@synopackageland/cli 0.4.1 → 0.5.3

package/dist/templates/native-go/backend/internal/background/schedule.go

@@ -0,0 +1,300 @@
+package background
+
+import (
+	"context"
+	"errors"
+	"golang.org/x/sys/unix"
+	"io"
+	"os"
+	"time"
+)
+
+const MaxSchedules = 8
+const ManualQueueReserve = 4
+
+// A tick delayed past this window is missed, never a catch-up submission.
+const ScheduleWindow = 5 * time.Second
+
+var ErrScheduleFull = errors.New("background schedule limit reached")
+var ErrInputUnavailable = errors.New("the imported private copy is unavailable")
+
+type Schedule struct {
+	ID              string    `json:"id"`
+	Key             string    `json:"key"`
+	Owner           Submitter `json:"owner"`
+	SourceJobID     string    `json:"sourceJobId"`
+	Name            string    `json:"name"`
+	InputDigest     string    `json:"inputDigest"`
+	InputBytes      int       `json:"inputBytes"`
+	WorkerRevision  int       `json:"workerRevision"`
+	IntervalSeconds int       `json:"intervalSeconds"`
+	Enabled         bool      `json:"enabled"`
+	CreatedAt       time.Time `json:"createdAt"`
+	NextAt          time.Time `json:"nextAt"`
+	LastTriggeredAt time.Time `json:"lastTriggeredAt,omitzero"`
+	Missed          uint64    `json:"missed"`
+	LastMissedAt    time.Time `json:"lastMissedAt,omitzero"`
+	Reason          string    `json:"reason,omitempty"`
+}
+type ScheduleRequest struct {
+	Key             string `json:"key"`
+	JobID           string `json:"jobId"`
+	IntervalSeconds int    `json:"intervalSeconds"`
+	Consent         bool   `json:"consent"`
+}
+
+func validInterval(seconds int) bool { return seconds == 3600 || seconds == 86400 || seconds == 604800 }
+func (a Access) seesSchedule(sc Schedule) bool {
+	return a.Admin || (a.Owner.Valid() && sc.Owner == a.Owner)
+}
+func findSchedule(j *journal, id string) *Schedule {
+	if !jobID.MatchString(id) {
+		return nil
+	}
+	for i := range j.Schedules {
+		if j.Schedules[i].ID == id {
+			return &j.Schedules[i]
+		}
+	}
+	return nil
+}
+func (s *Store) Schedules(ctx context.Context, a Access) ([]Schedule, error) {
+	out := []Schedule{}
+	err := s.withJournal(ctx, func(_ *os.Root, j *journal) (bool, error) {
+		for _, sc := range j.Schedules {
+			if a.seesSchedule(sc) {
+				out = append(out, sc)
+			}
+		}
+		return false, nil
+	})
+	return out, err
+}
+func readCopy(root *os.Root, id, digest string, size int) ([]byte, error) {
+	if !jobID.MatchString(id) || size < 1 || size > MaxInputBytes {
+		return nil, ErrInputUnavailable
+	}
+	f, err := root.OpenFile(inputs+"/"+id, os.O_RDONLY|unix.O_NOFOLLOW, 0)
+	if err != nil {
+		return nil, ErrInputUnavailable
+	}
+	defer f.Close()
+	if checkPrivate(f) != nil {
+		return nil, ErrInputUnavailable
+	}
+	b, err := io.ReadAll(io.LimitReader(f, MaxInputBytes+1))
+	if err != nil || len(b) != size || sha256hex(b) != digest {
+		return nil, ErrInputUnavailable
+	}
+	return b, nil
+}
+func (s *Store) CreateSchedule(ctx context.Context, r ScheduleRequest, a Access) (Schedule, bool, error) {
+	var out Schedule
+	dup := false
+	if !a.Owner.Valid() || !r.Consent || !validInterval(r.IntervalSeconds) || !keyRE.MatchString(r.Key) {
+		return out, false, ErrInvalid
+	}
+	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+		if !j.Enabled {
+			return false, ErrDisabled
+		}
+		if !a.Admin && !j.AllowOrdinaryUsers {
+			return false, ErrOrdinaryDisabled
+		}
+		for _, sc := range j.Schedules {
+			if sc.Owner == a.Owner && sc.Key == r.Key {
+				if sc.SourceJobID != r.JobID || sc.IntervalSeconds != r.IntervalSeconds {
+					return false, ErrKeyConflict
+				}
+				out, dup = sc, true
+				return false, nil
+			}
+		}
+		job := find(j, r.JobID)
+		if job == nil || job.PurgeRequested || job.Submitter != a.Owner {
+			return false, ErrNotFound
+		}
+		// Scheduling only a completed import avoids racing a mutable/incomplete source.
+		if job.State != StateSucceeded || job.ScheduleID != "" || job.WorkerRevision != s.revision {
+			return false, ErrInputUnavailable
+		}
+		data, err := readCopy(root, job.ID, job.InputDigest, job.InputBytes)
+		if err != nil {
+			return false, err
+		}
+		if len(j.Schedules) >= MaxSchedules {
+			return false, ErrScheduleFull
+		}
+		_, ownerBytes := j.ownerUsage(a.Owner)
+		if ownerBytes+int64(len(data)) > MaxOwnerBytes {
+			return false, ErrOwnerQuota
+		}
+		_, used := j.pending()
+		if used+int64(len(data)) > s.limits.MaxTotalBytes {
+			return false, ErrQuota
+		}
+		id, err := newID()
+		if err != nil {
+			return false, err
+		}
+		if err := writeInput(root, id, data); err != nil {
+			return false, err
+		}
+		now := s.now().UTC()
+		out = Schedule{ID: id, Key: r.Key, Owner: a.Owner, SourceJobID: job.ID, Name: job.Name, InputDigest: job.InputDigest, InputBytes: job.InputBytes, WorkerRevision: s.revision, IntervalSeconds: r.IntervalSeconds, Enabled: true, CreatedAt: now, NextAt: now.Add(time.Duration(r.IntervalSeconds) * time.Second)}
+		j.Schedules = append(j.Schedules, out)
+		return true, nil
+	})
+	return out, dup, err
+}
+
+// SetSchedule(false) journals revocation before the cancel watcher can observe it.
+// Enable is administrator-only and requires fresh explicit consent at the route.
+func (s *Store) SetSchedule(ctx context.Context, id string, enabled bool, a Access) (Schedule, error) {
+	var out Schedule
+	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+		sc := findSchedule(j, id)
+		if sc == nil || !a.seesSchedule(*sc) {
+			return false, ErrNotFound
+		}
+		if enabled {
+			if !a.Admin {
+				return false, ErrInvalid
+			}
+			if !j.Enabled {
+				return false, ErrDisabled
+			}
+			if _, err := readCopy(root, sc.ID, sc.InputDigest, sc.InputBytes); err != nil {
+				return false, err
+			}
+			sc.WorkerRevision = s.revision
+			sc.Enabled = true
+			sc.Reason = ""
+			sc.NextAt = s.now().UTC().Add(time.Duration(sc.IntervalSeconds) * time.Second)
+		} else {
+			sc.Enabled = false
+			sc.Reason = "disabled"
+			s.cancelScheduleJobs(root, j, id)
+		}
+		out = *sc
+		return true, nil
+	})
+	return out, err
+}
+func (s *Store) cancelScheduleJobs(root *os.Root, j *journal, id string) {
+	for i := range j.Jobs {
+		job := &j.Jobs[i]
+		if job.ScheduleID != id {
+			continue
+		}
+		if job.State == StateQueued {
+			s.finishJob(root, job, StateCanceled, "schedule-disabled")
+		} else if job.State == StateRunning {
+			job.CancelRequested = true
+		}
+	}
+}
+func (s *Store) DeleteSchedule(ctx context.Context, id string, a Access) error {
+	return s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+		sc := findSchedule(j, id)
+		if sc == nil || !a.seesSchedule(*sc) {
+			return false, ErrNotFound
+		}
+		s.cancelScheduleJobs(root, j, id)
+		kept := j.Schedules[:0]
+		for _, v := range j.Schedules {
+			if v.ID != id {
+				kept = append(kept, v)
+			}
+		}
+		j.Schedules = kept
+		return true, nil
+	})
+}
+func (s *Store) reconcileSchedules(root *os.Root, j *journal, recovering bool) bool {
+	changed := false
+	now := s.now().UTC()
+	for i := range j.Schedules {
+		sc := &j.Schedules[i]
+		if !validInterval(sc.IntervalSeconds) || sc.NextAt.IsZero() {
+			sc.Enabled = false
+			sc.Reason = "invalid-schedule"
+			s.cancelScheduleJobs(root, j, sc.ID)
+			changed = true
+			continue
+		}
+		if sc.WorkerRevision != s.revision {
+			sc.Enabled = false
+			sc.Reason = "worker-changed"
+			s.cancelScheduleJobs(root, j, sc.ID)
+			changed = true
+			continue
+		}
+		if !sc.Enabled || sc.NextAt.After(now) {
+			continue
+		}
+		due := sc.NextAt
+		period := time.Duration(sc.IntervalSeconds) * time.Second
+		count := uint64(now.Sub(due)/period) + 1
+		sc.NextAt = due.Add(time.Duration(count) * period)
+		changed = true
+		// Recovery deliberately skips even a just-due tick. There is no startup burst.
+		if recovering || !j.Enabled || count > 1 || now.Sub(due) > ScheduleWindow {
+			sc.Missed += count
+			sc.LastMissedAt = due
+			sc.Reason = "missed"
+			continue
+		}
+		data, err := readCopy(root, sc.ID, sc.InputDigest, sc.InputBytes)
+		if err != nil {
+			sc.Enabled = false
+			sc.Reason = "input-unavailable"
+			sc.Missed++
+			sc.LastMissedAt = due
+			continue
+		}
+		pending, ownerBytes := j.ownerUsage(sc.Owner)
+		countPending, used := j.pending()
+		reason := ""
+		switch {
+		case pending >= MaxOwnerPending:
+			reason = "owner-queue-full"
+		case ownerBytes+int64(len(data)+resultReserve) > MaxOwnerBytes:
+			reason = "owner-quota-exceeded"
+		case countPending >= MaxQueued-ManualQueueReserve:
+			reason = "queue-full"
+		case used+int64(len(data)+resultReserve) > s.limits.MaxTotalBytes:
+			reason = "quota-exceeded"
+		}
+		if reason != "" {
+			sc.Missed++
+			sc.LastMissedAt = due
+			sc.Reason = reason
+			continue
+		}
+		id, err := newID()
+		if err != nil {
+			sc.Missed++
+			sc.LastMissedAt = due
+			sc.Reason = "unavailable"
+			continue
+		}
+		if err := writeInput(root, id, data); err != nil {
+			sc.Missed++
+			sc.LastMissedAt = due
+			sc.Reason = "unavailable"
+			continue
+		}
+		sc.LastTriggeredAt = due
+		sc.Reason = ""
+		j.Jobs = append(j.Jobs, Job{ID: id, Key: "schedule-" + id, Name: sc.Name, State: StateQueued, Submitter: sc.Owner, Worker: WorkerSHA256V1, WorkerRevision: s.revision, InputDigest: sc.InputDigest, InputBytes: sc.InputBytes, SubmittedAt: now, ScheduleID: sc.ID, ScheduledAt: due})
+	}
+	j.trim()
+	return changed
+}
+
+// Tick advances each durable checkpoint and creates a job in the same commit.
+// Multiple processes therefore cannot admit the same schedule trigger twice.
+func (s *Store) Tick(ctx context.Context) error {
+	return s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) { return s.reconcileSchedules(root, j, false), nil })
+}

package/dist/templates/native-go/backend/internal/background/schedule_test.go

@@ -0,0 +1,335 @@
+package background
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+)
+
+func scheduledStore(t *testing.T) (*Store, *time.Time, Job, Schedule) {
+	t.Helper()
+	s, _ := newStore(t)
+	now := time.Date(2026, 10, 5, 0, 0, 0, 0, time.UTC)
+	s.now = func() time.Time { return now }
+	source := submit(t, s, "source", []byte("copy"))
+	_, _ = s.Claim(context.Background())
+	if err := s.Finish(context.Background(), source.ID, Outcome{State: StateSucceeded, Result: &Result{SHA256: digest([]byte("copy")), Bytes: 4}}); err != nil {
+		t.Fatal(err)
+	}
+	sc, _, err := s.CreateSchedule(context.Background(), ScheduleRequest{Key: "schedule", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return s, &now, source, sc
+}
+func TestScheduleDurablePrivateCopyAndConsent(t *testing.T) {
+	s, now, source, sc := scheduledStore(t)
+	ctx := context.Background()
+	list, err := NewStore(s.dir).Schedules(ctx, Access{Owner: admin})
+	if err != nil || len(list) != 1 || list[0].InputDigest != source.InputDigest || !list[0].NextAt.Equal(now.Add(time.Hour)) {
+		t.Fatalf("durable %+v %v", list, err)
+	}
+	b, err := os.ReadFile(filepath.Join(s.dir, inputs, sc.ID))
+	if err != nil || string(b) != "copy" {
+		t.Fatalf("copy %q %v", b, err)
+	}
+	for _, r := range []ScheduleRequest{{Key: "x", JobID: source.ID, IntervalSeconds: 3600}, {Key: "x", JobID: source.ID, IntervalSeconds: 1, Consent: true}, {Key: "x", JobID: "../journal.json", IntervalSeconds: 3600, Consent: true}} {
+		if _, _, err := s.CreateSchedule(ctx, r, Access{Owner: admin, Admin: true}); err == nil {
+			t.Fatalf("admitted %+v", r)
+		}
+	}
+	again, dup, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "schedule", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true})
+	if err != nil || !dup || again.ID != sc.ID {
+		t.Fatalf("retry %+v %v %v", again, dup, err)
+	}
+}
+func TestScheduleConcurrentTwoTriggersNoReplayRestartMissed(t *testing.T) {
+	s, now, _, sc := scheduledStore(t)
+	ctx := context.Background()
+	for round := 1; round <= 2; round++ {
+		*now = now.Add(time.Hour)
+		var wg sync.WaitGroup
+		for i := 0; i < 8; i++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				if err := s.Tick(ctx); err != nil {
+					t.Error(err)
+				}
+			}()
+		}
+		wg.Wait()
+		jobs, _ := s.List(ctx)
+		n := 0
+		for _, j := range jobs {
+			if j.ScheduleID == sc.ID {
+				n++
+			}
+		}
+		if n != round {
+			t.Fatalf("round %d got %d", round, n)
+		}
+		j, err := s.Claim(ctx)
+		if err != nil || j == nil {
+			t.Fatal(err)
+		}
+		if !j.ScheduledAt.Equal(*now) {
+			t.Fatal("trigger time")
+		}
+		if err := s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{SHA256: j.InputDigest, Bytes: 4}}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	before, _ := s.List(ctx)
+	*now = now.Add(3*time.Hour + time.Minute)
+	if err := s.Recover(ctx); err != nil {
+		t.Fatal(err)
+	}
+	_ = s.Tick(ctx)
+	after, _ := s.List(ctx)
+	if len(after) != len(before) {
+		t.Fatal("restart replayed")
+	}
+	list, _ := s.Schedules(ctx, Access{Admin: true})
+	if list[0].Missed != 3 || !list[0].NextAt.After(*now) {
+		t.Fatalf("missed %+v", list)
+	}
+	*now = now.Add(-4 * time.Hour)
+	_ = s.Tick(ctx)
+	after, _ = s.List(ctx)
+	if len(after) != len(before) {
+		t.Fatal("backward clock replay")
+	}
+}
+func TestScheduleIsolationDisableDeleteRevision(t *testing.T) {
+	s, now, source, sc := scheduledStore(t)
+	ctx := context.Background()
+	other := Access{Owner: Submitter{User: "normal2", UID: "1026"}}
+	if list, _ := s.Schedules(ctx, other); len(list) != 0 {
+		t.Fatal("leak")
+	}
+	if _, err := s.SetSchedule(ctx, sc.ID, false, other); !errors.Is(err, ErrNotFound) {
+		t.Fatal(err)
+	}
+	if err := s.DeleteSchedule(ctx, sc.ID, other); !errors.Is(err, ErrNotFound) {
+		t.Fatal(err)
+	}
+	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "steal", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, other); err == nil {
+		t.Fatal("cross-owner")
+	}
+	*now = now.Add(time.Hour)
+	_ = s.Tick(ctx)
+	job, _ := s.Claim(ctx)
+	if _, err := s.SetSchedule(ctx, sc.ID, false, Access{Owner: admin}); err != nil {
+		t.Fatal(err)
+	}
+	_ = s.Finish(ctx, job.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 4}})
+	got, _ := s.Get(ctx, job.ID)
+	if got.State != StateCanceled || got.Result != nil {
+		t.Fatal("disable lost")
+	}
+	*now = now.Add(time.Hour)
+	_ = s.Tick(ctx)
+	jobs, _ := s.List(ctx)
+	if len(jobs) != 2 {
+		t.Fatal("disabled trigger")
+	}
+	if _, err := s.SetSchedule(ctx, sc.ID, true, Access{Owner: admin}); !errors.Is(err, ErrInvalid) {
+		t.Fatal(err)
+	}
+	s.revision++
+	if err := s.Recover(ctx); err != nil {
+		t.Fatal(err)
+	}
+	list, _ := s.Schedules(ctx, Access{Admin: true})
+	if list[0].Enabled || list[0].Reason != "worker-changed" {
+		t.Fatal(list)
+	}
+	if _, err := s.SetSchedule(ctx, sc.ID, true, Access{Admin: true, Owner: admin}); err != nil {
+		t.Fatal(err)
+	}
+	list, _ = s.Schedules(ctx, Access{Admin: true})
+	if list[0].WorkerRevision != s.revision {
+		t.Fatal("revision")
+	}
+	if err := s.DeleteSchedule(ctx, sc.ID, Access{Owner: admin}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(s.dir, inputs, sc.ID)); !errors.Is(err, os.ErrNotExist) {
+		t.Fatal("copy remains")
+	}
+}
+func TestScheduleBoundsQuotasAndModeRevocation(t *testing.T) {
+	s, now, source, _ := scheduledStore(t)
+	ctx := context.Background()
+	for i := 1; i < MaxSchedules; i++ {
+		if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: fmt.Sprint(i), JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "overflow", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true}); !errors.Is(err, ErrScheduleFull) {
+		t.Fatal(err)
+	}
+	*now = now.Add(time.Hour)
+	_ = s.Tick(ctx)
+	jobs, _ := s.List(ctx)
+	n := 0
+	for _, j := range jobs {
+		if !j.State.terminal() {
+			n++
+		}
+	}
+	if n != MaxOwnerPending {
+		t.Fatalf("pending %d", n)
+	}
+	list, _ := s.Schedules(ctx, Access{Admin: true})
+	missed := uint64(0)
+	for _, sc := range list {
+		missed += sc.Missed
+	}
+	if missed != 6 {
+		t.Fatalf("missed %d", missed)
+	}
+	_ = s.SetEnabled(ctx, false)
+	_ = s.SetEnabled(ctx, true)
+	*now = now.Add(time.Hour)
+	_ = s.Tick(ctx)
+	list, _ = s.Schedules(ctx, Access{Admin: true})
+	for _, sc := range list {
+		if sc.Enabled {
+			t.Fatal("revived")
+		}
+	}
+}
+func TestScheduleLateLegacyTamperPurge(t *testing.T) {
+	s, now, source, sc := scheduledStore(t)
+	ctx := context.Background()
+	*now = now.Add(time.Hour + time.Minute)
+	_ = s.Tick(ctx)
+	jobs, _ := s.List(ctx)
+	if len(jobs) != 1 {
+		t.Fatal("catchup")
+	}
+	list, _ := s.Schedules(ctx, Access{Admin: true})
+	if list[0].Missed != 1 || list[0].Reason != "missed" {
+		t.Fatal(list)
+	}
+	_ = os.Remove(filepath.Join(s.dir, inputs, source.ID))
+	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "legacy", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true}); !errors.Is(err, ErrInputUnavailable) {
+		t.Fatal(err)
+	}
+	_ = os.WriteFile(filepath.Join(s.dir, inputs, sc.ID), []byte("evil"), 0600)
+	*now = list[0].NextAt
+	_ = s.Tick(ctx)
+	list, _ = s.Schedules(ctx, Access{Admin: true})
+	if list[0].Enabled || list[0].Reason != "input-unavailable" {
+		t.Fatal(list)
+	}
+	_, err := s.PurgeOwner(ctx, admin, "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	list, _ = s.Schedules(ctx, Access{Admin: true})
+	if len(list) != 0 {
+		t.Fatal("purge schedule")
+	}
+}
+
+func TestScheduleReservesFourManualQueueSlots(t *testing.T) {
+	s, now, _, sc := scheduledStore(t)
+	ctx := context.Background()
+	for i := 0; i < 12; i++ {
+		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "manual", Data: []byte("x"), Admin: true, Submitter: Submitter{User: "other", UID: fmt.Sprint(2000 + i)}})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	*now = now.Add(time.Hour)
+	if err := s.Tick(ctx); err != nil {
+		t.Fatal(err)
+	}
+	list, _ := s.Schedules(ctx, Access{Admin: true})
+	if list[0].ID != sc.ID || list[0].Reason != "queue-full" || list[0].Missed != 1 {
+		t.Fatal(list)
+	}
+	for i := 12; i < 16; i++ {
+		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "manual", Data: []byte("x"), Admin: true, Submitter: Submitter{User: "other", UID: fmt.Sprint(2000 + i)}})
+		if err != nil {
+			t.Fatalf("reserved slot: %v", err)
+		}
+	}
+}
+func TestRetainedCopyQuotaHistoryAndOrdinaryScheduleGate(t *testing.T) {
+	s, now, source, _ := scheduledStore(t)
+	ctx := context.Background()
+	if err := s.Recover(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(s.dir, inputs, source.ID)); err != nil {
+		t.Fatal("recover deleted retained import")
+	}
+	_, bytes := func() (int, int64) {
+		var n int
+		var b int64
+		_ = s.withJournal(ctx, func(_ *os.Root, j *journal) (bool, error) { n, b = j.ownerUsage(admin); return false, nil })
+		return n, b
+	}()
+	if bytes != 8+resultReserve {
+		t.Fatalf("retained quota %d", bytes)
+	}
+	owner := Submitter{User: "normal1", UID: "1025"}
+	_ = s.SetOrdinaryUsers(ctx, true)
+	j, _, err := s.Submit(ctx, SubmitRequest{Key: "user", Name: "copy", Data: []byte("copy"), Submitter: owner})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = s.Claim(ctx)
+	_ = s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 4}})
+	_ = s.SetOrdinaryUsers(ctx, false)
+	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "user", JobID: j.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: owner}); !errors.Is(err, ErrOrdinaryDisabled) {
+		t.Fatal(err)
+	}
+	for i := 0; i < MaxHistory+2; i++ {
+		j := submit(t, s, fmt.Sprint(i), []byte("x"))
+		_, _ = s.Claim(ctx)
+		_ = s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 1}})
+	}
+	if _, err := os.Stat(filepath.Join(s.dir, inputs, source.ID)); !errors.Is(err, os.ErrNotExist) {
+		t.Fatal("history leaked copy")
+	}
+	// Pin survives trimming of the imported source job.
+	list, _ := s.Schedules(ctx, Access{Admin: true})
+	*now = list[0].NextAt
+	_ = s.Tick(ctx)
+	jobs, _ := s.List(ctx)
+	found := false
+	for _, j := range jobs {
+		if j.ScheduleID == list[0].ID {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("history removed pin")
+	}
+}
+
+func TestGlobalQuotaReservesResultBeforeRetainedCopyAdmission(t *testing.T) {
+	s, _ := newStore(t)
+	ctx := context.Background()
+	s.limits.MaxTotalBytes = resultReserve + 1
+	_, _, err := s.Submit(ctx, SubmitRequest{Key: "oversized-total", Name: "copy", Data: []byte("xx"), Submitter: admin, Admin: true})
+	if !errors.Is(err, ErrQuota) {
+		t.Fatalf("result reservation overflow admitted: %v", err)
+	}
+	j := submit(t, s, "exact", []byte("x"))
+	_, _ = s.Claim(ctx)
+	_ = s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 1}})
+	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "pin", JobID: j.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true}); !errors.Is(err, ErrQuota) {
+		t.Fatalf("retained copy quota %v", err)
+	}
+}