@wipcomputer/wip-ldm-os 0.4.86 → 0.4.87-alpha.2

package/scripts/test-backup-engine.py

@@ -0,0 +1,609 @@
+#!/usr/bin/env python3
+"""Disposable fixture suite for the Slice 2 backup engine."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import socket
+import sqlite3
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+
+REPO = Path(__file__).resolve().parent.parent
+RUNNER = REPO / "scripts/ldm-backup.sh"
+ENGINE = REPO / "scripts/ldm-backup-engine.py"
+PRODUCTION_POLICY = REPO / "scripts/ldm-backup-policy.json"
+# Exact IDs derived from the controlling Slice 1 source-inventory tables.
+SLICE1_POLICY_IDS = {
+    "ldm-crystal", "ldm-agents", "ldm-shared", "ldm-hooks", "ldm-library",
+    "ldm-templates", "ldm-catalog", "ldm-change-dependencies",
+    "ldm-config-dependencies", "ldm-doc-dependencies", "ldm-extension-registry",
+    "ldm-config", "ldm-state", "ldm-secrets", "ldm-sessions", "ldm-messages",
+    "ldm-local-git", "ldm-legacy-backups", "ldm-trash", "ldm-logs",
+    "ldm-runtime-bin", "ldm-transient-runtime", "openclaw-memory-main",
+    "openclaw-context-embeddings", "openclaw-workspace", "openclaw-agents",
+    "openclaw-config", "openclaw-credentials", "openclaw-secrets",
+    "openclaw-identity", "openclaw-devices", "openclaw-state",
+    "openclaw-legacy-sqlite", "openclaw-approval-state", "openclaw-cron",
+    "openclaw-tasks", "openclaw-subagents", "openclaw-delivery-queue",
+    "openclaw-plugin-mutable-data", "openclaw-media", "openclaw-local-git",
+    "openclaw-installed-code", "openclaw-transient-runtime",
+    "openclaw-legacy-artifacts", "claude-projects", "claude-history",
+    "claude-file-history", "claude-settings", "claude-sessions", "claude-plans",
+    "claude-tasks", "claude-jobs", "claude-session-environment",
+    "claude-primary-instructions", "claude-repo-instructions", "claude-readme",
+    "claude-mcp-config", "claude-rules", "claude-skills",
+    "claude-plugin-manifests", "claude-local-git", "claude-transient-runtime",
+    "claude-backups", "codex-sessions", "codex-session-index", "codex-history",
+    "codex-memories", "codex-memory-index", "codex-config", "codex-auth",
+    "codex-agents-instructions", "codex-rules", "codex-skills", "codex-plugins",
+    "codex-global-state", "codex-state-databases", "codex-goals-databases",
+    "codex-logs-databases", "codex-pets", "codex-generated-artifacts",
+    "codex-transient-runtime", "codex-local-git", "home-ssh", "home-gnupg",
+    "home-config", "home-npmrc", "home-gitconfig", "home-zshrc",
+    "home-keychains", "launchagent-backup", "launchagent-healthcheck",
+    "launchagent-gateway", "workspace-local-state", "workspace-repo-inventory",
+    "workspace-remote-tracked", "workspace-uncommitted-state",
+    "workspace-worktrees", "workspace-dependency-caches",
+    "workspace-compiled-output", "workspace-third-party-clones",
+    "workspace-temp-roots", "workspace-trash", "workspace-root-git",
+    "system-installed-versions", "system-macos-manifest",
+    "system-onepassword-bootstrap", "system-package-inventories",
+    "system-reconstruction-runbook",
+}
+
+
+def json_bytes(value):
+    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
+
+
+class Fixture:
+    def __init__(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="ldm-backup-fixture-")
+        self.root = Path(self.temp.name).resolve()
+        self.home = self.root / "home"
+        self.ldm = self.root / "ldm"
+        self.openclaw = self.root / "openclaw"
+        self.claude = self.root / "claude"
+        self.codex = self.root / "codex"
+        self.workspace = self.root / "workspace"
+        self.backup = self.root / "backup"
+        self.state = self.root / "state"
+        self.icloud = self.root / "icloud"
+        self.lock = self.root / "locks/backup.lock"
+        for path in (self.home, self.ldm, self.openclaw, self.claude, self.codex, self.workspace, self.backup, self.state, self.icloud, self.lock.parent):
+            path.mkdir(parents=True, exist_ok=True)
+        (self.ldm / "safe.txt").write_text("ldm fixture\n", encoding="utf-8")
+        (self.openclaw / "data").mkdir()
+        (self.openclaw / "data/keep.txt").write_text("openclaw fixture\n", encoding="utf-8")
+        (self.openclaw / "data/ignored.tmp").write_text("ignored\n", encoding="utf-8")
+        self.sqlite_path = self.codex / "state.db"
+        db = sqlite3.connect(self.sqlite_path)
+        db.execute("CREATE TABLE facts(value TEXT)")
+        db.execute("INSERT INTO facts VALUES ('fixture')")
+        db.commit()
+        db.close()
+        self.policy_path = self.root / "policy.json"
+        self.policy = {
+            "schema_version": 1,
+            "rule_version": "fixture-v1",
+            "evidence_status_values": ["complete", "deferred-after-write-failure"],
+            "disk_floors": {"warning_percent": 15, "critical_percent": 10, "emergency_percent": 5, "start_reserve_percent": 10},
+            "sources": [
+                {
+                    "id": "fixture-file", "root": "LDM_HOME", "path": "safe.txt",
+                    "display_path": "$LDM_HOME/safe.txt", "destination": "ldm/safe.txt",
+                    "type": "file", "classification": ["required"], "required": True,
+                    "action": "capture", "exclusions": [],
+                },
+                {
+                    "id": "fixture-tree", "root": "OPENCLAW_HOME", "path": "data",
+                    "display_path": "$OPENCLAW_HOME/data/", "destination": "openclaw/data",
+                    "type": "tree", "classification": ["required"], "required": True,
+                    "action": "capture", "exclusions": [
+                        {"pattern": "*.tmp", "reason": "fixture transient", "reconstruction_source": "fixture generator", "rule_version": "fixture-v1"}
+                    ],
+                },
+                {
+                    "id": "fixture-sqlite", "root": "CODEX_HOME", "path": "state.db",
+                    "display_path": "$CODEX_HOME/state.db", "destination": "codex/state.db",
+                    "type": "sqlite", "classification": ["required"], "required": True,
+                    "action": "capture", "exclusions": [],
+                },
+            ],
+        }
+        self.write_policy()
+
+    def write_policy(self):
+        self.policy_path.write_text(json.dumps(self.policy, indent=2) + "\n", encoding="utf-8")
+
+    def env(self, **extra):
+        values = os.environ.copy()
+        values.update({
+            "LDM_BACKUP_REQUIRE_FIXTURE": "1",
+            "LDM_BACKUP_FIXTURE_ROOT": str(self.root),
+            "LDM_BACKUP_HOME": str(self.home),
+            "LDM_BACKUP_LDM_HOME": str(self.ldm),
+            "LDM_BACKUP_OPENCLAW_HOME": str(self.openclaw),
+            "LDM_BACKUP_CLAUDE_HOME": str(self.claude),
+            "LDM_BACKUP_CODEX_HOME": str(self.codex),
+            "LDM_BACKUP_WORKSPACE": str(self.workspace),
+            "LDM_BACKUP_DESTINATION": str(self.backup),
+            "LDM_BACKUP_STATE_DIR": str(self.state),
+            "LDM_BACKUP_ICLOUD_SUBSTITUTE": str(self.icloud),
+            "LDM_BACKUP_LOCK_PATH": str(self.lock),
+            "LDM_BACKUP_ENGINE": str(ENGINE),
+            "LDM_BACKUP_POLICY": str(self.policy_path),
+            "LDM_BACKUP_TEST_TOTAL_BYTES": str(10_000_000),
+            "LDM_BACKUP_TEST_AVAILABLE_BYTES": str(9_000_000),
+            "PYTHONDONTWRITEBYTECODE": "1",
+        })
+        values.update({key: str(value) for key, value in extra.items()})
+        return values
+
+    def run(self, *args, env=None):
+        return subprocess.run([str(RUNNER), *args], env=env or self.env(), text=True, capture_output=True)
+
+    def dry_plan(self):
+        result = self.run("--dry-run", "--json")
+        if result.returncode != 0:
+            raise AssertionError(result.stderr + result.stdout)
+        return json.loads(result.stdout)
+
+    def snapshots(self):
+        return sorted(path for path in self.backup.iterdir() if path.is_dir() and not path.name.startswith(".in-progress-"))
+
+    def close(self):
+        self.temp.cleanup()
+
+
+class BackupEngineTests(unittest.TestCase):
+    def setUp(self):
+        self.fixture = Fixture()
+
+    def tearDown(self):
+        self.fixture.close()
+
+    def assert_failed_without_success(self, result):
+        self.assertNotEqual(result.returncode, 0)
+        self.assertNotIn("Backup complete", result.stdout)
+        self.assertFalse(any((path / "completion.json").exists() for path in self.fixture.backup.glob(".in-progress-*")))
+
+    def test_successful_snapshot_and_sqlite_quick_check(self):
+        result = self.fixture.run()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        snapshot = self.fixture.snapshots()[0]
+        self.assertTrue((snapshot / "completion.json").is_file())
+        db = sqlite3.connect(snapshot / "codex/state.db")
+        self.assertEqual(db.execute("PRAGMA quick_check").fetchone()[0], "ok")
+        db.close()
+
+    def test_production_policy_exactly_matches_slice1_inventory_ids(self):
+        policy = json.loads(PRODUCTION_POLICY.read_text())
+        self.assertEqual(set(policy["evidence_status_values"]), {"complete", "deferred-after-write-failure"})
+        ids = {source["id"] for source in policy["sources"]}
+        self.assertEqual(ids, SLICE1_POLICY_IDS)
+        for source in policy["sources"]:
+            if source["required"] and source["action"] == "manifest":
+                self.assertEqual(source.get("manifest_generator"), "path-inventory", source["id"])
+        sources = {source["id"]: source for source in policy["sources"]}
+        for source_id in (
+            "ldm-local-git",
+            "openclaw-local-git",
+            "claude-local-git",
+            "system-macos-manifest",
+            "system-onepassword-bootstrap",
+            "system-package-inventories",
+        ):
+            self.assertEqual(sources[source_id]["action"], "blocked")
+
+    def test_package_deploys_runner_engine_and_policy(self):
+        package = json.loads((REPO / "package.json").read_text())
+        entries = {entry["name"]: entry for entry in package["wipLdmOs"]["binFiles"]}
+        self.assertEqual(entries["ldm-backup.sh"]["source"], "scripts/ldm-backup.sh")
+        self.assertEqual(entries["ldm-backup-engine.py"]["source"], "scripts/ldm-backup-engine.py")
+        self.assertEqual(entries["ldm-backup-policy.json"]["source"], "scripts/ldm-backup-policy.json")
+        self.assertFalse(entries["ldm-backup-policy.json"]["executable"])
+
+    def test_production_policy_plans_inside_fixture_without_writes(self):
+        env = self.fixture.env(LDM_BACKUP_POLICY=PRODUCTION_POLICY)
+        result = self.fixture.run("--dry-run", "--json", env=env)
+        self.assertNotEqual(result.returncode, 0)
+        plan = json.loads(result.stdout)
+        self.assertEqual(plan["policy_rule_version"], "slice1-2026-07-11")
+        self.assertGreater(len(plan["sources"]), 30)
+        self.assertFalse(list(self.fixture.state.iterdir()))
+        self.assertFalse(self.fixture.lock.exists())
+
+    def test_concurrent_run_lockout(self):
+        self.fixture.lock.write_text(json.dumps({"pid": os.getpid()}), encoding="utf-8")
+        result = self.fixture.run()
+        self.assert_failed_without_success(result)
+        self.assertIn("concurrent-run", result.stderr)
+
+    def test_stale_lock_is_reported_and_not_stolen(self):
+        self.fixture.lock.write_text(json.dumps({"pid": 99999999}), encoding="utf-8")
+        result = self.fixture.run()
+        self.assert_failed_without_success(result)
+        self.assertIn("stale-lock", result.stderr)
+        self.assertTrue(self.fixture.lock.exists())
+
+    def test_required_source_missing(self):
+        (self.fixture.ldm / "safe.txt").unlink()
+        result = self.fixture.run()
+        self.assert_failed_without_success(result)
+        state = json.loads((self.fixture.state / "result.json").read_text())
+        self.assertEqual(state["failure_code"], "preflight-failed")
+
+    def add_required_manifest_source(self, create=True):
+        path = self.fixture.ldm / "git-state"
+        if create:
+            path.mkdir()
+            (path / "HEAD").write_text("ref: refs/heads/main\n", encoding="utf-8")
+        self.fixture.policy["sources"].append({
+            "id": "fixture-manifest", "root": "LDM_HOME", "path": "git-state",
+            "display_path": "$LDM_HOME/git-state/", "destination": None, "type": "tree",
+            "classification": ["required"], "required": True, "action": "manifest",
+            "manifest_generator": "path-inventory", "exclusions": [],
+        })
+        self.fixture.write_policy()
+
+    def test_missing_required_manifest_evidence_fails_preflight(self):
+        self.add_required_manifest_source(create=False)
+        result = self.fixture.run()
+        self.assert_failed_without_success(result)
+        self.assertIn("preflight-failed", result.stderr)
+        self.assertFalse(list(self.fixture.backup.glob(".in-progress-*")))
+
+    def test_failed_manifest_generation_cannot_complete(self):
+        self.add_required_manifest_source()
+        result = self.fixture.run(env=self.fixture.env(
+            LDM_BACKUP_TEST_MANIFEST_FAIL_ID="fixture-manifest",
+        ))
+        self.assert_failed_without_success(result)
+        self.assertIn("manifest-evidence-failed", result.stderr)
+        staging = list(self.fixture.backup.glob(".in-progress-*"))[0]
+        self.assertFalse((staging / "completion.json").exists())
+
+    def test_valid_manifest_action_produces_machine_readable_evidence(self):
+        self.add_required_manifest_source()
+        result = self.fixture.run()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        manifest = json.loads((self.fixture.snapshots()[0] / "manifest.json").read_text())
+        evidence = next(item for item in manifest["manifest_evidence"] if item["source_id"] == "fixture-manifest")
+        self.assertEqual(evidence["generator"], "path-inventory")
+        self.assertEqual(evidence["status"], "valid")
+        self.assertGreaterEqual(evidence["member_count"], 2)
+        self.assertEqual(
+            evidence["inventory_sha256"],
+            hashlib.sha256(json_bytes(evidence["members"])).hexdigest(),
+        )
+
+    def test_completion_validation_requires_manifest_evidence(self):
+        self.add_required_manifest_source()
+        result = self.fixture.run(env=self.fixture.env(
+            LDM_BACKUP_TEST_DROP_MANIFEST_EVIDENCE_ID="fixture-manifest",
+        ))
+        self.assert_failed_without_success(result)
+        self.assertIn("manifest-required-evidence-missing", result.stderr)
+
+    def test_generatorless_manifest_tree_with_socket_short_circuits_before_walk(self):
+        socket_path = self.fixture.home / "s"
+        listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        listener.bind(str(socket_path))
+        try:
+            self.fixture.policy["sources"].append({
+                "id": "fixture-generatorless-manifest",
+                "root": "HOME",
+                "path": ".",
+                "display_path": "$HOME/",
+                "destination": None,
+                "type": "tree",
+                "classification": ["rebuildable"],
+                "required": False,
+                "action": "manifest",
+                "exclusions": [],
+            })
+            self.fixture.write_policy()
+            dry_run = self.fixture.run("--dry-run", "--json")
+            self.assertEqual(dry_run.returncode, 0, dry_run.stderr)
+            plan = json.loads(dry_run.stdout)
+            source = next(
+                item for item in plan["sources"]
+                if item["id"] == "fixture-generatorless-manifest"
+            )
+            self.assertEqual(source["status"], "blocked")
+            self.assertEqual(source["block_reason"], "manifest generator is not implemented")
+            result = self.fixture.run()
+            self.assertEqual(result.returncode, 0, result.stderr)
+            manifest = json.loads((self.fixture.snapshots()[0] / "manifest.json").read_text())
+            exclusion = next(
+                item for item in manifest["exclusions"]
+                if item["source_id"] == "fixture-generatorless-manifest"
+            )
+            self.assertEqual(exclusion["reason"], "manifest generator is not implemented")
+        finally:
+            listener.close()
+
+    def test_blocked_required_source_fails_dry_run_without_secret_output(self):
+        secret = "do-not-print-this-secret"
+        (self.fixture.ldm / "secret-token.txt").write_text(secret, encoding="utf-8")
+        self.fixture.policy["sources"].append({
+            "id": "fixture-secret", "root": "LDM_HOME", "path": "secret-token.txt",
+            "display_path": "$LDM_HOME/[sensitive]", "destination": None, "type": "file",
+            "classification": ["required", "sensitive", "blocked"], "required": True,
+            "action": "blocked", "block_reason": "encryption required", "exclusions": [],
+        })
+        self.fixture.write_policy()
+        result = self.fixture.run("--dry-run")
+        self.assert_failed_without_success(result)
+        self.assertNotIn(secret, result.stdout + result.stderr)
+        self.assertFalse(self.fixture.snapshots())
+
+    def test_sqlite_validation_failure(self):
+        result = self.fixture.run(env=self.fixture.env(LDM_BACKUP_TEST_SQLITE_FAIL_ID="fixture-sqlite"))
+        self.assert_failed_without_success(result)
+        self.assertIn("sqlite-validation-failed", result.stderr)
+
+    def test_disk_full_during_capture(self):
+        result = self.fixture.run(env=self.fixture.env(LDM_BACKUP_TEST_FAIL_AFTER_BYTES=1))
+        self.assert_failed_without_success(result)
+        self.assertTrue(list(self.fixture.backup.glob(".in-progress-*")))
+        self.assertFalse(self.fixture.snapshots())
+
+    def test_preflight_failure_happens_before_staging(self):
+        result = self.fixture.run(env=self.fixture.env(LDM_BACKUP_TEST_TOTAL_BYTES=1000, LDM_BACKUP_TEST_AVAILABLE_BYTES=100))
+        self.assert_failed_without_success(result)
+        self.assertFalse(list(self.fixture.backup.glob(".in-progress-*")))
+        self.assertTrue((self.fixture.state / "attempt.json").is_file())
+
+    def test_dry_run_destination_failure_is_nonzero_and_read_only(self):
+        blocked_parent = self.fixture.root / "destination-is-a-file"
+        blocked_parent.write_text("not a directory\n", encoding="utf-8")
+        env = self.fixture.env(LDM_BACKUP_DESTINATION=blocked_parent / "backup")
+        result = self.fixture.run("--dry-run", "--json", env=env)
+        self.assertNotEqual(result.returncode, 0)
+        plan = json.loads(result.stdout)
+        self.assertIn("destination-unavailable", plan["blocking_reasons"])
+        self.assertFalse(list(self.fixture.state.iterdir()))
+
+    def test_crash_during_staging_never_promotes(self):
+        result = self.fixture.run(env=self.fixture.env(LDM_BACKUP_TEST_CRASH_AFTER_FILES=1))
+        self.assertEqual(result.returncode, 88)
+        self.assertTrue(list(self.fixture.backup.glob(".in-progress-*")))
+        self.assertFalse(self.fixture.snapshots())
+
+    def make_verified_snapshot(self, name, pinned=False):
+        path = self.fixture.backup / name
+        path.mkdir()
+        manifest = {"terminal_result": "success"}
+        (path / "manifest.json").write_bytes(json_bytes(manifest))
+        marker = {"status": "complete", "manifest_sha256": hashlib.sha256((path / "manifest.json").read_bytes()).hexdigest()}
+        (path / "completion.json").write_bytes(json_bytes(marker))
+        if pinned:
+            (path / ".pinned").write_text("keep\n", encoding="utf-8")
+        return path
+
+    def test_pinned_snapshot_does_not_consume_retention_slot(self):
+        pinned = self.make_verified_snapshot("2026-01-01--00-00-00", pinned=True)
+        old1 = self.make_verified_snapshot("2026-01-02--00-00-00")
+        old2 = self.make_verified_snapshot("2026-01-03--00-00-00")
+        self.make_verified_snapshot("2026-01-04--00-00-00")
+        unverified = self.fixture.backup / "2026-01-05--00-00-00"
+        unverified.mkdir()
+        result = self.fixture.run("--keep", "2")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertTrue(pinned.exists())
+        self.assertFalse(old1.exists())
+        self.assertFalse(old2.exists())
+        self.assertTrue(unverified.exists())
+
+    def test_retention_requires_at_least_one_unpinned_slot(self):
+        result = self.fixture.run("--keep", "0")
+        self.assert_failed_without_success(result)
+        self.assertIn("keep-invalid", result.stderr)
+
+    def test_estimate_matches_captured_policy_payload(self):
+        plan = self.fixture.dry_plan()
+        result = self.fixture.run()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        snapshot = self.fixture.snapshots()[0]
+        manifest = json.loads((snapshot / "manifest.json").read_text())
+        captured = sum(item["size"] for item in manifest["sources"])
+        self.assertEqual(plan["estimated_payload_bytes"], captured)
+        logical_snapshot_bytes = sum(path.stat().st_size for path in snapshot.rglob("*") if path.is_file())
+        self.assertEqual(plan["estimated_new_bytes"], logical_snapshot_bytes)
+
+    def test_size_change_before_capture_is_recorded_and_captured_consistently(self):
+        result = self.fixture.run(env=self.fixture.env(
+            LDM_BACKUP_TEST_MUTATE_SOURCE_ID="fixture-file",
+            LDM_BACKUP_TEST_MUTATE_MODE="size",
+        ))
+        self.assertEqual(result.returncode, 0, result.stderr)
+        manifest = json.loads((self.fixture.snapshots()[0] / "manifest.json").read_text())
+        record = next(item for item in manifest["sources"] if item["source_id"] == "fixture-file")
+        observation = next(item for item in manifest["source_observations"] if item["source_id"] == "fixture-file")
+        self.assertTrue(record["changed_since_plan"])
+        self.assertTrue(observation["changed_since_plan"])
+        self.assertNotEqual(record["planned_size"], record["size"])
+        self.assertNotEqual(observation["planned_payload_bytes"], observation["capture_payload_bytes"])
+        self.assertEqual(record["consistency_contract"], "capture-time-stable")
+
+    def configure_single_file_reserve_fixture(self):
+        (self.fixture.ldm / "safe.txt").write_bytes(b"a")
+        self.fixture.policy["sources"] = [self.fixture.policy["sources"][0]]
+        self.fixture.write_policy()
+        plan = self.fixture.dry_plan()
+        total = 1_000_000
+        required_reserve = total // 10
+        return total, required_reserve, plan["estimated_new_bytes"]
+
+    def test_source_growth_within_updated_reserve_succeeds(self):
+        total, required_reserve, planned_new = self.configure_single_file_reserve_fixture()
+        available = planned_new + required_reserve + 1000
+        result = self.fixture.run(env=self.fixture.env(
+            LDM_BACKUP_TEST_TOTAL_BYTES=total,
+            LDM_BACKUP_TEST_AVAILABLE_BYTES=available,
+            LDM_BACKUP_TEST_MUTATE_SOURCE_ID="fixture-file",
+            LDM_BACKUP_TEST_MUTATE_MODE="size",
+        ))
+        self.assertEqual(result.returncode, 0, result.stderr)
+        manifest = json.loads((self.fixture.snapshots()[0] / "manifest.json").read_text())
+        self.assertEqual(manifest["captured_payload_bytes"], 9)
+
+    def test_source_growth_crossing_reserve_fails_before_copy(self):
+        total, required_reserve, planned_new = self.configure_single_file_reserve_fixture()
+        available = planned_new + required_reserve + 4
+        result = self.fixture.run(env=self.fixture.env(
+            LDM_BACKUP_TEST_TOTAL_BYTES=total,
+            LDM_BACKUP_TEST_AVAILABLE_BYTES=available,
+            LDM_BACKUP_TEST_MUTATE_SOURCE_ID="fixture-file",
+            LDM_BACKUP_TEST_MUTATE_MODE="size",
+        ))
+        self.assert_failed_without_success(result)
+        self.assertIn("capture-reserve-gate", result.stderr)
+        staging = list(self.fixture.backup.glob(".in-progress-*"))[0]
+        self.assertFalse((staging / "ldm/safe.txt").exists())
+        state = json.loads((self.fixture.state / "result.json").read_text())
+        self.assertEqual(state["failure_code"], "capture-reserve-gate")
+        self.assertEqual(state["estimated_payload_bytes"], 9)
+        self.assertLess(state["reserve_after_bytes"], state["required_reserve_bytes"])
+
+    def test_same_size_change_before_capture_is_recorded_by_checksum(self):
+        result = self.fixture.run(env=self.fixture.env(
+            LDM_BACKUP_TEST_MUTATE_SOURCE_ID="fixture-file",
+            LDM_BACKUP_TEST_MUTATE_MODE="same-size",
+        ))
+        self.assertEqual(result.returncode, 0, result.stderr)
+        manifest = json.loads((self.fixture.snapshots()[0] / "manifest.json").read_text())
+        record = next(item for item in manifest["sources"] if item["source_id"] == "fixture-file")
+        observation = next(item for item in manifest["source_observations"] if item["source_id"] == "fixture-file")
+        self.assertTrue(record["changed_since_plan"])
+        self.assertTrue(observation["changed_since_plan"])
+        self.assertEqual(record["planned_size"], record["size"])
+        self.assertNotEqual(record["planned_checksum_sha256"], record["checksum_sha256"])
+        self.assertNotEqual(observation["planned_inventory_sha256"], observation["capture_inventory_sha256"])
+
+    def test_change_during_capture_is_fatal(self):
+        result = self.fixture.run(env=self.fixture.env(
+            LDM_BACKUP_TEST_MUTATE_SOURCE_ID="fixture-file",
+            LDM_BACKUP_TEST_MUTATE_PHASE="during-capture",
+            LDM_BACKUP_TEST_MUTATE_MODE="same-size",
+        ))
+        self.assert_failed_without_success(result)
+        self.assertIn("source-changed-during-capture", result.stderr)
+
+    def test_completion_marker_missing_is_visible_failure(self):
+        result = self.fixture.run()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        snapshot = self.fixture.snapshots()[0]
+        (snapshot / "completion.json").unlink()
+        verify = subprocess.run([sys.executable, str(ENGINE), "--verify-snapshot", str(snapshot)], text=True, capture_output=True)
+        self.assertNotEqual(verify.returncode, 0)
+
+    def test_completion_marker_is_written_only_after_all_gates(self):
+        result = self.fixture.run(env=self.fixture.env(LDM_BACKUP_TEST_FAIL_BEFORE_COMPLETION=1))
+        self.assert_failed_without_success(result)
+        staging = list(self.fixture.backup.glob(".in-progress-*"))[0]
+        self.assertTrue((staging / "manifest.json").is_file())
+        self.assertFalse((staging / "completion.json").exists())
+        self.assertFalse(self.fixture.snapshots())
+
+    def test_state_files_are_atomic_and_valid(self):
+        result = self.fixture.run()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        for name in ("schedule.json", "attempt.json", "result.json", "success-local.json"):
+            json.loads((self.fixture.state / name).read_text())
+        self.assertFalse(list(self.fixture.state.rglob("*.tmp")))
+
+    def test_evidence_status_enum_rejects_placeholder(self):
+        self.fixture.policy["evidence_status_values"] = ["complete-or-deferred-after-write-failure"]
+        self.fixture.write_policy()
+        result = self.fixture.run("--dry-run")
+        self.assert_failed_without_success(result)
+        self.assertIn("policy-enum-invalid", result.stderr)
+
+    def test_runtime_evidence_status_enum_is_explicit(self):
+        (self.fixture.state / "containment.json").write_text(
+            json.dumps({"evidence_status": "complete-or-deferred-after-write-failure"}),
+            encoding="utf-8",
+        )
+        result = self.fixture.run()
+        self.assert_failed_without_success(result)
+        self.assertIn("state-enum-invalid", result.stderr)
+
+    def test_schedule_evidence_status_is_unknown_without_marker(self):
+        result = self.fixture.run()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        schedule = json.loads((self.fixture.state / "schedule.json").read_text())
+        self.assertEqual(schedule["evidence_status"], "unknown")
+
+    def test_corrupt_config_is_fatal(self):
+        (self.fixture.ldm / "config.json").write_text("{not-json", encoding="utf-8")
+        result = self.fixture.run("--dry-run")
+        self.assert_failed_without_success(result)
+        self.assertIn("Backup failed [config-invalid]", result.stderr)
+        self.assertNotIn("Traceback", result.stderr)
+
+    def test_null_config_paths_is_fatal(self):
+        (self.fixture.ldm / "config.json").write_text('{"paths": null}\n', encoding="utf-8")
+        result = self.fixture.run("--dry-run")
+        self.assert_failed_without_success(result)
+        self.assertIn("config-invalid", result.stderr)
+
+    def test_snapshot_identifiers_use_utc(self):
+        plan = self.fixture.dry_plan()
+        self.assertRegex(plan["snapshot_id"], r"^\d{4}-\d{2}-\d{2}--\d{2}-\d{2}-\d{2}Z$")
+
+    def test_runner_has_structured_python3_guard(self):
+        runner = RUNNER.read_text(encoding="utf-8")
+        self.assertIn("command -v python3", runner)
+        self.assertIn("Backup failed [python3-missing]", runner)
+
+    def test_dry_run_is_read_only_and_matches_real_plan(self):
+        before = sorted(str(path.relative_to(self.fixture.root)) for path in self.fixture.root.rglob("*"))
+        plan = self.fixture.dry_plan()
+        after = sorted(str(path.relative_to(self.fixture.root)) for path in self.fixture.root.rglob("*"))
+        self.assertEqual(before, after)
+        self.assertFalse(self.fixture.lock.exists())
+        self.assertFalse(list(self.fixture.state.iterdir()))
+        result = self.fixture.run()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        manifest = json.loads((self.fixture.snapshots()[0] / "manifest.json").read_text())
+        self.assertEqual(plan["estimated_payload_bytes"], sum(item["size"] for item in manifest["sources"]))
+
+    def test_fixture_path_escape_aborts_before_writes(self):
+        env = self.fixture.env(LDM_BACKUP_WORKSPACE="/tmp/not-inside-fixture")
+        result = self.fixture.run("--dry-run", env=env)
+        self.assert_failed_without_success(result)
+        self.assertIn("fixture-path-escape", result.stderr)
+        self.assertFalse(list(self.fixture.state.iterdir()))
+
+    def test_fixture_source_symlink_escape_aborts_before_writes(self):
+        outside = Path("/tmp")
+        (self.fixture.ldm / "escape").symlink_to(outside, target_is_directory=True)
+        self.fixture.policy["sources"][0]["path"] = "escape"
+        self.fixture.policy["sources"][0]["type"] = "tree"
+        self.fixture.write_policy()
+        result = self.fixture.run("--dry-run")
+        self.assert_failed_without_success(result)
+        self.assertIn("fixture-source-escape", result.stderr)
+        self.assertFalse(list(self.fixture.state.iterdir()))
+
+    def test_policy_destination_traversal_is_rejected(self):
+        self.fixture.policy["sources"][0]["destination"] = "../escape"
+        self.fixture.write_policy()
+        result = self.fixture.run("--dry-run")
+        self.assert_failed_without_success(result)
+        self.assertIn("policy-invalid", result.stderr)
+        self.assertFalse(list(self.fixture.state.iterdir()))
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)