@synopackageland/cli 0.5.0 → 0.6.0

package/templates/native-go/backend/internal/helper/lifecycle.go

@@ -1,234 +0,0 @@
-package helper
-
-import (
-	"context"
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-)
-
-// Lifecycle is deliberately unknown to old strict approval parsers. A separate
-// latch file alone would let an approved pre-M1g controller resurrect a helper.
-type Binding struct {
-	Entered uint64 `json:"entered"`
-	Boot    string `json:"boot"`
-	Install string `json:"install"`
-}
-type Lifecycle struct {
-	Schema     int     `json:"schema"`
-	Lease      *Lease  `json:"lease,omitempty"`
-	Epoch      string  `json:"epoch"`
-	Binding    Binding `json:"binding"`
-	Phase      string  `json:"phase"`
-	Reason     string  `json:"reason,omitempty"`
-	SubReason  string  `json:"subReason,omitempty"`
-	Completion string  `json:"completion,omitempty"`
-}
-
-func (l *Lifecycle) valid() bool {
-	if l == nil {
-		return true
-	} // legacy is diagnostic/cleanup only; never start/recover
-	if l.Schema != 2 || !digestPattern.MatchString(l.Epoch) || l.Binding.Boot == "" || l.Binding.Entered == 0 || !digestPattern.MatchString(l.Binding.Install) {
-		return false
-	}
-	if l.Lease != nil && l.Lease.Inode == 0 {
-		return false
-	}
-	if l.Phase != "running" && l.Phase != "fenced" && l.Phase != "stopped" {
-		return false
-	}
-	if l.Completion != "" {
-		return l.Phase == "stopped" && digestPattern.MatchString(l.Completion)
-	}
-	return true
-}
-
-var errBusy = errors.New("lifecycle busy")
-
-func policyUpdate(c Client, change func(*Record) error) error {
-	if err := protected(c.StateDir, c.Owner, true); err != nil {
-		return err
-	}
-	f, err := os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	if err := protected(f.Name(), c.Owner, false); err != nil {
-		return err
-	}
-	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
-		return errBusy
-	}
-	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
-	r, err := readRecord(c.StateDir, c.Owner)
-	if errors.Is(err, fs.ErrNotExist) {
-		r = Record{Inventory: c.Expected}
-	} else if err != nil {
-		return err
-	}
-	if err := change(&r); err != nil {
-		return err
-	}
-	r.Schema = 2
-	return writeProtected(c.StateDir, "approval.json", r)
-}
-func fenceRecord(c Client, epoch, reason string, detail ...string) error {
-	return policyUpdate(c, func(r *Record) error {
-		if r.Lifecycle == nil || r.Lifecycle.Epoch != epoch || r.Inventory != c.Expected {
-			return errTrust
-		}
-		if r.Lifecycle.Phase == "stopped" {
-			return errTrust
-		}
-		r.Lifecycle.Phase = "fenced"
-		if r.Lifecycle.Reason == "" {
-			r.Lifecycle.Reason = reason
-			if len(detail) > 0 {
-				r.Lifecycle.SubReason = detail[0]
-			}
-		}
-		r.Lifecycle.Completion = ""
-		r.Residual = true
-		return nil
-	})
-}
-func runtimeAbsent(c Client) bool {
-	for _, name := range []string{"process.json", "helper.sock", "supervisor.sock"} {
-		if _, err := os.Lstat(filepath.Join(c.RunDir, name)); !errors.Is(err, fs.ErrNotExist) {
-			return false
-		}
-	}
-	return true
-}
-func completeRecord(c Client, epoch string, p Process, cohort ...*CohortCompletion) error {
-	var q *CohortCompletion
-	if len(cohort) > 1 {
-		return errTrust
-	}
-	if len(cohort) == 1 {
-		q = cohort[0]
-		if q != nil && !q.valid() {
-			return errTrust
-		}
-	}
-	return policyUpdate(c, func(r *Record) error {
-		if r.Lifecycle == nil || r.Lifecycle.Epoch != epoch || r.Inventory != c.Expected || r.Lifecycle.Phase != "fenced" || !runtimeAbsent(c) || p.Inventory != r.Inventory || p.Boot != r.Lifecycle.Binding.Boot || p.Mode != "supervised" || p.PID <= 1 || p.Start == "" || p.Inode == 0 {
-			return errTrust
-		}
-		r.Lifecycle.Phase = "stopped"
-		proof := Completion{Epoch: epoch, Process: p, Cohort: q}
-		return storeCompletion(c, r, proof)
-	})
-}
-
-// storeCompletion publishes the private artifact before the approval commit.
-// The caller holds policy.lock and has already established runtime quiescence.
-func storeCompletion(c Client, r *Record, proof Completion) error {
-	bytes, err := json.Marshal(proof)
-	if err != nil {
-		return err
-	}
-	if err := writeProtected(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json", proof); err != nil {
-		return err
-	}
-	sum := sha256.Sum256(bytes)
-	r.Lifecycle.Completion = hex.EncodeToString(sum[:])
-	r.Residual = false
-	return nil
-}
-
-func finalizeStart(c Client, epoch string) error {
-	return policyUpdate(c, func(r *Record) error {
-		if !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Epoch != epoch || r.Lifecycle.Phase != "running" {
-			return errTrust
-		}
-		r.Residual = false
-		return nil
-	})
-}
-func newLifecycle(b Binding) (*Lifecycle, error) {
-	var nonce [32]byte
-	if _, err := rand.Read(nonce[:]); err != nil {
-		return nil, err
-	}
-	l := &Lifecycle{Schema: 2, Epoch: hex.EncodeToString(nonce[:]), Binding: b, Phase: "running"}
-	if !l.valid() {
-		return nil, errTrust
-	}
-	return l, nil
-}
-
-// Observe is injected only by tests. Production requires the fixed root bus
-// observer; nil cannot mean permission to start.
-type Observation func(context.Context, Inventory) (Binding, error)
-
-// The approval digest is the commit point. An orphan private proof cannot
-// authorize cleanup, and CGI status never needs access to private process IDs.
-type Completion struct {
-	Epoch   string            `json:"epoch"`
-	Process Process           `json:"process"`
-	Repair  *RepairCompletion `json:"repair,omitempty"`
-	Cohort  *CohortCompletion `json:"cohort,omitempty"`
-}
-
-func completionRecord(c Client, r Record) (Completion, error) {
-	var proof Completion
-	if r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" {
-		return proof, errTrust
-	}
-	path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
-	if err := protected(c.StateDir, c.Owner, true); err != nil {
-		return proof, err
-	}
-	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW, 0)
-	if err != nil {
-		return proof, err
-	}
-	defer f.Close()
-	st, err := f.Stat()
-	if err != nil {
-		return proof, err
-	}
-	stat, ok := st.Sys().(*syscall.Stat_t)
-	if !ok || stat.Uid != c.Owner || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 || st.Size() > 4096 {
-		return proof, errTrust
-	}
-	bytes, err := io.ReadAll(io.LimitReader(f, 4097))
-	if err != nil {
-		return proof, err
-	}
-	sum := sha256.Sum256(bytes)
-	if hex.EncodeToString(sum[:]) != r.Lifecycle.Completion {
-		return proof, errTrust
-	}
-	d := json.NewDecoder(strings.NewReader(string(bytes)))
-	d.DisallowUnknownFields()
-	if d.Decode(&proof) != nil || d.Decode(new(any)) != io.EOF {
-		return proof, errTrust
-	}
-	if proof.Cohort != nil && (!proof.Cohort.valid() || proof.Repair != nil) {
-		return proof, errTrust
-	}
-	if proof.Repair != nil {
-		q := proof.Repair
-		if proof.Epoch != r.Lifecycle.Epoch || proof.Process != (Process{}) || q.Inventory != r.Inventory || q.Boot != r.Lifecycle.Binding.Boot || r.Lifecycle.Lease == nil || q.Lease != *r.Lifecycle.Lease {
-			return proof, errTrust
-		}
-		return proof, nil
-	}
-	p := proof.Process
-	if proof.Epoch != r.Lifecycle.Epoch || p.Inventory != r.Inventory || p.Mode != "supervised" || p.Boot != r.Lifecycle.Binding.Boot || p.PID <= 1 || p.Start == "" || p.Inode == 0 {
-		return proof, errTrust
-	}
-	return proof, nil
-}

package/templates/native-go/backend/internal/helper/lifecycle_test.go

@@ -1,473 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-)
-
-func testBinding() Binding {
-	return Binding{Boot: "fixture-boot", Entered: 7, Install: strings.Repeat("c", 64)}
-}
-func testLifecycle(phase string) *Lifecycle {
-	return &Lifecycle{Schema: 2, Epoch: strings.Repeat("d", 64), Binding: testBinding(), Phase: phase}
-}
-func TestLifecycleUnavailableRefusesBeforeStart(t *testing.T) {
-	c, f := controlFixture(t)
-	c.Observe = func(context.Context, Inventory) (Binding, error) { return Binding{}, errors.New("bus unavailable") }
-	if c.Control(context.Background(), "enable") == nil || f.started != 0 {
-		t.Fatal("unknown authority started helper")
-	}
-}
-func TestLifecycleStopLatchAndExplicitRecover(t *testing.T) {
-	c, f := controlFixture(t)
-	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
-	record(t, c.Client, r)
-	if err := fenceRecord(c.Client, r.Lifecycle.Epoch, "unit-stopped"); err != nil {
-		t.Fatal(err)
-	}
-	s := c.Status(context.Background())
-	if s.State != "failed" || s.Cleanup != "required" {
-		t.Fatal(s)
-	}
-	r, _ = readRecord(c.StateDir, c.Owner)
-	if !r.Enabled || r.Lifecycle.Phase != "fenced" {
-		t.Fatal(r)
-	}
-	if err := c.Control(context.Background(), "teardown"); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Control(context.Background(), "recover"); err != nil {
-		t.Fatal(err)
-	}
-	got, _ := readRecord(c.StateDir, c.Owner)
-	if got.Lifecycle.Epoch == r.Lifecycle.Epoch || got.Lifecycle.Phase != "running" || f.started != 1 {
-		t.Fatal(got)
-	}
-}
-func TestLifecycleRecoverRejectsChangedInstallAndReboot(t *testing.T) {
-	for _, which := range []string{"install", "boot"} {
-		t.Run(which, func(t *testing.T) {
-			c, f := controlFixture(t)
-			record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("stopped")})
-			c.Observe = func(context.Context, Inventory) (Binding, error) {
-				b := testBinding()
-				if which == "boot" {
-					b.Boot = "reboot"
-				} else {
-					b.Install = strings.Repeat("e", 64)
-				}
-				return b, nil
-			}
-			if c.Control(context.Background(), "recover") == nil || f.started != 0 {
-				t.Fatal("continuity changed")
-			}
-		})
-	}
-}
-func TestLifecycleOldStrictControllerCannotReplay(t *testing.T) {
-	c, _ := controlFixture(t)
-	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("stopped")})
-	b, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-	var legacy struct {
-		Inventory Inventory `json:"inventory"`
-		Enabled   bool      `json:"enabled"`
-		Residual  bool      `json:"residual,omitempty"`
-	}
-	d := json.NewDecoder(strings.NewReader(string(b)))
-	d.DisallowUnknownFields()
-	if d.Decode(&legacy) == nil {
-		t.Fatal("old payload can ignore latch")
-	}
-}
-func TestLifecycleStartupFinalizationCannotOverwriteFence(t *testing.T) {
-	c, _ := controlFixture(t)
-	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
-	record(t, c.Client, r)
-	if err := fenceRecord(c.Client, r.Lifecycle.Epoch, "unit-stopped"); err != nil {
-		t.Fatal(err)
-	}
-	if finalizeStart(c.Client, r.Lifecycle.Epoch) == nil {
-		t.Fatal("startup overwrote fence")
-	}
-	got, _ := readRecord(c.StateDir, c.Owner)
-	if got.Lifecycle.Phase != "fenced" || !got.Residual {
-		t.Fatal(got)
-	}
-}
-func TestLifecycleCompletionRequiresMatchingEpochAndIdentity(t *testing.T) {
-	c, f := controlFixture(t)
-	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true})
-	if completeRecord(c.Client, "wrong", f.current) == nil {
-		t.Fatal("wrong epoch completed")
-	}
-	if completeRecord(c.Client, strings.Repeat("d", 64), f.current) == nil {
-		t.Fatal("live runtime completed")
-	}
-	if err := c.teardown(); err != nil {
-		t.Fatal(err)
-	}
-	if err := completeRecord(c.Client, strings.Repeat("d", 64), f.current); err != nil {
-		t.Fatal(err)
-	}
-	r, _ := readRecord(c.StateDir, c.Owner)
-	proof, e := completionRecord(c.Client, r)
-	if e != nil {
-		t.Fatal(e)
-	}
-	if r.Residual || r.Lifecycle.Completion == "" || proof.Process != f.current {
-		t.Fatal(r)
-	}
-	if c.Status(context.Background()).State != "stopped" {
-		t.Fatal("completion not readable")
-	}
-}
-
-func TestLifecyclePolicyLockDoesNotBlockControllerStop(t *testing.T) {
-	c, _ := controlFixture(t)
-	lock, err := os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_CREATE|os.O_RDWR, 0600)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer lock.Close()
-	if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
-		t.Fatal(err)
-	}
-	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
-	if err := fenceRecord(c.Client, strings.Repeat("d", 64), "unit-stopped"); !errors.Is(err, errBusy) {
-		t.Fatal("fence blocked/replaced approval", err)
-	}
-}
-func TestLifecycleMalformedSchemaAndCompletionRefuse(t *testing.T) {
-	for _, which := range []string{"schema", "epoch", "phase", "identity", "entered"} {
-		t.Run(which, func(t *testing.T) {
-			c, _ := controlFixture(t)
-			l := testLifecycle("stopped")
-			switch which {
-			case "schema":
-				l.Schema = 1
-			case "epoch":
-				l.Epoch = "old"
-			case "phase":
-				l.Phase = "ready"
-			case "entered":
-				l.Binding.Entered = 0
-			case "identity":
-				l.Completion = "wrong"
-			}
-			record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: l})
-			if _, err := readRecord(c.StateDir, c.Owner); err == nil {
-				t.Fatal("malformed policy accepted")
-			}
-		})
-	}
-}
-
-func TestLifecycleControllerAcceptsOnlyExactAutonomousCompletion(t *testing.T) {
-	c, f := controlFixture(t)
-	f.stopHook = func(p Process) error {
-		if err := cleanRuntime(c.Client, true); err != nil {
-			return err
-		}
-		if err := completeRecord(c.Client, strings.Repeat("d", 64), p); err != nil {
-			return err
-		}
-		return errTrust // supervisor exited before the controller's socket dial
-	}
-	if err := c.Control(context.Background(), "teardown"); err != nil {
-		t.Fatal("valid autonomous completion refused", err)
-	}
-}
-
-func TestLifecyclePublicApprovalDoesNotDiscloseCompletionProcess(t *testing.T) {
-	c, f := controlFixture(t)
-	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true})
-	if err := c.teardown(); err != nil {
-		t.Fatal(err)
-	}
-	if err := completeRecord(c.Client, strings.Repeat("d", 64), f.current); err != nil {
-		t.Fatal(err)
-	}
-	b, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-	if strings.Contains(string(b), `"pid"`) || strings.Contains(string(b), `"inode"`) {
-		t.Fatal("private process identity disclosed")
-	}
-}
-
-func TestLifecycleRecoverRejectsMissingCompletionProof(t *testing.T) {
-	c, f := controlFixture(t)
-	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true})
-	if err := c.teardown(); err != nil {
-		t.Fatal(err)
-	}
-	if err := completeRecord(c.Client, strings.Repeat("d", 64), f.current); err != nil {
-		t.Fatal(err)
-	}
-	os.Remove(filepath.Join(c.StateDir, "completion-"+strings.Repeat("d", 64)+".json"))
-	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
-		t.Fatal("missing completion bypassed")
-	}
-}
-
-func TestLifecycleDisableUpgradesLegacyGateAgainstReplay(t *testing.T) {
-	c, _ := controlFixture(t)
-	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true})
-	if err := c.Control(context.Background(), "disable"); err != nil {
-		t.Fatal(err)
-	}
-	b, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-	var old struct {
-		Inventory Inventory `json:"inventory"`
-		Enabled   bool      `json:"enabled"`
-		Residual  bool      `json:"residual,omitempty"`
-	}
-	d := json.NewDecoder(strings.NewReader(string(b)))
-	d.DisallowUnknownFields()
-	if d.Decode(&old) == nil {
-		t.Fatal("legacy enable can replay disabled gate")
-	}
-}
-
-func TestLifecycleCrashAfterUnlinkWithoutCommitKeepsCleanupRequired(t *testing.T) {
-	c, f := controlFixture(t)
-	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true}
-	record(t, c.Client, r)
-	if err := cleanRuntime(c.Client, true); err != nil {
-		t.Fatal(err)
-	}
-	if c.Control(context.Background(), "teardown") == nil || f.stopped != 0 {
-		t.Fatal("unlink alone certified completion")
-	}
-	got, _ := readRecord(c.StateDir, c.Owner)
-	if !got.Residual || got.Lifecycle.Phase != "fenced" {
-		t.Fatal("crash intent erased")
-	}
-}
-func TestLifecycleExplicitRepairAfterVerifiedNewBoot(t *testing.T) {
-	c, _ := controlFixture(t)
-	record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced"), Residual: true})
-	os.Remove(filepath.Join(c.RunDir, "process.json"))
-	c.Boot = func() (string, error) { return "verified-new-boot", nil }
-	if err := c.Control(context.Background(), "disable"); err != nil {
-		t.Fatal(err)
-	}
-	r, _ := readRecord(c.StateDir, c.Owner)
-	if r.Enabled || r.Residual {
-		t.Fatal("post-reboot disable failed")
-	}
-}
-
-// The controller has read a fenced approval, but the owner finishes between
-// that read and the process-record read. No timing sleeps or fake syscall error.
-func TestLifecycleTeardownSnapshotAcceptsCommittedOwnerExit(t *testing.T) {
-	c, f := controlFixture(t)
-	if err := fenceRecord(c.Client, testLifecycle("running").Epoch, "admin-stop"); err != nil {
-		t.Fatal(err)
-	}
-	before, err := readRecord(c.StateDir, c.Owner)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := cleanRuntime(c.Client, true); err != nil {
-		t.Fatal(err)
-	}
-	if err := completeRecord(c.Client, before.Lifecycle.Epoch, f.current); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.teardownRecord(before, f.current); err != nil {
-		t.Fatal("exact committed completion rejected after approval snapshot", err)
-	}
-}
-
-func TestLifecycleTeardownCompletionRejectsChangedWitness(t *testing.T) {
-	for _, kind := range []string{"epoch", "inventory", "binding", "lease", "pid", "start", "inode", "device", "digest", "orphan", "missing", "mode", "symlink", "runtime"} {
-		t.Run(kind, func(t *testing.T) {
-			c, f := controlFixture(t)
-			if err := fenceRecord(c.Client, testLifecycle("running").Epoch, "admin-stop"); err != nil {
-				t.Fatal(err)
-			}
-			before, err := readRecord(c.StateDir, c.Owner)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err := cleanRuntime(c.Client, true); err != nil {
-				t.Fatal(err)
-			}
-			if err := completeRecord(c.Client, before.Lifecycle.Epoch, f.current); err != nil {
-				t.Fatal(err)
-			}
-			r, err := readRecord(c.StateDir, c.Owner)
-			if err != nil {
-				t.Fatal(err)
-			}
-			proof, err := completionRecord(c.Client, r)
-			if err != nil {
-				t.Fatal(err)
-			}
-			path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
-			switch kind {
-			case "epoch":
-				r.Lifecycle.Epoch = strings.Repeat("e", 64)
-				proof.Epoch = r.Lifecycle.Epoch
-			case "inventory":
-				r.Inventory.Version = "9.0.0-9999"
-				proof.Process.Inventory = r.Inventory
-			case "binding":
-				r.Lifecycle.Binding.Entered++
-			case "lease":
-				r.Lifecycle.Lease = &Lease{Device: 1, Inode: 999}
-			case "pid":
-				proof.Process.PID++
-			case "start":
-				proof.Process.Start = "101"
-			case "inode":
-				proof.Process.Inode++
-			case "device":
-				proof.Process.Device++
-			}
-			if err := storeCompletion(c.Client, &r, proof); err != nil {
-				t.Fatal(err)
-			}
-			switch kind {
-			case "digest":
-				r.Lifecycle.Completion = strings.Repeat("f", 64)
-			case "orphan":
-				r.Lifecycle.Phase = "fenced"
-				r.Lifecycle.Completion = ""
-				r.Residual = true
-			case "missing":
-				if err := os.Remove(path); err != nil {
-					t.Fatal(err)
-				}
-			case "mode":
-				if err := os.Chmod(path, 0644); err != nil {
-					t.Fatal(err)
-				}
-			case "symlink":
-				if err := os.Rename(path, path+".saved"); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.Symlink(path+".saved", path); err != nil {
-					t.Fatal(err)
-				}
-			case "runtime":
-				if err := os.WriteFile(filepath.Join(c.RunDir, "helper.sock"), []byte("foreign"), 0600); err != nil {
-					t.Fatal(err)
-				}
-			}
-			record(t, c.Client, r)
-			saved, err := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err := c.teardownRecord(before, f.current); err == nil {
-				t.Fatal("changed/uncommitted completion accepted", kind)
-			}
-			after, err := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-			if err != nil {
-				t.Fatal(err)
-			}
-			if string(saved) != string(after) || f.stopped != 0 || f.started != 0 {
-				t.Fatal("failed reconciliation changed evidence or touched process")
-			}
-		})
-	}
-}
-
-func TestLifecycleControlActionsAcceptExactOwnerCompletion(t *testing.T) {
-	for _, action := range []string{"teardown", "disable", "recover"} {
-		t.Run(action, func(t *testing.T) {
-			c, f := controlFixture(t)
-			f.stopHook = func(p Process) error {
-				if err := cleanRuntime(c.Client, true); err != nil {
-					return err
-				}
-				if err := completeRecord(c.Client, testLifecycle("running").Epoch, p); err != nil {
-					return err
-				}
-				return errTrust
-			}
-			if err := c.Control(context.Background(), action); err != nil {
-				t.Fatal(err)
-			}
-			r, err := readRecord(c.StateDir, c.Owner)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if r.Residual || r.Enabled != (action != "disable") {
-				t.Fatal(r)
-			}
-			if action == "recover" {
-				if f.started != 1 || r.Lifecycle.Epoch == testLifecycle("running").Epoch {
-					t.Fatal("Recover did not create new epoch")
-				}
-			} else if f.started != 0 {
-				t.Fatal("Stop operation started helper")
-			}
-		})
-	}
-}
-
-func TestLifecycleTeardownRefusesUnwitnessedConcurrentCompletion(t *testing.T) {
-	c, f := controlFixture(t)
-	before, err := readRecord(c.StateDir, c.Owner)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := fenceRecord(c.Client, before.Lifecycle.Epoch, "admin-stop"); err != nil {
-		t.Fatal(err)
-	}
-	if err := cleanRuntime(c.Client, true); err != nil {
-		t.Fatal(err)
-	}
-	if err := completeRecord(c.Client, before.Lifecycle.Epoch, f.current); err != nil {
-		t.Fatal(err)
-	}
-	if c.teardownFor(before, Process{}) == nil {
-		t.Fatal("concurrent exit accepted without saved owned identity")
-	}
-}
-
-func TestLifecycleTeardownUnlinkRaceStillRequiresCommittedProof(t *testing.T) {
-	for _, committed := range []bool{false, true} {
-		c, f := controlFixture(t)
-		f.stopHook = func(p Process) error {
-			if err := cleanRuntime(c.Client, true); err != nil {
-				return err
-			}
-			if committed {
-				return completeRecord(c.Client, testLifecycle("running").Epoch, p)
-			}
-			return nil
-		}
-		err := c.Control(context.Background(), "teardown")
-		if (err == nil) != committed {
-			t.Fatalf("commit=%v err=%v", committed, err)
-		}
-	}
-}
-
-func TestLifecycleOwnedStopCannotUseRepairCompletion(t *testing.T) {
-	c, f, _ := repairFixture(t)
-	before, err := readRecord(c.StateDir, c.Owner)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := cleanRuntime(c.Client, true); err != nil {
-		t.Fatal(err)
-	}
-	if err := policyUpdate(c.Client, func(r *Record) error {
-		r.Lifecycle.Phase = "stopped"
-		return storeCompletion(c.Client, r, Completion{Epoch: r.Lifecycle.Epoch, Repair: &RepairCompletion{Inventory: r.Inventory, Boot: r.Lifecycle.Binding.Boot, Lease: *r.Lifecycle.Lease}})
-	}); err != nil {
-		t.Fatal(err)
-	}
-	if c.teardownRecord(before, f.current) == nil {
-		t.Fatal("repair artifact substituted for exact owned process proof")
-	}
-}