@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/helper/read_transfer_test.go

@@ -1,177 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func TestReadStreamControlCeilings(t *testing.T) {
-	s, repo, _, _, g, _ := grantCohortFixture(t)
-	_ = s
-	repo.store.Grants[0].Actions = []Action{ActionReadStream}
-	r := grantControl(t, g, '1', '2', '3', MaxTransferBytes)
-	r.Op = ActionReadStream
-	b, _ := json.Marshal(r)
-	if _, c := DecodeDataRequest(bytes.NewReader(b)); c != "" {
-		t.Fatal(c)
-	}
-	r.Args = []byte(`{"segments":["fixture"],"maxBytes":67108865}`)
-	b, _ = json.Marshal(r)
-	if _, c := DecodeDataRequest(bytes.NewReader(b)); c != ErrLimit {
-		t.Fatal(c)
-	}
-	r.Op = ActionRead
-	b, _ = json.Marshal(r)
-	if _, c := DecodeDataRequest(bytes.NewReader(b)); c == "" {
-		t.Fatal("bounded mode accepted stream ceiling")
-	}
-}
-func TestReadStreamIdleAndTotalDeadline(t *testing.T) {
-	now := time.Now()
-	op := &cohortOperation{work: &readOnlyWork{Action: ActionReadStream}, admittedAt: now, lastActivity: now}
-	if op.expired(now.Add(StreamIdleTimeout - time.Nanosecond)) {
-		t.Fatal("early timeout")
-	}
-	if !op.expired(now.Add(StreamIdleTimeout)) {
-		t.Fatal("idle ignored")
-	}
-	op.lastActivity = now.Add(StreamTotalTimeout - time.Second)
-	if !op.expired(now.Add(StreamTotalTimeout)) {
-		t.Fatal("total ignored")
-	}
-}
-func TestReadStreamFreshGrantProofEveryChunk(t *testing.T) {
-	for _, kind := range []string{"valid", "acl", "groups", "epoch", "replay", "R", "busy"} {
-		t.Run(kind, func(t *testing.T) {
-			s, repo, c, carriers, g, _ := grantCohortFixture(t)
-			repo.store.Grants[0].Actions = []Action{ActionReadStream}
-			p := &metadataProcessStub{operationFixture: &operationFixture{}, result: &readOnlyResult{Bytes: 2 * MaxChunkBytes}, released: true}
-			c.startChild = func(NativeActor, operationBinding) (operationProcess, error) { return p, nil }
-			r := grantControl(t, g, '1', '2', '3', 2*MaxChunkBytes)
-			r.Op = ActionReadStream
-			if code := s.start(context.Background(), operationPeer{42, 0}, carriers, r); code != "" {
-				t.Fatal(code)
-			}
-			chunk := grantControl(t, g, '1', '4', '5', MaxChunkBytes)
-			chunk.Op = ActionReadStream
-			if code := s.chunk(context.Background(), operationPeer{42, 0}, carriers, chunk); code != "" {
-				t.Fatal(code)
-			}
-			p.pending = false
-			chunk.Nonce = grantRef('6')
-			chunk.Ticket = grantRef('7')
-			switch kind {
-			case "acl":
-				s.services.operations = grantOperationStub{code: ErrDenied}
-			case "groups":
-				c.operations[r.OperationID].actor.account.Groups = []uint32{999}
-			case "epoch":
-				chunk.Epoch = grantRef('f')
-			case "replay":
-				chunk.Nonce = grantRef('4')
-				chunk.Ticket = grantRef('5')
-			case "R":
-				repo.store.Grants[0].State = GrantRevoked
-				repo.store.Grants[0].Revision++
-				repo.store.Grants[0].RevokedAt = g.CreatedAt
-				repo.store.Grants[0].Reason = ErrRevoked
-			case "busy":
-				p.pending = true
-			}
-			code := s.chunk(context.Background(), operationPeer{42, 0}, carriers, chunk)
-			if kind == "valid" {
-				if code != "" || c.operations[r.OperationID].bytes != 2*MaxChunkBytes {
-					t.Fatal(code)
-				}
-			} else if code == "" || c.operations[r.OperationID].bytes != MaxChunkBytes {
-				t.Fatal("invalid lease admitted", code)
-			}
-		})
-	}
-}
-
-func TestStreamTicketWindowDoesNotTruncateAtBoundedReadWindow(t *testing.T) {
-	s, repo, _, carriers, g, _ := grantCohortFixture(t)
-	repo.store.Grants[0].Actions = []Action{ActionReadStream}
-	a, code := s.authority.actor(context.Background(), carriers, nil)
-	if code != "" {
-		t.Fatal(code)
-	}
-	for i := 0; i < MaxTransferBytes/MaxChunkBytes+1; i++ {
-		r := grantControl(t, g, '1', '2', '3', MaxChunkBytes)
-		r.Op = ActionReadStream
-		r.Nonce = fmt.Sprintf("%064x", i+1)
-		r.Ticket = fmt.Sprintf("%064x", i+10000)
-		proof, code := (grantOperationStub{}).ValidateOperation(context.Background(), a, r, g)
-		if code != "" {
-			t.Fatal(code)
-		}
-		if code = s.ticketLocked(r, proof.Ticket, a); code != "" {
-			t.Fatal(i, code)
-		}
-		s.burnTicket(r)
-		if code = s.ticketLocked(r, proof.Ticket, a); code != ErrReplay {
-			t.Fatal(i, code)
-		}
-	}
-}
-
-type relayFailureFixture struct{ *operationFixture }
-
-func (p relayFailureFixture) idle() (bool, error) { return true, io.ErrClosedPipe }
-func TestCohortPollCancelsDisconnectedOutput(t *testing.T) {
-	c, _, _, a, b, _ := cohortFixture(t)
-	f := &operationFixture{childFixture: childFixture{exitOn: syscall.SIGKILL}}
-	op := &cohortOperation{binding: b, actor: a, process: relayFailureFixture{f}, admittedAt: c.now()}
-	c.operations[b.OperationID] = op
-	c.started = 1
-	if err := c.poll(); err != nil {
-		t.Fatal(err)
-	}
-	if !op.canceled || !f.stopped {
-		t.Fatal("disconnected client retained live transfer")
-	}
-	if err := c.poll(); err != nil {
-		t.Fatal(err)
-	}
-	if len(c.operations) != 0 || c.reaped != 1 {
-		t.Fatal("disconnect did not reach observed quiescence")
-	}
-}
-
-func TestTransferSubjectFreshnessIncludesSessionObservation(t *testing.T) {
-	p, s, _, carriers, now := nativeFixture()
-	s.value.CheckedAt = now.Add(-NativeProofFreshness / 2)
-	a, code := p.Resolve(context.Background(), carriers)
-	if code != "" {
-		t.Fatal(code)
-	}
-	if !a.account.CheckedAt.Equal(s.value.CheckedAt) {
-		t.Fatal("transfer extended older session proof", a.account.CheckedAt, s.value.CheckedAt)
-	}
-}
-
-func TestReadStreamServerIssuedWindowCompletesMaximumTransfer(t *testing.T) {
-	tickets, actor, request, _ := deliveryFixture(t)
-	request.Op = ActionReadStream
-	for i := 0; i < MaxTransferBytes/MaxChunkBytes+1; i++ {
-		request.Nonce = fmt.Sprintf("%064x", i+10000)
-		issued, code := tickets.issue(context.Background(), actor, request)
-		if code != "" {
-			t.Fatal(i, code)
-		}
-		if _, code = tickets.consume(context.Background(), actor, issued); code != "" {
-			t.Fatal(i, code)
-		}
-	}
-	request.Op = ActionRead
-	if _, code := tickets.issue(context.Background(), actor, request); code != "" {
-		t.Fatal("stream consumed independent bounded window", code)
-	}
-}

package/dist/templates/native-go/backend/internal/helper/readonly.go

@@ -1,105 +0,0 @@
-package helper
-
-import (
-	"context"
-	"strings"
-)
-
-// Fixed internal work, assembled only by the trusted supervisor. Never accept
-// RootPath or descriptors from package/browser RPC. Grant admission stays S3-owned.
-type readOnlyWork struct {
-	RootPath string   `json:"rootPath"`
-	Action   Action   `json:"action"`
-	Segments []string `json:"segments"`
-	MaxBytes uint64   `json:"maxBytes"`
-	Limit    uint32   `json:"limit"`
-}
-
-type readOnlyResult struct {
-	Mutation *MutationReceipt `json:"mutation,omitempty"`
-	Code     Code             `json:"code"`
-	Entry    *Entry           `json:"entry,omitempty"`
-	List     *ListResult      `json:"list,omitempty"`
-	Bytes    uint64           `json:"bytes"`
-}
-
-// Mandatory child-side native share/home and action ACL adapter. Unknown native
-// semantics MUST refuse; syscall success cannot substitute for DSM share gates.
-// fd is an actor-opened object, never a caller path or root-opened readable FD.
-// No adapter is installed in shipped binaries until separate DSM proof passes.
-type readOnlyACL interface {
-	Authorize(context.Context, Action, int) Code
-}
-
-func (w readOnlyWork) validate() Code {
-	if !strings.HasPrefix(w.RootPath, "/") || w.RootPath == "/" {
-		return ErrInvalid
-	}
-	if code := ValidateRelativeSegments(strings.Split(w.RootPath[1:], "/"), false); code != "" {
-		return code
-	}
-	if !w.Action.ReadOnly() {
-		return ErrUnsupported
-	}
-	if code := ValidateRelativeSegments(w.Segments, w.Action != ActionRead && w.Action != ActionReadStream); code != "" {
-		return code
-	}
-	switch w.Action {
-	case ActionRead, ActionReadStream:
-		if w.MaxBytes == 0 || w.MaxBytes > readDataCeiling(w.Action) || w.Limit != 0 {
-			return ErrLimit
-		}
-	case ActionList:
-		if w.Limit == 0 || w.Limit > MaxPageEntries || w.MaxBytes != 0 {
-			return ErrLimit
-		}
-	case ActionStat:
-		if w.Limit != 0 || w.MaxBytes != 0 {
-			return ErrInvalid
-		}
-	}
-	return ""
-}
-
-// Private child metadata; bulk data only traverses the inherited leased pipe.
-type readOnlyPacket struct {
-	Binding       operationBinding `json:"binding"`
-	Token         string           `json:"token"`
-	Result        *readOnlyResult  `json:"result,omitempty"`
-	MountFD       *uint32          `json:"mountFd,omitempty"`
-	ChunkSequence uint64           `json:"chunkSequence,omitempty"`
-	MountSequence uint64           `json:"mountSequence,omitempty"`
-}
-type readOnlyMountReply struct {
-	Token    string `json:"token"`
-	Sequence uint64 `json:"sequence"`
-	Mount    uint64 `json:"mount"`
-	Code     Code   `json:"code"`
-}
-type readOnlyPacketOutcome struct {
-	result        *readOnlyResult
-	err           error
-	mountSequence uint64
-}
-
-func (r readOnlyResult) validFor(w readOnlyWork) bool {
-	if r.Mutation != nil {
-		return false
-	}
-	if r.Code != "" {
-		return r.Code.Valid() && r.Bytes == 0 && r.Entry == nil && r.List == nil
-	}
-	switch w.Action {
-	case ActionRead, ActionReadStream:
-		return r.Bytes <= w.MaxBytes && r.Entry == nil && r.List == nil
-	case ActionStat:
-		return r.Bytes == 0 && r.Entry != nil && r.List == nil
-	case ActionList:
-		return r.Bytes == 0 && r.Entry == nil && r.List != nil && len(r.List.Entries) <= int(w.Limit) && r.List.Cursor == ""
-	}
-	return false
-}
-
-type operationReadOnlyFinish struct {
-	Token string `json:"token"`
-}

package/dist/templates/native-go/backend/internal/helper/readonly_admission.go

@@ -1,85 +0,0 @@
-package helper
-
-import (
-	"encoding/json"
-	"slices"
-)
-
-// Private epoch-live capability, supplied by the fixed S3 operation validator.
-// It is not serialized into grant storage or caller controls. On Linux the only
-// concrete production witness accepted by the child factory is an O_PATH pin.
-type readOnlyRootWitness interface {
-	readOnlyRootPath() string
-	sameReadOnlyRoot(readOnlyRootWitness) bool
-}
-type readOnlyMetadataProcess interface {
-	readOnlyMetadata() (*readOnlyResult, bool, error)
-	releaseReadOnlyMetadata() error
-	readOnlyLeaseReady(uint32) Code
-}
-
-func readOnlyRequestWork(r DataRequest, root readOnlyRootWitness) (*readOnlyWork, Code) {
-	w := &readOnlyWork{Action: r.Op}
-	if root != nil {
-		w.RootPath = root.readOnlyRootPath()
-	}
-	switch r.Op {
-	case ActionRead, ActionReadStream:
-		var a ReadArgs
-		if code := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); code != "" {
-			return nil, code
-		}
-		w.Segments = slices.Clone(a.Segments)
-		w.MaxBytes = a.MaxBytes
-	case ActionStat:
-		var a StatArgs
-		if code := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); code != "" {
-			return nil, code
-		}
-		w.Segments = slices.Clone(a.Segments)
-	case ActionList:
-		var a ListArgs
-		if code := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); code != "" {
-			return nil, code
-		}
-		if a.Cursor != "" {
-			return nil, ErrUnsupported
-		}
-		w.Segments = slices.Clone(a.Segments)
-		w.Limit = a.Limit
-	default:
-		return nil, ErrUnsupported
-	}
-	// Unit-test S3 synthetic factories have no root. The actual Linux factory
-	// always refuses nil; production has no native/ACL adapter installed.
-	if root != nil {
-		if code := w.validate(); code != "" {
-			return nil, code
-		}
-	}
-	return w, ""
-}
-func sameReadOnlyRequest(op *cohortOperation, w *readOnlyWork, root readOnlyRootWitness, metadata bool) bool {
-	if op.work == nil || op.work.Action != w.Action || !slices.Equal(op.work.Segments, w.Segments) || op.work.Limit != w.Limit {
-		return false
-	}
-	if op.root == nil {
-		if root != nil {
-			return false
-		}
-	} else if root == nil || !op.root.sameReadOnlyRoot(root) {
-		return false
-	}
-	return !metadata || op.work.MaxBytes == w.MaxBytes
-}
-func cloneReadOnlyResult(r *readOnlyResult) *readOnlyResult {
-	b, err := json.Marshal(r)
-	if err != nil {
-		return nil
-	}
-	var result readOnlyResult
-	if json.Unmarshal(b, &result) != nil {
-		return nil
-	}
-	return &result
-}

package/dist/templates/native-go/backend/internal/helper/readonly_cohort_linux_test.go

@@ -1,253 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func readOnlyVMFixture(t *testing.T) LinuxProcesses {
-	t.Helper()
-	source := os.Getenv("M2_S5_FIXTURE")
-	if source == "" {
-		t.Skip("NIC-free root VM fixture")
-	}
-	digest, err := executableDigest(source)
-	if err != nil {
-		t.Fatal(err)
-	}
-	i := Inventory{Package: "root", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: digest, RegistryDigest: strings.Repeat("b", 64)}
-	c := NewClient(i)
-	for _, dir := range []string{c.StateDir, c.RunDir} {
-		if err := os.Mkdir(dir, 0700); err != nil {
-			t.Fatal(err)
-		}
-		t.Cleanup(func() { os.RemoveAll(dir) })
-	}
-	binary := c.StateDir + "/payload-" + digest
-	b, err := os.ReadFile(source)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(binary, b, 0700); err != nil {
-		t.Fatal(err)
-	}
-	root := "/tmp/m2-s5-operations"
-	if err := os.Mkdir(root, 0755); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { os.RemoveAll(root) })
-	os.WriteFile(root+"/group", bytes.Repeat([]byte("group-only;"), 20000), 0640)
-	os.Chown(root+"/group", 0, 105)
-	os.WriteFile(root+"/denied", []byte("denied-canary"), 0600)
-	vmUnit(t, "start")
-	return LinuxProcesses{Client: c, Binary: binary}
-}
-func readOnlyVMRef(t *testing.T) string {
-	t.Helper()
-	var b [32]byte
-	if _, e := rand.Read(b[:]); e != nil {
-		t.Fatal(e)
-	}
-	return hex.EncodeToString(b[:])
-}
-func readOnlyVMRequest(t *testing.T, g Grant, act Action, args any) DataRequest {
-	b, _ := json.Marshal(args)
-	return DataRequest{Inventory: g.Inventory, Epoch: g.LastValidated.Epoch, Op: act, GrantID: g.ID, GrantRevision: g.Revision, OperationID: readOnlyVMRef(t), Nonce: readOnlyVMRef(t), Ticket: readOnlyVMRef(t), Args: b}
-}
-func grantVMMetadata(t *testing.T, p LinuxProcesses, r DataRequest) *readOnlyResult {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-	defer cancel()
-	var value *readOnlyResult
-	if err := waitHealthy(ctx, func(context.Context) bool {
-		r.Nonce = readOnlyVMRef(t)
-		r.Ticket = readOnlyVMRef(t)
-		res := grantVMCall(t, p, "operation.result", r)
-		if res.Code == ErrBusy {
-			return false
-		}
-		if res.Code != "" || res.Files == nil {
-			t.Fatalf("metadata refused: %+v", res)
-		}
-		value = res.Files
-		return true
-	}); err != nil {
-		t.Fatal(err)
-	}
-	return value
-}
-func readOnlyVMCreate(t *testing.T, p LinuxProcesses) Grant {
-	t.Helper()
-	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead, ActionStat, ActionList}})
-	if res.Code != "" || res.Intent == nil {
-		t.Fatal(res)
-	}
-	b, e := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
-	if e != nil {
-		t.Fatal(e)
-	}
-	store, code := DecodeGrantStore(bytes.NewReader(b))
-	if code != "" {
-		t.Fatal(code)
-	}
-	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
-	if res.Code != "" || res.Grant == nil {
-		t.Fatal(res)
-	}
-	return *res.Grant
-}
-func TestLinuxReadOnlyProtocol2ChildrenRelayAndReap(t *testing.T) {
-	p := readOnlyVMFixture(t)
-	proc := startVMHelper(t, p)
-	g := readOnlyVMCreate(t, p)
-	for _, kind := range []string{"stat", "list", "read", "deny"} {
-		os.Remove(p.RunDir + "/fixture-readonly-bytes")
-		act := ActionRead
-		var args any = ReadArgs{Segments: []string{"group"}, MaxBytes: MaxBoundedBytes}
-		switch kind {
-		case "stat":
-			act = ActionStat
-			args = StatArgs{Segments: []string{"group"}}
-		case "list":
-			act = ActionList
-			args = ListArgs{Segments: []string{}, Limit: 20}
-		case "deny":
-			args = ReadArgs{Segments: []string{"denied"}, MaxBytes: MaxBoundedBytes}
-		}
-		r := readOnlyVMRequest(t, g, act, args)
-		if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
-			t.Fatal(res)
-		}
-		result := grantVMMetadata(t, p, r)
-		for sent := uint64(0); sent < result.Bytes; {
-			n := result.Bytes - sent
-			if n > MaxChunkBytes {
-				n = MaxChunkBytes
-			}
-			chunk := r
-			chunk.Nonce = readOnlyVMRef(t)
-			chunk.Ticket = readOnlyVMRef(t)
-			chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"group"}, MaxBytes: n})
-			res := grantVMCall(t, p, "operation.chunk", chunk)
-			if res.Code == ErrBusy {
-				time.Sleep(10 * time.Millisecond)
-				continue
-			}
-			if res.Code != "" {
-				t.Fatal(res)
-			}
-			sent += n
-		}
-		ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-		if waitHealthy(ctx, func(context.Context) bool {
-			_, err := os.Stat(p.RunDir + "/fixture-readonly-bytes")
-			return err == nil && len(processChildren(proc.PID)) == 1
-		}) != nil {
-			cancel()
-			t.Fatal(kind, "operation did not reap")
-		}
-		cancel()
-		data, err := os.ReadFile(p.RunDir + "/fixture-readonly-bytes")
-		if err != nil {
-			t.Fatal(err)
-		}
-		switch kind {
-		case "stat":
-			if result.Code != "" || result.Entry == nil || result.Entry.Bytes != 220000 || len(data) != 0 {
-				t.Fatal(result)
-			}
-		case "list":
-			if result.Code != "" || result.List == nil || len(result.List.Entries) != 1 || result.List.Entries[0].Name != "group" || len(data) != 0 {
-				t.Fatal(result)
-			}
-		case "read":
-			expected, _ := os.ReadFile("/tmp/m2-s5-operations/group")
-			if result.Code != "" || !bytes.Equal(data, expected) {
-				t.Fatal(result, len(data))
-			}
-		case "deny":
-			if result.Code != ErrDenied || len(data) != 0 || result.Entry != nil || result.List != nil {
-				t.Fatal("denied metadata escaped", result)
-			}
-		}
-	}
-	vmUnit(t, "stop")
-	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		r, e := readRecord(p.StateDir, 0)
-		return e == nil && r.Lifecycle.Phase == "stopped"
-	}) != nil {
-		t.Fatal("autonomous completion missing")
-	}
-	record, _ := readRecord(p.StateDir, 0)
-	proof, err := completionRecord(p.Client, record)
-	if err != nil || proof.Cohort == nil || proof.Cohort.Started != 4 || proof.Cohort.Reaped != 4 || !proof.Cohort.RelaysStopped {
-		t.Fatal(proof, err)
-	}
-}
-func TestLinuxReadOnlyBlockedRelayRevokeUsesExistingS3Quiescence(t *testing.T) {
-	p := readOnlyVMFixture(t)
-	proc := startVMHelper(t, p)
-	g := readOnlyVMCreate(t, p)
-	os.WriteFile(p.RunDir+"/fixture-readonly-block-output", nil, 0600)
-	r := readOnlyVMRequest(t, g, ActionRead, ReadArgs{Segments: []string{"group"}, MaxBytes: MaxBoundedBytes})
-	if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
-		t.Fatal(res)
-	}
-	result := grantVMMetadata(t, p, r)
-	if result.Code != "" || result.Bytes == 0 {
-		t.Fatal(result)
-	}
-	chunk := r
-	chunk.Nonce = readOnlyVMRef(t)
-	chunk.Ticket = readOnlyVMRef(t)
-	chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"group"}, MaxBytes: MaxChunkBytes})
-	if res := grantVMCall(t, p, "operation.chunk", chunk); res.Code != "" {
-		t.Fatal(res)
-	}
-	children := processChildren(proc.PID)
-	if len(children) != 2 {
-		t.Fatal("missing owned child", children)
-	}
-	b, _ := os.ReadFile(p.StateDir + "/grants.json")
-	store, code := DecodeGrantStore(bytes.NewReader(b))
-	if code != "" {
-		t.Fatal(code)
-	}
-	res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
-	if res.Code != "" || res.Revoke == nil || !res.Revoke.Revoked || !res.Revoke.Drained {
-		t.Fatal(res)
-	}
-	b, err := os.ReadFile(p.StateDir + "/grant-q-" + g.ID + ".json")
-	var q GrantQuiescence
-	if err != nil || json.Unmarshal(b, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.Started != 1 || q.Cohort.Reaped != 1 || q.Cohort.AdmittedBytes != MaxChunkBytes {
-		t.Fatal(q, err)
-	}
-	if len(processChildren(proc.PID)) != 1 {
-		t.Fatal("Q before reap")
-	}
-	if res := grantVMCall(t, p, "operation.result", r); res.Code == "" || res.Files != nil {
-		t.Fatal("metadata after R", res)
-	}
-	if res := grantVMCall(t, p, "operation.chunk", chunk); res.Code == "" {
-		t.Fatal("lease after R", res)
-	}
-	if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); err != nil {
-		t.Fatal(err)
-	}
-	for _, pid := range children {
-		if _, e := os.Stat(fmt.Sprintf("/proc/%d", pid)); !os.IsNotExist(e) {
-			t.Fatal("child survived teardown", pid)
-		}
-	}
-}