@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_job.go

@@ -0,0 +1,697 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/hex"
+	"encoding/json"
+	"slices"
+	"time"
+)
+
+// This is an explicit in-process assembly seam, not an enabled dispatch entry.
+// Only the VM fixture calls it in S2. Keep cmd/helper/sdk_registry.go refusing.
+func newSDKJobOwner(s *supervisorGrants, compiled []byte, services sdkJobServices) (*sdkJobOwner, Code) {
+	if s == nil || s.cohort == nil || s.authority == nil || len(compiled) == 0 {
+		return nil, ErrUnavailable
+	}
+	r, why := DecodeSDKRegistry(compiled)
+	canonical, err := json.Marshal(r)
+	sum := sha256.Sum256(compiled)
+	i := s.cohort.inventory
+	if why != "" || err != nil || !bytes.Equal(canonical, compiled) || i.Protocol != DataProtocol || i.DataAccess != "relaxed" || i.RegistryDigest != hex.EncodeToString(sum[:]) || s.authority.policy.Inventory != i || s.authority.mu != &s.cohort.gate.mu {
+		return nil, ErrIncompatible
+	}
+	if services.Validator == nil || services.Journal == nil || services.Start == nil {
+		return nil, ErrUnavailable
+	}
+	if s.authority.sdkJobs != nil {
+		return nil, ErrBusy
+	}
+	o := &sdkJobOwner{grants: s, services: services, workers: map[string]jobcontract.Worker{}, jobs: map[string]*sdkJob{}, controls: map[string]bool{}}
+	origin := time.Now()
+	o.attachNow = func() time.Duration { return time.Since(origin) }
+	for _, w := range r.SDK {
+		o.workers[w.ID] = w
+	}
+	// One reservation table, one reaper, one observer/lifetime. Preserve the M2
+	// factory for its own operations; a job never runs as a nested M2 child.
+	s.authority.sdkJobs = o
+	previous := s.cohort.startChild
+	s.cohort.startChild = func(a NativeActor, b operationBinding) (operationProcess, error) {
+		j := o.jobs[b.OperationID]
+		if j == nil {
+			if previous == nil {
+				return nil, ErrUnavailable
+			}
+			return previous(a, b)
+		}
+		// Background credentials need a distinct S7 bootstrap. Never pass the
+		// old consent NativeActor through the interactive launcher.
+		if j.background != nil {
+			return nil, ErrUnavailable
+		}
+		if j.op == nil || j.op.binding != b || j.process != nil {
+			return nil, ErrDenied
+		}
+		p, err := services.Start(a, b, sdkJobPlan{j.request, j.worker, j.root})
+		j.process = p
+		return p, err
+	}
+	return o, ""
+}
+
+func sdkInventory(i Inventory) jobcontract.Inventory {
+	return jobcontract.Inventory{Package: i.Package, Version: i.Version, Protocol: i.Protocol, PayloadDigest: i.PayloadDigest, RegistryDigest: i.RegistryDigest, DataAccess: i.DataAccess}
+}
+func sdkCode(why jobcontract.SafeReason) Code {
+	code := Code(why)
+	if code == "" || code.Valid() {
+		return code
+	}
+	return ErrUnavailable
+}
+func cloneSDKRequest(r sdkJobRequest) (sdkJobRequest, Code) {
+	control, err := json.Marshal(r.Control)
+	if err != nil {
+		return sdkJobRequest{}, ErrInvalid
+	}
+	c, why := jobcontract.DecodeControl(bytes.NewReader(control))
+	if why != "" {
+		return sdkJobRequest{}, sdkCode(why)
+	}
+	input, err := json.Marshal(r.Input)
+	if err != nil {
+		return sdkJobRequest{}, ErrInvalid
+	}
+	in, why := jobcontract.DecodeInput(bytes.NewReader(input))
+	if why != "" {
+		return sdkJobRequest{}, sdkCode(why)
+	}
+	return sdkJobRequest{c, in}, ""
+}
+func (o *sdkJobOwner) request(r sdkJobRequest) (sdkJobRequest, jobcontract.Worker, Code) {
+	r, code := cloneSDKRequest(r)
+	if code != "" {
+		return r, jobcontract.Worker{}, code
+	}
+	b := r.Control.Binding
+	p := o.grants.authority.policy
+	if r.Control.Op != "jobs.submit" || b.Mode != jobcontract.Interactive || b.Delegation != nil {
+		return r, jobcontract.Worker{}, ErrUnsupported
+	}
+	if b.Inventory != sdkInventory(p.Inventory) || b.Epoch != p.Epoch || b.ApprovalBinding != p.ApprovalBinding || b.CapabilityDigest != p.CapabilityDigest {
+		return r, jobcontract.Worker{}, ErrIncompatible
+	}
+	w, ok := o.workers[b.Worker.ID]
+	if !ok || b.Worker.Revision != w.Revision || b.InputSchemaDigest != w.InputSchemaDigest {
+		return r, w, ErrIncompatible
+	}
+	if why := jobcontract.ValidatePlan(w, r.Input, jobcontract.Interactive); why != "" {
+		return r, w, sdkCode(why)
+	}
+	digest, why := jobcontract.InputDigest(r.Input, w.InputSchemaDigest)
+	if why != "" || digest != b.InputDigest {
+		return r, w, ErrInvalid
+	}
+	return r, w, ""
+}
+
+// Observations outside admission/storage locks, followed by the existing
+// authority transaction. Always compare against the original interactive actor.
+func (o *sdkJobOwner) validate(ctx context.Context, j *sdkJob, cp sdkJobCheckpoint) (NativeActor, sdkJobProof, Code) {
+	s := o.grants
+	var old *NativeActor
+	if j.actor.valid {
+		old = &j.actor
+	}
+	a, code := s.authority.actor(ctx, j.carriers, old)
+	if code != "" {
+		return NativeActor{}, sdkJobProof{}, code
+	}
+	if a.IdentityBasis() != "uid-username" || a.UID() == 0 || a.GID() == 0 || a.account.Groups == nil {
+		return NativeActor{}, sdkJobProof{}, ErrDenied
+	}
+	b := j.request.Control.Binding
+	step := cp.Step
+	if step >= uint64(len(j.request.Input.Steps)) {
+		step = uint64(len(j.request.Input.Steps) - 1)
+	}
+	action := Action(j.request.Input.Steps[step].Action)
+	g, code := s.authority.grantForActor(a, DataRequest{GrantID: b.ParentGrant.ID, GrantRevision: b.ParentGrant.Revision, Op: action})
+	if code != "" {
+		return NativeActor{}, sdkJobProof{}, code
+	}
+	proof, code := o.services.Validator.ValidateJob(ctx, a, j.request, g, cp)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		return NativeActor{}, sdkJobProof{}, code
+	}
+	a, code = s.authority.actor(ctx, j.carriers, &a)
+	if code != "" {
+		return NativeActor{}, sdkJobProof{}, code
+	}
+	now := s.cohort.now()
+	if jobcontract.CompareBinding(proof.Binding, b) != "" || proof.Intent != j.request.Control.Intent || proof.Principal != a.Principal() || proof.SessionRef != a.SessionRef() || proof.Nonce != j.request.Control.Nonce || proof.Ticket != j.request.Control.Ticket || !nativeFresh(proof.CheckedAt, now) || !now.Before(proof.ExpiresAt) || proof.ExpiresAt.Sub(now) > IntentTTL || proof.Root == nil {
+		return NativeActor{}, sdkJobProof{}, ErrDenied
+	}
+	if j.root != nil && !j.root.sameReadOnlyRoot(proof.Root) {
+		return NativeActor{}, sdkJobProof{}, ErrSuspended
+	}
+	return a, proof, ""
+}
+func (o *sdkJobOwner) admission(j *sdkJob, a NativeActor, p sdkJobProof, step uint64, reserve func() Code) Code {
+	if step >= uint64(len(j.request.Input.Steps)) {
+		step = uint64(len(j.request.Input.Steps) - 1)
+	}
+	b := j.request.Control.Binding
+	return o.grants.authority.WithGrantAdmission(GrantAdmission{a, b.ParentGrant.ID, b.ParentGrant.Revision, Action(j.request.Input.Steps[step].Action), p.Continuity, p.Continuous}, func(g Grant, a NativeActor) Code {
+		// Intent fsync and authority lock acquisition may have consumed the
+		// remaining proof lifetime. The original observation cannot be refreshed
+		// by a newer actor lookup or by completing the durable write.
+		now := o.grants.cohort.now()
+		if !j.terminal && j.background == nil && o.attachExpired(j) {
+			return ErrExpired
+		}
+		if !now.Before(p.ExpiresAt) {
+			return ErrExpired
+		}
+		if !nativeFresh(p.CheckedAt, now) {
+			return ErrStale
+		}
+		for _, s := range j.request.Input.Steps {
+			if !slices.Contains(g.Actions, Action(s.Action)) {
+				return ErrDenied
+			}
+		}
+		if !o.grants.cohort.allowed() {
+			return ErrFenced
+		}
+		return reserve()
+	})
+}
+func (o *sdkJobOwner) capacity(a NativeActor) Code {
+	c := o.grants.cohort
+	count := 0
+	for _, op := range c.operations {
+		if op.actor.UID() == a.UID() {
+			count++
+		}
+	}
+	if len(c.operations) >= jobcontract.MaxChildren || count >= jobcontract.MaxUIDChildren {
+		return ErrBusy
+	}
+	return ""
+}
+
+func (o *sdkJobOwner) submit(ctx context.Context, peer operationPeer, carriers SessionCarriers, request sdkJobRequest) Code {
+	c := o.grants.cohort
+	if !c.peerAllowed(peer) {
+		return ErrDenied
+	}
+	r, w, code := o.request(request)
+	if code != "" {
+		return code
+	}
+	b := r.Control.Binding
+	if o.jobs[b.Job.ID] != nil || o.controls["n:"+r.Control.Nonce] || o.controls["t:"+r.Control.Ticket] || o.controls["i:"+r.Control.Intent.ID] {
+		return ErrReplay
+	}
+	if len(o.jobs) >= jobcontract.MaxExecutionKeys || len(o.controls) >= 3*jobcontract.MaxMutationControls {
+		return ErrBusy
+	}
+	total := uint64(len(r.Input.Steps))
+	j := &sdkJob{request: r, worker: w, carriers: carriers, counters: jobcontract.Result{ResultSchema: 1}, receipt: sdkJobReceipt{Job: jobcontract.Job{Binding: b, State: jobcontract.Pending, AcceptedAt: uint64(c.now().UnixMilli()), Progress: jobcontract.Progress{Phase: "starting", TotalUnits: &total}}}}
+	a, p, code := o.validate(ctx, j, sdkJobCheckpoint{Phase: "submit"})
+	if code != "" {
+		return code
+	}
+	// Busy submission does not silently become a persistent pending queue.
+	c.gate.mu.Lock()
+	code = o.capacity(a)
+	if !c.allowed() {
+		code = ErrFenced
+	}
+	c.gate.mu.Unlock()
+	if code != "" {
+		return code
+	}
+	j.actor, j.root = a, p.Root
+	if code := o.issueAttach(j); code != "" {
+		return code
+	}
+	o.jobs[b.Job.ID] = j
+	o.controls["n:"+r.Control.Nonce], o.controls["t:"+r.Control.Ticket] = true, true
+	o.controls["i:"+r.Control.Intent.ID] = true
+	intent := sdkJobIntent{r, jobcontract.Principal{IdentityBasis: "uid-username", UID: a.UID(), Username: a.Username()}, a.SessionRef()}
+	if code = o.services.Journal.Reserve(intent); code != "" {
+		c.gate.fence("sdk-job-journal-uncertain")
+		j.journalUncertain = true
+		o.uncertain(j)
+		return code
+	}
+	code = o.admission(j, a, p, 0, func() Code {
+		if o.attachExpired(j) {
+			return ErrExpired
+		}
+		if ctx.Err() != nil {
+			return nativeContextCode(ctx)
+		}
+		if code := o.capacity(a); code != "" {
+			return code
+		}
+		binding := operationBinding{c.inventory, c.epoch, b.Job.ID, r.Control.Nonce, b.ParentGrant.ID, b.ParentGrant.Revision}
+		op, code := c.reserveLocked(a, binding)
+		if code != "" {
+			return code
+		}
+		// Use the existing long-operation lifetime envelope (120s/10s idle).
+		// This marker never enters the M2 I/O factory: the router above sends only
+		// the immutable SDK plan to the fixed child. Per-worker limits narrow it.
+		op.work = &readOnlyWork{Action: ActionReadStream}
+		op.maxBytes = w.Limits.StreamBytes
+		j.op = op
+		j.lastCheckpoint = c.now()
+		return ""
+	})
+	if code != "" {
+		j.failure = code
+		o.finish(j)
+		return code
+	}
+	code = c.launchReserved(j.op)
+	if code != "" {
+		o.reject(j, code)
+		if j.process == nil {
+			o.finish(j)
+		}
+	}
+	return code
+}
+
+func (o *sdkJobOwner) reject(j *sdkJob, code Code) {
+	if j.terminal {
+		return
+	}
+	if j.failure == "" {
+		j.failure = code
+	}
+	if j.op != nil {
+		j.op.canceled = true
+		if j.op.process != nil {
+			j.op.process.stopRelay()
+		}
+	}
+	j.receipt.Result = nil
+}
+func (o *sdkJobOwner) uncertain(j *sdkJob) {
+	j.receipt.Job.State = jobcontract.CleanupRequired
+	j.receipt.Job.Reason = jobcontract.ReasonCleanupRequired
+	j.receipt.Job.Drained = false
+	j.receipt.Job.FinishedAt = nil
+	j.receipt.Result = nil
+	j.failure = ErrCleanupRequired
+	j.carriers = SessionCarriers{}
+}
+func (o *sdkJobOwner) checkpoint(ctx context.Context, j *sdkJob, cp sdkJobCheckpoint) Code {
+	if cp.Step != j.step {
+		return ErrInvalid
+	}
+	switch cp.Phase {
+	case "before-step":
+		if j.stepOpen || j.step >= uint64(len(j.request.Input.Steps)) || cp.Bytes != 0 {
+			return ErrInvalid
+		}
+	case "before-chunk":
+		if !j.stepOpen || j.step >= uint64(len(j.request.Input.Steps)) || cp.Bytes == 0 || uint64(cp.Bytes) > j.worker.Limits.ChunkBytes {
+			return ErrInvalid
+		}
+		s := j.request.Input.Steps[j.step]
+		if s.Action != jobcontract.Read && s.Action != jobcontract.ReadStream {
+			return ErrInvalid
+		}
+		if uint64(cp.Bytes) > *s.MaxBytes || j.stepAdmitted > *s.MaxBytes-uint64(cp.Bytes) || j.admitted > j.worker.Limits.StreamBytes-uint64(cp.Bytes) {
+			return ErrLimit
+		}
+	case "before-result":
+		if j.stepOpen || j.step != uint64(len(j.request.Input.Steps)) || j.resultAllowed || cp.Bytes != 0 {
+			return ErrInvalid
+		}
+	default:
+		return ErrInvalid
+	}
+	a, p, code := o.validate(ctx, j, cp)
+	if code != "" {
+		return code
+	}
+	code = o.admission(j, a, p, cp.Step, func() Code {
+		if j.op.canceled || j.failure != "" {
+			return ErrCanceled
+		}
+		j.actor = a
+		j.op.actor = a
+		switch cp.Phase {
+		case "before-step":
+			j.stepOpen = true
+			j.stepAdmitted = 0
+		case "before-chunk":
+			j.admitted += uint64(cp.Bytes)
+			j.stepAdmitted += uint64(cp.Bytes)
+			j.op.bytes = j.admitted
+		case "before-result":
+			j.resultAllowed = true
+		}
+		j.lastCheckpoint = o.grants.cohort.now()
+		j.op.lastActivity = j.lastCheckpoint
+		return ""
+	})
+	if code != "" {
+		return code
+	}
+	deadline := a.account.CheckedAt.Add(NativeProofFreshness)
+	if d := p.CheckedAt.Add(NativeProofFreshness); d.Before(deadline) {
+		deadline = d
+	}
+	if !o.grants.cohort.now().Before(deadline) {
+		return ErrStale
+	}
+	if j.process.reply(sdkJobReply{Deadline: deadline.UnixNano()}) != nil {
+		return ErrCleanupRequired
+	}
+	return ""
+}
+func (o *sdkJobOwner) event(ctx context.Context, j *sdkJob, e sdkJobEvent) Code {
+	if j.failure != "" || j.op == nil || j.op.canceled {
+		return ErrCanceled
+	}
+	if e.Kind != "ready" && j.receipt.Job.State != jobcontract.Running {
+		return ErrInvalid
+	}
+	if e.Kind != "checkpoint" && e.Checkpoint != (sdkJobCheckpoint{}) {
+		return ErrInvalid
+	}
+	if e.Kind != "progress" && e.Progress != nil {
+		return ErrInvalid
+	}
+	if e.Kind != "step-result" && e.Kind != "result" && e.Result != nil {
+		return ErrInvalid
+	}
+	switch e.Kind {
+	case "ready":
+		if j.receipt.Job.State != jobcontract.Pending {
+			return ErrInvalid
+		}
+		now := uint64(o.grants.cohort.now().UnixMilli())
+		j.receipt.Job.StartedAt = &now
+		j.receipt.Job.State = jobcontract.Running
+	case "checkpoint":
+		return o.checkpoint(ctx, j, e.Checkpoint)
+	case "step-result":
+		if !j.stepOpen || e.Result == nil || jobcontract.ValidateResult(*e.Result) != "" {
+			return ErrInvalid
+		}
+		r := *e.Result
+		if r.SafeReason != "" {
+			return sdkCode(r.SafeReason)
+		}
+		s := j.request.Input.Steps[j.step]
+		entries := uint64(0)
+		if s.Action == jobcontract.Stat {
+			entries = 1
+		}
+		if s.Action == jobcontract.List {
+			entries = *s.Limit
+		}
+		if r.CompletedSteps != 1 || r.Entries > entries || r.BytesRead != j.stepAdmitted {
+			return ErrInvalid
+		}
+		j.counters.CompletedSteps++
+		j.counters.Entries += r.Entries
+		j.counters.BytesRead += r.BytesRead
+		j.step++
+		j.stepOpen = false
+	case "progress":
+		if e.Progress == nil || jobcontract.ValidateProgress(*e.Progress, j.lastSeenProgress) != "" {
+			return ErrInvalid
+		}
+		p := *e.Progress
+		if p.CompletedUnits > uint64(len(j.request.Input.Steps)) || p.BytesRead > j.admitted || p.TotalUnits != nil && *p.TotalUnits != uint64(len(j.request.Input.Steps)) {
+			return ErrInvalid
+		}
+		raw, _ := json.Marshal(p)
+		if len(raw) > jobcontract.MaxProgressBytes {
+			return ErrLimit
+		}
+		if p.TotalUnits != nil {
+			n := *p.TotalUnits
+			p.TotalUnits = &n
+		}
+		j.lastSeenProgress = &p
+		if j.progressPackets < jobcontract.MaxProgressPackets {
+			j.progressPackets++
+			now := o.grants.cohort.now()
+			if j.lastProgress.IsZero() || now.Sub(j.lastProgress) >= time.Second {
+				j.receipt.Job.Progress = p
+				j.lastProgress = now
+				j.progress = append(j.progress, p)
+				if len(j.progress) > jobcontract.MaxProgressRing {
+					j.progress = j.progress[1:]
+				}
+			}
+		}
+	case "result":
+		if !j.resultAllowed || j.resultReceived || e.Result == nil || *e.Result != j.counters {
+			return ErrInvalid
+		}
+		j.resultReceived = true
+	default:
+		return ErrInvalid
+	}
+	if j.process.reply(sdkJobReply{}) != nil {
+		return ErrCleanupRequired
+	}
+	return ""
+}
+
+// Bounded owner-loop work. Progress cannot refresh idle deadlines. It does not
+// signal on an observer fence: the existing supervisor persists lifecycle denial
+// before it drains, preserving the M1 ordering and lifetime witness.
+func (o *sdkJobOwner) poll(ctx context.Context) Code {
+	if o.session != nil {
+		return o.session.poll()
+	}
+	if b := o.grants.authority.sdkBackground; b != nil {
+		if c := b.poll(ctx); c != "" {
+			return c
+		}
+	}
+	c := o.grants.cohort
+	if !c.gate.allow(c.now()) || !c.peerAllowed(operationPeer{c.helperPID, 0}) {
+		for _, j := range o.jobs {
+			if !j.terminal {
+				o.reject(j, ErrFenced)
+			}
+		}
+		return ErrFenced
+	}
+	for _, j := range o.jobs {
+		if j.background != nil || j.terminal || j.op == nil || j.process == nil {
+			continue
+		}
+		if o.attachExpired(j) {
+			if code := o.cancelOwned(ctx, j); code != "" {
+				return code
+			}
+			continue
+		}
+		now := c.now()
+		if now.Before(j.op.admittedAt) || now.Before(j.lastCheckpoint) || now.Sub(j.op.admittedAt) >= time.Duration(j.worker.Limits.TotalMS)*time.Millisecond || now.Sub(j.lastCheckpoint) >= time.Duration(j.worker.Limits.IdleMS)*time.Millisecond {
+			o.reject(j, ErrTimeout)
+		}
+		if j.failure == "" && !j.op.canceled {
+			if e, ok := j.process.next(); ok {
+				if code := o.event(ctx, j, e); code != "" {
+					if o.attachExpired(j) {
+						if cancelCode := o.cancelOwned(ctx, j); cancelCode != "" {
+							return cancelCode
+						}
+					} else {
+						o.reject(j, code)
+					}
+				}
+			}
+			if j.failure == "" && now.Sub(j.actor.account.CheckedAt) >= NativeProofFreshness {
+				a, p, code := o.validate(ctx, j, sdkJobCheckpoint{Phase: "observe", Step: j.step})
+				if code == "" {
+					code = o.admission(j, a, p, j.step, func() Code { j.actor = a; return "" })
+				}
+				if code != "" {
+					o.reject(j, code)
+				}
+			}
+		}
+	}
+	if err := c.poll(); err != nil {
+		c.gate.fence("sdk-job-drain-unknown")
+		for _, j := range o.jobs {
+			if !j.terminal && j.op != nil {
+				o.reject(j, ErrCleanupRequired)
+				o.uncertain(j)
+			}
+		}
+		return ErrCleanupRequired
+	}
+	for id, j := range o.jobs {
+		if j.background != nil || j.terminal || j.op == nil {
+			continue
+		}
+		if _, retired := c.receipts[id]; retired {
+			if j.failure == "" && j.op.canceled {
+				o.reject(j, ErrCanceled)
+			}
+			if j.failure == "" && (!j.resultReceived || !j.process.exitSuccess()) {
+				o.reject(j, ErrUnavailable)
+			}
+			if j.failure == "" {
+				a, p, code := o.validate(ctx, j, sdkJobCheckpoint{Phase: "finish", Step: j.step})
+				if code == "" {
+					code = o.admission(j, a, p, j.step, func() Code { return "" })
+				}
+				if code != "" {
+					o.reject(j, code)
+				}
+			}
+			o.finish(j)
+		}
+	}
+	return ""
+}
+
+// The sole owner serializes cancel and finish. Observer fencing shares this
+// mutex; bounded journal I/O runs without any GrantRepository transaction lock.
+func (o *sdkJobOwner) finish(j *sdkJob) {
+	if j.terminal {
+		return
+	}
+	if j.journalUncertain {
+		o.uncertain(j)
+		return
+	}
+	c := o.grants.cohort
+	c.gate.mu.Lock()
+	defer c.gate.mu.Unlock()
+	if j.process != nil {
+		if _, ok := c.receipts[j.request.Control.Binding.Job.ID]; !ok {
+			return
+		}
+	}
+	if j.failure == "" && !c.allowed() {
+		j.failure = ErrFenced
+	}
+	r := j.receipt
+	now := uint64(c.now().UnixMilli())
+	if now < r.Job.AcceptedAt || r.Job.StartedAt != nil && now < *r.Job.StartedAt {
+		c.gate.fenceLocked("sdk-job-clock-rollback")
+		o.uncertain(j)
+		j.terminal = true
+		return
+	}
+	r.Job.FinishedAt = &now
+	r.Job.Drained = true
+	switch {
+	case r.Job.CancelRequested:
+		r.Job.State = jobcontract.Canceled
+		r.Job.Reason = jobcontract.ReasonCanceled
+	case j.failure != "":
+		r.Job.State = jobcontract.Failed
+		r.Job.Reason = jobcontract.SafeReason(j.failure)
+	default:
+		r.Job.State = jobcontract.Succeeded
+		r.Job.Reason = ""
+		value := j.counters
+		r.Result = &value
+	}
+	if jobcontract.ValidateJob(r.Job) != "" || o.services.Journal.Finish(r) != "" {
+		c.gate.fenceLocked("sdk-job-journal-uncertain")
+		j.journalUncertain = true
+		o.uncertain(j)
+		j.terminal = true
+		return
+	}
+	j.receipt = r
+	j.terminal = true
+	j.carriers = SessionCarriers{}
+}
+func (o *sdkJobOwner) cancel(ctx context.Context, peer operationPeer, carriers SessionCarriers, b jobcontract.Binding) Code {
+	c := o.grants.cohort
+	if !c.peerAllowed(peer) {
+		return ErrDenied
+	}
+	j := o.jobs[b.Job.ID]
+	if j == nil || jobcontract.CompareBinding(b, j.request.Control.Binding) != "" {
+		return ErrDenied
+	}
+	a, code := o.grants.authority.actor(ctx, carriers, nil)
+	if code != "" {
+		return code
+	}
+	if a.Principal() != j.actor.Principal() {
+		return ErrDenied
+	}
+	return o.cancelOwned(ctx, j)
+}
+
+// S7's trusted transport EOF/Abort watcher calls this with the binding captured
+// at submit, never a new caller-supplied ID. No fresh login is needed to stop an
+// already-owned job; otherwise logout could prevent interactive cancellation.
+// The watcher must finish before S7 publishes its transport-level Q.
+func (o *sdkJobOwner) disconnect(ctx context.Context, b jobcontract.Binding) Code {
+	j := o.jobs[b.Job.ID]
+	if j == nil || jobcontract.CompareBinding(b, j.request.Control.Binding) != "" {
+		return ErrDenied
+	}
+	if j.background != nil {
+		return ""
+	} // explicit background consent survives transport EOF
+	return o.cancelOwned(ctx, j)
+}
+
+func (o *sdkJobOwner) cancelOwned(ctx context.Context, j *sdkJob) Code {
+	if j.background != nil {
+		return ErrUnsupported
+	} // use background.revoke with authority CAS
+	c := o.grants.cohort
+	b := j.request.Control.Binding
+	if j.terminal {
+		return ErrStale
+	}
+	c.gate.mu.Lock()
+	j.receipt.Job.CancelRequested = true
+	j.receipt.Job.State = jobcontract.CancelRequested
+	o.reject(j, ErrCanceled)
+	code := o.services.Journal.Cancel(b)
+	if code != "" {
+		c.gate.fenceLocked("sdk-job-journal-uncertain")
+		j.journalUncertain = true
+		o.uncertain(j)
+	}
+	c.gate.mu.Unlock()
+	// Denial is latched even if cancel durability failed. Do not claim accepted
+	// or drained; still try to stop the already-owned child outside all locks.
+	drainCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
+	defer cancel()
+	err := c.drainSelected(drainCtx, TerminateGrace, func(op *cohortOperation) bool { return op == j.op })
+	if code != "" || err != nil {
+		c.gate.fence("sdk-job-drain-unknown")
+		o.uncertain(j)
+		return ErrCleanupRequired
+	}
+	o.finish(j)
+	if !j.receipt.Job.Drained {
+		return ErrCleanupRequired
+	}
+	return ""
+}