fix: admit managed operations at their dispatch boundary

Author: thymikee

packages/platform-apple/src/runtime-simulator-readiness.test.ts

@@ -20,32 +20,31 @@ test('bound simulator readiness captures authority and refuses mismatches or fai
     }),
     async () => {
       const device = { ...IOS_SIMULATOR, simulatorSetPath: '/managed/set' };
-      const ensureReady = vi.fn(async () => {});
+      const admit = vi.fn(async (): Promise<never> => {
+        throw new Error('Deep readiness must not recursively admit');
+      });
       const operations = await withManagedDeviceScope(
         {
           device,
           owner: managedLocalRuntimeOwner('allocator'),
           fence: { token: 'fence', generation: 1 },
-          ensureReady,
+          admit,
           run: async <T>(task: () => Promise<T>) => await task(),
         },
         async () => bindSimulatorReadiness(Object.freeze({ ensureBootedSimulator })),
       );
       await operations.ensureBootedSimulator(device);
-      expect(ensureReady).toHaveBeenCalledOnce();
+      expect(admit).not.toHaveBeenCalled();
       await expect(
         operations.ensureBootedSimulator({ ...device, simulatorSetPath: undefined }),
       ).rejects.toMatchObject({ details: { reason: 'managed-device-transport-mismatch' } });
-      expect(ensureReady).toHaveBeenCalledOnce();
+      expect(admit).not.toHaveBeenCalled();
       const abort = new AbortController();
       abort.abort(new Error('cancelled'));
       await expect(
         operations.ensureBootedSimulator(device, { signal: abort.signal }),
       ).rejects.toThrow('cancelled');
-      expect(ensureReady).toHaveBeenCalledOnce();
-      ensureReady.mockRejectedValueOnce(new Error('lease fenced'));
-      await expect(operations.ensureBootedSimulator(device)).rejects.toThrow('lease fenced');
-      expect(ensureReady).toHaveBeenCalledTimes(2);
+      expect(admit).not.toHaveBeenCalled();
     },
   );
 });

packages/provision-kit/src/managed-device-scope.test.ts

@@ -18,8 +18,8 @@ test('managed readiness scopes isolate concurrent devices and leave ordinary rea
     device,
     owner: managedLocalRuntimeOwner('allocator'),
     fence: { token: 'fence', generation: 1 },
-    ensureReady: async () => {
-      ready.push(device.id);
+    admit: async <T>(_task: () => Promise<T>): Promise<T> => {
+      throw new Error('Readiness must not recursively admit');
     },
     run: async <T>(task: () => Promise<T>) => await task(),
   };
@@ -30,13 +30,11 @@ test('managed readiness scopes isolate concurrent devices and leave ordinary rea
         {
           ...managed,
           device: selected,
-          ensureReady: async () => {
-            ready.push(id);
-          },
         },
         async () => {
           await Promise.resolve();
           expect(await delegateManagedDeviceReadiness(selected)).toBe(true);
+          ready.push(id);
           await expect(
             delegateManagedDeviceReadiness({ ...selected, id: 'foreign' }),
           ).rejects.toMatchObject({ details: { reason: 'managed-device-transport-mismatch' } });

packages/provision-kit/src/managed-device-scope.ts

@@ -35,7 +35,6 @@ export function resolveManagedDeviceReadiness():
   if (!managed) return undefined;
   return async (device) => {
     assertManagedDeviceIdentity(managed, device);
-    await managed.ensureReady();
   };
 }
 

src/platform-runtime-gateway.fixtures.ts

@@ -61,7 +61,7 @@ export function managedGatewayScope(
       device,
       owner,
       fence,
-      ensureReady: async () => {},
+      admit: async (task) => await task(),
       run: async (task) => await task(),
     },
   };

src/platform-runtime-managed-owner.fixtures.ts

@@ -59,10 +59,11 @@ async function managedAutomationScope(platform: ManagedLeasePlatform) {
     managedDevice: {
       ...scope.managedDevice!,
       run: reachability.run,
-      ensureReady: async () => {
-        const result = await admission.run(horizon, scope.signal, async () => {});
+      admit: async <T>(task: () => Promise<T>) => {
+        const result = await admission.run(horizon, scope.signal, task);
         if (result.status !== 'admitted')
           throw new AppError('COMMAND_FAILED', 'Managed lease refused.', { reason: result.status });
+        return result.value;
       },
     },
   };

src/platform-runtime-managed-owner.test.ts

@@ -240,6 +240,62 @@ test.skipIf(process.platform === 'win32')(
 );
 
 describe('managed local runtime owner', () => {
+  test('dispatches the real operation inside admission before authority can be fenced', async () => {
+    const events: string[] = [];
+    const cancellation = new AbortController();
+    let cancelOnAdmission = false;
+    const family = localFamilyRuntimeFixture({ family: 'apple', device });
+    const local = await family.module.loadRuntime({} as PlatformRuntimeHost);
+    const owner = createManagedLocalRuntimeOwner({
+      owner: managed,
+      loadLocal: async () => ({
+        ...local,
+        bind: async (request) => {
+          const binding = await local.bind(request);
+          return {
+            ...binding,
+            operations: {
+              ...binding.operations,
+              readClipboard: async () => {
+                events.push('native');
+                expect(events.at(-2)).toBe('admitted');
+                return 'clipboard';
+              },
+            },
+          };
+        },
+      }),
+    });
+    const binding = await owner.bind({
+      device,
+      intent: exactly(),
+      scope: {
+        ...scope,
+        signal: cancellation.signal,
+        managedDevice: {
+          ...scope.managedDevice!,
+          admit: async (task) => {
+            events.push('admitted');
+            if (cancelOnAdmission) cancellation.abort(new Error('cancelled during admission'));
+            try {
+              return await task();
+            } finally {
+              events.push('fenced');
+            }
+          },
+        },
+      },
+    });
+    expect(await binding.operations.readClipboard!({})).toBe('clipboard');
+    cancelOnAdmission = true;
+    await expect(binding.operations.readClipboard!({})).rejects.toThrow(
+      'cancelled during admission',
+    );
+    await binding[Symbol.asyncDispose]();
+    expect(events).toEqual(['admitted', 'native', 'fenced', 'admitted', 'fenced']);
+    expect(family.calls.disposals).toBe(1);
+  });
+
   test('exposes only reviewed operations even when the local family offers every cell', async () => {
     const { owner } = managedOwnerFixture();
 

src/platform-runtime-managed-owner.ts

@@ -105,9 +105,10 @@ export function createManagedLocalRuntimeOwner(params: {
           withMethodScope({ ...binding.operations }, (task) =>
             run(async () => {
               request.scope.signal.throwIfAborted();
-              await managed.ensureReady();
-              request.scope.signal.throwIfAborted();
-              return await task();
+              return await managed.admit(async () => {
+                request.scope.signal.throwIfAborted();
+                return await task();
+              });
             }),
           ),
           facts,