@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/helper/observer_diagnostic.go

@@ -12,6 +12,8 @@ const observerDiagnosticLimit = 32768
 // Only fixed branch names and transport metadata belong here. Never store a
 // signal body, query value, installation identity, or an error's text.
 type observerEvent struct {
+	Stage          string    `json:"stage,omitempty"`
+	Code           Code      `json:"code,omitempty"`
 	At             time.Time `json:"at"`
 	Kind           string    `json:"kind"`
 	Detail         string    `json:"detail,omitempty"`
@@ -23,12 +25,27 @@ type observerEvent struct {
 	SignalSequence uint64    `json:"signalSequence,omitempty"`
 	QuerySerial    uint64    `json:"querySerial,omitempty"`
 }
+
+// One pinned period survives ring wrap. Timestamps contain no query values;
+// elapsed time is measured before UTC serialization, using Go's monotonic clock.
+type observerQueryPending struct {
+	StartedAt   time.Time `json:"startedAt"`
+	PendingAt   time.Time `json:"pendingAt"`
+	EndedAt     time.Time `json:"endedAt"`
+	Outcome     string    `json:"outcome"`
+	ElapsedNS   int64     `json:"elapsedNs"`
+	Phase       string    `json:"phase"`
+	ErrorClass  string    `json:"errorClass"`
+	QuerySerial uint64    `json:"querySerial"`
+}
+
 type observerDiagnostic struct {
-	Schema int             `json:"schema"`
-	Epoch  string          `json:"epoch"`
-	Reason string          `json:"reason"`
-	Fence  observerEvent   `json:"fence"`
-	Events []observerEvent `json:"events"`
+	QueryPending *observerQueryPending `json:"queryPending,omitempty"`
+	Schema       int                   `json:"schema"`
+	Epoch        string                `json:"epoch"`
+	Reason       string                `json:"reason"`
+	Fence        observerEvent         `json:"fence"`
+	Events       []observerEvent       `json:"events"`
 }
 
 func (g *admission) recordObserver(e observerEvent) {
@@ -40,6 +57,7 @@ func (g *admission) recordObserverLocked(e observerEvent) {
 	if e.At.IsZero() {
 		e.At = time.Now().UTC()
 	}
+	e.At = e.At.UTC()
 	g.events[g.eventNext] = e
 	g.eventNext = (g.eventNext + 1) % observerEventLimit
 	if g.eventCount < observerEventLimit {
@@ -54,7 +72,7 @@ func (g *admission) fenceObserver(reason string, e observerEvent) {
 func (g *admission) fenceObserverLocked(reason string, e observerEvent) {
 	e.Kind = "fence"
 	if e.At.IsZero() {
-		e.At = time.Now().UTC()
+		e.At = time.Now()
 	}
 	if e.Detail == "" {
 		e.Detail = reason
@@ -62,6 +80,8 @@ func (g *admission) fenceObserverLocked(reason string, e observerEvent) {
 	if g.blocked == "" {
 		g.blocked = reason
 		g.firstFence = e
+		g.finishQueryPendingLocked("fence", e.At)
+		g.notifyObserverDiagnosticLocked()
 	}
 	g.recordObserverLocked(e)
 }
@@ -69,6 +89,14 @@ func (g *admission) observerDiagnostic(epoch string) observerDiagnostic {
 	g.mu.Lock()
 	defer g.mu.Unlock()
 	d := observerDiagnostic{Schema: 1, Epoch: epoch, Reason: g.blocked, Fence: g.firstFence, Events: make([]observerEvent, g.eventCount)}
+	if g.queryPending != nil {
+		period := *g.queryPending
+		period.StartedAt = period.StartedAt.UTC()
+		period.PendingAt = period.PendingAt.UTC()
+		period.EndedAt = period.EndedAt.UTC()
+		d.QueryPending = &period
+	}
+	d.Fence.At = d.Fence.At.UTC()
 	start := (g.eventNext - g.eventCount + observerEventLimit) % observerEventLimit
 	for n := range d.Events {
 		d.Events[n] = g.events[(start+n)%observerEventLimit]
@@ -76,12 +104,30 @@ func (g *admission) observerDiagnostic(epoch string) observerDiagnostic {
 	return d
 }
 
-// Diagnostics are independent of approval/completion authority. Write once on
-// owner return, after teardown attempts. A parked owner retains its lifecycle
-// sub-reason; a failed diagnostic write cannot change its fence or proof.
+// Coalesce notifications while storage is slow. The latest pinned period keeps
+// both endpoints even when a start and end arrive before the writer can run.
+func (g *admission) notifyObserverDiagnosticLocked() {
+	select {
+	case g.diagnosticWake <- struct{}{}:
+	default:
+	}
+}
+func (g *admission) finishQueryPendingLocked(outcome string, now time.Time) {
+	if g.queryPending == nil || g.queryPending.Outcome != "pending" {
+		return
+	}
+	g.queryPending.EndedAt = now
+	g.queryPending.Outcome = outcome
+	g.queryPending.ElapsedNS = int64(now.Sub(g.queryPending.StartedAt))
+	g.recordObserverLocked(observerEvent{At: now, Kind: "query-pending-ended", Detail: outcome, QuerySerial: g.unitSerial})
+	g.notifyObserverDiagnosticLocked()
+}
+
+// A write error cannot change a fence, admission, completion proof, or return
+// result. This fixed-size snapshot never stores signal bodies or query values.
 func persistObserverDiagnostic(c Client, epoch string, g *admission) {
 	d := g.observerDiagnostic(epoch)
-	if d.Reason == "" || !digestPattern.MatchString(epoch) {
+	if (d.Reason == "" && d.QueryPending == nil) || !digestPattern.MatchString(epoch) {
 		return
 	}
 	b, err := json.Marshal(d)

package/templates/native-go/backend/internal/helper/observer_diagnostic_linux_test.go

@@ -67,6 +67,12 @@ func TestLinuxObserverQueryErrorClassification(t *testing.T) {
 			return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: c.err, phase: "get-unit"}
 		})
 		d := o.gate.observerDiagnostic("")
+		if c.want == "deadline" {
+			if err != nil || o.gate.readiness(time.Now()) != "query-revalidating" {
+				t.Fatalf("deadline not pending: %+v %v", d, err)
+			}
+			continue
+		}
 		if err == nil || d.Fence.Phase != "get-unit" || d.Fence.ErrorClass != c.want || d.Fence.Detail != "query-failed" {
 			t.Fatalf("classification %s: %+v %v", c.want, d, err)
 		}

package/templates/native-go/backend/internal/helper/observer_diagnostic_writer.go

@@ -0,0 +1,40 @@
+package helper
+
+import "sync"
+
+// Diagnostics are independent of approval/completion authority. A single
+// worker does live writes; the signal/admission ordering point never does I/O.
+// Shutdown retains the existing best-effort final snapshot after teardown.
+func startObserverDiagnostics(c Client, epoch string, g *admission) func() {
+	return startObserverDiagnosticWriter(g, func() { persistObserverDiagnostic(c, epoch, g) })
+}
+
+func startObserverDiagnosticWriter(g *admission, persist func()) func() {
+	wake, stop, done := make(chan struct{}, 1), make(chan struct{}), make(chan struct{})
+	g.mu.Lock()
+	g.diagnosticWake = wake
+	g.mu.Unlock()
+	go func() {
+		defer close(done)
+		persist()
+		for {
+			select {
+			case <-wake:
+				persist()
+			case <-stop:
+				persist()
+				return
+			}
+		}
+	}()
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			g.mu.Lock()
+			g.diagnosticWake = nil
+			g.mu.Unlock()
+			close(stop)
+			<-done
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/process_linux.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/process_linux.go:1
 package helper
 
 import (

package/templates/native-go/backend/internal/helper/query_deadline_linux_test.go

@@ -0,0 +1,115 @@
+package helper
+
+import (
+	"context"
+	"github.com/godbus/dbus/v5"
+	"testing"
+	"time"
+)
+
+// Shared systemd congestion caused by Alpha's upgrade must not kill Beta.
+// A real 500ms context expiry exercises the same GetUnit/GetAll error path.
+func TestLinuxQueryDeadlineCrossPackageRecovery(t *testing.T) {
+	for _, name := range []string{"Alpha", "Beta"} {
+		t.Run(name, func(t *testing.T) {
+			for _, phase := range []string{"get-unit", "get-all"} {
+				t.Run(phase, func(t *testing.T) {
+					o := diagnosticObserver(t)
+					o.unit = "pkgctl-" + name + ".service"
+					ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
+					defer cancel()
+					err := o.reconcileSnapshot(ctx, func(ctx context.Context) (Binding, map[string]dbus.Variant, error) {
+						<-ctx.Done()
+						return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: ctx.Err(), phase: phase}
+					})
+					if err != nil || o.gate.readiness(time.Now()) != "query-revalidating" || o.gate.allow(time.Now()) {
+						t.Fatalf("temporary deadline fenced instead of pending: %v %+v", err, o.gate.observerDiagnostic(""))
+					}
+					time.Sleep(250 * time.Millisecond)
+					if err := o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+						return testBinding(), activeUnitValues(o), nil
+					}); err != nil || !o.gate.allow(time.Now()) {
+						t.Fatalf("unchanged snapshot did not recover: %v", err)
+					}
+				})
+			}
+		})
+	}
+}
+
+func TestLinuxQueryDeadlineBoundAndStickyFence(t *testing.T) {
+	o := diagnosticObserver(t)
+	start := time.Now()
+	timeout := func(context.Context) (Binding, map[string]dbus.Variant, error) {
+		return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: context.DeadlineExceeded, phase: "get-unit"}
+	}
+	if err := o.reconcileSnapshot(context.Background(), timeout); err != nil {
+		t.Fatal("first deadline fenced", err)
+	}
+	for n := 0; n < 3; n++ {
+		if err := o.reconcileSnapshot(context.Background(), timeout); err != nil {
+			t.Fatal("retry fenced", err)
+		}
+	}
+	if o.gate.readiness(start.Add(2900*time.Millisecond)) != "query-revalidating" {
+		t.Fatal("missing bounded pending")
+	}
+	if !o.gate.fenced(start.Add(3100*time.Millisecond)) || o.gate.observerDiagnostic("").Fence.Detail != "query-deadline" {
+		t.Fatal("query budget extended", o.gate.observerDiagnostic(""))
+	}
+	_ = o.observeValues(testBinding(), activeUnitValues(o), o.gate.unitSerial, time.Now())
+	if o.gate.allow(time.Now()) {
+		t.Fatal("fence resurrected")
+	}
+}
+
+func TestLinuxQueryDeadlineCannotExtendReloadOrHideIdentity(t *testing.T) {
+	for _, kind := range []string{"reload-first", "query-first", "identity", "cancel", "initial"} {
+		t.Run(kind, func(t *testing.T) {
+			o := diagnosticObserver(t)
+			now := time.Now()
+			if kind == "initial" {
+				o.gate = newAdmission(testBinding())
+			}
+			if kind == "reload-first" {
+				o.gate.requestUnitCheck(true, now.Add(-9500*time.Millisecond))
+				o.gate.requestUnitCheck(false, now)
+			}
+			err := o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+				return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: context.DeadlineExceeded, phase: "get-all"}
+			})
+			if kind == "initial" {
+				if err == nil {
+					t.Fatal("initial failure acquired authority")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal("deadline fenced early", err)
+			}
+			switch kind {
+			case "query-first":
+				o.gate.requestUnitCheck(true, now.Add(time.Second))
+				if !o.gate.fenced(now.Add(3100 * time.Millisecond)) {
+					t.Fatal("reload extended query budget")
+				}
+			case "reload-first":
+				if !o.gate.fenced(now.Add(3100 * time.Millisecond)) {
+					t.Fatal("query extended verification")
+				}
+			case "identity":
+				v := activeUnitValues(o)
+				v["ActiveEnterTimestampMonotonic"] = dbus.MakeVariant(uint64(999))
+				if o.observeValues(testBinding(), v, o.gate.unitSerial, time.Now()) == nil {
+					t.Fatal("changed identity accepted")
+				}
+			case "cancel":
+				if o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+					return Binding{}, nil, context.Canceled
+				}) == nil {
+					t.Fatal("cancel retried")
+				}
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/query_pending_diagnostic_test.go

@@ -0,0 +1,254 @@
+package helper
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestQueryPendingDiagnosticSnapshotIsBoundedAndDetached(t *testing.T) {
+	g := newAdmission(testBinding())
+	now := time.Now().In(time.FixedZone("fixture", 8*60*60))
+	g.queryPending = &observerQueryPending{StartedAt: now, PendingAt: now.Add(500 * time.Millisecond), Outcome: "pending", Phase: "get-unit", ErrorClass: "deadline"}
+	for n := 0; n < observerEventLimit+20; n++ {
+		g.recordObserver(observerEvent{Kind: "query-phase"})
+	}
+	d := g.observerDiagnostic(strings.Repeat("e", 64))
+	if d.QueryPending == nil || !d.QueryPending.StartedAt.Equal(now) {
+		t.Fatalf("missing pinned period: %+v", d)
+	}
+	if d.QueryPending.StartedAt.Location() != time.UTC || d.QueryPending.PendingAt.Location() != time.UTC {
+		t.Fatal("diagnostic timestamps are not UTC")
+	}
+	d.QueryPending.Outcome = "mutated"
+	if g.observerDiagnostic(d.Epoch).QueryPending.Outcome != "pending" {
+		t.Fatal("snapshot aliases period")
+	}
+	payload, err := json.Marshal(d)
+	if err != nil || len(payload) > observerDiagnosticLimit {
+		t.Fatalf("size %d: %v", len(payload), err)
+	}
+	var decoded observerDiagnostic
+	if err := json.Unmarshal(payload, &decoded); err != nil || decoded.QueryPending == nil || !decoded.QueryPending.StartedAt.Equal(now) {
+		t.Fatalf("period roundtrip: %+v %v", decoded, err)
+	}
+}
+
+func TestQueryPendingDiagnosticPeriodLifecycle(t *testing.T) {
+	for _, outcome := range []string{"ready", "fence", "signal-fence", "reload-fence"} {
+		t.Run(outcome, func(t *testing.T) {
+			start := time.Now()
+			g := newAdmission(testBinding())
+			g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+			e := observerEvent{Phase: "get-owner", ErrorClass: "deadline", QuerySerial: 0}
+			if !g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), e) {
+				t.Fatal("first timeout fenced")
+			}
+			first := g.observerDiagnostic("").QueryPending
+			if first == nil || !first.StartedAt.Equal(start) || !first.PendingAt.Equal(start.Add(500*time.Millisecond)) || first.Outcome != "pending" || first.Phase != "get-owner" || first.ElapsedNS != 0 {
+				t.Fatalf("wrong first query: %+v", first)
+			}
+			e.Phase = "get-all"
+			if !g.deferUnitDeadline(0, start.Add(750*time.Millisecond), start.Add(time.Second), e) {
+				t.Fatal("retry fenced")
+			}
+			for n := 0; n < observerEventLimit+20; n++ {
+				g.recordObserver(observerEvent{Kind: "query-phase"})
+			}
+			end := start.Add(1500 * time.Millisecond)
+			want := outcome
+			switch outcome {
+			case "ready":
+				g.observeUnit(testBinding(), 7, "", false, true, 0, end)
+			case "fence":
+				end = start.Add(unitQueryRecoveryBudget)
+				g.fenced(end)
+			case "signal-fence":
+				want = "fence"
+				g.fenceObserver("bus-owner-changed", observerEvent{At: end, Detail: "owner-signal"})
+			case "reload-fence":
+				want = "fence"
+				g.requestUnitCheck(true, start.Add(time.Second))
+				end = start.Add(unitQueryRecoveryBudget)
+				g.fenced(end)
+			}
+			d := g.observerDiagnostic("")
+			p := d.QueryPending
+			if p == nil || !p.StartedAt.Equal(start) || !p.PendingAt.Equal(start.Add(500*time.Millisecond)) || !p.EndedAt.Equal(end) || p.Outcome != want || p.ElapsedNS != int64(end.Sub(start)) || p.Phase != "get-owner" {
+				t.Fatalf("wrong ended period: %+v", p)
+			}
+			if want == "ready" {
+				if !g.allow(end) {
+					t.Fatal("recovered admission denied")
+				}
+				later := end.Add(100 * time.Millisecond)
+				g.deferUnitDeadline(0, later, later.Add(500*time.Millisecond), e)
+				if p = g.observerDiagnostic("").QueryPending; !p.StartedAt.Equal(later) || p.Outcome != "pending" || !p.EndedAt.IsZero() || p.ElapsedNS != 0 {
+					t.Fatalf("latest cycle not replaced: %+v", p)
+				}
+			} else {
+				g.observeUnit(testBinding(), 7, "", false, true, g.unitSerial, end)
+				if g.allow(end) || g.observerDiagnostic("").QueryPending.ElapsedNS != p.ElapsedNS {
+					t.Fatal("terminal period or fence changed")
+				}
+			}
+		})
+	}
+}
+
+func TestQueryPendingDiagnosticDiscardedProbeDoesNotStartOrEndPeriod(t *testing.T) {
+	start := time.Now()
+	g := newAdmission(testBinding())
+	if g.deferUnitDeadline(0, start, start, observerEvent{}) || g.observerDiagnostic("").QueryPending != nil {
+		t.Fatal("startup acquired pending")
+	}
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	g.requestUnitCheck(true, start)
+	if g.deferUnitDeadline(0, start, start, observerEvent{}) || g.observerDiagnostic("").QueryPending != nil {
+		t.Fatal("obsolete probe started pending")
+	}
+	g.requestUnitCheck(false, start)
+	g.deferUnitDeadline(g.unitSerial, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start.Add(time.Second))
+	if p := g.observerDiagnostic("").QueryPending; p == nil || p.Outcome != "pending" {
+		t.Fatalf("obsolete success ended pending: %+v", p)
+	}
+}
+
+func TestQueryPendingDiagnosticPersistsWhileOwnerLives(t *testing.T) {
+	for _, fail := range []bool{false, true} {
+		t.Run(map[bool]string{false: "private-file", true: "write-failure"}[fail], func(t *testing.T) {
+			c := fixture(t)
+			path := filepath.Join(c.StateDir, "observer-diagnostic.json")
+			if fail {
+				if err := os.Mkdir(path, 0700); err != nil {
+					t.Fatal(err)
+				}
+			}
+			start := time.Now()
+			g := newAdmission(testBinding())
+			g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+			stop := startObserverDiagnostics(c, strings.Repeat("e", 64), g)
+			defer stop()
+			g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-all", ErrorClass: "deadline"})
+			read := func(want string) observerDiagnostic {
+				t.Helper()
+				deadline := time.Now().Add(2 * time.Second)
+				for time.Now().Before(deadline) {
+					b, err := os.ReadFile(path)
+					var d observerDiagnostic
+					if err == nil && json.Unmarshal(b, &d) == nil && d.QueryPending != nil && d.QueryPending.Outcome == want {
+						return d
+					}
+					time.Sleep(time.Millisecond)
+				}
+				t.Fatalf("live %s diagnostic not persisted", want)
+				return observerDiagnostic{}
+			}
+			if !fail {
+				read("pending")
+			}
+			end := start.Add(750 * time.Millisecond)
+			g.observeUnit(testBinding(), 7, "", false, true, 0, end)
+			if !g.allow(end) {
+				t.Fatal("write failure changed recovery")
+			}
+			if !fail {
+				d := read("ready")
+				if d.Reason != "" || d.Epoch != strings.Repeat("e", 64) || d.QueryPending.ElapsedNS != int64(750*time.Millisecond) {
+					t.Fatalf("bad live recovery: %+v", d)
+				}
+				st, err := os.Stat(path)
+				if err != nil || st.Mode().Perm() != 0600 || st.Size() > observerDiagnosticLimit {
+					t.Fatalf("bad private bounded file: %v %v", st, err)
+				}
+				g.deferUnitDeadline(0, end, end.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+				g.fenced(end.Add(unitQueryRecoveryBudget))
+				d = read("fence")
+				if d.QueryPending.ElapsedNS != int64(unitQueryRecoveryBudget) || d.Fence.Detail != "query-deadline" {
+					t.Fatalf("bad live fence: %+v", d)
+				}
+			}
+		})
+	}
+}
+
+func TestQueryPendingDiagnosticSlowWriterCannotDelayAdmission(t *testing.T) {
+	g := newAdmission(testBinding())
+	start := time.Now()
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	var writes atomic.Int32
+	stop := startObserverDiagnosticWriter(g, func() {
+		if writes.Add(1) == 1 {
+			close(entered)
+			<-release
+		}
+	})
+	// Always release before shutdown, including a failing assertion.
+	defer stop()
+	defer close(release)
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("writer not started")
+	}
+	done := make(chan struct{})
+	go func() {
+		// Repeated periods while storage is stalled must coalesce in bounded memory.
+		for n := 0; n < observerEventLimit*2; n++ {
+			at := start.Add(time.Duration(n) * time.Millisecond)
+			g.deferUnitDeadline(0, at, at.Add(time.Microsecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+			g.observeUnit(testBinding(), 7, "", false, true, 0, at.Add(2*time.Microsecond))
+		}
+		g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+		g.fenced(start.Add(unitQueryRecoveryBudget))
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("storage blocked admission")
+	}
+	d := g.observerDiagnostic("")
+	if d.QueryPending == nil || d.QueryPending.Outcome != "fence" || d.QueryPending.ElapsedNS != int64(unitQueryRecoveryBudget) || len(d.Events) != observerEventLimit {
+		t.Fatalf("latest period lost: %+v", d)
+	}
+}
+
+func TestQueryPendingDiagnosticShutdownFlushesLatest(t *testing.T) {
+	g := newAdmission(testBinding())
+	start := time.Now()
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	entered, release := make(chan struct{}), make(chan struct{})
+	var latest atomic.Pointer[observerDiagnostic]
+	var writes atomic.Int32
+	stop := startObserverDiagnosticWriter(g, func() {
+		if writes.Add(1) == 1 {
+			close(entered)
+			<-release
+		}
+		d := g.observerDiagnostic(strings.Repeat("e", 64))
+		latest.Store(&d)
+	})
+	defer stop()
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		close(release)
+		t.Fatal("writer not started")
+	}
+	g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start.Add(750*time.Millisecond))
+	close(release)
+	stop()
+	d := latest.Load()
+	if d == nil || d.QueryPending == nil || d.QueryPending.Outcome != "ready" || d.QueryPending.ElapsedNS != int64(750*time.Millisecond) {
+		t.Fatalf("shutdown lost latest: %+v", d)
+	}
+}

package/templates/native-go/backend/internal/helper/relaxed_invalidation.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/relaxed_invalidation.go:1
 package helper
 
 import (

package/templates/native-go/backend/internal/helper/s1r_actor_races_linux_test.go

@@ -2,9 +2,12 @@ package helper
 
 import (
 	"context"
+	"errors"
 	"os"
 	"strings"
 	"testing"
+
+	"golang.org/x/sys/unix"
 )
 
 func s1rActorRaces(t *testing.T, spec s1rActorSpec, kind string) {
@@ -190,15 +193,31 @@ func s1rActorRaces(t *testing.T, spec s1rActorSpec, kind string) {
 		s1rMust(t, os.Chmod(root, 0500))
 		defer os.Chmod(root, 0700)
 		r, c := x.Commit(ctx)
-		// Current S7 maps linkat EACCES to unsupported; require the exact behavior,
-		// report it, and preserve the fail-closed publish gate.
-		if c != ErrUnsupported || r.Published || r.Committed || r.BytesWritten != 3 {
+		if c != ErrDenied || !r.Created || r.Published || r.Committed || r.BytesWritten != 3 {
 			t.Fatal("publish after parent chmod", r, c)
 		}
 		if _, e := os.Stat(root + "/result"); !os.IsNotExist(e) {
 			t.Fatal("publish wrote forbidden directory", e)
 		}
-		t.Log("parent write permission removed: kernel denies linkat; receipt retains staged bytes, published=false")
+		var st unix.Stat_t
+		s1rMust(t, unix.Fstat(int(x.file.Fd()), &st))
+		if st.Nlink != 0 || st.Size != 3 {
+			t.Fatal("anonymous stage changed after denial", st.Nlink, st.Size)
+		}
+		if retry, code := x.Commit(ctx); code != ErrReplay || retry != r {
+			t.Fatal("denied publish replay changed receipt", retry, code)
+		}
+		x.Close()
+		x.Close()
+		if _, e := x.file.Stat(); !errors.Is(e, os.ErrClosed) {
+			t.Fatal("stage descriptor still open", e)
+		}
+		entries, e := os.ReadDir(root)
+		s1rMust(t, e)
+		if len(entries) != 1 || entries[0].Name() != "file" {
+			t.Fatal("denied publish left a named stage", entries)
+		}
+		t.Log("parent write permission removed: publish denied; staged bytes and receipt retained; close leaves no named stage")
 	case "open-fd-write-permission-loss":
 		work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"result"}, MaxBytes: 6}
 		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})

package/templates/native-go/backend/internal/helper/sdk_assembly_linux.go

@@ -0,0 +1,51 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/dsm"
+	"dsmapp/internal/filestation"
+)
+
+type unavailableSDKValidator struct{}
+
+func (unavailableSDKValidator) ValidateJob(context.Context, NativeActor, sdkJobRequest, Grant, sdkJobCheckpoint) (sdkJobProof, Code) {
+	return sdkJobProof{}, ErrUnavailable
+}
+
+// The sole owner calls this once, after the authority's startup reconciliation.
+// Native/POSIX services stay unavailable. Production uses only session-authenticated
+// File Station requests; explicit native VM fixtures retain their own test seam.
+func openSDKJobs(c Client, binary string, s *supervisorGrants, repo *FileGrantRepository) (*sdkJobOwner, Code, string) {
+	if len(sdkCompiledRegistry) == 0 {
+		return nil, ErrUnavailable, "jobs-registry"
+	}
+	journal, code, stage := newSDKFileJobJournalDiagnostic(repo)
+	if code != "" {
+		return nil, code, stage
+	}
+	var validator sdkJobValidator = unavailableSDKValidator{}
+	if v, ok := s.services.consent.(sdkJobValidator); ok {
+		validator = v
+	}
+	o, code := newSDKJobOwner(s, sdkCompiledRegistry, sdkJobServices{Validator: validator, Journal: journal, Start: func(a NativeActor, b operationBinding, p sdkJobPlan) (sdkJobProcess, error) {
+		return startLinuxSDKJob(c, binary, a, b, p)
+	}})
+	if code != "" {
+		return nil, code, "jobs-owner"
+	}
+	// Reuse the same retained journal/index for revocation. No observer, validator,
+	// ready/consume loop or background child bootstrap is installed.
+	if _, code = newSDKBackgroundOwner(o, nil, nil, journal, newSDKEpochClock()); code != "" {
+		return nil, code, "background-index"
+	}
+	if _, nativeFixture := s.services.consent.(sdkJobValidator); !nativeFixture {
+		o.session, code = newSDKSessionJobs(o, filestation.Local("/var/packages/"+c.Expected.Package+"/var"), dsm.NewAuthenticator())
+		if code != "" {
+			return nil, code, "session-history"
+		}
+	}
+	newSDKJobViews(o)
+	return o, "", ""
+}