@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/sdk_job.go

@@ -1,697 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/hex"
-	"encoding/json"
-	"slices"
-	"time"
-)
-
-// This is an explicit in-process assembly seam, not an enabled dispatch entry.
-// Only the VM fixture calls it in S2. Keep cmd/helper/sdk_registry.go refusing.
-func newSDKJobOwner(s *supervisorGrants, compiled []byte, services sdkJobServices) (*sdkJobOwner, Code) {
-	if s == nil || s.cohort == nil || s.authority == nil || len(compiled) == 0 {
-		return nil, ErrUnavailable
-	}
-	r, why := DecodeSDKRegistry(compiled)
-	canonical, err := json.Marshal(r)
-	sum := sha256.Sum256(compiled)
-	i := s.cohort.inventory
-	if why != "" || err != nil || !bytes.Equal(canonical, compiled) || i.Protocol != DataProtocol || i.DataAccess != "relaxed" || i.RegistryDigest != hex.EncodeToString(sum[:]) || s.authority.policy.Inventory != i || s.authority.mu != &s.cohort.gate.mu {
-		return nil, ErrIncompatible
-	}
-	if services.Validator == nil || services.Journal == nil || services.Start == nil {
-		return nil, ErrUnavailable
-	}
-	if s.authority.sdkJobs != nil {
-		return nil, ErrBusy
-	}
-	o := &sdkJobOwner{grants: s, services: services, workers: map[string]jobcontract.Worker{}, jobs: map[string]*sdkJob{}, controls: map[string]bool{}}
-	origin := time.Now()
-	o.attachNow = func() time.Duration { return time.Since(origin) }
-	for _, w := range r.SDK {
-		o.workers[w.ID] = w
-	}
-	// One reservation table, one reaper, one observer/lifetime. Preserve the M2
-	// factory for its own operations; a job never runs as a nested M2 child.
-	s.authority.sdkJobs = o
-	previous := s.cohort.startChild
-	s.cohort.startChild = func(a NativeActor, b operationBinding) (operationProcess, error) {
-		j := o.jobs[b.OperationID]
-		if j == nil {
-			if previous == nil {
-				return nil, ErrUnavailable
-			}
-			return previous(a, b)
-		}
-		// Background credentials need a distinct S7 bootstrap. Never pass the
-		// old consent NativeActor through the interactive launcher.
-		if j.background != nil {
-			return nil, ErrUnavailable
-		}
-		if j.op == nil || j.op.binding != b || j.process != nil {
-			return nil, ErrDenied
-		}
-		p, err := services.Start(a, b, sdkJobPlan{j.request, j.worker, j.root})
-		j.process = p
-		return p, err
-	}
-	return o, ""
-}
-
-func sdkInventory(i Inventory) jobcontract.Inventory {
-	return jobcontract.Inventory{Package: i.Package, Version: i.Version, Protocol: i.Protocol, PayloadDigest: i.PayloadDigest, RegistryDigest: i.RegistryDigest, DataAccess: i.DataAccess}
-}
-func sdkCode(why jobcontract.SafeReason) Code {
-	code := Code(why)
-	if code == "" || code.Valid() {
-		return code
-	}
-	return ErrUnavailable
-}
-func cloneSDKRequest(r sdkJobRequest) (sdkJobRequest, Code) {
-	control, err := json.Marshal(r.Control)
-	if err != nil {
-		return sdkJobRequest{}, ErrInvalid
-	}
-	c, why := jobcontract.DecodeControl(bytes.NewReader(control))
-	if why != "" {
-		return sdkJobRequest{}, sdkCode(why)
-	}
-	input, err := json.Marshal(r.Input)
-	if err != nil {
-		return sdkJobRequest{}, ErrInvalid
-	}
-	in, why := jobcontract.DecodeInput(bytes.NewReader(input))
-	if why != "" {
-		return sdkJobRequest{}, sdkCode(why)
-	}
-	return sdkJobRequest{c, in}, ""
-}
-func (o *sdkJobOwner) request(r sdkJobRequest) (sdkJobRequest, jobcontract.Worker, Code) {
-	r, code := cloneSDKRequest(r)
-	if code != "" {
-		return r, jobcontract.Worker{}, code
-	}
-	b := r.Control.Binding
-	p := o.grants.authority.policy
-	if r.Control.Op != "jobs.submit" || b.Mode != jobcontract.Interactive || b.Delegation != nil {
-		return r, jobcontract.Worker{}, ErrUnsupported
-	}
-	if b.Inventory != sdkInventory(p.Inventory) || b.Epoch != p.Epoch || b.ApprovalBinding != p.ApprovalBinding || b.CapabilityDigest != p.CapabilityDigest {
-		return r, jobcontract.Worker{}, ErrIncompatible
-	}
-	w, ok := o.workers[b.Worker.ID]
-	if !ok || b.Worker.Revision != w.Revision || b.InputSchemaDigest != w.InputSchemaDigest {
-		return r, w, ErrIncompatible
-	}
-	if why := jobcontract.ValidatePlan(w, r.Input, jobcontract.Interactive); why != "" {
-		return r, w, sdkCode(why)
-	}
-	digest, why := jobcontract.InputDigest(r.Input, w.InputSchemaDigest)
-	if why != "" || digest != b.InputDigest {
-		return r, w, ErrInvalid
-	}
-	return r, w, ""
-}
-
-// Observations outside admission/storage locks, followed by the existing
-// authority transaction. Always compare against the original interactive actor.
-func (o *sdkJobOwner) validate(ctx context.Context, j *sdkJob, cp sdkJobCheckpoint) (NativeActor, sdkJobProof, Code) {
-	s := o.grants
-	var old *NativeActor
-	if j.actor.valid {
-		old = &j.actor
-	}
-	a, code := s.authority.actor(ctx, j.carriers, old)
-	if code != "" {
-		return NativeActor{}, sdkJobProof{}, code
-	}
-	if a.IdentityBasis() != "uid-username" || a.UID() == 0 || a.GID() == 0 || a.account.Groups == nil {
-		return NativeActor{}, sdkJobProof{}, ErrDenied
-	}
-	b := j.request.Control.Binding
-	step := cp.Step
-	if step >= uint64(len(j.request.Input.Steps)) {
-		step = uint64(len(j.request.Input.Steps) - 1)
-	}
-	action := Action(j.request.Input.Steps[step].Action)
-	g, code := s.authority.grantForActor(a, DataRequest{GrantID: b.ParentGrant.ID, GrantRevision: b.ParentGrant.Revision, Op: action})
-	if code != "" {
-		return NativeActor{}, sdkJobProof{}, code
-	}
-	proof, code := o.services.Validator.ValidateJob(ctx, a, j.request, g, cp)
-	if code = nativeObservationCode(ctx, code); code != "" {
-		return NativeActor{}, sdkJobProof{}, code
-	}
-	a, code = s.authority.actor(ctx, j.carriers, &a)
-	if code != "" {
-		return NativeActor{}, sdkJobProof{}, code
-	}
-	now := s.cohort.now()
-	if jobcontract.CompareBinding(proof.Binding, b) != "" || proof.Intent != j.request.Control.Intent || proof.Principal != a.Principal() || proof.SessionRef != a.SessionRef() || proof.Nonce != j.request.Control.Nonce || proof.Ticket != j.request.Control.Ticket || !nativeFresh(proof.CheckedAt, now) || !now.Before(proof.ExpiresAt) || proof.ExpiresAt.Sub(now) > IntentTTL || proof.Root == nil {
-		return NativeActor{}, sdkJobProof{}, ErrDenied
-	}
-	if j.root != nil && !j.root.sameReadOnlyRoot(proof.Root) {
-		return NativeActor{}, sdkJobProof{}, ErrSuspended
-	}
-	return a, proof, ""
-}
-func (o *sdkJobOwner) admission(j *sdkJob, a NativeActor, p sdkJobProof, step uint64, reserve func() Code) Code {
-	if step >= uint64(len(j.request.Input.Steps)) {
-		step = uint64(len(j.request.Input.Steps) - 1)
-	}
-	b := j.request.Control.Binding
-	return o.grants.authority.WithGrantAdmission(GrantAdmission{a, b.ParentGrant.ID, b.ParentGrant.Revision, Action(j.request.Input.Steps[step].Action), p.Continuity, p.Continuous}, func(g Grant, a NativeActor) Code {
-		// Intent fsync and authority lock acquisition may have consumed the
-		// remaining proof lifetime. The original observation cannot be refreshed
-		// by a newer actor lookup or by completing the durable write.
-		now := o.grants.cohort.now()
-		if !j.terminal && j.background == nil && o.attachExpired(j) {
-			return ErrExpired
-		}
-		if !now.Before(p.ExpiresAt) {
-			return ErrExpired
-		}
-		if !nativeFresh(p.CheckedAt, now) {
-			return ErrStale
-		}
-		for _, s := range j.request.Input.Steps {
-			if !slices.Contains(g.Actions, Action(s.Action)) {
-				return ErrDenied
-			}
-		}
-		if !o.grants.cohort.allowed() {
-			return ErrFenced
-		}
-		return reserve()
-	})
-}
-func (o *sdkJobOwner) capacity(a NativeActor) Code {
-	c := o.grants.cohort
-	count := 0
-	for _, op := range c.operations {
-		if op.actor.UID() == a.UID() {
-			count++
-		}
-	}
-	if len(c.operations) >= jobcontract.MaxChildren || count >= jobcontract.MaxUIDChildren {
-		return ErrBusy
-	}
-	return ""
-}
-
-func (o *sdkJobOwner) submit(ctx context.Context, peer operationPeer, carriers SessionCarriers, request sdkJobRequest) Code {
-	c := o.grants.cohort
-	if !c.peerAllowed(peer) {
-		return ErrDenied
-	}
-	r, w, code := o.request(request)
-	if code != "" {
-		return code
-	}
-	b := r.Control.Binding
-	if o.jobs[b.Job.ID] != nil || o.controls["n:"+r.Control.Nonce] || o.controls["t:"+r.Control.Ticket] || o.controls["i:"+r.Control.Intent.ID] {
-		return ErrReplay
-	}
-	if len(o.jobs) >= jobcontract.MaxExecutionKeys || len(o.controls) >= 3*jobcontract.MaxMutationControls {
-		return ErrBusy
-	}
-	total := uint64(len(r.Input.Steps))
-	j := &sdkJob{request: r, worker: w, carriers: carriers, counters: jobcontract.Result{ResultSchema: 1}, receipt: sdkJobReceipt{Job: jobcontract.Job{Binding: b, State: jobcontract.Pending, AcceptedAt: uint64(c.now().UnixMilli()), Progress: jobcontract.Progress{Phase: "starting", TotalUnits: &total}}}}
-	a, p, code := o.validate(ctx, j, sdkJobCheckpoint{Phase: "submit"})
-	if code != "" {
-		return code
-	}
-	// Busy submission does not silently become a persistent pending queue.
-	c.gate.mu.Lock()
-	code = o.capacity(a)
-	if !c.allowed() {
-		code = ErrFenced
-	}
-	c.gate.mu.Unlock()
-	if code != "" {
-		return code
-	}
-	j.actor, j.root = a, p.Root
-	if code := o.issueAttach(j); code != "" {
-		return code
-	}
-	o.jobs[b.Job.ID] = j
-	o.controls["n:"+r.Control.Nonce], o.controls["t:"+r.Control.Ticket] = true, true
-	o.controls["i:"+r.Control.Intent.ID] = true
-	intent := sdkJobIntent{r, jobcontract.Principal{IdentityBasis: "uid-username", UID: a.UID(), Username: a.Username()}, a.SessionRef()}
-	if code = o.services.Journal.Reserve(intent); code != "" {
-		c.gate.fence("sdk-job-journal-uncertain")
-		j.journalUncertain = true
-		o.uncertain(j)
-		return code
-	}
-	code = o.admission(j, a, p, 0, func() Code {
-		if o.attachExpired(j) {
-			return ErrExpired
-		}
-		if ctx.Err() != nil {
-			return nativeContextCode(ctx)
-		}
-		if code := o.capacity(a); code != "" {
-			return code
-		}
-		binding := operationBinding{c.inventory, c.epoch, b.Job.ID, r.Control.Nonce, b.ParentGrant.ID, b.ParentGrant.Revision}
-		op, code := c.reserveLocked(a, binding)
-		if code != "" {
-			return code
-		}
-		// Use the existing long-operation lifetime envelope (120s/10s idle).
-		// This marker never enters the M2 I/O factory: the router above sends only
-		// the immutable SDK plan to the fixed child. Per-worker limits narrow it.
-		op.work = &readOnlyWork{Action: ActionReadStream}
-		op.maxBytes = w.Limits.StreamBytes
-		j.op = op
-		j.lastCheckpoint = c.now()
-		return ""
-	})
-	if code != "" {
-		j.failure = code
-		o.finish(j)
-		return code
-	}
-	code = c.launchReserved(j.op)
-	if code != "" {
-		o.reject(j, code)
-		if j.process == nil {
-			o.finish(j)
-		}
-	}
-	return code
-}
-
-func (o *sdkJobOwner) reject(j *sdkJob, code Code) {
-	if j.terminal {
-		return
-	}
-	if j.failure == "" {
-		j.failure = code
-	}
-	if j.op != nil {
-		j.op.canceled = true
-		if j.op.process != nil {
-			j.op.process.stopRelay()
-		}
-	}
-	j.receipt.Result = nil
-}
-func (o *sdkJobOwner) uncertain(j *sdkJob) {
-	j.receipt.Job.State = jobcontract.CleanupRequired
-	j.receipt.Job.Reason = jobcontract.ReasonCleanupRequired
-	j.receipt.Job.Drained = false
-	j.receipt.Job.FinishedAt = nil
-	j.receipt.Result = nil
-	j.failure = ErrCleanupRequired
-	j.carriers = SessionCarriers{}
-}
-func (o *sdkJobOwner) checkpoint(ctx context.Context, j *sdkJob, cp sdkJobCheckpoint) Code {
-	if cp.Step != j.step {
-		return ErrInvalid
-	}
-	switch cp.Phase {
-	case "before-step":
-		if j.stepOpen || j.step >= uint64(len(j.request.Input.Steps)) || cp.Bytes != 0 {
-			return ErrInvalid
-		}
-	case "before-chunk":
-		if !j.stepOpen || j.step >= uint64(len(j.request.Input.Steps)) || cp.Bytes == 0 || uint64(cp.Bytes) > j.worker.Limits.ChunkBytes {
-			return ErrInvalid
-		}
-		s := j.request.Input.Steps[j.step]
-		if s.Action != jobcontract.Read && s.Action != jobcontract.ReadStream {
-			return ErrInvalid
-		}
-		if uint64(cp.Bytes) > *s.MaxBytes || j.stepAdmitted > *s.MaxBytes-uint64(cp.Bytes) || j.admitted > j.worker.Limits.StreamBytes-uint64(cp.Bytes) {
-			return ErrLimit
-		}
-	case "before-result":
-		if j.stepOpen || j.step != uint64(len(j.request.Input.Steps)) || j.resultAllowed || cp.Bytes != 0 {
-			return ErrInvalid
-		}
-	default:
-		return ErrInvalid
-	}
-	a, p, code := o.validate(ctx, j, cp)
-	if code != "" {
-		return code
-	}
-	code = o.admission(j, a, p, cp.Step, func() Code {
-		if j.op.canceled || j.failure != "" {
-			return ErrCanceled
-		}
-		j.actor = a
-		j.op.actor = a
-		switch cp.Phase {
-		case "before-step":
-			j.stepOpen = true
-			j.stepAdmitted = 0
-		case "before-chunk":
-			j.admitted += uint64(cp.Bytes)
-			j.stepAdmitted += uint64(cp.Bytes)
-			j.op.bytes = j.admitted
-		case "before-result":
-			j.resultAllowed = true
-		}
-		j.lastCheckpoint = o.grants.cohort.now()
-		j.op.lastActivity = j.lastCheckpoint
-		return ""
-	})
-	if code != "" {
-		return code
-	}
-	deadline := a.account.CheckedAt.Add(NativeProofFreshness)
-	if d := p.CheckedAt.Add(NativeProofFreshness); d.Before(deadline) {
-		deadline = d
-	}
-	if !o.grants.cohort.now().Before(deadline) {
-		return ErrStale
-	}
-	if j.process.reply(sdkJobReply{Deadline: deadline.UnixNano()}) != nil {
-		return ErrCleanupRequired
-	}
-	return ""
-}
-func (o *sdkJobOwner) event(ctx context.Context, j *sdkJob, e sdkJobEvent) Code {
-	if j.failure != "" || j.op == nil || j.op.canceled {
-		return ErrCanceled
-	}
-	if e.Kind != "ready" && j.receipt.Job.State != jobcontract.Running {
-		return ErrInvalid
-	}
-	if e.Kind != "checkpoint" && e.Checkpoint != (sdkJobCheckpoint{}) {
-		return ErrInvalid
-	}
-	if e.Kind != "progress" && e.Progress != nil {
-		return ErrInvalid
-	}
-	if e.Kind != "step-result" && e.Kind != "result" && e.Result != nil {
-		return ErrInvalid
-	}
-	switch e.Kind {
-	case "ready":
-		if j.receipt.Job.State != jobcontract.Pending {
-			return ErrInvalid
-		}
-		now := uint64(o.grants.cohort.now().UnixMilli())
-		j.receipt.Job.StartedAt = &now
-		j.receipt.Job.State = jobcontract.Running
-	case "checkpoint":
-		return o.checkpoint(ctx, j, e.Checkpoint)
-	case "step-result":
-		if !j.stepOpen || e.Result == nil || jobcontract.ValidateResult(*e.Result) != "" {
-			return ErrInvalid
-		}
-		r := *e.Result
-		if r.SafeReason != "" {
-			return sdkCode(r.SafeReason)
-		}
-		s := j.request.Input.Steps[j.step]
-		entries := uint64(0)
-		if s.Action == jobcontract.Stat {
-			entries = 1
-		}
-		if s.Action == jobcontract.List {
-			entries = *s.Limit
-		}
-		if r.CompletedSteps != 1 || r.Entries > entries || r.BytesRead != j.stepAdmitted {
-			return ErrInvalid
-		}
-		j.counters.CompletedSteps++
-		j.counters.Entries += r.Entries
-		j.counters.BytesRead += r.BytesRead
-		j.step++
-		j.stepOpen = false
-	case "progress":
-		if e.Progress == nil || jobcontract.ValidateProgress(*e.Progress, j.lastSeenProgress) != "" {
-			return ErrInvalid
-		}
-		p := *e.Progress
-		if p.CompletedUnits > uint64(len(j.request.Input.Steps)) || p.BytesRead > j.admitted || p.TotalUnits != nil && *p.TotalUnits != uint64(len(j.request.Input.Steps)) {
-			return ErrInvalid
-		}
-		raw, _ := json.Marshal(p)
-		if len(raw) > jobcontract.MaxProgressBytes {
-			return ErrLimit
-		}
-		if p.TotalUnits != nil {
-			n := *p.TotalUnits
-			p.TotalUnits = &n
-		}
-		j.lastSeenProgress = &p
-		if j.progressPackets < jobcontract.MaxProgressPackets {
-			j.progressPackets++
-			now := o.grants.cohort.now()
-			if j.lastProgress.IsZero() || now.Sub(j.lastProgress) >= time.Second {
-				j.receipt.Job.Progress = p
-				j.lastProgress = now
-				j.progress = append(j.progress, p)
-				if len(j.progress) > jobcontract.MaxProgressRing {
-					j.progress = j.progress[1:]
-				}
-			}
-		}
-	case "result":
-		if !j.resultAllowed || j.resultReceived || e.Result == nil || *e.Result != j.counters {
-			return ErrInvalid
-		}
-		j.resultReceived = true
-	default:
-		return ErrInvalid
-	}
-	if j.process.reply(sdkJobReply{}) != nil {
-		return ErrCleanupRequired
-	}
-	return ""
-}
-
-// Bounded owner-loop work. Progress cannot refresh idle deadlines. It does not
-// signal on an observer fence: the existing supervisor persists lifecycle denial
-// before it drains, preserving the M1 ordering and lifetime witness.
-func (o *sdkJobOwner) poll(ctx context.Context) Code {
-	if o.session != nil {
-		return o.session.poll()
-	}
-	if b := o.grants.authority.sdkBackground; b != nil {
-		if c := b.poll(ctx); c != "" {
-			return c
-		}
-	}
-	c := o.grants.cohort
-	if !c.gate.allow(c.now()) || !c.peerAllowed(operationPeer{c.helperPID, 0}) {
-		for _, j := range o.jobs {
-			if !j.terminal {
-				o.reject(j, ErrFenced)
-			}
-		}
-		return ErrFenced
-	}
-	for _, j := range o.jobs {
-		if j.background != nil || j.terminal || j.op == nil || j.process == nil {
-			continue
-		}
-		if o.attachExpired(j) {
-			if code := o.cancelOwned(ctx, j); code != "" {
-				return code
-			}
-			continue
-		}
-		now := c.now()
-		if now.Before(j.op.admittedAt) || now.Before(j.lastCheckpoint) || now.Sub(j.op.admittedAt) >= time.Duration(j.worker.Limits.TotalMS)*time.Millisecond || now.Sub(j.lastCheckpoint) >= time.Duration(j.worker.Limits.IdleMS)*time.Millisecond {
-			o.reject(j, ErrTimeout)
-		}
-		if j.failure == "" && !j.op.canceled {
-			if e, ok := j.process.next(); ok {
-				if code := o.event(ctx, j, e); code != "" {
-					if o.attachExpired(j) {
-						if cancelCode := o.cancelOwned(ctx, j); cancelCode != "" {
-							return cancelCode
-						}
-					} else {
-						o.reject(j, code)
-					}
-				}
-			}
-			if j.failure == "" && now.Sub(j.actor.account.CheckedAt) >= NativeProofFreshness {
-				a, p, code := o.validate(ctx, j, sdkJobCheckpoint{Phase: "observe", Step: j.step})
-				if code == "" {
-					code = o.admission(j, a, p, j.step, func() Code { j.actor = a; return "" })
-				}
-				if code != "" {
-					o.reject(j, code)
-				}
-			}
-		}
-	}
-	if err := c.poll(); err != nil {
-		c.gate.fence("sdk-job-drain-unknown")
-		for _, j := range o.jobs {
-			if !j.terminal && j.op != nil {
-				o.reject(j, ErrCleanupRequired)
-				o.uncertain(j)
-			}
-		}
-		return ErrCleanupRequired
-	}
-	for id, j := range o.jobs {
-		if j.background != nil || j.terminal || j.op == nil {
-			continue
-		}
-		if _, retired := c.receipts[id]; retired {
-			if j.failure == "" && j.op.canceled {
-				o.reject(j, ErrCanceled)
-			}
-			if j.failure == "" && (!j.resultReceived || !j.process.exitSuccess()) {
-				o.reject(j, ErrUnavailable)
-			}
-			if j.failure == "" {
-				a, p, code := o.validate(ctx, j, sdkJobCheckpoint{Phase: "finish", Step: j.step})
-				if code == "" {
-					code = o.admission(j, a, p, j.step, func() Code { return "" })
-				}
-				if code != "" {
-					o.reject(j, code)
-				}
-			}
-			o.finish(j)
-		}
-	}
-	return ""
-}
-
-// The sole owner serializes cancel and finish. Observer fencing shares this
-// mutex; bounded journal I/O runs without any GrantRepository transaction lock.
-func (o *sdkJobOwner) finish(j *sdkJob) {
-	if j.terminal {
-		return
-	}
-	if j.journalUncertain {
-		o.uncertain(j)
-		return
-	}
-	c := o.grants.cohort
-	c.gate.mu.Lock()
-	defer c.gate.mu.Unlock()
-	if j.process != nil {
-		if _, ok := c.receipts[j.request.Control.Binding.Job.ID]; !ok {
-			return
-		}
-	}
-	if j.failure == "" && !c.allowed() {
-		j.failure = ErrFenced
-	}
-	r := j.receipt
-	now := uint64(c.now().UnixMilli())
-	if now < r.Job.AcceptedAt || r.Job.StartedAt != nil && now < *r.Job.StartedAt {
-		c.gate.fenceLocked("sdk-job-clock-rollback")
-		o.uncertain(j)
-		j.terminal = true
-		return
-	}
-	r.Job.FinishedAt = &now
-	r.Job.Drained = true
-	switch {
-	case r.Job.CancelRequested:
-		r.Job.State = jobcontract.Canceled
-		r.Job.Reason = jobcontract.ReasonCanceled
-	case j.failure != "":
-		r.Job.State = jobcontract.Failed
-		r.Job.Reason = jobcontract.SafeReason(j.failure)
-	default:
-		r.Job.State = jobcontract.Succeeded
-		r.Job.Reason = ""
-		value := j.counters
-		r.Result = &value
-	}
-	if jobcontract.ValidateJob(r.Job) != "" || o.services.Journal.Finish(r) != "" {
-		c.gate.fenceLocked("sdk-job-journal-uncertain")
-		j.journalUncertain = true
-		o.uncertain(j)
-		j.terminal = true
-		return
-	}
-	j.receipt = r
-	j.terminal = true
-	j.carriers = SessionCarriers{}
-}
-func (o *sdkJobOwner) cancel(ctx context.Context, peer operationPeer, carriers SessionCarriers, b jobcontract.Binding) Code {
-	c := o.grants.cohort
-	if !c.peerAllowed(peer) {
-		return ErrDenied
-	}
-	j := o.jobs[b.Job.ID]
-	if j == nil || jobcontract.CompareBinding(b, j.request.Control.Binding) != "" {
-		return ErrDenied
-	}
-	a, code := o.grants.authority.actor(ctx, carriers, nil)
-	if code != "" {
-		return code
-	}
-	if a.Principal() != j.actor.Principal() {
-		return ErrDenied
-	}
-	return o.cancelOwned(ctx, j)
-}
-
-// S7's trusted transport EOF/Abort watcher calls this with the binding captured
-// at submit, never a new caller-supplied ID. No fresh login is needed to stop an
-// already-owned job; otherwise logout could prevent interactive cancellation.
-// The watcher must finish before S7 publishes its transport-level Q.
-func (o *sdkJobOwner) disconnect(ctx context.Context, b jobcontract.Binding) Code {
-	j := o.jobs[b.Job.ID]
-	if j == nil || jobcontract.CompareBinding(b, j.request.Control.Binding) != "" {
-		return ErrDenied
-	}
-	if j.background != nil {
-		return ""
-	} // explicit background consent survives transport EOF
-	return o.cancelOwned(ctx, j)
-}
-
-func (o *sdkJobOwner) cancelOwned(ctx context.Context, j *sdkJob) Code {
-	if j.background != nil {
-		return ErrUnsupported
-	} // use background.revoke with authority CAS
-	c := o.grants.cohort
-	b := j.request.Control.Binding
-	if j.terminal {
-		return ErrStale
-	}
-	c.gate.mu.Lock()
-	j.receipt.Job.CancelRequested = true
-	j.receipt.Job.State = jobcontract.CancelRequested
-	o.reject(j, ErrCanceled)
-	code := o.services.Journal.Cancel(b)
-	if code != "" {
-		c.gate.fenceLocked("sdk-job-journal-uncertain")
-		j.journalUncertain = true
-		o.uncertain(j)
-	}
-	c.gate.mu.Unlock()
-	// Denial is latched even if cancel durability failed. Do not claim accepted
-	// or drained; still try to stop the already-owned child outside all locks.
-	drainCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
-	defer cancel()
-	err := c.drainSelected(drainCtx, TerminateGrace, func(op *cohortOperation) bool { return op == j.op })
-	if code != "" || err != nil {
-		c.gate.fence("sdk-job-drain-unknown")
-		o.uncertain(j)
-		return ErrCleanupRequired
-	}
-	o.finish(j)
-	if !j.receipt.Job.Drained {
-		return ErrCleanupRequired
-	}
-	return ""
-}