@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/publication_test.go

@@ -0,0 +1,178 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// An approval rename is visible before the publisher's directory fsync and
+// policy.lock release. Reproduce that interval with real files and flock.
+func heldCompletion(t *testing.T, c Controller, f *fakeProcesses) (<-chan error, func()) {
+	t.Helper()
+	published := make(chan error, 1)
+	var lock *os.File
+	f.stopHook = func(p Process) error {
+		var err error
+		lock, err = os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_RDWR, 0)
+		if err == nil {
+			err = syscall.Flock(int(lock.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
+		}
+		if err == nil {
+			err = cleanRuntime(c.Client, true)
+		}
+		if err == nil {
+			var r Record
+			r, err = readRecord(c.StateDir, c.Owner)
+			if err == nil {
+				r.Lifecycle.Phase = "stopped"
+				err = storeCompletion(c.Client, &r, Completion{Epoch: r.Lifecycle.Epoch, Process: p})
+				if err == nil {
+					err = writeProtected(c.StateDir, "approval.json", r)
+				}
+			}
+		}
+		published <- err
+		return errTrust // owner completed before the controller socket operation
+	}
+	release := func() {
+		if lock != nil {
+			syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
+			lock.Close()
+			lock = nil
+		}
+	}
+	return published, release
+}
+
+func TestControllerWaitsForCompletionPublisherUnlock(t *testing.T) {
+	for _, action := range []string{"teardown", "disable", "recover", "enable"} {
+		t.Run(action, func(t *testing.T) {
+			c, f := controlFixture(t)
+			published, release := heldCompletion(t, c, f)
+			defer release()
+			result := make(chan error, 1)
+			go func() { result <- c.Control(context.Background(), action) }()
+			if err := <-published; err != nil {
+				t.Fatal(err)
+			}
+			select {
+			case err := <-result:
+				t.Fatalf("returned before the completion publisher unlocked: %v", err)
+			case <-time.After(100 * time.Millisecond):
+			}
+			release()
+			select {
+			case err := <-result:
+				if err != nil {
+					t.Fatal("exact owner completion refused after unlock", err)
+				}
+			case <-time.After(2 * time.Second):
+				t.Fatal("controller did not finish after publisher unlock")
+			}
+			r, _ := readRecord(c.StateDir, c.Owner)
+			starts := 0
+			if action == "enable" || action == "recover" {
+				starts = 1
+			}
+			if r.Residual || r.Enabled != (action != "disable") || f.started != starts {
+				t.Fatal("incorrect post-teardown state", r, f.started)
+			}
+		})
+	}
+}
+
+func TestControllerRevalidatesCompletionAfterPublisherUnlock(t *testing.T) {
+	for _, kind := range []string{"epoch", "inventory", "binding", "lease", "proof", "digest", "missing-commit", "missing-proof", "mode", "symlink", "runtime"} {
+		t.Run(kind, func(t *testing.T) {
+			c, f := controlFixture(t)
+			published, release := heldCompletion(t, c, f)
+			defer release()
+			result := make(chan error, 1)
+			go func() { result <- c.Control(context.Background(), "recover") }()
+			if err := <-published; err != nil {
+				t.Fatal(err)
+			}
+			select {
+			case err := <-result:
+				t.Fatalf("returned before revalidation: %v", err)
+			case <-time.After(100 * time.Millisecond):
+			}
+			r, _ := readRecord(c.StateDir, c.Owner)
+			switch kind {
+			case "epoch":
+				r.Lifecycle.Epoch = strings.Repeat("e", 64)
+			case "inventory":
+				r.Inventory.Version = "9.0.0-0001"
+			case "binding":
+				r.Lifecycle.Binding.Entered++
+			case "lease":
+				r.Lifecycle.Lease = &Lease{Device: 1, Inode: 9}
+			case "proof":
+				p := f.current
+				p.Start = "different-owned-process"
+				if err := storeCompletion(c.Client, &r, Completion{Epoch: r.Lifecycle.Epoch, Process: p}); err != nil {
+					t.Fatal(err)
+				}
+			case "digest":
+				r.Lifecycle.Completion = strings.Repeat("f", 64)
+			case "missing-commit":
+				r.Lifecycle.Completion = ""
+			case "missing-proof", "mode", "symlink":
+				path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+				var err error
+				if kind == "mode" {
+					err = os.Chmod(path, 0644)
+				} else {
+					err = os.Remove(path)
+					if err == nil && kind == "symlink" {
+						err = os.Symlink("approval.json", path)
+					}
+				}
+				if err != nil {
+					t.Fatal(err)
+				}
+			case "runtime":
+				if err := writeProcess(c.RunDir, f.current); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+				t.Fatal(err)
+			}
+			before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			release()
+			if err := <-result; err == nil || f.started != 0 {
+				t.Fatal("changed completion accepted", err, f.started)
+			}
+			after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			if string(before) != string(after) {
+				t.Fatal("failure evidence overwritten")
+			}
+		})
+	}
+}
+
+func TestControllerCompletionPublisherWaitIsBounded(t *testing.T) {
+	c, f := controlFixture(t)
+	published, release := heldCompletion(t, c, f)
+	defer release()
+	result := make(chan error, 1)
+	go func() { result <- c.Control(context.Background(), "teardown") }()
+	if err := <-published; err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case err := <-result:
+		if !errors.Is(err, errBusy) {
+			t.Fatal("persistent publisher lock was accepted", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("unbounded publisher lock wait")
+	}
+}

package/dist/templates/native-go/backend/internal/helper/query_deadline_linux_test.go

@@ -0,0 +1,115 @@
+package helper
+
+import (
+	"context"
+	"github.com/godbus/dbus/v5"
+	"testing"
+	"time"
+)
+
+// Shared systemd congestion caused by Alpha's upgrade must not kill Beta.
+// A real 500ms context expiry exercises the same GetUnit/GetAll error path.
+func TestLinuxQueryDeadlineCrossPackageRecovery(t *testing.T) {
+	for _, name := range []string{"Alpha", "Beta"} {
+		t.Run(name, func(t *testing.T) {
+			for _, phase := range []string{"get-unit", "get-all"} {
+				t.Run(phase, func(t *testing.T) {
+					o := diagnosticObserver(t)
+					o.unit = "pkgctl-" + name + ".service"
+					ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
+					defer cancel()
+					err := o.reconcileSnapshot(ctx, func(ctx context.Context) (Binding, map[string]dbus.Variant, error) {
+						<-ctx.Done()
+						return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: ctx.Err(), phase: phase}
+					})
+					if err != nil || o.gate.readiness(time.Now()) != "query-revalidating" || o.gate.allow(time.Now()) {
+						t.Fatalf("temporary deadline fenced instead of pending: %v %+v", err, o.gate.observerDiagnostic(""))
+					}
+					time.Sleep(250 * time.Millisecond)
+					if err := o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+						return testBinding(), activeUnitValues(o), nil
+					}); err != nil || !o.gate.allow(time.Now()) {
+						t.Fatalf("unchanged snapshot did not recover: %v", err)
+					}
+				})
+			}
+		})
+	}
+}
+
+func TestLinuxQueryDeadlineBoundAndStickyFence(t *testing.T) {
+	o := diagnosticObserver(t)
+	start := time.Now()
+	timeout := func(context.Context) (Binding, map[string]dbus.Variant, error) {
+		return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: context.DeadlineExceeded, phase: "get-unit"}
+	}
+	if err := o.reconcileSnapshot(context.Background(), timeout); err != nil {
+		t.Fatal("first deadline fenced", err)
+	}
+	for n := 0; n < 3; n++ {
+		if err := o.reconcileSnapshot(context.Background(), timeout); err != nil {
+			t.Fatal("retry fenced", err)
+		}
+	}
+	if o.gate.readiness(start.Add(2900*time.Millisecond)) != "query-revalidating" {
+		t.Fatal("missing bounded pending")
+	}
+	if !o.gate.fenced(start.Add(3100*time.Millisecond)) || o.gate.observerDiagnostic("").Fence.Detail != "query-deadline" {
+		t.Fatal("query budget extended", o.gate.observerDiagnostic(""))
+	}
+	_ = o.observeValues(testBinding(), activeUnitValues(o), o.gate.unitSerial, time.Now())
+	if o.gate.allow(time.Now()) {
+		t.Fatal("fence resurrected")
+	}
+}
+
+func TestLinuxQueryDeadlineCannotExtendReloadOrHideIdentity(t *testing.T) {
+	for _, kind := range []string{"reload-first", "query-first", "identity", "cancel", "initial"} {
+		t.Run(kind, func(t *testing.T) {
+			o := diagnosticObserver(t)
+			now := time.Now()
+			if kind == "initial" {
+				o.gate = newAdmission(testBinding())
+			}
+			if kind == "reload-first" {
+				o.gate.requestUnitCheck(true, now.Add(-9500*time.Millisecond))
+				o.gate.requestUnitCheck(false, now)
+			}
+			err := o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+				return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: context.DeadlineExceeded, phase: "get-all"}
+			})
+			if kind == "initial" {
+				if err == nil {
+					t.Fatal("initial failure acquired authority")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal("deadline fenced early", err)
+			}
+			switch kind {
+			case "query-first":
+				o.gate.requestUnitCheck(true, now.Add(time.Second))
+				if !o.gate.fenced(now.Add(3100 * time.Millisecond)) {
+					t.Fatal("reload extended query budget")
+				}
+			case "reload-first":
+				if !o.gate.fenced(now.Add(3100 * time.Millisecond)) {
+					t.Fatal("query extended verification")
+				}
+			case "identity":
+				v := activeUnitValues(o)
+				v["ActiveEnterTimestampMonotonic"] = dbus.MakeVariant(uint64(999))
+				if o.observeValues(testBinding(), v, o.gate.unitSerial, time.Now()) == nil {
+					t.Fatal("changed identity accepted")
+				}
+			case "cancel":
+				if o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+					return Binding{}, nil, context.Canceled
+				}) == nil {
+					t.Fatal("cancel retried")
+				}
+			}
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/helper/query_pending_diagnostic_test.go

@@ -0,0 +1,254 @@
+package helper
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestQueryPendingDiagnosticSnapshotIsBoundedAndDetached(t *testing.T) {
+	g := newAdmission(testBinding())
+	now := time.Now().In(time.FixedZone("fixture", 8*60*60))
+	g.queryPending = &observerQueryPending{StartedAt: now, PendingAt: now.Add(500 * time.Millisecond), Outcome: "pending", Phase: "get-unit", ErrorClass: "deadline"}
+	for n := 0; n < observerEventLimit+20; n++ {
+		g.recordObserver(observerEvent{Kind: "query-phase"})
+	}
+	d := g.observerDiagnostic(strings.Repeat("e", 64))
+	if d.QueryPending == nil || !d.QueryPending.StartedAt.Equal(now) {
+		t.Fatalf("missing pinned period: %+v", d)
+	}
+	if d.QueryPending.StartedAt.Location() != time.UTC || d.QueryPending.PendingAt.Location() != time.UTC {
+		t.Fatal("diagnostic timestamps are not UTC")
+	}
+	d.QueryPending.Outcome = "mutated"
+	if g.observerDiagnostic(d.Epoch).QueryPending.Outcome != "pending" {
+		t.Fatal("snapshot aliases period")
+	}
+	payload, err := json.Marshal(d)
+	if err != nil || len(payload) > observerDiagnosticLimit {
+		t.Fatalf("size %d: %v", len(payload), err)
+	}
+	var decoded observerDiagnostic
+	if err := json.Unmarshal(payload, &decoded); err != nil || decoded.QueryPending == nil || !decoded.QueryPending.StartedAt.Equal(now) {
+		t.Fatalf("period roundtrip: %+v %v", decoded, err)
+	}
+}
+
+func TestQueryPendingDiagnosticPeriodLifecycle(t *testing.T) {
+	for _, outcome := range []string{"ready", "fence", "signal-fence", "reload-fence"} {
+		t.Run(outcome, func(t *testing.T) {
+			start := time.Now()
+			g := newAdmission(testBinding())
+			g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+			e := observerEvent{Phase: "get-owner", ErrorClass: "deadline", QuerySerial: 0}
+			if !g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), e) {
+				t.Fatal("first timeout fenced")
+			}
+			first := g.observerDiagnostic("").QueryPending
+			if first == nil || !first.StartedAt.Equal(start) || !first.PendingAt.Equal(start.Add(500*time.Millisecond)) || first.Outcome != "pending" || first.Phase != "get-owner" || first.ElapsedNS != 0 {
+				t.Fatalf("wrong first query: %+v", first)
+			}
+			e.Phase = "get-all"
+			if !g.deferUnitDeadline(0, start.Add(750*time.Millisecond), start.Add(time.Second), e) {
+				t.Fatal("retry fenced")
+			}
+			for n := 0; n < observerEventLimit+20; n++ {
+				g.recordObserver(observerEvent{Kind: "query-phase"})
+			}
+			end := start.Add(1500 * time.Millisecond)
+			want := outcome
+			switch outcome {
+			case "ready":
+				g.observeUnit(testBinding(), 7, "", false, true, 0, end)
+			case "fence":
+				end = start.Add(unitQueryRecoveryBudget)
+				g.fenced(end)
+			case "signal-fence":
+				want = "fence"
+				g.fenceObserver("bus-owner-changed", observerEvent{At: end, Detail: "owner-signal"})
+			case "reload-fence":
+				want = "fence"
+				g.requestUnitCheck(true, start.Add(time.Second))
+				end = start.Add(unitQueryRecoveryBudget)
+				g.fenced(end)
+			}
+			d := g.observerDiagnostic("")
+			p := d.QueryPending
+			if p == nil || !p.StartedAt.Equal(start) || !p.PendingAt.Equal(start.Add(500*time.Millisecond)) || !p.EndedAt.Equal(end) || p.Outcome != want || p.ElapsedNS != int64(end.Sub(start)) || p.Phase != "get-owner" {
+				t.Fatalf("wrong ended period: %+v", p)
+			}
+			if want == "ready" {
+				if !g.allow(end) {
+					t.Fatal("recovered admission denied")
+				}
+				later := end.Add(100 * time.Millisecond)
+				g.deferUnitDeadline(0, later, later.Add(500*time.Millisecond), e)
+				if p = g.observerDiagnostic("").QueryPending; !p.StartedAt.Equal(later) || p.Outcome != "pending" || !p.EndedAt.IsZero() || p.ElapsedNS != 0 {
+					t.Fatalf("latest cycle not replaced: %+v", p)
+				}
+			} else {
+				g.observeUnit(testBinding(), 7, "", false, true, g.unitSerial, end)
+				if g.allow(end) || g.observerDiagnostic("").QueryPending.ElapsedNS != p.ElapsedNS {
+					t.Fatal("terminal period or fence changed")
+				}
+			}
+		})
+	}
+}
+
+func TestQueryPendingDiagnosticDiscardedProbeDoesNotStartOrEndPeriod(t *testing.T) {
+	start := time.Now()
+	g := newAdmission(testBinding())
+	if g.deferUnitDeadline(0, start, start, observerEvent{}) || g.observerDiagnostic("").QueryPending != nil {
+		t.Fatal("startup acquired pending")
+	}
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	g.requestUnitCheck(true, start)
+	if g.deferUnitDeadline(0, start, start, observerEvent{}) || g.observerDiagnostic("").QueryPending != nil {
+		t.Fatal("obsolete probe started pending")
+	}
+	g.requestUnitCheck(false, start)
+	g.deferUnitDeadline(g.unitSerial, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start.Add(time.Second))
+	if p := g.observerDiagnostic("").QueryPending; p == nil || p.Outcome != "pending" {
+		t.Fatalf("obsolete success ended pending: %+v", p)
+	}
+}
+
+func TestQueryPendingDiagnosticPersistsWhileOwnerLives(t *testing.T) {
+	for _, fail := range []bool{false, true} {
+		t.Run(map[bool]string{false: "private-file", true: "write-failure"}[fail], func(t *testing.T) {
+			c := fixture(t)
+			path := filepath.Join(c.StateDir, "observer-diagnostic.json")
+			if fail {
+				if err := os.Mkdir(path, 0700); err != nil {
+					t.Fatal(err)
+				}
+			}
+			start := time.Now()
+			g := newAdmission(testBinding())
+			g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+			stop := startObserverDiagnostics(c, strings.Repeat("e", 64), g)
+			defer stop()
+			g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-all", ErrorClass: "deadline"})
+			read := func(want string) observerDiagnostic {
+				t.Helper()
+				deadline := time.Now().Add(2 * time.Second)
+				for time.Now().Before(deadline) {
+					b, err := os.ReadFile(path)
+					var d observerDiagnostic
+					if err == nil && json.Unmarshal(b, &d) == nil && d.QueryPending != nil && d.QueryPending.Outcome == want {
+						return d
+					}
+					time.Sleep(time.Millisecond)
+				}
+				t.Fatalf("live %s diagnostic not persisted", want)
+				return observerDiagnostic{}
+			}
+			if !fail {
+				read("pending")
+			}
+			end := start.Add(750 * time.Millisecond)
+			g.observeUnit(testBinding(), 7, "", false, true, 0, end)
+			if !g.allow(end) {
+				t.Fatal("write failure changed recovery")
+			}
+			if !fail {
+				d := read("ready")
+				if d.Reason != "" || d.Epoch != strings.Repeat("e", 64) || d.QueryPending.ElapsedNS != int64(750*time.Millisecond) {
+					t.Fatalf("bad live recovery: %+v", d)
+				}
+				st, err := os.Stat(path)
+				if err != nil || st.Mode().Perm() != 0600 || st.Size() > observerDiagnosticLimit {
+					t.Fatalf("bad private bounded file: %v %v", st, err)
+				}
+				g.deferUnitDeadline(0, end, end.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+				g.fenced(end.Add(unitQueryRecoveryBudget))
+				d = read("fence")
+				if d.QueryPending.ElapsedNS != int64(unitQueryRecoveryBudget) || d.Fence.Detail != "query-deadline" {
+					t.Fatalf("bad live fence: %+v", d)
+				}
+			}
+		})
+	}
+}
+
+func TestQueryPendingDiagnosticSlowWriterCannotDelayAdmission(t *testing.T) {
+	g := newAdmission(testBinding())
+	start := time.Now()
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	var writes atomic.Int32
+	stop := startObserverDiagnosticWriter(g, func() {
+		if writes.Add(1) == 1 {
+			close(entered)
+			<-release
+		}
+	})
+	// Always release before shutdown, including a failing assertion.
+	defer stop()
+	defer close(release)
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("writer not started")
+	}
+	done := make(chan struct{})
+	go func() {
+		// Repeated periods while storage is stalled must coalesce in bounded memory.
+		for n := 0; n < observerEventLimit*2; n++ {
+			at := start.Add(time.Duration(n) * time.Millisecond)
+			g.deferUnitDeadline(0, at, at.Add(time.Microsecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+			g.observeUnit(testBinding(), 7, "", false, true, 0, at.Add(2*time.Microsecond))
+		}
+		g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+		g.fenced(start.Add(unitQueryRecoveryBudget))
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("storage blocked admission")
+	}
+	d := g.observerDiagnostic("")
+	if d.QueryPending == nil || d.QueryPending.Outcome != "fence" || d.QueryPending.ElapsedNS != int64(unitQueryRecoveryBudget) || len(d.Events) != observerEventLimit {
+		t.Fatalf("latest period lost: %+v", d)
+	}
+}
+
+func TestQueryPendingDiagnosticShutdownFlushesLatest(t *testing.T) {
+	g := newAdmission(testBinding())
+	start := time.Now()
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	entered, release := make(chan struct{}), make(chan struct{})
+	var latest atomic.Pointer[observerDiagnostic]
+	var writes atomic.Int32
+	stop := startObserverDiagnosticWriter(g, func() {
+		if writes.Add(1) == 1 {
+			close(entered)
+			<-release
+		}
+		d := g.observerDiagnostic(strings.Repeat("e", 64))
+		latest.Store(&d)
+	})
+	defer stop()
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		close(release)
+		t.Fatal("writer not started")
+	}
+	g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start.Add(750*time.Millisecond))
+	close(release)
+	stop()
+	d := latest.Load()
+	if d == nil || d.QueryPending == nil || d.QueryPending.Outcome != "ready" || d.QueryPending.ElapsedNS != int64(750*time.Millisecond) {
+		t.Fatalf("shutdown lost latest: %+v", d)
+	}
+}

package/dist/templates/native-go/backend/internal/helper/read_stream_cohort_linux_test.go

@@ -0,0 +1,156 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+)
+
+func readStreamVMCreate(t *testing.T, p LinuxProcesses) Grant {
+	t.Helper()
+	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionReadStream}})
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	b, e := os.ReadFile(p.StateDir + "/grants.json")
+	if e != nil {
+		t.Fatal(e)
+	}
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
+	if res.Code != "" || res.Grant == nil {
+		t.Fatal(res)
+	}
+	return *res.Grant
+}
+func readStreamVMWait(t *testing.T, fn func() bool) {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if err := waitHealthy(ctx, func(context.Context) bool { return fn() }); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestLinuxReadStreamRealChildProofBackpressureAndQ(t *testing.T) {
+	for _, kind := range []string{"complete", "acl", "groups", "disconnect", "epoch", "backpressure"} {
+		t.Run(kind, func(t *testing.T) {
+			p := readOnlyVMFixture(t)
+			proc := startVMHelper(t, p)
+			g := readStreamVMCreate(t, p)
+			defer func() {
+				if e := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); e != nil {
+					t.Error(e)
+				}
+			}()
+			expected := bytes.Repeat([]byte("s"), 2*MaxBoundedBytes)
+			if e := os.WriteFile("/tmp/m2-s5-operations/stream", expected, 0644); e != nil {
+				t.Fatal(e)
+			}
+			if kind == "backpressure" {
+				os.WriteFile(p.RunDir+"/fixture-readonly-block-output", nil, 0600)
+			}
+			if kind == "disconnect" {
+				os.WriteFile(p.RunDir+"/fixture-disconnect", nil, 0600)
+			}
+			r := readOnlyVMRequest(t, g, ActionReadStream, ReadArgs{Segments: []string{"stream"}, MaxBytes: MaxTransferBytes})
+			if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
+				t.Fatal(res)
+			}
+			metadata := grantVMMetadata(t, p, r)
+			if metadata.Code != "" || metadata.Bytes != uint64(len(expected)) {
+				t.Fatal(metadata)
+			}
+			chunk := r
+			chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"stream"}, MaxBytes: MaxChunkBytes})
+			lease := func() Code {
+				chunk.Nonce = readOnlyVMRef(t)
+				chunk.Ticket = readOnlyVMRef(t)
+				return grantVMCall(t, p, "operation.chunk", chunk).Code
+			}
+			if code := lease(); code != "" {
+				t.Fatal(code)
+			}
+			if kind == "backpressure" {
+				if code := lease(); code != ErrBusy {
+					t.Fatal("slow client accepted second outstanding lease", code)
+				}
+				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+				store, _ := DecodeGrantStore(bytes.NewReader(raw))
+				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+				if res.Code != "" || res.Revoke == nil || !res.Revoke.Drained {
+					t.Fatal(res)
+				}
+				raw, e := os.ReadFile(p.StateDir + "/grant-q-" + g.ID + ".json")
+				var q GrantQuiescence
+				if e != nil || json.Unmarshal(raw, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.AdmittedBytes != MaxChunkBytes {
+					t.Fatal(q, e)
+				}
+				if code := lease(); code == "" {
+					t.Fatal("lease after R/Q")
+				}
+				return
+			}
+			readStreamVMWait(t, func() bool {
+				b, _ := os.ReadFile(p.RunDir + "/fixture-progress")
+				n, _ := strconv.Atoi(string(b))
+				return n == MaxChunkBytes
+			})
+			switch kind {
+			case "acl":
+				os.WriteFile("/tmp/m2-s5-operations/deny-acl", nil, 0644)
+			case "groups":
+				os.WriteFile("/tmp/m2-s5-operations/group-change", nil, 0644)
+			case "epoch":
+				chunk.Epoch = grantRef('f')
+			}
+			if kind == "complete" {
+				for sent := MaxChunkBytes; sent < len(expected); {
+					code := lease()
+					if code == ErrBusy {
+						time.Sleep(time.Millisecond)
+						continue
+					}
+					if code != "" {
+						t.Fatal(sent, code)
+					}
+					sent += MaxChunkBytes
+				}
+			} else if kind != "disconnect" {
+				code := lease()
+				if kind != "acl" && code == "" {
+					t.Fatal("changed binding admitted", kind)
+				}
+			}
+			if kind == "epoch" {
+				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+				store, _ := DecodeGrantStore(bytes.NewReader(raw))
+				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+				if res.Code != "" || !res.Revoke.Drained {
+					t.Fatal(res)
+				}
+			}
+			readStreamVMWait(t, func() bool {
+				_, e := os.Stat(p.RunDir + "/fixture-readonly-bytes")
+				return e == nil && len(processChildren(proc.PID)) == 1
+			})
+			b, e := os.ReadFile(p.RunDir + "/fixture-readonly-bytes")
+			if e != nil {
+				t.Fatal(e)
+			}
+			want := MaxChunkBytes
+			if kind == "complete" {
+				want = len(expected)
+			}
+			if len(b) != want || !bytes.Equal(b, expected[:want]) {
+				t.Fatal(kind, "unproved or truncated bytes", len(b), want)
+			}
+		})
+	}
+}