@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/helper/jobcontract/validate.go

@@ -0,0 +1,462 @@
+package jobcontract
+
+import (
+	"io"
+	"reflect"
+	"regexp"
+	"slices"
+	"strings"
+	"unicode/utf8"
+)
+
+var (
+	packagePattern   = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`)
+	versionPattern   = regexp.MustCompile(`^\d+(\.\d+){0,3}-\d{4}$`)
+	digestPattern    = regexp.MustCompile(`^[a-f0-9]{64}$`)
+	referencePattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$`)
+)
+
+func (r SafeReason) Error() string { return string(r) }
+func (r SafeReason) Valid() bool {
+	switch r {
+	case Invalid, Incompatible, Unsupported, Replay, Stale, Expired, Denied, Unavailable,
+		Suspended, Revoked, Fenced, Busy, LimitExceeded, ReasonCanceled, Timeout, Partial,
+		CommitUncertain, ReasonCleanupRequired, Internal:
+		return true
+	}
+	return false
+}
+func optionalReason(r SafeReason) bool { return r == "" || r.Valid() }
+func validRef(r RevisionRef) bool      { return digestPattern.MatchString(r.ID) && positive(r.Revision) }
+func validWorkerRef(r RevisionRef) bool {
+	return referencePattern.MatchString(r.ID) && positive(r.Revision)
+}
+func positive(n uint64) bool    { return n > 0 && n <= MaxSafeInteger }
+func validMode(m Mode) bool     { return m == Interactive || m == Background }
+func validAction(a Action) bool { return a == List || a == Stat || a == Read || a == ReadStream }
+
+// Values pin §5.4; manifests may only lower them. Budgets apply to the entire job.
+func HardLimits() Limits {
+	return Limits{InputBytes: MaxInputBytes, Steps: MaxSteps, TotalMS: 120000,
+		IdleMS: 10000, MetadataMS: 5000, BoundedMS: 10000, BoundedBytes: 1 << 20,
+		StreamBytes: 64 << 20, ChunkBytes: 64 << 10, OutstandingLeases: 1}
+}
+
+func ValidateLimits(l Limits) SafeReason {
+	values, ceilings := reflect.ValueOf(l), reflect.ValueOf(HardLimits())
+	for i := 0; i < values.NumField(); i++ {
+		n := values.Field(i).Uint()
+		if !positive(n) {
+			return Invalid
+		}
+		if n > ceilings.Field(i).Uint() {
+			return LimitExceeded
+		}
+	}
+	if l.IdleMS > l.TotalMS || l.MetadataMS > l.TotalMS || l.BoundedMS > l.TotalMS || l.ChunkBytes > l.StreamBytes {
+		return Invalid
+	}
+	return ""
+}
+
+func ValidateWorker(w Worker) SafeReason {
+	if w.RegistrySchema != RegistrySchema {
+		return Incompatible
+	}
+	if w.Kind != "sdk-read-plan" {
+		return Unsupported
+	}
+	if !referencePattern.MatchString(w.ID) || !positive(w.Revision) ||
+		!digestPattern.MatchString(w.HandlerBinding) || !digestPattern.MatchString(w.InputSchemaDigest) || !digestPattern.MatchString(w.OutputSchemaDigest) {
+		return Invalid
+	}
+	if len(w.Actions) == 0 || len(w.Actions) > 4 || len(w.Modes) == 0 || len(w.Modes) > 2 || len(w.Checkpoints) != 3 {
+		return Invalid
+	}
+	actions, modes, checkpoints := map[Action]bool{}, map[Mode]bool{}, map[string]bool{}
+	for _, a := range w.Actions {
+		if !validAction(a) || actions[a] {
+			return Unsupported
+		}
+		actions[a] = true
+	}
+	for _, m := range w.Modes {
+		if !validMode(m) || modes[m] {
+			return Invalid
+		}
+		modes[m] = true
+	}
+	for _, p := range w.Checkpoints {
+		if !slices.Contains([]string{"before-step", "before-chunk", "before-result"}, p) || checkpoints[p] {
+			return Invalid
+		}
+		checkpoints[p] = true
+	}
+	return ValidateLimits(w.Limits)
+}
+
+func validateSegments(ss []string, root bool) SafeReason {
+	if ss == nil || (!root && len(ss) == 0) {
+		return Invalid
+	}
+	if len(ss) > 32 {
+		return LimitExceeded
+	}
+	n := 0
+	for i, s := range ss {
+		if len(s) > 255 {
+			return LimitExceeded
+		}
+		if s == "" || s == "." || s == ".." || !utf8.ValidString(s) || strings.ContainsAny(s, "/\\\x00") {
+			return Invalid
+		}
+		n += len(s)
+		if i > 0 {
+			n++
+		}
+		if n > 4096 {
+			return LimitExceeded
+		}
+	}
+	return ""
+}
+
+func ValidateInput(in Input) SafeReason {
+	if len(in.Steps) == 0 {
+		return Invalid
+	}
+	if len(in.Steps) > MaxSteps {
+		return LimitExceeded
+	}
+	var bounded, total uint64
+	for _, s := range in.Steps {
+		if !validAction(s.Action) {
+			return Unsupported
+		}
+		if c := validateSegments(s.Segments, s.Action == List || s.Action == Stat); c != "" {
+			return c
+		}
+		switch s.Action {
+		case List:
+			if s.Limit == nil || !positive(*s.Limit) || s.MaxBytes != nil {
+				return Invalid
+			}
+			if *s.Limit > 200 {
+				return LimitExceeded
+			}
+		case Stat:
+			if s.Limit != nil || s.MaxBytes != nil {
+				return Invalid
+			}
+		case Read, ReadStream:
+			if s.MaxBytes == nil || !positive(*s.MaxBytes) || s.Limit != nil {
+				return Invalid
+			}
+			ceiling := uint64(64 << 20)
+			if s.Action == Read {
+				ceiling = 1 << 20
+			}
+			if *s.MaxBytes > ceiling {
+				return LimitExceeded
+			}
+			// Check each term before adding; no integer wrap or per-step reset.
+			total += *s.MaxBytes
+			if s.Action == Read {
+				bounded += *s.MaxBytes
+			}
+			if total > 64<<20 || bounded > 1<<20 {
+				return LimitExceeded
+			}
+		}
+	}
+	if len(encodeInput(in, "")) > MaxInputBytes {
+		return LimitExceeded
+	}
+	return ""
+}
+
+// ValidatePlan narrows a fixed input against one descriptor, never a grant/ACL.
+func ValidatePlan(w Worker, in Input, mode Mode) SafeReason {
+	if c := ValidateWorker(w); c != "" {
+		return c
+	}
+	if c := ValidateInput(in); c != "" {
+		return c
+	}
+	if !slices.Contains(w.Modes, mode) {
+		return Unsupported
+	}
+	if uint64(len(in.Steps)) > w.Limits.Steps || uint64(len(encodeInput(in, ""))) > w.Limits.InputBytes {
+		return LimitExceeded
+	}
+	var bounded, total uint64
+	for _, s := range in.Steps {
+		if !slices.Contains(w.Actions, s.Action) {
+			return Unsupported
+		}
+		if s.MaxBytes != nil {
+			total += *s.MaxBytes
+			if s.Action == Read {
+				bounded += *s.MaxBytes
+			}
+		}
+	}
+	if bounded > w.Limits.BoundedBytes || total > w.Limits.StreamBytes {
+		return LimitExceeded
+	}
+	return ""
+}
+
+func ValidateBinding(b Binding) SafeReason {
+	i := b.Inventory
+	if i.Protocol != DataProtocol || b.JobSchema != JobSchema || i.DataAccess != "relaxed" {
+		return Incompatible
+	}
+	if !packagePattern.MatchString(i.Package) || !versionPattern.MatchString(i.Version) ||
+		!digestPattern.MatchString(i.PayloadDigest) || !digestPattern.MatchString(i.RegistryDigest) {
+		return Invalid
+	}
+	if !digestPattern.MatchString(b.Epoch) || !validRef(b.Job) || !validWorkerRef(b.Worker) || !validRef(b.ParentGrant) {
+		return Invalid
+	}
+	for _, d := range []string{b.ApprovalBinding, b.CapabilityDigest, b.InputSchemaDigest, b.InputDigest} {
+		if !digestPattern.MatchString(d) {
+			return Invalid
+		}
+	}
+	if !validMode(b.Mode) {
+		return Incompatible
+	}
+	if b.Mode == Interactive && b.Delegation != nil || b.Mode == Background && (b.Delegation == nil || !validRef(*b.Delegation)) {
+		return Invalid
+	}
+	return ""
+}
+
+// CompareBinding checks every field. It cannot validate a ticket or authorize I/O.
+func CompareBinding(got, expected Binding) SafeReason {
+	if c := ValidateBinding(got); c != "" {
+		return c
+	}
+	if c := ValidateBinding(expected); c != "" {
+		return c
+	}
+	if !reflect.DeepEqual(got, expected) {
+		return Incompatible
+	}
+	return ""
+}
+
+func ValidateControl(r Control) SafeReason {
+	if c := ValidateBinding(r.Binding); c != "" {
+		return c
+	}
+	if !validRef(r.Intent) || !digestPattern.MatchString(r.Nonce) || !digestPattern.MatchString(r.Ticket) {
+		return Invalid
+	}
+	switch r.Op {
+	case "jobs.submit", "jobs.cancel":
+	case "background.revoke":
+		if r.Binding.Mode != Background {
+			return Incompatible
+		}
+	default:
+		return Unsupported
+	}
+	return ""
+}
+
+func validPrincipal(p Principal) bool {
+	return p.IdentityBasis == "uid-username" && p.UID != 0 && p.UID != ^uint32(0) &&
+		p.Username != "" && len(p.Username) <= 255 && utf8.ValidString(p.Username) && !strings.ContainsAny(p.Username, "\x00/\\\r\n")
+}
+func validatePrivate(b PrivateBinding) SafeReason {
+	if c := ValidateBinding(b.Binding); c != "" {
+		return c
+	}
+	if !validPrincipal(b.Actor) {
+		return Invalid
+	}
+	if b.Binding.Mode == Interactive && !digestPattern.MatchString(b.SessionRef) || b.Binding.Mode == Background && b.SessionRef != "" {
+		return Invalid
+	}
+	return ""
+}
+
+func ValidateIntent(i Intent) SafeReason {
+	if i.JobSchema != JobSchema {
+		return Incompatible
+	}
+	if c := validatePrivate(i.Binding); c != "" {
+		return c
+	}
+	if !digestPattern.MatchString(i.ID) || !positive(i.Revision) || !digestPattern.MatchString(i.SummaryDigest) ||
+		!positive(i.CreatedAt) || !positive(i.ExpiresAt) || i.ExpiresAt <= i.CreatedAt || i.ExpiresAt-i.CreatedAt > IntentTTLMS {
+		return Invalid
+	}
+	d, c := InputDigest(i.Input, i.Binding.Binding.InputSchemaDigest)
+	if c != "" {
+		return c
+	}
+	if d != i.Binding.Binding.InputDigest {
+		return Invalid
+	}
+	return ""
+}
+
+func ValidateBackground(r BackgroundRecord) SafeReason {
+	if r.BackgroundSchema != BackgroundSchema {
+		return Incompatible
+	}
+	if c := validatePrivate(r.Binding); c != "" {
+		return c
+	}
+	if r.Binding.Binding.Mode != Background || r.Issuer != r.Binding.Actor || !validPrincipal(r.Issuer) {
+		return Invalid
+	}
+	if !positive(r.CreatedAt) || !positive(r.ExpiresAt) || !positive(r.NotBefore) || r.ExpiresAt <= r.CreatedAt ||
+		r.ExpiresAt-r.CreatedAt > MaxBackgroundTTLMS || r.NotBefore < r.CreatedAt || r.NotBefore >= r.ExpiresAt || !optionalReason(r.Reason) {
+		return Invalid
+	}
+	if r.ExecutionKey != "" && !digestPattern.MatchString(r.ExecutionKey) {
+		return Invalid
+	}
+	switch r.State {
+	case "active":
+		if r.ExecutionKey != "" || r.Reason != "" {
+			return Invalid
+		}
+	case "consumed":
+		if r.ExecutionKey == "" || r.Reason != "" {
+			return Invalid
+		}
+	case "expired", "revoked", "suspended":
+		if r.Reason == "" {
+			return Invalid
+		} // retain burned key
+	default:
+		return Invalid
+	}
+	return ""
+}
+
+func ValidateProgress(p Progress, previous *Progress) SafeReason {
+	if p.Sequence > MaxSafeInteger || p.CompletedUnits > MaxSafeInteger || p.BytesRead > 64<<20 || p.BytesWritten != 0 {
+		return Invalid
+	}
+	if !slices.Contains([]string{"starting", "metadata", "reading", "finishing"}, p.Phase) {
+		return Invalid
+	}
+	if p.TotalUnits != nil && (*p.TotalUnits > MaxSafeInteger || p.CompletedUnits > *p.TotalUnits) {
+		return Invalid
+	}
+	if previous != nil && (p.Sequence <= previous.Sequence || p.CompletedUnits < previous.CompletedUnits || p.BytesRead < previous.BytesRead ||
+		(previous.TotalUnits != nil && (p.TotalUnits == nil || *p.TotalUnits != *previous.TotalUnits))) {
+		return Invalid
+	}
+	return ""
+}
+
+func terminal(s State) bool {
+	return s == Succeeded || s == Failed || s == Canceled || s == Interrupted
+}
+
+// Allowed edges are shape constraints only, never durability/credential/Q proof.
+func TransitionAllowed(from, to State) bool {
+	switch from {
+	case Pending:
+		return to == Running || to == CancelRequested || to == Failed || to == Interrupted || to == CleanupRequired
+	case Running:
+		return to == Succeeded || to == Failed || to == CancelRequested || to == Interrupted || to == CleanupRequired
+	case CancelRequested:
+		return to == Draining || to == Canceled || to == Failed || to == Interrupted || to == CleanupRequired
+	case Draining, CleanupRequired:
+		return to == Canceled || to == Failed || to == Interrupted || (from == Draining && to == CleanupRequired)
+	}
+	return false
+}
+
+func ValidateJob(j Job) SafeReason {
+	if c := ValidateBinding(j.Binding); c != "" {
+		return c
+	}
+	if !optionalReason(j.Reason) || !positive(j.AcceptedAt) {
+		return Invalid
+	}
+	if c := ValidateProgress(j.Progress, nil); c != "" {
+		return c
+	}
+	if j.StartedAt != nil && (!positive(*j.StartedAt) || *j.StartedAt < j.AcceptedAt) {
+		return Invalid
+	}
+	if j.FinishedAt != nil && (!positive(*j.FinishedAt) || *j.FinishedAt < j.AcceptedAt || j.StartedAt != nil && *j.FinishedAt < *j.StartedAt) {
+		return Invalid
+	}
+	if terminal(j.State) {
+		if j.FinishedAt == nil {
+			return Invalid
+		}
+	} else if j.FinishedAt != nil || j.Drained {
+		return Invalid
+	}
+	switch j.State {
+	case Pending:
+		if j.StartedAt != nil || j.CancelRequested {
+			return Invalid
+		}
+	case Running:
+		if j.StartedAt == nil || j.CancelRequested {
+			return Invalid
+		}
+	case CancelRequested, Draining:
+		if !j.CancelRequested {
+			return Invalid
+		}
+	case CleanupRequired:
+		if j.Reason != ReasonCleanupRequired {
+			return Invalid
+		}
+	case Succeeded:
+		if j.StartedAt == nil || !j.Drained || j.EffectsUnknown || j.Reason != "" {
+			return Invalid
+		}
+	case Failed, Interrupted:
+		if j.Reason == "" {
+			return Invalid
+		}
+	case Canceled:
+		if !j.CancelRequested || j.Reason == "" {
+			return Invalid
+		}
+	default:
+		return Invalid
+	}
+	return ""
+}
+
+func decodeValidated[T any](r io.Reader, limit int, validate func(T) SafeReason) (T, SafeReason) {
+	var v T
+	if c := decodeObject(r, &v, limit); c != "" {
+		return *new(T), c
+	}
+	if c := validate(v); c != "" {
+		return *new(T), c
+	}
+	return v, ""
+}
+func DecodeInput(r io.Reader) (Input, SafeReason) {
+	return decodeValidated(r, MaxInputBytes, ValidateInput)
+}
+func DecodeWorker(r io.Reader) (Worker, SafeReason) {
+	return decodeValidated(r, MaxControlBytes, ValidateWorker)
+}
+func DecodeControl(r io.Reader) (Control, SafeReason) {
+	return decodeValidated(r, MaxControlBytes, ValidateControl)
+}
+func DecodeIntent(r io.Reader) (Intent, SafeReason) {
+	return decodeValidated(r, MaxArtifactBytes, ValidateIntent)
+}
+func DecodeBackground(r io.Reader) (BackgroundRecord, SafeReason) {
+	return decodeValidated(r, MaxArtifactBytes, ValidateBackground)
+}
+func DecodeJob(r io.Reader) (Job, SafeReason) { return decodeValidated(r, MaxStatusBytes, ValidateJob) }

package/templates/native-go/backend/internal/helper/legacy_authority_schema_linux_test.go

@@ -0,0 +1,34 @@
+//go:build linux && !synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLegacyAuthorityUnknownSchemaDoesNotOverwrite(t *testing.T) {
+	for _, raw := range []string{`{"grantSchema":2,"storeRevision":7,"grants":[]}`, `{"grantSchema":99,"storeRevision":7,"grants":[]}`, `{"grantSchema":1,"storeRevision":7,"grants":[],"background":[]}`} {
+		dir, inventory, _ := rootGrantFixture(t)
+		path := filepath.Join(dir, "grants.json")
+		if err := os.WriteFile(path, []byte(raw), 0600); err != nil {
+			t.Fatal(err)
+		}
+		repo := openRootGrantRepository(t, dir, inventory)
+		if _, code := NewGrantAuthority(repo, nil, nil, nil); code == "" {
+			t.Fatal("legacy read new schema")
+		}
+		if code := repo.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
+			*s = GrantStore{Schema: 1, Revision: 1, Grants: []Grant{}}
+			return true, ""
+		}); code != ErrFenced {
+			t.Fatal("legacy overwrote unsupported store", code)
+		}
+		after, err := os.ReadFile(path)
+		if err != nil || !bytes.Equal([]byte(raw), after) {
+			t.Fatal("unknown bytes changed", err)
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/legacy_authority_schema_test.go

@@ -0,0 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+package helper
+
+// Ordinary behavioral fixtures start with a current envelope; migration has separate tests.
+const testAuthoritySchema = 1

package/templates/native-go/backend/internal/helper/management.go

@@ -0,0 +1,79 @@
+package helper
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// A different build cannot acquire authority from this record. Management only
+// consumes the old owner's terminal publication; it never rewrites approval or
+// starts/signals a process. Private completion contents stay private to root.
+func (c Client) staleManagementStopped() bool {
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || !c.Expected.Valid() || r.Inventory.Package != c.Expected.Package || r.Schema != 2 || !r.Enabled || r.Residual || r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" || r.Lifecycle.Lease == nil {
+		return false
+	}
+	if !c.canonicalApproval(r) || !c.completionPublished(r) {
+		return false
+	}
+	if err := protected(c.RunDir, c.Owner, true); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return false
+	}
+	// Bind the historical lifetime witness even for package-user hooks that
+	// cannot read mode-0600 files. The sealed terminal publication attests that
+	// this epoch has exited; it is not inferred from missing /run files alone.
+	lease, err := os.Lstat(leasePath(c, r.Lifecycle))
+	if err != nil {
+		return false
+	}
+	stat, ok := lease.Sys().(*syscall.Stat_t)
+	if !ok || !lease.Mode().IsRegular() || lease.Mode().Perm() != 0600 || lease.Size() != 64 || stat.Uid != c.Owner || stat.Nlink != 1 || uint64(stat.Dev) != r.Lifecycle.Lease.Device || stat.Ino != r.Lifecycle.Lease.Inode {
+		return false
+	}
+	proof, err := os.Lstat(filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json"))
+	if err != nil {
+		return false
+	}
+	st, ok := proof.Sys().(*syscall.Stat_t)
+	if !ok || st.Nlink != 1 || proof.Size() == 0 || proof.Size() > 4096 {
+		return false
+	}
+	if uint32(os.Geteuid()) == c.Owner {
+		// The owner additionally verifies private bytes and kernel quiescence.
+		lock, err := acquireLifetime(c, r.Lifecycle)
+		if err != nil {
+			return false
+		}
+		defer lock.Close()
+	}
+	// Recheck the exact protected publication after inspecting proof and runtime.
+	return runtimeAbsent(c) && c.canonicalApproval(r)
+}
+
+func (c Client) canonicalApproval(r Record) bool {
+	f, err := os.OpenFile(filepath.Join(c.StateDir, "approval.json"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return false
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return false
+	}
+	stat, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || !st.Mode().IsRegular() || st.Mode().Perm() != 0644 || stat.Uid != c.Owner || stat.Nlink != 1 || st.Size() > 4096 {
+		return false
+	}
+	got, err := io.ReadAll(io.LimitReader(f, 4097))
+	if err != nil {
+		return false
+	}
+	want, err := json.Marshal(r)
+	return err == nil && bytes.Equal(got, want)
+}

package/templates/native-go/backend/internal/helper/observation.go

@@ -8,6 +8,7 @@ import (
 const observationFreshness = time.Second
 const unitVerificationBudget = 3 * time.Second
 const unitReloadBudget = 10 * time.Second
+const unitQueryRecoveryBudget = 3 * time.Second
 
 // Signal delivery, bounded reload verification, and admission share one ordering
 // point. A temporary suspension is distinct from an irreversible sticky fence.
@@ -16,10 +17,13 @@ type admission struct {
 	events                [observerEventLimit]observerEvent
 	eventNext, eventCount int
 	firstFence            observerEvent
+	queryPending          *observerQueryPending
+	diagnosticWake        chan struct{}
 	binding               Binding
 	entered               uint64
 	seen                  time.Time
 	blocked               string
+	queryUntil            time.Time
 	pendingUntil          time.Time
 	reloadUntil           time.Time
 	reloading             bool
@@ -130,6 +134,8 @@ func (g *admission) observeUnit(b Binding, entered uint64, invocation string, pr
 	}
 	g.invocation, g.hasInvocation, g.unitObserved = invocation, present, true
 	g.recordObserverLocked(observerEvent{Kind: "query-accepted", QuerySerial: serial})
+	g.finishQueryPendingLocked("ready", now)
+	g.queryUntil = time.Time{}
 	g.pendingUntil = time.Time{}
 	g.reloadUntil = time.Time{}
 }
@@ -157,16 +163,23 @@ func (g *admission) checkLocked(now time.Time) {
 	if g.blocked != "" {
 		return
 	} // Do not flood the diagnostic ring with the same terminal check.
+	if !g.queryUntil.IsZero() && !now.Before(g.queryUntil) {
+		g.fenceObserverLocked("observation-unavailable", observerEvent{At: now, Detail: "query-deadline", QuerySerial: g.unitSerial})
+		return
+	}
 	if !g.pendingUntil.IsZero() {
 		if !now.Before(g.pendingUntil) {
 			detail := "verification-deadline"
 			if g.reloading {
 				detail = "reload-deadline"
 			}
-			g.fenceObserverLocked("observation-unavailable", observerEvent{Detail: detail, QuerySerial: g.unitSerial})
+			g.fenceObserverLocked("observation-unavailable", observerEvent{At: now, Detail: detail, QuerySerial: g.unitSerial})
 		}
 		return // The fixed verification budget replaces freshness only while denied.
 	}
+	if !g.queryUntil.IsZero() {
+		return // A fixed query recovery window denies admission instead of freshness.
+	}
 	if g.seen.IsZero() || now.Sub(g.seen) > observationFreshness {
 		g.fenceObserverLocked("observation-expired", observerEvent{Detail: "freshness-deadline", QuerySerial: g.unitSerial})
 	}
@@ -178,7 +191,7 @@ func (g *admission) allow(now time.Time) bool {
 }
 func (g *admission) allowLocked(now time.Time) bool {
 	g.checkLocked(now)
-	return g.blocked == "" && g.pendingUntil.IsZero()
+	return g.blocked == "" && g.pendingUntil.IsZero() && g.queryUntil.IsZero()
 }
 
 // Only the lifecycle owner may turn this terminal result into durable teardown.
@@ -197,8 +210,35 @@ func (g *admission) readiness(now time.Time) string {
 	if g.allowLocked(now) {
 		return "ready"
 	}
+	if g.blocked == "" && !g.queryUntil.IsZero() {
+		return "query-revalidating"
+	}
 	if g.blocked == "" && !g.reloadUntil.IsZero() && !g.pendingUntil.IsZero() {
 		return "reload-revalidating"
 	}
 	return "fenced"
 }
+
+// Only a previously authenticated observation may temporarily suspend. Startup
+// cannot acquire authority from a timeout. Neither retries nor reload edges
+// extend this deadline, and an expired/sticky fence always wins.
+func (g *admission) deferUnitDeadline(serial uint64, started, now time.Time, e observerEvent) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if !g.unitObserved || serial != g.unitSerial || g.reloading {
+		return false
+	}
+	g.checkLocked(now)
+	if g.blocked != "" {
+		return false
+	}
+	if g.queryUntil.IsZero() {
+		g.queryUntil = started.Add(unitQueryRecoveryBudget)
+		g.queryPending = &observerQueryPending{StartedAt: started, PendingAt: now, Outcome: "pending", Phase: e.Phase, ErrorClass: e.ErrorClass, QuerySerial: serial}
+		g.notifyObserverDiagnosticLocked()
+	}
+	e.Kind = "query-pending"
+	g.recordObserverLocked(e)
+	g.checkLocked(now)
+	return g.blocked == ""
+}

package/templates/native-go/backend/internal/helper/observation_health_test.go

@@ -89,7 +89,7 @@ func TestPendingReplyNeverCertifiesAdmissionOrStop(t *testing.T) {
 		res  Response
 		want string
 	}{
-		{Response{OK: true}, "ready"}, {Response{Error: "reload-revalidating"}, "reload-revalidating"},
+		{Response{OK: true}, "ready"}, {Response{Error: "query-revalidating"}, "query-revalidating"}, {Response{OK: true, Error: "query-revalidating"}, "fenced"}, {Response{Error: "reload-revalidating"}, "reload-revalidating"},
 		{Response{OK: true, Error: "reload-revalidating"}, "fenced"}, {Response{Error: "fenced"}, "fenced"}, {Response{}, "fenced"},
 	} {
 		if got := supervisorReadiness(tc.res, nil); got != tc.want {
@@ -113,3 +113,15 @@ func TestPendingReplyNeverCertifiesAdmissionOrStop(t *testing.T) {
 		}
 	}
 }
+
+func TestQueryPendingReplyNeverCertifiesStop(t *testing.T) {
+	i := fixture(t).Expected
+	res := Response{Inventory: i, Nonce: "nonce", Error: "query-revalidating"}
+	data, _ := json.Marshal(res)
+	if readSupervisorReply(bytes.NewReader(data), i, "nonce") == nil {
+		t.Fatal("query pending certified ACK")
+	}
+	if supervisorReadiness(res, errTrust) != "fenced" {
+		t.Fatal("unauthenticated query pending")
+	}
+}