@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/query_pending_diagnostic_test.go

@@ -1,254 +0,0 @@
-package helper
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-func TestQueryPendingDiagnosticSnapshotIsBoundedAndDetached(t *testing.T) {
-	g := newAdmission(testBinding())
-	now := time.Now().In(time.FixedZone("fixture", 8*60*60))
-	g.queryPending = &observerQueryPending{StartedAt: now, PendingAt: now.Add(500 * time.Millisecond), Outcome: "pending", Phase: "get-unit", ErrorClass: "deadline"}
-	for n := 0; n < observerEventLimit+20; n++ {
-		g.recordObserver(observerEvent{Kind: "query-phase"})
-	}
-	d := g.observerDiagnostic(strings.Repeat("e", 64))
-	if d.QueryPending == nil || !d.QueryPending.StartedAt.Equal(now) {
-		t.Fatalf("missing pinned period: %+v", d)
-	}
-	if d.QueryPending.StartedAt.Location() != time.UTC || d.QueryPending.PendingAt.Location() != time.UTC {
-		t.Fatal("diagnostic timestamps are not UTC")
-	}
-	d.QueryPending.Outcome = "mutated"
-	if g.observerDiagnostic(d.Epoch).QueryPending.Outcome != "pending" {
-		t.Fatal("snapshot aliases period")
-	}
-	payload, err := json.Marshal(d)
-	if err != nil || len(payload) > observerDiagnosticLimit {
-		t.Fatalf("size %d: %v", len(payload), err)
-	}
-	var decoded observerDiagnostic
-	if err := json.Unmarshal(payload, &decoded); err != nil || decoded.QueryPending == nil || !decoded.QueryPending.StartedAt.Equal(now) {
-		t.Fatalf("period roundtrip: %+v %v", decoded, err)
-	}
-}
-
-func TestQueryPendingDiagnosticPeriodLifecycle(t *testing.T) {
-	for _, outcome := range []string{"ready", "fence", "signal-fence", "reload-fence"} {
-		t.Run(outcome, func(t *testing.T) {
-			start := time.Now()
-			g := newAdmission(testBinding())
-			g.observeUnit(testBinding(), 7, "", false, true, 0, start)
-			e := observerEvent{Phase: "get-owner", ErrorClass: "deadline", QuerySerial: 0}
-			if !g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), e) {
-				t.Fatal("first timeout fenced")
-			}
-			first := g.observerDiagnostic("").QueryPending
-			if first == nil || !first.StartedAt.Equal(start) || !first.PendingAt.Equal(start.Add(500*time.Millisecond)) || first.Outcome != "pending" || first.Phase != "get-owner" || first.ElapsedNS != 0 {
-				t.Fatalf("wrong first query: %+v", first)
-			}
-			e.Phase = "get-all"
-			if !g.deferUnitDeadline(0, start.Add(750*time.Millisecond), start.Add(time.Second), e) {
-				t.Fatal("retry fenced")
-			}
-			for n := 0; n < observerEventLimit+20; n++ {
-				g.recordObserver(observerEvent{Kind: "query-phase"})
-			}
-			end := start.Add(1500 * time.Millisecond)
-			want := outcome
-			switch outcome {
-			case "ready":
-				g.observeUnit(testBinding(), 7, "", false, true, 0, end)
-			case "fence":
-				end = start.Add(unitQueryRecoveryBudget)
-				g.fenced(end)
-			case "signal-fence":
-				want = "fence"
-				g.fenceObserver("bus-owner-changed", observerEvent{At: end, Detail: "owner-signal"})
-			case "reload-fence":
-				want = "fence"
-				g.requestUnitCheck(true, start.Add(time.Second))
-				end = start.Add(unitQueryRecoveryBudget)
-				g.fenced(end)
-			}
-			d := g.observerDiagnostic("")
-			p := d.QueryPending
-			if p == nil || !p.StartedAt.Equal(start) || !p.PendingAt.Equal(start.Add(500*time.Millisecond)) || !p.EndedAt.Equal(end) || p.Outcome != want || p.ElapsedNS != int64(end.Sub(start)) || p.Phase != "get-owner" {
-				t.Fatalf("wrong ended period: %+v", p)
-			}
-			if want == "ready" {
-				if !g.allow(end) {
-					t.Fatal("recovered admission denied")
-				}
-				later := end.Add(100 * time.Millisecond)
-				g.deferUnitDeadline(0, later, later.Add(500*time.Millisecond), e)
-				if p = g.observerDiagnostic("").QueryPending; !p.StartedAt.Equal(later) || p.Outcome != "pending" || !p.EndedAt.IsZero() || p.ElapsedNS != 0 {
-					t.Fatalf("latest cycle not replaced: %+v", p)
-				}
-			} else {
-				g.observeUnit(testBinding(), 7, "", false, true, g.unitSerial, end)
-				if g.allow(end) || g.observerDiagnostic("").QueryPending.ElapsedNS != p.ElapsedNS {
-					t.Fatal("terminal period or fence changed")
-				}
-			}
-		})
-	}
-}
-
-func TestQueryPendingDiagnosticDiscardedProbeDoesNotStartOrEndPeriod(t *testing.T) {
-	start := time.Now()
-	g := newAdmission(testBinding())
-	if g.deferUnitDeadline(0, start, start, observerEvent{}) || g.observerDiagnostic("").QueryPending != nil {
-		t.Fatal("startup acquired pending")
-	}
-	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
-	g.requestUnitCheck(true, start)
-	if g.deferUnitDeadline(0, start, start, observerEvent{}) || g.observerDiagnostic("").QueryPending != nil {
-		t.Fatal("obsolete probe started pending")
-	}
-	g.requestUnitCheck(false, start)
-	g.deferUnitDeadline(g.unitSerial, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
-	g.observeUnit(testBinding(), 7, "", false, true, 0, start.Add(time.Second))
-	if p := g.observerDiagnostic("").QueryPending; p == nil || p.Outcome != "pending" {
-		t.Fatalf("obsolete success ended pending: %+v", p)
-	}
-}
-
-func TestQueryPendingDiagnosticPersistsWhileOwnerLives(t *testing.T) {
-	for _, fail := range []bool{false, true} {
-		t.Run(map[bool]string{false: "private-file", true: "write-failure"}[fail], func(t *testing.T) {
-			c := fixture(t)
-			path := filepath.Join(c.StateDir, "observer-diagnostic.json")
-			if fail {
-				if err := os.Mkdir(path, 0700); err != nil {
-					t.Fatal(err)
-				}
-			}
-			start := time.Now()
-			g := newAdmission(testBinding())
-			g.observeUnit(testBinding(), 7, "", false, true, 0, start)
-			stop := startObserverDiagnostics(c, strings.Repeat("e", 64), g)
-			defer stop()
-			g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-all", ErrorClass: "deadline"})
-			read := func(want string) observerDiagnostic {
-				t.Helper()
-				deadline := time.Now().Add(2 * time.Second)
-				for time.Now().Before(deadline) {
-					b, err := os.ReadFile(path)
-					var d observerDiagnostic
-					if err == nil && json.Unmarshal(b, &d) == nil && d.QueryPending != nil && d.QueryPending.Outcome == want {
-						return d
-					}
-					time.Sleep(time.Millisecond)
-				}
-				t.Fatalf("live %s diagnostic not persisted", want)
-				return observerDiagnostic{}
-			}
-			if !fail {
-				read("pending")
-			}
-			end := start.Add(750 * time.Millisecond)
-			g.observeUnit(testBinding(), 7, "", false, true, 0, end)
-			if !g.allow(end) {
-				t.Fatal("write failure changed recovery")
-			}
-			if !fail {
-				d := read("ready")
-				if d.Reason != "" || d.Epoch != strings.Repeat("e", 64) || d.QueryPending.ElapsedNS != int64(750*time.Millisecond) {
-					t.Fatalf("bad live recovery: %+v", d)
-				}
-				st, err := os.Stat(path)
-				if err != nil || st.Mode().Perm() != 0600 || st.Size() > observerDiagnosticLimit {
-					t.Fatalf("bad private bounded file: %v %v", st, err)
-				}
-				g.deferUnitDeadline(0, end, end.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
-				g.fenced(end.Add(unitQueryRecoveryBudget))
-				d = read("fence")
-				if d.QueryPending.ElapsedNS != int64(unitQueryRecoveryBudget) || d.Fence.Detail != "query-deadline" {
-					t.Fatalf("bad live fence: %+v", d)
-				}
-			}
-		})
-	}
-}
-
-func TestQueryPendingDiagnosticSlowWriterCannotDelayAdmission(t *testing.T) {
-	g := newAdmission(testBinding())
-	start := time.Now()
-	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
-	entered := make(chan struct{})
-	release := make(chan struct{})
-	var writes atomic.Int32
-	stop := startObserverDiagnosticWriter(g, func() {
-		if writes.Add(1) == 1 {
-			close(entered)
-			<-release
-		}
-	})
-	// Always release before shutdown, including a failing assertion.
-	defer stop()
-	defer close(release)
-	select {
-	case <-entered:
-	case <-time.After(time.Second):
-		t.Fatal("writer not started")
-	}
-	done := make(chan struct{})
-	go func() {
-		// Repeated periods while storage is stalled must coalesce in bounded memory.
-		for n := 0; n < observerEventLimit*2; n++ {
-			at := start.Add(time.Duration(n) * time.Millisecond)
-			g.deferUnitDeadline(0, at, at.Add(time.Microsecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
-			g.observeUnit(testBinding(), 7, "", false, true, 0, at.Add(2*time.Microsecond))
-		}
-		g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
-		g.fenced(start.Add(unitQueryRecoveryBudget))
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("storage blocked admission")
-	}
-	d := g.observerDiagnostic("")
-	if d.QueryPending == nil || d.QueryPending.Outcome != "fence" || d.QueryPending.ElapsedNS != int64(unitQueryRecoveryBudget) || len(d.Events) != observerEventLimit {
-		t.Fatalf("latest period lost: %+v", d)
-	}
-}
-
-func TestQueryPendingDiagnosticShutdownFlushesLatest(t *testing.T) {
-	g := newAdmission(testBinding())
-	start := time.Now()
-	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
-	entered, release := make(chan struct{}), make(chan struct{})
-	var latest atomic.Pointer[observerDiagnostic]
-	var writes atomic.Int32
-	stop := startObserverDiagnosticWriter(g, func() {
-		if writes.Add(1) == 1 {
-			close(entered)
-			<-release
-		}
-		d := g.observerDiagnostic(strings.Repeat("e", 64))
-		latest.Store(&d)
-	})
-	defer stop()
-	select {
-	case <-entered:
-	case <-time.After(time.Second):
-		close(release)
-		t.Fatal("writer not started")
-	}
-	g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
-	g.observeUnit(testBinding(), 7, "", false, true, 0, start.Add(750*time.Millisecond))
-	close(release)
-	stop()
-	d := latest.Load()
-	if d == nil || d.QueryPending == nil || d.QueryPending.Outcome != "ready" || d.QueryPending.ElapsedNS != int64(750*time.Millisecond) {
-		t.Fatalf("shutdown lost latest: %+v", d)
-	}
-}

package/dist/templates/native-go/backend/internal/helper/read_stream_cohort_linux_test.go

@@ -1,156 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"os"
-	"strconv"
-	"testing"
-	"time"
-)
-
-func readStreamVMCreate(t *testing.T, p LinuxProcesses) Grant {
-	t.Helper()
-	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionReadStream}})
-	if res.Code != "" || res.Intent == nil {
-		t.Fatal(res)
-	}
-	b, e := os.ReadFile(p.StateDir + "/grants.json")
-	if e != nil {
-		t.Fatal(e)
-	}
-	store, code := DecodeGrantStore(bytes.NewReader(b))
-	if code != "" {
-		t.Fatal(code)
-	}
-	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
-	if res.Code != "" || res.Grant == nil {
-		t.Fatal(res)
-	}
-	return *res.Grant
-}
-func readStreamVMWait(t *testing.T, fn func() bool) {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-	defer cancel()
-	if err := waitHealthy(ctx, func(context.Context) bool { return fn() }); err != nil {
-		t.Fatal(err)
-	}
-}
-func TestLinuxReadStreamRealChildProofBackpressureAndQ(t *testing.T) {
-	for _, kind := range []string{"complete", "acl", "groups", "disconnect", "epoch", "backpressure"} {
-		t.Run(kind, func(t *testing.T) {
-			p := readOnlyVMFixture(t)
-			proc := startVMHelper(t, p)
-			g := readStreamVMCreate(t, p)
-			defer func() {
-				if e := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); e != nil {
-					t.Error(e)
-				}
-			}()
-			expected := bytes.Repeat([]byte("s"), 2*MaxBoundedBytes)
-			if e := os.WriteFile("/tmp/m2-s5-operations/stream", expected, 0644); e != nil {
-				t.Fatal(e)
-			}
-			if kind == "backpressure" {
-				os.WriteFile(p.RunDir+"/fixture-readonly-block-output", nil, 0600)
-			}
-			if kind == "disconnect" {
-				os.WriteFile(p.RunDir+"/fixture-disconnect", nil, 0600)
-			}
-			r := readOnlyVMRequest(t, g, ActionReadStream, ReadArgs{Segments: []string{"stream"}, MaxBytes: MaxTransferBytes})
-			if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
-				t.Fatal(res)
-			}
-			metadata := grantVMMetadata(t, p, r)
-			if metadata.Code != "" || metadata.Bytes != uint64(len(expected)) {
-				t.Fatal(metadata)
-			}
-			chunk := r
-			chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"stream"}, MaxBytes: MaxChunkBytes})
-			lease := func() Code {
-				chunk.Nonce = readOnlyVMRef(t)
-				chunk.Ticket = readOnlyVMRef(t)
-				return grantVMCall(t, p, "operation.chunk", chunk).Code
-			}
-			if code := lease(); code != "" {
-				t.Fatal(code)
-			}
-			if kind == "backpressure" {
-				if code := lease(); code != ErrBusy {
-					t.Fatal("slow client accepted second outstanding lease", code)
-				}
-				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
-				store, _ := DecodeGrantStore(bytes.NewReader(raw))
-				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
-				if res.Code != "" || res.Revoke == nil || !res.Revoke.Drained {
-					t.Fatal(res)
-				}
-				raw, e := os.ReadFile(p.StateDir + "/grant-q-" + g.ID + ".json")
-				var q GrantQuiescence
-				if e != nil || json.Unmarshal(raw, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.AdmittedBytes != MaxChunkBytes {
-					t.Fatal(q, e)
-				}
-				if code := lease(); code == "" {
-					t.Fatal("lease after R/Q")
-				}
-				return
-			}
-			readStreamVMWait(t, func() bool {
-				b, _ := os.ReadFile(p.RunDir + "/fixture-progress")
-				n, _ := strconv.Atoi(string(b))
-				return n == MaxChunkBytes
-			})
-			switch kind {
-			case "acl":
-				os.WriteFile("/tmp/m2-s5-operations/deny-acl", nil, 0644)
-			case "groups":
-				os.WriteFile("/tmp/m2-s5-operations/group-change", nil, 0644)
-			case "epoch":
-				chunk.Epoch = grantRef('f')
-			}
-			if kind == "complete" {
-				for sent := MaxChunkBytes; sent < len(expected); {
-					code := lease()
-					if code == ErrBusy {
-						time.Sleep(time.Millisecond)
-						continue
-					}
-					if code != "" {
-						t.Fatal(sent, code)
-					}
-					sent += MaxChunkBytes
-				}
-			} else if kind != "disconnect" {
-				code := lease()
-				if kind != "acl" && code == "" {
-					t.Fatal("changed binding admitted", kind)
-				}
-			}
-			if kind == "epoch" {
-				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
-				store, _ := DecodeGrantStore(bytes.NewReader(raw))
-				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
-				if res.Code != "" || !res.Revoke.Drained {
-					t.Fatal(res)
-				}
-			}
-			readStreamVMWait(t, func() bool {
-				_, e := os.Stat(p.RunDir + "/fixture-readonly-bytes")
-				return e == nil && len(processChildren(proc.PID)) == 1
-			})
-			b, e := os.ReadFile(p.RunDir + "/fixture-readonly-bytes")
-			if e != nil {
-				t.Fatal(e)
-			}
-			want := MaxChunkBytes
-			if kind == "complete" {
-				want = len(expected)
-			}
-			if len(b) != want || !bytes.Equal(b, expected[:want]) {
-				t.Fatal(kind, "unproved or truncated bytes", len(b), want)
-			}
-		})
-	}
-}

package/dist/templates/native-go/backend/internal/helper/read_transfer.go

@@ -1,40 +0,0 @@
-package helper
-
-import (
-	"context"
-	"time"
-)
-
-// Stream is a staged fixed read action. It has no public socket/generator/CGI
-// enablement until DSM FD ACL and end-to-end CGI proof pass.
-const MaxStreamReplayEntries = MaxPackageOperations * (MaxTransferBytes/MaxChunkBytes + MaxReplayEntries)
-
-func readDataCeiling(a Action) uint64 {
-	if a == ActionReadStream {
-		return MaxTransferBytes
-	}
-	return MaxBoundedBytes
-}
-func (op *cohortOperation) expired(now time.Time) bool {
-	if op.admittedAt.IsZero() {
-		return false
-	}
-	stream := op.work != nil && op.work.Action == ActionReadStream || op.writeWork != nil && op.writeWork.Action == ActionWriteStream
-	if !stream {
-		return now.Sub(op.admittedAt) >= BoundedTimeout
-	}
-	last := op.lastActivity
-	if last.IsZero() {
-		last = op.admittedAt
-	}
-	return now.Before(op.admittedAt) || now.Before(last) || now.Sub(op.admittedAt) >= StreamTotalTimeout || now.Sub(last) >= StreamIdleTimeout
-}
-
-// Internal child stream interface. Only a fixed actor-opened FD implementation
-// is constructed by bootstrap. Caller transport supplies leases, never a source.
-// A successful chunk includes fresh child FD ACL/object checks. Root separately
-// binds subject/session/ticket/grant/revision/epoch under the S3 admission lock.
-type readStreamSource interface {
-	ReadChunk(context.Context, uint32) ([]byte, Code)
-	Close()
-}

package/dist/templates/native-go/backend/internal/helper/read_transfer_linux.go

@@ -1,109 +0,0 @@
-package helper
-
-import (
-	"context"
-	"golang.org/x/sys/unix"
-	"io"
-)
-
-// Child-only FD source. Bounded reads retain S5's eager validation/buffer;
-// streams retain the captured object and allocate at most one leased chunk.
-// No caller path, range, URL, executable, or root-opened readable FD is accepted.
-type actorReadTransfer struct {
-	ctx               context.Context
-	object            *readOnlyObject
-	work              readOnlyWork
-	acl               readOnlyACL
-	buffer            []byte
-	remaining, offset uint64
-}
-
-func openActorReadTransfer(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork, acl readOnlyACL) (*actorReadTransfer, readOnlyResult) {
-	fail := func(c Code) (*actorReadTransfer, readOnlyResult) { return nil, readOnlyResult{Code: c} }
-	if code := w.validate(); code != "" {
-		return fail(code)
-	}
-	if w.Action != ActionRead && w.Action != ActionReadStream {
-		return fail(ErrUnsupported)
-	}
-	if acl == nil {
-		return fail(ErrUnsupported)
-	}
-	o, code := resolveReadOnly(ctx, pin, w)
-	if code != "" {
-		return fail(code)
-	}
-	ok := false
-	defer func() {
-		if !ok {
-			o.Close()
-		}
-	}()
-	if code := authorizeReadOnly(ctx, o, w, acl); code != "" {
-		return fail(code)
-	}
-	if o.before.Mode&unix.S_IFMT != unix.S_IFREG {
-		return fail(ErrDenied)
-	}
-	if o.before.Size < 0 || uint64(o.before.Size) > w.MaxBytes {
-		return fail(ErrLimit)
-	}
-	src := &actorReadTransfer{ctx: ctx, object: o, work: w, acl: acl, remaining: uint64(o.before.Size)}
-	if w.Action == ActionRead {
-		b, err := io.ReadAll(io.LimitReader(o.data, int64(w.MaxBytes)+1))
-		if err != nil {
-			return fail(readOnlyError(err))
-		}
-		if uint64(len(b)) > w.MaxBytes {
-			return fail(ErrLimit)
-		}
-		if uint64(len(b)) != src.remaining {
-			return fail(ErrStale)
-		}
-		src.buffer = b
-	}
-	if code := src.check(); code != "" {
-		return fail(code)
-	}
-	ok = true
-	return src, readOnlyResult{Bytes: src.remaining}
-}
-func (s *actorReadTransfer) check() Code {
-	if code := authorizeReadOnly(s.ctx, s.object, s.work, s.acl); code != "" {
-		return code
-	}
-	return readOnlyUnchanged(int(s.object.data.Fd()), s.object.before)
-}
-func (s *actorReadTransfer) Next(n uint32) ([]byte, Code) {
-	if n == 0 || n > MaxChunkBytes || uint64(n) > s.remaining {
-		return nil, ErrLimit
-	}
-	if code := s.check(); code != "" {
-		return nil, code
-	}
-	var b []byte
-	if s.work.Action == ActionRead {
-		b = s.buffer[s.offset : s.offset+uint64(n)]
-	} else {
-		b = make([]byte, n)
-		if _, err := io.ReadFull(s.object.data, b); err != nil {
-			return nil, ErrStale
-		}
-	}
-	if code := s.check(); code != "" {
-		return nil, code
-	}
-	s.remaining -= uint64(n)
-	s.offset += uint64(n)
-	return b, ""
-}
-func (s *actorReadTransfer) Close() { s.object.Close(); s.buffer = nil }
-
-var _ readStreamSource = (*actorReadTransfer)(nil)
-
-func (s *actorReadTransfer) ReadChunk(ctx context.Context, n uint32) ([]byte, Code) {
-	original := s.ctx
-	s.ctx = ctx
-	defer func() { s.ctx = original }()
-	return s.Next(n)
-}

package/dist/templates/native-go/backend/internal/helper/read_transfer_linux_test.go

@@ -1,118 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"testing"
-)
-
-func TestActorReadStreamChunkACLAndChange(t *testing.T) {
-	for _, kind := range []string{"valid", "acl", "replacement", "hardlink", "mutation", "oversize", "cancel"} {
-		t.Run(kind, func(t *testing.T) {
-			pin, root := readOnlyFixture(t)
-			data := bytes.Repeat([]byte("z"), 2*MaxChunkBytes)
-			os.WriteFile(root+"/file", data, 0644)
-			acl := &changingTransferACL{}
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-			w := readWork(pin, "file")
-			w.Action = ActionReadStream
-			w.MaxBytes = MaxTransferBytes
-			src, result := openActorReadTransfer(ctx, pin, w, acl)
-			if result.Code != "" || src == nil || result.Bytes != uint64(len(data)) {
-				t.Fatal(result)
-			}
-			defer src.Close()
-			b, code := src.Next(MaxChunkBytes)
-			if code != "" || len(b) != MaxChunkBytes {
-				t.Fatal(code)
-			}
-			switch kind {
-			case "acl":
-				acl.deny = true
-			case "replacement":
-				os.Rename(root+"/file", root+"/old")
-				os.WriteFile(root+"/file", data, 0644)
-			case "hardlink":
-				os.Link(root+"/file", root+"/alias")
-			case "mutation":
-				os.WriteFile(root+"/file", data[:1], 0644)
-			case "cancel":
-				cancel()
-			}
-			n := uint32(MaxChunkBytes)
-			if kind == "oversize" {
-				n++
-			}
-			b, code = src.Next(n)
-			if kind == "valid" {
-				if code != "" || len(b) != MaxChunkBytes || acl.calls < 6 {
-					t.Fatal(code, acl.calls)
-				}
-			} else if code == "" || len(b) != 0 {
-				t.Fatal("unproved chunk escaped", code, len(b))
-			}
-		})
-	}
-}
-
-type changingTransferACL struct {
-	deny  bool
-	calls int
-}
-
-func (a *changingTransferACL) Authorize(context.Context, Action, int) Code {
-	a.calls++
-	if a.deny {
-		return ErrDenied
-	}
-	return ""
-}
-
-func TestActorReadStreamMaximumHasNoWholeFileBuffer(t *testing.T) {
-	pin, root := readOnlyFixture(t)
-	f, e := os.Create(root + "/maximum")
-	if e != nil {
-		t.Fatal(e)
-	}
-	if e = f.Truncate(MaxTransferBytes); e != nil {
-		t.Fatal(e)
-	}
-	f.Close()
-	w := readWork(pin, "maximum")
-	w.Action = ActionReadStream
-	w.MaxBytes = MaxTransferBytes
-	ctx, cancel := context.WithTimeout(context.Background(), StreamTotalTimeout)
-	defer cancel()
-	src, result := openActorReadTransfer(ctx, pin, w, fixtureReadOnlyACL{})
-	if result.Code != "" || src == nil || src.buffer != nil || result.Bytes != MaxTransferBytes {
-		t.Fatal(result)
-	}
-	defer src.Close()
-	for n := 0; n < MaxTransferBytes/MaxChunkBytes; n++ {
-		b, code := src.Next(MaxChunkBytes)
-		if code != "" || len(b) != MaxChunkBytes {
-			t.Fatal(n, code)
-		}
-	}
-	if _, code := src.Next(1); code != ErrLimit {
-		t.Fatal("read beyond transfer ceiling", code)
-	}
-}
-
-func TestReadStreamOutputWatchErrorSurvivesSuccessfulChunk(t *testing.T) {
-	p := newLinuxOperationRelay(nil, nil, nil, nil)
-	p.outputWatch = make(chan error, 1)
-	p.outputWatchDone = false
-	p.outputWatch <- io.ErrClosedPipe
-	p.pending = make(chan operationRelayOutcome, 1)
-	p.pending <- operationRelayOutcome{}
-	if _, err := p.idle(); err == nil {
-		t.Fatal("successful chunk erased disconnect")
-	}
-	if _, err := p.idle(); err == nil {
-		t.Fatal("disconnect observation lost")
-	}
-}