@synopackageland/cli 0.8.0 → 0.9.0

package/templates/native-go-delegate/DELEGATE.md

@@ -1,263 +0,0 @@
-# Delegated background file jobs
-
-This overlay implements PLAN §2.4 v1. It runs in the package account and connects
-only to the executor socket. The executor verifies the current DSM `id` cookie
-when creating/listing/revoking a user delegation; the CGI never sends a username.
-A worker stores only a delegation ID and job ID, never session credentials.
-
-## CLI assembly
-
-`init --with delegate` and `add delegate` apply base → jobs → delegate.
-The SDK registers `DelegateRoutes` using the trusted manifest scope and lists
-all 17 delegate methods in `sdk-permissions.json`: `delegate.disable` and
-`delegate.enable` require administrators, the others `authenticated`.
-App-owned permissions remain in `permissions.json`. `init --with delegate` sets
-`app.status` to authenticated so ordinary users can mount their panels;
-`add delegate` leaves `permissions.json` unchanged. The CLI binds both
-policy files to the CGI build. SDK policy edits and overrides fail validation.
-
-`background.Job.DelegationID` is an optional field in the shared base store.
-Delegate does not replace store.go, so CGI lock budgets, cancellation and schedule
-recovery always use the same implementation as jobs. CGI routes use
-`NewRequestStore`; workers retain `NewStore`. `add` still checks ownership of the
-shared store before activating delegate.
-
-```ts
-interface ExecutorSetup {
-  status(): Promise<CapabilityStatus>
-  authorize(password: string, selectedScope?: string): Promise<CapabilityStatus>
-  control(action: 'start' | 'stop' | 'purge'): Promise<CapabilityStatus>
-}
-```
-
-Passwords are sent only to DSM PasswordConfirm and are never persisted. Socket
-status must match the packaged executor and policy digests before readiness.
-
-Jobs are available to authenticated users immediately after executor approval;
-there are no enabled/ordinary-user admission switches. The jobs overlay supplies
-the shared NasPicker and session metadata provider without delegate UI copies.
-
-The overlay replaces `cmd/background-worker/main.go`, which refuses root and
-uses a fixed dispatcher for the existing SHA256 worker and the download worker.
-It retains the existing jobs spool, owner/UID checks, admission quotas,
-cancellation journal, schedule tick, recovery and heartbeat. There is no arbitrary
-worker name from HTTP input.
-
-## CGI routes
-
-| Method | Parameters | Result |
-| --- | --- | --- |
-| `delegate.status` | `{}` | capability `state`, optional `reason` |
-| `delegate.create` | `job_id`, `ops`, `path`, `ttl_seconds` | executor grant |
-| `delegate.list` | `{}` | executor's `{delegations: [...]}` |
-| `delegate.revoke` | `delegation_id` | `{revoked}` |
-| `delegate.jobs.submit` | `key`, `url`, `dest`, `name` | owner-bound job including `delegation_id` |
-| `delegate.jobs.list` | `{}` | `{jobs: [...]}` for the current username AND UID |
-| `delegate.jobs.cancel` | `id` | `{job, revocation_pending}` |
-
-`delegate.create` uses the manifest's scope and accepts only the five Files
-operation IDs, with a TTL of 1–3600 seconds. The download example creates a
-one-hour `files.write` grant. Administrators do not bypass job ownership here.
-The executor independently rejects ineligible subjects, including admin runners.
-List items use `delegation_id`, `job_id`, `path`, `expires_at`, optional `revoked`.
-
-## Typed files
-
-`filestation.Files` is a single typed interface with List, Info, CreateFolder,
-CheckPermission and Write. Both `filestation.RequestContext.Files()` (live
-File Station session) and `delegate.JobContext.Files()` (executor) implement it.
-The request adapter is added by this overlay in the existing filestation package;
-no second Page, Entry or ListOptions type is introduced.
-
-For metadata operations the executor receives `path`; createFolder additionally
-receives `name`. The fixed executor accepts no pagination/sort parameters, so
-job Files.List supports the default ListOptions only; nondefault options return
-`unsupported`. Adding wire pagination requires the controller to approve a §2.4
-contract extension.
-Every offline operation also receives `delegation_id` and `job_id`. Write uses
-exactly §2.4's `staging`, `dest_dir`, `name`. Paths in these payloads never grant
-permission; the executor checks current subject, operation and scope.
-
-```go
-func save(ctx context.Context, job delegate.JobContext, content io.Reader, size int64) error {
-    return job.Files().Write(ctx, "/home/Downloads", "download.txt", content, size)
-}
-```
-
-Write stages exactly `size` bytes under `/var/packages/<pkg>/var/executor-staging/`
-using an internally generated filename, mode 0600 inside a 0700 directory.
-The executor receives only that relative random name. Local staging is removed
-on success or any refusal/read/size/cancellation/transport failure. Download is
-limited to 64 MiB and 60 seconds, accepts HTTP/HTTPS without embedded credentials,
-and does not follow redirects or use ambient proxy settings. Both declared and
-streamed lengths are bounded. The worker downloads into a random staging file,
-then passes the content through Files.Write.
-
-The persisted `delegate-<job-id>.json` record is a revocation retry journal,
-separate from the job's `delegation_id`. It survives canceled input removal and
-history trimming. Completion, failure, cancellation, purge and restart
-recovery all feed cleanup; an unavailable executor leaves a record for the next
-worker sweep. Outstanding revocation records are bounded to 80; admission refuses
-new grants if cleanup reaches that limit. An unknown grant-creation response cannot reveal a delegation ID;
-the executor TTL bounds that grant. An uncertain write is never replayed.
-
-If the executor socket cannot be dialed, no request has been sent. The download
-worker retains its staged bytes and retries that request after 2, 4, 8, 16,
-then 30 seconds (30-second cap), for at most 15 minutes. This wait is separate
-from the 60-second download budget. `delegate.jobs.list` reports
-`waiting_executor`; the panel shows the startup waiting message in all nine
-supported locales and keeps cancellation and polling available. The shared
-journal retains the claimed running slot for quota/ownership/recovery rules;
-the delegation sidecar stores the waiting flag and grant expiry. List reads
-both under one short lock, and retry timers/socket calls never hold that lock.
-Cancellation and local revocation stop waiting through the existing 100 ms
-cancel watcher; grant expiry bounds the next wait. The executor still checks
-revocation, expiry and current eligibility before any operation. At the
-15-minute deadline the job fails with `EXECUTOR_UNAVAILABLE`, retaining pending
-revocation cleanup. Errors after a connection is established are terminal;
-partial writes, disconnects, timeouts and executor refusals are never replayed.
-A stopped worker keeps the existing interrupted/no-replay recovery behavior.
-
-Stable executor refusal codes are preserved, with sanitized messages. Local
-transport codes are `EXECUTOR_UNAVAILABLE`, `EXECUTOR_TIMEOUT`,
-`EXECUTOR_TOO_LARGE`, `EXECUTOR_PROTOCOL`, and `canceled`. Framing, including the
-newline, is bounded to 64 KiB in each direction, with one request per connection.
-
-## Local verification
-
-From the repository root:
-
-```sh
-packages/app-cli/templates/native-go-delegate/test.sh
-packages/app-cli/templates/native-go-delegate/test-frontend.sh
-```
-
-The Go fixture merges the base backend and delegate overlay,
-then runs all base/overlay tests with the race detector, host/Linux amd64/arm64
-vet, and formatting checks. CGI tests use the shipped SDK capability permissions and a
-fake Unix-socket executor. The frontend fixture merges the Vue base and this
-overlay and runs fake-provider UI tests plus Vue type checking and Vite build.
-The fixtures are temporary and are removed after each run.
-
-These tests do not claim DSM kernel ACL, owner, reboot, real task or real executor
-validation. CLI activation and real executor/setup integration belong to the other
-P2 workstreams.
-
-## Choose the scope at install and confirm it once
-
-New `init` / `add delegate` projects default to `scope: install-selected`.
-The DSM install wizard's native `api_store` combobox dynamically lists local
-shares using the installer's administrator session (`SYNO.Core.Share list v1`).
-A checkbox offers each user's `/home` instead; choosing a share never creates it
-or grants its ACL to the package account. This wizard was measured on vt-nas
-DSM 7.4 through a session-only SSH tunnel. Other DSM versions remain unverified.
-
-Installation saves `{schema:1, scope}` in package-owned
-`var/delegate-install.json`. It is **only a pre-selection**. The existing
-administrator enable form displays it alongside the DSM password field. One
-PasswordConfirm authorizes the pinned boot/control tasks and a one-time exact
-selection task. Only the root executor writes
-`/usr/local/etc/synopkgland/<pkg>/delegations/selected-scope.record`
-(`schema`, `scope`, `generation`, root 0600). The package peer cannot call the
-internal selection operation, even with an administrator cookie. Shipped
-executor/policy pins lock the selection mode and operations; the chosen scope
-is protected runtime state, so changing it does not rewrite shipped pins.
-
-Settings uses this same form and `ctx.executor.authorize(password, scope)` to
-change the scope. There is no extra dialog or step. A new scope generation
-revokes existing grants and cancels pending saves under the publication fence.
-Changing away and back never revives old grants. Existing destination files
-remain. Selecting another directory for the same destination key replaces only
-that person's previous grant for the key. Every person must select again after
-scope changes. If the package draft differs, the UI shows both and follows the
-protected value. Existing `scope: home` and `shared:<name>` manifests retain their
-fixed-scope API and legacy TTL behavior. Dynamic selection requires the
-`until-revoked` / `files.moveFromStaging` declaration.
-
-A scope change on a running executor whose pins verify runs only the selection
-task. It never restarts the executor, so a copy in flight ends `canceled` with
-reason `scope-changed`, not `interrupted`. `authorize` waits about 20 seconds
-for the protected readback. A `blocked` reply that carries `requested: {scope,
-generation}` means the root task may still land: read `ctx.executor.status()`
-(or `delegate.status`) until `selection.scope` equals `requested.scope` with a
-`selection.generation` above `requested.generation` (applied); otherwise it was
-not applied. Submitting the same scope again is safe: the task is pinned to the
-current generation and an already selected scope is answered unchanged.
-
-## One typed destination lookup, online and offline
-
-The generated Vue template contains the complete administrator setup, confirmed
-scope, scope-limited NasPicker, personal destinations and operations, and admin
-kill switch. Use its existing facade:
-
-```ts
-import {createBackgroundSaveFacade} from './delegate/facade'
-const sdk = createBackgroundSaveFacade(ctx)
-const current = await sdk.destination('save')
-// current.selection: {scope, root, generation} | null — protected executor evidence
-// current.destination: {id, key, path, username, lifetime} | null — this caller only
-// current.status: active | missing | reselection-required | needs-scope-confirmation | disabled
-if (current.status === 'active') {
-  const ref = await sdk.exportExample({key: 'save', job_id: stableJobID})
-  // The generated My saves panel queries this reference; admission is not Saved.
-}
-```
-
-The authenticated CGI is `delegate.destination` with `{key}`; it verifies the
-fresh DSM session and username+UID, configured key, protected scope/generation
-and current grant. Neither browser storage nor the installation draft supplies
-a destination. Errors or missing protected evidence disable new selections.
-
-Go uses `service.Destination(ctx, caller, request, "save") (DestinationState,error)`.
-Capture `current.Destination.ID` in the App's own job only when status is active.
-After logout, a producer uses that ID with `service.MoveFromStaging(ctx, params)`.
-It does not use the package draft, pass a virtual destination path, or retain
-session credentials. The executor rechecks scope generation, account, grant,
-directory identity and DSM ACL before writing as the user's nonzero UID.
-
-The shipped **Save example file** button calls `delegate.example.export` with
-`{key, job_id}`. `backend/internal/delegate/example.go` is a working producer:
-it obtains this user's active destination, creates a small package-private JSON
-file (0600) under staging, and invokes `MoveFromStaging`. Repeated job IDs repeat
-the original request: they return the original operation, admit only one the
-executor does not know, and never overwrite staging. Adapt this producer for
-daemon/export jobs and keep its stable ID. An uncertain result has no automatic
-retry; only a protected committed receipt means Saved.
-
-If admission failed or its reply was lost, call `MoveFromStaging` again later
-with the same params. It queries the original first and re-sends only an
-operation the executor does not know, with the pinned source unchanged (at most
-10 possibly-delivered sends, 2 s backoff doubling to 5 min; the worker sweep
-does the same). Retry on `EXECUTOR_UNAVAILABLE`, `EXECUTOR_TIMEOUT`,
-`EXECUTOR_PROTOCOL`, `canceled`, `EXECUTOR_PAUSED`, `queue-full`,
-`STORAGE_ERROR`, `ADMISSION_PENDING`, and on the package journal codes
-`jobs_busy` (lock busy), `jobs_unavailable` (transient I/O) and `canceled` (the
-caller's deadline or cancel ended the wait). None of these admitted anything a
-retry could duplicate; while the journal is unavailable, a ref the executor
-already knows still answers its state, so a committed move stays committed.
-Terminal: executor refusals such as `APP_DENIED`, `DELEGATION_DENIED`,
-`operation-conflict`, `disabled`, plus `STAGING_CHANGED`, `ADMISSION_EXHAUSTED`,
-`spool_unsafe` and `journal_corrupt` (the package spool needs repair), and
-`operation-not-found` for an accepted operation. See the delegate guide's Admission recovery table.
-
-Cancel with the original reference (`CancelOperation`, or
-`delegate.operations.cancel` from the UI); it is idempotent, so repeat it with
-the same reference after a retryable error or a lost reply. `queued` becomes
-`canceled` at once. A copy in flight answers `copying` with code
-`CANCEL_REQUESTED`: accepted and durable, not finished. Poll `OperationStatus`
-on the same reference until `canceled` (writer stopped, part removed, nothing
-published, staging kept), `committed` (publication won; the file stays, drop only
-the app record) or `uncertain` (a publish attempt failed first; keep querying).
-The request survives executor crash, package stop/start and logout.
-Revoke, scope change and disable store their reason (`grant-revoked`,
-`scope-changed`, `integration-disabled`) the same way: a copy in flight answers
-`CANCEL_REQUESTED` with it and settles `canceled` with it across a restart. A
-copy the executor stops without a cancel ends `interrupted`/`EXECUTOR_PAUSED`
-(`interrupted`/`interrupted` after a crash), never `WRITE_FAILED`. A cancel of
-a reference not yet admitted leaves a `canceled` tombstone that a late or
-recovered admission returns instead of copying, and a producer cancel is written
-to the mirror first, so `MoveFromStaging` and the worker sweep forward it rather
-than admit. See the delegate guide's Cancellation table.
-
-
-The pinned scope-selection task also binds the protected generation observed before confirmation. The executor compares it under the publish lock and refuses stale tasks, so a retained task cannot replay an older selection after another confirmation.

package/templates/native-go-delegate/backend/cmd/background-worker/main.go

@@ -1,48 +0,0 @@
-// Command background-worker is the package's fixed background worker. DSM runs
-// it as the package's systemd user unit under the package account; it never
-// runs as root and takes no input except the jobs in its private spool.
-package main
-
-import (
-	"context"
-	"log"
-	"os"
-	"os/signal"
-	"os/user"
-	"strconv"
-	"syscall"
-
-	"dsmapp/internal/app"
-	"dsmapp/internal/background"
-	"dsmapp/internal/delegate"
-)
-
-// Set by `synopkgland build-spk` through -ldflags -X.
-var packageID = "dev"
-var delegateScope, delegateOperationsJSON, delegateDestinationsJSON, delegateLifetime string
-
-func main() {
-	log.SetFlags(0)
-	log.SetPrefix(packageID + " background: ")
-	if err := background.RefuseRoot(os.Geteuid()); err != nil {
-		log.Fatal(err)
-	}
-	name := ""
-	if u, err := user.Current(); err == nil {
-		name = u.Username
-	}
-	info := background.WorkerInfo{PID: os.Getpid(), UID: os.Getuid(), Username: name}
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
-	defer stop()
-	log.Printf("started as uid %s", strconv.Itoa(info.UID))
-	dataDir := "/var/packages/" + packageID + "/var"
-	service := &delegate.Service{Client: delegate.Local(packageID), Store: background.NewStore(dataDir + "/background"), StagingDir: dataDir + "/executor-staging"}
-	settings, err := app.ParseDelegateConfig(app.Config{DelegateScope: delegateScope, DelegateOperationsJSON: delegateOperationsJSON, DelegateDestinationsJSON: delegateDestinationsJSON, DelegateLifetime: delegateLifetime})
-	if err != nil {
-		log.Fatal(err)
-	}
-	service.Scope, service.Operations, service.Destinations, service.Lifetime = settings.Scope, settings.Operations, settings.Destinations, settings.Lifetime
-	if err := service.Run(ctx, info); err != nil {
-		log.Fatal(err)
-	}
-}

package/templates/native-go-delegate/backend/internal/app/delegate.go

@@ -1,25 +0,0 @@
-package app
-
-import (
-	"dsmapp/internal/api"
-	"dsmapp/internal/background"
-	"dsmapp/internal/delegate"
-	"dsmapp/internal/filestation"
-	"path/filepath"
-)
-
-// DelegateRoutes is appended by the CLI's delegate capability assembly.
-// scope comes from the trusted manifest, never an HTTP parameter.
-func DelegateRoutes(cfg Config, scope string) []api.Route {
-	service := &delegate.Service{ExecutorDigest: cfg.ExecutorDigest, PolicyDigest: cfg.PolicyDigest, Client: delegate.Local(cfg.PackageID), Store: background.NewRequestStore(filepath.Join(cfg.DataDir, "background")), Scope: scope, StagingDir: filepath.Join(cfg.DataDir, "executor-staging"), InstallDraftPath: filepath.Join(cfg.DataDir, "delegate-install.json")}
-	settings, err := ParseDelegateConfig(cfg)
-	if err == nil {
-		service.Destinations, service.Operations, service.Lifetime = settings.Destinations, settings.Operations, settings.Lifetime
-	}
-	if cfg.SessionFiles != nil {
-		service.SessionFiles = cfg.SessionFiles
-	} else {
-		service.SessionFiles = filestation.Local(cfg.DataDir)
-	}
-	return service.Routes()
-}

package/templates/native-go-delegate/backend/internal/app/delegate_on.go

@@ -1,5 +0,0 @@
-package app
-
-import "dsmapp/internal/api"
-
-func (cfg Config) delegateRoutes() []api.Route { return DelegateRoutes(cfg, cfg.DelegateScope) }

package/templates/native-go-delegate/backend/internal/app/delegate_routes_test.go

@@ -1,31 +0,0 @@
-package app
-
-func init() {
-	for method, params := range map[string]string{
-		"delegate.example.export":     `{"key":"save","job_id":"example-1"}`,
-		"delegate.destination":        `{"key":"save"}`,
-		"delegate.select_destination": `{"key":"save","path":"/home"}`,
-		"delegate.move_from_staging":  `{"delegation_id":"grant","job_id":"export-1","staging":"a","name":"a","size":3}`,
-		"delegate.operations.get":     `{"delegation_id":"grant","job_id":"export-1"}`,
-		"delegate.operations.list":    `{}`,
-		"delegate.operations.cancel":  `{"delegation_id":"grant","job_id":"export-1"}`,
-		"delegate.disable":            `{}`, "delegate.enable": `{}`, "delegate.audit": `{}`,
-	} {
-		sampleParams[method] = params
-		sampleOutcome[method] = "session_required"
-	}
-
-	sampleParams["delegate.status"] = `{}`
-	sampleParams["delegate.create"] = `{"job_id":"job1","ops":["files.write"],"path":"/home","ttl_seconds":60}`
-	sampleParams["delegate.list"] = `{}`
-	sampleParams["delegate.revoke"] = `{"delegation_id":"missing"}`
-	sampleParams["delegate.jobs.submit"] = `{"key":"download","url":"http://localhost/file","dest":"/home","name":"file"}`
-	sampleParams["delegate.jobs.list"] = `{}`
-	sampleParams["delegate.jobs.cancel"] = `{"id":"missing"}`
-	sampleOutcome["delegate.create"] = "session_required"
-	sampleOutcome["delegate.list"] = "session_required"
-	sampleOutcome["delegate.revoke"] = "session_required"
-	sampleOutcome["delegate.jobs.submit"] = "identity_unavailable"
-	sampleOutcome["delegate.jobs.list"] = "identity_unavailable"
-	sampleOutcome["delegate.jobs.cancel"] = "identity_unavailable"
-}

package/templates/native-go-delegate/backend/internal/background/delegate_review_test.go

@@ -1,174 +0,0 @@
-package background
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func TestReviewGrantCreationDoesNotBlockOtherOwnersCancel(t *testing.T) {
-	dir := filepath.Join(t.TempDir(), "spool")
-	worker := NewStore(dir)
-	cgi := NewRequestStore(dir)
-	cgi.lockTimeout = 20 * time.Millisecond
-	ctx := context.Background()
-	alice := Submitter{User: "alice", UID: "1205"}
-	bob := Submitter{User: "bob", UID: "1206"}
-	j, _, err := worker.Submit(ctx, SubmitRequest{Key: "existing", Name: "hash", Data: []byte("x"), Submitter: alice})
-	if err != nil {
-		t.Fatal(err)
-	}
-	started, release := make(chan struct{}), make(chan struct{})
-	done := make(chan error, 1)
-	go func() {
-		_, err := cgi.SubmitDelegated(ctx, SubmitRequest{Key: "download", Name: "file", Data: []byte("x"), Submitter: bob}, func(string) (DelegationBinding, error) {
-			close(started)
-			<-release
-			return DelegationBinding{DelegationID: "grant"}, nil
-		}, func(DelegationBinding) {})
-		done <- err
-	}()
-	<-started
-	_, err = cgi.CancelFor(ctx, j.ID, Access{Owner: alice})
-	close(release)
-	if err2 := <-done; err2 != nil {
-		t.Fatal(err2)
-	}
-	if errors.Is(err, ErrBusy) {
-		t.Fatal("another owner's DSM grant request blocks cancellation under global jobs lock")
-	}
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestDelegatedReservationCannotRunAndCanceledGrantIsRevoked(t *testing.T) {
-	s := NewStore(filepath.Join(t.TempDir(), "spool"))
-	ctx := context.Background()
-	owner := Submitter{User: "alice", UID: "1205"}
-	req := SubmitRequest{Key: "pending", Name: "file", Data: []byte("input"), Submitter: owner}
-	rollback := 0
-	_, err := s.SubmitDelegated(ctx, req, func(id string) (DelegationBinding, error) {
-		if claimed, e := s.Claim(ctx); e != nil || claimed != nil {
-			t.Fatalf("claimed unfinished reservation: %+v %v", claimed, e)
-		}
-		if _, e := s.SubmitDelegated(ctx, req, func(string) (DelegationBinding, error) {
-			t.Fatal("duplicate grant created")
-			return DelegationBinding{DelegationID: ""}, nil
-		}, func(DelegationBinding) {}); !errors.Is(e, ErrBusy) {
-			t.Fatal("inflight duplicate must be busy", e)
-		}
-		if _, e := s.CancelFor(ctx, id, Access{Owner: owner}); e != nil {
-			t.Fatal(e)
-		}
-		return DelegationBinding{DelegationID: "grant"}, nil
-	}, func(b DelegationBinding) {
-		rollback++
-		if b.DelegationID != "grant" {
-			t.Fatal(b)
-		}
-		if _, e := s.Delegation(ctx, b.JobID); e != nil {
-			t.Fatal("revocation not durable", e)
-		}
-	})
-	if !errors.Is(err, ErrNotCancelable) || rollback != 1 {
-		t.Fatal("canceled grant committed", err, rollback)
-	}
-	pending, e := s.DelegationCleanup(ctx)
-	if e != nil || len(pending) != 1 {
-		t.Fatal(pending, e)
-	}
-}
-
-func TestDelegatedCommitFailureRevokesOutsideLock(t *testing.T) {
-	s := NewStore(filepath.Join(t.TempDir(), "spool"))
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	rollback := 0
-	_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "cancel-context", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(string) (DelegationBinding, error) {
-		cancel()
-		return DelegationBinding{DelegationID: "grant"}, nil
-	}, func(b DelegationBinding) {
-		rollback++
-		if _, e := s.Get(context.Background(), b.JobID); e != nil {
-			t.Fatal("rollback ran under journal lock", e)
-		}
-	})
-	if !errors.Is(err, context.Canceled) || rollback != 1 {
-		t.Fatal(err, rollback)
-	}
-	pending, e := s.DelegationCleanup(context.Background())
-	if e != nil || len(pending) != 1 {
-		t.Fatal("grant cleanup binding lost", pending, e)
-	}
-}
-
-func TestFailedGrantCreationReleasesReservation(t *testing.T) {
-	s := NewStore(filepath.Join(t.TempDir(), "spool"))
-	ctx := context.Background()
-	failure := errors.New("DSM unavailable")
-	var id string
-	_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "failed", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(job string) (DelegationBinding, error) {
-		id = job
-		return DelegationBinding{DelegationID: ""}, failure
-	}, func(DelegationBinding) { t.Error("revoked nonexistent grant") })
-	if !errors.Is(err, failure) {
-		t.Fatal(err)
-	}
-	job, e := s.Get(ctx, id)
-	if e != nil || job.AdmissionPending || job.State != StateFailed {
-		t.Fatal(job, e)
-	}
-}
-
-func TestDelegatedReservationRecoveryFailsClosed(t *testing.T) {
-	s := NewStore(filepath.Join(t.TempDir(), "spool"))
-	ctx := context.Background()
-	revoked := false
-	_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "recover", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(id string) (DelegationBinding, error) {
-		if e := s.Recover(ctx); e != nil {
-			t.Fatal(e)
-		}
-		job, e := s.Get(ctx, id)
-		if e != nil || job.State != StateInterrupted || job.AdmissionPending {
-			t.Fatal(job, e)
-		}
-		return DelegationBinding{DelegationID: "grant"}, nil
-	}, func(DelegationBinding) { revoked = true })
-	if !errors.Is(err, ErrNotCancelable) || !revoked {
-		t.Fatal("recovered reservation committed", err, revoked)
-	}
-}
-
-func TestDelegatedReservationsCountAgainstRevocationBacklog(t *testing.T) {
-	s := NewStore(filepath.Join(t.TempDir(), "spool"))
-	ctx := context.Background()
-	if err := s.withJournal(ctx, func(root *os.Root, _ *journal) (bool, error) {
-		for i := 0; i < MaxHistory+MaxQueued-1; i++ {
-			id := fmt.Sprintf("%032x", i)
-			if err := writeAtomic(root, bindingName(id), DelegationBinding{JobID: id, DelegationID: "old-grant"}); err != nil {
-				return false, err
-			}
-		}
-		return false, nil
-	}); err != nil {
-		t.Fatal(err)
-	}
-	_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "first", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "alice", UID: "1205"}}, func(string) (DelegationBinding, error) {
-		_, err := s.SubmitDelegated(ctx, SubmitRequest{Key: "second", Name: "file", Data: []byte("input"), Submitter: Submitter{User: "bob", UID: "1206"}}, func(string) (DelegationBinding, error) {
-			t.Error("inflight reservation exceeded cleanup backlog bound")
-			return DelegationBinding{DelegationID: "extra-grant"}, nil
-		}, func(DelegationBinding) {})
-		if !errors.Is(err, ErrQuota) {
-			t.Errorf("pending reservation did not reserve cleanup capacity: %v", err)
-		}
-		return DelegationBinding{DelegationID: "grant"}, nil
-	}, func(DelegationBinding) {})
-	if err != nil {
-		t.Fatal(err)
-	}
-}