@synopackageland/cli 0.4.1 → 0.5.3

package/templates/native-go/backend/internal/helper/sdk_background_authority_test.go

@@ -0,0 +1,714 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"fmt"
+	"slices"
+	"syscall"
+	"testing"
+	"time"
+)
+
+type sdkMemoryJournal struct {
+	sdkJobTestJournal
+	records     []sdkJournalRecord
+	recordsCode Code
+}
+
+func (j *sdkMemoryJournal) Records() ([]sdkJournalRecord, Code) {
+	if j.recordsCode != "" {
+		return nil, j.recordsCode
+	}
+	out := []sdkJournalRecord{}
+	for _, r := range j.records {
+		raw, _ := encodeSDKJournal(r)
+		copy, c := decodeSDKJournal(raw)
+		if c != "" {
+			return nil, c
+		}
+		out = append(out, copy)
+	}
+	return out, ""
+}
+func (j *sdkMemoryJournal) Reserve(i sdkJobIntent) Code {
+	if c := j.sdkJobTestJournal.Reserve(i); c != "" {
+		return c
+	}
+	b, _ := json.Marshal(sdkJournalRecord{Schema: 1, Intent: i, State: "pending"})
+	r, c := decodeSDKJournal(b)
+	if c != "" {
+		return c
+	}
+	j.records = append(j.records, r)
+	return ""
+}
+
+type sdkBackgroundValidatorFake struct {
+	root   readOnlyRootWitness
+	now    func() time.Time
+	code   Code
+	after  func()
+	mutate func(*sdkBackgroundProof)
+}
+
+func (v *sdkBackgroundValidatorFake) ValidateBackground(_ context.Context, _ backgroundSnapshot, r sdkJobRequest, g Grant) (sdkBackgroundProof, Code) {
+	if v.after != nil {
+		v.after()
+	}
+	p := sdkBackgroundProof{Binding: r.Control.Binding, Continuity: g.LastValidated, Continuous: true, CheckedAt: v.now(), Root: v.root}
+	if v.mutate != nil {
+		v.mutate(&p)
+	}
+	return p, v.code
+}
+
+type sdkBackgroundFixture struct {
+	*sdkJobTestFixture
+	bg         *sdkBackgroundOwner
+	offline    *offlineFake
+	journal2   *sdkMemoryJournal
+	validator2 *sdkBackgroundValidatorFake
+	wall       time.Time
+	mono       time.Duration
+	clockKnown bool
+}
+
+func newSDKBackgroundFixture(t *testing.T) *sdkBackgroundFixture {
+	f := sdkJobFixture(t, jobcontract.Interactive, jobcontract.Background)
+	x := &sdkBackgroundFixture{sdkJobTestFixture: f, wall: f.c.now(), clockKnown: true}
+	now := func() time.Time { return x.wall }
+	f.c.now = now
+	f.s.authority.now = now
+	f.s.authority.native.now = now
+	x.offline = &offlineFake{proof: backgroundAppProof{Identity: f.native.account.Identity, AppID: "FixturePrivilege", Known: true, Allowed: true, OfflineEquivalent: true, CheckedAt: x.wall}}
+	observer := &backgroundObserver{accounts: f.native, groups: f.native, app: x.offline, appID: "FixturePrivilege", now: now}
+	x.journal2 = &sdkMemoryJournal{sdkJobTestJournal: sdkJobTestJournal{intents: map[string]sdkJobIntent{}, receipts: map[string]sdkJobReceipt{}}}
+	f.o.services.Journal = x.journal2
+	x.validator2 = &sdkBackgroundValidatorFake{root: f.validator.root, now: now}
+	var c Code
+	x.bg, c = newSDKBackgroundOwner(f.o, observer, x.validator2, x.journal2, func() (time.Time, time.Duration, bool) { return x.wall, x.mono, x.clockKnown })
+	if c != "" {
+		t.Fatal(c)
+	}
+	return x
+}
+func (f *sdkBackgroundFixture) prepare(t *testing.T, ttl time.Duration) Intent {
+	t.Helper()
+	i, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input, TTL: ttl})
+	if c != "" {
+		t.Fatal(c)
+	}
+	return i
+}
+func (f *sdkBackgroundFixture) confirm(t *testing.T, i Intent) jobcontract.BackgroundRecord {
+	t.Helper()
+	r, c := f.bg.confirm(context.Background(), f.carriers, i.ID, i.SummaryDigest, f.repo.store.Revision)
+	if c != "" {
+		t.Fatal(c)
+	}
+	return r
+}
+func (f *sdkBackgroundFixture) refresh() {
+	f.native.session.CheckedAt = f.wall
+	f.native.account.CheckedAt = f.wall
+	f.native.groups.CheckedAt = f.wall
+	f.native.app.CheckedAt = f.wall
+	f.offline.proof.CheckedAt = f.wall
+	f.c.gate.observe(f.c.gate.binding, 1, true, f.wall)
+}
+func TestSDKBackgroundConsentSingleUseAndNoSessionReuse(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	i := f.prepare(t, 0)
+	r := f.confirm(t, i)
+	if r.ExpiresAt-r.CreatedAt != 24*60*60*1000 || r.Binding.SessionRef != "" || r.Issuer != r.Binding.Actor || len(f.repo.store.Background) != 1 || len(f.journal2.records) != 1 {
+		t.Fatal(r)
+	}
+	if _, c := f.bg.confirm(context.Background(), f.carriers, i.ID, i.SummaryDigest, f.repo.store.Revision); c != ErrReplay {
+		t.Fatal(c)
+	}
+	f.native.sessionCode = ErrDenied
+	res, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID)
+	if c != "" || res.Record.State != "consumed" || res.Record.ExecutionKey == "" || len(f.c.operations) != 1 {
+		t.Fatal(c, res)
+	}
+	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c != ErrReplay {
+		t.Fatal("single use", c)
+	}
+	// S3 reservation is not registry->spawn. Neither process factory nor session
+	// refresh is invoked for background; S7 must implement offline child assembly.
+	if len(f.children) != 0 {
+		t.Fatal("production launch path added")
+	}
+	if c := f.c.launchReserved(res.operation); c != ErrUnavailable {
+		t.Fatal("background entered interactive launcher", c)
+	}
+}
+func TestSDKBackgroundIntentLimitsExactInputAndExpiry(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	for n := 0; n < MaxLiveIntents; n++ {
+		f.prepare(t, time.Hour)
+	}
+	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input}); c != ErrBusy {
+		t.Fatal("intent cap", c)
+	}
+	f = newSDKBackgroundFixture(t)
+	i := f.prepare(t, time.Hour)
+	if _, c := f.bg.confirm(context.Background(), f.carriers, i.ID, grantRef('b'), f.repo.store.Revision); c != ErrDenied {
+		t.Fatal(c)
+	}
+	f.wall = f.wall.Add(IntentTTL)
+	f.mono += IntentTTL
+	f.refresh()
+	if _, c := f.bg.confirm(context.Background(), f.carriers, i.ID, i.SummaryDigest, f.repo.store.Revision); c != ErrExpired {
+		t.Fatal("exact expiry", c)
+	}
+	f = newSDKBackgroundFixture(t)
+	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input, TTL: 8 * 24 * time.Hour}); c != ErrLimit {
+		t.Fatal(c)
+	}
+}
+func TestSDKBackgroundClockAndMissingProofLatch(t *testing.T) {
+	for _, kind := range []string{"wall-expiry", "monotonic-expiry", "rollback", "clock-unknown", "offline-missing", "input-change"} {
+		t.Run(kind, func(t *testing.T) {
+			f := newSDKBackgroundFixture(t)
+			r := f.confirm(t, f.prepare(t, time.Minute))
+			id := r.Binding.Binding.Delegation.ID
+			switch kind {
+			case "wall-expiry":
+				f.wall = f.wall.Add(time.Minute)
+			case "monotonic-expiry":
+				f.mono += time.Minute
+			case "rollback":
+				f.wall = f.wall.Add(-time.Second)
+			case "clock-unknown":
+				f.clockKnown = false
+			case "offline-missing":
+				f.bg.observer.app = nil
+			case "input-change":
+				f.journal2.records[0].Intent.Request.Input.Steps[0].Segments[0] = "other"
+			}
+			f.refresh()
+			if _, c := f.bg.consume(context.Background(), id); c == "" {
+				t.Fatal("invalid lease")
+			}
+			if len(f.children) != 0 || len(f.c.operations) != 0 {
+				t.Fatal("spawn/reservation without proof")
+			}
+			f.wall = time.UnixMilli(int64(r.CreatedAt))
+			f.mono = 0
+			f.clockKnown = true
+			f.refresh()
+			f.bg.observer.app = f.offline
+			if _, c := f.bg.consume(context.Background(), id); c == "" {
+				t.Fatal("denial resurrected")
+			}
+		})
+	}
+}
+
+func TestSDKBackgroundParentRevokeDrainsEveryDerivedJob(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r := f.confirm(t, f.prepare(t, time.Hour))
+	res, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID)
+	if c != "" {
+		t.Fatal(c)
+	}
+	child := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}, ok: true}
+	res.operation.process = child
+	f.bg.job(r.Binding.Binding.Delegation.ID).process = child
+	f.c.started++
+	result, c := f.s.authority.Revoke(context.Background(), f.carriers, f.g.ID, f.g.Revision, f.repo.store.Revision)
+	if c != "" || !result.Revoked || !result.Drained {
+		t.Fatal(result, c)
+	}
+	if f.repo.store.Background[0].State != "revoked" || len(f.c.operations) != 0 || f.c.reaped != 1 {
+		t.Fatal("parent fanout missing", f.repo.store.Background, len(f.c.operations), f.c.reaped)
+	}
+	j := f.bg.job(r.Binding.Binding.Delegation.ID)
+	if j.failure == "" || !j.receipt.Job.Drained || !j.terminal {
+		t.Fatal("job revived or missing durable Q", j.receipt)
+	}
+}
+func TestSDKBackgroundParentFailureDoesNotClaimRQ(t *testing.T) {
+	for _, kind := range []string{"R", "Q"} {
+		t.Run(kind, func(t *testing.T) {
+			f := newSDKBackgroundFixture(t)
+			r := f.confirm(t, f.prepare(t, time.Hour))
+			if kind == "R" {
+				f.repo.fail = ErrCommitUncertain
+			} else {
+				f.repo.qFailure = ErrUnavailable
+			}
+			result, c := f.s.authority.Revoke(context.Background(), f.carriers, f.g.ID, f.g.Revision, f.repo.store.Revision)
+			if c == "" || result.Drained || (kind == "R" && result.Revoked) {
+				t.Fatal("invented R/Q", result, c)
+			}
+			if j := f.bg.job(r.Binding.Binding.Delegation.ID); j.failure == "" || j.receipt.Job.Drained {
+				t.Fatal("no sticky output denial", j.receipt)
+			}
+		})
+	}
+}
+func TestSDKBackgroundRestartSuspendsConsumedAndPending(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	first := f.confirm(t, f.prepare(t, time.Hour))
+	f.confirm(t, f.prepare(t, time.Hour))
+	if _, c := f.bg.consume(context.Background(), first.Binding.Binding.Delegation.ID); c != "" {
+		t.Fatal(c)
+	}
+	if _, c := NewGrantAuthority(f.repo, nil, nil, nil); c != "" {
+		t.Fatal(c)
+	}
+	for _, r := range f.repo.store.Background {
+		if r.State != "suspended" {
+			t.Fatal("restart authority", r)
+		}
+	}
+	if f.repo.store.Background[0].ExecutionKey == "" {
+		t.Fatal("lost burned key")
+	}
+}
+
+func TestSDKBackgroundIdentityMismatchRevokesAllDelegations(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r := f.confirm(t, f.prepare(t, time.Hour))
+	f.confirm(t, f.prepare(t, time.Hour))
+	f.native.account.Identity.UID++
+	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c == "" {
+		t.Fatal("identity mismatch admitted")
+	}
+	if f.repo.store.Grants[0].State != GrantRevoked {
+		t.Fatal("parent identity was not revoked")
+	}
+	for _, r := range f.repo.store.Background {
+		if r.State != "revoked" {
+			t.Fatal("partial invalidation", r.State)
+		}
+	}
+}
+func TestSDKBackgroundSharedIssuerFanoutAndRetainedClosure(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	f.repo.store.Grants[0].Scope.Kind = ScopeShared
+	f.g.Scope.Kind = ScopeShared
+	first := f.confirm(t, f.prepare(t, time.Hour))
+	one, c := f.bg.consume(context.Background(), first.Binding.Binding.Delegation.ID)
+	if c != "" {
+		t.Fatal(c)
+	}
+	old := f.native.account.Identity
+	f.rememberOfflineActor()
+	bob := RelaxedIdentity{UID: 2002, Username: "bob"}
+	setRelaxedIdentity(f.native, bob)
+	f.offline.proof.Identity = bob
+	second := f.confirm(t, f.prepare(t, time.Hour))
+	two, c := f.bg.consume(context.Background(), second.Binding.Binding.Delegation.ID)
+	if c != "" {
+		t.Fatal(c)
+	}
+	for _, res := range []sdkBackgroundReservation{one, two} {
+		p := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}}
+		res.operation.process = p
+		f.bg.job(res.Record.Binding.Binding.Delegation.ID).process = p
+		f.c.started++
+	}
+	// The consenting shared issuer was alice; bob is only a beneficiary. An
+	// issuer mismatch must drain BOTH actors, not just jobs of the current caller.
+	if c := f.bg.invalidateIdentities(context.Background(), []RelaxedIdentity{old, {UID: old.UID, Username: "alice2"}}); c != "" {
+		t.Fatal(c)
+	}
+	if len(f.c.operations) != 0 || f.c.reaped != 2 {
+		t.Fatal("shared beneficiary survived", len(f.c.operations), f.c.reaped)
+	}
+	for _, r := range f.repo.store.Background {
+		if r.State != "revoked" {
+			t.Fatal("shared record survived")
+		}
+	}
+	// A retained, interrupted intent still contributes old identities even when
+	// no current job owns it. Closure must be order-independent.
+	g := cloneAuthorityGrant(f.g)
+	g.ID = grantRef('7')
+	g.Owner.UID = 3003
+	g.Owner.Username = "alice3"
+	g.Issuer = g.Owner
+	g.State = GrantActive
+	f.repo.store.Grants = append(f.repo.store.Grants, g)
+	seed := f.journal2.records[0]
+	seed.State = "interrupted"
+	seed.Intent.Actor = jobcontract.Principal{IdentityBasis: "uid-username", UID: old.UID, Username: "alice3"}
+	seed.Intent.Request.Control.Binding.Job.ID = grantRef('8')
+	f.journal2.records = append(f.journal2.records, seed)
+	f.s.authority.mu.Lock()
+	ids, c := f.s.authority.sdkIdentityClosureLocked([]RelaxedIdentity{old})
+	f.s.authority.mu.Unlock()
+	if c != "" || !slices.Contains(ids, RelaxedIdentity{UID: 3003, Username: "alice3"}) {
+		t.Fatal("retained identity missing", ids, c)
+	}
+}
+func TestSDKBackgroundIncompleteIndexFences(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	f.confirm(t, f.prepare(t, time.Hour))
+	f.journal2.recordsCode = ErrUnavailable
+	if c := f.bg.invalidateIdentities(context.Background(), []RelaxedIdentity{f.native.account.Identity}); c != ErrCleanupRequired || !f.s.authority.fenced {
+		t.Fatal(c, f.s.authority.fenced)
+	}
+}
+
+func TestSDKBackgroundLeaseRechecksExpiryAndOriginalInput(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r := f.confirm(t, f.prepare(t, time.Minute))
+	id := r.Binding.Binding.Delegation.ID
+	if _, c := f.bg.consume(context.Background(), id); c != "" {
+		t.Fatal(c)
+	}
+	f.native.sessionCode = ErrDenied
+	admitted := 0
+	if c := f.bg.admit(context.Background(), id, 0, func() Code { admitted++; return "" }); c != "" || admitted != 1 {
+		t.Fatal("offline lease required session", c)
+	}
+	f.wall = f.wall.Add(time.Minute)
+	f.mono += time.Minute
+	f.refresh()
+	if c := f.bg.admit(context.Background(), id, 0, func() Code { admitted++; return "" }); c == "" || admitted != 1 {
+		t.Fatal("expired output admitted", c)
+	}
+	if f.repo.store.Background[0].State != "expired" {
+		t.Fatal("expiry not latched")
+	}
+}
+func TestSDKBackgroundQueueSlotsAndFullAuthority(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r1 := f.confirm(t, f.prepare(t, time.Hour))
+	r2 := f.confirm(t, f.prepare(t, time.Hour))
+	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input}); c != ErrBusy {
+		t.Fatal("UID pending cap", c)
+	}
+	if _, c := f.bg.consume(context.Background(), r1.Binding.Binding.Delegation.ID); c != "" {
+		t.Fatal(c)
+	}
+	if _, c := f.bg.consume(context.Background(), r2.Binding.Binding.Delegation.ID); c != ErrBusy {
+		t.Fatal("background slot cap", c)
+	}
+	if f.repo.store.Background[1].State != "active" {
+		t.Fatal("busy consumed key")
+	}
+	f = newSDKBackgroundFixture(t)
+	for n := 1; n < MaxGrants; n++ {
+		g := cloneAuthorityGrant(f.g)
+		g.ID = fmt.Sprintf("%064x", n)
+		g.State = GrantRevoked
+		g.Reason = ErrRevoked
+		g.RevokedAt = g.CreatedAt
+		f.repo.store.Grants = append(f.repo.store.Grants, g)
+	}
+	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input}); c != ErrLimit {
+		t.Fatal("tombstone cap", c)
+	}
+	if len(f.repo.store.Grants) != MaxGrants {
+		t.Fatal("evicted tombstones")
+	}
+}
+func TestSDKBackgroundIntentFsyncCannotRefreshProof(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	i := f.prepare(t, time.Hour)
+	pending := f.s.authority.intents[i.ID]
+	pending.intent.ExpiresAt = f.wall.Add(time.Millisecond).UnixMilli()
+	f.s.authority.intents[i.ID] = pending
+	f.journal2.afterReserve = func() {
+		f.wall = f.wall.Add(10 * time.Millisecond)
+		f.mono += 10 * time.Millisecond
+	}
+	if _, c := f.bg.confirm(context.Background(), f.carriers, i.ID, i.SummaryDigest, f.repo.store.Revision); c != ErrExpired || !f.s.authority.fenced || len(f.repo.store.Background) != 0 {
+		t.Fatal(c, f.s.authority.fenced)
+	}
+	if len(f.journal2.records) != 1 {
+		t.Fatal("orphan execution key lost")
+	}
+}
+
+type sdkOfflineDirectory struct {
+	live     *relaxedFake
+	liveApp  *offlineFake
+	accounts map[string]RelaxedAccount
+	groups   map[RelaxedIdentity]RelaxedGroups
+	apps     map[RelaxedIdentity]backgroundAppProof
+}
+
+func (d *sdkOfflineDirectory) LookupRelaxedAccount(_ context.Context, name string) (RelaxedAccount, Code) {
+	if name == d.live.account.Identity.Username {
+		return d.live.account, d.live.accountCode
+	}
+	a, ok := d.accounts[name]
+	if !ok {
+		return RelaxedAccount{}, ErrDenied
+	}
+	return a, ""
+}
+func (d *sdkOfflineDirectory) LookupRelaxedGroups(_ context.Context, a RelaxedAccount) (RelaxedGroups, Code) {
+	if a.Identity == d.live.account.Identity {
+		return d.live.groups, d.live.groupCode
+	}
+	g, ok := d.groups[a.Identity]
+	if !ok {
+		return RelaxedGroups{}, ErrUnavailable
+	}
+	return g, ""
+}
+func (d *sdkOfflineDirectory) observeBackgroundApp(ctx context.Context, a RelaxedAccount, app string) (backgroundAppProof, Code) {
+	if a.Identity == d.live.account.Identity {
+		return d.liveApp.observeBackgroundApp(ctx, a, app)
+	}
+	p, ok := d.apps[a.Identity]
+	if !ok {
+		return backgroundAppProof{}, ErrUnavailable
+	}
+	return p, ""
+}
+func (f *sdkBackgroundFixture) rememberOfflineActor() *sdkOfflineDirectory {
+	d, ok := f.bg.observer.accounts.(*sdkOfflineDirectory)
+	if !ok {
+		d = &sdkOfflineDirectory{live: f.native, liveApp: f.offline, accounts: map[string]RelaxedAccount{}, groups: map[RelaxedIdentity]RelaxedGroups{}, apps: map[RelaxedIdentity]backgroundAppProof{}}
+		f.bg.observer.accounts = d
+		f.bg.observer.groups = d
+		f.bg.observer.app = d
+	}
+	d.accounts[f.native.account.Identity.Username] = f.native.account
+	d.groups[f.native.account.Identity] = f.native.groups
+	d.apps[f.native.account.Identity] = f.offline.proof
+	return d
+}
+func TestSDKBackgroundObservesSharedIssuerBeforeLease(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	f.repo.store.Grants[0].Scope.Kind = ScopeShared
+	f.g.Scope.Kind = ScopeShared
+	d := f.rememberOfflineActor()
+	old := f.native.account.Identity
+	bob := RelaxedIdentity{UID: 2002, Username: "bob"}
+	setRelaxedIdentity(f.native, bob)
+	f.offline.proof.Identity = bob
+	r := f.confirm(t, f.prepare(t, time.Hour))
+	issuer := d.accounts[old.Username]
+	issuer.Identity.UID++
+	d.accounts[old.Username] = issuer
+	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c == "" {
+		t.Fatal("shared issuer was never observed")
+	}
+	if f.repo.store.Grants[0].State != GrantRevoked || f.repo.store.Background[0].State != "revoked" {
+		t.Fatal("shared issuer mismatch not durable")
+	}
+}
+
+func TestSDKBackgroundSharesOnlyOneOwnerAndJournal(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	if _, c := newSDKJobOwner(f.s, f.registry, f.o.services); c != ErrBusy {
+		t.Fatal("second owner permitted", c)
+	}
+}
+func TestSDKBackgroundUnknownClockSuspends(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r := f.confirm(t, f.prepare(t, time.Hour))
+	f.clockKnown = false
+	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c == "" {
+		t.Fatal("unknown clock")
+	}
+	if f.repo.store.Background[0].State != "suspended" {
+		t.Fatal("unknown clock not suspended", f.repo.store.Background[0].State)
+	}
+}
+
+func TestSDKBackgroundBoundedQueueRotatesUIDs(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	f.repo.store.Grants[0].Scope.Kind = ScopeShared
+	f.g.Scope.Kind = ScopeShared
+	for n := 0; n < 8; n++ {
+		f.rememberOfflineActor()
+		if n > 0 {
+			id := RelaxedIdentity{UID: uint32(1001 + n), Username: fmt.Sprintf("user-%d", n)}
+			setRelaxedIdentity(f.native, id)
+			f.offline.proof.Identity = id
+		}
+		f.confirm(t, f.prepare(t, time.Hour))
+		f.confirm(t, f.prepare(t, time.Hour))
+	}
+	ids, c := f.bg.ready(context.Background())
+	if c != "" || len(ids) != jobcontract.MaxPending {
+		t.Fatal(len(ids), c)
+	}
+	seen := map[uint32]bool{}
+	for _, id := range ids[:8] {
+		uid := f.bg.job(id).background.snapshot.identity.UID
+		if seen[uid] {
+			t.Fatal("UID starvation")
+		}
+		seen[uid] = true
+	}
+	again, c := f.bg.ready(context.Background())
+	if c != "" || f.bg.job(ids[0]).actor.UID() == f.bg.job(again[0]).actor.UID() {
+		t.Fatal("queue never rotates", c)
+	}
+	f.rememberOfflineActor()
+	id := RelaxedIdentity{UID: 3003, Username: "overflow"}
+	setRelaxedIdentity(f.native, id)
+	f.offline.proof.Identity = id
+	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input}); c != ErrBusy {
+		t.Fatal("package pending cap", c)
+	}
+	if len(f.children) != 0 || len(f.c.operations) != 0 {
+		t.Fatal("queue itself dispatched")
+	}
+}
+
+// Keep signal events on the lifecycle owner's call stack so tests can control
+// cancellation without racing fixture state or waiting for a wall-clock delay.
+type sdkBackgroundRevokeProcess struct {
+	sdkJobTestProcess
+	afterSignal func(syscall.Signal)
+}
+
+func (p *sdkBackgroundRevokeProcess) signal(s syscall.Signal) error {
+	if err := p.sdkJobTestProcess.signal(s); err != nil {
+		return err
+	}
+	if p.afterSignal != nil {
+		p.afterSignal(s)
+	}
+	return nil
+}
+
+func TestSDKBackgroundRevokePermissionAndFailedQ(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r := f.confirm(t, f.prepare(t, time.Hour))
+	id := r.Binding.Binding.Delegation.ID
+	res, c := f.bg.consume(context.Background(), id)
+	if c != "" {
+		t.Fatal(c)
+	}
+	p := &sdkBackgroundRevokeProcess{} // never reaped, including after TERM/KILL
+	res.operation.process = p
+	f.bg.job(id).process = p
+	f.c.started++
+	bob := RelaxedIdentity{UID: 2002, Username: "bob"}
+	setRelaxedIdentity(f.native, bob)
+	f.native.groups.Admin = false
+	if result, c := f.bg.revoke(context.Background(), f.carriers, id, res.Record.Binding.Binding.Delegation.Revision, f.repo.store.Revision); c != ErrDenied || result.Revoked {
+		t.Fatal("foreign nonadmin revoked", result, c)
+	}
+	if f.repo.store.Background[0].State != "consumed" || res.operation.canceled || len(p.signals) != 0 || f.journal2.cancels != 0 || f.s.authority.fenced {
+		t.Fatal("foreign nonadmin changed revocation state")
+	}
+	f.native.groups.Admin = true
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	p.afterSignal = func(s syscall.Signal) {
+		if s != syscall.SIGTERM {
+			t.Fatal("unexpected escalation before cancellation", s)
+		}
+		// Cancel only after R, denial and journal cancellation have completed
+		// and Q has started. Scheduling during authorization cannot consume
+		// the drain budget; the child still never supplies a reap proof.
+		if f.repo.inTransaction || f.repo.store.Background[0].State != "revoked" || !res.operation.canceled || f.journal2.cancels != 1 || !p.relayStopped() {
+			t.Fatal("Q signaled before durable R/denial")
+		}
+		cancel()
+	}
+	result, c := f.bg.revoke(ctx, f.carriers, id, res.Record.Binding.Binding.Delegation.Revision, f.repo.store.Revision)
+	if c != ErrCleanupRequired || !result.Revoked || result.Drained || len(f.c.operations) != 1 || !f.s.authority.fenced {
+		t.Fatal("fake Q", result, c)
+	}
+	if f.repo.store.Background[0].State != "revoked" || !res.operation.canceled || f.bg.job(id).receipt.Job.Drained {
+		t.Fatal("lost R/denial")
+	}
+	if !slices.Equal(p.signals, []syscall.Signal{syscall.SIGTERM}) || p.reaped || f.c.reaped != 0 || f.journal2.cancels != 1 {
+		t.Fatal("failed Q lacked the stop event or invented a reap proof", p.signals, p.reaped, f.c.reaped, f.journal2.cancels)
+	}
+}
+func TestSDKBackgroundDelayedJobDoesNotExtendExpiry(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	req := sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input, TTL: time.Minute, NotBefore: f.wall.Add(30 * time.Second)}
+	i, c := f.bg.prepare(context.Background(), f.carriers, req)
+	if c != "" {
+		t.Fatal(c)
+	}
+	r := f.confirm(t, i)
+	if ids, c := f.bg.ready(context.Background()); c != "" || len(ids) != 0 {
+		t.Fatal(ids, c)
+	}
+	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c != ErrBusy {
+		t.Fatal(c)
+	}
+	f.wall = f.wall.Add(time.Minute)
+	f.mono += time.Minute
+	f.refresh()
+	if ids, c := f.bg.ready(context.Background()); c != "" || len(ids) != 0 {
+		t.Fatal("deadline extended", ids, c)
+	}
+	if f.repo.store.Background[0].State != "expired" {
+		t.Fatal("expired pending retained active")
+	}
+}
+
+func TestSDKBackgroundDisconnectDoesNotCancelConsent(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r := f.confirm(t, f.prepare(t, time.Hour))
+	id := r.Binding.Binding.Delegation.ID
+	if _, c := f.bg.consume(context.Background(), id); c != "" {
+		t.Fatal(c)
+	}
+	j := f.bg.job(id)
+	if c := f.o.disconnect(context.Background(), j.request.Control.Binding); c != "" {
+		t.Fatal(c)
+	}
+	if j.failure != "" || j.terminal || f.journal2.cancels != 0 || len(f.c.operations) != 1 {
+		t.Fatal("closing browser canceled offline delegation")
+	}
+}
+func TestSDKBackgroundSuspendedParentPollCompletesQ(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r := f.confirm(t, f.prepare(t, time.Hour))
+	id := r.Binding.Binding.Delegation.ID
+	res, c := f.bg.consume(context.Background(), id)
+	if c != "" {
+		t.Fatal(c)
+	}
+	child := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}}
+	res.operation.process = child
+	f.bg.job(id).process = child
+	f.c.started++
+	proof := admissionFor(t, f.s.authority.native, f.carriers, f.g)
+	proof.Continuous = false
+	if c := f.s.authority.WithGrantAdmission(proof, func(Grant, NativeActor) Code { return "" }); c != ErrSuspended {
+		t.Fatal(c)
+	}
+	if c := f.o.poll(context.Background()); c != "" {
+		t.Fatal(c)
+	}
+	j := f.bg.job(id)
+	if !j.terminal || !j.receipt.Job.Drained || len(f.c.operations) != 0 {
+		t.Fatal("suspension never completed Q", j.receipt)
+	}
+}
+
+func TestSDKBackgroundObserverFenceDefersSignalsToLifecycleOwner(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	r := f.confirm(t, f.prepare(t, time.Hour))
+	id := r.Binding.Binding.Delegation.ID
+	res, c := f.bg.consume(context.Background(), id)
+	if c != "" {
+		t.Fatal(c)
+	}
+	child := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}}
+	res.operation.process = child
+	f.bg.job(id).process = child
+	f.c.started++
+	f.c.gate.fence("fixture")
+	if c := f.o.poll(context.Background()); c != ErrFenced {
+		t.Fatal(c)
+	}
+	if len(child.signals) != 0 {
+		t.Fatal("signaled before durable lifecycle fence", child.signals)
+	}
+}