@synopackageland/cli 0.5.0 → 0.6.0

package/templates/native-go/backend/internal/identity/store.go

@@ -0,0 +1,109 @@
+package identity
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+)
+
+type record struct {
+	Subject Subject   `json:"subject"`
+	Expires time.Time `json:"expires"`
+}
+type bucket struct {
+	Start time.Time `json:"start"`
+	Count int       `json:"count"`
+}
+type state struct {
+	Sessions map[string]record `json:"sessions"`
+	Rates    map[string]bucket `json:"rates"`
+}
+
+// CGI processes share a package-private, locked store. Only hashes of bearer
+// IDs and rate-limit subjects are persisted; DSM credentials never enter it.
+func (s *Service) transaction(fn func(*state) error) error {
+	if err := os.MkdirAll(s.dir, 0700); err != nil {
+		return err
+	}
+	if err := os.Chmod(s.dir, 0700); err != nil {
+		return err
+	}
+	lock, err := os.OpenFile(filepath.Join(s.dir, "lock"), os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		return err
+	}
+	defer lock.Close()
+	if err = syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
+		return err
+	}
+	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
+	st := state{Sessions: map[string]record{}, Rates: map[string]bucket{}}
+	path := filepath.Join(s.dir, "state.json")
+	raw, err := os.ReadFile(path)
+	if err == nil {
+		if len(raw) > 4<<20 || json.Unmarshal(raw, &st) != nil || st.Sessions == nil || st.Rates == nil {
+			return errors.New("invalid identity store")
+		}
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	now := s.cfg.Now()
+	for k, v := range st.Sessions {
+		if !now.Before(v.Expires) {
+			delete(st.Sessions, k)
+		}
+	}
+	for k, v := range st.Rates {
+		if !now.Before(v.Start.Add(time.Minute)) {
+			delete(st.Rates, k)
+		}
+	}
+	result := fn(&st)
+	raw, err = json.Marshal(st)
+	if err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(s.dir, ".state-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if _, err = tmp.Write(raw); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err = tmp.Close(); err != nil {
+		return err
+	}
+	if err = os.Rename(tmp.Name(), path); err != nil {
+		return err
+	}
+	return result
+}
+func (s *Service) limited(st *state, ip, account string) bool {
+	keys := []string{"ip:" + digest(ip), "account:" + digest(account)}
+	for i, key := range keys {
+		limit := 20
+		if i == 1 {
+			limit = 5
+		}
+		if st.Rates[key].Count >= limit {
+			return true
+		}
+	}
+	if len(st.Rates) > 4096 {
+		return true
+	}
+	for _, key := range keys {
+		b := st.Rates[key]
+		if b.Count == 0 {
+			b.Start = s.cfg.Now()
+		}
+		b.Count++
+		st.Rates[key] = b
+	}
+	return false
+}

package/templates/native-go/backend/internal/jsonlimits/limits.go

@@ -0,0 +1,48 @@
+// Package jsonlimits bounds JSON complexity before a decoder allocates values.
+package jsonlimits
+
+const (
+	MaxDepth           = 32
+	MaxStructuralBytes = 65536
+)
+
+// WithinLimits scans raw JSON using constant memory. It counts punctuation
+// outside strings, bounding both wide collections and nesting independently
+// of the transport's byte limit. Syntax validation remains the decoder's job.
+func WithinLimits(body []byte) bool {
+	depth, structural := 0, 0
+	inString, escaped := false, false
+	for _, c := range body {
+		if inString {
+			if escaped {
+				escaped = false
+			} else if c == '\\' {
+				escaped = true
+			} else if c == '"' {
+				inString = false
+			}
+			continue
+		}
+		switch c {
+		case '"':
+			inString = true
+		case '{', '[':
+			depth++
+			structural++
+			if depth > MaxDepth {
+				return false
+			}
+		case '}', ']':
+			if depth > 0 {
+				depth--
+			}
+			structural++
+		case ',', ':':
+			structural++
+		}
+		if structural > MaxStructuralBytes {
+			return false
+		}
+	}
+	return true
+}

package/templates/native-go/backend/internal/jsonlimits/limits_test.go

@@ -0,0 +1,52 @@
+package jsonlimits
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestExactStructureAndDepthBounds(t *testing.T) {
+	for name, tc := range map[string]struct {
+		body string
+		ok   bool
+	}{
+		"structure at limit":   {"[" + strings.Repeat("0,", MaxStructuralBytes-2) + "0]", true},
+		"structure over limit": {"[" + strings.Repeat("0,", MaxStructuralBytes-1) + "0]", false},
+		"depth at limit":       {strings.Repeat("[", MaxDepth) + "0" + strings.Repeat("]", MaxDepth), true},
+		"depth over limit":     {strings.Repeat("[", MaxDepth+1) + "0" + strings.Repeat("]", MaxDepth+1), false},
+		"object punctuation":   {"{" + strings.Repeat(`"x":0,`, MaxStructuralBytes/2) + `"x":0}`, false},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if !json.Valid([]byte(tc.body)) {
+				t.Fatal("invalid fixture")
+			}
+			if WithinLimits([]byte(tc.body)) != tc.ok {
+				t.Fatalf("want allowed=%v", tc.ok)
+			}
+		})
+	}
+}
+
+func TestStringEscapesCannotHideFollowingStructure(t *testing.T) {
+	for _, value := range []string{`\`, `"`, `\"`, `[]{}:,`, "\u4f60\u597d"} {
+		encoded, err := json.Marshal(strings.Repeat(value, 65536))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !WithinLimits(encoded) {
+			t.Fatal("string contents counted as structure")
+		}
+		body := append(append([]byte(`{"text":`), encoded...), []byte(`,"array":[`+strings.Repeat("0,", MaxStructuralBytes)+`0]}`)...)
+		if !json.Valid(body) || WithinLimits(body) {
+			t.Fatal("escaped string hid oversized array")
+		}
+	}
+}
+
+func TestScannerDoesNotAllocate(t *testing.T) {
+	body := []byte("[" + strings.Repeat("0,", MaxStructuralBytes-2) + "0]")
+	if allocations := testing.AllocsPerRun(10, func() { WithinLimits(body) }); allocations != 0 {
+		t.Fatalf("allocations=%v", allocations)
+	}
+}

package/templates/native-go/dsm-package.yaml

@@ -1,6 +1,6 @@
 # Standalone native DSM package: an unsigned SPK that runs as its own package
-# `synopkgland build-spk` reads this file.
-schema: 1
+# `synopkgland build` reads this file.
+schema: 2
 
 # INFO.package: letters and digits, starting with a letter. It also names the
 # DSM app (SYNO.SDS.<package>) and the CGI URL /webman/3rdparty/<package>/.
@@ -17,15 +17,9 @@ os_min_ver: "7.1-42661"
 arches: [x86_64, aarch64]
 
 backend:
-  # Build the Go module in ./backend (package ./cmd/app) as the CGI.
-  go:
-    dir: backend
-    main: ./cmd/app
-  # Or ship a CGI executable you already have (remove `go:` above). Each file
-  # must be a static Linux ELF for its arch; it then owns authentication itself.
-  # binary:
-  #   x86_64: prebuilt/api-x86_64
-  #   aarch64: prebuilt/api-aarch64
+  kind: go
+  dir: backend
+  main: ./cmd/app
 
 ui:
   # Static files served at /webman/3rdparty/<package>/app/. app.js and app.css
@@ -33,9 +27,9 @@ ui:
   dir: ui
 
 # UI languages: i18n/messages/<locale>.json for en, zh-TW, zh-CN, ja, ko, de,
-# fr, es and it (DSM's other languages fall back to English). build-spk checks
+# fr, es and it (DSM's other languages fall back to English). build checks
 # that every language has the en.json keys and placeholders, and that the keys
-# listed in the glossary use Synology's own DSM wording.
+# listed in the glossary use DSM's own wording.
 i18n:
   messages: i18n/messages
   glossary: i18n/glossary.json
@@ -51,8 +45,5 @@ i18n:
     es: { description: Un paquete nativo de DSM con backend en Go e interfaz en ventana de DSM. }
     it: { description: Un pacchetto DSM nativo con backend Go e interfaccia in una finestra DSM. }
 
-# none: everything runs as the package account.
-# root: also fixed root operations, one root/<name>.sh each, that run only
-#       after a DSM administrator approves them in the package window.
-#       See README.md "Root access" before using it.
-privilege: __PRIVILEGE__
+# Optional SDK capabilities; delegate/rootOps share administrator-approved executor setup.
+capabilities: {}

package/templates/native-go-delegate/DELEGATE.md

@@ -0,0 +1,142 @@
+# Delegated background file jobs
+
+This overlay implements PLAN §2.4 v1. It runs in the package account and connects
+only to the executor socket. The executor verifies the current DSM `id` cookie
+when creating/listing/revoking a user delegation; the CGI never sends a username.
+A worker stores only a delegation ID and job ID, never session credentials.
+
+## CLI assembly
+
+`init --with delegate` and `add delegate` apply base → jobs → delegate.
+The SDK registers `DelegateRoutes` using the trusted manifest scope and gives
+all seven methods below `authenticated` access through `sdk-permissions.json`.
+App-owned permissions remain in `permissions.json`; `app.status` is initialized
+as authenticated so ordinary users can mount their panels. The CLI binds both
+policy files to the CGI build. SDK policy edits and overrides fail validation.
+
+`background.Job.DelegationID` is an optional field in the shared base store.
+Delegate does not replace store.go, so CGI lock budgets, cancellation and schedule
+recovery always use the same implementation as jobs. CGI routes use
+`NewRequestStore`; workers retain `NewStore`. `add` still checks ownership of the
+shared store before activating delegate.
+
+```ts
+interface ExecutorSetup {
+  status(): Promise<CapabilityStatus>
+  authorize(password: string): Promise<CapabilityStatus>
+  control(action: 'start' | 'stop' | 'purge'): Promise<CapabilityStatus>
+}
+```
+
+Passwords are sent only to DSM PasswordConfirm and are never persisted. Socket
+status must match the packaged executor and policy digests before readiness.
+
+Jobs are available to authenticated users immediately after executor approval;
+there are no enabled/ordinary-user admission switches. The jobs overlay supplies
+the shared NasPicker and session metadata provider without delegate UI copies.
+
+The overlay replaces `cmd/background-worker/main.go`, which refuses root and
+uses a fixed dispatcher for the existing SHA256 worker and the download worker.
+It retains the existing jobs spool, owner/UID checks, admission quotas,
+cancellation journal, schedule tick, recovery and heartbeat. There is no arbitrary
+worker name from HTTP input.
+
+## CGI routes
+
+| Method | Parameters | Result |
+| --- | --- | --- |
+| `delegate.status` | `{}` | capability `state`, optional `reason` |
+| `delegate.create` | `job_id`, `ops`, `path`, `ttl_seconds` | executor grant |
+| `delegate.list` | `{}` | executor's `{delegations: [...]}` |
+| `delegate.revoke` | `delegation_id` | `{revoked}` |
+| `delegate.jobs.submit` | `key`, `url`, `dest`, `name` | owner-bound job including `delegation_id` |
+| `delegate.jobs.list` | `{}` | `{jobs: [...]}` for the current username AND UID |
+| `delegate.jobs.cancel` | `id` | `{job, revocation_pending}` |
+
+`delegate.create` uses the manifest's scope and accepts only the five Files
+operation IDs, with a TTL of 1–3600 seconds. The download example creates a
+one-hour `files.write` grant. Administrators do not bypass job ownership here.
+The executor independently rejects ineligible subjects, including admin runners.
+List items use `delegation_id`, `job_id`, `path`, `expires_at`, optional `revoked`.
+
+## Typed files
+
+`filestation.Files` is a single typed interface with List, Info, CreateFolder,
+CheckPermission and Write. Both `filestation.RequestContext.Files()` (live
+File Station session) and `delegate.JobContext.Files()` (executor) implement it.
+The request adapter is added by this overlay in the existing filestation package;
+no second Page, Entry or ListOptions type is introduced.
+
+For metadata operations the executor receives `path`; createFolder additionally
+receives `name`. The fixed executor accepts no pagination/sort parameters, so
+job Files.List supports the default ListOptions only; nondefault options return
+`unsupported`. Adding wire pagination requires the controller to approve a §2.4
+contract extension.
+Every offline operation also receives `delegation_id` and `job_id`. Write uses
+exactly §2.4's `staging`, `dest_dir`, `name`. Paths in these payloads never grant
+permission; the executor checks current subject, operation and scope.
+
+```go
+func save(ctx context.Context, job delegate.JobContext, content io.Reader, size int64) error {
+    return job.Files().Write(ctx, "/home/Downloads", "download.txt", content, size)
+}
+```
+
+Write stages exactly `size` bytes under `/var/packages/<pkg>/var/executor-staging/`
+using an internally generated filename, mode 0600 inside a 0700 directory.
+The executor receives only that relative random name. Local staging is removed
+on success or any refusal/read/size/cancellation/transport failure. Download is
+limited to 64 MiB and 60 seconds, accepts HTTP/HTTPS without embedded credentials,
+and does not follow redirects or use ambient proxy settings. Both declared and
+streamed lengths are bounded. The worker downloads into a random staging file,
+then passes the content through Files.Write.
+
+The persisted `delegate-<job-id>.json` record is a revocation retry journal,
+separate from the job's `delegation_id`. It survives canceled input removal and
+history trimming. Completion, failure, cancellation, purge and restart
+recovery all feed cleanup; an unavailable executor leaves a record for the next
+worker sweep. Outstanding revocation records are bounded to 80; admission refuses
+new grants if cleanup reaches that limit. An unknown grant-creation response cannot reveal a delegation ID;
+the executor TTL bounds that grant. An uncertain write is never replayed.
+
+If the executor socket cannot be dialed, no request has been sent. The download
+worker retains its staged bytes and retries that request after 2, 4, 8, 16,
+then 30 seconds (30-second cap), for at most 15 minutes. This wait is separate
+from the 60-second download budget. `delegate.jobs.list` reports
+`waiting_executor`; the panel shows the startup waiting message in all nine
+supported locales and keeps cancellation and polling available. The shared
+journal retains the claimed running slot for quota/ownership/recovery rules;
+the delegation sidecar stores the waiting flag and grant expiry. List reads
+both under one short lock, and retry timers/socket calls never hold that lock.
+Cancellation and local revocation stop waiting through the existing 100 ms
+cancel watcher; grant expiry bounds the next wait. The executor still checks
+revocation, expiry and current eligibility before any operation. At the
+15-minute deadline the job fails with `EXECUTOR_UNAVAILABLE`, retaining pending
+revocation cleanup. Errors after a connection is established are terminal;
+partial writes, disconnects, timeouts and executor refusals are never replayed.
+A stopped worker keeps the existing interrupted/no-replay recovery behavior.
+
+Stable executor refusal codes are preserved, with sanitized messages. Local
+transport codes are `EXECUTOR_UNAVAILABLE`, `EXECUTOR_TIMEOUT`,
+`EXECUTOR_TOO_LARGE`, `EXECUTOR_PROTOCOL`, and `canceled`. Framing, including the
+newline, is bounded to 64 KiB in each direction, with one request per connection.
+
+## Local verification
+
+From the repository root:
+
+```sh
+packages/app-cli/templates/native-go-delegate/test.sh
+packages/app-cli/templates/native-go-delegate/test-frontend.sh
+```
+
+The Go fixture merges the base backend and delegate overlay,
+then runs all base/overlay tests with the race detector, host/Linux amd64/arm64
+vet, and formatting checks. CGI tests use the shipped SDK capability permissions and a
+fake Unix-socket executor. The frontend fixture merges the Vue base and this
+overlay and runs fake-provider UI tests plus Vue type checking and Vite build.
+The fixtures are temporary and are removed after each run.
+
+These tests do not claim DSM kernel ACL, owner, reboot, real task or real executor
+validation. CLI activation and real executor/setup integration belong to the other
+P2 workstreams.

package/templates/native-go-delegate/backend/cmd/background-worker/main.go

@@ -0,0 +1,41 @@
+// Command background-worker is the package's fixed background worker. DSM runs
+// it as the package's systemd user unit under the package account; it never
+// runs as root and takes no input except the jobs in its private spool.
+package main
+
+import (
+	"context"
+	"log"
+	"os"
+	"os/signal"
+	"os/user"
+	"strconv"
+	"syscall"
+
+	"dsmapp/internal/background"
+	"dsmapp/internal/delegate"
+)
+
+// Set by `synopkgland build-spk` through -ldflags -X.
+var packageID = "dev"
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix(packageID + " background: ")
+	if err := background.RefuseRoot(os.Geteuid()); err != nil {
+		log.Fatal(err)
+	}
+	name := ""
+	if u, err := user.Current(); err == nil {
+		name = u.Username
+	}
+	info := background.WorkerInfo{PID: os.Getpid(), UID: os.Getuid(), Username: name}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+	log.Printf("started as uid %s", strconv.Itoa(info.UID))
+	dataDir := "/var/packages/" + packageID + "/var"
+	service := &delegate.Service{Client: delegate.Local(packageID), Store: background.NewStore(dataDir + "/background"), StagingDir: dataDir + "/executor-staging"}
+	if err := service.Run(ctx, info); err != nil {
+		log.Fatal(err)
+	}
+}

package/templates/native-go-delegate/backend/internal/app/delegate.go

@@ -0,0 +1,15 @@
+package app
+
+import (
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"dsmapp/internal/delegate"
+	"path/filepath"
+)
+
+// DelegateRoutes is appended by the CLI's delegate capability assembly.
+// scope comes from the trusted manifest, never an HTTP parameter.
+func DelegateRoutes(cfg Config, scope string) []api.Route {
+	service := &delegate.Service{ExecutorDigest: cfg.ExecutorDigest, PolicyDigest: cfg.PolicyDigest, Client: delegate.Local(cfg.PackageID), Store: background.NewRequestStore(filepath.Join(cfg.DataDir, "background")), Scope: scope, StagingDir: filepath.Join(cfg.DataDir, "executor-staging")}
+	return service.Routes()
+}

package/templates/native-go-delegate/backend/internal/app/delegate_on.go

@@ -0,0 +1,5 @@
+package app
+
+import "dsmapp/internal/api"
+
+func (cfg Config) delegateRoutes() []api.Route { return DelegateRoutes(cfg, cfg.DelegateScope) }

package/templates/native-go-delegate/backend/internal/app/delegate_routes_test.go

@@ -0,0 +1,17 @@
+package app
+
+func init() {
+	sampleParams["delegate.status"] = `{}`
+	sampleParams["delegate.create"] = `{"job_id":"job1","ops":["files.write"],"path":"/home","ttl_seconds":60}`
+	sampleParams["delegate.list"] = `{}`
+	sampleParams["delegate.revoke"] = `{"delegation_id":"missing"}`
+	sampleParams["delegate.jobs.submit"] = `{"key":"download","url":"http://localhost/file","dest":"/home","name":"file"}`
+	sampleParams["delegate.jobs.list"] = `{}`
+	sampleParams["delegate.jobs.cancel"] = `{"id":"missing"}`
+	sampleOutcome["delegate.create"] = "session_required"
+	sampleOutcome["delegate.list"] = "session_required"
+	sampleOutcome["delegate.revoke"] = "session_required"
+	sampleOutcome["delegate.jobs.submit"] = "identity_unavailable"
+	sampleOutcome["delegate.jobs.list"] = "identity_unavailable"
+	sampleOutcome["delegate.jobs.cancel"] = "identity_unavailable"
+}

package/templates/native-go-delegate/backend/internal/background/delegate_review_test.go

@@ -0,0 +1,174 @@
+package background
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestReviewGrantCreationDoesNotBlockOtherOwnersCancel(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "spool")
+	worker := NewStore(dir)
+	cgi := NewRequestStore(dir)
+	cgi.lockTimeout = 20 * time.Millisecond
+	ctx := context.Background()
+	alice := Submitter{User: "alice", UID: "1205"}
+	bob := Submitter{User: "bob", UID: "1206"}
+	j, _, err := worker.Submit(ctx, SubmitRequest{Key: "existing", Name: "hash", Data: []byte("x"), Submitter: alice})
+	if err != nil {
+		t.Fatal(err)
+	}
+	started, release := make(chan struct{}), make(chan struct{})
+	done := make(chan error, 1)
+	go func() {
+		_, err := cgi.SubmitDelegated(ctx, SubmitRequest{Key: "download", Name: "file", Data: []byte("x"), Submitter: bob}, func(string) (DelegationBinding, error) {
+			close(started)
+			<-release
+			return DelegationBinding{DelegationID: "grant"}, nil
+		}, func(DelegationBinding) {})
+		done <- err
+	}()
+	<-started
+	_, err = cgi.CancelFor(ctx, j.ID, Access{Owner: alice})
+	close(release)
+	if err2 := <-done; err2 != nil {
+		t.Fatal(err2)
+	}
+	if errors.Is(err, ErrBusy) {
+		t.Fatal("another owner's DSM grant request blocks cancellation under global jobs lock")
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDelegatedReservationCannotRunAndCanceledGrantIsRevoked(t *testing.T) {
+	s := NewStore(filepath.Join(t.TempDir(), "spool"))
+	ctx := context.Background()
+	owner := Submitter{User: "alice", UID: "1205"}
+	req := SubmitRequest{Key: "pending", Name: "file", Data: []byte("input"), Submitter: owner}
+	rollback := 0
+	_, err := s.SubmitDelegated(ctx, req, func(id string) (DelegationBinding, error) {
+		if claimed, e := s.Claim(ctx); e != nil || claimed != nil {
+			t.Fatalf("claimed unfinished reservation: %+v %v", claimed, e)
+		}
+		if _, e := s.SubmitDelegated(ctx, req, func(string) (DelegationBinding, error) {
+			t.Fatal("duplicate grant created")
+			return DelegationBinding{DelegationID: ""}, nil
+		}, func(DelegationBinding) {}); !errors.Is(e, ErrBusy) {
+			t.Fatal("inflight duplicate must be busy", e)
+		}
+		if _, e := s.CancelFor(ctx, id, Access{Owner: owner}); e != nil {
+			t.Fatal(e)
+		}
+		return DelegationBinding{DelegationID: "grant"}, nil
+	}, func(b DelegationBinding) {
+		rollback++
+		if b.DelegationID != "grant" {
+			t.Fatal(b)
+		}
+		if _, e := s.Delegation(ctx, b.JobID); e != nil {
+			t.Fatal("revocation not durable", e)
+		}
+	})
+	if !errors.Is(err, ErrNotCancelable) || rollback != 1 {
+		t.Fatal("canceled grant committed", err, rollback)
+	}
+	pending, e := s.DelegationCleanup(ctx)
+	if e != nil || len(pending) != 1 {
+		t.Fatal(pending, e)
+	}
+}
+
+func TestDelegatedCommitFailureRevokesOutsideLock(t *testing.T) {
+	s := NewStore(filepath.Join(t.TempDir(), "spool"))
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	rollback := 0
+	_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "cancel-context", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(string) (DelegationBinding, error) {
+		cancel()
+		return DelegationBinding{DelegationID: "grant"}, nil
+	}, func(b DelegationBinding) {
+		rollback++
+		if _, e := s.Get(context.Background(), b.JobID); e != nil {
+			t.Fatal("rollback ran under journal lock", e)
+		}
+	})
+	if !errors.Is(err, context.Canceled) || rollback != 1 {
+		t.Fatal(err, rollback)
+	}
+	pending, e := s.DelegationCleanup(context.Background())
+	if e != nil || len(pending) != 1 {
+		t.Fatal("grant cleanup binding lost", pending, e)
+	}
+}
+
+func TestFailedGrantCreationReleasesReservation(t *testing.T) {
+	s := NewStore(filepath.Join(t.TempDir(), "spool"))
+	ctx := context.Background()
+	failure := errors.New("DSM unavailable")
+	var id string
+	_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "failed", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(job string) (DelegationBinding, error) {
+		id = job
+		return DelegationBinding{DelegationID: ""}, failure
+	}, func(DelegationBinding) { t.Error("revoked nonexistent grant") })
+	if !errors.Is(err, failure) {
+		t.Fatal(err)
+	}
+	job, e := s.Get(ctx, id)
+	if e != nil || job.AdmissionPending || job.State != StateFailed {
+		t.Fatal(job, e)
+	}
+}
+
+func TestDelegatedReservationRecoveryFailsClosed(t *testing.T) {
+	s := NewStore(filepath.Join(t.TempDir(), "spool"))
+	ctx := context.Background()
+	revoked := false
+	_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "recover", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(id string) (DelegationBinding, error) {
+		if e := s.Recover(ctx); e != nil {
+			t.Fatal(e)
+		}
+		job, e := s.Get(ctx, id)
+		if e != nil || job.State != StateInterrupted || job.AdmissionPending {
+			t.Fatal(job, e)
+		}
+		return DelegationBinding{DelegationID: "grant"}, nil
+	}, func(DelegationBinding) { revoked = true })
+	if !errors.Is(err, ErrNotCancelable) || !revoked {
+		t.Fatal("recovered reservation committed", err, revoked)
+	}
+}
+
+func TestDelegatedReservationsCountAgainstRevocationBacklog(t *testing.T) {
+	s := NewStore(filepath.Join(t.TempDir(), "spool"))
+	ctx := context.Background()
+	if err := s.withJournal(ctx, func(root *os.Root, _ *journal) (bool, error) {
+		for i := 0; i < MaxHistory+MaxQueued-1; i++ {
+			id := fmt.Sprintf("%032x", i)
+			if err := writeAtomic(root, bindingName(id), DelegationBinding{JobID: id, DelegationID: "old-grant"}); err != nil {
+				return false, err
+			}
+		}
+		return false, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "first", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(string) (DelegationBinding, error) {
+		_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "second", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "bob", UID: "1206"}}, func(string) (DelegationBinding, error) {
+			t.Error("inflight reservation exceeded cleanup backlog bound")
+			return DelegationBinding{DelegationID: "extra-grant"}, nil
+		}, func(DelegationBinding) {})
+		if !errors.Is(err, ErrQuota) {
+			t.Errorf("pending reservation did not reserve cleanup capacity: %v", err)
+		}
+		return DelegationBinding{DelegationID: "grant"}, nil
+	}, func(DelegationBinding) {})
+	if err != nil {
+		t.Fatal(err)
+	}
+}