@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/sdk_background_authority_test.go

@@ -1,714 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"fmt"
-	"slices"
-	"syscall"
-	"testing"
-	"time"
-)
-
-type sdkMemoryJournal struct {
-	sdkJobTestJournal
-	records     []sdkJournalRecord
-	recordsCode Code
-}
-
-func (j *sdkMemoryJournal) Records() ([]sdkJournalRecord, Code) {
-	if j.recordsCode != "" {
-		return nil, j.recordsCode
-	}
-	out := []sdkJournalRecord{}
-	for _, r := range j.records {
-		raw, _ := encodeSDKJournal(r)
-		copy, c := decodeSDKJournal(raw)
-		if c != "" {
-			return nil, c
-		}
-		out = append(out, copy)
-	}
-	return out, ""
-}
-func (j *sdkMemoryJournal) Reserve(i sdkJobIntent) Code {
-	if c := j.sdkJobTestJournal.Reserve(i); c != "" {
-		return c
-	}
-	b, _ := json.Marshal(sdkJournalRecord{Schema: 1, Intent: i, State: "pending"})
-	r, c := decodeSDKJournal(b)
-	if c != "" {
-		return c
-	}
-	j.records = append(j.records, r)
-	return ""
-}
-
-type sdkBackgroundValidatorFake struct {
-	root   readOnlyRootWitness
-	now    func() time.Time
-	code   Code
-	after  func()
-	mutate func(*sdkBackgroundProof)
-}
-
-func (v *sdkBackgroundValidatorFake) ValidateBackground(_ context.Context, _ backgroundSnapshot, r sdkJobRequest, g Grant) (sdkBackgroundProof, Code) {
-	if v.after != nil {
-		v.after()
-	}
-	p := sdkBackgroundProof{Binding: r.Control.Binding, Continuity: g.LastValidated, Continuous: true, CheckedAt: v.now(), Root: v.root}
-	if v.mutate != nil {
-		v.mutate(&p)
-	}
-	return p, v.code
-}
-
-type sdkBackgroundFixture struct {
-	*sdkJobTestFixture
-	bg         *sdkBackgroundOwner
-	offline    *offlineFake
-	journal2   *sdkMemoryJournal
-	validator2 *sdkBackgroundValidatorFake
-	wall       time.Time
-	mono       time.Duration
-	clockKnown bool
-}
-
-func newSDKBackgroundFixture(t *testing.T) *sdkBackgroundFixture {
-	f := sdkJobFixture(t, jobcontract.Interactive, jobcontract.Background)
-	x := &sdkBackgroundFixture{sdkJobTestFixture: f, wall: f.c.now(), clockKnown: true}
-	now := func() time.Time { return x.wall }
-	f.c.now = now
-	f.s.authority.now = now
-	f.s.authority.native.now = now
-	x.offline = &offlineFake{proof: backgroundAppProof{Identity: f.native.account.Identity, AppID: "FixturePrivilege", Known: true, Allowed: true, OfflineEquivalent: true, CheckedAt: x.wall}}
-	observer := &backgroundObserver{accounts: f.native, groups: f.native, app: x.offline, appID: "FixturePrivilege", now: now}
-	x.journal2 = &sdkMemoryJournal{sdkJobTestJournal: sdkJobTestJournal{intents: map[string]sdkJobIntent{}, receipts: map[string]sdkJobReceipt{}}}
-	f.o.services.Journal = x.journal2
-	x.validator2 = &sdkBackgroundValidatorFake{root: f.validator.root, now: now}
-	var c Code
-	x.bg, c = newSDKBackgroundOwner(f.o, observer, x.validator2, x.journal2, func() (time.Time, time.Duration, bool) { return x.wall, x.mono, x.clockKnown })
-	if c != "" {
-		t.Fatal(c)
-	}
-	return x
-}
-func (f *sdkBackgroundFixture) prepare(t *testing.T, ttl time.Duration) Intent {
-	t.Helper()
-	i, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input, TTL: ttl})
-	if c != "" {
-		t.Fatal(c)
-	}
-	return i
-}
-func (f *sdkBackgroundFixture) confirm(t *testing.T, i Intent) jobcontract.BackgroundRecord {
-	t.Helper()
-	r, c := f.bg.confirm(context.Background(), f.carriers, i.ID, i.SummaryDigest, f.repo.store.Revision)
-	if c != "" {
-		t.Fatal(c)
-	}
-	return r
-}
-func (f *sdkBackgroundFixture) refresh() {
-	f.native.session.CheckedAt = f.wall
-	f.native.account.CheckedAt = f.wall
-	f.native.groups.CheckedAt = f.wall
-	f.native.app.CheckedAt = f.wall
-	f.offline.proof.CheckedAt = f.wall
-	f.c.gate.observe(f.c.gate.binding, 1, true, f.wall)
-}
-func TestSDKBackgroundConsentSingleUseAndNoSessionReuse(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	i := f.prepare(t, 0)
-	r := f.confirm(t, i)
-	if r.ExpiresAt-r.CreatedAt != 24*60*60*1000 || r.Binding.SessionRef != "" || r.Issuer != r.Binding.Actor || len(f.repo.store.Background) != 1 || len(f.journal2.records) != 1 {
-		t.Fatal(r)
-	}
-	if _, c := f.bg.confirm(context.Background(), f.carriers, i.ID, i.SummaryDigest, f.repo.store.Revision); c != ErrReplay {
-		t.Fatal(c)
-	}
-	f.native.sessionCode = ErrDenied
-	res, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID)
-	if c != "" || res.Record.State != "consumed" || res.Record.ExecutionKey == "" || len(f.c.operations) != 1 {
-		t.Fatal(c, res)
-	}
-	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c != ErrReplay {
-		t.Fatal("single use", c)
-	}
-	// S3 reservation is not registry->spawn. Neither process factory nor session
-	// refresh is invoked for background; S7 must implement offline child assembly.
-	if len(f.children) != 0 {
-		t.Fatal("production launch path added")
-	}
-	if c := f.c.launchReserved(res.operation); c != ErrUnavailable {
-		t.Fatal("background entered interactive launcher", c)
-	}
-}
-func TestSDKBackgroundIntentLimitsExactInputAndExpiry(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	for n := 0; n < MaxLiveIntents; n++ {
-		f.prepare(t, time.Hour)
-	}
-	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input}); c != ErrBusy {
-		t.Fatal("intent cap", c)
-	}
-	f = newSDKBackgroundFixture(t)
-	i := f.prepare(t, time.Hour)
-	if _, c := f.bg.confirm(context.Background(), f.carriers, i.ID, grantRef('b'), f.repo.store.Revision); c != ErrDenied {
-		t.Fatal(c)
-	}
-	f.wall = f.wall.Add(IntentTTL)
-	f.mono += IntentTTL
-	f.refresh()
-	if _, c := f.bg.confirm(context.Background(), f.carriers, i.ID, i.SummaryDigest, f.repo.store.Revision); c != ErrExpired {
-		t.Fatal("exact expiry", c)
-	}
-	f = newSDKBackgroundFixture(t)
-	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input, TTL: 8 * 24 * time.Hour}); c != ErrLimit {
-		t.Fatal(c)
-	}
-}
-func TestSDKBackgroundClockAndMissingProofLatch(t *testing.T) {
-	for _, kind := range []string{"wall-expiry", "monotonic-expiry", "rollback", "clock-unknown", "offline-missing", "input-change"} {
-		t.Run(kind, func(t *testing.T) {
-			f := newSDKBackgroundFixture(t)
-			r := f.confirm(t, f.prepare(t, time.Minute))
-			id := r.Binding.Binding.Delegation.ID
-			switch kind {
-			case "wall-expiry":
-				f.wall = f.wall.Add(time.Minute)
-			case "monotonic-expiry":
-				f.mono += time.Minute
-			case "rollback":
-				f.wall = f.wall.Add(-time.Second)
-			case "clock-unknown":
-				f.clockKnown = false
-			case "offline-missing":
-				f.bg.observer.app = nil
-			case "input-change":
-				f.journal2.records[0].Intent.Request.Input.Steps[0].Segments[0] = "other"
-			}
-			f.refresh()
-			if _, c := f.bg.consume(context.Background(), id); c == "" {
-				t.Fatal("invalid lease")
-			}
-			if len(f.children) != 0 || len(f.c.operations) != 0 {
-				t.Fatal("spawn/reservation without proof")
-			}
-			f.wall = time.UnixMilli(int64(r.CreatedAt))
-			f.mono = 0
-			f.clockKnown = true
-			f.refresh()
-			f.bg.observer.app = f.offline
-			if _, c := f.bg.consume(context.Background(), id); c == "" {
-				t.Fatal("denial resurrected")
-			}
-		})
-	}
-}
-
-func TestSDKBackgroundParentRevokeDrainsEveryDerivedJob(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r := f.confirm(t, f.prepare(t, time.Hour))
-	res, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID)
-	if c != "" {
-		t.Fatal(c)
-	}
-	child := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}, ok: true}
-	res.operation.process = child
-	f.bg.job(r.Binding.Binding.Delegation.ID).process = child
-	f.c.started++
-	result, c := f.s.authority.Revoke(context.Background(), f.carriers, f.g.ID, f.g.Revision, f.repo.store.Revision)
-	if c != "" || !result.Revoked || !result.Drained {
-		t.Fatal(result, c)
-	}
-	if f.repo.store.Background[0].State != "revoked" || len(f.c.operations) != 0 || f.c.reaped != 1 {
-		t.Fatal("parent fanout missing", f.repo.store.Background, len(f.c.operations), f.c.reaped)
-	}
-	j := f.bg.job(r.Binding.Binding.Delegation.ID)
-	if j.failure == "" || !j.receipt.Job.Drained || !j.terminal {
-		t.Fatal("job revived or missing durable Q", j.receipt)
-	}
-}
-func TestSDKBackgroundParentFailureDoesNotClaimRQ(t *testing.T) {
-	for _, kind := range []string{"R", "Q"} {
-		t.Run(kind, func(t *testing.T) {
-			f := newSDKBackgroundFixture(t)
-			r := f.confirm(t, f.prepare(t, time.Hour))
-			if kind == "R" {
-				f.repo.fail = ErrCommitUncertain
-			} else {
-				f.repo.qFailure = ErrUnavailable
-			}
-			result, c := f.s.authority.Revoke(context.Background(), f.carriers, f.g.ID, f.g.Revision, f.repo.store.Revision)
-			if c == "" || result.Drained || (kind == "R" && result.Revoked) {
-				t.Fatal("invented R/Q", result, c)
-			}
-			if j := f.bg.job(r.Binding.Binding.Delegation.ID); j.failure == "" || j.receipt.Job.Drained {
-				t.Fatal("no sticky output denial", j.receipt)
-			}
-		})
-	}
-}
-func TestSDKBackgroundRestartSuspendsConsumedAndPending(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	first := f.confirm(t, f.prepare(t, time.Hour))
-	f.confirm(t, f.prepare(t, time.Hour))
-	if _, c := f.bg.consume(context.Background(), first.Binding.Binding.Delegation.ID); c != "" {
-		t.Fatal(c)
-	}
-	if _, c := NewGrantAuthority(f.repo, nil, nil, nil); c != "" {
-		t.Fatal(c)
-	}
-	for _, r := range f.repo.store.Background {
-		if r.State != "suspended" {
-			t.Fatal("restart authority", r)
-		}
-	}
-	if f.repo.store.Background[0].ExecutionKey == "" {
-		t.Fatal("lost burned key")
-	}
-}
-
-func TestSDKBackgroundIdentityMismatchRevokesAllDelegations(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r := f.confirm(t, f.prepare(t, time.Hour))
-	f.confirm(t, f.prepare(t, time.Hour))
-	f.native.account.Identity.UID++
-	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c == "" {
-		t.Fatal("identity mismatch admitted")
-	}
-	if f.repo.store.Grants[0].State != GrantRevoked {
-		t.Fatal("parent identity was not revoked")
-	}
-	for _, r := range f.repo.store.Background {
-		if r.State != "revoked" {
-			t.Fatal("partial invalidation", r.State)
-		}
-	}
-}
-func TestSDKBackgroundSharedIssuerFanoutAndRetainedClosure(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	f.repo.store.Grants[0].Scope.Kind = ScopeShared
-	f.g.Scope.Kind = ScopeShared
-	first := f.confirm(t, f.prepare(t, time.Hour))
-	one, c := f.bg.consume(context.Background(), first.Binding.Binding.Delegation.ID)
-	if c != "" {
-		t.Fatal(c)
-	}
-	old := f.native.account.Identity
-	f.rememberOfflineActor()
-	bob := RelaxedIdentity{UID: 2002, Username: "bob"}
-	setRelaxedIdentity(f.native, bob)
-	f.offline.proof.Identity = bob
-	second := f.confirm(t, f.prepare(t, time.Hour))
-	two, c := f.bg.consume(context.Background(), second.Binding.Binding.Delegation.ID)
-	if c != "" {
-		t.Fatal(c)
-	}
-	for _, res := range []sdkBackgroundReservation{one, two} {
-		p := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}}
-		res.operation.process = p
-		f.bg.job(res.Record.Binding.Binding.Delegation.ID).process = p
-		f.c.started++
-	}
-	// The consenting shared issuer was alice; bob is only a beneficiary. An
-	// issuer mismatch must drain BOTH actors, not just jobs of the current caller.
-	if c := f.bg.invalidateIdentities(context.Background(), []RelaxedIdentity{old, {UID: old.UID, Username: "alice2"}}); c != "" {
-		t.Fatal(c)
-	}
-	if len(f.c.operations) != 0 || f.c.reaped != 2 {
-		t.Fatal("shared beneficiary survived", len(f.c.operations), f.c.reaped)
-	}
-	for _, r := range f.repo.store.Background {
-		if r.State != "revoked" {
-			t.Fatal("shared record survived")
-		}
-	}
-	// A retained, interrupted intent still contributes old identities even when
-	// no current job owns it. Closure must be order-independent.
-	g := cloneAuthorityGrant(f.g)
-	g.ID = grantRef('7')
-	g.Owner.UID = 3003
-	g.Owner.Username = "alice3"
-	g.Issuer = g.Owner
-	g.State = GrantActive
-	f.repo.store.Grants = append(f.repo.store.Grants, g)
-	seed := f.journal2.records[0]
-	seed.State = "interrupted"
-	seed.Intent.Actor = jobcontract.Principal{IdentityBasis: "uid-username", UID: old.UID, Username: "alice3"}
-	seed.Intent.Request.Control.Binding.Job.ID = grantRef('8')
-	f.journal2.records = append(f.journal2.records, seed)
-	f.s.authority.mu.Lock()
-	ids, c := f.s.authority.sdkIdentityClosureLocked([]RelaxedIdentity{old})
-	f.s.authority.mu.Unlock()
-	if c != "" || !slices.Contains(ids, RelaxedIdentity{UID: 3003, Username: "alice3"}) {
-		t.Fatal("retained identity missing", ids, c)
-	}
-}
-func TestSDKBackgroundIncompleteIndexFences(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	f.confirm(t, f.prepare(t, time.Hour))
-	f.journal2.recordsCode = ErrUnavailable
-	if c := f.bg.invalidateIdentities(context.Background(), []RelaxedIdentity{f.native.account.Identity}); c != ErrCleanupRequired || !f.s.authority.fenced {
-		t.Fatal(c, f.s.authority.fenced)
-	}
-}
-
-func TestSDKBackgroundLeaseRechecksExpiryAndOriginalInput(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r := f.confirm(t, f.prepare(t, time.Minute))
-	id := r.Binding.Binding.Delegation.ID
-	if _, c := f.bg.consume(context.Background(), id); c != "" {
-		t.Fatal(c)
-	}
-	f.native.sessionCode = ErrDenied
-	admitted := 0
-	if c := f.bg.admit(context.Background(), id, 0, func() Code { admitted++; return "" }); c != "" || admitted != 1 {
-		t.Fatal("offline lease required session", c)
-	}
-	f.wall = f.wall.Add(time.Minute)
-	f.mono += time.Minute
-	f.refresh()
-	if c := f.bg.admit(context.Background(), id, 0, func() Code { admitted++; return "" }); c == "" || admitted != 1 {
-		t.Fatal("expired output admitted", c)
-	}
-	if f.repo.store.Background[0].State != "expired" {
-		t.Fatal("expiry not latched")
-	}
-}
-func TestSDKBackgroundQueueSlotsAndFullAuthority(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r1 := f.confirm(t, f.prepare(t, time.Hour))
-	r2 := f.confirm(t, f.prepare(t, time.Hour))
-	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input}); c != ErrBusy {
-		t.Fatal("UID pending cap", c)
-	}
-	if _, c := f.bg.consume(context.Background(), r1.Binding.Binding.Delegation.ID); c != "" {
-		t.Fatal(c)
-	}
-	if _, c := f.bg.consume(context.Background(), r2.Binding.Binding.Delegation.ID); c != ErrBusy {
-		t.Fatal("background slot cap", c)
-	}
-	if f.repo.store.Background[1].State != "active" {
-		t.Fatal("busy consumed key")
-	}
-	f = newSDKBackgroundFixture(t)
-	for n := 1; n < MaxGrants; n++ {
-		g := cloneAuthorityGrant(f.g)
-		g.ID = fmt.Sprintf("%064x", n)
-		g.State = GrantRevoked
-		g.Reason = ErrRevoked
-		g.RevokedAt = g.CreatedAt
-		f.repo.store.Grants = append(f.repo.store.Grants, g)
-	}
-	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input}); c != ErrLimit {
-		t.Fatal("tombstone cap", c)
-	}
-	if len(f.repo.store.Grants) != MaxGrants {
-		t.Fatal("evicted tombstones")
-	}
-}
-func TestSDKBackgroundIntentFsyncCannotRefreshProof(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	i := f.prepare(t, time.Hour)
-	pending := f.s.authority.intents[i.ID]
-	pending.intent.ExpiresAt = f.wall.Add(time.Millisecond).UnixMilli()
-	f.s.authority.intents[i.ID] = pending
-	f.journal2.afterReserve = func() {
-		f.wall = f.wall.Add(10 * time.Millisecond)
-		f.mono += 10 * time.Millisecond
-	}
-	if _, c := f.bg.confirm(context.Background(), f.carriers, i.ID, i.SummaryDigest, f.repo.store.Revision); c != ErrExpired || !f.s.authority.fenced || len(f.repo.store.Background) != 0 {
-		t.Fatal(c, f.s.authority.fenced)
-	}
-	if len(f.journal2.records) != 1 {
-		t.Fatal("orphan execution key lost")
-	}
-}
-
-type sdkOfflineDirectory struct {
-	live     *relaxedFake
-	liveApp  *offlineFake
-	accounts map[string]RelaxedAccount
-	groups   map[RelaxedIdentity]RelaxedGroups
-	apps     map[RelaxedIdentity]backgroundAppProof
-}
-
-func (d *sdkOfflineDirectory) LookupRelaxedAccount(_ context.Context, name string) (RelaxedAccount, Code) {
-	if name == d.live.account.Identity.Username {
-		return d.live.account, d.live.accountCode
-	}
-	a, ok := d.accounts[name]
-	if !ok {
-		return RelaxedAccount{}, ErrDenied
-	}
-	return a, ""
-}
-func (d *sdkOfflineDirectory) LookupRelaxedGroups(_ context.Context, a RelaxedAccount) (RelaxedGroups, Code) {
-	if a.Identity == d.live.account.Identity {
-		return d.live.groups, d.live.groupCode
-	}
-	g, ok := d.groups[a.Identity]
-	if !ok {
-		return RelaxedGroups{}, ErrUnavailable
-	}
-	return g, ""
-}
-func (d *sdkOfflineDirectory) observeBackgroundApp(ctx context.Context, a RelaxedAccount, app string) (backgroundAppProof, Code) {
-	if a.Identity == d.live.account.Identity {
-		return d.liveApp.observeBackgroundApp(ctx, a, app)
-	}
-	p, ok := d.apps[a.Identity]
-	if !ok {
-		return backgroundAppProof{}, ErrUnavailable
-	}
-	return p, ""
-}
-func (f *sdkBackgroundFixture) rememberOfflineActor() *sdkOfflineDirectory {
-	d, ok := f.bg.observer.accounts.(*sdkOfflineDirectory)
-	if !ok {
-		d = &sdkOfflineDirectory{live: f.native, liveApp: f.offline, accounts: map[string]RelaxedAccount{}, groups: map[RelaxedIdentity]RelaxedGroups{}, apps: map[RelaxedIdentity]backgroundAppProof{}}
-		f.bg.observer.accounts = d
-		f.bg.observer.groups = d
-		f.bg.observer.app = d
-	}
-	d.accounts[f.native.account.Identity.Username] = f.native.account
-	d.groups[f.native.account.Identity] = f.native.groups
-	d.apps[f.native.account.Identity] = f.offline.proof
-	return d
-}
-func TestSDKBackgroundObservesSharedIssuerBeforeLease(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	f.repo.store.Grants[0].Scope.Kind = ScopeShared
-	f.g.Scope.Kind = ScopeShared
-	d := f.rememberOfflineActor()
-	old := f.native.account.Identity
-	bob := RelaxedIdentity{UID: 2002, Username: "bob"}
-	setRelaxedIdentity(f.native, bob)
-	f.offline.proof.Identity = bob
-	r := f.confirm(t, f.prepare(t, time.Hour))
-	issuer := d.accounts[old.Username]
-	issuer.Identity.UID++
-	d.accounts[old.Username] = issuer
-	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c == "" {
-		t.Fatal("shared issuer was never observed")
-	}
-	if f.repo.store.Grants[0].State != GrantRevoked || f.repo.store.Background[0].State != "revoked" {
-		t.Fatal("shared issuer mismatch not durable")
-	}
-}
-
-func TestSDKBackgroundSharesOnlyOneOwnerAndJournal(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	if _, c := newSDKJobOwner(f.s, f.registry, f.o.services); c != ErrBusy {
-		t.Fatal("second owner permitted", c)
-	}
-}
-func TestSDKBackgroundUnknownClockSuspends(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r := f.confirm(t, f.prepare(t, time.Hour))
-	f.clockKnown = false
-	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c == "" {
-		t.Fatal("unknown clock")
-	}
-	if f.repo.store.Background[0].State != "suspended" {
-		t.Fatal("unknown clock not suspended", f.repo.store.Background[0].State)
-	}
-}
-
-func TestSDKBackgroundBoundedQueueRotatesUIDs(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	f.repo.store.Grants[0].Scope.Kind = ScopeShared
-	f.g.Scope.Kind = ScopeShared
-	for n := 0; n < 8; n++ {
-		f.rememberOfflineActor()
-		if n > 0 {
-			id := RelaxedIdentity{UID: uint32(1001 + n), Username: fmt.Sprintf("user-%d", n)}
-			setRelaxedIdentity(f.native, id)
-			f.offline.proof.Identity = id
-		}
-		f.confirm(t, f.prepare(t, time.Hour))
-		f.confirm(t, f.prepare(t, time.Hour))
-	}
-	ids, c := f.bg.ready(context.Background())
-	if c != "" || len(ids) != jobcontract.MaxPending {
-		t.Fatal(len(ids), c)
-	}
-	seen := map[uint32]bool{}
-	for _, id := range ids[:8] {
-		uid := f.bg.job(id).background.snapshot.identity.UID
-		if seen[uid] {
-			t.Fatal("UID starvation")
-		}
-		seen[uid] = true
-	}
-	again, c := f.bg.ready(context.Background())
-	if c != "" || f.bg.job(ids[0]).actor.UID() == f.bg.job(again[0]).actor.UID() {
-		t.Fatal("queue never rotates", c)
-	}
-	f.rememberOfflineActor()
-	id := RelaxedIdentity{UID: 3003, Username: "overflow"}
-	setRelaxedIdentity(f.native, id)
-	f.offline.proof.Identity = id
-	if _, c := f.bg.prepare(context.Background(), f.carriers, sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input}); c != ErrBusy {
-		t.Fatal("package pending cap", c)
-	}
-	if len(f.children) != 0 || len(f.c.operations) != 0 {
-		t.Fatal("queue itself dispatched")
-	}
-}
-
-// Keep signal events on the lifecycle owner's call stack so tests can control
-// cancellation without racing fixture state or waiting for a wall-clock delay.
-type sdkBackgroundRevokeProcess struct {
-	sdkJobTestProcess
-	afterSignal func(syscall.Signal)
-}
-
-func (p *sdkBackgroundRevokeProcess) signal(s syscall.Signal) error {
-	if err := p.sdkJobTestProcess.signal(s); err != nil {
-		return err
-	}
-	if p.afterSignal != nil {
-		p.afterSignal(s)
-	}
-	return nil
-}
-
-func TestSDKBackgroundRevokePermissionAndFailedQ(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r := f.confirm(t, f.prepare(t, time.Hour))
-	id := r.Binding.Binding.Delegation.ID
-	res, c := f.bg.consume(context.Background(), id)
-	if c != "" {
-		t.Fatal(c)
-	}
-	p := &sdkBackgroundRevokeProcess{} // never reaped, including after TERM/KILL
-	res.operation.process = p
-	f.bg.job(id).process = p
-	f.c.started++
-	bob := RelaxedIdentity{UID: 2002, Username: "bob"}
-	setRelaxedIdentity(f.native, bob)
-	f.native.groups.Admin = false
-	if result, c := f.bg.revoke(context.Background(), f.carriers, id, res.Record.Binding.Binding.Delegation.Revision, f.repo.store.Revision); c != ErrDenied || result.Revoked {
-		t.Fatal("foreign nonadmin revoked", result, c)
-	}
-	if f.repo.store.Background[0].State != "consumed" || res.operation.canceled || len(p.signals) != 0 || f.journal2.cancels != 0 || f.s.authority.fenced {
-		t.Fatal("foreign nonadmin changed revocation state")
-	}
-	f.native.groups.Admin = true
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	p.afterSignal = func(s syscall.Signal) {
-		if s != syscall.SIGTERM {
-			t.Fatal("unexpected escalation before cancellation", s)
-		}
-		// Cancel only after R, denial and journal cancellation have completed
-		// and Q has started. Scheduling during authorization cannot consume
-		// the drain budget; the child still never supplies a reap proof.
-		if f.repo.inTransaction || f.repo.store.Background[0].State != "revoked" || !res.operation.canceled || f.journal2.cancels != 1 || !p.relayStopped() {
-			t.Fatal("Q signaled before durable R/denial")
-		}
-		cancel()
-	}
-	result, c := f.bg.revoke(ctx, f.carriers, id, res.Record.Binding.Binding.Delegation.Revision, f.repo.store.Revision)
-	if c != ErrCleanupRequired || !result.Revoked || result.Drained || len(f.c.operations) != 1 || !f.s.authority.fenced {
-		t.Fatal("fake Q", result, c)
-	}
-	if f.repo.store.Background[0].State != "revoked" || !res.operation.canceled || f.bg.job(id).receipt.Job.Drained {
-		t.Fatal("lost R/denial")
-	}
-	if !slices.Equal(p.signals, []syscall.Signal{syscall.SIGTERM}) || p.reaped || f.c.reaped != 0 || f.journal2.cancels != 1 {
-		t.Fatal("failed Q lacked the stop event or invented a reap proof", p.signals, p.reaped, f.c.reaped, f.journal2.cancels)
-	}
-}
-func TestSDKBackgroundDelayedJobDoesNotExtendExpiry(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	req := sdkBackgroundPrepare{Worker: f.r.Control.Binding.Worker, Parent: f.r.Control.Binding.ParentGrant, Input: f.r.Input, TTL: time.Minute, NotBefore: f.wall.Add(30 * time.Second)}
-	i, c := f.bg.prepare(context.Background(), f.carriers, req)
-	if c != "" {
-		t.Fatal(c)
-	}
-	r := f.confirm(t, i)
-	if ids, c := f.bg.ready(context.Background()); c != "" || len(ids) != 0 {
-		t.Fatal(ids, c)
-	}
-	if _, c := f.bg.consume(context.Background(), r.Binding.Binding.Delegation.ID); c != ErrBusy {
-		t.Fatal(c)
-	}
-	f.wall = f.wall.Add(time.Minute)
-	f.mono += time.Minute
-	f.refresh()
-	if ids, c := f.bg.ready(context.Background()); c != "" || len(ids) != 0 {
-		t.Fatal("deadline extended", ids, c)
-	}
-	if f.repo.store.Background[0].State != "expired" {
-		t.Fatal("expired pending retained active")
-	}
-}
-
-func TestSDKBackgroundDisconnectDoesNotCancelConsent(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r := f.confirm(t, f.prepare(t, time.Hour))
-	id := r.Binding.Binding.Delegation.ID
-	if _, c := f.bg.consume(context.Background(), id); c != "" {
-		t.Fatal(c)
-	}
-	j := f.bg.job(id)
-	if c := f.o.disconnect(context.Background(), j.request.Control.Binding); c != "" {
-		t.Fatal(c)
-	}
-	if j.failure != "" || j.terminal || f.journal2.cancels != 0 || len(f.c.operations) != 1 {
-		t.Fatal("closing browser canceled offline delegation")
-	}
-}
-func TestSDKBackgroundSuspendedParentPollCompletesQ(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r := f.confirm(t, f.prepare(t, time.Hour))
-	id := r.Binding.Binding.Delegation.ID
-	res, c := f.bg.consume(context.Background(), id)
-	if c != "" {
-		t.Fatal(c)
-	}
-	child := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}}
-	res.operation.process = child
-	f.bg.job(id).process = child
-	f.c.started++
-	proof := admissionFor(t, f.s.authority.native, f.carriers, f.g)
-	proof.Continuous = false
-	if c := f.s.authority.WithGrantAdmission(proof, func(Grant, NativeActor) Code { return "" }); c != ErrSuspended {
-		t.Fatal(c)
-	}
-	if c := f.o.poll(context.Background()); c != "" {
-		t.Fatal(c)
-	}
-	j := f.bg.job(id)
-	if !j.terminal || !j.receipt.Job.Drained || len(f.c.operations) != 0 {
-		t.Fatal("suspension never completed Q", j.receipt)
-	}
-}
-
-func TestSDKBackgroundObserverFenceDefersSignalsToLifecycleOwner(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	r := f.confirm(t, f.prepare(t, time.Hour))
-	id := r.Binding.Binding.Delegation.ID
-	res, c := f.bg.consume(context.Background(), id)
-	if c != "" {
-		t.Fatal(c)
-	}
-	child := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}}
-	res.operation.process = child
-	f.bg.job(id).process = child
-	f.c.started++
-	f.c.gate.fence("fixture")
-	if c := f.o.poll(context.Background()); c != ErrFenced {
-		t.Fatal(c)
-	}
-	if len(child.signals) != 0 {
-		t.Fatal("signaled before durable lifecycle fence", child.signals)
-	}
-}