@synopackageland/cli 0.8.0 → 0.9.0

package/templates/native-go/backend/internal/background/schedule.go

@@ -1,336 +0,0 @@
-package background
-
-import (
-	"context"
-	"errors"
-	"golang.org/x/sys/unix"
-	"io"
-	"os"
-	"time"
-)
-
-const MaxSchedules = 8
-const ManualQueueReserve = 4
-
-// A tick delayed past this window is missed, never a catch-up submission.
-const ScheduleWindow = 5 * time.Second
-
-var ErrScheduleFull = errors.New("background schedule limit reached")
-var ErrInputUnavailable = errors.New("the imported private copy is unavailable")
-
-type Schedule struct {
-	ID              string    `json:"id"`
-	Key             string    `json:"key"`
-	Owner           Submitter `json:"owner"`
-	SourceJobID     string    `json:"sourceJobId"`
-	Name            string    `json:"name"`
-	InputDigest     string    `json:"inputDigest"`
-	InputBytes      int       `json:"inputBytes"`
-	WorkerRevision  int       `json:"workerRevision"`
-	IntervalSeconds int       `json:"intervalSeconds"`
-	Enabled         bool      `json:"enabled"`
-	CreatedAt       time.Time `json:"createdAt"`
-	NextAt          time.Time `json:"nextAt"`
-	LastTriggeredAt time.Time `json:"lastTriggeredAt,omitzero"`
-	Missed          uint64    `json:"missed"`
-	LastMissedAt    time.Time `json:"lastMissedAt,omitzero"`
-	Reason          string    `json:"reason,omitempty"`
-}
-type ScheduleRequest struct {
-	Key             string `json:"key"`
-	JobID           string `json:"jobId"`
-	IntervalSeconds int    `json:"intervalSeconds"`
-	Consent         bool   `json:"consent"`
-}
-
-func validInterval(seconds int) bool { return seconds == 3600 || seconds == 86400 || seconds == 604800 }
-func (a Access) seesSchedule(sc Schedule) bool {
-	return a.Admin || (a.Owner.Valid() && sc.Owner == a.Owner)
-}
-func findSchedule(j *journal, id string) *Schedule {
-	if !jobID.MatchString(id) {
-		return nil
-	}
-	for i := range j.Schedules {
-		if j.Schedules[i].ID == id {
-			return &j.Schedules[i]
-		}
-	}
-	return nil
-}
-func (s *Store) Schedules(ctx context.Context, a Access) ([]Schedule, error) {
-	out := []Schedule{}
-	err := s.withJournal(ctx, func(_ *os.Root, j *journal) (bool, error) {
-		for _, sc := range j.Schedules {
-			if a.seesSchedule(sc) {
-				out = append(out, sc)
-			}
-		}
-		return false, nil
-	})
-	return out, err
-}
-func readCopy(root *os.Root, id, digest string, size int) ([]byte, error) {
-	if !jobID.MatchString(id) || size < 1 || size > MaxInputBytes {
-		return nil, ErrInputUnavailable
-	}
-	f, err := root.OpenFile(inputs+"/"+id, os.O_RDONLY|unix.O_NOFOLLOW, 0)
-	if err != nil {
-		return nil, ErrInputUnavailable
-	}
-	defer f.Close()
-	if checkPrivate(f) != nil {
-		return nil, ErrInputUnavailable
-	}
-	b, err := io.ReadAll(io.LimitReader(f, MaxInputBytes+1))
-	if err != nil || len(b) != size || sha256hex(b) != digest {
-		return nil, ErrInputUnavailable
-	}
-	return b, nil
-}
-func (s *Store) CreateSchedule(ctx context.Context, r ScheduleRequest, a Access) (Schedule, bool, error) {
-	var out Schedule
-	dup := false
-	if !a.Owner.Valid() || !r.Consent || !validInterval(r.IntervalSeconds) || !keyRE.MatchString(r.Key) {
-		return out, false, ErrInvalid
-	}
-	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
-		for _, sc := range j.Schedules {
-			if sc.Owner == a.Owner && sc.Key == r.Key {
-				if sc.SourceJobID != r.JobID || sc.IntervalSeconds != r.IntervalSeconds {
-					return false, ErrKeyConflict
-				}
-				out, dup = sc, true
-				return false, nil
-			}
-		}
-		job := find(j, r.JobID)
-		if job == nil || job.PurgeRequested || job.Submitter != a.Owner {
-			return false, ErrNotFound
-		}
-		// Scheduling only a completed import avoids racing a mutable/incomplete source.
-		if job.State != StateSucceeded || job.ScheduleID != "" || job.WorkerRevision != s.revision {
-			return false, ErrInputUnavailable
-		}
-		data, err := readCopy(root, job.ID, job.InputDigest, job.InputBytes)
-		if err != nil {
-			return false, err
-		}
-		if len(j.Schedules) >= MaxSchedules {
-			return false, ErrScheduleFull
-		}
-		_, ownerBytes := j.ownerUsage(a.Owner)
-		if ownerBytes+int64(len(data)) > MaxOwnerBytes {
-			return false, ErrOwnerQuota
-		}
-		_, used := j.pending()
-		if used+int64(len(data)) > s.limits.MaxTotalBytes {
-			return false, ErrQuota
-		}
-		id, err := newID()
-		if err != nil {
-			return false, err
-		}
-		if err := writeInput(root, id, data); err != nil {
-			return false, err
-		}
-		now := s.now().UTC()
-		out = Schedule{ID: id, Key: r.Key, Owner: a.Owner, SourceJobID: job.ID, Name: job.Name, InputDigest: job.InputDigest, InputBytes: job.InputBytes, WorkerRevision: s.revision, IntervalSeconds: r.IntervalSeconds, Enabled: true, CreatedAt: now, NextAt: now.Add(time.Duration(r.IntervalSeconds) * time.Second)}
-		j.Schedules = append(j.Schedules, out)
-		return true, nil
-	})
-	return out, dup, err
-}
-
-// SetSchedule(false) journals revocation before the cancel watcher can observe it.
-// Enable is administrator-only and requires fresh explicit consent at the route.
-func (s *Store) SetSchedule(ctx context.Context, id string, enabled bool, a Access) (Schedule, error) {
-	var out Schedule
-	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
-		sc := findSchedule(j, id)
-		if sc == nil || !a.seesSchedule(*sc) {
-			return false, ErrNotFound
-		}
-		if enabled {
-			if !a.Admin {
-				return false, ErrInvalid
-			}
-			if _, err := readCopy(root, sc.ID, sc.InputDigest, sc.InputBytes); err != nil {
-				return false, err
-			}
-			sc.WorkerRevision = s.revision
-			sc.Enabled = true
-			sc.Reason = ""
-			sc.NextAt = s.now().UTC().Add(time.Duration(sc.IntervalSeconds) * time.Second)
-		} else {
-			sc.Enabled = false
-			sc.Reason = "disabled"
-			s.cancelScheduleJobs(root, j, id)
-		}
-		out = *sc
-		return true, nil
-	})
-	return out, err
-}
-func (s *Store) cancelScheduleJobs(root *os.Root, j *journal, id string) {
-	for i := range j.Jobs {
-		job := &j.Jobs[i]
-		if job.ScheduleID != id {
-			continue
-		}
-		if job.State == StateQueued {
-			s.finishJob(root, job, StateCanceled, "schedule-disabled")
-		} else if job.State == StateRunning {
-			job.CancelRequested = true
-		}
-	}
-}
-func (s *Store) DeleteSchedule(ctx context.Context, id string, a Access) error {
-	return s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
-		sc := findSchedule(j, id)
-		if sc == nil || !a.seesSchedule(*sc) {
-			return false, ErrNotFound
-		}
-		s.cancelScheduleJobs(root, j, id)
-		kept := j.Schedules[:0]
-		for _, v := range j.Schedules {
-			if v.ID != id {
-				kept = append(kept, v)
-			}
-		}
-		j.Schedules = kept
-		return true, nil
-	})
-}
-
-type tickCopy struct {
-	schedule Schedule
-	err      error
-}
-
-func (s *Store) reconcileSchedules(root *os.Root, j *journal, recovering bool, copies map[string]tickCopy) bool {
-	changed := false
-	now := s.now().UTC()
-	for i := range j.Schedules {
-		sc := &j.Schedules[i]
-		if !validInterval(sc.IntervalSeconds) || sc.NextAt.IsZero() {
-			sc.Enabled = false
-			sc.Reason = "invalid-schedule"
-			s.cancelScheduleJobs(root, j, sc.ID)
-			changed = true
-			continue
-		}
-		if sc.WorkerRevision != s.revision {
-			sc.Enabled = false
-			sc.Reason = "worker-changed"
-			s.cancelScheduleJobs(root, j, sc.ID)
-			changed = true
-			continue
-		}
-		if !sc.Enabled || sc.NextAt.After(now) {
-			continue
-		}
-		due := sc.NextAt
-		period := time.Duration(sc.IntervalSeconds) * time.Second
-		count := uint64(now.Sub(due)/period) + 1
-		// Preparation happens without the journal lock. A concurrent disable,
-		// deletion, reapproval or tick invalidates that snapshot. Do not advance
-		// its checkpoint unless this admission still uses the exact schedule.
-		copy, prepared := copies[sc.ID]
-		if !recovering && count == 1 && now.Sub(due) <= ScheduleWindow && (!prepared || copy.schedule != *sc) {
-			continue
-		}
-		sc.NextAt = due.Add(time.Duration(count) * period)
-		changed = true
-		// Recovery deliberately skips even a just-due tick. There is no startup burst.
-		if recovering || count > 1 || now.Sub(due) > ScheduleWindow {
-			sc.Missed += count
-			sc.LastMissedAt = due
-			sc.Reason = "missed"
-			continue
-		}
-		if copy.err != nil {
-			sc.Enabled = false
-			sc.Reason = "input-unavailable"
-			sc.Missed++
-			sc.LastMissedAt = due
-			continue
-		}
-		pending, ownerBytes := j.ownerUsage(sc.Owner)
-		countPending, used := j.pending()
-		reason := ""
-		switch {
-		case pending >= MaxOwnerPending:
-			reason = "owner-queue-full"
-		case ownerBytes+int64(sc.InputBytes+resultReserve) > MaxOwnerBytes:
-			reason = "owner-quota-exceeded"
-		case countPending >= MaxQueued-ManualQueueReserve:
-			reason = "queue-full"
-		case used+int64(sc.InputBytes+resultReserve) > s.limits.MaxTotalBytes:
-			reason = "quota-exceeded"
-		}
-		if reason != "" {
-			sc.Missed++
-			sc.LastMissedAt = due
-			sc.Reason = reason
-			continue
-		}
-		id, err := newID()
-		if err != nil {
-			sc.Missed++
-			sc.LastMissedAt = due
-			sc.Reason = "unavailable"
-			continue
-		}
-		// Private inputs are immutable. Link the verified schedule copy instead
-		// of reading, hashing and copying its contents under the journal lock.
-		// The worker checks the digest again when it consumes the linked input.
-		if err := root.Link(inputs+"/"+sc.ID, inputs+"/"+id); err != nil {
-			sc.Missed++
-			sc.LastMissedAt = due
-			sc.Reason = "unavailable"
-			continue
-		}
-		if err := syncDir(root, inputs); err != nil {
-			_ = root.Remove(inputs + "/" + id)
-			sc.Missed++
-			sc.LastMissedAt = due
-			sc.Reason = "unavailable"
-			continue
-		}
-		sc.LastTriggeredAt = due
-		sc.Reason = ""
-		j.Jobs = append(j.Jobs, Job{ID: id, Key: "schedule-" + id, Name: sc.Name, State: StateQueued, Submitter: sc.Owner, Worker: WorkerSHA256V1, WorkerRevision: s.revision, InputDigest: sc.InputDigest, InputBytes: sc.InputBytes, SubmittedAt: now, ScheduleID: sc.ID, ScheduledAt: due})
-	}
-	j.trim()
-	return changed
-}
-
-// Tick advances each durable checkpoint and creates a job in the same commit.
-// Multiple processes therefore cannot admit the same schedule trigger twice.
-func (s *Store) Tick(ctx context.Context) error {
-	schedules, err := s.Schedules(ctx, Access{Admin: true})
-	if err != nil {
-		return err
-	}
-	root, err := s.openRoot()
-	if err != nil {
-		return err
-	}
-	defer root.Close()
-	copies := make(map[string]tickCopy)
-	now := s.now().UTC()
-	for _, sc := range schedules {
-		if !sc.Enabled || sc.WorkerRevision != s.revision || !validInterval(sc.IntervalSeconds) || sc.NextAt.IsZero() || sc.NextAt.After(now) || now.Sub(sc.NextAt) > ScheduleWindow {
-			continue
-		}
-		_, err := s.readScheduleCopy(ctx, root, sc.ID, sc.InputDigest, sc.InputBytes)
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-		copies[sc.ID] = tickCopy{schedule: sc, err: err}
-	}
-	return s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
-		return s.reconcileSchedules(root, j, false, copies), nil
-	})
-}

package/templates/native-go/backend/internal/background/schedule_test.go

@@ -1,368 +0,0 @@
-package background
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-)
-
-func scheduledStore(t *testing.T) (*Store, *time.Time, Job, Schedule) {
-	t.Helper()
-	s, _ := newStore(t)
-	now := time.Date(2026, 10, 5, 0, 0, 0, 0, time.UTC)
-	s.now = func() time.Time { return now }
-	source := submit(t, s, "source", []byte("copy"))
-	_, _ = s.Claim(context.Background())
-	if err := s.Finish(context.Background(), source.ID, Outcome{State: StateSucceeded, Result: &Result{SHA256: digest([]byte("copy")), Bytes: 4}}); err != nil {
-		t.Fatal(err)
-	}
-	sc, _, err := s.CreateSchedule(context.Background(), ScheduleRequest{Key: "schedule", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return s, &now, source, sc
-}
-func TestScheduleDurablePrivateCopyAndConsent(t *testing.T) {
-	s, now, source, sc := scheduledStore(t)
-	ctx := context.Background()
-	list, err := NewStore(s.dir).Schedules(ctx, Access{Owner: admin})
-	if err != nil || len(list) != 1 || list[0].InputDigest != source.InputDigest || !list[0].NextAt.Equal(now.Add(time.Hour)) {
-		t.Fatalf("durable %+v %v", list, err)
-	}
-	b, err := os.ReadFile(filepath.Join(s.dir, inputs, sc.ID))
-	if err != nil || string(b) != "copy" {
-		t.Fatalf("copy %q %v", b, err)
-	}
-	for _, r := range []ScheduleRequest{{Key: "x", JobID: source.ID, IntervalSeconds: 3600}, {Key: "x", JobID: source.ID, IntervalSeconds: 1, Consent: true}, {Key: "x", JobID: "../journal.json", IntervalSeconds: 3600, Consent: true}} {
-		if _, _, err := s.CreateSchedule(ctx, r, Access{Owner: admin, Admin: true}); err == nil {
-			t.Fatalf("admitted %+v", r)
-		}
-	}
-	again, dup, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "schedule", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true})
-	if err != nil || !dup || again.ID != sc.ID {
-		t.Fatalf("retry %+v %v %v", again, dup, err)
-	}
-}
-func TestScheduleConcurrentTwoTriggersNoReplayRestartMissed(t *testing.T) {
-	s, now, _, sc := scheduledStore(t)
-	ctx := context.Background()
-	for round := 1; round <= 2; round++ {
-		*now = now.Add(time.Hour)
-		var wg sync.WaitGroup
-		for i := 0; i < 8; i++ {
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				if err := s.Tick(ctx); err != nil {
-					t.Error(err)
-				}
-			}()
-		}
-		wg.Wait()
-		jobs, _ := s.List(ctx)
-		n := 0
-		for _, j := range jobs {
-			if j.ScheduleID == sc.ID {
-				n++
-			}
-		}
-		if n != round {
-			t.Fatalf("round %d got %d", round, n)
-		}
-		j, err := s.Claim(ctx)
-		if err != nil || j == nil {
-			t.Fatal(err)
-		}
-		if !j.ScheduledAt.Equal(*now) {
-			t.Fatal("trigger time")
-		}
-		if err := s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{SHA256: j.InputDigest, Bytes: 4}}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	before, _ := s.List(ctx)
-	*now = now.Add(3*time.Hour + time.Minute)
-	if err := s.Recover(ctx); err != nil {
-		t.Fatal(err)
-	}
-	_ = s.Tick(ctx)
-	after, _ := s.List(ctx)
-	if len(after) != len(before) {
-		t.Fatal("restart replayed")
-	}
-	list, _ := s.Schedules(ctx, Access{Admin: true})
-	if list[0].Missed != 3 || !list[0].NextAt.After(*now) {
-		t.Fatalf("missed %+v", list)
-	}
-	*now = now.Add(-4 * time.Hour)
-	_ = s.Tick(ctx)
-	after, _ = s.List(ctx)
-	if len(after) != len(before) {
-		t.Fatal("backward clock replay")
-	}
-}
-func TestScheduleIsolationDisableDeleteRevision(t *testing.T) {
-	s, now, source, sc := scheduledStore(t)
-	ctx := context.Background()
-	other := Access{Owner: Submitter{User: "normal2", UID: "1026"}}
-	if list, _ := s.Schedules(ctx, other); len(list) != 0 {
-		t.Fatal("leak")
-	}
-	if _, err := s.SetSchedule(ctx, sc.ID, false, other); !errors.Is(err, ErrNotFound) {
-		t.Fatal(err)
-	}
-	if err := s.DeleteSchedule(ctx, sc.ID, other); !errors.Is(err, ErrNotFound) {
-		t.Fatal(err)
-	}
-	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "steal", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, other); err == nil {
-		t.Fatal("cross-owner")
-	}
-	*now = now.Add(time.Hour)
-	_ = s.Tick(ctx)
-	job, _ := s.Claim(ctx)
-	if _, err := s.SetSchedule(ctx, sc.ID, false, Access{Owner: admin}); err != nil {
-		t.Fatal(err)
-	}
-	_ = s.Finish(ctx, job.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 4}})
-	got, _ := s.Get(ctx, job.ID)
-	if got.State != StateCanceled || got.Result != nil {
-		t.Fatal("disable lost")
-	}
-	*now = now.Add(time.Hour)
-	_ = s.Tick(ctx)
-	jobs, _ := s.List(ctx)
-	if len(jobs) != 2 {
-		t.Fatal("disabled trigger")
-	}
-	if _, err := s.SetSchedule(ctx, sc.ID, true, Access{Owner: admin}); !errors.Is(err, ErrInvalid) {
-		t.Fatal(err)
-	}
-	s.revision++
-	if err := s.Recover(ctx); err != nil {
-		t.Fatal(err)
-	}
-	list, _ := s.Schedules(ctx, Access{Admin: true})
-	if list[0].Enabled || list[0].Reason != "worker-changed" {
-		t.Fatal(list)
-	}
-	if _, err := s.SetSchedule(ctx, sc.ID, true, Access{Admin: true, Owner: admin}); err != nil {
-		t.Fatal(err)
-	}
-	list, _ = s.Schedules(ctx, Access{Admin: true})
-	if list[0].WorkerRevision != s.revision {
-		t.Fatal("revision")
-	}
-	if err := s.DeleteSchedule(ctx, sc.ID, Access{Owner: admin}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(filepath.Join(s.dir, inputs, sc.ID)); !errors.Is(err, os.ErrNotExist) {
-		t.Fatal("copy remains")
-	}
-}
-func TestScheduleBoundsQuotasAndModeRevocation(t *testing.T) {
-	s, now, source, _ := scheduledStore(t)
-	ctx := context.Background()
-	for i := 1; i < MaxSchedules; i++ {
-		if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: fmt.Sprint(i), JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "overflow", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true}); !errors.Is(err, ErrScheduleFull) {
-		t.Fatal(err)
-	}
-	*now = now.Add(time.Hour)
-	_ = s.Tick(ctx)
-	jobs, _ := s.List(ctx)
-	n := 0
-	for _, j := range jobs {
-		if !j.State.terminal() {
-			n++
-		}
-	}
-	if n != MaxOwnerPending {
-		t.Fatalf("pending %d", n)
-	}
-	list, _ := s.Schedules(ctx, Access{Admin: true})
-	missed := uint64(0)
-	for _, sc := range list {
-		missed += sc.Missed
-	}
-	if missed != 6 {
-		t.Fatalf("missed %d", missed)
-	}
-	for _, sc := range list {
-		if _, err := s.SetSchedule(ctx, sc.ID, false, Access{Admin: true}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	*now = now.Add(time.Hour)
-	_ = s.Tick(ctx)
-	list, _ = s.Schedules(ctx, Access{Admin: true})
-	for _, sc := range list {
-		if sc.Enabled {
-			t.Fatal("revived")
-		}
-	}
-}
-func TestScheduleLateLegacyTamperPurge(t *testing.T) {
-	s, now, source, sc := scheduledStore(t)
-	ctx := context.Background()
-	*now = now.Add(time.Hour + time.Minute)
-	_ = s.Tick(ctx)
-	jobs, _ := s.List(ctx)
-	if len(jobs) != 1 {
-		t.Fatal("catchup")
-	}
-	list, _ := s.Schedules(ctx, Access{Admin: true})
-	if list[0].Missed != 1 || list[0].Reason != "missed" {
-		t.Fatal(list)
-	}
-	_ = os.Remove(filepath.Join(s.dir, inputs, source.ID))
-	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "legacy", JobID: source.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true}); !errors.Is(err, ErrInputUnavailable) {
-		t.Fatal(err)
-	}
-	_ = os.WriteFile(filepath.Join(s.dir, inputs, sc.ID), []byte("evil"), 0600)
-	*now = list[0].NextAt
-	_ = s.Tick(ctx)
-	list, _ = s.Schedules(ctx, Access{Admin: true})
-	if list[0].Enabled || list[0].Reason != "input-unavailable" {
-		t.Fatal(list)
-	}
-	_, err := s.PurgeOwner(ctx, admin, "admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	list, _ = s.Schedules(ctx, Access{Admin: true})
-	if len(list) != 0 {
-		t.Fatal("purge schedule")
-	}
-}
-
-func TestScheduleReservesFourManualQueueSlots(t *testing.T) {
-	s, now, _, sc := scheduledStore(t)
-	ctx := context.Background()
-	for i := 0; i < 12; i++ {
-		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "manual", Data: []byte("x"), Submitter: Submitter{User: "other", UID: fmt.Sprint(2000 + i)}})
-		if err != nil {
-			t.Fatal(err)
-		}
-	}
-	*now = now.Add(time.Hour)
-	if err := s.Tick(ctx); err != nil {
-		t.Fatal(err)
-	}
-	list, _ := s.Schedules(ctx, Access{Admin: true})
-	if list[0].ID != sc.ID || list[0].Reason != "queue-full" || list[0].Missed != 1 {
-		t.Fatal(list)
-	}
-	for i := 12; i < 16; i++ {
-		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "manual", Data: []byte("x"), Submitter: Submitter{User: "other", UID: fmt.Sprint(2000 + i)}})
-		if err != nil {
-			t.Fatalf("reserved slot: %v", err)
-		}
-	}
-}
-func TestRetainedCopyQuotaHistoryAndOrdinarySchedule(t *testing.T) {
-	s, now, source, _ := scheduledStore(t)
-	ctx := context.Background()
-	if err := s.Recover(ctx); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(filepath.Join(s.dir, inputs, source.ID)); err != nil {
-		t.Fatal("recover deleted retained import")
-	}
-	_, bytes := func() (int, int64) {
-		var n int
-		var b int64
-		_ = s.withJournal(ctx, func(_ *os.Root, j *journal) (bool, error) { n, b = j.ownerUsage(admin); return false, nil })
-		return n, b
-	}()
-	if bytes != 8+resultReserve {
-		t.Fatalf("retained quota %d", bytes)
-	}
-	owner := Submitter{User: "normal1", UID: "1025"}
-	j, _, err := s.Submit(ctx, SubmitRequest{Key: "user", Name: "copy", Data: []byte("copy"), Submitter: owner})
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, _ = s.Claim(ctx)
-	_ = s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 4}})
-	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "user", JobID: j.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: owner}); err != nil {
-		t.Fatal(err)
-	}
-	for i := 0; i < MaxHistory+2; i++ {
-		j := submit(t, s, fmt.Sprint(i), []byte("x"))
-		_, _ = s.Claim(ctx)
-		_ = s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 1}})
-	}
-	if _, err := os.Stat(filepath.Join(s.dir, inputs, source.ID)); !errors.Is(err, os.ErrNotExist) {
-		t.Fatal("history leaked copy")
-	}
-	// Pin survives trimming of the imported source job.
-	list, _ := s.Schedules(ctx, Access{Admin: true})
-	*now = list[0].NextAt
-	_ = s.Tick(ctx)
-	jobs, _ := s.List(ctx)
-	found := false
-	for _, j := range jobs {
-		if j.ScheduleID == list[0].ID {
-			found = true
-		}
-	}
-	if !found {
-		t.Fatal("history removed pin")
-	}
-}
-
-func TestGlobalQuotaReservesResultBeforeRetainedCopyAdmission(t *testing.T) {
-	s, _ := newStore(t)
-	ctx := context.Background()
-	s.limits.MaxTotalBytes = resultReserve + 1
-	_, _, err := s.Submit(ctx, SubmitRequest{Key: "oversized-total", Name: "copy", Data: []byte("xx"), Submitter: admin})
-	if !errors.Is(err, ErrQuota) {
-		t.Fatalf("result reservation overflow admitted: %v", err)
-	}
-	j := submit(t, s, "exact", []byte("x"))
-	_, _ = s.Claim(ctx)
-	_ = s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 1}})
-	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "pin", JobID: j.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: admin, Admin: true}); !errors.Is(err, ErrQuota) {
-		t.Fatalf("retained copy quota %v", err)
-	}
-}
-
-func TestTickReadsCopyOutsideLockAndRechecksRevocation(t *testing.T) {
-	s, now, _, sc := scheduledStore(t)
-	*now = now.Add(time.Hour)
-	entered, resume := make(chan struct{}), make(chan struct{})
-	s.readScheduleCopy = func(ctx context.Context, root *os.Root, id, digest string, size int) ([]byte, error) {
-		close(entered)
-		<-resume
-		return readCopy(root, id, digest, size)
-	}
-	done := make(chan error, 1)
-	go func() { done <- s.Tick(context.Background()) }()
-	select {
-	case <-entered:
-	case <-time.After(time.Second):
-		t.Fatal("tick never prepared copy")
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 250*time.Millisecond)
-	defer cancel()
-	_, err := s.SetSchedule(ctx, sc.ID, false, Access{Owner: admin})
-	close(resume)
-	if tickErr := <-done; tickErr != nil {
-		t.Fatal(tickErr)
-	}
-	if err != nil {
-		t.Fatalf("copy read held journal lock: %v", err)
-	}
-	jobs, err := s.List(context.Background())
-	if err != nil || len(jobs) != 1 {
-		t.Fatalf("revoked snapshot admitted: %+v %v", jobs, err)
-	}
-}