@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/supervisor_linux_test.go

@@ -1,913 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-// This opt-in fixture uses a root-only, disposable Linux VM and an independently
-// cross-compiled cmd/helper. Never creates accounts or accesses a NAS.
-func linuxFixture(t *testing.T) LinuxProcesses {
-	t.Helper()
-	source := os.Getenv("M1C_HELPER_FIXTURE")
-	if source == "" {
-		t.Skip("requires disposable Linux root VM and M1C_HELPER_FIXTURE")
-	}
-	if os.Geteuid() != 0 {
-		t.Fatal("VM fixture requires root")
-	}
-	traces, _ := filepath.Glob("/tmp/m1h-trace-*")
-	for _, path := range traces {
-		if err := os.Remove(path); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if t.Name() == "TestLinuxHelperSelfExitIsReapedWithoutSignallingReusedPID" {
-		source = "/helper-self-exit"
-	}
-	if t.Name() == "TestLinuxControllerWaitsForRealCompletionPublisher" {
-		source = "/helper-held-completion"
-	}
-	digest, err := executableDigest(source)
-	if err != nil {
-		t.Fatal(err)
-	}
-	i := Inventory{Package: "root", Version: "1.0.0-0001", Protocol: 1, PayloadDigest: digest, RegistryDigest: strings.Repeat("b", 64)}
-	c := NewClient(i)
-
-	for _, dir := range []string{c.StateDir, c.RunDir} {
-		if err := os.Mkdir(dir, 0700); err != nil {
-			t.Fatal(err)
-		}
-		t.Cleanup(func() { os.RemoveAll(dir) })
-	}
-	t.Cleanup(func() {
-		r, e := readRecord(c.StateDir, 0)
-		b, _ := json.Marshal(r)
-		t.Logf("VM final lifecycle=%s readError=%v failed=%t", b, e, t.Failed())
-		if t.Failed() {
-			traces, _ := filepath.Glob("/tmp/m1h-trace-*")
-			for _, path := range traces {
-				b, _ := os.ReadFile(path)
-				t.Logf("VM trace %s: %s", path, b)
-			}
-		}
-	})
-	exe := filepath.Join(c.StateDir, "payload-"+digest)
-	b, err := os.ReadFile(source)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(exe, b, 0700); err != nil {
-		t.Fatal(err)
-	}
-	vmUnit(t, "start")
-	return LinuxProcesses{Client: c, Binary: exe}
-}
-func startVMHelper(t *testing.T, p LinuxProcesses) Process {
-	t.Helper()
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
-	t.Cleanup(func() {
-		r, e := readRecord(p.StateDir, 0)
-		b, _ := json.Marshal(r)
-		t.Logf("VM pre-cleanup lifecycle=%s readError=%v failed=%t", b, e, t.Failed())
-		err := ctl.Control(context.Background(), "disable")
-		t.Logf("VM cleanup disable=%v", err)
-		if t.Failed() {
-			traces, _ := filepath.Glob("/tmp/m1h-trace-*")
-			for _, path := range traces {
-				b, _ := os.ReadFile(path)
-				t.Logf("VM trace %s: %s", path, b)
-			}
-		}
-	})
-	if err := ctl.Control(context.Background(), "enable"); err != nil {
-		t.Fatal(err)
-	}
-	record, err := readProcess(p.RunDir, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return record
-}
-func supervisedPID(t *testing.T, pid int) int {
-	t.Helper()
-	paths, _ := filepath.Glob("/proc/" + strconv.Itoa(pid) + "/task/*/children")
-	for _, path := range paths {
-		b, _ := os.ReadFile(path)
-		for _, s := range strings.Fields(string(b)) {
-			child, _ := strconv.Atoi(s)
-			if child > 1 {
-				return child
-			}
-		}
-	}
-	t.Fatal("supervisor has no child")
-	return 0
-}
-
-// Observation only: an absent process or zombie has exited. No signal is sent
-// to this PID, including if it has been reused. These fixtures run in a fresh VM.
-func waitPIDExit(t *testing.T, pid int) {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		b, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")
-		if os.IsNotExist(err) {
-			return true
-		}
-		end := strings.LastIndex(string(b), ") ")
-		return err == nil && end >= 0 && strings.HasPrefix(string(b)[end+2:], "Z ")
-	}) != nil {
-		t.Fatal("owned process survived")
-	}
-}
-func TestLinuxActivationAlwaysUsesSupervisorAndNormalStop(t *testing.T) {
-	p := linuxFixture(t)
-	for n := 0; n < 20; n++ {
-		t.Run("cycle-"+strconv.Itoa(n), func(t *testing.T) {
-			proc := startVMHelper(t, p)
-			if proc.Mode != "supervised" {
-				t.Fatalf("activation did not select supervisor: %+v", proc)
-			}
-			child := supervisedPID(t, proc.PID)
-			if p.Status(context.Background()).State != "ready" {
-				t.Fatal("missing live handshake")
-			}
-			if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "disable"); err != nil {
-				t.Fatal(err)
-			}
-			waitPIDExit(t, child)
-			if err := p.CheckStopped(context.Background()); err != nil {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-
-func TestLinuxHelperSelfExitIsReapedWithoutSignallingReusedPID(t *testing.T) {
-	p := linuxFixture(t)
-	proc := startVMHelper(t, p)
-	if proc.Mode != "supervised" {
-		t.Fatal("not supervised")
-	}
-	child := supervisedPID(t, proc.PID)
-	// The VM-only helper fixture exits itself when this root-owned marker exists.
-	if err := os.WriteFile(filepath.Join(p.RunDir, "fixture-exit"), nil, 0600); err != nil {
-		t.Fatal(err)
-	}
-	waitPIDExit(t, child)
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		_, err := os.Stat("/proc/" + strconv.Itoa(child))
-		return os.IsNotExist(err)
-	}) != nil {
-		t.Fatal("supervisor did not reap")
-	}
-	if err := p.Stop(proc); err != nil {
-		t.Fatal(err)
-	}
-}
-func TestLinuxSupervisorDeathKillsHelperAndPreservesFailedCleanup(t *testing.T) {
-	p := linuxFixture(t)
-	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Lifecycle: vmLifecycle(t, p)})
-	// Keep the supervisor as our own unreaped child; only its parent signals it.
-	cmd := exec.Command(p.Binary, "supervise")
-	if err := cmd.Start(); err != nil {
-		t.Fatal(err)
-	}
-	owned := &ownedLinuxChild{process: cmd.Process}
-	t.Cleanup(func() { stopChild(context.Background(), owned, time.Millisecond) })
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	err := waitHealthy(ctx, func(ctx context.Context) bool { return p.Status(ctx).State == "ready" })
-	cancel()
-	if err != nil {
-		t.Fatal(err)
-	}
-	proc, err := readProcess(p.RunDir, 0)
-	if err != nil || proc.Mode != "supervised" || proc.PID != cmd.Process.Pid {
-		t.Fatalf("%+v %v", proc, err)
-	}
-	child := supervisedPID(t, proc.PID)
-	if err := owned.signal(syscall.SIGKILL); err != nil {
-		t.Fatal(err)
-	}
-	waitPIDExit(t, child)
-	waitPIDExit(t, proc.PID)
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
-	if ctl.Control(context.Background(), "teardown") == nil {
-		t.Fatal("lost supervisor falsely cleaned")
-	}
-	s := p.Status(context.Background())
-	if s.State != "failed" || s.Cleanup != "required" {
-		t.Fatal(s)
-	}
-	if ctl.Control(context.Background(), "disable") == nil {
-		t.Fatal("lost supervisor falsely disabled cleanly")
-	}
-	r, err := readRecord(p.StateDir, 0)
-	if err != nil || r.Enabled || !r.Residual {
-		t.Fatalf("%+v %v", r, err)
-	}
-	if _, err := os.Stat(filepath.Join(p.RunDir, "process.json")); err != nil {
-		t.Fatal("failure evidence removed")
-	}
-}
-func TestLinuxUnsupervisedRecordAndDirectServeRefuse(t *testing.T) {
-	p := linuxFixture(t)
-	proc := startVMHelper(t, p)
-	for _, mode := range []string{"", "unknown"} {
-		foreign := proc
-		foreign.Mode = mode
-		if p.Stop(foreign) == nil {
-			t.Fatal("unsupervised record accepted")
-		}
-	}
-	// Remove stopped sockets before testing the retired action, so a bind
-	// conflict cannot masquerade as refusal of unsupervised startup.
-	if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, p.Binary, "serve")
-	if cmd.Run() == nil || ctx.Err() != nil {
-		t.Fatal("direct unsupervised serve accepted")
-	}
-	if _, err := os.Stat(filepath.Join(p.RunDir, "helper.sock")); !os.IsNotExist(err) {
-		t.Fatal("direct serve opened socket")
-	}
-}
-
-func TestLinuxOwnedChildSelfExitAndECHILDRefusal(t *testing.T) {
-	for _, externallyReaped := range []bool{false, true} {
-		cmd := exec.Command("/bin/sh", "-c", "exit 0")
-		if err := cmd.Start(); err != nil {
-			t.Fatal(err)
-		}
-		child := &ownedLinuxChild{process: cmd.Process}
-		if externallyReaped {
-			if err := cmd.Wait(); err != nil {
-				t.Fatal(err)
-			}
-			if err := stopChild(context.Background(), child, time.Millisecond); !errors.Is(err, syscall.ECHILD) {
-				t.Fatal("ECHILD did not refuse", err)
-			}
-		} else {
-			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-			err := waitHealthy(ctx, func(context.Context) bool { done, err := child.exited(); return done && err == nil })
-			cancel()
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err := stopChild(context.Background(), child, time.Millisecond); err != nil {
-				t.Fatal(err)
-			}
-			if child.signal(syscall.SIGTERM) == nil {
-				t.Fatal("reaped PID signalled")
-			}
-		}
-	}
-}
-func TestLinuxSupervisorIdentityConflictsAndSocketSubstitutionRefuse(t *testing.T) {
-	p := linuxFixture(t)
-	proc := startVMHelper(t, p)
-	for _, field := range []string{"boot", "start", "inode", "digest", "mode"} {
-		foreign := proc
-		switch field {
-		case "boot":
-			foreign.Boot = "reboot"
-		case "start":
-			foreign.Start = "reuse"
-		case "inode":
-			foreign.Inode++
-		case "digest":
-			foreign.Inventory.PayloadDigest = strings.Repeat("c", 64)
-		case "mode":
-			foreign.Mode = "unknown"
-		}
-		if p.Stop(foreign) == nil {
-			t.Fatal("foreign supervisor accepted", field)
-		}
-	}
-	socket := filepath.Join(p.RunDir, "supervisor.sock")
-	old := socket + ".owned"
-	if err := os.Rename(socket, old); err != nil {
-		t.Fatal(err)
-	}
-	fake, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chmod(socket, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if p.Stop(proc) == nil {
-		t.Fatal("other root PID substituted supervisor")
-	}
-	fake.Close()
-	if err := os.Rename(old, socket); err != nil {
-		t.Fatal(err)
-	}
-	if p.Status(context.Background()).State != "ready" {
-		t.Fatal("refusal stopped real helper")
-	}
-	if err := p.Stop(proc); err != nil {
-		t.Fatal(err)
-	}
-}
-func TestLinuxReparentedChildRefusesBeforeSocket(t *testing.T) {
-	p := linuxFixture(t)
-	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Lifecycle: vmLifecycle(t, p)})
-	cmd := exec.Command(p.Binary, "serve-child")
-	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=1"}
-	if cmd.Run() == nil {
-		t.Fatal("already reparented child served")
-	}
-	if _, err := os.Stat(filepath.Join(p.RunDir, "helper.sock")); !os.IsNotExist(err) {
-		t.Fatal("unsafe child opened socket")
-	}
-}
-
-func vmUnit(t *testing.T, action string) {
-	t.Helper()
-	if out, err := exec.Command("/bin/systemctl", action, "pkgctl-root.service").CombinedOutput(); err != nil {
-		t.Fatalf("systemctl %s: %v %s", action, err, out)
-	}
-}
-
-// Run the generated M1f hook as an unprivileged user against the real M1g
-// helper. The VM models management ordering, not DSM Package Center itself.
-func TestLinuxPrestopRequiresAdminTeardownAndPrestartNeverRecovers(t *testing.T) {
-	p := linuxFixture(t)
-	for _, dir := range []string{p.StateDir, p.RunDir} {
-		if err := os.Chmod(dir, 0755); err != nil {
-			t.Fatal(err)
-		}
-	}
-	proc := startVMHelper(t, p)
-	child := supervisedPID(t, proc.PID)
-	log := "/tmp/m1f-prestop-message"
-	if err := os.WriteFile(log, nil, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chown(log, 65534, 65534); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { os.Remove(log) })
-	hook := func(action string, allow bool) {
-		t.Helper()
-		before, err := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err := os.Truncate(log, 0); err != nil {
-			t.Fatal(err)
-		}
-		cmd := exec.Command("/var/packages/root/scripts/start-stop-status", action)
-		cmd.Env = append(os.Environ(), "SYNOPKG_TEMP_LOGFILE="+log)
-		cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
-		out, err := cmd.CombinedOutput()
-		if (err == nil) != allow {
-			t.Fatalf("%s allow=%v: %v %s", action, allow, err, out)
-		}
-		if !allow {
-			message, err := os.ReadFile(log)
-			if err != nil || string(message) != string(out) || !strings.Contains(string(out), "helper_teardown") {
-				t.Fatalf("missing DSM refusal message: %v %s %s", err, out, message)
-			}
-		}
-		after, err := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
-		if err != nil || string(before) != string(after) {
-			t.Fatal("nonprivileged hook changed lifecycle latch", err)
-		}
-	}
-	hook("prestop", false)
-	if _, err := observeLinux(context.Background(), p.Expected); err != nil {
-		t.Fatal("prestop refusal changed active unit", err)
-	}
-	current, err := readProcess(p.RunDir, 0)
-	if err != nil || current != proc || p.Status(context.Background()).State != "ready" {
-		t.Fatal("prestop refusal stopped helper", err)
-	}
-	hook("prestart", true)
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
-	if err := ctl.Control(context.Background(), "teardown"); err != nil {
-		t.Fatal(err)
-	}
-	waitPIDExit(t, child)
-	waitPIDExit(t, proc.PID)
-	hook("prestop", true)
-	vmUnit(t, "stop")
-	hook("stop", true)
-	vmUnit(t, "start")
-	hook("prestart", true)
-	hook("start", true)
-	if p.Status(context.Background()).State != "stopped" || !runtimeAbsent(p.Client) {
-		t.Fatal("package Start recovered integration")
-	}
-	stopped, err := readRecord(p.StateDir, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	incomplete := stopped
-	incomplete.Residual = true
-	record(t, p.Client, incomplete)
-	hook("prestop", false)
-	hook("prestart", true)
-	record(t, p.Client, stopped)
-	if err := ctl.Control(context.Background(), "recover"); err != nil {
-		t.Fatal(err)
-	}
-	recovered, err := readRecord(p.StateDir, 0)
-	if err != nil || recovered.Lifecycle.Epoch == stopped.Lifecycle.Epoch || p.Status(context.Background()).State != "ready" {
-		t.Fatal("explicit Recover failed", err)
-	}
-	if err := ctl.Control(context.Background(), "disable"); err != nil {
-		t.Fatal(err)
-	}
-	hook("prestop", true)
-	hook("prestart", true)
-	if p.Status(context.Background()).State != "not-enabled" || !runtimeAbsent(p.Client) {
-		t.Fatal("prestart cleared disabled gate")
-	}
-}
-
-func vmLifecycle(t *testing.T, p LinuxProcesses) *Lifecycle {
-	t.Helper()
-	b, err := observeLinux(context.Background(), p.Expected)
-	if err != nil {
-		t.Fatal(err)
-	}
-	l, err := newLifecycle(b)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := createLifetime(p.Client, l); err != nil {
-		t.Fatal(err)
-	}
-	return l
-}
-
-func TestLinuxUnitStopFencesBeforeLockAndPublishesCompletion(t *testing.T) {
-	p := linuxFixture(t)
-	proc := startVMHelper(t, p)
-	child := supervisedPID(t, proc.PID)
-	lock, err := os.OpenFile(filepath.Join(p.StateDir, "policy.lock"), os.O_RDWR, 0600)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer lock.Close()
-	if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
-		t.Fatal(err)
-	}
-	vmUnit(t, "stop")
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	err = waitHealthy(ctx, func(context.Context) bool {
-		s := p.Status(context.Background())
-		return s.State == "failed" && s.Cleanup == "required"
-	})
-	cancel()
-	syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
-	if err != nil {
-		t.Fatal("memory fence waited for policy lock", err)
-	}
-	ctx, cancel = context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		r, e := readRecord(p.StateDir, 0)
-		return e == nil && !r.Residual && r.Lifecycle.Phase == "stopped" && r.Lifecycle.Completion != ""
-	}) != nil {
-		t.Fatal("completion missing")
-	}
-	r, _ := readRecord(p.StateDir, 0)
-	proof, e := completionRecord(p.Client, r)
-	if e != nil {
-		t.Fatal(e)
-	}
-	if proof.Process != proc {
-		t.Fatal("wrong completion identity", r)
-	}
-	waitPIDExit(t, child)
-	waitPIDExit(t, proc.PID)
-	if err := p.CheckStopped(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
-	if ctl.Control(context.Background(), "recover") == nil {
-		t.Fatal("inactive unit recovered")
-	}
-	vmUnit(t, "start")
-	if p.Status(context.Background()).State != "stopped" {
-		t.Fatal("unit Start resurrected integration")
-	}
-	if err := ctl.Control(context.Background(), "recover"); err != nil {
-		t.Fatal(err)
-	}
-	next, _ := readRecord(p.StateDir, 0)
-	if next.Lifecycle.Epoch == r.Lifecycle.Epoch || p.Status(context.Background()).State != "ready" {
-		t.Fatal("explicit recovery failed")
-	}
-}
-func TestLinuxRapidUnitStopStartNeverClearsFence(t *testing.T) {
-	p := linuxFixture(t)
-	proc := startVMHelper(t, p)
-	vmUnit(t, "stop")
-	vmUnit(t, "start")
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		r, e := readRecord(p.StateDir, 0)
-		return e == nil && r.Lifecycle.Phase == "stopped" && !r.Residual
-	}) != nil {
-		t.Fatal("rapid transition missed")
-	}
-	waitPIDExit(t, proc.PID)
-	if p.Status(context.Background()).State != "stopped" {
-		t.Fatal("rapid Start resurrected")
-	}
-}
-func TestLinuxBusUnavailableRefusesActivation(t *testing.T) {
-	p := linuxFixture(t)
-	socket := busPath
-	if err := os.Rename(socket, socket+".fixture"); err != nil {
-		t.Fatal(err)
-	}
-	defer os.Rename(socket+".fixture", socket)
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
-	if ctl.Control(context.Background(), "enable") == nil {
-		t.Fatal("activation without bus")
-	}
-	if !runtimeAbsent(p.Client) {
-		t.Fatal("unknown authority spawned runtime")
-	}
-}
-
-func TestLinuxRealOldPayloadReplayRefusesNewApproval(t *testing.T) {
-	p := linuxFixture(t)
-	_ = startVMHelper(t, p)
-	if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); err != nil {
-		t.Fatal(err)
-	}
-	before, err := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	digest, err := executableDigest("/helper-legacy")
-	if err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(p.StateDir, "payload-"+digest)
-	b, err := os.ReadFile("/helper-legacy")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(path, b, 0700); err != nil {
-		t.Fatal(err)
-	}
-	for _, action := range []string{"enable", "recover", "supervise"} {
-		if out, err := exec.Command(path, action).CombinedOutput(); err == nil {
-			t.Fatalf("old payload replayed %s %s", action, out)
-		}
-	}
-	after, _ := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
-	if string(before) != string(after) || !runtimeAbsent(p.Client) {
-		t.Fatal("old payload changed latch")
-	}
-}
-func TestLinuxBusRestartFencesAndCompletesRuntime(t *testing.T) {
-	p := linuxFixture(t)
-	proc := startVMHelper(t, p)
-	if out, err := exec.Command("/bin/systemctl", "restart", "dbus.service").CombinedOutput(); err != nil {
-		t.Fatal(err, string(out))
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		r, e := readRecord(p.StateDir, 0)
-		return e == nil && r.Lifecycle.Phase == "stopped" && !r.Residual && r.Lifecycle.Completion != ""
-	}) != nil {
-		t.Fatal("bus loss did not complete")
-	}
-	waitPIDExit(t, proc.PID)
-	if p.Status(context.Background()).State != "stopped" {
-		t.Fatal("bus reconnection revived helper")
-	}
-}
-
-func TestLinuxLostSupervisorRepairThenExplicitRecover(t *testing.T) {
-	p := linuxFixture(t)
-	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Lifecycle: vmLifecycle(t, p)})
-	cmd := exec.Command(p.Binary, "supervise")
-	if err := cmd.Start(); err != nil {
-		t.Fatal(err)
-	}
-	owned := &ownedLinuxChild{process: cmd.Process}
-	t.Cleanup(func() { stopChild(context.Background(), owned, time.Millisecond) })
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	err := waitHealthy(ctx, func(ctx context.Context) bool { return p.Status(ctx).State == "ready" })
-	cancel()
-	if err != nil {
-		t.Fatal(err)
-	}
-	proc, err := readProcess(p.RunDir, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	child := supervisedPID(t, proc.PID)
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
-	if ctl.Control(context.Background(), "repair") == nil {
-		t.Fatal("repaired live supervisor")
-	}
-	if p.Status(context.Background()).State != "ready" {
-		t.Fatal("busy repair fenced active helper")
-	}
-	if err := owned.signal(syscall.SIGKILL); err != nil {
-		t.Fatal(err)
-	}
-	waitPIDExit(t, proc.PID)
-	waitPIDExit(t, child)
-	if ctl.Control(context.Background(), "recover") == nil {
-		t.Fatal("loss recovered without repair")
-	}
-	if err := ctl.Control(context.Background(), "repair"); err != nil {
-		t.Fatal(err)
-	}
-	repaired, err := readRecord(p.StateDir, 0)
-	if err != nil || repaired.Residual || repaired.Lifecycle.Completion == "" || p.Status(context.Background()).State != "stopped" {
-		t.Fatal("repair not committed", err)
-	}
-	proof, err := completionRecord(p.Client, repaired)
-	if err != nil || proof.Repair == nil || !runtimeAbsent(p.Client) {
-		t.Fatal("no repair proof", err)
-	}
-	if err := ctl.Control(context.Background(), "repair"); err != nil {
-		t.Fatal(err)
-	}
-	if err := ctl.Control(context.Background(), "recover"); err != nil {
-		t.Fatal(err)
-	}
-	next, _ := readRecord(p.StateDir, 0)
-	if next.Lifecycle.Epoch == repaired.Lifecycle.Epoch || p.Status(context.Background()).State != "ready" {
-		t.Fatal("explicit recovery did not start new epoch")
-	}
-	t.Cleanup(func() { ctl.Control(context.Background(), "disable") })
-	// A package/nonroot process cannot use the executable repair entry.
-	for _, dir := range []string{p.StateDir, p.RunDir} {
-		if err := os.Chmod(dir, 0755); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.Chmod(p.Binary, 0755); err != nil {
-		t.Fatal(err)
-	}
-	denied := exec.Command(p.Binary, "repair")
-	denied.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
-	output, err := denied.CombinedOutput()
-	if err == nil || !strings.Contains(string(output), "helper lifecycle refused") {
-		t.Fatal("package user did not reach euid refusal", err, string(output))
-	}
-
-}
-
-func TestLinuxInheritedLifetimePinsLockUntilLastHolderExit(t *testing.T) {
-	p := linuxFixture(t)
-	l := vmLifecycle(t, p)
-	lease, err := acquireLifetime(p.Client, l)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cmd := exec.Command("/bin/sleep", "60")
-	cmd.ExtraFiles = []*os.File{lease}
-	if err := cmd.Start(); err != nil {
-		t.Fatal(err)
-	}
-	child := &ownedLinuxChild{process: cmd.Process}
-	t.Cleanup(func() { stopChild(context.Background(), child, time.Millisecond) })
-	// Model supervisor loss while the inherited child is still alive. No
-	// LOCK_UN: closing that would release the shared flock prematurely.
-	lease.Close()
-	if got, err := acquireLifetime(p.Client, l); err == nil {
-		got.Close()
-		t.Fatal("parent close released live child's witness")
-	}
-	if err := stopChild(context.Background(), child, time.Millisecond); err != nil {
-		t.Fatal(err)
-	}
-	got, err := acquireLifetime(p.Client, l)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got.Close()
-}
-
-func TestLinuxPreR2PayloadReplayAndLateSupervisorRefuseRepairLatch(t *testing.T) {
-	p := linuxFixture(t)
-	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Residual: true, Lifecycle: vmLifecycle(t, p)})
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
-	// No process was started: the same lease also proves the startup crash gap.
-	if err := ctl.Control(context.Background(), "repair"); err != nil {
-		t.Fatal(err)
-	}
-	before, _ := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
-	if out, err := exec.Command(p.Binary, "supervise").CombinedOutput(); err == nil {
-		t.Fatal("late supervisor crossed repair latch", string(out))
-	}
-	for _, source := range []string{"/helper-pre-r2", "/helper-m1d"} {
-		digest, err := executableDigest(source)
-		if err != nil {
-			t.Fatal(err)
-		}
-		bytes, err := os.ReadFile(source)
-		if err != nil {
-			t.Fatal(err)
-		}
-		path := filepath.Join(p.StateDir, "payload-"+digest)
-		if err := os.WriteFile(path, bytes, 0700); err != nil {
-			t.Fatal(err)
-		}
-		for _, action := range []string{"enable", "recover", "supervise", "disable", "teardown"} {
-			if out, err := exec.Command(path, action).CombinedOutput(); err == nil {
-				t.Fatal("old payload crossed repair schema", source, action, string(out))
-			}
-		}
-	}
-	after, _ := os.ReadFile(filepath.Join(p.StateDir, "approval.json"))
-	if string(before) != string(after) || !runtimeAbsent(p.Client) {
-		t.Fatal("replay altered completion")
-	}
-}
-
-func TestLinuxActualM1dLostSupervisorResidueCannotGainRepairWitness(t *testing.T) {
-	p := linuxFixture(t)
-	digest, err := executableDigest("/helper-m1d")
-	if err != nil {
-		t.Fatal(err)
-	}
-	old := p
-	old.Expected.PayloadDigest = digest
-	old.Binary = filepath.Join(p.StateDir, "payload-"+digest)
-	bytes, err := os.ReadFile("/helper-m1d")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(old.Binary, bytes, 0700); err != nil {
-		t.Fatal(err)
-	}
-	record(t, p.Client, Record{Inventory: old.Expected, Enabled: true})
-	cmd := exec.Command(old.Binary, "supervise")
-	if err := cmd.Start(); err != nil {
-		t.Fatal(err)
-	}
-	owned := &ownedLinuxChild{process: cmd.Process}
-	t.Cleanup(func() { stopChild(context.Background(), owned, time.Millisecond) })
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	err = waitHealthy(ctx, func(ctx context.Context) bool { return old.Status(ctx).State == "ready" })
-	cancel()
-	if err != nil {
-		t.Fatal(err)
-	}
-	proc, err := readProcess(p.RunDir, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	child := supervisedPID(t, proc.PID)
-	if err := owned.signal(syscall.SIGKILL); err != nil {
-		t.Fatal(err)
-	}
-	waitPIDExit(t, proc.PID)
-	waitPIDExit(t, child)
-	// Mimic an upgraded controller; it must not create a new lock as purported
-	// historical proof, even though both observed PIDs have exited in this VM.
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux}
-	if ctl.Control(context.Background(), "repair") == nil {
-		t.Fatal("upgraded helper repaired unwitnessed legacy residue")
-	}
-	for _, name := range []string{"helper.sock", "supervisor.sock", "process.json"} {
-		if _, err := os.Lstat(filepath.Join(p.RunDir, name)); err != nil {
-			t.Fatal("legacy evidence removed", name, err)
-		}
-	}
-	leases, _ := filepath.Glob(filepath.Join(p.StateDir, "lifetime-*.lock"))
-	if len(leases) != 0 {
-		t.Fatal("retroactively manufactured witness", leases)
-	}
-}
-
-func TestLinuxAdminTeardownSnapshotRace(t *testing.T) {
-	p := linuxFixture(t)
-	proc := startVMHelper(t, p)
-	child := supervisedPID(t, proc.PID)
-	ctl := Controller{Client: p.Client, Processes: p, Observe: observeLinux, Boot: linuxBoot}
-	// Capture the fenced snapshot inside the policy transaction, before the
-	// owner can complete it. Then deliberately let the real owner win the race.
-	var before Record
-	if err := policyUpdate(p.Client, func(r *Record) error {
-		r.Lifecycle.Phase = "fenced"
-		r.Lifecycle.Reason = "admin-stop"
-		r.Residual = true
-		before = *r
-		return nil
-	}); err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		r, e := readRecord(p.StateDir, 0)
-		if e != nil {
-			return false
-		}
-		proof, e := completionRecord(p.Client, r)
-		return e == nil && proof.Process == proc && runtimeAbsent(p.Client)
-	}) != nil {
-		t.Fatal("owner did not commit autonomous admin-stop")
-	}
-	waitPIDExit(t, child)
-	waitPIDExit(t, proc.PID)
-	if err := ctl.teardownRecord(before, proc); err != nil {
-		t.Fatal("exact committed completion rejected after approval snapshot", err)
-	}
-}
-
-type pausedCompletionProcesses struct {
-	LinuxProcesses
-	visible string
-}
-
-func (p pausedCompletionProcesses) Stop(proc Process) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	if err := waitHealthy(ctx, func(context.Context) bool {
-		_, err := os.Stat(p.visible)
-		return err == nil
-	}); err != nil {
-		return err
-	}
-	// Exercise the real socket/identity path after autonomous runtime unlink.
-	return p.LinuxProcesses.Stop(proc)
-}
-
-func TestLinuxControllerWaitsForRealCompletionPublisher(t *testing.T) {
-	p := linuxFixture(t)
-	proc := startVMHelper(t, p)
-	child := supervisedPID(t, proc.PID)
-	hold := filepath.Join(p.StateDir, "fixture-hold-completion")
-	if err := os.WriteFile(hold, []byte("pause publisher after approval rename"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	defer func() {
-		os.Remove(hold) // disposable VM fixture only; never a NAS operation
-		waitPIDExit(t, child)
-		waitPIDExit(t, proc.PID)
-	}()
-	result := make(chan error, 1)
-	go func() {
-		processes := pausedCompletionProcesses{LinuxProcesses: p, visible: filepath.Join(p.StateDir, "fixture-completion-visible")}
-		result <- (Controller{Client: p.Client, Processes: processes, Observe: observeLinux, Boot: linuxBoot}).Control(context.Background(), "teardown")
-	}()
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		_, visible := os.Stat(filepath.Join(p.StateDir, "fixture-completion-visible"))
-		r, e := readRecord(p.StateDir, 0)
-		if visible != nil || e != nil {
-			return false
-		}
-		proof, e := completionRecord(p.Client, r)
-		return e == nil && proof.Process == proc && runtimeAbsent(p.Client)
-	}) != nil {
-		t.Fatal("real supervisor did not publish while holding policy.lock")
-	}
-	select {
-	case err := <-result:
-		t.Fatal("controller returned before publisher unlocked", err)
-	case <-time.After(100 * time.Millisecond):
-	}
-	if err := os.Remove(hold); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case err := <-result:
-		if err != nil {
-			t.Fatal("real committed completion refused after publisher unlock", err)
-		}
-	case <-ctx.Done():
-		t.Fatal("controller did not finish after publisher unlock")
-	}
-	if err := p.CheckStopped(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-}