c != "" {
+		return c
+	}
+	var op *cohortOperation
+	c = s.authority.WithGrantAdmission(GrantAdmission{actor, r.GrantID, r.GrantRevision, r.Op, proof.Binding, proof.Continuous}, func(_ Grant, a NativeActor) Code {
+		if c := nativeContextCode(ctx); c != "" {
+			return c
+		}
+		if c := s.ticketLocked(r, proof.Ticket, a); c != "" {
+			return c
+		}
+		var c Code
+		op, c = s.cohort.reserveLocked(a, b)
+		if c != "" {
+			return c
+		}
+		op.writeWork = w
+		op.root = proof.root
+		op.maxBytes = w.MaxBytes
+		s.burnTicket(r)
+		return ""
+	})
+	if c != "" {
+		return c
+	}
+	return s.cohort.launchReserved(op)
+}
+func (s *supervisorGrants) writeControl(ctx context.Context, peer operationPeer, carriers SessionCarriers, r DataRequest, commit bool) Code {
+	if !s.cohort.peerAllowed(peer) {
+		return ErrDenied
+	}
+	op := s.cohort.operations[r.OperationID]
+	if op == nil || op.writeWork == nil || op.binding.Inventory != r.Inventory || op.binding.Epoch != r.Epoch || op.binding.GrantID != r.GrantID || op.binding.GrantRevision != r.GrantRevision {
+		return ErrDenied
+	}
+	if op.canceled || op.process == nil {
+		return ErrCanceled
+	}
+	p, ok := op.process.(writeMutationProcess)
+	if !ok {
+		return ErrUnavailable
+	}
+	actor, proof, c := s.validate(ctx, carriers, r, &op.actor)
+	if c != "" {
+		op.canceled = true
+		p.stopRelay()
+		return c
+	}
+	n := uint32(0)
+	if commit && op.writeWork.Staged {
+		var a PublishArgs
+		if c := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); c != "" {
+			return c
+		}
+		if r.Op != ActionPublish || a.StageID != op.binding.OperationID || !a.NoOverwrite || proof.root == nil || !op.root.sameReadOnlyRoot(proof.root) {
+			return ErrDenied
+		}
+	} else {
+		w, c := writeRequestWork(r, proof.root)
+		if c != "" {
+			return c
+		}
+		if !sameWriteRequest(op, w, proof.root, commit) {
+			return ErrDenied
+		}
+		if !commit {
+			if w.MaxBytes > MaxChunkBytes {
+				return ErrLimit
+			}
+			n = uint32(w.MaxBytes)
+		}
+	}
+	c = s.authority.WithGrantAdmission(GrantAdmission{actor, r.GrantID, r.GrantRevision, r.Op, proof.Binding, proof.Continuous}, func(_ Grant, a NativeActor) Code {
+		if c := nativeContextCode(ctx); c != "" {
+			return c
+		}
+		if c := s.ticketLocked(r, proof.Ticket, a); c != "" {
+			return c
+		}
+		if !s.cohort.allowed() {
+			return ErrFenced
+		}
+		if op.canceled || op.commitReserved {
+			return ErrReplay
+		}
+		if op.expired(s.cohort.now()) {
+			return ErrTimeout
+		}
+		idle, e := p.idle()
+		if e != nil {
+			return ErrCleanupRequired
+		}
+		if !idle {
+			return ErrBusy
+		}
+		_, c, ready := p.mutationResult()
+		if !ready {
+			return ErrBusy
+		}
+		if c != "" {
+			return c
+		}
+		if commit {
+			op.commitReserved = true
+			op.actor = a
+		} else {
+			if c := s.cohort.reserveChunkLocked(op, a, n); c != "" {
+				return c
+			}
+		}
+		s.burnTicket(r)
+		return ""
+	})
+	if c != "" {
+		return c
+	}
+	// A commit lease admitted before durable R may finish. A later R closes the
+	// relay and drains the actual owned child; it never claims rollback.
+	if commit {
+		if e := p.commitWithActor(op.actor); e != nil {
+			op.canceled = true
+			p.stopRelay()
+			return ErrCleanupRequired
+		}
+		return ""
+	}
+	return s.cohort.deliverChunk(op, n)
+}
+func (s *supervisorGrants) writeResult(ctx context.Context, peer operationPeer, carriers SessionCarriers, r DataRequest) (*MutationReceipt, Code) {
+	if !s.cohort.peerAllowed(peer) {
+		return nil, ErrDenied
+	}
+	op := s.cohort.operations[r.OperationID]
+	archived := s.cohort.receipts[r.OperationID].write
+	if op == nil && archived != nil {
+		op = &archived.operation
+	}
+	if op == nil || op.writeWork == nil || op.binding.Inventory != r.Inventory || op.binding.Epoch != r.Epoch || op.binding.GrantID != r.GrantID || op.binding.GrantRevision != r.GrantRevision {
+		return nil, ErrDenied
+	}
+	actor, proof, c := s.validate(ctx, carriers, r, &op.actor)
+	if c != "" {
+		return nil, c
+	}
+	w, c := writeRequestWork(r, proof.root)
+	if c != "" || !sameWriteRequest(op, w, proof.root, true) {
+		return nil, ErrDenied
+	}
+	var value MutationReceipt
+	var resultCode Code
+	ready := false
+	if archived != nil && op.process == nil {
+		value, resultCode, ready = archived.receipt, archived.code, true
+	} else {
+		p, ok := op.process.(writeMutationProcess)
+		if !ok {
+			return nil, ErrUnavailable
+		}
+		value, resultCode, ready = p.mutationResult()
+	}
+	if !ready {
+		return nil, ErrBusy
+	}
+	c = s.authority.WithGrantAdmission(GrantAdmission{actor, r.GrantID, r.GrantRevision, r.Op, proof.Binding, proof.Continuous}, func(_ Grant, a NativeActor) Code {
+		if c := nativeContextCode(ctx); c != "" {
+			return c
+		}
+		if c := s.ticketLocked(r, proof.Ticket, a); c != "" {
+			return c
+		}
+		s.burnTicket(r)
+		return ""
+	})
+	if c != "" {
+		return nil, c
+	}
+	if op.commitReserved || resultCode != "" {
+		if s.services.writeIntents == nil {
+			return &value, ErrCleanupRequired
+		}
+		if c := s.services.writeIntents.Record(op.binding, value, resultCode); c != "" {
+			return &value, c
+		}
+		if p, ok := op.process.(interface{ releaseWriteResult() error }); ok {
+			if e := p.releaseWriteResult(); e != nil {
+				return &value, ErrCleanupRequired
+			}
+		}
+	}
+	return &value, resultCode
+}

package/dist/templates/native-go/backend/internal/helper/write_admission_test.go

@@ -0,0 +1,135 @@
+package helper
+
+import (
+	"context"
+	"testing"
+)
+
+type writeIntentStub struct{ seen map[string]bool }
+
+func (j *writeIntentStub) Reserve(b operationBinding, _ Principal, _ writeWork) Code {
+	if j.seen == nil {
+		j.seen = map[string]bool{}
+	}
+	if j.seen[b.OperationID] {
+		return ErrReplay
+	}
+	j.seen[b.OperationID] = true
+	return ""
+}
+
+type writeProcessStub struct {
+	*operationFixture
+	commits    int
+	receipt    MutationReceipt
+	resultCode Code
+}
+
+func (p *writeProcessStub) commitWithActor(NativeActor) error {
+	p.commits++
+	p.receipt.Committed = true
+	p.receipt.Published = true
+	return nil
+}
+func (p *writeProcessStub) mutationResult() (MutationReceipt, Code, bool) {
+	return p.receipt, p.resultCode, true
+}
+func TestWriteGrantCommitOrdersAgainstRevokeAndDoesNotHoldDiskLocks(t *testing.T) {
+	for _, kind := range []string{"commit-first", "revoke-first", "during-proof", "default-off", "publish-off", "duplicate", "wrong-grant", "wrong-peer"} {
+		t.Run(kind, func(t *testing.T) {
+			s, repo, c, carrier, g, _ := grantCohortFixture(t)
+			gates := writeGates{Create: true, Stream: true, Publish: true}
+			s.services.writes = gates
+			s.authority.writes = gates
+			repo.store.Grants[0].Actions = []Action{ActionCreate, ActionWriteStream, ActionPublish}
+			root := &readOnlyRootStub{path: "/trusted/root"}
+			s.services.operations = readOnlyGrantValidatorStub{root: root}
+			s.services.writeIntents = &writeIntentStub{}
+			p := &writeProcessStub{operationFixture: &operationFixture{}, receipt: MutationReceipt{Created: true, BytesWritten: 3}}
+			c.startChild = func(NativeActor, operationBinding) (operationProcess, error) {
+				if repo.inTransaction {
+					t.Fatal("bootstrap under disk locks")
+				}
+				return p, nil
+			}
+			r := readOnlyGrantControl(t, g, ActionWriteStream, '1', '2', '3', WriteStreamArgs{Segments: []string{"file"}, MaxBytes: 10})
+			if kind == "default-off" {
+				s.services.writes = writeGates{}
+				if code := s.start(context.Background(), operationPeer{42, 0}, carrier, r); code != ErrUnsupported {
+					t.Fatal(code)
+				}
+				return
+			}
+			if code := s.start(context.Background(), operationPeer{42, 0}, carrier, r); code != "" {
+				t.Fatal(code)
+			}
+			request := readOnlyGrantControl(t, g, ActionPublish, '1', '4', '5', PublishArgs{StageID: r.OperationID, NoOverwrite: true})
+			peer := operationPeer{42, 0}
+			switch kind {
+			case "revoke-first":
+				repo.store.Grants[0].State = GrantRevoked
+				repo.store.Grants[0].Revision++
+				repo.store.Grants[0].Reason = ErrRevoked
+				repo.store.Grants[0].RevokedAt = g.CreatedAt
+			case "during-proof":
+				s.services.operations = readOnlyGrantValidatorStub{root: root, after: func() {
+					repo.store.Grants[0].State = GrantRevoked
+					repo.store.Grants[0].Revision++
+					repo.store.Grants[0].Reason = ErrRevoked
+					repo.store.Grants[0].RevokedAt = g.CreatedAt
+				}}
+			case "publish-off":
+				s.services.writes.Publish = false
+			case "wrong-grant":
+				request.GrantID = grantRef('f')
+			case "wrong-peer":
+				peer.PID++
+			}
+			code := s.writeControl(context.Background(), peer, carrier, request, true)
+			if kind == "commit-first" || kind == "duplicate" {
+				if code != "" || p.commits != 1 {
+					t.Fatal(code, p.commits)
+				}
+				request.Nonce = grantRef('6')
+				request.Ticket = grantRef('7')
+				if code := s.writeControl(context.Background(), peer, carrier, request, true); code != ErrReplay {
+					t.Fatal("second commit", code)
+				}
+			} else if code == "" || p.commits != 0 {
+				t.Fatal("commit crossed deny", kind, code, p.commits)
+			}
+		})
+	}
+}
+
+func TestWriteReceiptRemainsAuthorizedAfterChildReap(t *testing.T) {
+	s, repo, c, carrier, g, _ := grantCohortFixture(t)
+	gates := writeGates{Create: true}
+	s.services.writes = gates
+	s.authority.writes = gates
+	repo.store.Grants[0].Actions = []Action{ActionCreate}
+	root := &readOnlyRootStub{path: "/trusted/root"}
+	s.services.operations = readOnlyGrantValidatorStub{root: root}
+	s.services.writeIntents = &writeIntentStub{}
+	p := &writeProcessStub{operationFixture: &operationFixture{}, receipt: MutationReceipt{Created: true, Published: true, BytesWritten: 3, Committed: true}}
+	c.startChild = func(NativeActor, operationBinding) (operationProcess, error) { return p, nil }
+	r := readOnlyGrantControl(t, g, ActionCreate, '1', '2', '3', CreateArgs{Segments: []string{"file"}, Bytes: 3, Exclusive: true})
+	if code := s.start(context.Background(), operationPeer{42, 0}, carrier, r); code != "" {
+		t.Fatal(code)
+	}
+	c.retire(r.OperationID, c.operations[r.OperationID])
+	r.Nonce = grantRef('4')
+	r.Ticket = grantRef('5')
+	m, code := s.writeResult(context.Background(), operationPeer{42, 0}, carrier, r)
+	if code != "" || m == nil || !m.Committed || m.BytesWritten != 3 {
+		t.Fatal(m, code)
+	}
+	r.Nonce = grantRef('6')
+	r.Ticket = grantRef('7')
+	r.GrantID = grantRef('f')
+	if m, code := s.writeResult(context.Background(), operationPeer{42, 0}, carrier, r); code == "" || m != nil {
+		t.Fatal("foreign receipt", m, code)
+	}
+}
+
+func (j *writeIntentStub) Record(operationBinding, MutationReceipt, Code) Code { return "" }

package/dist/templates/native-go/backend/internal/helper/write_cohort_linux_test.go

@@ -0,0 +1,218 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"golang.org/x/sys/unix"
+	"os"
+	"os/exec"
+	"testing"
+)
+
+func writeVMCreate(t *testing.T, p LinuxProcesses) Grant {
+	t.Helper()
+	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionCreate, ActionWriteStream, ActionPublish}})
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+	store, c := DecodeGrantStore(bytes.NewReader(raw))
+	if c != "" {
+		t.Fatal(c)
+	}
+	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
+	if res.Code != "" || res.Grant == nil {
+		t.Fatal(res)
+	}
+	return *res.Grant
+}
+func writeVMResult(t *testing.T, p LinuxProcesses, r DataRequest) (MutationReceipt, Code) {
+	t.Helper()
+	var m MutationReceipt
+	var code Code
+	readStreamVMWait(t, func() bool {
+		r.Nonce = readOnlyVMRef(t)
+		r.Ticket = readOnlyVMRef(t)
+		res := grantVMCall(t, p, "operation.result", r)
+		if res.Code == ErrBusy {
+			return false
+		}
+		if res.Mutation == nil {
+			t.Fatalf("missing mutation receipt: %+v", res)
+		}
+		m = *res.Mutation
+		code = res.Code
+		return true
+	})
+	return m, code
+}
+func TestLinuxWriteActorRelayPublishRevokeAndInheritedACL(t *testing.T) {
+	for _, kind := range []string{"create", "stream", "exists", "replacement", "revoke", "duplicate", "inherited-acl", "disk-full", "fsync-gap", "commit-first"} {
+		t.Run(kind, func(t *testing.T) {
+			p := readOnlyVMFixture(t)
+			if kind == "disk-full" {
+				if e := unix.Mount("tmpfs", "/tmp/m2-s5-operations", "tmpfs", 0, "size=64k,mode=0755"); e != nil {
+					t.Fatal(e)
+				}
+				t.Cleanup(func() { unix.Unmount("/tmp/m2-s5-operations", 0) })
+			}
+			os.Mkdir("/tmp/m2-s5-operations/write", 0770)
+			os.Chown("/tmp/m2-s5-operations/write", 1001, 100)
+			if kind == "inherited-acl" {
+				if b, e := exec.Command("setfacl", "-m", "d:u:1002:r--,d:g::r--,d:o::---", "/tmp/m2-s5-operations/write").CombinedOutput(); e != nil {
+					t.Fatal(string(b), e)
+				}
+			}
+			proc := startVMHelper(t, p)
+			_ = proc
+			g := writeVMCreate(t, p)
+			defer func() {
+				if e := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); e != nil {
+					t.Error(e)
+				}
+			}()
+			os.WriteFile(p.RunDir+"/fixture-write-input", nil, 0600)
+			action := ActionCreate
+			ceiling := uint64(MaxBoundedBytes)
+			if kind == "stream" || kind == "exists" || kind == "fsync-gap" {
+				action = ActionWriteStream
+				ceiling = 2 * MaxBoundedBytes
+			}
+			var args any = CreateArgs{Segments: []string{"write", "new"}, Bytes: ceiling, Exclusive: true}
+			if action == ActionWriteStream {
+				args = WriteStreamArgs{Segments: []string{"write", "new"}, MaxBytes: ceiling}
+			}
+			r := readOnlyVMRequest(t, g, action, args)
+			if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
+				t.Fatal(res)
+			}
+			m, c := writeVMResult(t, p, r)
+			if c != "" || !m.Created || m.BytesWritten != 0 {
+				t.Fatal(m, c)
+			}
+			if kind == "duplicate" {
+				r.Nonce = readOnlyVMRef(t)
+				r.Ticket = readOnlyVMRef(t)
+				if res := grantVMCall(t, p, "operation.start", r); res.Code != ErrReplay {
+					t.Fatal("retry not burned", res)
+				}
+			}
+			chunk := r
+			var chunkArgs any = CreateArgs{Segments: []string{"write", "new"}, Bytes: MaxChunkBytes, Exclusive: true}
+			if action == ActionWriteStream {
+				chunkArgs = WriteStreamArgs{Segments: []string{"write", "new"}, MaxBytes: MaxChunkBytes}
+			}
+			chunk.Args, _ = json.Marshal(chunkArgs)
+			for n := uint64(0); n < ceiling; n += MaxChunkBytes {
+				chunk.Nonce = readOnlyVMRef(t)
+				chunk.Ticket = readOnlyVMRef(t)
+				if res := grantVMCall(t, p, "operation.chunk", chunk); res.Code != "" {
+					t.Fatal(res)
+				}
+				m, c = writeVMResult(t, p, r)
+				if kind == "disk-full" && c == ErrPartial {
+					if m.BytesWritten == 0 || m.BytesWritten > 2*MaxChunkBytes || m.Committed {
+						t.Fatal(m, c)
+					}
+					return
+				}
+				if c != "" || m.BytesWritten != n+MaxChunkBytes {
+					t.Fatal(m, c)
+				}
+				if kind == "replacement" || kind == "revoke" {
+					break
+				}
+			}
+			switch kind {
+			case "replacement":
+				os.Rename("/tmp/m2-s5-operations/write/new", "/tmp/m2-s5-operations/write/moved")
+				os.WriteFile("/tmp/m2-s5-operations/write/new", []byte("foreign"), 0644)
+			case "fsync-gap":
+				os.WriteFile("/tmp/m2-s5-operations/publish-fsync-fail", nil, 0644)
+			case "exists":
+				os.WriteFile("/tmp/m2-s5-operations/write/new", []byte("foreign"), 0644)
+			case "revoke":
+				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+				store, _ := DecodeGrantStore(bytes.NewReader(raw))
+				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+				if res.Code != "" || res.Revoke == nil || !res.Revoke.Drained {
+					t.Fatal(res)
+				}
+				commit := r
+				commit.Nonce = readOnlyVMRef(t)
+				commit.Ticket = readOnlyVMRef(t)
+				if res := grantVMCall(t, p, "operation.commit", commit); res.Code == "" {
+					t.Fatal("commit after R")
+				}
+				return
+			}
+			commit := r
+			commit.Nonce = readOnlyVMRef(t)
+			commit.Ticket = readOnlyVMRef(t)
+			if action == ActionWriteStream {
+				commit.Op = ActionPublish
+				commit.Args, _ = json.Marshal(PublishArgs{StageID: r.OperationID, NoOverwrite: true})
+			}
+			if res := grantVMCall(t, p, "operation.commit", commit); res.Code != "" {
+				t.Fatal(res)
+			}
+			m, c = writeVMResult(t, p, r)
+			if kind == "fsync-gap" {
+				if c != ErrCommitUncertain || m.Committed || !m.Published {
+					t.Fatal(m, c)
+				}
+				if _, e := os.Stat("/tmp/m2-s5-operations/write/new"); e != nil {
+					t.Fatal("publish lost", e)
+				}
+				if _, e := os.Stat(p.StateDir + "/write-receipt-" + r.OperationID + ".json"); e != nil {
+					t.Fatal("uncertain receipt not retained", e)
+				}
+				return
+			}
+			if kind == "exists" || kind == "replacement" {
+				if c == "" || m.Committed {
+					t.Fatal(m, c)
+				}
+				b, _ := os.ReadFile("/tmp/m2-s5-operations/write/new")
+				if string(b) != "foreign" {
+					t.Fatal("foreign changed")
+				}
+				return
+			}
+			if c != "" || !m.Committed || !m.Published || m.BytesWritten != ceiling {
+				t.Fatal(m, c)
+			}
+			b, e := os.ReadFile("/tmp/m2-s5-operations/write/new")
+			if e != nil || !bytes.Equal(b, bytes.Repeat([]byte("w"), int(ceiling))) {
+				t.Fatal("wrong actor data", len(b), e)
+			}
+			info, _ := os.Stat("/tmp/m2-s5-operations/write/new")
+			_ = info
+			if kind == "inherited-acl" {
+				acl, e := exec.Command("getfacl", "-n", "/tmp/m2-s5-operations/write/new").CombinedOutput()
+				if e != nil || !bytes.Contains(acl, []byte("user:1002:r--")) {
+					t.Fatal(string(acl), e)
+				}
+			}
+			readStreamVMWait(t, func() bool { return len(processChildren(proc.PID)) == 1 })
+			m, c = writeVMResult(t, p, r)
+			if c != "" || !m.Committed {
+				t.Fatal("receipt lost after reap", m, c)
+			}
+			if kind == "commit-first" {
+				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+				store, _ := DecodeGrantStore(bytes.NewReader(raw))
+				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+				if res.Code != "" || !res.Revoke.Drained {
+					t.Fatal(res)
+				}
+				raw, _ = os.ReadFile(p.StateDir + "/grant-q-" + g.ID + ".json")
+				var q GrantQuiescence
+				if json.Unmarshal(raw, &q) != nil || q.Cohort == nil || q.Cohort.CommittedOperations != 1 || q.Cohort.BytesWritten != ceiling || q.Cohort.WriteEffectsUnknown {
+					t.Fatal("commit-before-R effects lost", q)
+				}
+			}
+		})
+	}
+}