truf-server/tests/test_pipeline_postgres_integration.py

import os
import hashlib
import json
from contextlib import ExitStack
from datetime import datetime, timedelta, timezone
from pathlib import Path
import socket
import subprocess
import sys
import tempfile
import threading
import time
import unittest
import uuid
from types import SimpleNamespace
from unittest import mock


ROOT = Path(__file__).resolve().parents[1]
APP_DIR = ROOT / 'app'
PG_BIN = Path(os.environ['TRUF_TEST_PG_BIN']) if os.environ.get(
    'TRUF_TEST_PG_BIN'
) else ROOT / 'runtime' / 'postgres' / 'pgsql' / 'bin'
PG_INITDB = PG_BIN / ('initdb.exe' if os.name == 'nt' else 'initdb')
PG_CTL = PG_BIN / ('pg_ctl.exe' if os.name == 'nt' else 'pg_ctl')
sys.path.insert(0, str(APP_DIR))

from jsonl_projector import JsonlProjector
from keycheckers.gemini import geminiKeycheck
from keycheckers.openai import Keycheck as openaiKeycheck
from migrate_runtime_safety import (
    _canonical_json_sha256,
    apply_cold_target_queue_reactivation,
    apply_stale_target_queue_cold,
    backfill_normalized_raw_results,
    plan_cold_target_queue_reactivation,
    plan_stale_target_queue_cold,
    recover_stale_result_pipeline,
    rebuild_jsonl_projections,
    review_pipeline_quarantine_manifest,
)
from console_runner import reserve_v2_admission_with_recovery, validate_v2_capacity_model
import console_runner
import dashboard
import docker_depth_experiment as depth
from docker_depth_report import build_docker_depth_report
from process_identity import current_process_identity
from result_bundle import (
    FORMAT_VERSION, BundleReservation, ResultBundleReader, ResultBundleWriter,
)
from result_ingester import ResultIngester
import result_ingester
from runtime_security import atomic_write_private_json, ensure_private_directory, harden_private_file
from scanner import acquire_scan_slot, scan_config, stage_result_bundle
import scanner
import scanner_db
import worker_contracts
from scan_execution import (
    PACKAGE_DETECTOR_POLICY, PROTOCOL_VERSION, QueueDispositionPolicy,
    remote_execution_identity,
)
from scanner_db import (
    DOCKER_ADAPTIVE_SHADOW_SELECTION_METRIC_KEYS,
    DiscoveryPausedError,
    DockerFindingAttributionLimitError,
    DiscoveryRetryLeaseError,
    HAS_CLAIMABLE_TARGETS_V2_SQL,
    PIPELINE_MIGRATION_VERSIONS,
    PIPELINE_SCHEMA_SQL,
    PipelineCapacityUnavailable,
    REMOTE_ASSIGNMENT_CAPACITY_MIGRATION,
    RuntimeControlRevisionConflictError,
    RuntimeSafetySchemaError,
    ScanEventConflictError,
    ScannerDB,
    canonical_docker_layer_plan_bytes,
    canonical_git_scan_plan_bytes,
    docker_layer_coverage_policy_sha256,
    docker_layer_execution_policy_sha256,
    docker_layer_selection_policy_sha256,
    migrate_runtime_safety_schema,
)


@unittest.skipUnless(PG_INITDB.is_file(), 'bundled PostgreSQL is unavailable')
class PipelinePostgresIntegrationTests(unittest.TestCase):
    def setUp(self):
        self.temp = tempfile.TemporaryDirectory()
        self.root = Path(self.temp.name)
        self.data = self.root / 'data'
        self.log = self.root / 'postgres.log'
        self.bundle_root = self.root / 'bundles'
        self.results = self.root / 'results'
        self.keychecks = self.root / 'keychecks'
        for path in (self.root, self.bundle_root, self.results, self.keychecks):
            ensure_private_directory(str(path), reject_reparse=True)
        with socket.socket() as listener:
            listener.bind(('127.0.0.1', 0))
            self.port = listener.getsockname()[1]
        flags = subprocess.CREATE_NO_WINDOW if os.name == 'nt' else 0
        subprocess.run(
            [
                str(PG_INITDB), '-D', str(self.data),
                '--username=postgres', '--auth=trust', '--encoding=UTF8',
                '--no-locale', '--no-sync',
            ],
            check=True,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
            creationflags=flags,
            timeout=60,
        )
        postgres_options = f'-p {self.port} -h 127.0.0.1'
        if os.name != 'nt':
            postgres_options += f' -k {self.root}'
        subprocess.run(
            [
                str(PG_CTL), '-D', str(self.data), '-l', str(self.log),
                '-o', postgres_options, '-w', 'start',
            ],
            check=True,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
            creationflags=flags,
            timeout=60,
        )
        self.dsn = f'postgresql://postgres@127.0.0.1:{self.port}/postgres'
        import psycopg

        with psycopg.connect(self.dsn, autocommit=True) as raw:
            raw.execute('REVOKE CREATE ON SCHEMA public FROM PUBLIC')

    @staticmethod
    def _arm_delayed_commit(database, commit_number):
        entered = threading.Event()
        release = threading.Event()
        real_commit = database.conn.commit
        calls = {'count': 0}

        def delayed_commit():
            calls['count'] += 1
            if calls['count'] == commit_number:
                entered.set()
                if not release.wait(10):
                    raise RuntimeError('timed out waiting to release PostgreSQL commit')
            return real_commit()

        database.conn.commit = delayed_commit
        return entered, release

    @staticmethod
    def _remote_execution_snapshot():
        scan_kwargs = {
            'timeout_sec': 30.0,
            'trufflehog_config': PACKAGE_DETECTOR_POLICY,
        }
        execution_limits = {
            'candidate_max_items': 1,
            'candidate_max_bytes': 1024,
        }
        scan_policy = {
            'drop_detectors': [],
            'strict_git_provider_token_filter': True,
            'trufflehog_stdout_max_mb': 32,
            'trufflehog_stderr_max_mb': 8,
            'result_bundle_max_event_bytes': 1024 * 1024,
            'trufflehog_max_findings_per_target': 20000,
            'trufflehog_job_memory_limit_bytes': 0,
            'trufflehog_windows_job_cpu_weight': 0,
            'trufflehog_windows_memory_priority': 0,
            'trufflehog_diagnostic_max_lines': 2000,
            'trufflehog_diagnostic_max_line_chars': 8192,
            'trufflehog_diagnostic_max_line_bytes': 8192,
            'trufflehog_diagnostic_max_errors': 200,
            'trufflehog_diagnostic_max_warnings': 200,
            'trufflehog_diagnostic_max_unclassified': 20,
        }
        effective, execution = remote_execution_identity(
            'github', scan_kwargs, scan_kwargs, QueueDispositionPolicy(),
            execution_limits, scan_policy,
        )
        return effective, {
            'schema': 1,
            'compatibility': {
                'protocol_version': PROTOCOL_VERSION,
                'bundle_format_version': FORMAT_VERSION,
                'platform_tag': 'windows-x86_64',
                'code_manifest_sha256': 'd' * 64,
                'effective_config_sha256': effective,
                'detector_policy_sha256': 'e' * 64,
            },
            'execution': execution,
            'planning': {
                'kind': 'exact_git_v1',
                'git_baseline_depth': 100,
                'git_ref_resolution_attempts': 2,
                'git_ref_resolution_timeout_sec': 10.0,
                'git_ref_resolution_max_bytes': 1 << 20,
            },
            'credential_ref': {'source': 'github', 'auth_entry': 'primary'},
        }

    def tearDown(self):
        flags = subprocess.CREATE_NO_WINDOW if os.name == 'nt' else 0
        try:
            subprocess.run(
                [str(PG_CTL), '-D', str(self.data), '-m', 'fast', '-w', 'stop'],
                check=False,
                stdin=subprocess.DEVNULL,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,
                creationflags=flags,
                timeout=60,
            )
        finally:
            self.temp.cleanup()

    def _docker_attribution_db(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        migrate_runtime_safety_schema(db, initialize_base=True)
        now = scanner_db.utc_now_iso()
        db.conn.execute(
            '''INSERT INTO pipeline_leases(
                   worker_name, generation, lease_token, supervisor_instance_id,
                   state, lease_expires_at, updated_at
               ) VALUES ('result_ingester', 1, 'attribution-ingester',
                         'attribution-supervisor', 'ready',
                         '2999-01-01T00:00:00+00:00', ?)
               ON CONFLICT(worker_name) DO UPDATE SET
                   supervisor_instance_id = excluded.supervisor_instance_id,
                   state = excluded.state,
                   lease_expires_at = excluded.lease_expires_at,
                   updated_at = excluded.updated_at''',
            (now,),
        )
        db.conn.commit()
        return db

    def _prepare_docker_attribution_bundle(
        self, db, label, layers, findings, *, experiment_bound=True,
    ):
        safe_label = label.replace('_', '-').lower()
        repository = f'owner/{safe_label}'
        manifest_digest = 'sha256:' + hashlib.sha256(
            f'manifest:{label}'.encode('ascii')
        ).hexdigest()
        target = f'{repository}@{manifest_digest}'
        self.assertEqual(
            db.enqueue_targets('dockerhub', 'docker', safe_label, [target]), 1,
        )
        identity = hashlib.sha256(label.encode('ascii')).hexdigest()
        claim = db.reserve_and_claim_target(
            'dockerhub', 'docker', current_process_identity(),
            'attribution-supervisor', 4 * 1024 * 1024, 4 * 1024 * 1024,
            10, 1024 * 1024,
            capacity_limits={
                'bundle_items': 100, 'bundle_bytes': 128 * 1024 * 1024,
                'projection_items': 100, 'projection_bytes': 128 * 1024 * 1024,
                'keycheck_items': 100, 'keycheck_bytes': 128 * 1024 * 1024,
            },
            reservation_token=f'attribution-{safe_label}',
            bundle_id=hashlib.sha256(f'bundle:{label}'.encode('ascii')).hexdigest()[:32],
            scan_event_id=hashlib.sha256(f'event:{label}'.encode('ascii')).hexdigest()[:32],
        )
        self.assertIsNotNone(claim)
        reservation = db.conn.execute(
            'SELECT * FROM result_reservations WHERE id = ?',
            (claim['reservation_id'],),
        ).fetchone()
        binding_id = None
        manifest_id = None
        target_id = None
        if experiment_bound:
            experiment = db.conn.execute(
                '''INSERT INTO docker_depth_experiments(
                       experiment_key, source, state, config_sha256,
                       ordered_queries_sha256, selector_version, selector_sha256,
                       provenance_policy_sha256, query_count,
                       repositories_per_query, images_per_repository, target_limit,
                       target_count, created_at, updated_at, activated_at
                   ) VALUES (?, 'dockerhub', 'active', ?, ?, 'selector-v1', ?, ?,
                             1, 1, 1, 1, 1, ?, ?, ?) RETURNING id''',
                (
                    f'attribution-{safe_label}', identity, identity, identity, identity,
                    reservation['created_at'], reservation['created_at'],
                    reservation['created_at'],
                ),
            ).fetchone()
            graph_sha256 = depth.canonical_docker_layer_graph_hash(tuple(layers))
            manifest = db.conn.execute(
                '''INSERT INTO docker_image_manifests(
                       target_queue_id, source, repository, manifest_digest,
                       manifest_media_type, graph_sha256, manifest_size_bytes,
                       layer_count, resolved_at, created_at
                   ) VALUES (?, 'dockerhub', ?, ?,
                             'application/vnd.oci.image.manifest.v1+json', ?, 1,
                             ?, ?, ?) RETURNING id''',
                (
                    claim['queue_id'], repository, manifest_digest, graph_sha256,
                    len(layers), reservation['created_at'], reservation['created_at'],
                ),
            ).fetchone()
            manifest_id = int(manifest['id'])
            media_type = 'application/vnd.oci.image.layer.v1.tar+gzip'
            for position, digest in enumerate(layers, 1):
                db.conn.execute(
                    '''INSERT INTO docker_manifest_layers(
                           manifest_id, position_from_base, position_from_top,
                           layer_digest, media_type, layer_size_bytes,
                           descriptor_sha256, created_at
                       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)''',
                    (
                        manifest_id, position, len(layers) - position + 1,
                        digest, media_type, position,
                        depth.canonical_docker_descriptor_hash(
                            digest, media_type, position,
                        ),
                        reservation['created_at'],
                    ),
                )
            target_row = db.conn.execute(
                '''INSERT INTO docker_depth_experiment_targets(
                       experiment_id, target_queue_id, manifest_id,
                       counter_ordinal, state, dispatch_wave, dispatch_order,
                       reservation_count, created_at, updated_at
                   ) VALUES (?, ?, ?, 1, 'reserved', 1, 1, 1, ?, ?)
                   RETURNING id''',
                (
                    experiment['id'], claim['queue_id'], manifest_id,
                    reservation['created_at'], reservation['created_at'],
                ),
            ).fetchone()
            target_id = int(target_row['id'])
            binding = db.conn.execute(
                '''INSERT INTO docker_depth_experiment_scan_bindings(
                       experiment_target_id, reservation_id, attempt, state,
                       bound_at, created_at
                   ) VALUES (?, ?, 1, 'reserved', ?, ?) RETURNING id''',
                (
                    target_id, claim['reservation_id'], reservation['created_at'],
                    reservation['created_at'],
                ),
            ).fetchone()
            binding_id = int(binding['id'])
            db.conn.commit()

        if callable(findings):
            findings = findings(manifest_digest, tuple(layers))
        prepared_findings = []
        for position, finding in enumerate(findings, 1):
            finding = dict(finding)
            finding.setdefault(
                'finding_uid',
                hashlib.sha256(f'{label}:finding:{position}'.encode('ascii')).hexdigest(),
            )
            prepared_findings.append(finding)
        staged = stage_result_bundle(
            {
                'scan_event_id': claim['scan_event_id'],
                'target': claim['target'],
                'scan_type': 'docker',
                'timestamp': '2026-09-10T00:00:00+00:00',
                'scan_started_at': '2026-09-10T00:00:00+00:00',
                'duration_sec': 1.0,
                'findings': prepared_findings,
                'errors': [],
            },
            claim, str(self.bundle_root), {},
            {'queue_status': 'done', 'queue_error': None, 'available_after': None},
            candidate_max_items=10, candidate_max_bytes=1024 * 1024,
        )
        self.assertTrue(db.mark_result_bundle_ready(
            claim['reservation_id'], {
                'bundle_id': staged.bundle_id,
                'scan_event_id': staged.scan_event_id,
                'scan_event_hash': staged.scan_event_hash,
                'relative_path': staged.relative_path,
                'actual_bytes': staged.actual_bytes,
                'frame_count': staged.frame_count,
                'finding_count': staged.finding_count,
                'error_count': staged.error_count,
                'candidate_count': staged.candidate_count,
            },
        ))
        reservation = db.conn.execute(
            'SELECT * FROM result_reservations WHERE id = ?',
            (claim['reservation_id'],),
        ).fetchone()
        bundle = db.conn.execute(
            'SELECT * FROM result_bundles WHERE reservation_id = ?',
            (claim['reservation_id'],),
        ).fetchone()
        db.conn.commit()
        path = self.bundle_root.joinpath(*staged.relative_path.split('/'))
        return {
            'binding_id': binding_id,
            'bundle': dict(bundle),
            'claim': claim,
            'manifest_digest': manifest_digest,
            'manifest_id': manifest_id,
            'path': path,
            'reservation': dict(reservation),
            'target': target,
            'target_id': target_id,
        }

    @staticmethod
    def _ingest_docker_attribution_bundle(db, prepared):
        return db.ingest_result_bundle(
            ResultBundleReader(str(prepared['path'])),
            prepared['reservation'], prepared['bundle'],
        )

    def test_docker_finding_normal_layer_digest_is_attributed_exactly(self):
        db = self._docker_attribution_db()
        try:
            layer_digest = 'sha256:' + ('1' * 64)
            prepared = self._prepare_docker_attribution_bundle(
                db, 'normal-layer', (layer_digest,), ({
                    'DetectorName': 'FixtureNormal',
                    'SourceMetadata': {
                        'Data': {'Docker': {'layer': layer_digest, 'file': '/fixture'}},
                    },
                },),
            )

            outcome = self._ingest_docker_attribution_bundle(db, prepared)

            rows = db.conn.execute(
                '''SELECT attribution_state, reported_layer_digest,
                          unattributed_reason, position_from_base,
                          position_from_top
                   FROM docker_finding_layer_attributions
                   WHERE scan_binding_id = ? ORDER BY id''',
                (prepared['binding_id'],),
            ).fetchall()
            db.conn.commit()
            self.assertFalse(outcome['duplicate'])
            self.assertEqual(
                [(
                    row['attribution_state'], row['reported_layer_digest'],
                    row['unattributed_reason'], row['position_from_base'],
                    row['position_from_top'],
                ) for row in rows],
                [('exact', layer_digest, None, 1, 1)],
            )
        finally:
            db.close()

    def test_docker_finding_duplicate_digest_keeps_every_manifest_position(self):
        db = self._docker_attribution_db()
        try:
            layer_digest = 'sha256:' + ('2' * 64)
            middle_digest = 'sha256:' + ('3' * 64)
            prepared = self._prepare_docker_attribution_bundle(
                db, 'duplicate-layer',
                (layer_digest, middle_digest, layer_digest),
                ({
                    'DetectorName': 'FixtureDuplicate',
                    'SourceMetadata': {'Data': {'Docker': {'layer': layer_digest}}},
                },),
            )

            outcome = self._ingest_docker_attribution_bundle(db, prepared)

            rows = db.conn.execute(
                '''SELECT a.attribution_state, a.reported_layer_digest,
                          a.position_from_base, a.position_from_top,
                          layer.manifest_id, target.manifest_id AS bound_manifest_id,
                          queue.target
                   FROM docker_finding_layer_attributions a
                   JOIN docker_manifest_layers layer ON layer.id = a.manifest_layer_id
                   JOIN docker_depth_experiment_scan_bindings binding
                     ON binding.id = a.scan_binding_id
                   JOIN docker_depth_experiment_targets target
                     ON target.id = binding.experiment_target_id
                   JOIN target_queue queue ON queue.id = target.target_queue_id
                   WHERE a.scan_binding_id = ?
                   ORDER BY a.position_from_base''',
                (prepared['binding_id'],),
            ).fetchall()
            db.conn.commit()
            self.assertEqual(len(rows), 2)
            self.assertEqual(
                [
                    (
                        row['attribution_state'], row['reported_layer_digest'],
                        row['position_from_base'], row['position_from_top'],
                        row['manifest_id'], row['bound_manifest_id'], row['target'],
                    )
                    for row in rows
                ],
                [
                    ('exact', layer_digest, 1, 3, prepared['manifest_id'],
                     prepared['manifest_id'], prepared['target']),
                    ('exact', layer_digest, 3, 1, prepared['manifest_id'],
                     prepared['manifest_id'], prepared['target']),
                ],
            )
            self.assertFalse(outcome['duplicate'])
        finally:
            db.close()

    def test_docker_attribution_fanout_at_limit_keeps_all_positions(self):
        db = self._docker_attribution_db()
        try:
            layer_digest = 'sha256:' + ('2' * 64)
            prepared = self._prepare_docker_attribution_bundle(
                db, 'fanout-at-limit', (layer_digest, layer_digest), ({
                    'DetectorName': 'FixtureFanoutBound',
                    'SourceMetadata': {'Data': {'Docker': {'layer': layer_digest}}},
                },),
            )

            with mock.patch.object(
                scanner_db, 'DOCKER_DEPTH_MAX_ATTRIBUTION_ROWS_PER_BUNDLE', 2,
            ):
                outcome = self._ingest_docker_attribution_bundle(db, prepared)

            self.assertFalse(outcome['duplicate'])
            self.assertEqual(db.conn.execute(
                '''SELECT COUNT(*) AS count
                   FROM docker_finding_layer_attributions
                   WHERE scan_binding_id = ?''',
                (prepared['binding_id'],),
            ).fetchone()['count'], 2)
            db.conn.commit()
        finally:
            db.close()

    def test_docker_attribution_fanout_over_limit_rolls_back_whole_bundle(self):
        db = self._docker_attribution_db()
        try:
            layer_digest = 'sha256:' + ('3' * 64)
            prepared = self._prepare_docker_attribution_bundle(
                db, 'fanout-over-limit', (layer_digest, layer_digest), (
                    {
                        'DetectorName': 'FixtureFanoutOne',
                        'SourceMetadata': {
                            'Data': {'Docker': {'layer': layer_digest}},
                        },
                    },
                    {
                        'DetectorName': 'FixtureFanoutTwo',
                        'SourceMetadata': {
                            'Data': {'Docker': {'layer': layer_digest}},
                        },
                    },
                ),
            )

            with mock.patch.object(
                scanner_db, 'DOCKER_DEPTH_MAX_ATTRIBUTION_ROWS_PER_BUNDLE', 3,
            ), self.assertRaises(DockerFindingAttributionLimitError):
                self._ingest_docker_attribution_bundle(db, prepared)

            state = db.conn.execute(
                '''SELECT reservation.state AS reservation_state,
                          bundle.state AS bundle_state,
                          (SELECT COUNT(*) FROM target_scans
                           WHERE result_reservation_id = reservation.id) AS scans,
                          (SELECT COUNT(*) FROM findings) AS findings,
                          (SELECT COUNT(*)
                           FROM docker_finding_layer_attributions) AS attributions
                   FROM result_reservations reservation
                   JOIN result_bundles bundle
                     ON bundle.reservation_id = reservation.id
                   WHERE reservation.id = ?''',
                (prepared['claim']['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                tuple(state[name] for name in (
                    'reservation_state', 'bundle_state', 'scans', 'findings',
                    'attributions',
                )),
                ('ready', 'ready', 0, 0, 0),
            )
            ingester = ResultIngester(
                db, str(self.bundle_root), 'attribution-supervisor',
            )
            ingester.lease = {
                'generation': 1, 'lease_token': 'attribution-ingester',
            }
            with mock.patch.object(
                scanner_db, 'DOCKER_DEPTH_MAX_ATTRIBUTION_ROWS_PER_BUNDLE', 3,
            ):
                self.assertTrue(ingester.process_one())
            quarantined = db.conn.execute(
                '''SELECT reservation.state AS reservation_state,
                          binding.state AS binding_state,
                          target.state AS target_state,
                          quarantine.reason_code
                   FROM result_reservations reservation
                   JOIN docker_depth_experiment_scan_bindings binding
                     ON binding.reservation_id = reservation.id
                   JOIN docker_depth_experiment_targets target
                     ON target.id = binding.experiment_target_id
                   JOIN pipeline_quarantine quarantine
                     ON quarantine.reservation_id = reservation.id
                   WHERE reservation.id = ?''',
                (prepared['claim']['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                tuple(quarantined[name] for name in (
                    'reservation_state', 'binding_state', 'target_state',
                    'reason_code',
                )),
                (
                    'quarantined', 'quarantined', 'quarantined',
                    'docker_attribution_limit_exceeded',
                ),
            )
        finally:
            db.close()

    def test_docker_content_fallback_uses_blob_and_bound_manifest_only(self):
        db = self._docker_attribution_db()
        try:
            first_digest = 'sha256:' + ('4' * 64)
            layer_digest = 'sha256:' + ('5' * 64)

            def findings(manifest_digest, _layers):
                return ({
                    'DetectorName': 'FixtureFallback',
                    'SourceMetadata': {'Data': {'DockerContent': {
                        'manifest_digest': manifest_digest,
                        'blob_digest': layer_digest,
                        'descriptor_kind': 'layer',
                        'positions': [99],
                    }}},
                },)

            prepared = self._prepare_docker_attribution_bundle(
                db, 'docker-content', (first_digest, layer_digest), findings,
            )
            self._ingest_docker_attribution_bundle(db, prepared)

            row = db.conn.execute(
                '''SELECT attribution_state, reported_layer_digest,
                          position_from_base, position_from_top,
                          unattributed_reason
                   FROM docker_finding_layer_attributions
                   WHERE scan_binding_id = ?''',
                (prepared['binding_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    row['attribution_state'], row['reported_layer_digest'],
                    row['position_from_base'], row['position_from_top'],
                    row['unattributed_reason'],
                ),
                ('exact', layer_digest, 2, 1, None),
            )
        finally:
            db.close()

    def test_docker_finding_invalid_evidence_is_explicitly_unattributed(self):
        db = self._docker_attribution_db()
        try:
            layer_digest = 'sha256:' + ('6' * 64)
            absent_digest = 'sha256:' + ('7' * 64)
            other_manifest = 'sha256:' + ('8' * 64)

            def findings(manifest_digest, _layers):
                return (
                    {'DetectorName': 'FixtureAbsent'},
                    {
                        'DetectorName': 'FixtureMalformed',
                        'SourceMetadata': {
                            'Data': {'Docker': {'layer': 'sha256:' + ('A' * 64)}},
                        },
                    },
                    {
                        'DetectorName': 'FixtureNotInManifest',
                        'SourceMetadata': {
                            'Data': {'Docker': {'layer': absent_digest}},
                        },
                    },
                    {
                        'DetectorName': 'FixtureManifestMismatch',
                        'SourceMetadata': {'Data': {'DockerContent': {
                            'manifest_digest': other_manifest,
                            'blob_digest': layer_digest,
                            'descriptor_kind': 'layer',
                        }}},
                    },
                    {
                        'DetectorName': 'FixtureMalformedFallback',
                        'SourceMetadata': {'Data': {'DockerContent': {
                            'manifest_digest': manifest_digest,
                            'blob_digest': 'not-a-digest',
                            'descriptor_kind': 'layer',
                        }}},
                    },
                )

            prepared = self._prepare_docker_attribution_bundle(
                db, 'unattributed', (layer_digest,), findings,
            )
            self._ingest_docker_attribution_bundle(db, prepared)

            rows = db.conn.execute(
                '''SELECT finding.detector_name, attribution.attribution_state,
                          attribution.unattributed_reason,
                          attribution.reported_layer_digest,
                          attribution.manifest_layer_id
                   FROM docker_finding_layer_attributions attribution
                   JOIN findings finding ON finding.id = attribution.finding_id
                   WHERE attribution.scan_binding_id = ?
                   ORDER BY finding.detector_name''',
                (prepared['binding_id'],),
            ).fetchall()
            db.conn.commit()
            self.assertEqual(
                {
                    row['detector_name']: (
                        row['attribution_state'], row['unattributed_reason'],
                        row['reported_layer_digest'], row['manifest_layer_id'],
                    )
                    for row in rows
                },
                {
                    'FixtureAbsent': ('unattributed', 'digest_absent', None, None),
                    'FixtureMalformed': ('unattributed', 'digest_invalid', None, None),
                    'FixtureNotInManifest': (
                        'unattributed', 'digest_not_in_manifest', None, None,
                    ),
                    'FixtureManifestMismatch': (
                        'unattributed', 'manifest_mismatch', None, None,
                    ),
                    'FixtureMalformedFallback': (
                        'unattributed', 'digest_invalid', None, None,
                    ),
                },
            )
            self.assertEqual(len(rows), 5)
        finally:
            db.close()

    def test_docker_finding_unbound_and_stale_reservations_are_not_attributed(self):
        db = self._docker_attribution_db()
        try:
            layer_digest = 'sha256:' + ('9' * 64)
            finding = ({
                'DetectorName': 'FixtureUnbound',
                'SourceMetadata': {'Data': {'Docker': {'layer': layer_digest}}},
            },)
            unbound = self._prepare_docker_attribution_bundle(
                db, 'unbound', (layer_digest,), finding, experiment_bound=False,
            )
            self._ingest_docker_attribution_bundle(db, unbound)
            self.assertEqual(db.conn.execute(
                'SELECT COUNT(*) AS count FROM docker_finding_layer_attributions'
            ).fetchone()['count'], 0)
            db.conn.commit()

            stale = self._prepare_docker_attribution_bundle(
                db, 'stale', (layer_digest,), finding,
            )
            current_generation_pass = db.conn.execute(
                '''UPDATE docker_depth_experiment_targets
                   SET reservation_count = 2 WHERE id = ?''',
                (stale['target_id'],),
            )
            db.conn.commit()
            with self.assertRaisesRegex(
                    ScanEventConflictError, 'exact reservation target identity'):
                self._ingest_docker_attribution_bundle(db, stale)
            state = db.conn.execute(
                '''SELECT reservation.state AS reservation_state,
                          bundle.state AS bundle_state,
                          (SELECT COUNT(*) FROM target_scans
                           WHERE result_reservation_id = reservation.id) AS scan_count,
                          (SELECT COUNT(*) FROM docker_finding_layer_attributions
                           WHERE scan_binding_id = ?) AS attribution_count
                   FROM result_reservations reservation
                   JOIN result_bundles bundle
                     ON bundle.reservation_id = reservation.id
                   WHERE reservation.id = ?''',
                (stale['binding_id'], stale['claim']['reservation_id']),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    state['reservation_state'], state['bundle_state'],
                    state['scan_count'], state['attribution_count'],
                ),
                ('ready', 'ready', 0, 0),
            )
        finally:
            db.close()

    def test_ingestion_rejects_cross_reservation_bundle_target_without_leaking_it(self):
        db = self._docker_attribution_db()
        try:
            prepared = self._prepare_docker_attribution_bundle(
                db, 'cross-reservation-content',
                ('sha256:' + ('9' * 64),), (),
            )
            prepared['path'].unlink()
            cross_target = 'owner/private-cross-reservation@sha256:' + ('8' * 64)
            cross_secret = 'SECRET_CROSS_RESERVATION_SENTINEL'
            with ResultBundleWriter.open(
                str(self.bundle_root), BundleReservation.from_mapping(prepared['claim']),
            ) as writer:
                writer.write_finding({
                    'DetectorName': 'FixtureCrossReservation',
                    'Raw': cross_secret,
                    'finding_uid': '7' * 64,
                })
                commit = writer.finish({
                    'reservation_id': prepared['claim']['reservation_id'],
                    'queue_id': prepared['claim']['queue_id'],
                    'bundle_id': prepared['claim']['bundle_id'],
                    'scan_event_id': prepared['claim']['scan_event_id'],
                    'source': 'dockerhub', 'platform': 'docker',
                    'query': prepared['claim']['query'],
                    'target': cross_target,
                    'normalized_target': cross_target,
                    'scan_type': 'docker', 'status': 'found',
                    'timestamp': '2026-09-10T00:00:00+00:00',
                    'queue_status': 'done',
                })
            db.conn.execute(
                '''UPDATE result_bundles
                   SET scan_event_hash = ?, actual_bytes = ?, frame_count = ?,
                       finding_count = ?, error_count = ?, candidate_count = ?
                   WHERE reservation_id = ?''',
                (
                    commit.scan_event_hash, commit.actual_bytes, commit.frame_count,
                    commit.finding_count, commit.error_count,
                    commit.candidate_count, prepared['claim']['reservation_id'],
                ),
            )
            bundle = dict(db.conn.execute(
                'SELECT * FROM result_bundles WHERE reservation_id = ?',
                (prepared['claim']['reservation_id'],),
            ).fetchone())
            db.conn.commit()

            with self.assertRaisesRegex(ValueError, 'scan identity') as raised:
                db.ingest_result_bundle(
                    ResultBundleReader(str(prepared['path'])),
                    prepared['reservation'], bundle,
                )

            self.assertNotIn(cross_target, str(raised.exception))
            self.assertNotIn(cross_secret, str(raised.exception))
            state = db.conn.execute(
                '''SELECT reservation.state AS reservation_state,
                          bundle.state AS bundle_state,
                          (SELECT COUNT(*) FROM target_scans) AS scans,
                          (SELECT COUNT(*) FROM findings) AS findings
                   FROM result_reservations reservation
                   JOIN result_bundles bundle
                     ON bundle.reservation_id = reservation.id
                   WHERE reservation.id = ?''',
                (prepared['claim']['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                tuple(state[name] for name in (
                    'reservation_state', 'bundle_state', 'scans', 'findings',
                )),
                ('ready', 'ready', 0, 0),
            )
        finally:
            db.close()

    def test_docker_finding_attribution_replay_and_concurrent_ingestion_are_idempotent(self):
        db = self._docker_attribution_db()
        try:
            layer_digest = 'sha256:' + ('a' * 64)
            prepared = self._prepare_docker_attribution_bundle(
                db, 'concurrent-replay', (layer_digest,), ({
                    'DetectorName': 'FixtureReplay',
                    'SourceMetadata': {'Data': {'Docker': {'layer': layer_digest}}},
                },),
            )
            barrier = threading.Barrier(2)
            outcomes = []
            errors = []

            def ingest():
                thread_db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    barrier.wait(timeout=10)
                    outcomes.append(self._ingest_docker_attribution_bundle(
                        thread_db, prepared,
                    ))
                except Exception as exc:
                    errors.append(exc)
                finally:
                    thread_db.close()

            threads = [threading.Thread(target=ingest) for _ in range(2)]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(timeout=15)
            self.assertTrue(all(not thread.is_alive() for thread in threads))
            self.assertFalse(errors, errors)
            self.assertEqual(
                sorted(outcome['duplicate'] for outcome in outcomes),
                [False, True],
            )
            replay = self._ingest_docker_attribution_bundle(db, prepared)
            self.assertTrue(replay['duplicate'])
            counts = db.conn.execute(
                '''SELECT
                       (SELECT COUNT(*) FROM target_scans
                        WHERE result_reservation_id = ?) AS scans,
                       (SELECT COUNT(*) FROM findings
                        WHERE target_scan_id = ?) AS findings,
                       (SELECT COUNT(*) FROM docker_finding_layer_attributions
                        WHERE scan_binding_id = ?) AS attributions''',
                (
                    prepared['claim']['reservation_id'], replay['target_scan_id'],
                    prepared['binding_id'],
                ),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (counts['scans'], counts['findings'], counts['attributions']),
                (1, 1, 1),
            )
        finally:
            db.close()

    def test_docker_finding_attribution_failure_rolls_back_result_bundle(self):
        import psycopg

        db = self._docker_attribution_db()
        try:
            layer_digest = 'sha256:' + ('b' * 64)
            prepared = self._prepare_docker_attribution_bundle(
                db, 'attribution-rollback', (layer_digest,), ({
                    'DetectorName': 'FixtureRollback',
                    'SourceMetadata': {'Data': {'Docker': {'layer': layer_digest}}},
                },),
            )
            db.conn.execute(
                '''CREATE FUNCTION fail_finding_layer_attribution() RETURNS trigger
                   LANGUAGE plpgsql AS $$
                   BEGIN RAISE EXCEPTION 'synthetic attribution rollback'; END $$'''
            )
            db.conn.execute(
                '''CREATE TRIGGER fail_finding_layer_attribution
                   BEFORE INSERT ON docker_finding_layer_attributions
                   FOR EACH ROW EXECUTE FUNCTION fail_finding_layer_attribution()'''
            )
            db.conn.commit()

            with self.assertRaises(psycopg.errors.RaiseException):
                self._ingest_docker_attribution_bundle(db, prepared)

            state = db.conn.execute(
                '''SELECT reservation.state AS reservation_state,
                          bundle.state AS bundle_state,
                          queue.status AS queue_state,
                          (SELECT COUNT(*) FROM target_scans
                           WHERE result_reservation_id = reservation.id) AS scans,
                          (SELECT COUNT(*) FROM findings) AS findings,
                          (SELECT COUNT(*) FROM docker_finding_layer_attributions)
                              AS attributions
                   FROM result_reservations reservation
                   JOIN result_bundles bundle
                     ON bundle.reservation_id = reservation.id
                   JOIN target_queue queue ON queue.id = reservation.queue_id
                   WHERE reservation.id = ?''',
                (prepared['claim']['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    state['reservation_state'], state['bundle_state'],
                    state['queue_state'], state['scans'], state['findings'],
                    state['attributions'],
                ),
                ('ready', 'ready', 'in_progress', 0, 0, 0),
            )

            db.conn.execute(
                'DROP TRIGGER fail_finding_layer_attribution '
                'ON docker_finding_layer_attributions'
            )
            db.conn.execute('DROP FUNCTION fail_finding_layer_attribution()')
            db.conn.commit()
            outcome = self._ingest_docker_attribution_bundle(db, prepared)
            self.assertFalse(outcome['duplicate'])
            self.assertEqual(db.conn.execute(
                '''SELECT COUNT(*) AS count
                   FROM docker_finding_layer_attributions
                   WHERE scan_binding_id = ?''',
                (prepared['binding_id'],),
            ).fetchone()['count'], 1)
            db.conn.commit()
        finally:
            db.close()

    def test_docker_depth_report_leaves_postgres_connection_idle(self):
        import psycopg

        db = self._docker_attribution_db()
        try:
            prepared = self._prepare_docker_attribution_bundle(
                db, 'report-transaction-state',
                ('sha256:' + ('c' * 64),), (),
            )

            experiment_id = db.conn.execute(
                '''SELECT experiment_id
                   FROM docker_depth_experiment_targets WHERE id = ?''',
                (prepared['target_id'],),
            ).fetchone()['experiment_id']
            db.conn.commit()
            report = build_docker_depth_report(
                db.conn, experiment_id=experiment_id,
            )

            self.assertEqual(
                db.conn._conn.info.transaction_status,
                psycopg.pq.TransactionStatus.IDLE,
            )
            self.assertTrue(report['snapshot']['read_only'])
            self.assertEqual(
                report['snapshot']['consistency'], 'repeatable_read',
            )
            self.assertEqual(report['physical']['totals']['target_count'], 1)
            self.assertEqual(report['physical']['totals']['targets_with_scans'], 0)
        finally:
            db.close()

    def test_docker_depth_schema_constraints_and_fk_actions_fail_closed(self):
        import psycopg

        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            for table, name in scanner_db.DOCKER_DEPTH_SCHEMA_AUTHORITY_CHECKS:
                db.conn.execute(
                    f'ALTER TABLE {scanner_db._quoted_pg_name(table)} '
                    f'DROP CONSTRAINT {scanner_db._quoted_pg_name(name)}'
                )
            db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                (scanner_db.DOCKER_DEPTH_SCHEMA_SELECTOR_AUTHORITY_MIGRATION,),
            )
            db.conn.commit()
            self.assertFalse(db.runtime_safety_schema_available())
            migrate_runtime_safety_schema(db)
            migrate_runtime_safety_schema(db)
            marker = db.conn.execute(
                '''SELECT COUNT(*) AS count, MIN(code_sha256) AS code_sha256
                   FROM runtime_schema_migrations WHERE version = ?''',
                (scanner_db.DOCKER_DEPTH_SCHEMA_SELECTOR_AUTHORITY_MIGRATION,),
            ).fetchone()
            self.assertEqual(marker['count'], 1)
            self.assertEqual(
                marker['code_sha256'],
                hashlib.sha256(PIPELINE_SCHEMA_SQL.encode('utf-8')).hexdigest(),
            )
            self.assertTrue(db.runtime_safety_schema_available(), db.last_error)
            generation_policy = '8' * 64
            generation_queries = '9' * 64
            self.assertFalse(db.dockerhub_discovery_generation_complete(
                'dockerhub', depth.DOCKER_DEPTH_COLLECTION_GENERATION,
                generation_queries, 61, generation_policy,
            ))
            generation_now = scanner_db.utc_now_iso()
            db.conn.execute(
                '''INSERT INTO docker_discovery_passes(
                       pass_token, source, pass_kind, collection_generation,
                       policy_sha256, ordered_queries_sha256,
                       expected_query_count, completed_query_count, state,
                       started_at, completed_at, created_at, updated_at
                    ) VALUES ('pg-legacy-generation', 'dockerhub', 'deep', 'legacy',
                             ?, ?, 61, 61, 'complete', ?, ?, ?, ?)''',
                (
                    generation_policy, generation_queries, generation_now,
                    generation_now, generation_now, generation_now,
                ),
            )
            db.conn.commit()
            self.assertFalse(db.dockerhub_discovery_generation_complete(
                'dockerhub', depth.DOCKER_DEPTH_COLLECTION_GENERATION,
                generation_queries, 61, generation_policy,
            ))
            current_generation_pass = db.conn.execute(
                '''INSERT INTO docker_discovery_passes(
                       pass_token, source, pass_kind, collection_generation,
                       policy_sha256, ordered_queries_sha256,
                       expected_query_count, completed_query_count, state,
                       started_at, completed_at, created_at, updated_at
                     ) VALUES ('pg-current-generation', 'dockerhub', 'deep', ?,
                              ?, ?, 61, 61, 'complete', ?, ?, ?, ?)
                    RETURNING id''',
                (
                    depth.DOCKER_DEPTH_COLLECTION_GENERATION,
                    generation_policy, generation_queries, generation_now,
                    generation_now, generation_now, generation_now,
                ),
            ).fetchone()
            db.conn.execute(
                '''INSERT INTO docker_discovery_pages(
                       pass_id, query, query_ordinal, page_number, result_count,
                       total_count, admitted_count, query_complete, admission_kind,
                       page_sha256, observed_at, created_at
                   ) SELECT ?, 'generation-' || ordinal, ordinal, 1, 0, 0, 0, 1,
                            'main', lpad(to_hex(ordinal + 1), 64, '0'), ?, ?
                     FROM generate_series(0, 60) AS ordinal''',
                (current_generation_pass['id'], generation_now, generation_now),
            )
            db.conn.commit()
            self.assertTrue(db.dockerhub_discovery_generation_complete(
                'dockerhub', depth.DOCKER_DEPTH_COLLECTION_GENERATION,
                generation_queries, 61, generation_policy,
            ))
            for table, expected_constraints in (
                scanner_db.DOCKER_DEPTH_EXPERIMENT_CHECK_SPECS.items()
            ):
                constraints = db.conn.table_check_constraints(table)
                for name, expression in expected_constraints.items():
                    self.assertIn(name, constraints)
                    self.assertTrue(constraints[name]['valid'])
                    self.assertEqual(
                        scanner_db._normalized_check_expression(
                            constraints[name]['expression'],
                        ),
                        scanner_db._normalized_check_expression(expression),
                    )

            foreign_key_tables = set(scanner_db.DOCKER_DEPTH_EXPERIMENT_TABLES) | {
                'discovery_retry_queue', 'target_queue_policy_events',
            }
            for foreign_key_table in foreign_key_tables:
                foreign_keys = db.conn.table_foreign_keys(foreign_key_table)
                for columns, referenced_table, referenced_columns in (
                    scanner_db.REQUIRED_FOREIGN_KEYS.get(foreign_key_table, ())
                ):
                    matches = [
                        foreign_key for foreign_key in foreign_keys.values()
                        if tuple(foreign_key['columns']) == columns
                        and foreign_key['referenced_table'] == referenced_table
                        and tuple(foreign_key['referenced_columns']) == referenced_columns
                    ]
                    self.assertEqual(len(matches), 1)
                    self.assertEqual(
                        (matches[0]['update_action'], matches[0]['delete_action']),
                        scanner_db._required_foreign_key_actions(
                            foreign_key_table, columns,
                        ),
                    )

            now = datetime.now(timezone.utc).isoformat(timespec='seconds')
            with self.assertRaises(psycopg.errors.CheckViolation):
                db.conn.execute(
                    '''INSERT INTO docker_depth_experiments(
                           experiment_key, source, config_sha256,
                           ordered_queries_sha256, selector_version,
                           selector_sha256, provenance_policy_sha256,
                           query_count, repositories_per_query,
                           images_per_repository, target_limit, created_at, updated_at
                       ) VALUES ('invalid-hash', 'dockerhub', ?, ?, 'selector-v1',
                                 ?, ?, 1, 1, 1, 1, ?, ?)''',
                    ('g' * 64, 'a' * 64, 'b' * 64, 'c' * 64, now, now),
                )
            db.conn.rollback()

            with self.assertRaises(psycopg.errors.CheckViolation):
                db.conn.execute(
                    '''INSERT INTO discovery_retry_queue(
                           work_key, source, query, policy_sha256, pass_kind,
                           work_kind, page_start, page_end, next_page, status,
                           attempts, created_at, updated_at
                       ) VALUES (?, 'dockerhub', 'pg-check-query', ?, 'ordinary',
                                 'page', 1, 1, 1, 'pending', 0, ?, ?)''',
                    ('a' * 64, 'A' * 64, now, now),
                )
            db.conn.rollback()

            db.enqueue_targets(
                'dockerhub', 'docker', 'pg-policy-query', ['owner/pg-policy'],
            )
            queue = db.conn.execute(
                '''SELECT id, updated_at FROM target_queue
                   WHERE source = 'dockerhub' AND normalized_target = 'owner/pg-policy' ''',
            ).fetchone()
            policy_experiment = db.conn.execute(
                '''INSERT INTO docker_depth_experiments(
                       experiment_key, source, config_sha256,
                       ordered_queries_sha256, selector_version, selector_sha256,
                       provenance_policy_sha256, query_count,
                       repositories_per_query, images_per_repository, target_limit,
                       created_at, updated_at
                   ) VALUES ('pg-policy-check', 'dockerhub', ?, ?, 'selector-v1',
                             ?, ?, 1, 1, 1, 1, ?, ?) RETURNING id''',
                ('1' * 64, '2' * 64, '3' * 64, '4' * 64, now, now),
            ).fetchone()
            db.conn.commit()
            invalid_policy_events = (
                (
                    "'cold', 'deferred', 'cold', "
                    "'dockerhub', 'docker', 'pg-policy-query', "
                    "'docker_depth_experiment_hold', NULL",
                    '5' * 64,
                ),
                (
                    "'reactivate', 'cold', 'pending', "
                    "'dockerhub', 'docker', 'pg-policy-query', "
                    "'reviewed_policy_reactivation', NULL",
                    '6' * 64,
                ),
                (
                    "'cold', 'deferred', 'cold', "
                    "'dockerhub', 'docker', 'pg-policy-query', "
                    "'docker_depth_experiment_hold', ?",
                    'A' * 64,
                ),
            )
            for values_sql, config_sha256 in invalid_policy_events:
                with self.subTest(policy_values=values_sql), self.assertRaises(
                    psycopg.errors.CheckViolation
                ):
                    params = [queue['id']]
                    if values_sql.endswith('?'):
                        params.append(policy_experiment['id'])
                    params.extend((
                        config_sha256, '7' * 64, '8' * 64, '9' * 64,
                        queue['updated_at'], now,
                    ))
                    db.conn.execute(
                        f'''INSERT INTO target_queue_policy_events(
                                queue_id, action, prior_status, next_status,
                                source, platform, query, reason_code, experiment_id,
                                config_sha256, policy_sha256, manifest_sha256,
                                review_audit_sha256, prior_updated_at, created_at
                            ) VALUES (?, {values_sql}, ?, ?, ?, ?, ?, ?)''',
                        tuple(params),
                    )
                db.conn.rollback()

            table = 'docker_depth_experiments'
            dropped_name = 'docker_depth_experiments_capacity_check'
            db.conn.execute(
                f'ALTER TABLE {table} DROP CONSTRAINT {dropped_name}'
            )
            self.assertFalse(db.runtime_safety_schema_available(commit=False))
            self.assertIn(dropped_name, db.last_error)
            with self.assertRaisesRegex(RuntimeSafetySchemaError, 'noncanonical check constraint'):
                migrate_runtime_safety_schema(db)
            self.assertTrue(db.runtime_safety_schema_available(), db.last_error)

            malformed_name = 'docker_depth_experiments_identity_check'
            db.conn.execute(
                f'ALTER TABLE {table} DROP CONSTRAINT {malformed_name}'
            )
            db.conn.execute(
                f'''ALTER TABLE {table} ADD CONSTRAINT {malformed_name}
                    CHECK (length(config_sha256) = 64)'''
            )
            self.assertFalse(db.runtime_safety_schema_available(commit=False))
            self.assertIn(malformed_name, db.last_error)
            with self.assertRaisesRegex(RuntimeSafetySchemaError, 'noncanonical check constraint'):
                migrate_runtime_safety_schema(db)
            self.assertTrue(db.runtime_safety_schema_available(), db.last_error)

            unvalidated_name = 'docker_depth_experiments_fence_check'
            unvalidated_expression = scanner_db.DOCKER_DEPTH_EXPERIMENT_CHECK_SPECS[
                table
            ][unvalidated_name]
            db.conn.execute(
                f'ALTER TABLE {table} DROP CONSTRAINT {unvalidated_name}'
            )
            db.conn.execute(
                f'''ALTER TABLE {table} ADD CONSTRAINT {unvalidated_name}
                    CHECK ({unvalidated_expression}) NOT VALID'''
            )
            self.assertFalse(db.runtime_safety_schema_available(commit=False))
            self.assertIn(unvalidated_name, db.last_error)
            with self.assertRaisesRegex(RuntimeSafetySchemaError, 'noncanonical check constraint'):
                migrate_runtime_safety_schema(db)
            self.assertTrue(db.runtime_safety_schema_available(), db.last_error)

            for malformed_table, malformed_check in (
                ('discovery_retry_queue', 'discovery_retry_queue_lifecycle_check'),
                (
                    'target_queue_policy_events',
                    'target_queue_policy_events_transition_check',
                ),
            ):
                with self.subTest(
                    malformed_table=malformed_table,
                    malformed_check=malformed_check,
                ):
                    db.conn.execute(
                        f'ALTER TABLE {scanner_db._quoted_pg_name(malformed_table)} '
                        f'DROP CONSTRAINT {scanner_db._quoted_pg_name(malformed_check)}'
                    )
                    db.conn.execute(
                        f'ALTER TABLE {scanner_db._quoted_pg_name(malformed_table)} '
                        f'ADD CONSTRAINT {scanner_db._quoted_pg_name(malformed_check)} '
                        'CHECK (1 = 1)'
                    )
                    self.assertFalse(
                        db.runtime_safety_schema_available(commit=False)
                    )
                    self.assertIn(malformed_check, db.last_error)
                    with self.assertRaisesRegex(
                        RuntimeSafetySchemaError, 'noncanonical check constraint',
                    ):
                        migrate_runtime_safety_schema(db)
                    self.assertTrue(
                        db.runtime_safety_schema_available(), db.last_error,
                    )

            binding_table = 'docker_depth_experiment_scan_bindings'
            foreign_keys = db.conn.table_foreign_keys(binding_table)
            foreign_key_name = next(
                name for name, foreign_key in foreign_keys.items()
                if foreign_key['columns'] == ['experiment_target_id']
            )
            db.conn.execute(
                f'ALTER TABLE {binding_table} DROP CONSTRAINT '
                f'{scanner_db._quoted_pg_name(foreign_key_name)}'
            )
            db.conn.execute(
                f'''ALTER TABLE {binding_table}
                    ADD CONSTRAINT {scanner_db._quoted_pg_name(foreign_key_name)}
                    FOREIGN KEY (experiment_target_id)
                    REFERENCES public.docker_depth_experiment_targets(id)
                    ON UPDATE NO ACTION ON DELETE CASCADE'''
            )
            self.assertFalse(db.runtime_safety_schema_available(commit=False))
            self.assertIn('actions ON UPDATE NO ACTION ON DELETE NO ACTION', db.last_error)
            with self.assertRaisesRegex(RuntimeSafetySchemaError, 'foreign key actions'):
                migrate_runtime_safety_schema(db)
            self.assertTrue(db.runtime_safety_schema_available(), db.last_error)
        finally:
            db.close()

    def test_docker_depth_scarcity_cohort_migration_backfills_existing_queries(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            now = scanner_db.utc_now_iso()
            digest = '7' * 64
            experiment_id = db.conn.execute(
                '''INSERT INTO docker_depth_experiments(
                       experiment_key, source, state, config_sha256,
                       ordered_queries_sha256, selector_version, selector_sha256,
                       provenance_policy_sha256, query_count,
                       repositories_per_query, images_per_repository, target_limit,
                       created_at, updated_at
                   ) VALUES ('scarcity-migration', 'dockerhub', 'held', ?, ?,
                             'selector-v1', ?, ?, 1, 10, 10, 1200, ?, ?)
                   RETURNING id''',
                (digest, digest, digest, digest, now, now),
            ).fetchone()['id']
            db.conn.execute(
                '''INSERT INTO docker_depth_experiment_queries(
                       experiment_id, source, query_ordinal, query, query_sha256,
                       required_repository_count, selected_repository_count,
                       created_at
                   ) VALUES (?, 'dockerhub', 0, 'scarcity-query', ?, 7, 7, ?)''',
                (experiment_id, digest, now),
            )
            db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                (scanner_db.DOCKER_DEPTH_SCARCITY_COHORT_MIGRATION,),
            )
            db.conn.execute(
                '''ALTER TABLE docker_depth_experiment_queries
                   DROP COLUMN selected_repository_count'''
            )
            db.conn.commit()

            self.assertFalse(db.runtime_safety_schema_available())
            migrate_runtime_safety_schema(db)
            migrate_runtime_safety_schema(db)

            row = db.conn.execute(
                '''SELECT required_repository_count, selected_repository_count
                   FROM docker_depth_experiment_queries
                   WHERE experiment_id = ? AND query_ordinal = 0''',
                (experiment_id,),
            ).fetchone()
            self.assertEqual(
                (row['required_repository_count'], row['selected_repository_count']),
                (7, 7),
            )
            self.assertIn(
                'docker_depth_experiment_queries_selection_check',
                db.conn.table_check_constraints('docker_depth_experiment_queries'),
            )
            marker = db.conn.execute(
                '''SELECT COUNT(*) AS count
                   FROM runtime_schema_migrations WHERE version = ?''',
                (scanner_db.DOCKER_DEPTH_SCARCITY_COHORT_MIGRATION,),
            ).fetchone()
            self.assertEqual(marker['count'], 1)
            self.assertTrue(db.runtime_safety_schema_available(), db.last_error)
        finally:
            db.close()

    def test_docker_depth_hold_query_index_migration_is_additive(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.conn.execute('DROP INDEX idx_target_scans_queue_id')
            db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                (scanner_db.DOCKER_DEPTH_HOLD_QUERY_INDEX_MIGRATION,),
            )
            db.conn.commit()

            self.assertFalse(db.runtime_safety_schema_available())
            migrate_runtime_safety_schema(db)
            migrate_runtime_safety_schema(db)
            index = db.conn.table_indexes('target_scans')[
                'idx_target_scans_queue_id'
            ]
            self.assertEqual(index['columns'], ['queue_id'])
            marker = db.conn.execute(
                '''SELECT COUNT(*) AS count
                   FROM runtime_schema_migrations WHERE version = ?''',
                (scanner_db.DOCKER_DEPTH_HOLD_QUERY_INDEX_MIGRATION,),
            ).fetchone()
            self.assertEqual(marker['count'], 1)
            self.assertTrue(db.runtime_safety_schema_available(), db.last_error)
        finally:
            db.close()

    def test_discovery_retry_migration_concurrent_claim_reclaim_and_fencing(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        retry_db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)
            self.assertTrue(setup_db.runtime_safety_schema_available(), setup_db.last_error)
            self.assertEqual(
                set(setup_db.conn.table_columns('discovery_retry_queue')),
                set(scanner_db.DISCOVERY_RETRY_QUEUE_COLUMN_SPECS),
            )
            indexes = setup_db.conn.table_indexes('discovery_retry_queue')
            self.assertTrue(indexes['uq_discovery_retry_queue_work_key']['unique'])
            self.assertEqual(
                indexes['idx_discovery_retry_queue_due']['columns'],
                ['source', 'available_after', 'id'],
            )
            marker = setup_db.conn.execute(
                'SELECT version FROM runtime_schema_migrations WHERE version = ?',
                (PIPELINE_MIGRATION_VERSIONS[-1],),
            ).fetchone()
            self.assertIsNotNone(marker)

            policy = 'c' * 64
            enqueued = setup_db.enqueue_discovery_retry(
                'dockerhub', 'integration-query', policy, 'ordinary', 'page', 2, 2,
                error_category='network',
            )
            coalesced = setup_db.enqueue_discovery_retry(
                'dockerhub', 'integration-query', policy, 'ordinary', 'page', 2, 2,
                error_category='auth_unavailable',
            )
            self.assertEqual(coalesced['id'], enqueued['id'])
            self.assertEqual(coalesced['inserted_count'], 0)
            self.assertEqual(coalesced['coalesced_count'], 1)
            barrier = threading.Barrier(2)
            claims = []
            failures = []
            claim_lock = threading.Lock()

            def claim(owner):
                db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    barrier.wait(10)
                    result = db.claim_discovery_retries(
                        'dockerhub', {'integration-query': policy}, owner,
                        limit=1, lease_seconds=60,
                    )
                    with claim_lock:
                        claims.extend(result)
                except Exception as exc:
                    with claim_lock:
                        failures.append(exc)
                finally:
                    db.close()

            workers = [
                threading.Thread(target=claim, args=(f'owner-{index}',))
                for index in range(2)
            ]
            for worker in workers:
                worker.start()
            for worker in workers:
                worker.join(15)
            self.assertFalse(failures)
            self.assertEqual(len(claims), 1)
            first_claim = claims[0]
            self.assertEqual(first_claim['id'], enqueued['id'])
            renewed = setup_db.renew_discovery_retry_lease(
                first_claim['id'], first_claim['lease_owner'],
                first_claim['lease_token'], lease_seconds=120,
            )
            self.assertEqual(renewed['status'], 'leased')
            self.assertGreater(
                renewed['lease_expires_at'], first_claim['lease_expires_at'],
            )

            setup_db.conn.execute(
                "UPDATE discovery_retry_queue SET lease_expires_at = '2000-01-01T00:00:00+00:00' WHERE id = ?",
                (enqueued['id'],),
            )
            setup_db.conn.commit()
            reclaimed = retry_db.claim_discovery_retries(
                'dockerhub', {'integration-query': policy}, 'reclaimer',
                limit=1, lease_seconds=60,
            )[0]
            self.assertEqual(reclaimed['attempts'], 2)
            self.assertNotEqual(reclaimed['lease_token'], first_claim['lease_token'])
            with self.assertRaises(DiscoveryRetryLeaseError):
                setup_db.finish_discovery_retry(
                    first_claim['id'], first_claim['lease_owner'], first_claim['lease_token'],
                )

            deferred = retry_db.update_discovery_retry(
                reclaimed['id'], reclaimed['lease_owner'], reclaimed['lease_token'],
                'remote_transient',
            )
            self.assertEqual(deferred['attempts'], 2)
            retry_db.conn.execute(
                'UPDATE discovery_retry_queue SET available_after = NULL WHERE id = ?',
                (enqueued['id'],),
            )
            retry_db.conn.commit()
            final_claim = retry_db.claim_discovery_retries(
                'dockerhub', {'integration-query': policy}, 'finisher',
                limit=1, lease_seconds=60,
            )[0]
            admitted = retry_db.persist_dockerhub_discovery_page(
                'dockerhub', 'integration-query',
                [{'repo_name': 'fixture/postgres-retry'}],
                final_claim['id'], final_claim['lease_owner'], final_claim['lease_token'],
                complete=True,
            )
            self.assertEqual(admitted['inserted_count'], 1)
            self.assertEqual(admitted['retry_completed_count'], 1)
            self.assertIsNone(retry_db.conn.execute(
                'SELECT id FROM discovery_retry_queue WHERE id = ?', (enqueued['id'],),
            ).fetchone())

            stale = retry_db.enqueue_discovery_retry(
                'dockerhub', 'removed-query', policy, 'deep', 'query',
            )
            self.assertEqual(
                retry_db.claim_discovery_retries(
                    'dockerhub', {'integration-query': policy}, 'holder',
                    limit=1, lease_seconds=60,
                ),
                [],
            )
            held = retry_db.conn.execute(
                '''SELECT status, last_error_category FROM discovery_retry_queue
                   WHERE id = ?''',
                (stale['id'],),
            ).fetchone()
            self.assertEqual(
                (held['status'], held['last_error_category']),
                ('held', 'query_removed'),
            )
        finally:
            retry_db.close()
            setup_db.close()

    def test_exact_git_plan_binding_and_coverage_are_fenced(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            target = 'https://github.com/example/repo.git'
            self.assertEqual(
                source_db.enqueue_targets('github', 'github', 'fixture', [target]),
                1,
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
            ).start()
            limits = {
                'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                'keycheck_items': 20, 'keycheck_bytes': 16 * 1024 * 1024,
            }
            producer = current_process_identity()
            head_a = 'a' * 40
            head_b = 'b' * 40

            def resolution(head):
                return {
                    'provider': 'github',
                    'repo_url': target,
                    'repo_path': 'example/repo',
                    'branch': 'main',
                    'ref': 'refs/heads/main',
                    'head_sha': head,
                    'ref_source': 'provider_default',
                }

            def claim(index):
                return source_db.reserve_and_claim_target(
                    'github', 'github', producer,
                    'integration-supervisor', 4 * 1024 * 1024, 4 * 1024 * 1024,
                    10, 1024 * 1024, run_id=run_id, cycle_id=cycle_id,
                    capacity_limits=limits,
                    reservation_token=f'exact-git-reservation-{index}',
                    bundle_id=f'{index:x}' * 32,
                    scan_event_id=f'{index + 8:x}' * 32,
                )

            def ingest(claimed, plan, execution_mode, continuity_reset=False):
                plan_sha256 = hashlib.sha256(canonical_git_scan_plan_bytes(plan)).hexdigest()
                exact_scope = {
                    key: plan.get(key)
                    for key in (
                        'provider', 'ref', 'head_sha', 'base_sha', 'mode',
                        'baseline_depth', 'ref_source',
                    )
                }
                result = {
                    'scan_event_id': claimed['scan_event_id'],
                    'target': claimed['target'],
                    'scan_type': 'github',
                    'timestamp': '2026-08-28T00:00:00+00:00',
                    'scan_started_at': '2026-08-28T00:00:00+00:00',
                    'duration_sec': 1.0,
                    'findings': [],
                    'errors': [],
                    'git_scan_plan': plan,
                    'git_scan_execution': {
                        'mode': execution_mode,
                        'pinned': True,
                        'success': True,
                        'continuity_reset': continuity_reset,
                        'plan_sha256': plan_sha256,
                    },
                    'scan_meta': {'exact_git_scope': exact_scope},
                }
                staged = stage_result_bundle(
                    result, claimed, str(self.bundle_root), {},
                    {'queue_status': 'done', 'queue_error': None, 'available_after': None},
                    candidate_max_items=10, candidate_max_bytes=1024 * 1024,
                )
                self.assertTrue(source_db.mark_result_bundle_ready(
                    claimed['reservation_id'], {
                        'bundle_id': staged.bundle_id,
                        'scan_event_id': staged.scan_event_id,
                        'scan_event_hash': staged.scan_event_hash,
                        'relative_path': staged.relative_path,
                        'actual_bytes': staged.actual_bytes,
                        'frame_count': staged.frame_count,
                        'finding_count': staged.finding_count,
                        'error_count': staged.error_count,
                        'candidate_count': staged.candidate_count,
                    },
                ))
                self.assertTrue(ingester.process_one())
                row = source_db.conn.execute(
                    '''SELECT q.covered_ref, q.covered_head, c.metadata_json
                       FROM target_queue q
                       JOIN scan_result_compat c ON c.target_scan_id = q.target_scan_id
                       WHERE q.id = ?''',
                    (claimed['queue_id'],),
                ).fetchone()
                source_db.conn.commit()
                return row, json.loads(row['metadata_json'])

            first = claim(1)
            self.assertIsNotNone(first)
            baseline = source_db.bind_git_scan_plan(
                first['reservation_id'], first['claim_lease_token'], resolution(head_a), 100,
            )
            self.assertEqual(baseline['mode'], 'baseline')
            self.assertEqual(
                source_db.bind_git_scan_plan(
                    first['reservation_id'], first['claim_lease_token'], resolution(head_a), 100,
                ),
                baseline,
            )
            with self.assertRaises(ScanEventConflictError):
                source_db.bind_git_scan_plan(
                    first['reservation_id'], first['claim_lease_token'], resolution(head_b), 100,
                )
            observed_during_scan = source_db.observe_discovered_targets(
                'github', 'github', 'fixture', [{
                    'target': target,
                    'remote_modified_at': '2099-01-01T00:00:00+00:00',
                }], rescan_limit=1,
            )
            self.assertEqual(observed_during_scan['queued_updated_count'], 0)
            first_row, first_metadata = ingest(first, baseline, 'baseline')
            self.assertEqual(
                (first_row['covered_ref'], first_row['covered_head']),
                ('refs/heads/main', head_a),
            )
            self.assertEqual(first_metadata['git_scan_plan'], baseline)
            self.assertEqual(first_metadata['scan_meta']['exact_git_scope']['head_sha'], head_a)
            observed_after_scan = source_db.observe_discovered_targets(
                'github', 'github', 'fixture', [{
                    'target': target,
                    'remote_modified_at': '2099-01-01T00:00:00+00:00',
                }], rescan_limit=1,
            )
            self.assertEqual(observed_after_scan['queued_updated_count'], 1)
            second = claim(2)
            delta = source_db.bind_git_scan_plan(
                second['reservation_id'], second['claim_lease_token'], resolution(head_b), 100,
            )
            self.assertEqual((delta['mode'], delta['base_sha']), ('delta', head_a))
            second_row, _second_metadata = ingest(second, delta, 'delta')
            self.assertEqual(
                (second_row['covered_ref'], second_row['covered_head']),
                ('refs/heads/main', head_b),
            )

            source_db.enqueue_targets(
                'github', 'github', 'fixture', [target], requeue_done=True,
            )
            third = claim(3)
            noop = source_db.bind_git_scan_plan(
                third['reservation_id'], third['claim_lease_token'], resolution(head_b), 100,
            )
            self.assertEqual((noop['mode'], noop['base_sha']), ('noop', head_b))
            third_row, _third_metadata = ingest(third, noop, 'noop')
            self.assertEqual(third_row['covered_head'], head_b)

            source_db.enqueue_targets(
                'github', 'github', 'fixture', [target], requeue_done=True,
            )
            fourth = claim(4)
            failed_plan = source_db.bind_git_scan_plan(
                fourth['reservation_id'], fourth['claim_lease_token'], resolution('c' * 40), 100,
            )
            self.assertEqual((failed_plan['mode'], failed_plan['base_sha']), ('delta', head_b))
            from result_bundle import ensure_bundle_reservation_paths

            ensure_bundle_reservation_paths(str(self.bundle_root), fourth)
            self.assertTrue(console_runner.refund_v2_claim_after_no_handoff(
                source_db, str(self.bundle_root), fourth, producer.as_dict(),
                'injected exact Git worker failure',
            ))
            refunded = source_db.conn.execute(
                '''SELECT r.state, q.status, q.covered_ref, q.covered_head
                   FROM result_reservations r JOIN target_queue q ON q.id = r.queue_id
                   WHERE r.id = ?''',
                (fourth['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (refunded['state'], refunded['status'], refunded['covered_ref'], refunded['covered_head']),
                ('refunded', 'pending', 'refs/heads/main', head_b),
            )
            with self.assertRaises(ScanEventConflictError):
                source_db.bind_git_scan_plan(
                    fourth['reservation_id'], fourth['claim_lease_token'], resolution('c' * 40), 100,
                )
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_docker_layer_migration_is_atomic_and_adds_existing_reservation_columns(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            with mock.patch.object(
                db,
                'require_runtime_safety_schema',
                side_effect=RuntimeSafetySchemaError('injected final validation failure'),
            ) as validate:
                with self.assertRaisesRegex(RuntimeSafetySchemaError, 'injected final validation'):
                    migrate_runtime_safety_schema(db, initialize_base=True)
            validate.assert_called_once_with(commit=False)
            self.assertFalse(db.conn.table_exists('runtime_schema_migrations'))
            self.assertFalse(db.conn.table_exists('docker_content_blobs'))
            db.conn.commit()

            self.assertTrue(migrate_runtime_safety_schema(db, initialize_base=True))
            db.conn.execute(
                'ALTER TABLE result_reservations DROP COLUMN docker_layer_plan_json'
            )
            db.conn.execute(
                'ALTER TABLE result_reservations DROP COLUMN docker_layer_plan_sha256'
            )
            db.conn.execute(
                'ALTER TABLE docker_image_blob_coverage DROP COLUMN selection_policy_sha256'
            )
            db.conn.execute(
                '''ALTER TABLE pipeline_quarantine
                   DROP CONSTRAINT pipeline_quarantine_review_status_check'''
            )
            db.conn.execute(
                '''ALTER TABLE pipeline_quarantine
                   ADD CONSTRAINT pipeline_quarantine_review_status_check
                   CHECK (review_status IN (
                       'pending','approved_retry','discarded','resolved'
                   ))'''
            )
            db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                (PIPELINE_MIGRATION_VERSIONS[-1],),
            )
            db.conn.commit()

            self.assertTrue(migrate_runtime_safety_schema(db))
            columns = db.conn.table_columns('result_reservations')
            self.assertTrue({
                'docker_layer_plan_json', 'docker_layer_plan_sha256',
            }.issubset(columns))
            self.assertIn(
                'selection_policy_sha256',
                db.conn.table_columns('docker_image_blob_coverage'),
            )
            self.assertIn(
                'idx_docker_image_blob_coverage_selection',
                db.conn.table_indexes('docker_image_blob_coverage'),
            )
            self.assertIn(
                'idx_docker_adaptive_shadow_reports_gate',
                db.conn.table_indexes('docker_adaptive_shadow_reports'),
            )
            review_constraint = db.conn.execute(
                '''SELECT pg_catalog.pg_get_constraintdef(con.oid, true) AS definition
                   FROM pg_catalog.pg_constraint con
                   JOIN pg_catalog.pg_class tbl ON tbl.oid = con.conrelid
                   JOIN pg_catalog.pg_namespace n ON n.oid = tbl.relnamespace
                   WHERE con.contype = 'c' AND n.nspname = ?
                     AND tbl.relname = 'pipeline_quarantine'
                     AND con.conname = 'pipeline_quarantine_review_status_check' ''',
                (db.conn.application_schema,),
            ).fetchone()
            self.assertIn('approved_rescan', review_constraint['definition'])
            self.assertIsNotNone(db.conn.execute(
                'SELECT version FROM runtime_schema_migrations WHERE version = ?',
                (PIPELINE_MIGRATION_VERSIONS[-1],),
            ).fetchone())
            marker = db.conn.execute(
                '''SELECT code_sha256 FROM runtime_schema_migrations
                   WHERE version = '20260902_14_adaptive_docker_payload_scanning' '''
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                marker['code_sha256'],
                hashlib.sha256(PIPELINE_SCHEMA_SQL.encode('utf-8')).hexdigest(),
            )
            self.assertTrue(db.require_runtime_safety_schema())
        finally:
            db.close()

    def test_docker_adaptive_selector_backfill_requires_quiescence_and_rolls_back(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            run_id = db.start_run('integration', selected_source='dockerhub')
            cycle_id = db.start_source_cycle(
                run_id, 'dockerhub', 'docker', 'integration', 'selector-backfill',
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
            ).start()
            producer = current_process_identity()
            manifest = 'sha256:' + ('a' * 64)
            target = f'example/selector-backfill@{manifest}'
            self.assertEqual(
                db.enqueue_targets('dockerhub', 'docker', 'integration', [target]), 1,
            )
            claimed = db.reserve_and_claim_target(
                'dockerhub', 'docker', producer, 'integration-supervisor',
                4 * 1024 * 1024, 4 * 1024 * 1024, 4, 1024 * 1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 20,
                    'bundle_bytes': 128 * 1024 * 1024,
                    'projection_items': 20,
                    'projection_bytes': 128 * 1024 * 1024,
                    'keycheck_items': 20,
                    'keycheck_bytes': 32 * 1024 * 1024,
                },
                reservation_token='docker-selector-backfill-reservation',
                bundle_id='a' * 64,
                scan_event_id='b' * 64,
            )
            self.assertIsNotNone(claimed)
            limits = {
                'config_max_bytes': 1024 * 1024,
                'layer_max_bytes': 8 * 1024 * 1024,
                'image_max_bytes': 16 * 1024 * 1024,
                'max_layers': 4,
                'archive_max_size_bytes': 8 * 1024 * 1024,
                'archive_max_depth': 4,
                'archive_timeout_sec': 30,
                'blob_timeout_sec': 600,
                'filesystem_concurrency': 2,
                'blob_max_attempts': 3,
            }
            plan = db.bind_docker_layer_plan(
                claimed['reservation_id'], claimed['claim_lease_token'],
                {
                    'version': 1,
                    'image': target,
                    'repository': 'example/selector-backfill',
                    'manifest_digest': manifest,
                    'platform_os': 'linux',
                    'platform_arch': 'amd64',
                    'manifest_media_type': 'application/vnd.oci.image.manifest.v1+json',
                    'config': {
                        'digest': 'sha256:' + ('c' * 64),
                        'size': 4096,
                        'media_type': 'application/vnd.oci.image.config.v1+json',
                    },
                    'layers': [],
                },
                limits,
                'd' * 64,
                blob_lease_seconds=60,
            )
            db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                ('20260902_14_adaptive_docker_payload_scanning',),
            )
            db.conn.commit()
            with self.assertRaisesRegex(RuntimeSafetySchemaError, 'requires stopped, reconciled'):
                migrate_runtime_safety_schema(db)
            self.assertIsNone(db.conn.execute(
                'SELECT version FROM runtime_schema_migrations WHERE version = ?',
                ('20260902_14_adaptive_docker_payload_scanning',),
            ).fetchone())
            db.conn.execute(
                '''INSERT INTO runtime_schema_migrations(version, applied_at, code_sha256)
                   VALUES (?, ?, ?)''',
                (
                    '20260902_14_adaptive_docker_payload_scanning',
                    datetime.now(timezone.utc).isoformat(timespec='seconds'),
                    hashlib.sha256(PIPELINE_SCHEMA_SQL.encode('utf-8')).hexdigest(),
                ),
            )
            db.conn.commit()
            self.assertTrue(db.refund_uncommitted_reservation(
                claimed['reservation_id'], producer.as_dict(),
                'selector backfill fixture is quiescent',
                partial_absence_confirmed=True,
            ))
            self.assertTrue(ingester.stop())
            ingester = None

            db.conn.execute(
                '''UPDATE docker_image_blob_coverage SET selection_policy_sha256 = ''
                   WHERE reservation_id = ?''',
                (claimed['reservation_id'],),
            )
            db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                ('20260902_14_adaptive_docker_payload_scanning',),
            )
            db.conn.commit()
            self.assertTrue(migrate_runtime_safety_schema(db))
            backfilled = db.conn.execute(
                '''SELECT selection_policy_sha256 FROM docker_image_blob_coverage
                   WHERE reservation_id = ?''',
                (claimed['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(backfilled['selection_policy_sha256'], plan['selection_policy_sha256'])

            db.conn.execute(
                '''UPDATE docker_image_blob_coverage SET selection_policy_sha256 = ''
                   WHERE reservation_id = ?''',
                (claimed['reservation_id'],),
            )
            db.conn.execute(
                "UPDATE result_reservations SET docker_layer_plan_json = '{}' WHERE id = ?",
                (claimed['reservation_id'],),
            )
            db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                ('20260902_14_adaptive_docker_payload_scanning',),
            )
            db.conn.commit()
            with self.assertRaises(RuntimeSafetySchemaError):
                migrate_runtime_safety_schema(db)
            rolled_back = db.conn.execute(
                '''SELECT coverage.selection_policy_sha256,
                          reservation.docker_layer_plan_json
                   FROM docker_image_blob_coverage coverage
                   JOIN result_reservations reservation
                     ON reservation.id = coverage.reservation_id
                   WHERE coverage.reservation_id = ?''',
                (claimed['reservation_id'],),
            ).fetchone()
            marker = db.conn.execute(
                'SELECT version FROM runtime_schema_migrations WHERE version = ?',
                ('20260902_14_adaptive_docker_payload_scanning',),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (rolled_back['selection_policy_sha256'], rolled_back['docker_layer_plan_json']),
                ('', '{}'),
            )
            self.assertIsNone(marker)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            db.close()
            ingester_db.close()

    def test_offline_result_pipeline_recovery_converges_before_marker14(self):
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        projector_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(source_db, initialize_base=True)
            source_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'offline-recovery',
            )
            self.assertEqual(source_db.enqueue_targets(
                'github', 'github', 'offline-recovery', [
                    'https://example.invalid/ready',
                    'https://example.invalid/abandoned',
                    'https://example.invalid/late-ready',
                ],
            ), 3)
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'stale-supervisor', lease_seconds=60,
            ).start()
            limits = {
                'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                'keycheck_items': 30, 'keycheck_bytes': 16 * 1024 * 1024,
            }
            producer = current_process_identity()
            ready = source_db.reserve_and_claim_target(
                'github', 'github', producer, 'stale-supervisor',
                4 * 1024 * 1024, 4 * 1024 * 1024, 10, 1024 * 1024,
                run_id=run_id, cycle_id=cycle_id, capacity_limits=limits,
                reservation_token='offline-ready-reservation',
                bundle_id='a' * 32, scan_event_id='b' * 32,
            )
            abandoned = source_db.reserve_and_claim_target(
                'github', 'github', producer, 'stale-supervisor',
                4 * 1024 * 1024, 4 * 1024 * 1024, 10, 1024 * 1024,
                run_id=run_id, cycle_id=cycle_id, capacity_limits=limits,
                reservation_token='offline-abandoned-reservation',
                bundle_id='c' * 32, scan_event_id='d' * 32,
            )
            late_ready = source_db.reserve_and_claim_target(
                'github', 'github', producer, 'stale-supervisor',
                4 * 1024 * 1024, 4 * 1024 * 1024, 10, 1024 * 1024,
                run_id=run_id, cycle_id=cycle_id, capacity_limits=limits,
                reservation_token='offline-late-ready-reservation',
                bundle_id='1' * 32, scan_event_id='2' * 32,
            )
            self.assertIsNotNone(ready)
            self.assertIsNotNone(abandoned)
            self.assertIsNotNone(late_ready)
            self.assertNotEqual(ready['reservation_id'], abandoned['reservation_id'])
            staged = stage_result_bundle(
                {
                    'scan_event_id': ready['scan_event_id'], 'target': ready['target'],
                    'scan_type': 'github', 'timestamp': '2026-09-02T00:00:00+00:00',
                    'findings': [{
                        'DetectorName': 'OpenAI', 'Raw': 'sk-offline-recovery-fixture',
                        'finding_uid': 'e' * 64, 'Verified': False,
                    }],
                    'errors': [],
                },
                ready, str(self.bundle_root), {}, {'queue_status': 'done'},
                candidate_max_items=10, candidate_max_bytes=1024 * 1024,
            )
            self.assertTrue(source_db.mark_result_bundle_ready(
                ready['reservation_id'], {
                    'bundle_id': staged.bundle_id, 'scan_event_id': staged.scan_event_id,
                    'scan_event_hash': staged.scan_event_hash,
                    'relative_path': staged.relative_path, 'actual_bytes': staged.actual_bytes,
                    'frame_count': staged.frame_count, 'finding_count': staged.finding_count,
                    'error_count': staged.error_count, 'candidate_count': staged.candidate_count,
                },
            ))
            late_staged = stage_result_bundle(
                {
                    'scan_event_id': late_ready['scan_event_id'],
                    'target': late_ready['target'], 'scan_type': 'github',
                    'timestamp': '2026-09-02T00:00:00+00:00',
                    'findings': [], 'errors': ['late ready fixture'],
                },
                late_ready, str(self.bundle_root), {}, {'queue_status': 'done'},
                candidate_max_items=10, candidate_max_bytes=1024 * 1024,
            )
            expired_at = '2000-01-01T00:00:00+00:00'
            source_db.conn.execute(
                'UPDATE result_reservations SET producer_lease_expires_at = ? WHERE id = ?',
                (expired_at, late_ready['reservation_id']),
            )
            source_db.conn.execute(
                'UPDATE target_queue SET lease_expires_at = ? WHERE id = ?',
                (expired_at, late_ready['queue_id']),
            )
            source_db.conn.commit()
            late_metadata = ResultBundleReader(
                str(self.bundle_root / late_staged.relative_path)
            ).validate()
            late_values = late_metadata.as_dict()
            late_values['relative_path'] = late_staged.relative_path
            self.assertFalse(source_db.mark_result_bundle_ready(
                late_ready['reservation_id'], late_values,
            ))
            self.assertFalse(source_db.recover_expired_result_bundle_ready(
                late_ready['reservation_id'], late_values,
            ))

            projector_lease = projector_db.acquire_pipeline_lease(
                'jsonl_projector', 'stale-supervisor', producer,
                lease_seconds=60, initial_state='ready',
            )
            self.assertIsNotNone(projector_lease)
            ingester_db.close()
            projector_db.close()
            ingester = None

            source_db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                ('20260902_14_adaptive_docker_payload_scanning',),
            )
            source_db.conn.execute(
                'ALTER TABLE keycheck_candidates DROP COLUMN routed_service'
            )
            source_db.conn.commit()
            with ExitStack() as patches:
                patches.enter_context(mock.patch.object(
                    result_ingester, 'exact_process_identity_state', return_value='dead',
                ))
                patches.enter_context(mock.patch.object(
                    scanner_db, 'exact_process_identity_state', return_value='dead',
                ))
                report = recover_stale_result_pipeline(
                    source_db, {
                        'global': {
                            'result_bundle_dir': str(self.bundle_root),
                            'pipeline_quarantine_max_items': 100,
                            'pipeline_quarantine_max_bytes': 64 * 1024 * 1024,
                        },
                        'supervisor': {'result_ingester': {'lease_seconds': 60}},
                    },
                    max_rows=10, max_seconds=30,
                )
            self.assertEqual(report['processed_bundles'], 2)
            remaining = source_db.conn.execute(
                '''SELECT state, last_error_code, last_error_detail FROM result_reservations
                   WHERE state IN ('scanning','ready','ingesting','db_committed')
                   ORDER BY id'''
            ).fetchall()
            source_db.conn.commit()
            self.assertTrue(report['quiescent'], {
                'report': report,
                'remaining': [
                    (row['state'], row['last_error_code'], row['last_error_detail'])
                    for row in remaining
                ],
            })
            self.assertEqual(report['final'], {
                'worker_leases': 0, 'result_reservations': 0,
                'queue_leases': 0, 'blob_leases': 0,
            })
            states = source_db.conn.execute(
                'SELECT state FROM result_reservations ORDER BY id'
            ).fetchall()
            queue = source_db.conn.execute(
                '''SELECT status, current_result_reservation_id
                   FROM target_queue ORDER BY id'''
            ).fetchall()
            candidate = source_db.conn.execute(
                'SELECT service FROM keycheck_candidates'
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                [row['state'] for row in states],
                ['acknowledged', 'refunded', 'acknowledged'],
            )
            self.assertEqual([row['status'] for row in queue], ['done', 'pending', 'done'])
            self.assertTrue(all(row['current_result_reservation_id'] is None for row in queue))
            self.assertEqual(candidate['service'], 'openai')

            self.assertTrue(migrate_runtime_safety_schema(source_db))
            migrated = source_db.conn.execute(
                'SELECT routed_service FROM keycheck_candidates'
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(migrated['routed_service'], '')
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()
            projector_db.close()

    def test_docker_adaptive_shadow_gate_is_aggregate_fresh_and_fenced(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            run_id = db.start_run('integration', selected_source='dockerhub')
            cycle_id = db.start_source_cycle(
                run_id, 'dockerhub', 'docker', 'integration', 'adaptive-shadow',
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
            ).start()
            target = 'example/adaptive-shadow@sha256:' + ('a' * 64)
            self.assertEqual(
                db.enqueue_targets('dockerhub', 'docker', 'integration', [target]), 1,
            )
            claimed = db.reserve_and_claim_target(
                'dockerhub', 'docker', current_process_identity(),
                'integration-supervisor', 4 * 1024 * 1024, 4 * 1024 * 1024,
                4, 1024 * 1024, run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 20,
                    'bundle_bytes': 128 * 1024 * 1024,
                    'projection_items': 20,
                    'projection_bytes': 128 * 1024 * 1024,
                    'keycheck_items': 20,
                    'keycheck_bytes': 32 * 1024 * 1024,
                },
                reservation_token='docker-adaptive-shadow-reservation',
                bundle_id='1' * 64, scan_event_id='2' * 64,
            )
            self.assertIsNotNone(claimed)
            policies = {
                'scan_policy_sha256': '3' * 64,
                'execution_policy_sha256': '4' * 64,
                'selection_policy_sha256': '5' * 64,
            }
            missing = db.docker_adaptive_gate_report(
                claimed['reservation_id'], claimed['claim_lease_token'],
                **policies,
            )
            self.assertEqual((missing['passed'], missing['reason']), (False, 'missing'))

            report = db.start_docker_adaptive_shadow_report(
                **policies, cohort_size=50, lease_owner='integration-shadow',
            )
            with self.assertRaises(ScanEventConflictError):
                db.start_docker_adaptive_shadow_report(
                    **policies, cohort_size=50, lease_owner='integration-shadow-two',
                )
            with self.assertRaises(ScanEventConflictError):
                db.checkpoint_docker_adaptive_shadow_report(
                    report['report_token'], report['lease_owner'], 'stale-lease-token',
                )
            for expected_checkpoint in range(1, 101):
                checkpoint = db.checkpoint_docker_adaptive_shadow_report(
                    report['report_token'], report['lease_owner'], report['lease_token'],
                )
                self.assertEqual(checkpoint['sink_checkpoint_count'], expected_checkpoint)
            selection_metrics = {
                name: 0 for name in DOCKER_ADAPTIVE_SHADOW_SELECTION_METRIC_KEYS
            }
            selection_metrics['omitted_layer_too_large'] = 12
            selection_metrics['adaptive_checkpoints'] = 50
            with self.assertRaises(ValueError):
                db.finish_docker_adaptive_shadow_report(
                    report['report_token'], report['lease_owner'], report['lease_token'],
                    completed_pairs=50, omitted_descriptor_count=12,
                    selection_metrics={
                        **selection_metrics, 'omitted_layer_too_large': 11,
                    },
                )
            completed = db.finish_docker_adaptive_shadow_report(
                report['report_token'], report['lease_owner'], report['lease_token'],
                completed_pairs=50,
                full_routed_count=100,
                adaptive_routed_count=90,
                routed_intersection_count=86,
                full_detector_count=80,
                adaptive_detector_count=70,
                detector_intersection_count=65,
                full_slot_ms=100000,
                adaptive_slot_ms=40000,
                omitted_descriptor_count=12,
                failure_count=0,
                privacy_violation_count=0,
                safety_regression_count=0,
                selection_metrics=selection_metrics,
                routed_recall_ppm=1,
                slot_ratio_ppm=1,
            )
            self.assertTrue(completed['passed'])
            self.assertEqual(
                (completed['routed_recall_ppm'], completed['slot_ratio_ppm']),
                (860000, 400000),
            )
            passed = db.docker_adaptive_gate_report(
                claimed['reservation_id'], claimed['claim_lease_token'],
                **policies,
            )
            self.assertEqual((passed['passed'], passed['reason']), (True, 'passed'))
            self.assertEqual(passed['report_id'], report['id'])

            stale_at = (
                datetime.now(timezone.utc) - timedelta(days=8)
            ).isoformat(timespec='seconds')
            db.conn.execute(
                '''UPDATE docker_adaptive_shadow_reports SET completed_at = ?
                   WHERE id = ?''',
                (stale_at, report['id']),
            )
            db.conn.commit()
            stale = db.docker_adaptive_gate_report(
                claimed['reservation_id'], claimed['claim_lease_token'],
                **policies,
            )
            self.assertEqual((stale['passed'], stale['reason']), (False, 'stale'))
            db.conn.execute(
                '''UPDATE docker_adaptive_shadow_reports SET completed_at = ?
                   WHERE id = ?''',
                (datetime.now(timezone.utc).isoformat(timespec='seconds'), report['id']),
            )
            db.conn.commit()

            failed_threshold = db.start_docker_adaptive_shadow_report(
                **policies, cohort_size=50, lease_owner='integration-shadow-two',
            )
            for _ in range(100):
                db.checkpoint_docker_adaptive_shadow_report(
                    failed_threshold['report_token'], failed_threshold['lease_owner'],
                    failed_threshold['lease_token'],
                )
            failed_result = db.finish_docker_adaptive_shadow_report(
                failed_threshold['report_token'], failed_threshold['lease_owner'],
                failed_threshold['lease_token'], completed_pairs=50,
                full_routed_count=100, adaptive_routed_count=100,
                routed_intersection_count=84, full_detector_count=1,
                adaptive_detector_count=1, detector_intersection_count=1,
                full_slot_ms=100000, adaptive_slot_ms=10000,
                omitted_descriptor_count=0, failure_count=0,
                privacy_violation_count=0, safety_regression_count=0,
                selection_metrics={
                    name: 0 for name in DOCKER_ADAPTIVE_SHADOW_SELECTION_METRIC_KEYS
                },
            )
            self.assertFalse(failed_result['passed'])
            latest = db.docker_adaptive_gate_report(
                claimed['reservation_id'], claimed['claim_lease_token'],
                **policies,
            )
            self.assertEqual((latest['passed'], latest['reason']), (False, 'thresholds'))
            with self.assertRaises(ScanEventConflictError):
                db.docker_adaptive_gate_report(
                    claimed['reservation_id'], 'stale-claim-token', **policies,
                )

            report_columns = db.conn.table_columns('docker_adaptive_shadow_reports')
            self.assertTrue({
                'target', 'normalized_target', 'secret', 'provider_key_hash',
                'detector_secret_hash', 'finding_id', 'reservation_id',
            }.isdisjoint(report_columns))
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            db.close()
            ingester_db.close()

    def test_docker_layer_policy_reclaim_and_quarantine_are_exactly_fenced(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='dockerhub')
            cycle_id = source_db.start_source_cycle(
                run_id, 'dockerhub', 'docker', 'integration', 'fixture',
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
            ).start()
            producer = current_process_identity()
            capacity_limits = {
                'bundle_items': 20, 'bundle_bytes': 128 * 1024 * 1024,
                'projection_items': 20, 'projection_bytes': 128 * 1024 * 1024,
                'keycheck_items': 20, 'keycheck_bytes': 32 * 1024 * 1024,
            }
            layer_limits = {
                'config_max_bytes': 1024 * 1024,
                'layer_max_bytes': 8 * 1024 * 1024,
                'image_max_bytes': 16 * 1024 * 1024,
                'max_layers': 4,
                'archive_max_size_bytes': 8 * 1024 * 1024,
                'archive_max_depth': 4,
                'archive_timeout_sec': 30,
                'blob_timeout_sec': 600,
                'filesystem_concurrency': 2,
                'blob_max_attempts': 3,
            }
            content_digest = 'sha256:' + ('f' * 64)

            def target(index):
                return f'example/layer-db-{index}@sha256:{index:064x}'

            def resolution(index, size=4096):
                image = target(index)
                return {
                    'version': 1,
                    'image': image,
                    'repository': f'example/layer-db-{index}',
                    'manifest_digest': image.rsplit('@', 1)[1],
                    'platform_os': 'linux',
                    'platform_arch': 'amd64',
                    'manifest_media_type': 'application/vnd.oci.image.manifest.v1+json',
                    'config': {
                        'digest': content_digest,
                        'size': size,
                        'media_type': (
                            'application/vnd.docker.container.image.v1+json'
                            if index == 2
                            else 'application/vnd.oci.image.config.v1+json'
                        ),
                    },
                    'layers': [],
                }

            def claim(index):
                self.assertEqual(
                    source_db.enqueue_targets(
                        'dockerhub', 'docker', 'integration', [target(index)],
                    ),
                    1,
                )
                claimed = source_db.reserve_and_claim_target(
                    'dockerhub', 'docker', producer, 'integration-supervisor',
                    4 * 1024 * 1024, 4 * 1024 * 1024, 4, 1024 * 1024,
                    run_id=run_id, cycle_id=cycle_id,
                    capacity_limits=capacity_limits,
                    reservation_token=f'docker-layer-db-reservation-{index}',
                    bundle_id=f'{index:064x}',
                    scan_event_id=f'{index + 100:064x}',
                    claim_order='newest',
                )
                self.assertIsNotNone(claimed)
                return claimed

            def ready_metadata(staged):
                return {
                    'bundle_id': staged.bundle_id,
                    'scan_event_id': staged.scan_event_id,
                    'scan_event_hash': staged.scan_event_hash,
                    'relative_path': staged.relative_path,
                    'actual_bytes': staged.actual_bytes,
                    'frame_count': staged.frame_count,
                    'finding_count': staged.finding_count,
                    'error_count': staged.error_count,
                    'candidate_count': staged.candidate_count,
                }

            first = claim(1)
            second = claim(2)
            plans = {}
            failures = []
            barrier = threading.Barrier(2)

            def bind_concurrently(claimed, index):
                db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    barrier.wait(timeout=10)
                    plans[claimed['reservation_id']] = db.bind_docker_layer_plan(
                        claimed['reservation_id'], claimed['claim_lease_token'],
                        resolution(index), layer_limits, '1' * 64,
                        blob_lease_seconds=60,
                    )
                except Exception as exc:
                    failures.append(exc)
                finally:
                    db.close()

            threads = [
                threading.Thread(target=bind_concurrently, args=(first, 1)),
                threading.Thread(target=bind_concurrently, args=(second, 2)),
            ]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(timeout=30)
            self.assertTrue(all(not thread.is_alive() for thread in threads))
            self.assertEqual(failures, [])
            states = {
                claimed['reservation_id']: plans[claimed['reservation_id']]['descriptors'][0]['coverage_state']
                for claimed in (first, second)
            }
            self.assertEqual(sorted(states.values()), ['leased', 'shared_pending'])
            owner = first if states[first['reservation_id']] == 'leased' else second
            owner_index = 1 if owner is first else 2
            shared = second if owner is first else first
            owner_plan = plans[owner['reservation_id']]
            shared_plan = plans[shared['reservation_id']]
            shared_plan_sha256 = hashlib.sha256(
                canonical_docker_layer_plan_bytes(shared_plan)
            ).hexdigest()
            shared_timestamp = datetime.now(timezone.utc).isoformat(timespec='seconds')
            shared_staged = stage_result_bundle(
                {
                    'scan_event_id': shared['scan_event_id'],
                    'target': shared['target'],
                    'scan_type': 'docker',
                    'timestamp': shared_timestamp,
                    'scan_started_at': shared_timestamp,
                    'duration_sec': 0.1,
                    'findings': [],
                    'errors': ['shared content remains pending'],
                    'retryable': True,
                    'docker_layer_plan': shared_plan,
                    'docker_layer_execution': {
                        'version': 1, 'plan_sha256': shared_plan_sha256, 'blobs': [],
                    },
                },
                shared,
                str(self.bundle_root),
                {},
                {
                    'queue_status': 'deferred',
                    'queue_error': 'shared content remains pending',
                    'available_after': (
                        datetime.now(timezone.utc) + timedelta(minutes=5)
                    ).isoformat(timespec='seconds'),
                    'reset_attempts': True,
                },
                candidate_max_items=4,
                candidate_max_bytes=1024 * 1024,
            )
            policy_one = docker_layer_coverage_policy_sha256('1' * 64, layer_limits)
            blob = source_db.conn.execute(
                '''SELECT * FROM docker_content_blobs
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (content_digest, policy_one),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual((blob['state'], blob['attempts']), ('leased', 1))
            self.assertGreaterEqual(
                (datetime.fromisoformat(blob['lease_expires_at']) - datetime.now(timezone.utc)).total_seconds(),
                850,
            )

            with self.assertRaisesRegex(ScanEventConflictError, 'replay conflicts'):
                source_db.bind_docker_layer_plan(
                    owner['reservation_id'], owner['claim_lease_token'],
                    resolution(owner_index, size=8192), layer_limits, '1' * 64,
                )

            short_expiry = (
                datetime.now(timezone.utc) + timedelta(seconds=30)
            ).isoformat(timespec='seconds')
            source_db.conn.execute(
                '''UPDATE docker_content_blobs SET lease_expires_at = ?
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (short_expiry, content_digest, policy_one),
            )
            source_db.conn.commit()
            self.assertTrue(source_db.renew_result_claim(
                owner['reservation_id'], owner['claim_lease_token'], lease_seconds=60,
            ))
            renewed = source_db.conn.execute(
                '''SELECT lease_expires_at FROM docker_content_blobs
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (content_digest, policy_one),
            ).fetchone()
            source_db.conn.commit()
            self.assertGreater(
                datetime.fromisoformat(renewed['lease_expires_at']),
                datetime.fromisoformat(short_expiry),
            )

            expired = (
                datetime.now(timezone.utc) - timedelta(minutes=5)
            ).isoformat(timespec='seconds')
            source_db.conn.execute(
                '''UPDATE docker_content_blobs SET lease_expires_at = ?
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (expired, content_digest, policy_one),
            )
            source_db.conn.commit()
            third = claim(3)
            third_plan = source_db.bind_docker_layer_plan(
                third['reservation_id'], third['claim_lease_token'],
                resolution(3), layer_limits, '1' * 64, blob_lease_seconds=60,
            )
            self.assertEqual(third_plan['descriptors'][0]['coverage_state'], 'leased')
            self.assertTrue(source_db.refund_uncommitted_reservation(
                owner['reservation_id'], producer.as_dict(), 'old owner stopped after reclaim',
                partial_absence_confirmed=True,
            ))
            current_owner = source_db.conn.execute(
                '''SELECT lease_reservation_id, lease_token FROM docker_content_blobs
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (content_digest, policy_one),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(current_owner['lease_reservation_id'], third['reservation_id'])
            self.assertEqual(
                current_owner['lease_token'], third_plan['descriptors'][0]['lease_token'],
            )
            with self.assertRaisesRegex(ScanEventConflictError, 'not exactly quarantineable'):
                source_db.quarantine_result_bundle(
                    owner['reservation_id'], 'stale_owner', 'must not quarantine reclaimed work',
                    physical_confirmed=True,
                )

            plan_sha256 = hashlib.sha256(
                canonical_docker_layer_plan_bytes(third_plan)
            ).hexdigest()
            execution = {
                'version': 1,
                'plan_sha256': plan_sha256,
                'blobs': [{
                    'digest': content_digest,
                    'lease_token': third_plan['descriptors'][0]['lease_token'],
                    'status': 'covered',
                    'verified_bytes': 4096,
                    'transfer_bytes': 4096,
                    'transfer_duration_ms': 10,
                    'scan_duration_ms': 10,
                    'finding_count': 0,
                    'error_code': None,
                }],
            }
            timestamp = datetime.now(timezone.utc).isoformat(timespec='seconds')
            staged = stage_result_bundle(
                {
                    'scan_event_id': third['scan_event_id'],
                    'target': third['target'],
                    'scan_type': 'docker',
                    'timestamp': timestamp,
                    'scan_started_at': timestamp,
                    'duration_sec': 0.1,
                    'findings': [],
                    'errors': [],
                    'docker_layer_plan': third_plan,
                    'docker_layer_execution': execution,
                },
                third,
                str(self.bundle_root),
                {},
                {
                    'queue_status': 'done', 'queue_error': None,
                    'available_after': None, 'reset_attempts': False,
                },
                candidate_max_items=4,
                candidate_max_bytes=1024 * 1024,
            )
            self.assertTrue(source_db.mark_result_bundle_ready(
                third['reservation_id'], ready_metadata(staged),
            ))
            self.assertTrue(ingester.process_one())
            covered_one = source_db.conn.execute(
                '''SELECT state, attempts, covered_policy_sha256
                   FROM docker_content_blobs
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (content_digest, policy_one),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (covered_one['state'], covered_one['attempts'], covered_one['covered_policy_sha256']),
                ('covered', 2, policy_one),
            )

            self.assertTrue(source_db.mark_result_bundle_ready(
                shared['reservation_id'], ready_metadata(shared_staged),
            ))
            self.assertTrue(ingester.process_one())
            reconciled_shared = source_db.conn.execute(
                '''SELECT r.state AS reservation_state, q.status AS queue_status,
                          q.current_result_reservation_id, c.coverage_state,
                          (SELECT COUNT(*) FROM pipeline_quarantine pq
                           WHERE pq.reservation_id = r.id) AS quarantine_count
                   FROM result_reservations r
                   JOIN target_queue q ON q.id = r.queue_id
                   JOIN docker_image_blob_coverage c ON c.reservation_id = r.id
                   WHERE r.id = ?''',
                (shared['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (
                    reconciled_shared['reservation_state'],
                    reconciled_shared['queue_status'],
                    reconciled_shared['current_result_reservation_id'],
                    reconciled_shared['coverage_state'],
                    reconciled_shared['quarantine_count'],
                ),
                ('acknowledged', 'deferred', None, 'covered', 0),
            )

            adaptive_alias = claim(40)
            adaptive_alias_plan = source_db.bind_docker_layer_plan(
                adaptive_alias['reservation_id'], adaptive_alias['claim_lease_token'],
                resolution(40), layer_limits, '1' * 64, blob_lease_seconds=60,
                payload_classes=[], checkpoint={'max_blobs': 2, 'max_bytes': 8192},
            )
            self.assertEqual(adaptive_alias_plan['version'], 2)
            self.assertEqual(
                (
                    adaptive_alias_plan['descriptors'][0]['coverage_state'],
                    adaptive_alias_plan['descriptors'][0]['selection_reason'],
                ),
                ('covered', 'already_covered'),
            )
            adaptive_alias_sha256 = hashlib.sha256(
                canonical_docker_layer_plan_bytes(adaptive_alias_plan)
            ).hexdigest()
            alias_staged = stage_result_bundle(
                {
                    'scan_event_id': adaptive_alias['scan_event_id'],
                    'target': adaptive_alias['target'],
                    'scan_type': 'docker',
                    'timestamp': timestamp,
                    'scan_started_at': timestamp,
                    'duration_sec': 0.1,
                    'findings': [],
                    'errors': [],
                    'docker_layer_plan': adaptive_alias_plan,
                    'docker_layer_execution': {
                        'version': 2,
                        'plan_sha256': adaptive_alias_sha256,
                        'blobs': [],
                    },
                },
                adaptive_alias,
                str(self.bundle_root),
                {},
                {
                    'queue_status': 'done', 'queue_error': None,
                    'available_after': None, 'reset_attempts': False,
                },
                candidate_max_items=4,
                candidate_max_bytes=1024 * 1024,
            )
            self.assertTrue(source_db.mark_result_bundle_ready(
                adaptive_alias['reservation_id'], ready_metadata(alias_staged),
            ))
            self.assertTrue(ingester.process_one())
            adaptive_policy = docker_layer_execution_policy_sha256(
                '1' * 64, layer_limits,
            )
            aliased = source_db.conn.execute(
                '''SELECT state, attempts, covered_reservation_id,
                          covered_scan_event_id, covered_policy_sha256
                   FROM docker_content_blobs
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (content_digest, adaptive_policy),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (
                    aliased['state'], aliased['attempts'],
                    aliased['covered_reservation_id'], aliased['covered_scan_event_id'],
                    aliased['covered_policy_sha256'],
                ),
                (
                    'covered', 0, third['reservation_id'], third['scan_event_id'],
                    adaptive_policy,
                ),
            )

            incompatible_limits = dict(layer_limits)
            incompatible_limits['archive_timeout_sec'] = 31
            incompatible = claim(41)
            incompatible_plan = source_db.bind_docker_layer_plan(
                incompatible['reservation_id'], incompatible['claim_lease_token'],
                resolution(41), incompatible_limits, '1' * 64, blob_lease_seconds=60,
                payload_classes=[], checkpoint={'max_blobs': 2, 'max_bytes': 8192},
            )
            incompatible_policy = docker_layer_execution_policy_sha256(
                '1' * 64, incompatible_limits,
            )
            self.assertNotEqual(incompatible_policy, adaptive_policy)
            self.assertEqual(
                incompatible_plan['descriptors'][0]['coverage_state'], 'leased',
            )
            incompatible_blob = source_db.conn.execute(
                '''SELECT state, attempts, covered_reservation_id
                   FROM docker_content_blobs
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (content_digest, incompatible_policy),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (
                    incompatible_blob['state'], incompatible_blob['attempts'],
                    incompatible_blob['covered_reservation_id'],
                ),
                ('leased', 1, None),
            )
            self.assertTrue(source_db.refund_uncommitted_reservation(
                incompatible['reservation_id'], producer.as_dict(),
                'incompatible adaptive policy test cleanup',
                partial_absence_confirmed=True,
            ))

            fourth = claim(4)
            fourth_plan = source_db.bind_docker_layer_plan(
                fourth['reservation_id'], fourth['claim_lease_token'],
                resolution(4), layer_limits, '2' * 64, blob_lease_seconds=60,
            )
            policy_two = docker_layer_coverage_policy_sha256('2' * 64, layer_limits)
            self.assertNotEqual(policy_one, policy_two)
            policy_rows = source_db.conn.execute(
                '''SELECT coverage_policy_sha256, state, attempts
                   FROM docker_content_blobs WHERE digest = ?
                   ORDER BY coverage_policy_sha256''',
                (content_digest,),
            ).fetchall()
            source_db.conn.commit()
            by_policy = {row['coverage_policy_sha256']: row for row in policy_rows}
            self.assertEqual(
                (by_policy[policy_one]['state'], by_policy[policy_one]['attempts']),
                ('covered', 2),
            )
            self.assertEqual(
                (by_policy[policy_two]['state'], by_policy[policy_two]['attempts']),
                ('leased', 1),
            )

            fifth = claim(5)
            fifth_plan = source_db.bind_docker_layer_plan(
                fifth['reservation_id'], fifth['claim_lease_token'],
                resolution(5), layer_limits, '2' * 64, blob_lease_seconds=60,
            )
            self.assertEqual(fifth_plan['descriptors'][0]['coverage_state'], 'shared_pending')

            source_db.conn.execute(
                'UPDATE result_reservations SET producer_lease_expires_at = ? WHERE id = ?',
                (expired, fourth['reservation_id']),
            )
            source_db.conn.execute(
                'UPDATE target_queue SET lease_expires_at = ? WHERE id = ?',
                (expired, fourth['queue_id']),
            )
            source_db.conn.commit()
            self.assertFalse(source_db.mark_result_bundle_ready(
                fourth['reservation_id'], {
                    'bundle_id': fourth['bundle_id'],
                    'scan_event_id': fourth['scan_event_id'],
                    'scan_event_hash': 'e' * 64,
                    'relative_path': fourth['ready_relative_path'],
                    'actual_bytes': 1,
                    'frame_count': 1,
                    'finding_count': 0,
                    'error_count': 0,
                    'candidate_count': 0,
                },
            ))
            unsubmitted = source_db.conn.execute(
                '''SELECT state, lease_reservation_id FROM docker_content_blobs
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (content_digest, policy_two),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (unsubmitted['state'], unsubmitted['lease_reservation_id']),
                ('leased', fourth['reservation_id']),
            )

            fifth_sha256 = hashlib.sha256(
                canonical_docker_layer_plan_bytes(fifth_plan)
            ).hexdigest()
            staged_retry = stage_result_bundle(
                {
                    'scan_event_id': fifth['scan_event_id'],
                    'target': fifth['target'],
                    'scan_type': 'docker',
                    'timestamp': timestamp,
                    'scan_started_at': timestamp,
                    'duration_sec': 0.1,
                    'findings': [],
                    'errors': ['shared content remains pending'],
                    'retryable': True,
                    'docker_layer_plan': fifth_plan,
                    'docker_layer_execution': {
                        'version': 1, 'plan_sha256': fifth_sha256, 'blobs': [],
                    },
                },
                fifth,
                str(self.bundle_root),
                {},
                {
                    'queue_status': 'done',
                    'queue_error': 'shared content remains pending',
                    'available_after': None,
                    'reset_attempts': False,
                },
                candidate_max_items=4,
                candidate_max_bytes=1024 * 1024,
            )
            self.assertTrue(source_db.mark_result_bundle_ready(
                fifth['reservation_id'], ready_metadata(staged_retry),
            ))
            self.assertTrue(ingester.process_one())
            quarantined = source_db.conn.execute(
                '''SELECT * FROM pipeline_quarantine
                   WHERE subsystem = 'result_ingester' AND object_type = 'result_bundle'
                     AND reservation_id = ? AND review_status = 'pending' ''',
                (fifth['reservation_id'],),
            ).fetchone()
            reservation_state = source_db.conn.execute(
                'SELECT state FROM result_reservations WHERE id = ?',
                (fifth['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertIsNotNone(quarantined)
            self.assertEqual(
                quarantined['reason_code'], 'docker_coverage_disposition_conflict',
            )
            self.assertEqual(reservation_state['state'], 'quarantined')
            capacity_before = source_db.pipeline_capacity_snapshot()
            replayed = source_db.quarantine_result_bundle(
                fifth['reservation_id'], quarantined['reason_code'],
                quarantined['reason_detail'] or '', quarantined['source_relative_path'] or '',
                payload_sha256=quarantined['payload_sha256'] or '',
                byte_count=quarantined['byte_count'], physical_confirmed=True,
            )
            self.assertEqual(replayed, quarantined['id'])
            with self.assertRaisesRegex(ScanEventConflictError, 'conflicts with existing evidence'):
                source_db.quarantine_result_bundle(
                    fifth['reservation_id'], quarantined['reason_code'],
                    (quarantined['reason_detail'] or '') + ' changed',
                    quarantined['source_relative_path'] or '',
                    payload_sha256=quarantined['payload_sha256'] or '',
                    byte_count=quarantined['byte_count'], physical_confirmed=True,
                )
            capacity_after = source_db.pipeline_capacity_snapshot()
            capacity_keys = (
                'bundle_items', 'bundle_bytes', 'projection_items', 'projection_bytes',
                'keycheck_items', 'keycheck_bytes', 'quarantine_items', 'quarantine_bytes',
            )
            self.assertEqual(
                tuple(capacity_before[key] for key in capacity_keys),
                tuple(capacity_after[key] for key in capacity_keys),
            )
            quarantine_path = self.bundle_root.joinpath(
                *str(quarantined['source_relative_path']).split('/')
            )
            self.assertTrue(quarantine_path.exists())
            rescan_manifest = self.root / 'docker-bundle-rescan-review.json'
            atomic_write_private_json(str(rescan_manifest), {
                'type': 'truf-pipeline-quarantine-review-v1',
                'entries': [{
                    'id': quarantined['id'],
                    'reason_code': quarantined['reason_code'],
                    'payload_sha256': quarantined['payload_sha256'],
                    'action': 'rescan',
                }],
            })
            review_pipeline_quarantine_manifest(
                source_db, str(rescan_manifest), max_rows=1,
                config={'global': {
                    'results_dir': str(self.results),
                    'result_bundle_dir': str(self.bundle_root),
                }},
            )
            reviewed = source_db.conn.execute(
                '''SELECT q.status, q.attempts, q.current_result_reservation_id,
                          q.claim_event_id, r.state AS reservation_state,
                          pq.review_status
                   FROM result_reservations r
                   JOIN target_queue q ON q.id = r.queue_id
                   JOIN pipeline_quarantine pq ON pq.reservation_id = r.id
                   WHERE r.id = ?''',
                (fifth['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (
                    reviewed['status'], reviewed['attempts'],
                    reviewed['current_result_reservation_id'], reviewed['claim_event_id'],
                    reviewed['reservation_state'], reviewed['review_status'],
                ),
                ('pending', 0, None, None, 'quarantined', 'approved_rescan'),
            )
            self.assertFalse(quarantine_path.exists())
            capacity_rescanned = source_db.pipeline_capacity_snapshot()
            self.assertEqual(
                capacity_rescanned['quarantine_items'],
                capacity_after['quarantine_items'] - int(quarantined['capacity_items']),
            )
            self.assertEqual(
                capacity_rescanned['quarantine_bytes'],
                capacity_after['quarantine_bytes'] - int(quarantined['capacity_bytes']),
            )
            still_owned = source_db.conn.execute(
                '''SELECT state, lease_reservation_id FROM docker_content_blobs
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (content_digest, policy_two),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (still_owned['state'], still_owned['lease_reservation_id']),
                ('leased', fourth['reservation_id']),
            )
            self.assertNotEqual(shared['reservation_id'], owner['reservation_id'])
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_docker_layer_checkpoints_resume_without_rescanning_covered_blobs(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='dockerhub')
            cycle_id = source_db.start_source_cycle(
                run_id, 'dockerhub', 'docker', 'integration', 'checkpoint-resume',
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
            ).start()
            producer = current_process_identity()
            capacity_limits = {
                'bundle_items': 20, 'bundle_bytes': 128 * 1024 * 1024,
                'projection_items': 20, 'projection_bytes': 128 * 1024 * 1024,
                'keycheck_items': 20, 'keycheck_bytes': 32 * 1024 * 1024,
            }
            limits = {
                'config_max_bytes': 1024 * 1024,
                'layer_max_bytes': 8 * 1024 * 1024,
                'image_max_bytes': 16 * 1024 * 1024,
                'max_layers': 2,
                'archive_max_size_bytes': 8 * 1024 * 1024,
                'archive_max_depth': 4,
                'archive_timeout_sec': 30,
                'blob_timeout_sec': 600,
                'filesystem_concurrency': 2,
                'blob_max_attempts': 3,
            }
            manifest = 'sha256:' + ('a' * 64)
            config_digest = 'sha256:' + ('b' * 64)
            base_digest = 'sha256:' + ('c' * 64)
            middle_digest = 'sha256:' + ('e' * 64)
            top_digest = 'sha256:' + ('d' * 64)
            target = f'example/checkpoint-resume@{manifest}'
            resolution = {
                'version': 1,
                'image': target,
                'repository': 'example/checkpoint-resume',
                'manifest_digest': manifest,
                'platform_os': 'linux',
                'platform_arch': 'amd64',
                'manifest_media_type': 'application/vnd.oci.image.manifest.v1+json',
                'config': {
                    'digest': config_digest, 'size': 1024,
                    'media_type': 'application/vnd.oci.image.config.v1+json',
                },
                'layers': [
                    {
                        'digest': base_digest, 'size': 2048,
                        'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    },
                    {
                        'digest': middle_digest, 'size': 3072,
                        'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    },
                    {
                        'digest': top_digest, 'size': 4096,
                        'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    },
                ],
            }
            self.assertEqual(
                source_db.enqueue_targets('dockerhub', 'docker', 'integration', [target]), 1,
            )

            def reserve(sequence):
                return source_db.reserve_and_claim_target(
                    'dockerhub', 'docker', producer, 'integration-supervisor',
                    4 * 1024 * 1024, 4 * 1024 * 1024, 4, 1024 * 1024,
                    run_id=run_id, cycle_id=cycle_id,
                    capacity_limits=capacity_limits,
                    reservation_token=f'docker-checkpoint-{sequence}',
                    bundle_id=f'{sequence + 1000:064x}',
                    scan_event_id=f'{sequence + 2000:064x}',
                    claim_order='newest',
                )

            def stage_checkpoint(claimed, plan, done):
                leased = [
                    item for item in plan['descriptors']
                    if item['coverage_state'] == 'leased'
                ]
                self.assertEqual(len(leased), 1)
                descriptor = leased[0]
                plan_sha256 = hashlib.sha256(
                    canonical_docker_layer_plan_bytes(plan)
                ).hexdigest()
                timestamp = datetime.now(timezone.utc).isoformat(timespec='seconds')
                result = {
                    'scan_event_id': claimed['scan_event_id'],
                    'target': claimed['target'],
                    'scan_type': 'docker',
                    'timestamp': timestamp,
                    'scan_started_at': timestamp,
                    'duration_sec': 0.1,
                    'findings': [],
                    'errors': [] if done else ['next durable content checkpoint'],
                    'retryable': not done,
                    'docker_layer_plan': plan,
                    'docker_layer_execution': {
                        'version': 1,
                        'plan_sha256': plan_sha256,
                        'blobs': [{
                            'digest': descriptor['digest'],
                            'lease_token': descriptor['lease_token'],
                            'status': 'covered',
                            'verified_bytes': descriptor['size'],
                            'transfer_bytes': descriptor['size'],
                            'transfer_duration_ms': 10,
                            'scan_duration_ms': 10,
                            'finding_count': 0,
                            'error_code': None,
                        }],
                    },
                }
                available_after = None
                if not done:
                    available_after = (
                        datetime.now(timezone.utc) + timedelta(minutes=1)
                    ).isoformat(timespec='seconds')
                staged = stage_result_bundle(
                    result,
                    claimed,
                    str(self.bundle_root),
                    {},
                    {
                        'queue_status': 'done' if done else 'deferred',
                        'queue_error': None if done else 'next durable content checkpoint',
                        'available_after': available_after,
                        'reset_attempts': not done,
                    },
                    candidate_max_items=4,
                    candidate_max_bytes=1024 * 1024,
                )
                self.assertTrue(source_db.mark_result_bundle_ready(
                    claimed['reservation_id'], {
                        'bundle_id': staged.bundle_id,
                        'scan_event_id': staged.scan_event_id,
                        'scan_event_hash': staged.scan_event_hash,
                        'relative_path': staged.relative_path,
                        'actual_bytes': staged.actual_bytes,
                        'frame_count': staged.frame_count,
                        'finding_count': staged.finding_count,
                        'error_count': staged.error_count,
                        'candidate_count': staged.candidate_count,
                    },
                ))
                self.assertTrue(ingester.process_one())
                reservation_state = source_db.conn.execute(
                    '''SELECT state, last_error_code, last_error_detail
                       FROM result_reservations WHERE id = ?''',
                    (claimed['reservation_id'],),
                ).fetchone()
                source_db.conn.commit()
                self.assertEqual(
                    reservation_state['state'], 'acknowledged',
                    (reservation_state['last_error_code'], reservation_state['last_error_detail']),
                )
                return descriptor['position']

            initial_claim = reserve(0)
            self.assertIsNotNone(initial_claim)
            self.assertFalse(source_db.docker_layer_timeout_canary_eligible(
                initial_claim['reservation_id'], initial_claim['claim_lease_token'],
            ))
            timeout_at = datetime.now(timezone.utc).isoformat(timespec='seconds')
            timeout_result = {
                'scan_event_id': initial_claim['scan_event_id'],
                'target': initial_claim['target'],
                'scan_type': 'docker',
                'timestamp': timeout_at,
                'scan_started_at': timeout_at,
                'duration_sec': 600.0,
                'findings': [],
                'errors': ['Docker full-image command reached its deadline'],
                'error_class': 'timeout',
                'retryable': True,
                'scan_meta': {'command_timed_out': True},
            }
            timeout_staged = stage_result_bundle(
                timeout_result, initial_claim, str(self.bundle_root), {},
                {
                    'queue_status': 'deferred',
                    'queue_error': 'Docker full-image command reached its deadline',
                    'available_after': (
                        datetime.now(timezone.utc) + timedelta(hours=6)
                    ).isoformat(timespec='seconds'),
                    'reset_attempts': False,
                },
                candidate_max_items=4,
                candidate_max_bytes=1024 * 1024,
            )
            self.assertTrue(source_db.mark_result_bundle_ready(
                initial_claim['reservation_id'], {
                    'bundle_id': timeout_staged.bundle_id,
                    'scan_event_id': timeout_staged.scan_event_id,
                    'scan_event_hash': timeout_staged.scan_event_hash,
                    'relative_path': timeout_staged.relative_path,
                    'actual_bytes': timeout_staged.actual_bytes,
                    'frame_count': timeout_staged.frame_count,
                    'finding_count': timeout_staged.finding_count,
                    'error_count': timeout_staged.error_count,
                    'candidate_count': timeout_staged.candidate_count,
                },
            ))
            self.assertTrue(ingester.process_one())
            source_db.conn.execute(
                '''UPDATE target_queue SET available_after = ?
                   WHERE source = 'dockerhub' AND normalized_target = ?''',
                ('2000-01-01T00:00:00+00:00', target),
            )
            source_db.conn.commit()

            leased_positions = []
            final_reservation_id = None
            for sequence, expected_position in enumerate((0, 3, 2), 1):
                if sequence > 1:
                    source_db.conn.execute(
                        '''UPDATE target_queue SET available_after = ?
                           WHERE source = 'dockerhub' AND normalized_target = ?''',
                        ('2000-01-01T00:00:00+00:00', target),
                    )
                    source_db.conn.commit()
                claimed = reserve(sequence)
                self.assertIsNotNone(claimed)
                self.assertTrue(source_db.docker_layer_timeout_canary_eligible(
                    claimed['reservation_id'], claimed['claim_lease_token'],
                ))
                plan = source_db.bind_docker_layer_plan(
                    claimed['reservation_id'], claimed['claim_lease_token'],
                    resolution, limits, '1' * 64, blob_lease_seconds=60,
                )
                self.assertEqual(
                    [
                        item['position'] for item in plan['descriptors']
                        if item['coverage_state'] == 'leased'
                    ],
                    [expected_position],
                )
                expected_states = {
                    1: ['leased', 'skipped', 'selected', 'selected'],
                    2: ['covered', 'skipped', 'selected', 'leased'],
                    3: ['covered', 'skipped', 'leased', 'covered'],
                }
                self.assertEqual(
                    [item['coverage_state'] for item in plan['descriptors']],
                    expected_states[sequence],
                )
                leased_positions.append(stage_checkpoint(
                    claimed, plan, done=sequence == 3,
                ))
                final_reservation_id = claimed['reservation_id']

            self.assertEqual(leased_positions, [0, 3, 2])
            policy = docker_layer_coverage_policy_sha256('1' * 64, limits)
            blob_rows = source_db.conn.execute(
                '''SELECT digest, state, attempts FROM docker_content_blobs
                   WHERE coverage_policy_sha256 = ? ORDER BY digest''',
                (policy,),
            ).fetchall()
            coverage_rows = source_db.conn.execute(
                '''SELECT position, coverage_state FROM docker_image_blob_coverage
                   WHERE manifest_digest = ? AND coverage_policy_sha256 = ?
                     AND reservation_id = ?
                   ORDER BY position''',
                (manifest, policy, final_reservation_id),
            ).fetchall()
            queue_row = source_db.conn.execute(
                '''SELECT status, attempts FROM target_queue
                   WHERE source = 'dockerhub' AND normalized_target = ?''',
                (target,),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                [(row['digest'], row['state'], row['attempts']) for row in blob_rows],
                sorted([
                    (config_digest, 'covered', 1),
                    (base_digest, 'pending', 0),
                    (middle_digest, 'covered', 1),
                    (top_digest, 'covered', 1),
                ]),
            )
            self.assertEqual(
                [(row['position'], row['coverage_state']) for row in coverage_rows],
                [(0, 'covered'), (1, 'skipped'), (2, 'covered'), (3, 'covered')],
            )
            self.assertEqual((queue_row['status'], queue_row['attempts']), ('done', 1))
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_docker_adaptive_checkpoints_are_frozen_bounded_and_independent(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='dockerhub')
            cycle_id = source_db.start_source_cycle(
                run_id, 'dockerhub', 'docker', 'integration', 'adaptive-checkpoint',
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
            ).start()
            producer = current_process_identity()
            capacity_limits = {
                'bundle_items': 20, 'bundle_bytes': 128 * 1024 * 1024,
                'projection_items': 20, 'projection_bytes': 128 * 1024 * 1024,
                'keycheck_items': 20, 'keycheck_bytes': 32 * 1024 * 1024,
            }
            limits = {
                'config_max_bytes': 1024 * 1024,
                'layer_max_bytes': 8 * 1024 * 1024,
                'image_max_bytes': 8000,
                'max_layers': 2,
                'archive_max_size_bytes': 8 * 1024 * 1024,
                'archive_max_depth': 4,
                'archive_timeout_sec': 30,
                'blob_timeout_sec': 600,
                'filesystem_concurrency': 2,
                'blob_max_attempts': 3,
            }
            checkpoint = {'max_blobs': 2, 'max_bytes': 5000}
            manifest = 'sha256:' + ('1' * 64)
            digests = {
                'config': 'sha256:' + ('2' * 64),
                'bulk': 'sha256:' + ('3' * 64),
                'copy': 'sha256:' + ('4' * 64),
                'package': 'sha256:' + ('5' * 64),
                'app': 'sha256:' + ('6' * 64),
            }
            target = f'example/adaptive-checkpoint@{manifest}'
            resolution = {
                'version': 1,
                'image': target,
                'repository': 'example/adaptive-checkpoint',
                'manifest_digest': manifest,
                'platform_os': 'linux',
                'platform_arch': 'amd64',
                'manifest_media_type': 'application/vnd.oci.image.manifest.v1+json',
                'config': {
                    'digest': digests['config'], 'size': 1024,
                    'media_type': 'application/vnd.oci.image.config.v1+json',
                },
                'layers': [
                    {
                        'digest': digests['bulk'], 'size': 2000,
                        'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    },
                    {
                        'digest': digests['copy'], 'size': 3000,
                        'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    },
                    {
                        'digest': digests['package'], 'size': 4000,
                        'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    },
                    {
                        'digest': digests['app'], 'size': 5000,
                        'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    },
                ],
            }
            payload_classes = [
                'bulk_data', 'copy_add', 'package_run', 'app_config_run',
            ]
            self.assertEqual(
                source_db.enqueue_targets('dockerhub', 'docker', 'integration', [target]), 1,
            )

            def reserve(sequence):
                return source_db.reserve_and_claim_target(
                    'dockerhub', 'docker', producer, 'integration-supervisor',
                    4 * 1024 * 1024, 4 * 1024 * 1024, 4, 1024 * 1024,
                    run_id=run_id, cycle_id=cycle_id,
                    capacity_limits=capacity_limits,
                    reservation_token=f'docker-adaptive-checkpoint-{sequence}',
                    bundle_id=f'{sequence + 3000:064x}',
                    scan_event_id=f'{sequence + 4000:064x}',
                    claim_order='newest',
                )

            def bind(claimed):
                return source_db.bind_docker_layer_plan(
                    claimed['reservation_id'], claimed['claim_lease_token'],
                    resolution, limits, '7' * 64, blob_lease_seconds=60,
                    payload_classes=payload_classes, checkpoint=checkpoint,
                )

            def stage(claimed, plan, outcomes, *, done, reset_attempts):
                leased = {
                    descriptor['digest']: descriptor
                    for descriptor in plan['descriptors']
                    if descriptor['coverage_state'] == 'leased'
                }
                self.assertEqual(set(outcomes), set(leased))
                plan_sha256 = hashlib.sha256(
                    canonical_docker_layer_plan_bytes(plan)
                ).hexdigest()
                records = []
                for digest, status in outcomes.items():
                    descriptor = leased[digest]
                    records.append({
                        'digest': digest,
                        'lease_token': descriptor['lease_token'],
                        'status': status,
                        'verified_bytes': descriptor['size'] if status == 'covered' else 0,
                        'transfer_bytes': descriptor['size'],
                        'transfer_duration_ms': 10,
                        'scan_duration_ms': 10,
                        'finding_count': 0,
                        'error_code': None if status == 'covered' else 'scanner_retry',
                    })
                timestamp = datetime.now(timezone.utc).isoformat(timespec='seconds')
                available_after = None
                if not done:
                    available_after = (
                        datetime.now(timezone.utc) + timedelta(minutes=1)
                    ).isoformat(timespec='seconds')
                staged = stage_result_bundle(
                    {
                        'scan_event_id': claimed['scan_event_id'],
                        'target': claimed['target'],
                        'scan_type': 'docker',
                        'timestamp': timestamp,
                        'scan_started_at': timestamp,
                        'duration_sec': 0.1,
                        'findings': [],
                        'errors': [] if done else ['next adaptive content checkpoint'],
                        'retryable': not done,
                        'docker_layer_plan': plan,
                        'docker_layer_execution': {
                            'version': 2,
                            'plan_sha256': plan_sha256,
                            'blobs': records,
                        },
                    },
                    claimed,
                    str(self.bundle_root),
                    {},
                    {
                        'queue_status': 'done' if done else 'deferred',
                        'queue_error': None if done else 'next adaptive content checkpoint',
                        'available_after': available_after,
                        'reset_attempts': reset_attempts,
                    },
                    candidate_max_items=4,
                    candidate_max_bytes=1024 * 1024,
                )
                self.assertTrue(source_db.mark_result_bundle_ready(
                    claimed['reservation_id'], {
                        'bundle_id': staged.bundle_id,
                        'scan_event_id': staged.scan_event_id,
                        'scan_event_hash': staged.scan_event_hash,
                        'relative_path': staged.relative_path,
                        'actual_bytes': staged.actual_bytes,
                        'frame_count': staged.frame_count,
                        'finding_count': staged.finding_count,
                        'error_count': staged.error_count,
                        'candidate_count': staged.candidate_count,
                    },
                ))
                self.assertTrue(ingester.process_one())

            plans = []
            first = reserve(1)
            self.assertIsNotNone(first)
            first_plan = bind(first)
            plans.append(first_plan)
            self.assertEqual(first_plan['version'], 2)
            self.assertEqual(
                [
                    descriptor['digest'] for descriptor in first_plan['descriptors']
                    if descriptor['coverage_state'] == 'leased'
                ],
                [digests['config'], digests['copy']],
            )
            stage(
                first,
                first_plan,
                {digests['config']: 'covered', digests['copy']: 'retryable_failed'},
                done=False,
                reset_attempts=False,
            )
            source_db.conn.execute(
                '''UPDATE target_queue SET available_after = ?
                   WHERE source = 'dockerhub' AND normalized_target = ?''',
                ('2000-01-01T00:00:00+00:00', target),
            )
            source_db.conn.execute(
                '''UPDATE docker_content_blobs SET available_after = ?
                   WHERE digest = ? AND coverage_policy_sha256 = ?''',
                (
                    '2000-01-01T00:00:00+00:00', digests['copy'],
                    first_plan['execution_policy_sha256'],
                ),
            )
            source_db.conn.commit()

            second = reserve(2)
            self.assertIsNotNone(second)
            second_plan = bind(second)
            plans.append(second_plan)
            self.assertEqual(
                [
                    descriptor['digest'] for descriptor in second_plan['descriptors']
                    if descriptor['coverage_state'] == 'leased'
                ],
                [digests['copy']],
            )
            self.assertEqual(second_plan['descriptors'][0]['coverage_state'], 'covered')
            stage(
                second, second_plan, {digests['copy']: 'covered'},
                done=False, reset_attempts=True,
            )
            source_db.conn.execute(
                '''UPDATE target_queue SET available_after = ?
                   WHERE source = 'dockerhub' AND normalized_target = ?''',
                ('2000-01-01T00:00:00+00:00', target),
            )
            source_db.conn.commit()

            third = reserve(3)
            self.assertIsNotNone(third)
            third_plan = bind(third)
            plans.append(third_plan)
            self.assertEqual(
                [
                    descriptor['digest'] for descriptor in third_plan['descriptors']
                    if descriptor['coverage_state'] == 'leased'
                ],
                [digests['app']],
            )
            stage(
                third, third_plan, {digests['app']: 'covered'},
                done=True, reset_attempts=False,
            )

            expected_selection = [
                (True, 'config_selected'),
                (False, 'layer_limit_exhausted'),
                (True, 'selected_copy_add'),
                (False, 'layer_limit_exhausted'),
                (True, 'selected_app_config_run'),
            ]
            self.assertTrue(all(
                [
                    (descriptor['selected'], descriptor['selection_reason'])
                    for descriptor in plan['descriptors']
                ] == expected_selection
                for plan in plans
            ))
            self.assertEqual(len({plan['selection_policy_sha256'] for plan in plans}), 1)
            policy = third_plan['execution_policy_sha256']
            blob_rows = source_db.conn.execute(
                '''SELECT digest, state, attempts FROM docker_content_blobs
                   WHERE coverage_policy_sha256 = ? ORDER BY digest''',
                (policy,),
            ).fetchall()
            coverage_rows = source_db.conn.execute(
                '''SELECT position, selected, selection_reason, coverage_state,
                          selection_policy_sha256
                   FROM docker_image_blob_coverage
                   WHERE reservation_id = ? ORDER BY position''',
                (third['reservation_id'],),
            ).fetchall()
            source_db.conn.commit()
            self.assertEqual(
                [(row['digest'], row['state'], row['attempts']) for row in blob_rows],
                sorted([
                    (digests['config'], 'covered', 1),
                    (digests['bulk'], 'pending', 0),
                    (digests['copy'], 'covered', 2),
                    (digests['package'], 'pending', 0),
                    (digests['app'], 'covered', 1),
                ]),
            )
            self.assertEqual(
                [
                    (
                        row['position'], bool(row['selected']), row['selection_reason'],
                        row['coverage_state'], row['selection_policy_sha256'],
                    )
                    for row in coverage_rows
                ],
                [
                    (0, True, 'config_selected', 'covered', third_plan['selection_policy_sha256']),
                    (1, False, 'layer_limit_exhausted', 'skipped', third_plan['selection_policy_sha256']),
                    (2, True, 'selected_copy_add', 'covered', third_plan['selection_policy_sha256']),
                    (3, False, 'layer_limit_exhausted', 'skipped', third_plan['selection_policy_sha256']),
                    (4, True, 'selected_app_config_run', 'covered', third_plan['selection_policy_sha256']),
                ],
            )
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_reviewed_docker_depth_cohort_postgres_apply_is_atomic_and_idempotent(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            queries = tuple(f'pg-operator-query-{index:02d}' for index in range(61))
            config = {
                'global': {
                    'database_url': self.dsn,
                    'sync_file_queues': False,
                },
                'sources': {'dockerhub': {
                    'mode': 'search',
                    'require_digest': True,
                    'queries': list(queries),
                    'pages': 30,
                    'per_page': 100,
                    'docker_platform_candidate_tags': 20,
                    'docker_images_per_repository': 3,
                    'docker_depth_experiment': {
                        'experiment_key': 'pg-reviewed-cohort-v1',
                        'enabled': False,
                        'queries': list(queries),
                        'repositories_per_query': 10,
                        'shallow_images_per_repository': 1,
                        'deep_repositories_per_query': 1,
                        'deep_images_per_repository': 10,
                        'target_limit': 1200,
                        'selector_version': depth.DOCKER_DEPTH_SELECTOR_VERSION,
                    },
                }},
            }
            experiment = depth.validate_docker_depth_config(config).experiment
            policy_sha256 = 'b' * 64
            now = scanner_db.utc_now_iso()
            discovery_pass = db.conn.execute(
                '''INSERT INTO docker_discovery_passes(
                       pass_token, source, pass_kind, policy_sha256,
                       ordered_queries_sha256, expected_query_count,
                       completed_query_count, state, started_at, completed_at,
                       created_at, updated_at
                   ) VALUES ('pg-reviewed-cohort-pass', 'dockerhub', 'deep', ?, ?,
                             61, 61, 'complete', ?, ?, ?, ?) RETURNING id''',
                (policy_sha256, experiment.ordered_query_hash, now, now, now, now),
            ).fetchone()
            for query_ordinal, query in enumerate(queries):
                selected_count = 9 if query_ordinal == 0 else (
                    0 if query_ordinal == 1 else 10
                )
                page = db.conn.execute(
                    '''INSERT INTO docker_discovery_pages(
                           pass_id, query, query_ordinal, page_number, result_count,
                           admitted_count, query_complete, admission_kind, page_sha256,
                           observed_at, created_at
                        ) VALUES (?, ?, ?, 1, ?, ?, 1, 'main', ?, ?, ?)
                        RETURNING id''',
                    (
                        discovery_pass['id'], query, query_ordinal,
                        selected_count, selected_count,
                        f'{query_ordinal + 1:064x}', now, now,
                    ),
                ).fetchone()
                for rank in range(1, selected_count + 1):
                    repository = f'owner/pg-operator-q{query_ordinal:02d}-r{rank:02d}'
                    queue = db.conn.execute(
                        '''INSERT INTO target_queue(
                               source, platform, query, target, normalized_target,
                               status, resolver_state, created_at, updated_at
                           ) VALUES ('dockerhub', 'docker', ?, ?, ?, 'deferred',
                                     'pending', ?, ?) RETURNING id''',
                        (query, repository, repository, now, now),
                    ).fetchone()
                    db.conn.execute(
                        '''INSERT INTO docker_repository_query_provenance(
                               source, query, repository_queue_id, provenance_kind,
                               first_observed_at, last_observed_at, first_search_rank,
                               best_search_rank, last_search_rank, first_page_id,
                               last_page_id, first_policy_sha256, last_policy_sha256,
                               observation_count, fresh_observation_count,
                               fresh_complete_observation_count, fresh_coverage_eligible,
                               created_at, updated_at
                           ) VALUES ('dockerhub', ?, ?, 'fresh_page', ?, ?, ?, ?, ?, ?, ?, ?, ?,
                                     1, 1, 1, 1, ?, ?)''',
                        (
                            query, queue['id'], now, now, rank, rank, rank,
                            page['id'], page['id'], policy_sha256, policy_sha256,
                            now, now,
                        ),
                    )
                    db.conn.execute(
                        '''INSERT INTO docker_repository_query_observations(
                               page_id, repository_queue_id, source, query,
                               search_rank, observed_at
                           ) VALUES (?, ?, 'dockerhub', ?, ?, ?)''',
                        (page['id'], queue['id'], query, rank, now),
                    )
            db.conn.commit()

            manifest, manifest_sha256 = depth.generate_docker_depth_cohort_manifest(
                db, experiment, policy_sha256,
            )
            self.assertEqual(db.conn.execute(
                'SELECT COUNT(*) AS count FROM docker_depth_experiments'
            ).fetchone()['count'], 0)
            stale_queue_id = manifest['plan']['queries'][0]['repositories'][0][
                'repository_queue_id'
            ]
            db.conn.execute(
                "UPDATE target_queue SET status = 'cold' WHERE id = ?",
                (stale_queue_id,),
            )
            db.conn.commit()
            with self.assertRaisesRegex(
                    RuntimeError, 'cohort selection drifted after review'):
                depth.apply_docker_depth_cohort_manifest(
                    db, experiment, policy_sha256, manifest, manifest_sha256,
                )
            self.assertEqual(db.conn.execute(
                'SELECT COUNT(*) AS count FROM docker_depth_experiments'
            ).fetchone()['count'], 0)
            db.conn.execute(
                "UPDATE target_queue SET status = 'deferred' WHERE id = ?",
                (stale_queue_id,),
            )
            db.conn.commit()

            applied = depth.apply_docker_depth_cohort_manifest(
                db, experiment, policy_sha256, manifest, manifest_sha256,
            )
            replayed = depth.apply_docker_depth_cohort_manifest(
                db, experiment, policy_sha256, manifest, manifest_sha256,
            )
            self.assertTrue(applied['planned'])
            self.assertFalse(replayed['planned'])
            self.assertEqual(applied['plan_sha256'], replayed['plan_sha256'])
            counts = db.conn.execute(
                '''SELECT
                       (SELECT COUNT(*) FROM docker_depth_experiment_queries) AS queries,
                       (SELECT COUNT(*) FROM docker_depth_experiment_repositories) AS repositories'''
            ).fetchone()
            self.assertEqual((counts['queries'], counts['repositories']), (61, 599))
            selected_counts = db.conn.execute(
                '''SELECT query_ordinal, required_repository_count,
                          selected_repository_count
                   FROM docker_depth_experiment_queries
                   WHERE query_ordinal IN (0, 1)
                   ORDER BY query_ordinal'''
            ).fetchall()
            self.assertEqual(
                [
                    (
                        row['query_ordinal'], row['required_repository_count'],
                        row['selected_repository_count'],
                    )
                    for row in selected_counts
                ],
                [(0, 10, 9), (1, 10, 0)],
            )
        finally:
            db.close()

    def test_docker_depth_resolver_claim_and_shared_completion_are_atomic(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)
            setup_db.record_final_cutover({'test': self.id()})
            queries = tuple(f'pg-resolver-query-{index:02d}' for index in range(61))
            config = {
                'global': {
                    'database_url': self.dsn,
                    'sync_file_queues': False,
                },
                'sources': {'dockerhub': {
                    'mode': 'search',
                    'require_digest': True,
                    'queries': list(queries),
                    'pages': 30,
                    'per_page': 100,
                    'docker_platform_candidate_tags': 20,
                    'docker_images_per_repository': 3,
                    'docker_depth_experiment': {
                        'experiment_key': 'pg-resolver-test-v1',
                        'enabled': True,
                        'queries': list(queries),
                        'repositories_per_query': 10,
                        'shallow_images_per_repository': 1,
                        'deep_repositories_per_query': 1,
                        'deep_images_per_repository': 10,
                        'target_limit': 1200,
                        'selector_version': depth.DOCKER_DEPTH_SELECTOR_VERSION,
                    },
                }},
            }
            experiment_config = depth.validate_docker_depth_config(config).experiment
            policy_sha256 = 'b' * 64
            authority = depth.docker_depth_resolver_authority(
                experiment_config, policy_sha256,
            )
            now = scanner_db.utc_now_iso()
            experiment = setup_db.conn.execute(
                '''INSERT INTO docker_depth_experiments(
                       experiment_key, source, state, config_sha256,
                       ordered_queries_sha256, selector_version, selector_sha256,
                       provenance_policy_sha256, query_count, repositories_per_query,
                       images_per_repository, target_limit, plan_sha256,
                       hold_manifest_sha256, created_at, updated_at
                   ) VALUES (?, 'dockerhub', 'resolving', ?, ?, ?, ?, ?, 61, 10, 10,
                             1200, ?, ?, ?, ?) RETURNING id''',
                (
                    experiment_config.experiment_key, experiment_config.config_hash,
                    experiment_config.ordered_query_hash,
                    experiment_config.selector_version,
                    experiment_config.selector_hash, policy_sha256,
                    'c' * 64, 'd' * 64, now, now,
                ),
            ).fetchone()
            discovery_pass = setup_db.conn.execute(
                '''INSERT INTO docker_discovery_passes(
                       experiment_id, pass_token, source, pass_kind, policy_sha256,
                       ordered_queries_sha256, expected_query_count,
                       completed_query_count, state, started_at, completed_at,
                       created_at, updated_at
                   ) VALUES (?, 'pg-resolver-pass-token', 'dockerhub', 'deep', ?, ?,
                             61, 61, 'complete', ?, ?, ?, ?) RETURNING id''',
                (
                    experiment['id'], policy_sha256,
                    experiment_config.ordered_query_hash, now, now, now, now,
                ),
            ).fetchone()
            queue_by_repository = {}
            for query_ordinal, query in enumerate(queries):
                setup_db.conn.execute(
                    '''INSERT INTO docker_depth_experiment_queries(
                           experiment_id, source, query_ordinal, query, query_sha256,
                           required_repository_count, selected_repository_count, created_at
                        ) VALUES (?, 'dockerhub', ?, ?, ?, 10, 10, ?)''',
                    (
                        experiment['id'], query_ordinal, query,
                        depth._canonical_sha256(query), now,
                    ),
                )
                page = setup_db.conn.execute(
                    '''INSERT INTO docker_discovery_pages(
                           pass_id, query, query_ordinal, page_number, result_count,
                           admitted_count, query_complete, admission_kind, page_sha256,
                           observed_at, created_at
                       ) VALUES (?, ?, ?, 1, 10, 10, 1, 'main', ?, ?, ?)
                       RETURNING id''',
                    (
                        discovery_pass['id'], query, query_ordinal,
                        f'{query_ordinal + 1:064x}', now, now,
                    ),
                ).fetchone()
                for repository_rank in range(1, 11):
                    repository = (
                        'owner/pg-shared'
                        if repository_rank == 1 and query_ordinal in (0, 1)
                        else f'owner/pg-q{query_ordinal:02d}-r{repository_rank:02d}'
                    )
                    queue_id = queue_by_repository.get(repository)
                    if queue_id is None:
                        queue_id = setup_db.conn.execute(
                            '''INSERT INTO target_queue(
                                   source, platform, query, target, normalized_target,
                                   status, resolver_state, created_at, updated_at
                               ) VALUES ('dockerhub', 'docker', ?, ?, ?, 'deferred',
                                         'pending', ?, ?) RETURNING id''',
                            (query, repository, repository, now, now),
                        ).fetchone()['id']
                        queue_by_repository[repository] = queue_id
                    setup_db.conn.execute(
                        '''INSERT INTO docker_repository_query_provenance(
                               source, query, repository_queue_id, provenance_kind,
                               first_observed_at, last_observed_at, first_search_rank,
                               best_search_rank, last_search_rank, first_page_id,
                               last_page_id, first_policy_sha256, last_policy_sha256,
                               observation_count, fresh_observation_count,
                               fresh_complete_observation_count, fresh_coverage_eligible,
                               created_at, updated_at
                           ) VALUES ('dockerhub', ?, ?, 'fresh_page', ?, ?, ?, ?, ?, ?, ?, ?, ?,
                                     1, 1, 1, 1, ?, ?)''',
                        (
                            query, queue_id, now, now, repository_rank,
                            repository_rank, repository_rank, page['id'], page['id'],
                            policy_sha256, policy_sha256, now, now,
                        ),
                    )
                    setup_db.conn.execute(
                        '''INSERT INTO docker_repository_query_observations(
                               page_id, repository_queue_id, source, query,
                               search_rank, observed_at
                           ) VALUES (?, ?, 'dockerhub', ?, ?, ?)''',
                        (page['id'], queue_id, query, repository_rank, now),
                    )
                    setup_db.conn.execute(
                        '''INSERT INTO docker_depth_experiment_repositories(
                               experiment_id, query_ordinal, source, query,
                               repository_queue_id, eligibility_page_id,
                               repository_rank, planned_is_deep_probe, is_deep_probe,
                               work_state, created_at, updated_at
                           ) VALUES (?, ?, 'dockerhub', ?, ?, ?, ?, ?, ?, 'pending', ?, ?)''',
                        (
                            experiment['id'], query_ordinal, query, queue_id,
                            page['id'], repository_rank, int(repository_rank == 1),
                            int(repository_rank == 1), now, now,
                        ),
                    )
            stored_experiment = setup_db.conn.execute(
                'SELECT * FROM docker_depth_experiments WHERE id = ?',
                (experiment['id'],),
            ).fetchone()
            plan_sha256 = depth.canonical_docker_depth_plan_hash(
                depth._stored_cohort_plan(setup_db.conn, stored_experiment, authority)
            )
            setup_db.conn.execute(
                'UPDATE docker_depth_experiments SET plan_sha256 = ? WHERE id = ?',
                (plan_sha256, experiment['id']),
            )
            setup_db.conn.commit()

            barrier = threading.Barrier(2)
            claims = []
            claim_errors = []

            def claim():
                db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    barrier.wait(timeout=10)
                    rows = db.claim_docker_depth_experiment_resolutions(
                        'dockerhub', 1, 'pg-resolver-owner', authority=authority,
                        final_cutover=True,
                    )
                    claims.extend(rows)
                except Exception as exc:
                    claim_errors.append(exc)
                finally:
                    db.close()

            threads = [threading.Thread(target=claim) for _ in range(2)]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(timeout=15)
            self.assertFalse(claim_errors)
            self.assertEqual(
                sorted((row['repository_rank'], row['query_ordinal']) for row in claims),
                [(1, 0), (1, 1)],
            )
            renewed = setup_db.renew_docker_depth_experiment_resolution(
                'dockerhub', claims[0]['id'], claims[0]['resolver_generation'],
                claims[0]['resolver_token'], resolver_owner=claims[0]['resolver_owner'],
                lease_seconds=600, authority=authority, final_cutover=True,
            )
            stale_renewal = setup_db.renew_docker_depth_experiment_resolution(
                'dockerhub', claims[0]['id'], claims[0]['resolver_generation'],
                claims[0]['resolver_token'] + '-stale',
                resolver_owner=claims[0]['resolver_owner'], lease_seconds=600,
                authority=authority, final_cutover=True,
            )
            self.assertTrue(renewed['renewed'])
            self.assertEqual(
                stale_renewal, {'status': 'stale', 'renewed': False},
            )

            layer_digest = 'sha256:' + ('1' * 64)
            manifest_digest = 'sha256:' + ('2' * 64)
            candidate = {
                'target': f'owner/pg-shared@{manifest_digest}',
                'repository': 'owner/pg-shared',
                'manifest_digest': manifest_digest,
                'manifest_media_type': 'application/vnd.oci.image.manifest.v1+json',
                'manifest_size_bytes': 4096,
                'config_digest': 'sha256:' + ('3' * 64),
                'layers': (layer_digest, 'sha256:' + ('4' * 64), layer_digest),
                'layer_descriptors': (
                    {'digest': layer_digest, 'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip', 'size': 10},
                    {'digest': 'sha256:' + ('4' * 64), 'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip', 'size': 20},
                    {'digest': layer_digest, 'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip', 'size': 10},
                ),
                'updated_at': 1,
                'source_index': 0,
            }
            selected = scanner.select_docker_layer_graphs([candidate], 1)
            selected = tuple(
                scanner._docker_depth_selection_evidence(record, 1)
                for record in selected
            )
            outcome = scanner.DockerTagResolutionOutcome(
                tags=tuple(record['target'] for record in selected),
                status='ok', remote_attempted=True,
                selection_records=selected,
                selector_version=depth.DOCKER_DEPTH_SELECTOR_VERSION,
                selector_hash=depth.canonical_selector_hash(
                    depth.DOCKER_DEPTH_SELECTOR_VERSION
                ),
                candidate_distinct_graph_count=1,
                fresh_graph_evidence=True, cache_bypassed=True,
            )
            completion_barrier = threading.Barrier(3)
            completions = []
            page_results = []
            completion_errors = []

            def complete(claim_row):
                db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    completion_barrier.wait(timeout=10)
                    completions.append(db.finish_docker_depth_experiment_resolution(
                        'dockerhub', claim_row['id'], claim_row['resolver_generation'],
                        claim_row['resolver_token'], outcome, complete=True,
                        resolver_owner=claim_row['resolver_owner'], authority=authority,
                        final_cutover=True,
                    ))
                except Exception as exc:
                    completion_errors.append(exc)
                finally:
                    db.close()

            def admit_page():
                db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    completion_barrier.wait(timeout=10)
                    page_results.append(db.persist_dockerhub_discovery_page(
                        'dockerhub', queries[0], ['owner/pg-concurrent-page'],
                        observation={
                            'cycle_id': None, 'query_ordinal': 0,
                            'query_count': 61, 'page_number': 2,
                            'page_limit': 30, 'per_page': 100,
                            'total_count': 101, 'policy_sha256': policy_sha256,
                            'pass_kind': 'deep',
                            'collection_generation': depth.DOCKER_DEPTH_COLLECTION_GENERATION,
                            'ordered_query_hash': experiment_config.ordered_query_hash,
                            'query_complete': True,
                        },
                        experiment_authority=authority, final_cutover=True,
                    ))
                except Exception as exc:
                    completion_errors.append(exc)
                finally:
                    db.close()

            threads = [
                *(threading.Thread(target=complete, args=(row,)) for row in claims),
                threading.Thread(target=admit_page),
            ]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(timeout=15)
            self.assertTrue(all(not thread.is_alive() for thread in threads))
            self.assertFalse(completion_errors)
            self.assertEqual([result['status'] for result in completions], ['resolved', 'resolved'])
            self.assertEqual(page_results[0]['dynamic_hold_count'], 1)
            counts = setup_db.conn.execute(
                '''SELECT
                       (SELECT target_count FROM docker_depth_experiments WHERE id = ?) AS targets,
                       (SELECT selection_count FROM docker_depth_experiments WHERE id = ?) AS selections,
                       (SELECT COUNT(*) FROM docker_image_manifests) AS manifests,
                       (SELECT COUNT(*) FROM docker_manifest_layers) AS layers,
                       (SELECT COUNT(*) FROM docker_depth_experiment_targets) AS physical''',
                (experiment['id'], experiment['id']),
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(
                (
                    counts['targets'], counts['selections'], counts['manifests'],
                    counts['layers'], counts['physical'],
                ),
                (1, 2, 1, 3, 1),
            )
            self.assertFalse(setup_db.has_claimable_targets_v2(
                'dockerhub', 'docker', max_attempts=3,
            ))
            positions = setup_db.conn.execute(
                '''SELECT layer_digest, position_from_base, position_from_top
                   FROM docker_manifest_layers ORDER BY position_from_base'''
            ).fetchall()
            setup_db.conn.commit()
            self.assertEqual(
                [(row['layer_digest'], row['position_from_base'], row['position_from_top'])
                 for row in positions],
                [(layer_digest, 1, 3), ('sha256:' + ('4' * 64), 2, 2), (layer_digest, 3, 1)],
            )

            conflict_claim = setup_db.claim_docker_depth_experiment_resolutions(
                'dockerhub', 1, 'pg-conflict-owner', authority=authority,
                final_cutover=True,
            )[0]
            backup_repository = f'owner/pg-backup-{conflict_claim["query_ordinal"]:02d}'
            backup_queue = setup_db.conn.execute(
                '''INSERT INTO target_queue(
                       source, platform, query, target, normalized_target, status,
                       resolver_state, created_at, updated_at
                   ) VALUES ('dockerhub', 'docker', ?, ?, ?, 'deferred', 'pending',
                             ?, ?) RETURNING id''',
                (
                    conflict_claim['query'], backup_repository, backup_repository,
                    now, now,
                ),
            ).fetchone()
            backup_page_id = setup_db.conn.execute(
                '''SELECT eligibility_page_id
                   FROM docker_depth_experiment_repositories WHERE id = ?''',
                (conflict_claim['id'],),
            ).fetchone()['eligibility_page_id']
            setup_db.conn.execute(
                '''INSERT INTO docker_repository_query_provenance(
                       source, query, repository_queue_id, provenance_kind,
                       first_observed_at, last_observed_at, first_search_rank,
                       best_search_rank, last_search_rank, first_page_id,
                       last_page_id, first_policy_sha256, last_policy_sha256,
                       observation_count, fresh_observation_count,
                       fresh_complete_observation_count, fresh_coverage_eligible,
                       created_at, updated_at
                   ) VALUES ('dockerhub', ?, ?, 'fresh_page', ?, ?, 11, 11, 11,
                             ?, ?, ?, ?, 1, 1, 1, 1, ?, ?)''',
                (
                    conflict_claim['query'], backup_queue['id'], now, now,
                    backup_page_id, backup_page_id, policy_sha256, policy_sha256,
                    now, now,
                ),
            )
            setup_db.conn.execute(
                '''INSERT INTO docker_repository_query_observations(
                       page_id, repository_queue_id, source, query,
                       search_rank, observed_at
                   ) VALUES (?, ?, 'dockerhub', ?, 11, ?)''',
                (
                    backup_page_id, backup_queue['id'], conflict_claim['query'], now,
                ),
            )
            conflict_manifest_digest = 'sha256:' + ('5' * 64)
            conflict_target = f'{conflict_claim["target"]}@{conflict_manifest_digest}'
            setup_db.conn.execute(
                '''INSERT INTO target_queue(
                       source, platform, query, target, normalized_target, status,
                       created_at, updated_at, completed_at
                   ) VALUES ('dockerhub', 'docker', ?, ?, ?, 'done', ?, ?, ?)''',
                (
                    conflict_claim['query'], conflict_target, conflict_target,
                    now, now, now,
                ),
            )
            setup_db.conn.commit()
            conflict_candidate = {
                'target': conflict_target,
                'repository': conflict_claim['target'],
                'manifest_digest': conflict_manifest_digest,
                'manifest_media_type': 'application/vnd.oci.image.manifest.v1+json',
                'manifest_size_bytes': 2048,
                'config_digest': 'sha256:' + ('6' * 64),
                'layers': ('sha256:' + ('7' * 64),),
                'layer_descriptors': ({
                    'digest': 'sha256:' + ('7' * 64),
                    'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    'size': 30,
                },),
                'updated_at': 1,
                'source_index': 0,
            }
            conflict_selected = tuple(
                scanner._docker_depth_selection_evidence(record, 1)
                for record in scanner.select_docker_layer_graphs(
                    [conflict_candidate], 1,
                )
            )
            conflict_outcome = scanner.DockerTagResolutionOutcome(
                tags=tuple(record['target'] for record in conflict_selected),
                status='ok', remote_attempted=True,
                selection_records=conflict_selected,
                selector_version=depth.DOCKER_DEPTH_SELECTOR_VERSION,
                selector_hash=depth.canonical_selector_hash(
                    depth.DOCKER_DEPTH_SELECTOR_VERSION
                ),
                candidate_distinct_graph_count=1,
                fresh_graph_evidence=True, cache_bypassed=True,
            )
            conflict = setup_db.finish_docker_depth_experiment_resolution(
                'dockerhub', conflict_claim['id'],
                conflict_claim['resolver_generation'],
                conflict_claim['resolver_token'], conflict_outcome, complete=True,
                resolver_owner=conflict_claim['resolver_owner'], authority=authority,
                final_cutover=True,
            )
            self.assertEqual(conflict['status'], 'replaced')
            rollback_counts = setup_db.conn.execute(
                '''SELECT
                       (SELECT target_count FROM docker_depth_experiments WHERE id = ?) AS targets,
                       (SELECT selection_count FROM docker_depth_experiments WHERE id = ?) AS selections,
                       (SELECT COUNT(*) FROM docker_image_manifests) AS manifests,
                       (SELECT COUNT(*) FROM docker_depth_experiment_targets) AS physical''',
                (experiment['id'], experiment['id']),
            ).fetchone()
            conflict_member = setup_db.conn.execute(
                '''SELECT work_state, resolver_due_at, resolver_token,
                          replacement_repository_queue_id
                   FROM docker_depth_experiment_repositories WHERE id = ?''',
                (conflict_claim['id'],),
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(
                (
                    rollback_counts['targets'], rollback_counts['selections'],
                    rollback_counts['manifests'], rollback_counts['physical'],
                ),
                (1, 2, 1, 1),
            )
            self.assertEqual(conflict_member['work_state'], 'pending')
            self.assertIsNone(conflict_member['resolver_due_at'])
            self.assertIsNone(conflict_member['resolver_token'])
            self.assertEqual(
                conflict_member['replacement_repository_queue_id'], backup_queue['id'],
            )
            skip_rows = setup_db.conn.execute(
                '''SELECT candidate_kind, reason_code,
                          candidate_identity_sha256, evidence_sha256
                   FROM docker_depth_experiment_candidate_skips
                   WHERE experiment_repository_id = ? ORDER BY id''',
                (conflict_claim['id'],),
            ).fetchall()
            self.assertEqual(
                [(row['candidate_kind'], row['reason_code']) for row in skip_rows],
                [('image', 'immutable_target_terminal'),
                 ('repository', 'no_eligible_physical_target')],
            )
            self.assertTrue(all(
                len(row['candidate_identity_sha256']) == 64
                and len(row['evidence_sha256']) == 64
                for row in skip_rows
            ))

            scarcity_claim = setup_db.claim_docker_depth_experiment_resolutions(
                'dockerhub', 1, 'pg-scarcity-owner', authority=authority,
                final_cutover=True,
            )[0]
            scarcity_manifest_digest = 'sha256:' + ('b' * 64)
            scarcity_layer_digest = 'sha256:' + ('c' * 64)
            scarcity_target = (
                f'{scarcity_claim["target"]}@{scarcity_manifest_digest}'
            )
            setup_db.conn.execute(
                '''INSERT INTO target_queue(
                       source, platform, query, target, normalized_target, status,
                       created_at, updated_at, completed_at
                   ) VALUES ('dockerhub', 'docker', ?, ?, ?, 'done', ?, ?, ?)''',
                (
                    scarcity_claim['query'], scarcity_target, scarcity_target,
                    now, now, now,
                ),
            )
            scarcity_candidate = {
                'target': scarcity_target,
                'repository': scarcity_claim['target'],
                'manifest_digest': scarcity_manifest_digest,
                'manifest_media_type': 'application/vnd.oci.image.manifest.v1+json',
                'manifest_size_bytes': 1024,
                'config_digest': 'sha256:' + ('d' * 64),
                'layers': (scarcity_layer_digest,),
                'layer_descriptors': ({
                    'digest': scarcity_layer_digest,
                    'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    'size': 10,
                },),
                'updated_at': 1,
                'source_index': 0,
            }
            scarcity_selected = tuple(
                scanner._docker_depth_selection_evidence(record, 1)
                for record in scanner.select_docker_layer_graphs(
                    [scarcity_candidate], 1,
                )
            )
            scarcity_outcome = scanner.DockerTagResolutionOutcome(
                tags=tuple(record['target'] for record in scarcity_selected),
                status='ok', remote_attempted=True,
                selection_records=scarcity_selected,
                selector_version=depth.DOCKER_DEPTH_SELECTOR_VERSION,
                selector_hash=depth.canonical_selector_hash(
                    depth.DOCKER_DEPTH_SELECTOR_VERSION
                ),
                candidate_distinct_graph_count=1,
                fresh_graph_evidence=True, cache_bypassed=True,
            )
            setup_db.conn.commit()
            scarcity = setup_db.finish_docker_depth_experiment_resolution(
                'dockerhub', scarcity_claim['id'],
                scarcity_claim['resolver_generation'],
                scarcity_claim['resolver_token'], scarcity_outcome, complete=True,
                resolver_owner=scarcity_claim['resolver_owner'], authority=authority,
                final_cutover=True,
            )
            scarcity_member = setup_db.conn.execute(
                '''SELECT work_state, selected_image_count, last_error_code
                   FROM docker_depth_experiment_repositories WHERE id = ?''',
                (scarcity_claim['id'],),
            ).fetchone()
            scarcity_counts = setup_db.conn.execute(
                '''SELECT target_count, selection_count
                   FROM docker_depth_experiments WHERE id = ?''',
                (experiment['id'],),
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(
                (scarcity['status'], scarcity['reason']),
                ('skipped', depth.DOCKER_DEPTH_REPOSITORY_SKIP_REASON),
            )
            self.assertEqual(
                (
                    scarcity_member['work_state'],
                    scarcity_member['selected_image_count'],
                    scarcity_member['last_error_code'],
                ),
                ('skipped', 0, depth.DOCKER_DEPTH_REPOSITORY_SKIP_REASON),
            )
            self.assertEqual(
                (scarcity_counts['target_count'], scarcity_counts['selection_count']),
                (1, 2),
            )

            deep_manifest_digest = 'sha256:' + ('8' * 64)
            deep_layer_digest = 'sha256:' + ('9' * 64)
            deep_candidate = {
                'target': f'owner/pg-shared@{deep_manifest_digest}',
                'repository': 'owner/pg-shared',
                'manifest_digest': deep_manifest_digest,
                'manifest_media_type': 'application/vnd.oci.image.manifest.v1+json',
                'manifest_size_bytes': 2048,
                'config_digest': 'sha256:' + ('a' * 64),
                'layers': (deep_layer_digest,),
                'layer_descriptors': ({
                    'digest': deep_layer_digest,
                    'media_type': 'application/vnd.oci.image.layer.v1.tar+gzip',
                    'size': 30,
                },),
                'updated_at': 0,
                'source_index': 1,
            }
            deep_records = tuple(
                scanner._docker_depth_selection_evidence(record, 2)
                for record in scanner.select_docker_layer_graphs(
                    [candidate, deep_candidate], 2,
                )
            )
            self.assertEqual(
                [record['target'] for record in deep_records],
                [candidate['target'], deep_candidate['target']],
            )
            setup_db.conn.execute(
                '''UPDATE docker_depth_experiment_selections
                   SET selection_reason = ?, selection_evidence_sha256 = ?,
                       graph_sha256 = ?
                   WHERE experiment_repository_id = ? AND image_rank = 1''',
                (
                    deep_records[0]['selection_reason'],
                    deep_records[0]['selection_evidence_sha256'],
                    deep_records[0]['graph_sha256'], claims[0]['id'],
                ),
            )
            deep_queue = setup_db.conn.execute(
                '''INSERT INTO target_queue(
                       source, platform, query, target, normalized_target,
                       status, created_at, updated_at
                   ) VALUES ('dockerhub', 'docker', ?, ?, ?, 'pending', ?, ?)
                   RETURNING id''',
                (
                    claims[0]['query'], deep_records[1]['target'],
                    deep_records[1]['target'], now, now,
                ),
            ).fetchone()
            deep_manifest = setup_db.conn.execute(
                '''INSERT INTO docker_image_manifests(
                       target_queue_id, source, repository, manifest_digest,
                       manifest_media_type, config_digest, graph_sha256,
                       manifest_size_bytes, layer_count, resolved_at, created_at
                   ) VALUES (?, 'dockerhub', ?, ?, ?, ?, ?, ?, ?, ?, ?)
                   RETURNING id''',
                (
                    deep_queue['id'], deep_records[1]['repository'],
                    deep_records[1]['manifest_digest'],
                    deep_records[1]['manifest_media_type'],
                    deep_records[1]['config_digest'], deep_records[1]['graph_sha256'],
                    deep_records[1]['manifest_size_bytes'], deep_records[1]['layer_count'],
                    now, now,
                ),
            ).fetchone()
            for layer in deep_records[1]['layer_metadata']:
                setup_db.conn.execute(
                    '''INSERT INTO docker_manifest_layers(
                           manifest_id, position_from_base, position_from_top,
                           layer_digest, media_type, layer_size_bytes,
                           descriptor_sha256, created_at
                       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)''',
                    (
                        deep_manifest['id'], layer['position_from_base'],
                        layer['position_from_top'], layer['digest'], layer['media_type'],
                        layer['size_bytes'], layer['descriptor_sha256'], now,
                    ),
                )
            deep_target = setup_db.conn.execute(
                '''INSERT INTO docker_depth_experiment_targets(
                       experiment_id, target_queue_id, manifest_id, counter_ordinal,
                       state, dispatch_wave, dispatch_order, created_at, updated_at
                   ) VALUES (?, ?, ?, 2, 'pending', 2, 1, ?, ?) RETURNING id''',
                (experiment['id'], deep_queue['id'], deep_manifest['id'], now, now),
            ).fetchone()
            setup_db.conn.execute(
                '''INSERT INTO docker_depth_experiment_selections(
                       experiment_id, query_ordinal, experiment_repository_id,
                       experiment_target_id, image_rank, selection_reason,
                       selection_evidence_sha256, graph_sha256,
                       selected_at, created_at
                   ) VALUES (?, ?, ?, ?, 2, ?, ?, ?, ?, ?)''',
                (
                    experiment['id'], claims[0]['query_ordinal'], claims[0]['id'],
                    deep_target['id'], deep_records[1]['selection_reason'],
                    deep_records[1]['selection_evidence_sha256'],
                    deep_records[1]['graph_sha256'], now, now,
                ),
            )
            stored_experiment = setup_db.conn.execute(
                'SELECT * FROM docker_depth_experiments WHERE id = ?',
                (experiment['id'],),
            ).fetchone()
            pending_members = setup_db.conn.execute(
                '''SELECT * FROM docker_depth_experiment_repositories
                   WHERE experiment_id = ? AND work_state = 'pending'
                   ORDER BY id''',
                (experiment['id'],),
            ).fetchall()
            for member in pending_members:
                setup_db.conn.execute(
                    '''UPDATE docker_depth_experiment_repositories
                       SET work_state = 'skipped', is_deep_probe = 0,
                           selected_image_count = 0, last_error_code = ?,
                           resolver_due_at = NULL, resolved_at = ?, updated_at = ?
                       WHERE id = ?''',
                    (
                        depth.DOCKER_DEPTH_REPOSITORY_SKIP_REASON,
                        now, now, member['id'],
                    ),
                )
                repository_queue_id = int(
                    member['replacement_repository_queue_id']
                    or member['repository_queue_id']
                )
                setup_db._record_docker_depth_candidate_skip_locked(
                    stored_experiment, member, repository_queue_id,
                    'repository', int(member['replacement_count']) + 1,
                    {'repository_queue_id': repository_queue_id},
                    depth.DOCKER_DEPTH_REPOSITORY_SKIP_REASON, now,
                )
            setup_db.conn.execute(
                '''UPDATE docker_depth_experiment_repositories
                   SET is_deep_probe = 0
                   WHERE experiment_id = ? AND work_state = 'skipped' ''',
                (experiment['id'],),
            )
            setup_db.conn.execute(
                '''UPDATE docker_depth_experiment_repositories
                   SET is_deep_probe = 1, candidate_distinct_graph_count = 2,
                       selected_image_count = 2
                   WHERE id = ?''',
                (claims[0]['id'],),
            )
            stored_experiment = setup_db.conn.execute(
                'SELECT * FROM docker_depth_experiments WHERE id = ?',
                (experiment['id'],),
            ).fetchone()
            runtime_selection_sha256 = (
                setup_db._docker_depth_runtime_selection_sha256_locked(
                    stored_experiment, authority,
                )
            )
            setup_db.conn.execute(
                '''UPDATE docker_depth_experiments
                   SET state = 'active', target_count = 2, selection_count = 3,
                       selection_sha256 = ?,
                       activated_at = ?, updated_at = ? WHERE id = ?''',
                (runtime_selection_sha256, now, now, experiment['id']),
            )
            setup_db.conn.execute(
                '''INSERT INTO pipeline_leases(
                       worker_name, generation, lease_token, supervisor_instance_id,
                       state, lease_expires_at, updated_at
                   ) VALUES ('result_ingester', 1, 'pg-dispatch-ingester',
                             'pg-dispatch-supervisor', 'ready',
                             '2999-01-01T00:00:00+00:00', ?)
                   ON CONFLICT(worker_name) DO UPDATE SET
                       supervisor_instance_id = excluded.supervisor_instance_id,
                       state = excluded.state,
                       lease_expires_at = excluded.lease_expires_at,
                       updated_at = excluded.updated_at''',
                (now,),
            )
            setup_db.conn.commit()

            limits = {
                'bundle_items': 10, 'bundle_bytes': 1024 * 1024,
                'projection_items': 10, 'projection_bytes': 1024 * 1024,
                'keycheck_items': 10, 'keycheck_bytes': 1024 * 1024,
            }

            def reserve(label, bundle_digit, event_digit):
                return setup_db.reserve_and_claim_target(
                    'dockerhub', 'docker', current_process_identity(),
                    'pg-dispatch-supervisor', 4096, 2048, 1, 128,
                    capacity_limits=limits, reservation_token=label,
                    bundle_id=bundle_digit * 32, scan_event_id=event_digit * 32,
                    docker_depth_authority=authority, final_cutover=True,
                )

            import psycopg
            setup_db.conn.execute(
                '''CREATE FUNCTION fail_docker_depth_binding() RETURNS trigger
                   LANGUAGE plpgsql AS $$
                   BEGIN RAISE EXCEPTION 'synthetic binding rollback'; END $$'''
            )
            setup_db.conn.execute(
                '''CREATE TRIGGER fail_docker_depth_binding
                   BEFORE INSERT ON docker_depth_experiment_scan_bindings
                   FOR EACH ROW EXECUTE FUNCTION fail_docker_depth_binding()'''
            )
            setup_db.conn.commit()
            with self.assertRaises(psycopg.errors.RaiseException):
                reserve('pg-binding-rollback', 'b', 'c')
            rolled_back = setup_db.conn.execute(
                '''SELECT target.state, target.reservation_count, queue.status,
                          queue.current_result_reservation_id
                   FROM docker_depth_experiment_targets target
                   JOIN target_queue queue ON queue.id = target.target_queue_id
                   WHERE target.dispatch_wave = 1'''
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(
                (
                    rolled_back['state'], rolled_back['reservation_count'],
                    rolled_back['status'], rolled_back['current_result_reservation_id'],
                ),
                ('pending', 0, 'pending', None),
            )
            self.assertEqual(setup_db.conn.execute(
                'SELECT COUNT(*) AS count FROM result_reservations'
            ).fetchone()['count'], 0)
            setup_db.conn.commit()
            setup_db.conn.execute(
                'DROP TRIGGER fail_docker_depth_binding '
                'ON docker_depth_experiment_scan_bindings'
            )
            setup_db.conn.execute('DROP FUNCTION fail_docker_depth_binding()')
            setup_db.conn.commit()

            blocker = ScannerDB(db_url=self.dsn, initialize=False)
            try:
                blocker.conn.execute(
                    '''SELECT id FROM docker_depth_experiment_targets
                       WHERE experiment_id = ? AND dispatch_wave = 1 FOR UPDATE''',
                    (experiment['id'],),
                ).fetchone()
                self.assertIsNone(reserve('pg-wave-barrier', 'd', 'e'))
                self.assertEqual(setup_db.conn.execute(
                    'SELECT COUNT(*) AS count FROM docker_depth_experiment_scan_bindings'
                ).fetchone()['count'], 0)
                setup_db.conn.commit()
            finally:
                blocker.conn.rollback()
                blocker.close()

            breadth = reserve('pg-breadth-dispatch', 'f', '1')
            self.assertIsNone(reserve('pg-deep-barrier', '2', '3'))
            staged = stage_result_bundle(
                {
                    'scan_event_id': breadth['scan_event_id'],
                    'target': breadth['target'], 'scan_type': 'docker',
                    'timestamp': '2026-09-10T00:00:00+00:00',
                    'scan_started_at': '2026-09-10T00:00:00+00:00',
                    'duration_sec': 1.0, 'findings': [], 'errors': [],
                },
                breadth, str(self.bundle_root), {},
                {'queue_status': 'done', 'queue_error': None, 'available_after': None},
                candidate_max_items=10, candidate_max_bytes=1024 * 1024,
            )
            self.assertTrue(setup_db.mark_result_bundle_ready(
                breadth['reservation_id'], {
                    'bundle_id': staged.bundle_id,
                    'scan_event_id': staged.scan_event_id,
                    'scan_event_hash': staged.scan_event_hash,
                    'relative_path': staged.relative_path,
                    'actual_bytes': staged.actual_bytes,
                    'frame_count': staged.frame_count,
                    'finding_count': staged.finding_count,
                    'error_count': staged.error_count,
                    'candidate_count': staged.candidate_count,
                },
            ))
            breadth_reservation = dict(setup_db.conn.execute(
                'SELECT * FROM result_reservations WHERE id = ?',
                (breadth['reservation_id'],),
            ).fetchone())
            breadth_bundle = dict(setup_db.conn.execute(
                'SELECT * FROM result_bundles WHERE reservation_id = ?',
                (breadth['reservation_id'],),
            ).fetchone())
            setup_db.conn.commit()
            experiment_locked = threading.Event()
            release_ingestion = threading.Event()
            ingestion_results = []
            validator_results = []
            concurrency_errors = []

            def ingest_while_locked():
                db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    db._lock_docker_depth_experiment_for_reservation(
                        breadth['reservation_id']
                    )
                    experiment_locked.set()
                    release_ingestion.wait(timeout=10)
                    path = self.bundle_root.joinpath(*staged.relative_path.split('/'))
                    ingestion_results.append(db.ingest_result_bundle(
                        ResultBundleReader(str(path)), breadth_reservation,
                        breadth_bundle,
                    ))
                except Exception as exc:
                    concurrency_errors.append(exc)
                finally:
                    db.close()

            def validate_after_ingestion():
                db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    validator_results.append(db.refresh_docker_depth_experiment_state(
                        authority, final_cutover=True,
                    ))
                except Exception as exc:
                    concurrency_errors.append(exc)
                finally:
                    db.close()

            ingest_thread = threading.Thread(target=ingest_while_locked)
            ingest_thread.start()
            self.assertTrue(experiment_locked.wait(timeout=10))
            validator_thread = threading.Thread(target=validate_after_ingestion)
            validator_thread.start()
            time.sleep(0.2)
            self.assertTrue(validator_thread.is_alive())
            release_ingestion.set()
            ingest_thread.join(timeout=15)
            validator_thread.join(timeout=15)
            self.assertFalse(ingest_thread.is_alive())
            self.assertFalse(validator_thread.is_alive())
            self.assertFalse(concurrency_errors)
            self.assertTrue(ingestion_results[0]['ingested'])
            self.assertEqual(validator_results[0]['status'], 'active')
            deep = reserve('pg-deep-dispatch', '4', '5')
            self.assertEqual(
                [(breadth['dispatch_wave'], breadth['dispatch_order']),
                 (deep['dispatch_wave'], deep['dispatch_order'])],
                [(1, 1), (2, 1)],
            )
            bound = setup_db.conn.execute(
                '''SELECT target.id, COUNT(selection.id) AS attributions,
                          COUNT(DISTINCT binding.id) AS bindings,
                          MIN(reservation.queue_id) AS reservation_queue_id,
                          target.target_queue_id
                   FROM docker_depth_experiment_targets target
                   JOIN docker_depth_experiment_selections selection
                     ON selection.experiment_target_id = target.id
                   JOIN docker_depth_experiment_scan_bindings binding
                     ON binding.experiment_target_id = target.id
                   JOIN result_reservations reservation
                     ON reservation.id = binding.reservation_id
                   WHERE target.dispatch_wave = 1
                   GROUP BY target.id, target.target_queue_id'''
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(
                (bound['attributions'], bound['bindings'],
                 bound['reservation_queue_id'], bound['target_queue_id']),
                (2, 1, bound['target_queue_id'], bound['target_queue_id']),
            )

            self.assertTrue(setup_db.refund_uncommitted_reservation(
                deep['reservation_id'], current_process_identity(),
                'exercise atomic saturation hold', partial_absence_confirmed=True,
            ))
            saturated = setup_db.reserve_and_claim_target(
                'dockerhub', 'docker', current_process_identity(),
                'pg-dispatch-supervisor', 4096, 2048, 1, 128,
                capacity_limits={
                    'bundle_items': 0, 'bundle_bytes': 0,
                    'projection_items': 0, 'projection_bytes': 0,
                    'keycheck_items': 0, 'keycheck_bytes': 0,
                },
                reservation_token='pg-atomic-saturation',
                bundle_id='7' * 32, scan_event_id='8' * 32,
                docker_depth_authority=authority, final_cutover=True,
            )
            self.assertIsNone(saturated)
            final = setup_db.conn.execute(
                '''SELECT experiment.state AS experiment_state,
                          experiment.hold_reason_code, intent.state AS intent_state,
                          intent.resolution_detail, intent.reservation_id
                   FROM docker_depth_experiments experiment
                   JOIN admission_intents intent
                     ON intent.reservation_token = 'pg-atomic-saturation'
                   WHERE experiment.id = ?''',
                (experiment['id'],),
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(
                (
                    final['experiment_state'], final['hold_reason_code'],
                    final['intent_state'], final['resolution_detail'],
                    final['reservation_id'],
                ),
                ('active', None, 'aborted', 'pipeline_capacity_closed', None),
            )
        finally:
            setup_db.close()

    def test_docker_depth_concurrent_capacity_reservation_stops_at_cap(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)
            now = scanner_db.utc_now_iso()
            experiment = setup_db.conn.execute(
                '''INSERT INTO docker_depth_experiments(
                       experiment_key, source, state, config_sha256,
                       ordered_queries_sha256, selector_version, selector_sha256,
                       provenance_policy_sha256, query_count, repositories_per_query,
                       images_per_repository, target_limit, created_at, updated_at
                   ) VALUES ('pg-cap-test', 'dockerhub', 'resolving', ?, ?, 'selector-v1',
                             ?, ?, 1, 1, 1, 1, ?, ?) RETURNING id''',
                ('a' * 64, 'b' * 64, 'c' * 64, 'd' * 64, now, now),
            ).fetchone()
            identities = []
            for index in range(2):
                target = f'owner/cap@sha256:{index + 1:064x}'
                queue = setup_db.conn.execute(
                    '''INSERT INTO target_queue(
                           source, platform, query, target, normalized_target,
                           status, created_at, updated_at
                       ) VALUES ('dockerhub', 'docker', 'cap', ?, ?, 'pending', ?, ?)
                       RETURNING id''',
                    (target, target, now, now),
                ).fetchone()
                manifest = setup_db.conn.execute(
                    '''INSERT INTO docker_image_manifests(
                           target_queue_id, source, repository, manifest_digest,
                           manifest_media_type, graph_sha256, layer_count,
                           resolved_at, created_at
                       ) VALUES (?, 'dockerhub', 'owner/cap', ?,
                                 'application/vnd.oci.image.manifest.v1+json', ?, 0, ?, ?)
                       RETURNING id''',
                    (queue['id'], f'sha256:{index + 1:064x}', f'{index + 1:064x}', now, now),
                ).fetchone()
                identities.append((int(queue['id']), int(manifest['id'])))
            setup_db.conn.commit()
            barrier = threading.Barrier(2)
            results = []

            def reserve(identity, order):
                db = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    barrier.wait(timeout=10)
                    result = db.reserve_docker_depth_experiment_target_capacity_locked(
                        experiment['id'], identity[0], identity[1], 1, order, now,
                    )
                    time.sleep(0.1)
                    db.conn.commit()
                    results.append(('inserted', result['inserted']))
                except ScanEventConflictError:
                    db.conn.rollback()
                    results.append(('capacity', False))
                finally:
                    db.close()

            threads = [
                threading.Thread(target=reserve, args=(identity, index + 1))
                for index, identity in enumerate(identities)
            ]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(timeout=15)
            self.assertEqual(sorted(results), [('capacity', False), ('inserted', True)])
            final = setup_db.conn.execute(
                '''SELECT target_count,
                          (SELECT COUNT(*) FROM docker_depth_experiment_targets
                           WHERE experiment_id = ?) AS physical
                   FROM docker_depth_experiments WHERE id = ?''',
                (experiment['id'], experiment['id']),
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual((final['target_count'], final['physical']), (1, 1))
        finally:
            setup_db.close()

    def test_docker_resolution_retry_and_periodic_refresh_are_fenced(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)
            repo = 'example/docker-repo'
            digest_a = 'sha256:' + ('a' * 64)
            digest_b = 'sha256:' + ('b' * 64)
            target_a = f'{repo}@{digest_a}'
            target_b = f'{repo}@{digest_b}'
            self.assertEqual(
                source_db.enqueue_targets(
                    'dockerhub', 'docker', 'integration', [], unresolved_targets=[repo],
                ),
                1,
            )
            source_db.conn.execute(
                '''UPDATE target_queue
                   SET resolver_due_at = ?, available_after = ?, resolver_attempts = 5
                   WHERE source = 'dockerhub' AND normalized_target = ?''',
                ('2000-01-01T00:00:00+00:00', '2000-01-01T00:00:00+00:00', repo),
            )
            source_db.conn.commit()

            first = source_db.claim_docker_resolutions(
                'dockerhub', 1, 'integration-resolver', lease_seconds=60,
            )[0]
            self.assertEqual(
                (first['resolver_attempts_before'], first['resolver_attempts'], first['periodic']),
                (5, 6, False),
            )
            retry_at = (datetime.now(timezone.utc) + timedelta(minutes=5)).isoformat(
                timespec='seconds'
            )
            self.assertFalse(source_db.finish_docker_resolution(
                'dockerhub', first['id'], first['resolver_token'] + '-stale',
                [target_a], 'shared cooldown', complete=False,
                retry_at=retry_at, claim_attempt_consumed=False,
            ))
            self.assertEqual(
                source_db.conn.execute(
                    'SELECT COUNT(*) AS count FROM target_queue WHERE normalized_target = ?',
                    (target_a,),
                ).fetchone()['count'],
                0,
            )
            source_db.conn.commit()
            self.assertTrue(source_db.finish_docker_resolution(
                'dockerhub', first['id'], first['resolver_token'],
                [], 'shared cooldown', complete=False,
                retry_at=retry_at, claim_attempt_consumed=False,
            ))
            cooled = source_db.conn.execute(
                '''SELECT status, resolver_state, resolver_due_at, available_after,
                          resolver_attempts, resolver_token
                   FROM target_queue WHERE id = ?''',
                (first['id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                (
                    cooled['status'], cooled['resolver_state'], cooled['resolver_due_at'],
                    cooled['available_after'], cooled['resolver_attempts'], cooled['resolver_token'],
                ),
                ('deferred', 'retry', retry_at, retry_at, 5, None),
            )

            source_db.conn.execute(
                'UPDATE target_queue SET resolver_due_at = ?, available_after = ? WHERE id = ?',
                ('2000-01-01T00:00:00+00:00', '2000-01-01T00:00:00+00:00', first['id']),
            )
            source_db.conn.commit()
            second = source_db.claim_docker_resolutions(
                'dockerhub', 1, 'integration-resolver', lease_seconds=60,
            )[0]
            before_finish = datetime.now(timezone.utc)
            self.assertTrue(source_db.finish_docker_resolution(
                'dockerhub', second['id'], second['resolver_token'], [target_a],
                complete=True, refresh_interval_sec=86400,
            ))
            resolved = source_db.conn.execute(
                '''SELECT status, resolver_state, resolver_due_at, resolver_attempts
                   FROM target_queue WHERE id = ?''',
                (second['id'],),
            ).fetchone()
            self.assertEqual(
                (resolved['status'], resolved['resolver_state'], resolved['resolver_attempts']),
                ('done', 'resolved', 0),
            )
            self.assertGreaterEqual(
                datetime.fromisoformat(resolved['resolver_due_at']),
                before_finish + timedelta(hours=23, minutes=59),
            )
            self.assertEqual(
                source_db.conn.execute(
                    'SELECT COUNT(*) AS count FROM target_queue WHERE normalized_target = ?',
                    (target_a,),
                ).fetchone()['count'],
                1,
            )
            source_db.conn.commit()

            source_db.enqueue_targets(
                'dockerhub', 'docker', 'integration', [], unresolved_targets=[repo],
            )
            rediscovered = source_db.conn.execute(
                '''SELECT status, resolver_state, resolver_due_at, resolver_attempts
                   FROM target_queue WHERE id = ?''',
                (second['id'],),
            ).fetchone()
            self.assertEqual(dict(rediscovered), dict(resolved))
            self.assertEqual(source_db.claim_docker_resolutions(
                'dockerhub', 1, 'integration-resolver', lease_seconds=60,
                periodic_limit=1, periodic_only=True,
            ), [])

            source_db.conn.execute(
                'UPDATE target_queue SET resolver_due_at = ? WHERE id = ?',
                ('2000-01-01T00:00:00+00:00', second['id']),
            )
            source_db.conn.commit()
            periodic = source_db.claim_docker_resolutions(
                'dockerhub', 1, 'integration-resolver', lease_seconds=60,
                periodic_limit=1, periodic_only=True,
            )[0]
            self.assertTrue(periodic['periodic'])
            self.assertFalse(source_db.finish_docker_resolution(
                'dockerhub', periodic['id'], periodic['resolver_token'] + '-stale',
                [target_b], complete=True, refresh_interval_sec=86400,
            ))
            self.assertTrue(source_db.finish_docker_resolution(
                'dockerhub', periodic['id'], periodic['resolver_token'],
                [target_a, target_b], complete=True, refresh_interval_sec=86400,
            ))
            children = source_db.conn.execute(
                '''SELECT normalized_target, COUNT(*) AS count
                   FROM target_queue WHERE normalized_target IN (?, ?)
                   GROUP BY normalized_target ORDER BY normalized_target''',
                (target_a, target_b),
            ).fetchall()
            anchor = source_db.conn.execute(
                '''SELECT status, resolver_state, resolver_attempts, resolver_token
                   FROM target_queue WHERE id = ?''',
                (periodic['id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                [(row['normalized_target'], row['count']) for row in children],
                [(target_a, 1), (target_b, 1)],
            )
            self.assertEqual(
                (
                    anchor['status'], anchor['resolver_state'],
                    anchor['resolver_attempts'], anchor['resolver_token'],
                ),
                ('done', 'resolved', 0, None),
            )
        finally:
            source_db.close()
            setup_db.close()

    def test_target_queue_cold_policy_is_atomic_reversible_and_preserved(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            config = {'sources': {'dockerhub': {'queries': ['kept']}}}
            config_sha256 = 'a' * 64
            digest = lambda value: 'sha256:' + (value * 64)
            kept_target = f'example/kept@{digest("a")}'
            stale_targets = [
                f'example/stale-pending@{digest("b")}',
                f'example/stale-deferred@{digest("c")}',
            ]
            self.assertEqual(
                db.enqueue_targets('dockerhub', 'docker', 'kept', [kept_target]), 1,
            )
            self.assertEqual(
                db.enqueue_targets('dockerhub', 'docker', 'retired', stale_targets), 2,
            )
            stale_rows = db.conn.execute(
                '''SELECT * FROM target_queue
                   WHERE source = 'dockerhub' AND query = 'retired' ORDER BY id'''
            ).fetchall()
            deferred_id = int(stale_rows[1]['id'])
            db.conn.execute(
                '''UPDATE target_queue SET status = 'deferred', attempts = 2,
                          available_after = '2099-01-01T00:00:00+00:00',
                          last_error = 'fixture retry'
                   WHERE id = ?''',
                (deferred_id,),
            )
            db.conn.commit()
            stale_rows = db.conn.execute(
                '''SELECT * FROM target_queue
                   WHERE source = 'dockerhub' AND query = 'retired' ORDER BY id'''
            ).fetchall()
            originals = {int(row['id']): dict(row) for row in stale_rows}

            manifest = plan_stale_target_queue_cold(
                db, config, source='dockerhub', platform='docker',
                config_sha256=config_sha256, max_rows=10,
            )
            self.assertEqual(
                [entry['prior_status'] for entry in manifest['entries']],
                ['pending', 'deferred'],
            )
            manifest_sha256 = _canonical_json_sha256(manifest)

            blocked_id = int(stale_rows[0]['id'])
            db.conn.execute(
                'UPDATE target_queue SET lease_owner = ? WHERE id = ?',
                ('fixture-owner', blocked_id),
            )
            db.conn.commit()
            with self.assertRaisesRegex(RuntimeError, 'fenced row'):
                apply_stale_target_queue_cold(
                    db, config, manifest, manifest_sha256,
                    config_sha256=config_sha256, max_rows=10,
                )
            unchanged = db.conn.execute(
                '''SELECT status FROM target_queue
                   WHERE query = 'retired' ORDER BY id'''
            ).fetchall()
            event_count = db.conn.execute(
                'SELECT COUNT(*) AS count FROM target_queue_policy_events'
            ).fetchone()['count']
            db.conn.commit()
            self.assertEqual([row['status'] for row in unchanged], ['pending', 'deferred'])
            self.assertEqual(event_count, 0)

            db.conn.execute(
                'UPDATE target_queue SET lease_owner = NULL WHERE id = ?',
                (blocked_id,),
            )
            db.conn.commit()
            applied = apply_stale_target_queue_cold(
                db, config, manifest, manifest_sha256,
                config_sha256=config_sha256, max_rows=10,
            )
            self.assertEqual((applied['transitioned'], applied['duplicates']), (2, 0))
            replayed = apply_stale_target_queue_cold(
                db, config, manifest, manifest_sha256,
                config_sha256=config_sha256, max_rows=10,
            )
            self.assertEqual((replayed['transitioned'], replayed['duplicates']), (0, 2))

            cold_rows = db.conn.execute(
                '''SELECT * FROM target_queue
                   WHERE query = 'retired' ORDER BY id'''
            ).fetchall()
            db.conn.commit()
            for row in cold_rows:
                before = originals[int(row['id'])]
                self.assertEqual(row['status'], 'cold')
                for column in (
                    'source', 'platform', 'query', 'target', 'normalized_target',
                    'attempts', 'available_after', 'last_error', 'resolver_state',
                    'resolver_due_at', 'remote_modified_at', 'covered_ref', 'covered_head',
                ):
                    self.assertEqual(row[column], before[column])
            self.assertEqual(db.target_queue_counts('dockerhub')['counts']['cold'], 2)

            claimed = db.claim_targets(
                'dockerhub', 'docker', 10, lease_owner='fixture-claim',
                lease_seconds=60, return_rows=True,
            )
            self.assertEqual([row['target'] for row in claimed], [kept_target])
            self.assertEqual(
                db.enqueue_targets(
                    'dockerhub', 'docker', 'kept', [stale_targets[0]], requeue_done=True,
                ),
                1,
            )
            self.assertTrue(db.sync_target_queue_from_files(
                'dockerhub', 'docker', todo_targets=[stale_targets[0]],
                checked_targets=[stale_targets[1]], query='kept',
            ))
            preserved = db.conn.execute(
                '''SELECT status FROM target_queue
                   WHERE query = 'retired' ORDER BY id'''
            ).fetchall()
            db.conn.commit()
            self.assertEqual([row['status'] for row in preserved], ['cold', 'cold'])

            reactivation = plan_cold_target_queue_reactivation(
                db, config, source='dockerhub', platform='docker', query='retired',
                config_sha256=config_sha256, max_rows=10,
            )
            reactivation_sha256 = _canonical_json_sha256(reactivation)
            restored = apply_cold_target_queue_reactivation(
                db, config, reactivation, reactivation_sha256,
                config_sha256=config_sha256, max_rows=10,
            )
            self.assertEqual((restored['transitioned'], restored['duplicates']), (2, 0))
            replayed_restore = apply_cold_target_queue_reactivation(
                db, config, reactivation, reactivation_sha256,
                config_sha256=config_sha256, max_rows=10,
            )
            self.assertEqual(
                (replayed_restore['transitioned'], replayed_restore['duplicates']),
                (0, 2),
            )
            final_rows = db.conn.execute(
                '''SELECT status FROM target_queue
                   WHERE query = 'retired' ORDER BY id'''
            ).fetchall()
            events = db.conn.execute(
                '''SELECT action, COUNT(*) AS count FROM target_queue_policy_events
                   GROUP BY action ORDER BY action'''
            ).fetchall()
            db.conn.commit()
            self.assertEqual([row['status'] for row in final_rows], ['pending', 'deferred'])
            self.assertEqual([(row['action'], row['count']) for row in events], [
                ('cold', 2), ('reactivate', 2),
            ])
        finally:
            db.close()

    def test_rejected_query_policy_colds_only_exact_registered_source_pairs(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)

            def rejected(source, query, rows):
                return {
                    'source': source,
                    'query': query,
                    'status': 'rejected_zero_alive',
                    'evidence_cutoff': '2026-09-07T00:00:00+00:00',
                    'successful_scans': 1000,
                    'findings': 0,
                    'unique_credentials': 0,
                    'pending_candidates': 0,
                    'ever_alive_credentials': 0,
                    'reviewed_queue_rows': rows,
                }

            config = {
                'sources': {
                    'dockerhub': {'queries': ['kept']},
                    'github': {'queries': ['retired']},
                },
                'query_policy': {
                    'rejected': [
                        rejected('dockerhub', 'retired', 2),
                        rejected('github', 'obsolete', 1),
                    ],
                },
            }
            config_sha256 = 'b' * 64
            digest = lambda value: 'sha256:' + (value * 64)
            docker_targets = {
                'retired': [
                    f'example/rejected-a@{digest("a")}',
                    f'example/rejected-b@{digest("b")}',
                ],
                'unregistered': [f'example/unregistered@{digest("c")}'],
                'kept': [f'example/kept@{digest("d")}'],
            }
            for query, targets in docker_targets.items():
                self.assertEqual(
                    db.enqueue_targets('dockerhub', 'docker', query, targets),
                    len(targets),
                )
            github_targets = {
                'obsolete': ['https://example.invalid/rejected.git'],
                'retired': ['https://example.invalid/source-specific-kept.git'],
                'unregistered': ['https://example.invalid/unregistered.git'],
            }
            for query, targets in github_targets.items():
                self.assertEqual(
                    db.enqueue_targets('github', 'github', query, targets),
                    len(targets),
                )

            before = db.conn.execute(
                '''SELECT id, source, platform, query, target, normalized_target,
                          attempts, available_after, last_error, resolver_state,
                          resolver_due_at, remote_modified_at, covered_ref, covered_head
                   FROM target_queue ORDER BY id'''
            ).fetchall()
            db.conn.commit()
            before_by_id = {int(row['id']): dict(row) for row in before}

            docker_manifest = plan_stale_target_queue_cold(
                db, config, source='dockerhub', platform='docker',
                config_sha256=config_sha256, max_rows=10,
            )
            github_manifest = plan_stale_target_queue_cold(
                db, config, source='github', platform='github',
                config_sha256=config_sha256, max_rows=10,
            )
            self.assertEqual(docker_manifest['reason_code'], 'rejected_zero_alive')
            self.assertEqual(github_manifest['reason_code'], 'rejected_zero_alive')
            self.assertEqual(
                [entry['query'] for entry in docker_manifest['entries']],
                ['retired', 'retired'],
            )
            self.assertEqual(
                [entry['query'] for entry in github_manifest['entries']],
                ['obsolete'],
            )

            for manifest in (docker_manifest, github_manifest):
                manifest_sha256 = _canonical_json_sha256(manifest)
                applied = apply_stale_target_queue_cold(
                    db, config, manifest, manifest_sha256,
                    config_sha256=config_sha256, max_rows=10,
                )
                self.assertEqual(applied['duplicates'], 0)
                replayed = apply_stale_target_queue_cold(
                    db, config, manifest, manifest_sha256,
                    config_sha256=config_sha256, max_rows=10,
                )
                self.assertEqual(replayed['transitioned'], 0)
                self.assertEqual(replayed['duplicates'], len(manifest['entries']))

            rows = db.conn.execute(
                '''SELECT * FROM target_queue ORDER BY id'''
            ).fetchall()
            events = db.conn.execute(
                '''SELECT queue_id, action, reason_code
                   FROM target_queue_policy_events ORDER BY queue_id'''
            ).fetchall()
            db.conn.commit()
            cold = [row for row in rows if row['status'] == 'cold']
            self.assertEqual(
                [(row['source'], row['query']) for row in cold],
                [('dockerhub', 'retired'), ('dockerhub', 'retired'), ('github', 'obsolete')],
            )
            self.assertEqual(len(rows), len(before))
            self.assertEqual(len(events), 3)
            self.assertTrue(all(row['action'] == 'cold' for row in events))
            self.assertTrue(all(row['reason_code'] == 'rejected_zero_alive' for row in events))
            for row in cold:
                original = before_by_id[int(row['id'])]
                for column in (
                    'source', 'platform', 'query', 'target', 'normalized_target',
                    'attempts', 'available_after', 'last_error', 'resolver_state',
                    'resolver_due_at', 'remote_modified_at', 'covered_ref', 'covered_head',
                ):
                    self.assertEqual(row[column], original[column])
            self.assertEqual(
                sorted((row['source'], row['query'], row['status']) for row in rows if row['status'] != 'cold'),
                [
                    ('dockerhub', 'kept', 'pending'),
                    ('dockerhub', 'unregistered', 'pending'),
                    ('github', 'retired', 'pending'),
                    ('github', 'unregistered', 'pending'),
                ],
            )

            reactivation = plan_cold_target_queue_reactivation(
                db, config, source='github', platform='github', query='obsolete',
                config_sha256=config_sha256, max_rows=10,
            )
            restored = apply_cold_target_queue_reactivation(
                db, config, reactivation, _canonical_json_sha256(reactivation),
                config_sha256=config_sha256, max_rows=10,
            )
            self.assertEqual((restored['transitioned'], restored['duplicates']), (1, 0))
            github_rejected = db.conn.execute(
                '''SELECT status FROM target_queue
                   WHERE source = 'github' AND query = 'obsolete' '''
            ).fetchone()
            db.conn.commit()
            self.assertEqual(github_rejected['status'], 'pending')
        finally:
            db.close()

    def test_docker_resolution_allowed_queries_filter_retry_and_periodic_anchors(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            repositories = {
                'kept': 'example/resolver-kept',
                'removed': 'example/resolver-removed',
                'Kept': 'example/resolver-case-mismatch',
            }
            for query, repository in repositories.items():
                self.assertEqual(
                    db.enqueue_targets(
                        'dockerhub', 'docker', query, [], unresolved_targets=[repository],
                    ),
                    1,
                )
            db.conn.execute(
                '''UPDATE target_queue SET resolver_due_at = ?, available_after = ?
                   WHERE source = 'dockerhub' AND platform = 'docker' ''',
                ('2000-01-01T00:00:00+00:00', '2000-01-01T00:00:00+00:00'),
            )
            db.conn.commit()

            retry = db.claim_docker_resolutions(
                'dockerhub', 3, 'resolver-filter', lease_seconds=60,
                allowed_queries=('kept',),
            )
            self.assertEqual([row['target'] for row in retry], [repositories['kept']])
            self.assertTrue(db.finish_docker_resolution(
                'dockerhub', retry[0]['id'], retry[0]['resolver_token'],
                [], complete=True, refresh_interval_sec=60,
            ))
            untouched = db.conn.execute(
                '''SELECT query, resolver_state, resolver_token FROM target_queue
                   WHERE query IN ('removed', 'Kept') ORDER BY query'''
            ).fetchall()
            db.conn.commit()
            self.assertEqual(
                [(row['query'], row['resolver_state'], row['resolver_token']) for row in untouched],
                [('Kept', 'pending', None), ('removed', 'pending', None)],
            )

            db.conn.execute(
                '''UPDATE target_queue SET status = 'done', resolver_state = 'resolved',
                          resolver_token = NULL, resolver_due_at = ?, available_after = NULL
                   WHERE source = 'dockerhub' AND platform = 'docker' ''',
                ('2000-01-01T00:00:00+00:00',),
            )
            db.conn.commit()
            periodic = db.claim_docker_resolutions(
                'dockerhub', 3, 'resolver-filter', lease_seconds=60,
                periodic_limit=3, periodic_only=True, allowed_queries=('kept',),
            )
            self.assertEqual([row['target'] for row in periodic], [repositories['kept']])
            self.assertTrue(periodic[0]['periodic'])
            self.assertEqual(db.claim_docker_resolutions(
                'dockerhub', 3, 'resolver-empty', lease_seconds=60,
                periodic_limit=3, periodic_only=True, allowed_queries=(),
            ), [])
        finally:
            db.close()

    def test_projector_preserves_primary_sql_error_and_requires_findings_index(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        projector = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            index = db.conn.table_indexes('findings').get('idx_findings_target_scan_id_id')
            self.assertEqual(index['columns'], ['target_scan_id', 'id'])
            self.assertFalse(index['unique'])

            db.conn.execute('DROP INDEX idx_findings_target_scan_id_id')
            db.conn.commit()
            db._runtime_safety_schema_validated = False
            with self.assertRaisesRegex(RuntimeSafetySchemaError, 'idx_findings_target_scan_id_id'):
                db.require_runtime_safety_schema()
            migrate_runtime_safety_schema(db)
            self.assertTrue(db.require_runtime_safety_schema())

            run_id = db.start_run('integration', selected_source='github')
            cycle_id = db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            target_scan_id = db.record_target_result(
                run_id, cycle_id, 'github', 'fixture', 'https://example.invalid/rollback',
                {
                    'target': 'https://example.invalid/rollback',
                    'scan_type': 'github',
                    'timestamp': '2026-08-31T00:00:00+00:00',
                    'findings': [],
                    'errors': [],
                },
            )
            backfill_normalized_raw_results(db, max_rows=1, max_bytes=1024 * 1024)
            db.conn.execute(
                '''UPDATE pipeline_capacity
                   SET projection_items = projection_items + 1,
                       projection_bytes = projection_bytes + ? WHERE id = 1''',
                (1024 * 1024,),
            )
            job_id = db.conn.insert_returning_id(
                '''INSERT INTO projection_jobs(
                       job_kind, event_id, event_hash, target_scan_id, status,
                       required_stream_mask, capacity_items, capacity_bytes,
                       created_at, updated_at
                   ) VALUES ('scan_event', ?, ?, ?, 'pending', 1, 1, ?, ?, ?)''',
                (
                    '1' * 64, '2' * 64, target_scan_id, 1024 * 1024,
                    '2026-08-31T00:00:00+00:00', '2026-08-31T00:00:00+00:00',
                ),
            )
            db.conn.commit()
            projector = JsonlProjector(
                db, str(self.results), 'integration-supervisor', lease_seconds=300,
                keycheck_dir=str(self.keychecks),
            ).start()

            def fail_with_primary_sql_error(_target_scan_id):
                db.conn.execute('SELECT 1 / 0').fetchone()
                return iter(())

            db.iter_projection_findings = fail_with_primary_sql_error
            with self.assertRaises(Exception) as raised:
                projector.process_one()
            self.assertEqual(getattr(raised.exception, 'sqlstate', None), '22012')
            self.assertNotIn('current transaction is aborted', str(raised.exception).lower())
            self.assertEqual(db.conn.execute('SELECT 1 AS value').fetchone()['value'], 1)
            db.conn.commit()
            artifact = db.conn.execute(
                '''SELECT state FROM pipeline_artifacts
                   WHERE subsystem = 'jsonl_projector' AND owner_id = ?''',
                (job_id,),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(artifact['state'], 'deleted')
            projector.stop('primary SQL error fixture')
            self.assertIsNone(projector.lease)
        finally:
            if projector is not None and projector.lease is not None:
                projector.stop()
            db.close()

    def test_synthetic_llm_candidates_reach_final_database_accounting(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            target = 'https://example.invalid/synthetic-llm-pipeline'
            self.assertEqual(
                source_db.enqueue_targets('github', 'github', 'fixture', [target]), 1,
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            claim = source_db.reserve_and_claim_target(
                'github', 'github', current_process_identity(), 'integration-supervisor',
                4 * 1024 * 1024, 4 * 1024 * 1024, 10, 1024 * 1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                    'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                    'keycheck_items': 10, 'keycheck_bytes': 16 * 1024 * 1024,
                },
                reservation_token='synthetic-llm-reservation',
                bundle_id='9' * 32,
                scan_event_id='8' * 32,
            )
            self.assertIsNotNone(claim)
            alphabet = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'

            def material(label, length, characters):
                seed = hashlib.sha512(label.encode('ascii')).hexdigest()
                output = ''
                while len(output) < length:
                    output += ''.join(
                        characters[int(seed[index:index + 2], 16) % len(characters)]
                        for index in range(0, len(seed), 2)
                    )
                    seed = hashlib.sha512(seed.encode('ascii')).hexdigest()
                return output[:length]

            tokens = {
                'OpenAI': (
                    'sk-proj-' + material('db-openai-prefix', 24, alphabet)
                    + 'T3BlbkFJ' + material('db-openai-suffix', 24, alphabet)
                ),
                'OpenRouter': 'sk-or-v1-' + material(
                    'db-openrouter', 64, '0123456789abcdef',
                ),
                'Anthropic': (
                    'sk-ant-api03-' + material('db-anthropic', 93, alphabet + '-_') + 'AA'
                ),
            }
            result = {
                'scan_event_id': claim['scan_event_id'],
                'target': claim['target'],
                'scan_type': 'github',
                'timestamp': '2026-09-07T00:00:00+00:00',
                'scan_started_at': '2026-09-07T00:00:00+00:00',
                'duration_sec': 1.0,
                'findings': [
                    {
                        'DetectorName': detector,
                        'Raw': token,
                        'finding_uid': hashlib.sha256(detector.encode('ascii')).hexdigest(),
                        'Verified': False,
                    }
                    for detector, token in tokens.items()
                ],
                'errors': [],
            }
            staged = stage_result_bundle(
                result, claim, str(self.bundle_root), {},
                {'queue_status': 'done', 'queue_error': None, 'available_after': None},
                candidate_max_items=10, candidate_max_bytes=1024 * 1024,
            )
            self.assertEqual(staged.candidate_count, 3)
            self.assertTrue(source_db.mark_result_bundle_ready(
                claim['reservation_id'], {
                    'bundle_id': staged.bundle_id,
                    'scan_event_id': staged.scan_event_id,
                    'scan_event_hash': staged.scan_event_hash,
                    'relative_path': staged.relative_path,
                    'actual_bytes': staged.actual_bytes,
                    'frame_count': staged.frame_count,
                    'finding_count': staged.finding_count,
                    'error_count': staged.error_count,
                    'candidate_count': staged.candidate_count,
                },
            ))
            self.assertTrue(ingester.process_one())
            candidates = source_db.conn.execute(
                '''SELECT c.id, c.service
                   FROM keycheck_candidates c
                   ORDER BY c.service'''
            ).fetchall()
            source_db.conn.commit()
            self.assertEqual(
                [row['service'] for row in candidates],
                ['anthropic', 'openai', 'openrouter'],
            )
            for row in candidates:
                candidate = source_db.claim_keycheck_candidate(
                    row['service'], f'synthetic-{row["service"]}',
                )
                self.assertIsNotNone(candidate)
                event_id = hashlib.sha256(
                    f'synthetic-result:{row["service"]}'.encode('ascii')
                ).hexdigest()
                completed = source_db.complete_keycheck_candidate(
                    candidate['id'], candidate['lease_token'], event_id,
                    'ALIVE', 'alive', message='synthetic local result',
                    metadata={'synthetic': True},
                )
                self.assertTrue(completed['completed'])
            current = source_db.conn.execute(
                '''SELECT c.service, s.status_group
                   FROM keycheck_current_state s
                   JOIN keycheck_credentials c ON c.id = s.credential_id
                   ORDER BY c.service'''
            ).fetchall()
            source_db.conn.commit()
            self.assertEqual(
                [(row['service'], row['status_group']) for row in current],
                [('anthropic', 'alive'), ('openai', 'alive'), ('openrouter', 'alive')],
            )
            self.assertTrue(ingester.stop())
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_bundle_ingest_projection_and_db_keycheck_are_transactional(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        projector_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        projector = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            with self.assertRaisesRegex(RuntimeError, 'cutover marker'):
                ingester_db.require_final_cutover()
            ingester_db.record_final_cutover({'test': self.id()})
            self.assertTrue(ingester_db.require_runtime_safety_schema())
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            self.assertEqual(
                source_db.enqueue_targets(
                    'github', 'github', 'fixture', ['https://example.invalid/repo'],
                ),
                1,
            )

            injected = {'pending': True}

            def fault(stage, _value):
                if stage == 'after_db_commit' and injected['pending']:
                    injected['pending'] = False
                    raise RuntimeError('injected ambiguous commit response')

            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
                lease_seconds=300, fault=fault,
            ).start()
            claim = source_db.reserve_and_claim_target(
                'github', 'github', current_process_identity(), 'integration-supervisor',
                4 * 1024 * 1024, 4 * 1024 * 1024, 10, 1024 * 1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                    'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                    'keycheck_items': 100, 'keycheck_bytes': 16 * 1024 * 1024,
                },
                reservation_token='integration-reservation-one',
                bundle_id='1' * 32, scan_event_id='2' * 32,
            )
            self.assertIsNotNone(claim)
            result = {
                'scan_event_id': claim['scan_event_id'],
                'target': claim['target'],
                'scan_type': 'github',
                'timestamp': '2026-07-27T00:00:00+00:00',
                'scan_started_at': '2026-07-27T00:00:00+00:00',
                'duration_sec': 1.0,
                'findings': [{
                    'DetectorName': 'OpenAI',
                    'Raw': 'sk-integration-fixture-secret',
                    'finding_uid': 'f' * 64,
                    'Verified': False,
                }],
                'errors': [],
            }
            staged = stage_result_bundle(
                result, claim, str(self.bundle_root), {},
                {'queue_status': 'done', 'queue_error': None, 'available_after': None},
                candidate_max_items=10, candidate_max_bytes=1024 * 1024,
            )
            self.assertTrue(source_db.mark_result_bundle_ready(
                claim['reservation_id'], {
                    'bundle_id': staged.bundle_id,
                    'scan_event_id': staged.scan_event_id,
                    'scan_event_hash': staged.scan_event_hash,
                    'relative_path': staged.relative_path,
                    'actual_bytes': staged.actual_bytes,
                    'frame_count': staged.frame_count,
                    'finding_count': staged.finding_count,
                    'error_count': staged.error_count,
                    'candidate_count': staged.candidate_count,
                },
            ))
            with self.assertRaisesRegex(RuntimeError, 'ambiguous commit response'):
                ingester.process_one()
            self.assertEqual(
                source_db.conn.execute('SELECT COUNT(*) AS count FROM target_scans').fetchone()['count'],
                1,
            )
            source_db.conn.commit()
            unlink_fault = {'pending': True}

            def fail_after_unlink(stage, _value):
                if stage == 'after_unlink' and unlink_fault['pending']:
                    unlink_fault['pending'] = False
                    raise RuntimeError('injected unlink acknowledgement loss')

            ingester.fault = fail_after_unlink
            with self.assertRaisesRegex(RuntimeError, 'unlink acknowledgement loss'):
                ingester.process_one()
            self.assertEqual(source_db.pipeline_capacity_snapshot()['bundle_items'], 1)
            ingester.fault = None
            self.assertTrue(ingester.process_one())
            self.assertEqual(source_db.pipeline_capacity_snapshot()['bundle_items'], 0)
            self.assertTrue(source_db.mark_result_bundle_ready(
                claim['reservation_id'], {
                    'bundle_id': staged.bundle_id,
                    'scan_event_id': staged.scan_event_id,
                    'scan_event_hash': staged.scan_event_hash,
                    'relative_path': staged.relative_path,
                    'actual_bytes': staged.actual_bytes,
                    'frame_count': staged.frame_count,
                    'finding_count': staged.finding_count,
                    'error_count': staged.error_count,
                    'candidate_count': staged.candidate_count,
                },
            ))
            ready_artifact = source_db.conn.execute(
                '''SELECT state FROM pipeline_artifacts
                   WHERE subsystem = 'result_bundle' AND artifact_kind = 'bundle_ready'
                     AND owner_id = ?''',
                (claim['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(ready_artifact['state'], 'deleted')
            self.assertEqual(
                source_db.conn.execute('SELECT COUNT(*) AS count FROM target_scans').fetchone()['count'],
                1,
            )
            source_db.conn.commit()
            scan = source_db.conn.execute(
                'SELECT raw_result_json, raw_result_storage FROM target_scans WHERE scan_event_id = ?',
                (claim['scan_event_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertIsNone(scan['raw_result_json'])
            self.assertEqual(scan['raw_result_storage'], 'normalized_v2')

            projection_job = source_db.conn.execute(
                '''SELECT id, capacity_bytes FROM projection_jobs
                   WHERE event_id = ?''',
                (claim['scan_event_id'],),
            ).fetchone()
            source_db.conn.execute(
                '''UPDATE projection_jobs SET capacity_bytes = 1 WHERE id = ?''',
                (projection_job['id'],),
            )
            source_db.conn.execute(
                '''UPDATE pipeline_capacity
                   SET projection_bytes = ? WHERE id = 1''',
                (64 * 1024 * 1024,),
            )
            source_db.conn.commit()
            projector = JsonlProjector(
                projector_db, str(self.results), 'integration-supervisor',
                lease_seconds=300, keycheck_dir=str(self.keychecks),
                projection_max_bytes=64 * 1024 * 1024,
            ).start()
            self.assertTrue(projector.process_one())
            deferred_projection = source_db.conn.execute(
                '''SELECT status, capacity_bytes FROM projection_jobs WHERE id = ?''',
                (projection_job['id'],),
            ).fetchone()
            projection_quarantine = source_db.conn.execute(
                '''SELECT COUNT(*) AS count FROM pipeline_quarantine
                   WHERE projection_job_id = ?''',
                (projection_job['id'],),
            ).fetchone()
            projection_appends = source_db.conn.execute(
                '''SELECT COUNT(*) AS count FROM projection_appends
                   WHERE job_id = ?''',
                (projection_job['id'],),
            ).fetchone()
            source_db.conn.execute(
                '''UPDATE projection_jobs SET available_after = NULL WHERE id = ?''',
                (projection_job['id'],),
            )
            source_db.conn.execute(
                '''UPDATE pipeline_capacity SET projection_bytes = 1 WHERE id = 1'''
            )
            source_db.conn.commit()
            self.assertEqual(
                (deferred_projection['status'], deferred_projection['capacity_bytes']),
                ('pending', 1),
            )
            self.assertEqual(projection_quarantine['count'], 0)
            self.assertEqual(projection_appends['count'], 0)
            projector.stop()

            append_fault = {'pending': True}

            def fail_after_append(stage, _value):
                if stage == 'after_append_fsync' and append_fault['pending']:
                    append_fault['pending'] = False
                    raise RuntimeError('injected projection append acknowledgement loss')

            projector = JsonlProjector(
                projector_db, str(self.results), 'integration-supervisor',
                lease_seconds=300, keycheck_dir=str(self.keychecks),
                fault=fail_after_append, projection_max_bytes=64 * 1024 * 1024,
            ).start()
            with self.assertRaisesRegex(RuntimeError, 'projection append acknowledgement loss'):
                projector.process_one()
            projector.stop()
            projector = JsonlProjector(
                projector_db, str(self.results), 'integration-supervisor',
                lease_seconds=300, keycheck_dir=str(self.keychecks),
                projection_max_bytes=64 * 1024 * 1024,
            ).start()
            self.assertTrue(projector.process_one())
            self.assertTrue((self.results / 'scan_results.jsonl').is_file())
            self.assertTrue((self.results / 'found_secrets.jsonl').is_file())
            scan_lines = (self.results / 'scan_results.jsonl').read_text(encoding='utf-8').splitlines()
            self.assertEqual(len(scan_lines), 1)
            source_db.conn.execute(
                "UPDATE projection_streams SET rotation_bytes = 1 WHERE stream_name = 'scan_results'"
            )
            source_db.conn.commit()
            state = projector_db.projection_stream_state('scan_results')
            rotated = projector._rotate_if_needed(state, 1)
            self.assertEqual(rotated['current_generation'], 1)
            self.assertTrue((self.results / 'scan_results.g000000.jsonl').is_file())
            self.assertEqual((self.results / 'scan_results.jsonl').stat().st_size, 0)
            source_db.conn.execute(
                '''UPDATE pipeline_capacity SET projection_items = projection_items + 1,
                          projection_bytes = projection_bytes + 1024 WHERE id = 1'''
            )
            poison_job = source_db.conn.insert_returning_id(
                '''INSERT INTO projection_jobs(
                       job_kind, event_id, event_hash, status, required_stream_mask,
                       capacity_items, capacity_bytes, created_at, updated_at
                   ) VALUES ('scan_event', ?, ?, 'pending', 1, 1, 1024, ?, ?)''',
                ('d' * 64, 'e' * 64, '2026-07-27T00:00:00+00:00', '2026-07-27T00:00:00+00:00'),
            )
            source_db.conn.commit()
            self.assertTrue(projector.process_one())
            poison_state = source_db.conn.execute(
                'SELECT status FROM projection_jobs WHERE id = ?', (poison_job,),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(poison_state['status'], 'quarantined')

            source_db.conn.execute(
                '''UPDATE pipeline_capacity SET projection_items = projection_items + 1,
                          projection_bytes = projection_bytes + 1024 WHERE id = 1'''
            )
            abandoned_job = source_db.conn.insert_returning_id(
                '''INSERT INTO projection_jobs(
                       job_kind, event_id, event_hash, target_scan_id, status,
                       required_stream_mask, capacity_items, capacity_bytes, created_at, updated_at
                   ) VALUES ('scan_event', ?, ?, 1, 'pending', 1, 1, 1024, ?, ?)''',
                ('7' * 64, '8' * 64, '2026-07-27T00:00:00+00:00', '2026-07-27T00:00:00+00:00'),
            )
            source_db.conn.commit()
            abandoned_claim = source_db.claim_projection_job(
                projector.lease['generation'], projector.lease['lease_token'], 300,
            )
            self.assertEqual(abandoned_claim['id'], abandoned_job)
            stream_state = source_db.projection_stream_state('scan_results')
            source_db.prepare_projection_append(
                abandoned_job, abandoned_claim['lease_token'], 'scan_results',
                stream_state['generation'], 1, hashlib.sha256(b'x').hexdigest(), 1,
            )
            self.assertTrue(source_db.quarantine_projection_job(
                abandoned_job, abandoned_claim['lease_token'],
                'integration_abandoned_append', 'fixture',
            ))
            audit = source_db.conn.execute(
                '''SELECT COUNT(*) AS count FROM projection_append_audit
                   WHERE job_id = ? AND state = 'quarantined' ''',
                (abandoned_job,),
            ).fetchone()
            prepared = source_db.conn.execute(
                "SELECT COUNT(*) AS count FROM projection_appends WHERE job_id = ? AND state = 'prepared'",
                (abandoned_job,),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(audit['count'], 1)
            self.assertEqual(prepared['count'], 0)

            candidate = source_db.claim_keycheck_candidate('openai', 'integration-provider')
            self.assertIsNotNone(candidate)
            self.assertIsNone(source_db.complete_keycheck_candidate(
                candidate['id'], 'wrong-lease-token', 'a' * 64,
                'DEAD', 'dead', message='must not commit',
            ))
            openai_dir = self.keychecks / 'openai'
            ensure_private_directory(str(openai_dir), reject_reparse=True)
            legacy_results = openai_dir / 'openaiResults.jsonl'
            legacy_results.write_text('{"legacy":true}\n', encoding='ascii')
            harden_private_file(str(legacy_results))
            completed = source_db.complete_keycheck_candidate(
                candidate['id'], candidate['lease_token'], 'c' * 64,
                'ALIVE', 'alive', message='integration result',
                metadata={'probe': 'fixture'},
            )
            self.assertTrue(completed['completed'])
            stored_hashes = source_db.conn.execute(
                'SELECT key_hash, secret_hash FROM keycheck_results WHERE id = ?',
                (completed['keycheck_result_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(stored_hashes['key_hash'], candidate['provider_key_hash'])
            self.assertEqual(stored_hashes['secret_hash'], candidate['secret_hash'])
            replay = source_db.complete_keycheck_candidate(
                candidate['id'], candidate['lease_token'], 'c' * 64,
                'ALIVE', 'alive', message='integration result',
                metadata={'probe': 'fixture'},
            )
            self.assertTrue(replay['duplicate'])
            self.assertTrue(projector.process_one())
            current = source_db.conn.execute(
                '''SELECT status, state_version FROM keycheck_current_state
                   WHERE credential_id = ?''',
                (candidate['credential_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(current['status'], 'ALIVE')
            self.assertEqual(current['state_version'], 1)
            job_state = source_db.conn.execute(
                '''SELECT status, last_error_detail, required_stream_mask
                   FROM projection_jobs WHERE id = ?''',
                (completed['projection_job_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(job_state['status'], 'completed', job_state['last_error_detail'])
            self.assertEqual(job_state['required_stream_mask'], 8)
            self.assertTrue((self.keychecks / 'openai' / 'openaiResults.jsonl').is_file())
            self.assertFalse((self.keychecks / 'openai' / 'openaiChecked.txt').exists())
            self.assertTrue(
                (self.keychecks / 'openai' / 'openaiResults.jsonl')
                .read_text(encoding='utf-8').startswith('{"legacy":true}\n')
            )
            rebuild = rebuild_jsonl_projections(
                source_db, str(self.root / 'full-rebuild'),
                max_rows=100, max_bytes=64 * 1024 * 1024, max_seconds=30,
            )
            self.assertTrue(rebuild['completed'], rebuild)
            self.assertEqual(
                len((self.root / 'full-rebuild' / 'results' / 'scan_results.jsonl')
                    .read_text(encoding='utf-8').splitlines()),
                1,
            )
            projector.stop()
            self.assertTrue(ingester.stop())
        finally:
            if projector is not None and projector.lease is not None:
                projector.stop()
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            projector_db.close()
            source_db.close()
            ingester_db.close()

    def test_known_postgres_occurrences_use_cached_status_except_explicit_retries(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            now = '2026-07-27T00:00:00+00:00'
            cases = (
                (
                    'openai', openaiKeycheck, 'OpenAI', 'sk-' + ('a' * 40),
                    SimpleNamespace(
                        input='forbidden.jsonl', plain=['forbidden.txt'], proxy_file='proxy.txt',
                        max_keys=0, retry_network=False, retry_limited=False,
                        retry_unknown=False, retry_restricted=False, retry_no_balance=False,
                        recheck_all=False,
                    ),
                    'check_authentication', ('dead', 'fixture invalid key'),
                ),
                (
                    'gemini', geminiKeycheck, 'GoogleAI', 'AIza' + ('A' * 35),
                    SimpleNamespace(
                        input='forbidden.jsonl', plain=['forbidden.txt'], proxy_file='proxy.txt',
                        timeout=1, max_keys=0, probe_generation=False,
                        retry_limited=False, retry_unknown=False, retry_network=False,
                        retry_valid=False, recheck_all=False, debug=False,
                    ),
                    'check_key', {
                        'status': 'INVALID', 'error': {'message': 'fixture invalid key'},
                        'models': [], 'model_infos': [], 'notable_models': [],
                        'generation_models': [], 'model_class': 'none',
                    },
                ),
            )
            for service, provider, detector, key, args, probe_name, probe_result in cases:
                credential_hash = hashlib.sha256(f'{service}|{key}'.encode('utf-8')).hexdigest()
                provider_key_hash = hashlib.sha256(key.encode('utf-8')).hexdigest()
                credential_id = db.conn.insert_returning_id(
                    '''INSERT INTO keycheck_credentials(
                           service, credential_hash, provider_key_hash, candidate_kind,
                           secret_text, key_masked, created_at, updated_at
                       ) VALUES (?, ?, ?, 'provider_key', ?, '***', ?, ?)''',
                    (service, credential_hash, provider_key_hash, key, now, now),
                )
                candidate_ids = []
                for occurrence in range(4):
                    candidate_uid = hashlib.sha256(
                        f'{service}|{credential_id}|{occurrence}'.encode('utf-8')
                    ).hexdigest()
                    metadata_json = json.dumps({
                        'recheck_of_status': 'dead',
                        'state_version': 1,
                        'recheck_generation': 'fixture',
                    }) if occurrence == 2 else '{}'
                    candidate_ids.append(db.conn.insert_returning_id(
                        '''INSERT INTO keycheck_candidates(
                               candidate_uid, credential_id, service, secret_hash,
                               source, detector_name, metadata_json, state, capacity_bytes,
                               created_at, updated_at
                            ) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', 1024, ?, ?)''',
                        (
                            candidate_uid, credential_id, service, provider_key_hash,
                            f'fixture:{occurrence}', detector, metadata_json, now, now,
                        ),
                    ))
                db.conn.execute(
                    '''INSERT INTO pipeline_quarantine(
                           subsystem, object_type, object_id, keycheck_candidate_id,
                           reason_code, reason_detail, capacity_items, capacity_bytes,
                           review_status, detected_at, resolved_at
                       ) VALUES ('keycheck', 'keycheck_candidate', ?, ?,
                                 'provider_candidate_unconsumed', 'fixture', 0, 0,
                                 'approved_retry', ?, ?)''',
                    (candidate_ids[3], candidate_ids[3], now, now),
                )
                db.conn.execute(
                    '''UPDATE pipeline_capacity SET keycheck_items = keycheck_items + 4,
                              keycheck_bytes = keycheck_bytes + 4096 WHERE id = 1'''
                )
                db.conn.commit()

                leaf_common = sys.modules[provider.iter_findings.__module__]
                with ExitStack() as stack:
                    stack.enter_context(mock.patch.dict(os.environ, {
                        'KEYCHECK_INPUT_MODE': 'postgres', 'KEYCHECK_SERVICE': service,
                    }, clear=False))
                    stack.enter_context(mock.patch.object(
                        provider, 'require_provider_authority', return_value={},
                    ))
                    stack.enter_context(mock.patch.object(provider, 'parse_args', return_value=args))
                    stack.enter_context(mock.patch.object(provider, 'load_proxies', return_value=None))
                    stack.enter_context(mock.patch.object(
                        provider, 'record_cached_keycheck_occurrence',
                        side_effect=AssertionError('cached-file path executed'),
                    ))
                    stack.enter_context(mock.patch.object(
                        leaf_common, '_postgres_candidate_db', return_value=db,
                    ))
                    stack.enter_context(mock.patch(
                        'builtins.open',
                        side_effect=AssertionError('provider opened compatibility state'),
                    ))
                    probe = stack.enter_context(mock.patch.object(
                        provider, probe_name, return_value=probe_result,
                    ))
                    if service == 'gemini':
                        stack.enter_context(mock.patch.object(provider.time, 'sleep'))
                    leaf_common._ACTIVE_DB_CANDIDATE = None
                    provider.main()

                candidates = db.conn.execute(
                    '''SELECT state, keycheck_result_id FROM keycheck_candidates
                       WHERE credential_id = ? ORDER BY id''',
                    (credential_id,),
                ).fetchall()
                results = db.conn.execute(
                    '''SELECT id, candidate_id, event_id, status, status_group,
                              checked_at, message, metadata_json, result_source
                       FROM keycheck_results
                       WHERE credential_id = ? ORDER BY id''',
                    (credential_id,),
                ).fetchall()
                current = db.conn.execute(
                    '''SELECT state_version FROM keycheck_current_state
                       WHERE credential_id = ?''',
                    (credential_id,),
                ).fetchone()
                db.conn.commit()
                self.assertEqual(
                    [row['state'] for row in candidates],
                    ['completed', 'completed', 'completed', 'completed'],
                )
                self.assertEqual(len({row['keycheck_result_id'] for row in candidates}), 4)
                self.assertEqual(len(results), 4)
                self.assertEqual(len({row['candidate_id'] for row in results}), 4)
                self.assertEqual(
                    [row['result_source'] for row in results],
                    ['api_check', 'cached_status', 'api_check', 'api_check'],
                )
                self.assertEqual(current['state_version'], 3)
                self.assertEqual(probe.call_count, 3)
                self.assertIsNone(leaf_common._ACTIVE_DB_CANDIDATE)
                cached_result = results[1]
                cached_metadata = json.loads(cached_result['metadata_json'])
                cached_metadata.pop('_event_hash')
                replay = db.complete_keycheck_candidate(
                    cached_result['candidate_id'], 'expired-lease', cached_result['event_id'],
                    cached_result['status'], cached_result['status_group'],
                    checked_at=cached_result['checked_at'], message=cached_result['message'],
                    metadata=cached_metadata, result_source='cached_status',
                    cached_state_version=cached_metadata['cached_state_version'],
                    cached_last_result_id=cached_metadata['cached_result_id'],
                )
                self.assertTrue(replay['duplicate'])

            capacity = db.pipeline_capacity_snapshot()
            self.assertEqual((capacity['keycheck_items'], capacity['keycheck_bytes']), (0, 0))
        finally:
            db.close()

    def test_corrupt_bundle_is_quarantined_and_next_event_continues(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            targets = ['https://example.invalid/corrupt', 'https://example.invalid/valid']
            self.assertEqual(source_db.enqueue_targets('github', 'github', 'fixture', targets), 2)
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            limits = {
                'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                'keycheck_items': 100, 'keycheck_bytes': 16 * 1024 * 1024,
            }
            claims = [
                source_db.reserve_and_claim_target(
                    'github', 'github', current_process_identity(), 'integration-supervisor',
                    1024 * 1024, 1024 * 1024, 1, 64 * 1024,
                    run_id=run_id, cycle_id=cycle_id, capacity_limits=limits,
                    reservation_token=f'corrupt-reservation-{index}',
                    bundle_id=f'{index + 10:032x}', scan_event_id=f'{index + 20:032x}',
                )
                for index in range(2)
            ]
            corrupt = claims[0]
            ready_path = self.bundle_root.joinpath(*corrupt['ready_relative_path'].split('/'))
            ensure_private_directory(str(ready_path.parent), reject_reparse=True)
            ready_path.write_bytes(b'not-a-result-bundle')
            harden_private_file(str(ready_path))
            self.assertTrue(source_db.mark_result_bundle_ready(
                corrupt['reservation_id'], {
                    'bundle_id': corrupt['bundle_id'],
                    'scan_event_id': corrupt['scan_event_id'],
                    'scan_event_hash': hashlib.sha256(b'not-a-result-bundle').hexdigest(),
                    'relative_path': corrupt['ready_relative_path'],
                    'actual_bytes': ready_path.stat().st_size,
                    'frame_count': 1, 'finding_count': 0,
                    'error_count': 0, 'candidate_count': 0,
                },
            ))
            valid = claims[1]
            staged = stage_result_bundle(
                {
                    'scan_event_id': valid['scan_event_id'], 'target': valid['target'],
                    'scan_type': 'github', 'timestamp': '2026-07-27T00:00:00+00:00',
                    'findings': [], 'errors': [],
                },
                valid, str(self.bundle_root), {}, {'queue_status': 'done'},
                candidate_max_items=1, candidate_max_bytes=64 * 1024,
            )
            quarantine_baseline_items = 9999
            quarantine_baseline_bytes = 1024 * 1024 * 1024 - 1
            source_db.conn.execute(
                '''UPDATE pipeline_capacity SET quarantine_items = ?, quarantine_bytes = ?
                   WHERE id = 1''',
                (quarantine_baseline_items, quarantine_baseline_bytes),
            )
            source_db.conn.commit()
            # Simulate a lost ready-notification response; recovery uses the indexed exact path.
            ingester.recover()
            self.assertTrue(ingester.process_one())
            self.assertTrue(ingester.process_one())
            rows = source_db.conn.execute(
                'SELECT target, status FROM target_queue ORDER BY id'
            ).fetchall()
            source_db.conn.commit()
            self.assertEqual([row['status'] for row in rows], ['quarantined', 'done'])
            saturated = source_db.pipeline_capacity_snapshot()
            self.assertGreater(saturated['quarantine_items'], 10000)
            self.assertGreater(saturated['quarantine_bytes'], 1024 * 1024 * 1024)
            source_db.enqueue_targets(
                'github', 'github', 'fixture', ['https://example.invalid/blocked-after-poison'],
            )
            self.assertIsNone(source_db.reserve_and_claim_target(
                'github', 'github', current_process_identity(), 'integration-supervisor',
                1024 * 1024, 1024 * 1024, 1, 64 * 1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits=dict(
                    limits, quarantine_items=10000,
                    quarantine_bytes=1024 * 1024 * 1024,
                ),
                reservation_token='blocked-after-poison',
                bundle_id='9' * 32, scan_event_id='8' * 32,
            ))
            quarantine = source_db.conn.execute(
                '''SELECT id, reason_code, payload_sha256, source_relative_path
                   FROM pipeline_quarantine WHERE subsystem = 'result_ingester' '''
            ).fetchone()
            source_db.conn.commit()
            self.assertIsNotNone(quarantine)
            artifact = source_db.conn.execute(
                '''SELECT id, byte_count, state FROM pipeline_artifacts
                   WHERE subsystem = 'result_bundle' AND artifact_kind = 'bundle_quarantine' '''
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(artifact['state'], 'quarantined')
            self.assertGreater(artifact['byte_count'], 0)
            self.assertEqual(
                source_db.conn.execute('SELECT COUNT(*) AS count FROM target_scans').fetchone()['count'],
                1,
            )
            source_db.conn.commit()
            manifest = self.root / 'bundle-quarantine-review.json'
            atomic_write_private_json(str(manifest), {
                'type': 'truf-pipeline-quarantine-review-v1',
                'entries': [{
                    'id': quarantine['id'], 'reason_code': quarantine['reason_code'],
                    'payload_sha256': quarantine['payload_sha256'], 'action': 'discard',
                }],
            })
            review_pipeline_quarantine_manifest(
                source_db, str(manifest), max_rows=1,
                config={'global': {
                    'results_dir': str(self.results),
                    'result_bundle_dir': str(self.bundle_root),
                }},
            )
            self.assertFalse(
                (self.bundle_root / Path(quarantine['source_relative_path'])).exists()
            )
            reviewed_capacity = source_db.pipeline_capacity_snapshot()
            self.assertEqual(reviewed_capacity['quarantine_items'], quarantine_baseline_items)
            self.assertEqual(reviewed_capacity['quarantine_bytes'], quarantine_baseline_bytes)
            self.assertTrue(ingester.stop())
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_offline_review_refuses_conflicting_prepared_bundle_quarantine(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            source_db.enqueue_targets(
                'github', 'github', 'fixture', ['https://example.invalid/prepared-quarantine'],
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            claim = source_db.reserve_and_claim_target(
                'github', 'github', current_process_identity(), 'integration-supervisor',
                1024 * 1024, 2 * 1024 * 1024, 1, 64 * 1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 16 * 1024 * 1024,
                    'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                    'keycheck_items': 10, 'keycheck_bytes': 1024 * 1024,
                    'quarantine_items': 10, 'quarantine_bytes': 16 * 1024 * 1024,
                },
                reservation_token='prepared-quarantine-token',
                bundle_id='3' * 32, scan_event_id='4' * 32,
            )
            staged = stage_result_bundle(
                {
                    'scan_event_id': claim['scan_event_id'], 'target': claim['target'],
                    'scan_type': 'github', 'timestamp': '2026-07-27T00:00:00+00:00',
                    'findings': [], 'errors': [],
                },
                claim, str(self.bundle_root), {}, {'queue_status': 'done'},
                candidate_max_items=1, candidate_max_bytes=64 * 1024,
            )
            self.assertTrue(source_db.mark_result_bundle_ready(
                claim['reservation_id'], {
                    'bundle_id': staged.bundle_id, 'scan_event_id': staged.scan_event_id,
                    'scan_event_hash': staged.scan_event_hash,
                    'relative_path': staged.relative_path, 'actual_bytes': staged.actual_bytes,
                    'frame_count': staged.frame_count, 'finding_count': staged.finding_count,
                    'error_count': staged.error_count, 'candidate_count': staged.candidate_count,
                },
            ))
            quarantine_relative = f'quarantine/{claim["bundle_id"][:2]}/{claim["bundle_id"]}.trb'
            ready_path = self.bundle_root.joinpath(*claim['ready_relative_path'].split('/'))
            payload = ready_path.read_bytes()
            payload_hash = hashlib.sha256(payload).hexdigest()
            quarantine_id = source_db.quarantine_result_bundle(
                claim['reservation_id'], 'prepared_fixture', 'fixture move interrupted',
                quarantine_relative, payload_sha256=payload_hash,
                byte_count=len(payload), physical_confirmed=False,
            )
            quarantine_path = self.bundle_root.joinpath(*quarantine_relative.split('/'))
            ensure_private_directory(str(quarantine_path.parent), reject_reparse=True)
            quarantine_path.write_bytes(payload)
            harden_private_file(str(quarantine_path))
            manifest = self.root / 'prepared-quarantine-review.json'
            atomic_write_private_json(str(manifest), {
                'type': 'truf-pipeline-quarantine-review-v1',
                'entries': [{
                    'id': quarantine_id, 'reason_code': 'prepared_fixture',
                    'payload_sha256': payload_hash, 'action': 'discard',
                }],
            })
            with self.assertRaisesRegex(RuntimeError, 'conflicting physical state'):
                review_pipeline_quarantine_manifest(
                    source_db, str(manifest), max_rows=1,
                    config={'global': {
                        'results_dir': str(self.results),
                        'result_bundle_dir': str(self.bundle_root),
                    }},
                )
            reservation = source_db.conn.execute(
                'SELECT state FROM result_reservations WHERE id = ?',
                (claim['reservation_id'],),
            ).fetchone()
            quarantine = source_db.conn.execute(
                'SELECT review_status FROM pipeline_quarantine WHERE id = ?',
                (quarantine_id,),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(reservation['state'], 'ready')
            self.assertEqual(quarantine['review_status'], 'pending')
            self.assertTrue(ready_path.exists())
            self.assertGreater(source_db.pipeline_capacity_snapshot()['quarantine_items'], 0)
            quarantine_path.unlink()
            review_pipeline_quarantine_manifest(
                source_db, str(manifest), max_rows=1,
                config={'global': {
                    'results_dir': str(self.results),
                    'result_bundle_dir': str(self.bundle_root),
                }},
            )
            final = source_db.conn.execute(
                'SELECT state FROM result_reservations WHERE id = ?',
                (claim['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(final['state'], 'quarantined')
            self.assertFalse(ready_path.exists())
            self.assertFalse(quarantine_path.exists())
            self.assertEqual(source_db.pipeline_capacity_snapshot()['quarantine_items'], 0)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_offline_review_retries_valid_bundle_and_ingestion_converges(self):
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(source_db, initialize_base=True)
            source_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            self.assertEqual(source_db.enqueue_targets(
                'github', 'github', 'fixture', ['https://example.invalid/retry-bundle'],
            ), 1)
            claim = source_db.reserve_and_claim_target(
                'github', 'github', current_process_identity(), 'integration-supervisor',
                1024 * 1024, 2 * 1024 * 1024, 1, 64 * 1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                    'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                    'keycheck_items': 100, 'keycheck_bytes': 16 * 1024 * 1024,
                    'quarantine_items': 100, 'quarantine_bytes': 64 * 1024 * 1024,
                },
                reservation_token='retry-bundle-token',
                bundle_id='5' * 32, scan_event_id='6' * 32,
            )
            staged = stage_result_bundle(
                {
                    'scan_event_id': claim['scan_event_id'], 'target': claim['target'],
                    'scan_type': 'github', 'timestamp': '2026-07-27T00:00:00+00:00',
                    'findings': [], 'errors': [],
                },
                claim, str(self.bundle_root), {}, {'queue_status': 'done'},
                candidate_max_items=1, candidate_max_bytes=64 * 1024,
            )
            ready_path = self.bundle_root.joinpath(*claim['ready_relative_path'].split('/'))
            worker = ResultIngester(source_db, str(self.bundle_root), 'integration-supervisor')
            reservation_row = source_db.conn.execute(
                'SELECT * FROM result_reservations WHERE id = ?',
                (claim['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            quarantine_id = worker.quarantine(
                dict(reservation_row), str(ready_path),
                'bundle_validation_failed', 'transient permission fixture',
            )
            quarantine = source_db.pipeline_quarantine_for_review(quarantine_id)
            manifest = self.root / 'bundle-retry-review.json'
            atomic_write_private_json(str(manifest), {
                'type': 'truf-pipeline-quarantine-review-v1',
                'entries': [{
                    'id': quarantine_id,
                    'reason_code': quarantine['reason_code'],
                    'payload_sha256': quarantine['payload_sha256'],
                    'action': 'retry',
                }],
            })
            review_pipeline_quarantine_manifest(
                source_db, str(manifest), max_rows=1,
                config={'global': {
                    'results_dir': str(self.results),
                    'result_bundle_dir': str(self.bundle_root),
                    'result_bundle_max_event_bytes': 192 * 1024 * 1024,
                }},
            )
            reservation_row = source_db.conn.execute(
                'SELECT state FROM result_reservations WHERE id = ?',
                (claim['reservation_id'],),
            ).fetchone()
            review_row = source_db.conn.execute(
                'SELECT review_status FROM pipeline_quarantine WHERE id = ?',
                (quarantine_id,),
            ).fetchone()
            target_after_review = source_db.conn.execute(
                'SELECT status FROM target_queue WHERE id = ?', (claim['queue_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(reservation_row['state'], 'scanning')
            self.assertEqual(review_row['review_status'], 'approved_retry')
            self.assertEqual(target_after_review['status'], 'in_progress')
            self.assertTrue(ready_path.exists())

            ingester.recover()
            post_recover = source_db.conn.execute(
                '''SELECT r.state,
                          (SELECT reason_detail FROM pipeline_quarantine q
                           WHERE q.reservation_id = r.id AND q.review_status = 'pending'
                           ORDER BY q.id DESC LIMIT 1) AS quarantine_detail
                   FROM result_reservations r WHERE r.id = ?''',
                (claim['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(post_recover['state'], 'ready', post_recover['quarantine_detail'])
            self.assertTrue(ingester.process_one())
            target = source_db.conn.execute(
                'SELECT status FROM target_queue WHERE id = ?', (claim['queue_id'],),
            ).fetchone()
            final_quarantine = source_db.conn.execute(
                '''SELECT reason_detail FROM pipeline_quarantine
                   WHERE reservation_id = ? AND review_status = 'pending'
                   ORDER BY id DESC LIMIT 1''',
                (claim['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(
                target['status'], 'done',
                final_quarantine['reason_detail'] if final_quarantine else None,
            )
            self.assertFalse(ready_path.exists())
            capacity = source_db.pipeline_capacity_snapshot()
            self.assertEqual(capacity['quarantine_items'], 0)
            self.assertEqual(capacity['quarantine_bytes'], 0)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_updated_target_observation_is_bounded_concurrent_and_claim_fenced(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester_db = None
        ingester = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            run_id = db.start_run('integration', selected_source='github')
            cycle_id = db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            base_targets = {
                name: f'https://example.invalid/{name}'
                for name in (
                    'legacy', 'unchanged', 'active', 'failed', 'fenced',
                    'capped-one', 'capped-two', 'malformed',
                )
            }
            initial = db.observe_discovered_targets(
                'github', 'github', 'fixture',
                [
                    {'target': target, 'remote_modified_at': '2025-01-01T00:00:00Z'}
                    for target in base_targets.values()
                ],
                rescan_limit=1,
            )
            self.assertEqual(initial['queued_new_count'], len(base_targets))
            rows = db.conn.execute(
                'SELECT id, target FROM target_queue WHERE source = ?', ('github',),
            ).fetchall()
            ids = {row['target']: int(row['id']) for row in rows}
            db.conn.execute(
                '''UPDATE target_queue SET status = 'done', completed_at = ?,
                          scan_remote_modified_at = NULL
                   WHERE source = ?''',
                ('2025-02-01T00:00:00+00:00', 'github'),
            )
            db.conn.execute(
                '''UPDATE target_queue SET scan_remote_modified_at = ? WHERE id = ?''',
                ('2025-03-01T00:00:00+00:00', ids[base_targets['unchanged']]),
            )
            db.conn.execute(
                '''UPDATE target_queue SET status = 'in_progress', completed_at = NULL,
                          lease_owner = 'owner', lease_token = 'token', claim_batch = 'batch',
                          leased_at = ?, lease_expires_at = ?, scan_remote_modified_at = ?
                   WHERE id = ?''',
                (
                    '2025-02-01T00:00:00+00:00', '2027-02-01T00:00:00+00:00',
                    '2025-01-01T00:00:00+00:00', ids[base_targets['active']],
                ),
            )
            db.conn.execute(
                "UPDATE target_queue SET status = 'failed' WHERE id = ?",
                (ids[base_targets['failed']],),
            )
            db.conn.execute(
                "UPDATE target_queue SET claim_event_id = ? WHERE id = ?",
                ('f' * 32, ids[base_targets['fenced']]),
            )
            db.conn.commit()

            observed = db.observe_discovered_targets(
                'github', 'github', 'fixture',
                [
                    {'target': base_targets['legacy'], 'remote_modified_at': '2025-04-01T00:00:00Z'},
                    {'target': base_targets['unchanged'], 'remote_modified_at': '2025-03-01T00:00:00Z'},
                    {'target': base_targets['active'], 'remote_modified_at': '2025-05-01T00:00:00Z'},
                    {'target': base_targets['failed'], 'remote_modified_at': '2025-06-01T00:00:00Z'},
                    {'target': base_targets['fenced'], 'remote_modified_at': '2025-06-02T00:00:00Z'},
                    {'target': base_targets['capped-one'], 'remote_modified_at': '2025-07-01T00:00:00Z'},
                    {'target': base_targets['capped-two'], 'remote_modified_at': '2025-08-01T00:00:00Z'},
                    {'target': base_targets['malformed'], 'remote_modified_at': 'not-a-time'},
                ],
                rescan_limit=1,
            )
            self.assertEqual(observed['queued_new_count'], 0)
            self.assertEqual(observed['queued_updated_count'], 1)
            states = {
                row['target']: dict(row) for row in db.conn.execute(
                    '''SELECT target, status, remote_modified_at, scan_remote_modified_at,
                              lease_owner, lease_token, claim_batch
                       FROM target_queue WHERE source = ?''',
                    ('github',),
                ).fetchall()
            }
            db.conn.commit()
            self.assertEqual(states[base_targets['capped-two']]['status'], 'pending')
            self.assertEqual(states[base_targets['legacy']]['status'], 'done')
            self.assertEqual(states[base_targets['failed']]['status'], 'failed')
            self.assertEqual(states[base_targets['fenced']]['status'], 'done')
            self.assertEqual(states[base_targets['active']]['status'], 'in_progress')
            self.assertEqual(states[base_targets['active']]['lease_token'], 'token')
            self.assertEqual(
                states[base_targets['active']]['remote_modified_at'],
                '2025-05-01T00:00:00+00:00',
            )
            self.assertEqual(
                states[base_targets['malformed']]['remote_modified_at'],
                '2025-01-01T00:00:00+00:00',
            )

            second = db.observe_discovered_targets(
                'github', 'github', 'fixture',
                [
                    {'target': base_targets['legacy'], 'remote_modified_at': '2025-04-01T00:00:00Z'},
                    {'target': base_targets['capped-one'], 'remote_modified_at': '2025-07-01T00:00:00Z'},
                ],
                rescan_limit=2,
            )
            self.assertEqual(second['queued_updated_count'], 2)

            race_target = 'https://example.invalid/race'
            db.observe_discovered_targets(
                'race', 'github', 'fixture',
                [{'target': race_target, 'remote_modified_at': '2025-01-01T00:00:00Z'}],
            )
            db.conn.execute(
                '''UPDATE target_queue SET status = 'done', completed_at = ?,
                          scan_remote_modified_at = ? WHERE source = ?''',
                ('2025-02-01T00:00:00+00:00', '2025-01-01T00:00:00+00:00', 'race'),
            )
            db.conn.commit()
            barrier = threading.Barrier(2)
            outcomes = []
            failures = []
            lock = threading.Lock()

            def observe_race():
                connection = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    barrier.wait(5)
                    result = connection.observe_discovered_targets(
                        'race', 'github', 'fixture',
                        [{'target': race_target, 'remote_modified_at': '2025-09-01T00:00:00Z'}],
                        rescan_limit=1,
                    )
                    with lock:
                        outcomes.append(result['queued_updated_count'])
                except Exception as exc:
                    with lock:
                        failures.append(exc)
                finally:
                    connection.close()

            threads = [threading.Thread(target=observe_race) for _ in range(2)]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(10)
            self.assertEqual(failures, [])
            self.assertEqual(sorted(outcomes), [0, 1])

            reversed_targets = [
                'https://example.invalid/reversed-one',
                'https://example.invalid/reversed-two',
            ]
            db.observe_discovered_targets(
                'reversed-race', 'github', 'fixture',
                [
                    {'target': target, 'remote_modified_at': '2025-01-01T00:00:00Z'}
                    for target in reversed_targets
                ],
            )
            db.conn.execute(
                '''UPDATE target_queue SET status = 'done', completed_at = ?,
                          scan_remote_modified_at = ? WHERE source = ?''',
                (
                    '2025-02-01T00:00:00+00:00',
                    '2025-01-01T00:00:00+00:00', 'reversed-race',
                ),
            )
            db.conn.commit()
            barrier = threading.Barrier(2)
            outcomes = []
            failures = []

            def observe_reversed(reverse):
                connection = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    barrier.wait(5)
                    targets = list(reversed(reversed_targets)) if reverse else reversed_targets
                    result = connection.observe_discovered_targets(
                        'reversed-race', 'github', 'fixture',
                        [
                            {'target': target, 'remote_modified_at': '2025-09-01T00:00:00Z'}
                            for target in targets
                        ],
                        rescan_limit=2,
                    )
                    with lock:
                        outcomes.append(result['queued_updated_count'])
                except Exception as exc:
                    with lock:
                        failures.append(exc)
                finally:
                    connection.close()

            threads = [
                threading.Thread(target=observe_reversed, args=(False,)),
                threading.Thread(target=observe_reversed, args=(True,)),
            ]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(10)
            self.assertEqual(failures, [])
            self.assertEqual(sorted(outcomes), [0, 2])

            cooldown_target = 'https://example.invalid/cooldown'
            db.observe_discovered_targets(
                'cooldown-source', 'github', 'fixture',
                [{'target': cooldown_target, 'remote_modified_at': '2025-01-01T00:00:00Z'}],
            )
            db.conn.execute(
                '''UPDATE target_queue SET status = 'done', completed_at = ?,
                          scan_remote_modified_at = ? WHERE source = ?''',
                (
                    datetime.now(timezone.utc).isoformat(timespec='seconds'),
                    '2025-01-01T00:00:00+00:00', 'cooldown-source',
                ),
            )
            db.conn.commit()
            cooldown = db.observe_discovered_targets(
                'cooldown-source', 'github', 'fixture',
                [{'target': cooldown_target, 'remote_modified_at': '2025-09-01T00:00:00Z'}],
                rescan_limit=1, cooldown_seconds=86400,
            )
            self.assertEqual(cooldown['queued_updated_count'], 0)
            cooldown_state = db.conn.execute(
                'SELECT status FROM target_queue WHERE source = ?', ('cooldown-source',),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(cooldown_state['status'], 'done')
            db.conn.execute(
                '''UPDATE target_queue SET completed_at = ?
                   WHERE source = ?''',
                (
                    (datetime.now(timezone.utc) - timedelta(days=2)).isoformat(timespec='seconds'),
                    'cooldown-source',
                ),
            )
            db.conn.commit()
            cooldown_elapsed = db.observe_discovered_targets(
                'cooldown-source', 'github', 'fixture',
                [{'target': cooldown_target, 'remote_modified_at': '2025-09-01T00:00:00Z'}],
                rescan_limit=1, cooldown_seconds=86400,
            )
            self.assertEqual(cooldown_elapsed['queued_updated_count'], 1)

            claim_target = 'https://example.invalid/claim-snapshot'
            db.observe_discovered_targets(
                'claim-source', 'github', 'fixture',
                [{'target': claim_target, 'remote_modified_at': '2026-01-01T00:00:00Z'}],
            )
            claim_cycle = db.start_source_cycle(
                run_id, 'claim-source', 'github', 'integration', 'fixture',
            )
            ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            claim = db.reserve_and_claim_target(
                'claim-source', 'github', current_process_identity(), 'integration-supervisor',
                1024 * 1024, 64 * 1024, 1, 1024,
                run_id=run_id, cycle_id=claim_cycle,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                    'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                    'keycheck_items': 100, 'keycheck_bytes': 16 * 1024 * 1024,
                },
                reservation_token='updated-target-claim',
                bundle_id='c' * 32, scan_event_id='d' * 32,
            )
            self.assertIsNotNone(claim)
            claimed = db.conn.execute(
                '''SELECT status, remote_modified_at, scan_remote_modified_at
                   FROM target_queue WHERE id = ?''',
                (claim['queue_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(claimed['status'], 'in_progress')
            self.assertEqual(claimed['remote_modified_at'], claimed['scan_remote_modified_at'])

            during_scan = db.observe_discovered_targets(
                'claim-source', 'github', 'fixture',
                [{'target': claim_target, 'remote_modified_at': '2027-01-01T00:00:00Z'}],
                rescan_limit=1,
            )
            self.assertEqual(during_scan['queued_updated_count'], 0)
            changed = db.conn.execute(
                '''SELECT status, remote_modified_at, scan_remote_modified_at
                   FROM target_queue WHERE id = ?''',
                (claim['queue_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(changed['status'], 'in_progress')
            self.assertEqual(changed['remote_modified_at'], '2027-01-01T00:00:00+00:00')
            self.assertEqual(changed['scan_remote_modified_at'], '2026-01-01T00:00:00+00:00')
            staged = stage_result_bundle(
                {
                    'scan_event_id': claim['scan_event_id'],
                    'target': claim['target'],
                    'scan_type': 'github',
                    'timestamp': '2026-08-25T00:00:00+00:00',
                    'scan_started_at': '2026-08-25T00:00:00+00:00',
                    'duration_sec': 1.0,
                    'findings': [],
                    'errors': [],
                },
                claim,
                str(self.bundle_root),
                {},
                {'queue_status': 'done', 'queue_error': None, 'available_after': None},
                candidate_max_items=10,
                candidate_max_bytes=1024 * 1024,
            )
            self.assertTrue(db.mark_result_bundle_ready(
                claim['reservation_id'],
                {
                    'bundle_id': staged.bundle_id,
                    'scan_event_id': staged.scan_event_id,
                    'scan_event_hash': staged.scan_event_hash,
                    'relative_path': staged.relative_path,
                    'actual_bytes': staged.actual_bytes,
                    'frame_count': staged.frame_count,
                    'finding_count': staged.finding_count,
                    'error_count': staged.error_count,
                    'candidate_count': staged.candidate_count,
                },
            ))
            self.assertTrue(ingester.process_one())
            completed = db.conn.execute(
                '''SELECT status, remote_modified_at, scan_remote_modified_at
                   FROM target_queue WHERE id = ?''',
                (claim['queue_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(completed['status'], 'done')
            self.assertEqual(completed['remote_modified_at'], '2027-01-01T00:00:00+00:00')
            self.assertEqual(completed['scan_remote_modified_at'], '2026-01-01T00:00:00+00:00')
            follow_up = db.observe_discovered_targets(
                'claim-source', 'github', 'fixture',
                [{'target': claim_target, 'remote_modified_at': '2027-01-01T00:00:00Z'}],
                rescan_limit=1,
            )
            self.assertEqual(follow_up['queued_updated_count'], 1)

            legacy_target = 'https://example.invalid/legacy-claim'
            db.observe_discovered_targets(
                'legacy-claim-source', 'github', 'fixture',
                [{'target': legacy_target, 'remote_modified_at': '2026-05-01T00:00:00Z'}],
            )
            legacy_claim = db.claim_targets(
                'legacy-claim-source', 'github', 1, 'legacy-owner', 3600,
                return_rows=True,
            )[0]
            legacy_row = db.conn.execute(
                'SELECT remote_modified_at, scan_remote_modified_at FROM target_queue WHERE id = ?',
                (legacy_claim['id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(legacy_row['remote_modified_at'], legacy_row['scan_remote_modified_at'])

            db.finish_source_cycle(
                cycle_id, 'completed',
                {'fetched_count': 7, 'queued_new_count': 0, 'queued_updated_count': 3},
                {},
            )
            cycle = db.conn.execute(
                'SELECT queued_updated_count FROM source_cycles WHERE id = ?', (cycle_id,),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(cycle['queued_updated_count'], 3)

            window_start = datetime(2020, 1, 1, tzinfo=timezone.utc)
            window_end = datetime(2030, 1, 1, tzinfo=timezone.utc)
            dashboard_errors = []
            with mock.patch.object(dashboard, 'DASHBOARD_DB_DIALECT', 'postgres'), \
                    mock.patch.object(dashboard.st, 'error', side_effect=dashboard_errors.append):
                summary = dashboard.period_summary_df(db.conn, window_start, window_end)
                activity = dashboard.source_activity_df(db.conn, window_start, window_end)
            self.assertEqual(dashboard_errors, [])
            self.assertIn('queued_new', summary.columns)
            self.assertIn('queued_updated', summary.columns)
            self.assertIn('queued_new', activity.columns)
            self.assertIn('queued_updated', activity.columns)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            if ingester_db is not None:
                ingester_db.close()
            db.close()

    def test_updated_target_columns_upgrade_existing_runtime_schema(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.enqueue_targets(
                'legacy-upgrade', 'github', 'fixture',
                ['https://example.invalid/historical'],
            )
            run_id = db.start_run('integration', selected_source='legacy-upgrade')
            cycle_id = db.start_source_cycle(
                run_id, 'legacy-upgrade', 'github', 'integration', 'fixture',
            )
            db.conn.execute('DROP INDEX IF EXISTS idx_target_queue_updated_rescan')
            db.conn.execute('ALTER TABLE target_queue DROP COLUMN scan_remote_modified_at')
            db.conn.execute('ALTER TABLE target_queue DROP COLUMN remote_modified_at')
            db.conn.execute('ALTER TABLE source_cycles DROP COLUMN queued_updated_count')
            db.conn.commit()

            migrate_runtime_safety_schema(db, initialize_base=False)
            target = db.conn.execute(
                '''SELECT status, remote_modified_at, scan_remote_modified_at
                   FROM target_queue WHERE source = ?''',
                ('legacy-upgrade',),
            ).fetchone()
            cycle = db.conn.execute(
                'SELECT queued_updated_count FROM source_cycles WHERE id = ?', (cycle_id,),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(target['status'], 'pending')
            self.assertIsNone(target['remote_modified_at'])
            self.assertIsNone(target['scan_remote_modified_at'])
            self.assertEqual(cycle['queued_updated_count'], 0)
            self.assertTrue(
                db.conn.table_column_details('source_cycles')['queued_updated_count']['not_null']
            )
            self.assertIn(
                'idx_target_queue_updated_rescan', db.conn.table_indexes('target_queue'),
            )

            migrate_runtime_safety_schema(db, initialize_base=False)
            preserved = db.conn.execute(
                'SELECT COUNT(*) AS count FROM target_queue WHERE source = ?',
                ('legacy-upgrade',),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(preserved['count'], 1)
        finally:
            db.close()

    def test_target_claim_order_balances_old_and_fresh_backlog(self):
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(source_db, initialize_base=True)
            source_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='package_git')
            cycle_id = source_db.start_source_cycle(
                run_id, 'package_git', 'package_git', 'integration', 'fixture',
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            targets = [f'https://example.invalid/repo-{index}' for index in range(4)]
            self.assertEqual(source_db.enqueue_targets(
                'package_git', 'package_git', 'fixture', targets,
            ), 4)
            limits = {
                'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                'keycheck_items': 100, 'keycheck_bytes': 16 * 1024 * 1024,
            }

            def claim(label, bundle_id, scan_event_id, order):
                return source_db.reserve_and_claim_target(
                    'package_git', 'package_git', current_process_identity(),
                    'integration-supervisor', 1024 * 1024, 2 * 1024 * 1024,
                    1, 64 * 1024, run_id=run_id, cycle_id=cycle_id,
                    capacity_limits=limits, reservation_token=label,
                    bundle_id=bundle_id, scan_event_id=scan_event_id,
                    claim_order=order,
                )

            self.assertEqual(claim('newest', '1' * 32, 'a' * 32, 'newest')['target'], targets[3])
            self.assertEqual(claim('oldest', '2' * 32, 'b' * 32, 'oldest')['target'], targets[0])
            self.assertEqual(claim('balanced-new', '3' * 32, 'e' * 32, 'balanced')['target'], targets[2])
            self.assertEqual(claim('balanced-old', '4' * 32, 'f' * 32, 'balanced')['target'], targets[1])
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_concurrent_capacity_claim_is_atomic_and_fenced(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = setup_db.start_run('integration', selected_source='github')
            cycle_id = setup_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            setup_db.enqueue_targets(
                'github', 'github', 'fixture',
                ['https://example.invalid/one', 'https://example.invalid/two'],
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            barrier = threading.Barrier(2)
            claims = []
            failures = []
            lock = threading.Lock()
            limits = {
                'bundle_items': 1, 'bundle_bytes': 1024 * 1024,
                'projection_items': 10, 'projection_bytes': 16 * 1024 * 1024,
                'keycheck_items': 10, 'keycheck_bytes': 1024 * 1024,
            }

            def claim():
                connection = ScannerDB(db_url=self.dsn, initialize=False)
                try:
                    barrier.wait(5)
                    value = connection.reserve_and_claim_target(
                        'github', 'github', current_process_identity(),
                        'integration-supervisor', 1024 * 1024, 64 * 1024, 1, 1024,
                        run_id=run_id, cycle_id=cycle_id, capacity_limits=limits,
                        reservation_token=f'concurrent-{threading.get_ident()}',
                        bundle_id=f'{threading.get_ident():032x}'[-32:],
                        scan_event_id=f'{threading.get_ident() + 1000:032x}'[-32:],
                    )
                    with lock:
                        claims.append(value)
                except Exception as exc:
                    with lock:
                        failures.append(exc)
                finally:
                    connection.close()

            threads = [threading.Thread(target=claim) for _ in range(2)]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(10)
            self.assertEqual(failures, [])
            held = [value for value in claims if value]
            self.assertEqual(len(held), 1)
            capacity = setup_db.pipeline_capacity_snapshot()
            self.assertEqual(capacity['bundle_items'], 1)
            queue = setup_db.conn.execute(
                'SELECT status, current_result_reservation_id FROM target_queue ORDER BY id'
            ).fetchall()
            setup_db.conn.commit()
            self.assertEqual(sum(row['status'] == 'in_progress' for row in queue), 1)
            self.assertEqual(
                sum(row['current_result_reservation_id'] is not None for row in queue), 1,
            )
            self.assertTrue(setup_db.refund_uncommitted_reservation(
                held[0]['reservation_id'], current_process_identity(), 'integration refund',
                partial_absence_confirmed=True,
            ))
            self.assertEqual(setup_db.pipeline_capacity_snapshot()['bundle_items'], 0)
            next_claim = setup_db.reserve_and_claim_target(
                'github', 'github', current_process_identity(), 'integration-supervisor',
                1024 * 1024, 64 * 1024, 1, 1024,
                run_id=run_id, cycle_id=cycle_id, capacity_limits=limits,
                reservation_token='next-capacity-reservation',
                bundle_id='a' * 32, scan_event_id='b' * 32,
            )
            self.assertIsNotNone(next_claim)
            self.assertTrue(setup_db.refund_uncommitted_reservation(
                next_claim['reservation_id'], current_process_identity(), 'integration refund',
                partial_absence_confirmed=True,
            ))
            blocked_row = setup_db.conn.execute(
                "SELECT id FROM target_queue WHERE status = 'pending' ORDER BY id LIMIT 1"
            ).fetchone()
            setup_db.conn.execute(
                '''UPDATE target_queue SET remote_modified_at = ?, scan_remote_modified_at = ?
                   WHERE id = ?''',
                (
                    '2026-08-25T00:00:00+00:00',
                    '2026-08-24T00:00:00+00:00',
                    blocked_row['id'],
                ),
            )
            setup_db.conn.execute(
                'UPDATE pipeline_capacity SET quarantine_items = 10, quarantine_bytes = 1024 WHERE id = 1'
            )
            setup_db.conn.commit()
            blocked_limits = dict(limits, quarantine_items=10, quarantine_bytes=1024 * 1024)
            self.assertIsNone(setup_db.reserve_and_claim_target(
                'github', 'github', current_process_identity(), 'integration-supervisor',
                1024 * 1024, 64 * 1024, 1, 1024,
                run_id=run_id, cycle_id=cycle_id, capacity_limits=blocked_limits,
                reservation_token='quarantine-blocked-reservation',
                bundle_id='e' * 32, scan_event_id='f' * 32,
            ))
            blocked_after = setup_db.conn.execute(
                '''SELECT status, remote_modified_at, scan_remote_modified_at
                   FROM target_queue WHERE id = ?''',
                (blocked_row['id'],),
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(blocked_after['status'], 'pending')
            self.assertEqual(
                blocked_after['remote_modified_at'], '2026-08-25T00:00:00+00:00',
            )
            self.assertEqual(
                blocked_after['scan_remote_modified_at'], '2026-08-24T00:00:00+00:00',
            )
            self.assertTrue(ingester.stop())
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            setup_db.close()
            ingester_db.close()

    def test_legacy_raw_result_backfill_is_bounded_and_reconstructable(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            run_id = db.start_run('integration', selected_source='github')
            cycle_id = db.start_source_cycle(run_id, 'github', 'github', 'integration', 'fixture')
            target_scan_id = db.record_target_result(
                run_id, cycle_id, 'github', 'fixture', 'https://example.invalid/legacy',
                {
                    'target': 'https://example.invalid/legacy',
                    'scan_type': 'github', 'timestamp': '2026-07-27T00:00:00+00:00',
                    'findings': [{
                        'DetectorName': 'OpenAI', 'Raw': 'sk-legacy-fixture',
                        'finding_uid': '9' * 64, 'Verified': False,
                    }],
                    'errors': ['fixture error'],
                },
            )
            report = backfill_normalized_raw_results(
                db, max_rows=1, max_bytes=1024 * 1024, max_seconds=10,
            )
            self.assertEqual(report['processed'], 1)
            row = db.conn.execute(
                'SELECT raw_result_json, raw_result_storage FROM target_scans WHERE id = ?',
                (target_scan_id,),
            ).fetchone()
            db.conn.commit()
            self.assertIsNone(row['raw_result_json'])
            self.assertEqual(row['raw_result_storage'], 'normalized_v2')
            rebuilt = db.reconstruct_scan_result(target_scan_id)
            self.assertEqual(rebuilt['findings'][0]['Raw'], 'sk-legacy-fixture')
            self.assertEqual(rebuilt['errors'], ['fixture error'])
            first_marker = db.record_final_cutover({'deployment': 'before'})
            second_marker = db.record_final_cutover({'deployment': 'after'})
            preserved = db.conn.execute(
                'SELECT COUNT(*) AS count FROM target_scans WHERE id = ?', (target_scan_id,),
            ).fetchone()
            marker_rows = db.conn.execute(
                'SELECT COUNT(*) AS count FROM runtime_final_cutover WHERE id = 1'
            ).fetchone()
            db.conn.commit()
            self.assertNotEqual(
                first_marker['evidence_sha256'], second_marker['evidence_sha256'],
            )
            self.assertEqual((preserved['count'], marker_rows['count']), (1, 1))
        finally:
            db.close()

    def test_remote_baseline_global_cap_and_resolved_slot_are_atomic(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'remote-capacity-supervisor',
                lease_seconds=300,
            ).start()
            targets = [
                f'https://github.com/example/remote-capacity-{index}.git'
                for index in range(51)
            ]
            self.assertEqual(
                db.enqueue_targets('github', 'github', 'remote-capacity', targets),
                51,
            )
            token_sha256 = hashlib.sha256(b'remote-capacity-token').hexdigest()
            device = db.provision_remote_worker_device(
                'remote-capacity-user', 'remote-capacity-device',
                token_sha256, 51,
            )
            effective, snapshot = self._remote_execution_snapshot()
            limits = {
                'bundle_items': 100, 'bundle_bytes': 512 * 1024 * 1024,
                'projection_items': 100,
                'projection_bytes': 256 * 1024 * 1024,
                'projection_headroom_bytes': 128 * 1024 * 1024,
                'keycheck_items': 131072,
                'keycheck_bytes': 128 * 1024 * 1024,
                'quarantine_items': 100,
                'quarantine_bytes': 512 * 1024 * 1024,
            }

            def claim(index, label='claim'):
                identity = hashlib.sha256(
                    f'{label}:{index}'.encode('ascii')
                ).hexdigest()
                return db.reserve_and_claim_target(
                    'github', 'github', current_process_identity(),
                    'remote-capacity-supervisor', 64 * 1024 * 1024,
                    2 * 1024 * 1024, 0, 0,
                    lease_seconds=300, max_attempts=3,
                    capacity_limits=limits,
                    reservation_token=identity,
                    bundle_id=hashlib.sha256(
                        f'{label}:bundle:{index}'.encode('ascii')
                    ).hexdigest(),
                    scan_event_id=hashlib.sha256(
                        f'{label}:event:{index}'.encode('ascii')
                    ).hexdigest(),
                    final_cutover=True,
                    reserved_bundle_bytes=2 * 1024 * 1024,
                    remote_max_active=50,
                    remote_assignment={
                        'user_id': device['user_id'],
                        'device_id': device['device_id'],
                        'effective_config_sha256': effective,
                        'client_compat_sha256': hashlib.sha256(
                            f'{label}:client:{index}'.encode('ascii')
                        ).hexdigest(),
                        'token_sha256': token_sha256,
                        'result_upload_body_timeout_seconds': 1800,
                        'execution_snapshot': snapshot,
                    },
                ), identity

            claims = []
            for index in range(50):
                claimed, _identity = claim(index)
                self.assertIsNotNone(claimed)
                claims.append(claimed)
            capacity = db.pipeline_capacity_snapshot()
            self.assertEqual(capacity['bundle_bytes'], 100 * 1024 * 1024)
            self.assertEqual(capacity['projection_bytes'], 100 * 1024 * 1024)
            persisted = db.conn.execute(
                '''SELECT COUNT(*) AS count,
                          MIN(declared_bundle_bytes) AS hard_min,
                          MAX(declared_bundle_bytes) AS hard_max,
                          MIN(reserved_bundle_bytes) AS reserve_min,
                          MAX(reserved_bundle_bytes) AS reserve_max
                   FROM result_reservations WHERE remote_resolved_at IS NULL'''
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    persisted['count'], persisted['hard_min'],
                    persisted['hard_max'], persisted['reserve_min'],
                    persisted['reserve_max'],
                ),
                (50, 64 * 1024 * 1024, 64 * 1024 * 1024,
                 2 * 1024 * 1024, 2 * 1024 * 1024),
            )

            blocked, blocked_identity = claim(50, 'blocked')
            self.assertIsNone(blocked)
            self.assertEqual(
                db.admission_intent_resolution(blocked_identity),
                'remote_global_quota_closed',
            )
            receipt = db.report_remote_prebundle_failure(
                claims[0]['reservation_id'], device['device_id'], token_sha256,
                {
                    'failure_code': 'client_cancelled',
                    'detail': 'integration release',
                },
            )
            self.assertEqual(receipt['resolution'], 'prebundle_report')
            replacement, _identity = claim(50, 'replacement')
            self.assertIsNotNone(replacement)
            unresolved = db.conn.execute(
                '''SELECT COUNT(*) AS count FROM result_reservations
                   WHERE assignment_kind = 'remote' AND remote_resolved_at IS NULL'''
            ).fetchone()
            db.conn.commit()
            self.assertEqual(unresolved['count'], 50)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            ingester_db.close()
            db.close()

    def test_reserved_bundle_migration_backfills_and_reconciles_active_rows(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'migration-capacity-supervisor',
                lease_seconds=300,
            ).start()
            db.enqueue_targets(
                'github', 'github', 'migration-capacity',
                ['https://example.invalid/migration-capacity'],
            )
            claim = db.reserve_and_claim_target(
                'github', 'github', current_process_identity(),
                'migration-capacity-supervisor', 8 * 1024 * 1024,
                2 * 1024 * 1024, 0, 0,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 64 * 1024 * 1024,
                    'projection_items': 10,
                    'projection_bytes': 64 * 1024 * 1024,
                    'keycheck_items': 10, 'keycheck_bytes': 1024 * 1024,
                },
                reservation_token='migration-capacity-reservation',
                bundle_id='a' * 32, scan_event_id='b' * 32,
            )
            self.assertIsNotNone(claim)
            self.assertTrue(ingester.stop())
            db.conn.execute(
                'ALTER TABLE result_reservations DROP COLUMN reserved_bundle_bytes'
            )
            db.conn.execute(
                'DELETE FROM runtime_schema_migrations WHERE version = ?',
                (REMOTE_ASSIGNMENT_CAPACITY_MIGRATION,),
            )
            db.conn.execute(
                '''UPDATE pipeline_capacity SET bundle_items = 0, bundle_bytes = 0,
                          projection_items = 0, projection_bytes = 0'''
            )
            db.conn.commit()

            self.assertTrue(migrate_runtime_safety_schema(db))
            row = db.conn.execute(
                '''SELECT declared_bundle_bytes, reserved_bundle_bytes
                   FROM result_reservations WHERE id = ?''',
                (claim['reservation_id'],),
            ).fetchone()
            nullable = db.conn.execute(
                '''SELECT is_nullable FROM information_schema.columns
                   WHERE table_schema = ? AND table_name = 'result_reservations'
                     AND column_name = 'reserved_bundle_bytes' ''',
                (db.conn.application_schema,),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                row['reserved_bundle_bytes'], row['declared_bundle_bytes'],
            )
            self.assertEqual(nullable['is_nullable'], 'NO')
            capacity = db.pipeline_capacity_snapshot()
            self.assertEqual(capacity['bundle_items'], 1)
            self.assertEqual(capacity['bundle_bytes'], 8 * 1024 * 1024)
            self.assertEqual(capacity['projection_items'], 1)
            self.assertEqual(capacity['projection_bytes'], 2 * 1024 * 1024)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            ingester_db.close()
            db.close()

    def test_projection_capacity_expansion_defers_replays_and_releases_atomically(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            now = scanner_db.utc_now_iso()
            job_id = db.conn.insert_returning_id(
                '''INSERT INTO projection_jobs(
                       job_kind, event_id, event_hash, status,
                       required_stream_mask, capacity_items, capacity_bytes,
                       capacity_released, attempts, lease_generation,
                       lease_token, lease_expires_at, created_at, updated_at
                   ) VALUES ('scan_event', ?, ?, 'leased', 0, 1, 2, 0, 1,
                             1, 'projection-capacity-lease',
                             '2999-01-01T00:00:00+00:00', ?, ?)''',
                ('projection-capacity-event', 'a' * 64, now, now),
            )
            db.conn.execute(
                '''UPDATE pipeline_capacity
                   SET projection_items = 1, projection_bytes = 2,
                       updated_at = ? WHERE id = 1''',
                (now,),
            )
            db.conn.commit()

            self.assertIs(
                db.expand_projection_job_capacity(
                    job_id, 'projection-capacity-lease', 5, 4,
                ),
                False,
            )
            deferred = db.conn.execute(
                '''SELECT status, capacity_bytes, lease_token, last_error_code
                   FROM projection_jobs WHERE id = ?''',
                (job_id,),
            ).fetchone()
            capacity = db.pipeline_capacity_snapshot()
            self.assertEqual(
                (
                    deferred['status'], deferred['capacity_bytes'],
                    deferred['lease_token'], deferred['last_error_code'],
                    capacity['projection_bytes'],
                ),
                ('pending', 2, None, 'projection_capacity_backpressure', 2),
            )

            db.conn.execute(
                '''UPDATE projection_jobs
                   SET status = 'leased', lease_generation = 2,
                       lease_token = 'projection-capacity-retry',
                       lease_expires_at = '2999-01-01T00:00:00+00:00'
                   WHERE id = ?''',
                (job_id,),
            )
            db.conn.commit()
            expanded = db.expand_projection_job_capacity(
                job_id, 'projection-capacity-retry', 5, 10,
            )
            replayed = db.expand_projection_job_capacity(
                job_id, 'projection-capacity-retry', 5, 10,
            )
            self.assertEqual(expanded['capacity_bytes'], 5)
            self.assertEqual(replayed['capacity_bytes'], 5)
            self.assertEqual(db.pipeline_capacity_snapshot()['projection_bytes'], 5)
            self.assertTrue(db.complete_projection_job(
                job_id, 'projection-capacity-retry',
            ))
            self.assertEqual(db.pipeline_capacity_snapshot()['projection_bytes'], 0)
        finally:
            db.close()

    def test_ambiguous_admission_commit_reuses_exact_caller_identity(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        real_commit = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(run_id, 'github', 'github', 'integration', 'fixture')
            source_db.enqueue_targets(
                'github', 'github', 'fixture',
                ['https://example.invalid/ambiguous-one', 'https://example.invalid/ambiguous-two'],
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            arguments = dict(
                source='github', platform='github',
                producer_identity=current_process_identity(),
                supervisor_instance_id='integration-supervisor',
                declared_bundle_bytes=1024 * 1024, projection_bytes=64 * 1024,
                candidate_items=1, candidate_bytes=1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 16 * 1024 * 1024,
                    'projection_items': 10, 'projection_bytes': 16 * 1024 * 1024,
                    'keycheck_items': 10, 'keycheck_bytes': 1024 * 1024,
                },
                reservation_token='ambiguous-reservation-token',
                bundle_id='3' * 32, scan_event_id='4' * 32,
            )
            factory_calls = {'count': 0}

            def db_factory(**kwargs):
                connection = ScannerDB(**kwargs)
                factory_calls['count'] += 1
                if factory_calls['count'] == 1:
                    original_set_name = connection.set_application_name

                    def set_name_then_arm(value):
                        original_set_name(value)
                        original_commit = connection.conn.commit
                        commit_count = {'value': 0}

                        def ambiguous_commit():
                            commit_count['value'] += 1
                            original_commit()
                            if commit_count['value'] == 2:
                                raise OSError('injected admission acknowledgement loss')

                        connection.conn.commit = ambiguous_commit
                        return True

                    connection.set_application_name = set_name_then_arm
                return connection

            admission = reserve_v2_admission_with_recovery(
                self.dsn, arguments['source'], arguments['platform'],
                arguments['producer_identity'].as_dict(),
                arguments['supervisor_instance_id'],
                arguments['declared_bundle_bytes'], arguments['projection_bytes'],
                arguments['candidate_items'], arguments['candidate_bytes'],
                lease_seconds=3600, max_attempts=3,
                capacity_limits=arguments['capacity_limits'], run_id=run_id,
                cycle_id=cycle_id,
                reservation_token=arguments['reservation_token'],
                bundle_id=arguments['bundle_id'], scan_event_id=arguments['scan_event_id'],
                resolution_attempts=3, resolution_seconds=5,
                db_factory=db_factory, stop_requested=lambda: False, sleep=lambda _delay: None,
            )
            self.assertEqual(factory_calls['count'], 2)
            self.assertTrue(admission.permit_released)
            recovered = admission.claim
            self.assertEqual(recovered['reservation_token'], arguments['reservation_token'])
            self.assertEqual(recovered['bundle_id'], arguments['bundle_id'])
            self.assertEqual(source_db.pipeline_capacity_snapshot()['bundle_items'], 1)
            counts = source_db.conn.execute(
                '''SELECT COUNT(*) AS total,
                          SUM(CASE WHEN status = 'in_progress' THEN 1 ELSE 0 END) AS active,
                          SUM(attempts) AS attempts FROM target_queue'''
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(counts['total'], 2)
            self.assertEqual(counts['active'], 1)
            self.assertEqual(counts['attempts'], 1)
            self.assertTrue(source_db.refund_uncommitted_reservation(
                recovered['reservation_id'], current_process_identity(), 'integration refund',
                partial_absence_confirmed=True,
            ))
        finally:
            if real_commit is not None:
                source_db.conn.commit = real_commit
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_admission_intent_serializes_recovery_behind_late_commit(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        original = ScannerDB(db_url=self.dsn, initialize=False)
        recovery = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = setup_db.start_run('integration', selected_source='github')
            cycle_id = setup_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            setup_db.enqueue_targets(
                'github', 'github', 'fixture', ['https://example.invalid/late-commit'],
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            identity = current_process_identity()
            parameters = dict(
                source='github', platform='github', producer_identity=identity,
                supervisor_instance_id='integration-supervisor',
                declared_bundle_bytes=1024 * 1024, projection_bytes=2 * 1024 * 1024,
                candidate_items=1, candidate_bytes=1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 16 * 1024 * 1024,
                    'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                    'keycheck_items': 10, 'keycheck_bytes': 1024 * 1024,
                    'quarantine_items': 10, 'quarantine_bytes': 16 * 1024 * 1024,
                },
                reservation_token='late-commit-intent',
                bundle_id='1' * 32, scan_event_id='2' * 32,
            )
            before_commit = threading.Event()
            allow_commit = threading.Event()
            original_result = []
            recovery_result = []
            commit_calls = {'count': 0}
            real_commit = original.conn.commit

            def delayed_commit():
                commit_calls['count'] += 1
                if commit_calls['count'] == 2:
                    before_commit.set()
                    self.assertTrue(allow_commit.wait(10))
                    real_commit()
                    raise OSError('late commit acknowledgement lost')
                return real_commit()

            original.conn.commit = delayed_commit

            def submit_original():
                try:
                    original_result.append(original.reserve_and_claim_target(**parameters))
                except Exception as exc:
                    original_result.append(exc)

            def submit_recovery():
                try:
                    recovery_result.append(recovery.recover_result_reservation_claim(
                        parameters['reservation_token'], {
                            'bundle_id': parameters['bundle_id'],
                            'scan_event_id': parameters['scan_event_id'],
                            'source': parameters['source'],
                            'platform': parameters['platform'],
                            'producer_instance_id': parameters['supervisor_instance_id'],
                            'producer_pid': identity.pid,
                            'producer_creation_time': identity.creation_time,
                            'producer_executable': identity.executable,
                            'declared_bundle_bytes': parameters['declared_bundle_bytes'],
                            'reserved_bundle_bytes': parameters['declared_bundle_bytes'],
                            'reserved_projection_items': 1,
                            'reserved_projection_bytes': parameters['projection_bytes'],
                            'reserved_candidate_items': parameters['candidate_items'],
                            'reserved_candidate_bytes': parameters['candidate_bytes'],
                            'run_id': run_id,
                            'cycle_id': cycle_id,
                            'assignment_kind': 'local',
                            'remote_user_id': None,
                            'remote_device_id': None,
                            'remote_effective_config_sha256': None,
                            'remote_client_compat_sha256': None,
                            'remote_execution_snapshot_json': None,
                            'remote_execution_snapshot_sha256': None,
                        },
                    ))
                except Exception as exc:
                    recovery_result.append(exc)

            original_thread = threading.Thread(target=submit_original)
            original_thread.start()
            self.assertTrue(before_commit.wait(10))
            invisible = setup_db.conn.execute(
                'SELECT COUNT(*) AS count FROM result_reservations WHERE reservation_token = ?',
                (parameters['reservation_token'],),
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(invisible['count'], 0)
            recovery_thread = threading.Thread(target=submit_recovery)
            recovery_thread.start()
            time.sleep(0.2)
            self.assertTrue(recovery_thread.is_alive())
            allow_commit.set()
            original_thread.join(10)
            recovery_thread.join(10)
            self.assertIsInstance(original_result[0], OSError)
            self.assertIsInstance(recovery_result[0], dict)
            rows = setup_db.conn.execute(
                '''SELECT r.id, q.status, i.state AS intent_state
                   FROM result_reservations r
                   JOIN target_queue q ON q.id = r.queue_id
                   JOIN admission_intents i ON i.reservation_token = r.reservation_token
                   WHERE r.reservation_token = ?''',
                (parameters['reservation_token'],),
            ).fetchall()
            setup_db.conn.commit()
            self.assertEqual(len(rows), 1)
            self.assertEqual((rows[0]['status'], rows[0]['intent_state']), ('in_progress', 'committed'))
            capacity = setup_db.pipeline_capacity_snapshot()
            self.assertEqual((capacity['bundle_items'], capacity['projection_items']), (1, 1))
            self.assertTrue(setup_db.refund_uncommitted_reservation(
                rows[0]['id'], identity, 'integration cleanup', partial_absence_confirmed=True,
            ))
        finally:
            allow_commit.set() if 'allow_commit' in locals() else None
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            original.close()
            recovery.close()
            setup_db.close()
            ingester_db.close()

    def test_discovery_pause_and_provider_admission_serialize_in_both_orders(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        admission_first = ScannerDB(db_url=self.dsn, initialize=False)
        pause_after = ScannerDB(db_url=self.dsn, initialize=False)
        pause_first = ScannerDB(db_url=self.dsn, initialize=False)
        admission_after = ScannerDB(db_url=self.dsn, initialize=False)
        releases = []
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)
            entered, release = self._arm_delayed_commit(admission_first, 1)
            releases.append(release)
            admission_result = []
            pause_result = []

            def admit_before_pause():
                try:
                    admission_result.append(admission_first.enqueue_targets(
                        'github', 'github', 'race',
                        ['https://example.invalid/discovery-before-pause'],
                        discovery_admission=True,
                    ))
                except Exception as exc:
                    admission_result.append(exc)

            def pause_after_admission():
                try:
                    pause_result.append(pause_after.set_runtime_discovery_paused(
                        True, expected_revision=0, actor='integration:pause-after',
                        operation_id=str(uuid.uuid4()),
                    ))
                except Exception as exc:
                    pause_result.append(exc)

            admission_thread = threading.Thread(target=admit_before_pause)
            admission_thread.start()
            self.assertTrue(entered.wait(10))
            pause_thread = threading.Thread(target=pause_after_admission)
            pause_thread.start()
            time.sleep(0.2)
            self.assertTrue(pause_thread.is_alive())
            release.set()
            admission_thread.join(10)
            pause_thread.join(10)
            self.assertEqual(admission_result, [1])
            self.assertEqual(len(pause_result), 1)
            self.assertIsInstance(pause_result[0], dict)
            self.assertEqual(pause_result[0]['after']['revision'], 1)

            resumed = setup_db.set_runtime_discovery_paused(
                False, expected_revision=1, actor='integration:resume',
                operation_id=str(uuid.uuid4()),
            )
            self.assertEqual(resumed['after']['revision'], 2)

            pause_entered, pause_release = self._arm_delayed_commit(pause_first, 1)
            releases.append(pause_release)
            second_pause = []
            second_admission = []

            def commit_pause_first():
                try:
                    second_pause.append(pause_first.set_runtime_discovery_paused(
                        True, expected_revision=2, actor='integration:pause-first',
                        operation_id=str(uuid.uuid4()),
                    ))
                except Exception as exc:
                    second_pause.append(exc)

            def admit_after_pause():
                try:
                    second_admission.append(admission_after.enqueue_targets(
                        'github', 'github', 'race',
                        ['https://example.invalid/discovery-after-pause'],
                        discovery_admission=True,
                    ))
                except Exception as exc:
                    second_admission.append(exc)

            pause_thread = threading.Thread(target=commit_pause_first)
            pause_thread.start()
            self.assertTrue(pause_entered.wait(10))
            admission_thread = threading.Thread(target=admit_after_pause)
            admission_thread.start()
            time.sleep(0.2)
            self.assertTrue(admission_thread.is_alive())
            pause_release.set()
            pause_thread.join(10)
            admission_thread.join(10)
            self.assertEqual(len(second_pause), 1)
            self.assertIsInstance(second_pause[0], dict)
            self.assertEqual(len(second_admission), 1)
            self.assertIsInstance(second_admission[0], DiscoveryPausedError)

            rows = setup_db.conn.execute(
                '''SELECT target FROM target_queue
                   WHERE query = 'race' ORDER BY target'''
            ).fetchall()
            counts = setup_db.conn.execute(
                '''SELECT
                     (SELECT COUNT(*) FROM runtime_operations) AS operations,
                     (SELECT COUNT(*) FROM runtime_audit_events) AS audits'''
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(
                [row['target'] for row in rows],
                ['https://example.invalid/discovery-before-pause'],
            )
            self.assertEqual((counts['operations'], counts['audits']), (3, 3))
            state = setup_db.runtime_control_state()
            self.assertEqual(state['revision'], 3)
            self.assertTrue(state['effective_discovery_paused'])
        finally:
            for release in releases:
                release.set()
            admission_after.close()
            pause_first.close()
            pause_after.close()
            admission_first.close()
            setup_db.close()

    def test_dispatch_pause_and_remote_reservation_serialize_in_both_orders(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        admission_first = ScannerDB(db_url=self.dsn, initialize=False)
        pause_after = ScannerDB(db_url=self.dsn, initialize=False)
        pause_first = ScannerDB(db_url=self.dsn, initialize=False)
        admission_after = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        releases = []
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)
            setup_db.record_final_cutover({'test': self.id()})
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
                lease_seconds=300,
            ).start()
            targets = [
                'https://github.com/example/dispatch-before-pause.git',
                'https://github.com/example/dispatch-after-pause.git',
            ]
            self.assertEqual(
                setup_db.enqueue_targets('github', 'github', 'dispatch-race', targets),
                2,
            )
            token_sha256 = hashlib.sha256(b'dispatch-race-token').hexdigest()
            device = setup_db.provision_remote_worker_device(
                'dispatch-race-user', 'dispatch-race-device', token_sha256, 2,
            )
            effective, snapshot = self._remote_execution_snapshot()

            limits = {
                'bundle_items': 2, 'bundle_bytes': 2 * 1024 * 1024,
                'projection_items': 2, 'projection_bytes': 2 * 1024 * 1024,
                'keycheck_items': 2, 'keycheck_bytes': 2 * 1024 * 1024,
                'quarantine_items': 2, 'quarantine_bytes': 2 * 1024 * 1024,
            }
            request_ids = {
                label: {
                    'reservation_token': hashlib.sha256(
                        f'dispatch-request:{label}'.encode('ascii')
                    ).hexdigest(),
                    'bundle_id': hashlib.sha256(
                        f'dispatch-bundle:{label}'.encode('ascii')
                    ).hexdigest(),
                    'scan_event_id': hashlib.sha256(
                        f'dispatch-event:{label}'.encode('ascii')
                    ).hexdigest(),
                }
                for label in ('before', 'after')
            }

            def claim(database, label):
                identity = request_ids[label]
                return database.reserve_and_claim_target(
                    'github', 'github', current_process_identity(),
                    'integration-supervisor', 1024 * 1024, 1024 * 1024,
                    0, 0, lease_seconds=300, max_attempts=3,
                    capacity_limits=limits,
                    reservation_token=identity['reservation_token'],
                    bundle_id=identity['bundle_id'],
                    scan_event_id=identity['scan_event_id'],
                    claim_order='oldest', final_cutover=True,
                    remote_assignment={
                        'user_id': device['user_id'],
                        'device_id': device['device_id'],
                        'effective_config_sha256': effective,
                        'client_compat_sha256': hashlib.sha256(
                            f'dispatch-client:{label}'.encode('ascii')
                        ).hexdigest(),
                        'token_sha256': token_sha256,
                        'result_upload_body_timeout_seconds': 1800,
                        'execution_snapshot': snapshot,
                    },
                )

            entered, release = self._arm_delayed_commit(admission_first, 2)
            releases.append(release)
            first_claim = []
            first_pause = []

            def claim_before_pause():
                try:
                    first_claim.append(claim(admission_first, 'before'))
                except Exception as exc:
                    first_claim.append(exc)

            def pause_after_claim():
                try:
                    first_pause.append(pause_after.set_runtime_dispatch_paused(
                        True, expected_revision=0, actor='integration:dispatch-after',
                        operation_id=str(uuid.uuid4()),
                    ))
                except Exception as exc:
                    first_pause.append(exc)

            claim_thread = threading.Thread(target=claim_before_pause)
            claim_thread.start()
            self.assertTrue(entered.wait(10))
            pause_thread = threading.Thread(target=pause_after_claim)
            pause_thread.start()
            time.sleep(0.2)
            self.assertTrue(pause_thread.is_alive())
            release.set()
            claim_thread.join(10)
            pause_thread.join(10)
            self.assertEqual(len(first_claim), 1)
            self.assertIsInstance(first_claim[0], dict)
            self.assertEqual(first_claim[0]['target'], targets[0])
            self.assertEqual(len(first_pause), 1)
            self.assertIsInstance(first_pause[0], dict)

            setup_db.set_runtime_dispatch_paused(
                False, expected_revision=1, actor='integration:dispatch-resume',
                operation_id=str(uuid.uuid4()),
            )
            pause_entered, pause_release = self._arm_delayed_commit(pause_first, 1)
            releases.append(pause_release)
            second_pause = []
            second_claim = []

            def commit_pause_first():
                try:
                    second_pause.append(pause_first.set_runtime_dispatch_paused(
                        True, expected_revision=2, actor='integration:dispatch-first',
                        operation_id=str(uuid.uuid4()),
                    ))
                except Exception as exc:
                    second_pause.append(exc)

            def claim_after_pause():
                try:
                    second_claim.append(claim(admission_after, 'after'))
                except Exception as exc:
                    second_claim.append(exc)

            pause_thread = threading.Thread(target=commit_pause_first)
            pause_thread.start()
            self.assertTrue(pause_entered.wait(10))
            claim_thread = threading.Thread(target=claim_after_pause)
            claim_thread.start()
            time.sleep(0.2)
            self.assertTrue(claim_thread.is_alive())
            pause_release.set()
            pause_thread.join(10)
            claim_thread.join(10)
            self.assertEqual(len(second_pause), 1)
            self.assertIsInstance(second_pause[0], dict)
            self.assertEqual(second_claim, [None])

            rows = setup_db.conn.execute(
                '''SELECT q.target, q.status, q.attempts,
                          q.current_result_reservation_id
                   FROM target_queue q WHERE q.query = 'dispatch-race'
                   ORDER BY q.target'''
            ).fetchall()
            intents = setup_db.conn.execute(
                '''SELECT reservation_token, state, resolution_detail
                   FROM admission_intents ORDER BY reservation_token'''
            ).fetchall()
            reservations = setup_db.conn.execute(
                'SELECT COUNT(*) AS count FROM result_reservations'
            ).fetchone()
            setup_db.conn.commit()
            by_target = {row['target']: row for row in rows}
            self.assertEqual(
                (by_target[targets[0]]['status'], by_target[targets[0]]['attempts']),
                ('in_progress', 1),
            )
            self.assertEqual(
                (
                    by_target[targets[1]]['status'], by_target[targets[1]]['attempts'],
                    by_target[targets[1]]['current_result_reservation_id'],
                ),
                ('pending', 0, None),
            )
            intent_by_token = {row['reservation_token']: row for row in intents}
            self.assertEqual(
                intent_by_token[request_ids['before']['reservation_token']]['state'],
                'committed',
            )
            blocked = intent_by_token[request_ids['after']['reservation_token']]
            self.assertEqual(
                (blocked['state'], blocked['resolution_detail']),
                ('aborted', 'dispatch_gate_closed'),
            )
            self.assertEqual(reservations['count'], 1)
            self.assertEqual(setup_db.pipeline_capacity_snapshot()['bundle_items'], 1)
            state = setup_db.runtime_control_state()
            self.assertEqual(state['revision'], 3)
            self.assertTrue(state['effective_dispatch_paused'])
        finally:
            for release in releases:
                release.set()
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            admission_after.close()
            pause_first.close()
            pause_after.close()
            admission_first.close()
            ingester_db.close()
            setup_db.close()

    def test_concurrent_control_cas_has_one_winner_and_persists_across_reconnect(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        discovery_db = ScannerDB(db_url=self.dsn, initialize=False)
        dispatch_db = ScannerDB(db_url=self.dsn, initialize=False)
        operation_ids = {
            'discovery': str(uuid.uuid4()),
            'dispatch': str(uuid.uuid4()),
        }
        actors = {
            'discovery': 'integration:discovery-cas',
            'dispatch': 'integration:dispatch-cas',
        }
        outcomes = {}
        lock = threading.Lock()
        barrier = threading.Barrier(2)
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)

            def mutate(name, database):
                try:
                    barrier.wait(5)
                    if name == 'discovery':
                        value = database.set_runtime_discovery_paused(
                            True, expected_revision=0, actor=actors[name],
                            operation_id=operation_ids[name],
                        )
                    else:
                        value = database.set_runtime_dispatch_paused(
                            True, expected_revision=0, actor=actors[name],
                            operation_id=operation_ids[name],
                        )
                except Exception as exc:
                    value = exc
                with lock:
                    outcomes[name] = value

            threads = [
                threading.Thread(target=mutate, args=('discovery', discovery_db)),
                threading.Thread(target=mutate, args=('dispatch', dispatch_db)),
            ]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(10)
            winners = [name for name, value in outcomes.items() if isinstance(value, dict)]
            losers = [
                name for name, value in outcomes.items()
                if isinstance(value, RuntimeControlRevisionConflictError)
            ]
            self.assertEqual((len(winners), len(losers)), (1, 1))
            loser = outcomes[losers[0]]
            self.assertEqual(loser.expected_revision, 0)
            self.assertEqual(loser.current_state['revision'], 1)

            winner = winners[0]
            missing = losers[0]
            if missing == 'discovery':
                setup_db.set_runtime_discovery_paused(
                    True, expected_revision=1, actor=actors[missing],
                    operation_id=operation_ids[missing],
                )
            else:
                setup_db.set_runtime_dispatch_paused(
                    True, expected_revision=1, actor=actors[missing],
                    operation_id=operation_ids[missing],
                )
            counts = setup_db.conn.execute(
                '''SELECT
                     (SELECT COUNT(*) FROM runtime_operations) AS operations,
                     (SELECT COUNT(*) FROM runtime_audit_events) AS audits'''
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual((counts['operations'], counts['audits']), (2, 2))
        finally:
            dispatch_db.close()
            discovery_db.close()
            setup_db.close()

        reopened = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            state = reopened.runtime_control_state()
            self.assertEqual(state['revision'], 2)
            self.assertTrue(state['discovery_paused'])
            self.assertTrue(state['dispatch_paused'])
            if winner == 'discovery':
                replay = reopened.set_runtime_discovery_paused(
                    True, expected_revision=0, actor=actors[winner],
                    operation_id=operation_ids[winner],
                )
            else:
                replay = reopened.set_runtime_dispatch_paused(
                    True, expected_revision=0, actor=actors[winner],
                    operation_id=operation_ids[winner],
                )
            self.assertTrue(replay['replayed'])
            counts = reopened.conn.execute(
                '''SELECT
                     (SELECT COUNT(*) FROM runtime_operations) AS operations,
                     (SELECT COUNT(*) FROM runtime_audit_events) AS audits'''
            ).fetchone()
            reopened.conn.commit()
            self.assertEqual((counts['operations'], counts['audits']), (2, 2))
        finally:
            reopened.close()

    def test_runtime_operation_reconciliation_serializes_across_restart_race(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        running_db = ScannerDB(db_url=self.dsn, initialize=False)
        result_db = ScannerDB(db_url=self.dsn, initialize=False)
        operation_id = str(uuid.uuid4())
        expected = {
            'active_config_sha256': '1' * 64,
            'active_secrets_sha256': '2' * 64,
            'candidate_config_sha256': '3' * 64,
            'candidate_secrets_sha256': '4' * 64,
        }
        resulting = {
            'active_config_sha256': '3' * 64,
            'active_secrets_sha256': '4' * 64,
        }
        envelope = json.dumps({
            'schema': 1,
            'operation_id': operation_id,
            'action': 'apply-both',
            'result': 'succeeded',
            'safe_category': None,
            'safe_detail': None,
            'resulting_identity': resulting,
        }, sort_keys=True, separators=(',', ':')).encode('utf-8')
        barrier = threading.Barrier(2)
        outcomes = []
        lock = threading.Lock()
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)
            setup_db.create_runtime_operation(
                operation_id=operation_id,
                actor='integration:operation-race',
                action='apply-both',
                expected_identity=expected,
            )

            def run_transition(kind, database):
                try:
                    barrier.wait(5)
                    if kind == 'running':
                        value = database.mark_runtime_operation_running(operation_id)
                    else:
                        value = database.reconcile_runtime_operation_result(envelope)
                except Exception as exc:
                    value = exc
                with lock:
                    outcomes.append((kind, value))

            threads = [
                threading.Thread(target=run_transition, args=('running', running_db)),
                threading.Thread(target=run_transition, args=('result', result_db)),
            ]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join(10)
                self.assertFalse(thread.is_alive())

            by_kind = dict(outcomes)
            self.assertIsInstance(by_kind['result'], dict)
            self.assertEqual(by_kind['result']['status'], 'succeeded')
            running_outcome = by_kind['running']
            self.assertTrue(
                isinstance(running_outcome, dict)
                or isinstance(running_outcome, scanner_db.RuntimeOperationTransitionError)
            )
        finally:
            result_db.close()
            running_db.close()
            setup_db.close()

        reopened = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            persisted = reopened.runtime_operation(operation_id)
            self.assertEqual(persisted['status'], 'succeeded')
            self.assertEqual(persisted['resulting_identity'], resulting)
            audits = reopened.conn.execute(
                '''SELECT id, result, previous_event_id, previous_event_sha256, event_sha256
                   FROM runtime_audit_events WHERE operation_id = ? ORDER BY id''',
                (operation_id,),
            ).fetchall()
            reopened.conn.commit()
            self.assertEqual([row['result'] for row in audits], ['accepted', 'succeeded'])
            self.assertEqual(audits[1]['previous_event_id'], audits[0]['id'])
            self.assertEqual(audits[1]['previous_event_sha256'], audits[0]['event_sha256'])
        finally:
            reopened.close()

    def test_runtime_audit_cursor_pages_survive_restart_and_remain_append_only(self):
        database = ScannerDB(db_url=self.dsn, initialize=False)
        operation_ids = [str(uuid.uuid4()) for _ in range(4)]
        expected = {
            'active_config_sha256': '1' * 64,
            'active_secrets_sha256': '2' * 64,
            'candidate_config_sha256': '3' * 64,
            'candidate_secrets_sha256': None,
        }
        try:
            migrate_runtime_safety_schema(database, initialize_base=True)
            for operation_id in operation_ids:
                database.create_runtime_operation(
                    operation_id=operation_id,
                    actor='integration:audit-page',
                    action='apply-config',
                    expected_identity=expected,
                )
            first = database.runtime_audit_events(limit=2)
            self.assertEqual(len(first['events']), 2)
            self.assertEqual(
                [event['operation_id'] for event in first['events']],
                list(reversed(operation_ids[-2:])),
            )
            self.assertIsNotNone(first['next_before_event_id'])
        finally:
            database.close()

        reopened = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            second = reopened.runtime_audit_events(
                before_event_id=first['next_before_event_id'], limit=2,
            )
            self.assertEqual(
                [event['operation_id'] for event in second['events']],
                list(reversed(operation_ids[:2])),
            )
            self.assertIsNone(second['next_before_event_id'])
            self.assertTrue(
                set(event['id'] for event in first['events']).isdisjoint(
                    event['id'] for event in second['events']
                )
            )

            for statement in (
                "UPDATE runtime_audit_events SET actor = 'tampered'",
                'DELETE FROM runtime_audit_events',
                'TRUNCATE runtime_audit_events',
            ):
                with self.subTest(statement=statement), self.assertRaises(Exception):
                    reopened.conn.execute(statement)
                reopened.conn.rollback()
        finally:
            reopened.close()

    def test_managed_file_execution_advisory_lock_blocks_and_releases(self):
        for release_mode in ('explicit', 'session-close'):
            with self.subTest(release_mode=release_mode):
                operation_id = str(uuid.uuid4())
                owner = ScannerDB(db_url=self.dsn, initialize=False)
                started = threading.Event()
                acquired = threading.Event()
                release_contender = threading.Event()
                errors = []

                owner.acquire_runtime_managed_file_execution(operation_id)

                def contend():
                    contender = ScannerDB(db_url=self.dsn, initialize=False)
                    try:
                        started.set()
                        contender.acquire_runtime_managed_file_execution(operation_id)
                        acquired.set()
                        if not release_contender.wait(10):
                            raise AssertionError(
                                'managed file advisory lock release timed out'
                            )
                        contender.release_runtime_managed_file_execution(operation_id)
                    except BaseException as exc:
                        errors.append(exc)
                    finally:
                        contender.close()

                thread = threading.Thread(target=contend, daemon=True)
                thread.start()
                owner_released = False
                try:
                    self.assertTrue(started.wait(5))
                    self.assertFalse(acquired.wait(0.2))
                    if release_mode == 'explicit':
                        owner.release_runtime_managed_file_execution(operation_id)
                    else:
                        owner.close()
                    owner_released = True
                    self.assertTrue(acquired.wait(5))
                finally:
                    if not owner_released:
                        owner.close()
                    release_contender.set()
                    thread.join(10)
                    if release_mode == 'explicit':
                        owner.close()

                self.assertFalse(thread.is_alive())
                self.assertEqual(errors, [])

    def test_drain_allows_protocol1_upload_and_completes_after_ingestion_commit(self):
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(setup_db, initialize_base=True)
            setup_db.record_final_cutover({'test': self.id()})
            injected = {'pending': True}

            def fault(stage, _value):
                if stage == 'after_db_commit' and injected['pending']:
                    injected['pending'] = False
                    raise RuntimeError('injected remote ingestion acknowledgement loss')

            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor',
                lease_seconds=300, fault=fault,
            ).start()
            target = 'https://github.com/example/drain-upload.git'
            self.assertEqual(
                setup_db.enqueue_targets('github', 'github', 'drain-upload', [target]),
                1,
            )
            token_sha256 = hashlib.sha256(b'drain-upload-token').hexdigest()
            device = setup_db.provision_remote_worker_device(
                'drain-upload-user', 'drain-upload-device', token_sha256, 1,
            )
            effective, snapshot = self._remote_execution_snapshot()
            snapshot['compatibility']['protocol_version'] = 1
            reservation_token = hashlib.sha256(b'drain-upload-request').hexdigest()
            bundle_id = hashlib.sha256(b'drain-upload-bundle').hexdigest()
            scan_event_id = hashlib.sha256(b'drain-upload-event').hexdigest()
            declared_bytes = 1024 * 1024
            claim = setup_db.reserve_and_claim_target(
                'github', 'github', current_process_identity(),
                'integration-supervisor', declared_bytes, declared_bytes,
                0, 0, lease_seconds=300, max_attempts=3,
                capacity_limits={
                    'bundle_items': 1, 'bundle_bytes': declared_bytes,
                    'projection_items': 2, 'projection_bytes': 2 * declared_bytes,
                    'keycheck_items': 2, 'keycheck_bytes': 2 * declared_bytes,
                    'quarantine_items': 1, 'quarantine_bytes': declared_bytes,
                },
                reservation_token=reservation_token, bundle_id=bundle_id,
                scan_event_id=scan_event_id, claim_order='oldest',
                final_cutover=True,
                remote_assignment={
                    'user_id': device['user_id'],
                    'device_id': device['device_id'],
                    'effective_config_sha256': effective,
                    'client_compat_sha256': hashlib.sha256(
                        b'drain-upload-client'
                    ).hexdigest(),
                    'token_sha256': token_sha256,
                    'result_upload_body_timeout_seconds': 1800,
                    'execution_snapshot': snapshot,
                },
            )
            self.assertIsNotNone(claim)
            resolution = {
                'provider': 'github',
                'repo_url': target,
                'repo_path': 'example/drain-upload',
                'branch': 'main',
                'ref': 'refs/heads/main',
                'head_sha': 'b' * 40,
                'ref_source': 'provider_default',
            }
            plan = setup_db.bind_git_scan_plan(
                claim['reservation_id'], claim['claim_lease_token'], resolution, 100,
                remote_credential={
                    'device_id': device['device_id'],
                    'token_sha256': token_sha256,
                },
            )
            plan_sha256 = hashlib.sha256(
                canonical_git_scan_plan_bytes(plan)
            ).hexdigest()
            exact_scope = {
                key: plan.get(key) for key in (
                    'provider', 'ref', 'head_sha', 'base_sha', 'mode',
                    'baseline_depth', 'ref_source',
                )
            }
            staged = stage_result_bundle(
                {
                    'scan_event_id': claim['scan_event_id'],
                    'target': claim['target'],
                    'scan_type': 'github',
                    'timestamp': '2026-09-19T00:00:00+00:00',
                    'scan_started_at': '2026-09-19T00:00:00+00:00',
                    'duration_sec': 1.0,
                    'findings': [],
                    'errors': [],
                    'git_scan_plan': plan,
                    'git_scan_execution': {
                        'mode': plan['mode'],
                        'pinned': True,
                        'success': True,
                        'continuity_reset': False,
                        'plan_sha256': plan_sha256,
                    },
                    'scan_meta': {'exact_git_scope': exact_scope},
                },
                claim, str(self.bundle_root), {},
                {'queue_status': 'done', 'queue_error': None, 'available_after': None},
                candidate_max_items=1, candidate_max_bytes=1024,
            )
            ready_path = self.bundle_root.joinpath(*staged.relative_path.split('/'))
            upload_reader = ResultBundleReader(str(ready_path))
            metadata = upload_reader.validate().as_dict()
            metadata['relative_path'] = staged.relative_path
            upload_diagnostics = upload_reader.effective_diagnostics()
            metadata['effective_diagnostic_projection_version'] = 1
            metadata['effective_diagnostic_count'] = len(upload_diagnostics)
            metadata['effective_diagnostic_uids_sha256'] = (
                worker_contracts.ordered_diagnostic_uid_set_sha256(
                    upload_diagnostics
                )
            )
            payload_sha256 = hashlib.sha256(ready_path.read_bytes()).hexdigest()
            acceptance = {
                'device_id': device['device_id'],
                'token_sha256': token_sha256,
                'payload_sha256': payload_sha256,
            }

            started = setup_db.start_runtime_drain(
                expected_revision=0, actor='integration:drain',
                operation_id=str(uuid.uuid4()),
            )
            self.assertEqual(started['after']['drain_state'], 'draining')
            progress = setup_db.runtime_drain_progress()
            self.assertEqual(
                (
                    progress['live_remote_assignments'],
                    progress['precommit_result_bundles'],
                    progress['blocker_count'],
                ),
                (1, 0, 1),
            )
            self.assertTrue(progress['effective_discovery_paused'])
            self.assertTrue(progress['effective_dispatch_paused'])

            receipt = setup_db.mark_result_bundle_ready(
                claim['reservation_id'], metadata, remote_acceptance=acceptance,
            )
            self.assertEqual(receipt['resolution'], 'bundle_accepted')
            progress = setup_db.runtime_drain_progress()
            self.assertEqual(
                (
                    progress['live_remote_assignments'],
                    progress['precommit_result_bundles'],
                    progress['blocker_count'],
                ),
                (0, 1, 1),
            )
            self.assertIsNone(setup_db.reconcile_runtime_drain())

            with self.assertRaisesRegex(
                RuntimeError, 'remote ingestion acknowledgement loss',
            ):
                ingester.process_one()
            progress = setup_db.runtime_drain_progress()
            self.assertEqual(
                (
                    progress['live_remote_assignments'],
                    progress['precommit_result_bundles'],
                    progress['blocker_count'],
                ),
                (0, 0, 0),
            )
            completed = setup_db.reconcile_runtime_drain()
            self.assertEqual(completed['action'], 'control.drain.complete')
            self.assertEqual(completed['after']['drain_state'], 'drained')
            self.assertEqual(completed['after']['revision'], 2)
            state = setup_db.runtime_control_state()
            self.assertFalse(state['discovery_paused'])
            self.assertFalse(state['dispatch_paused'])
            self.assertTrue(state['effective_discovery_paused'])
            self.assertTrue(state['effective_dispatch_paused'])

            replay = setup_db.mark_result_bundle_ready(
                claim['reservation_id'], metadata, remote_acceptance=acceptance,
            )
            self.assertEqual(replay, receipt)
            status = setup_db.remote_assignment_status(
                claim['reservation_id'], device['device_id'], token_sha256,
            )
            self.assertEqual(
                {key: status[key] for key in receipt}, receipt,
            )
            self.assertIn('deadlines', status)
            self.assertIn('latest_progress', status)
            self.assertIn('diagnostics', status)
            ingester.fault = None
            self.assertTrue(ingester.process_one())
            final = setup_db.conn.execute(
                '''SELECT r.state AS reservation_state, b.state AS bundle_state,
                          q.status AS queue_status
                   FROM result_reservations r
                   JOIN result_bundles b ON b.reservation_id = r.id
                   JOIN target_queue q ON q.id = r.queue_id
                   WHERE r.id = ?''',
                (claim['reservation_id'],),
            ).fetchone()
            scan_count = setup_db.conn.execute(
                'SELECT COUNT(*) AS count FROM target_scans WHERE scan_event_id = ?',
                (claim['scan_event_id'],),
            ).fetchone()
            setup_db.conn.commit()
            self.assertEqual(
                (
                    final['reservation_state'], final['bundle_state'],
                    final['queue_status'], scan_count['count'],
                ),
                ('acknowledged', 'acknowledged', 'done', 1),
            )
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            ingester_db.close()
            setup_db.close()

    def test_production_capacity_allows_three_base_and_one_gated_bonus_admission(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        setup_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        old_limiter = (
            scan_config.max_active_scans,
            scan_config.scan_limiter_db,
            scan_config.opportunistic_scan_slots,
            scan_config.opportunistic_scan_sources,
        )
        leases = []
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = setup_db.start_run('integration', selected_source='github')
            cycle_id = setup_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            setup_db.enqueue_targets(
                'github', 'github', 'fixture',
                [f'https://example.invalid/slot-{index}' for index in range(5)],
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            event_bytes = 201326592
            projection_bytes = event_bytes * 2
            projection_limit = 2147483648
            headroom = projection_bytes
            model = validate_v2_capacity_model(
                4, event_bytes, projection_limit, headroom,
            )
            self.assertEqual(model['required_projection_bytes'], 2013265920)
            scan_config.max_active_scans = 3
            scan_config.opportunistic_scan_slots = 1
            scan_config.opportunistic_scan_sources = ['github']
            scan_config.scan_limiter_db = str(self.root / 'production-scan-limiter.db')
            claims = []
            limits = {
                'bundle_items': 10000,
                'bundle_bytes': 3221225472,
                'projection_items': 10000,
                'projection_bytes': projection_limit,
                'keycheck_items': 100000,
                'keycheck_bytes': 536870912,
                'quarantine_items': 10000,
                'quarantine_bytes': 1073741824,
            }
            with mock.patch.object(scanner, 'opportunistic_scan_slot_allowed', return_value=True):
                for index in range(4):
                    lease = acquire_scan_slot(
                        ['integration-production-slot', 'github'], 1800,
                        wait=False, start_heartbeat=False,
                    )
                    self.assertIsNotNone(lease)
                    leases.append(lease)
                    claims.append(setup_db.reserve_and_claim_target(
                        'github', 'github', current_process_identity(),
                        'integration-supervisor', event_bytes, projection_bytes,
                        2000, 2097152, run_id=run_id, cycle_id=cycle_id,
                        capacity_limits=limits,
                        reservation_token=f'production-slot-{index}',
                        bundle_id=f'{index + 1:032x}',
                        scan_event_id=f'{index + 101:032x}',
                    ))
                fifth_lease = acquire_scan_slot(
                    ['integration-production-slot', 'github'], 1800,
                    wait=False, start_heartbeat=False,
                )
            self.assertIsNone(fifth_lease)
            self.assertEqual(len([claim for claim in claims if claim]), 4)
            capacity = setup_db.pipeline_capacity_snapshot()
            self.assertEqual(capacity['projection_items'], 4)
            self.assertEqual(capacity['projection_bytes'], 4 * projection_bytes)
            self.assertGreaterEqual(
                projection_limit - capacity['projection_bytes'], headroom,
            )
            queue = setup_db.conn.execute(
                '''SELECT status, COUNT(*) AS count FROM target_queue
                   GROUP BY status ORDER BY status'''
            ).fetchall()
            setup_db.conn.commit()
            self.assertEqual(
                {row['status']: row['count'] for row in queue},
                {'in_progress': 4, 'pending': 1},
            )
            for lease in leases:
                lease.release()
            leases.clear()
            with self.assertRaisesRegex(RuntimeError, 'partial absence'):
                setup_db.refund_uncommitted_reservation(
                    claims[0]['reservation_id'], current_process_identity(),
                    'unconfirmed cleanup',
                )
            for claim in claims:
                self.assertTrue(setup_db.refund_uncommitted_reservation(
                    claim['reservation_id'], current_process_identity(),
                    'integration cleanup', partial_absence_confirmed=True,
                ))
            old = '2000-01-01T00:00:00+00:00'
            setup_db.conn.execute(
                '''INSERT INTO admission_intents(
                       reservation_token, intent_sha256, state, resolution_detail,
                       created_at, updated_at, resolved_at
                   ) VALUES ('retire-aborted', ?, 'aborted', 'fixture', ?, ?, ?),
                            ('retain-pending', ?, 'pending', 'fixture', ?, ?, NULL)''',
                ('1' * 64, old, old, old, '2' * 64, old, old),
            )
            setup_db.conn.execute(
                "UPDATE admission_intents SET resolved_at = ?, updated_at = ? WHERE state = 'committed'",
                (old, old),
            )
            setup_db.conn.execute(
                "UPDATE pipeline_artifacts SET deleted_at = ?, updated_at = ? WHERE state = 'deleted'",
                (old, old),
            )
            protected = setup_db.conn.execute(
                "SELECT id FROM pipeline_artifacts WHERE state = 'deleted' ORDER BY id LIMIT 1"
            ).fetchone()
            setup_db.conn.execute(
                '''INSERT INTO pipeline_quarantine(
                       subsystem, object_type, object_id, reason_code, reason_detail,
                       byte_count, capacity_items, capacity_bytes,
                       capacity_credit_applied, review_status, detected_at
                   ) VALUES ('fixture','projection_tail',?,'fixture','fixture',
                             0,0,0,0,'pending',?)''',
                (protected['id'], old),
            )
            setup_db.conn.commit()
            self.assertEqual(setup_db.retire_admission_intents(3600, 100), 1)
            retired_artifacts = setup_db.retire_deleted_pipeline_artifacts(3600, 100)
            intent_states = setup_db.conn.execute(
                'SELECT reservation_token, state FROM admission_intents ORDER BY reservation_token'
            ).fetchall()
            protected_row = setup_db.conn.execute(
                'SELECT state FROM pipeline_artifacts WHERE id = ?', (protected['id'],),
            ).fetchone()
            intent_summary = setup_db.conn.execute(
                'SELECT retired_count, chain_sha256 FROM admission_intent_retirement WHERE id = 1'
            ).fetchone()
            artifact_summary = setup_db.conn.execute(
                'SELECT retired_count, chain_sha256 FROM pipeline_artifact_retirement WHERE id = 1'
            ).fetchone()
            setup_db.conn.commit()
            self.assertNotIn('retire-aborted', {row['reservation_token'] for row in intent_states})
            self.assertIn('retain-pending', {row['reservation_token'] for row in intent_states})
            self.assertTrue(any(row['state'] == 'committed' for row in intent_states))
            self.assertIsNotNone(protected_row)
            self.assertGreaterEqual(retired_artifacts, 1)
            self.assertEqual(intent_summary['retired_count'], 1)
            self.assertNotEqual(intent_summary['chain_sha256'], '0' * 64)
            self.assertEqual(artifact_summary['retired_count'], retired_artifacts)
            self.assertNotEqual(artifact_summary['chain_sha256'], '0' * 64)
        finally:
            for lease in leases:
                lease.release()
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            (
                scan_config.max_active_scans,
                scan_config.scan_limiter_db,
                scan_config.opportunistic_scan_slots,
                scan_config.opportunistic_scan_sources,
            ) = old_limiter
            setup_db.close()
            ingester_db.close()

    def test_unknown_partial_blocks_refund_then_dead_producer_recovery_converges(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            source_db.enqueue_targets(
                'github', 'github', 'fixture', ['https://example.invalid/partial-recovery'],
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            identity = current_process_identity()
            claim = source_db.reserve_and_claim_target(
                'github', 'github', identity, 'integration-supervisor',
                1024 * 1024, 2 * 1024 * 1024, 1, 1024,
                run_id=run_id, cycle_id=cycle_id,
                capacity_limits={
                    'bundle_items': 10, 'bundle_bytes': 16 * 1024 * 1024,
                    'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                    'keycheck_items': 10, 'keycheck_bytes': 1024 * 1024,
                    'quarantine_items': 10, 'quarantine_bytes': 16 * 1024 * 1024,
                },
                reservation_token='partial-recovery-token',
                bundle_id='6' * 32, scan_event_id='7' * 32,
            )
            from result_bundle import bundle_partial_path, ensure_bundle_reservation_paths

            ensure_bundle_reservation_paths(str(self.bundle_root), claim)
            partial = bundle_partial_path(
                str(self.bundle_root), claim['bundle_id'], claim['reservation_token'],
            )
            Path(partial).write_bytes(b'incomplete')
            harden_private_file(partial)
            with mock.patch.object(
                console_runner, 'durable_unlink', side_effect=OSError('storage unlink unknown'),
            ):
                self.assertFalse(console_runner.refund_v2_claim_after_no_handoff(
                    source_db, str(self.bundle_root), claim, identity.as_dict(), 'fixture failure',
                ))
            retained = source_db.conn.execute(
                'SELECT state FROM result_reservations WHERE id = ?',
                (claim['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(retained['state'], 'scanning')
            self.assertEqual(source_db.pipeline_capacity_snapshot()['bundle_items'], 1)
            with mock.patch.object(
                result_ingester, 'exact_process_identity_state', return_value='dead',
            ):
                ingester.recover()
            recovered = source_db.conn.execute(
                'SELECT state FROM result_reservations WHERE id = ?',
                (claim['reservation_id'],),
            ).fetchone()
            count = source_db.conn.execute(
                'SELECT COUNT(*) AS count FROM result_reservations'
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(recovered['state'], 'refunded')
            self.assertEqual(count['count'], 1)
            self.assertFalse(os.path.exists(partial))
            self.assertEqual(source_db.pipeline_capacity_snapshot()['bundle_items'], 0)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_persistent_cleanup_failure_on_a_does_not_block_bundle_b(self):
        ingester_db = ScannerDB(db_url=self.dsn, initialize=False)
        source_db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(ingester_db, initialize_base=True)
            ingester_db.record_final_cutover({'test': self.id()})
            run_id = source_db.start_run('integration', selected_source='github')
            cycle_id = source_db.start_source_cycle(
                run_id, 'github', 'github', 'integration', 'fixture',
            )
            source_db.enqueue_targets(
                'github', 'github', 'fixture',
                ['https://example.invalid/cleanup-a', 'https://example.invalid/cleanup-b'],
            )
            ingester = ResultIngester(
                ingester_db, str(self.bundle_root), 'integration-supervisor', lease_seconds=300,
            ).start()
            identity = current_process_identity()
            limits = {
                'bundle_items': 10, 'bundle_bytes': 16 * 1024 * 1024,
                'projection_items': 10, 'projection_bytes': 64 * 1024 * 1024,
                'keycheck_items': 10, 'keycheck_bytes': 1024 * 1024,
                'quarantine_items': 10, 'quarantine_bytes': 16 * 1024 * 1024,
            }
            claims = [
                source_db.reserve_and_claim_target(
                    'github', 'github', identity, 'integration-supervisor',
                    1024 * 1024, 2 * 1024 * 1024, 1, 1024,
                    run_id=run_id, cycle_id=cycle_id, capacity_limits=limits,
                    reservation_token=f'cleanup-{name}',
                    bundle_id=(char * 32), scan_event_id=(event_char * 32),
                )
                for name, char, event_char in (('a', 'a', 'c'), ('b', 'b', 'd'))
            ]
            from result_bundle import bundle_partial_path, ensure_bundle_reservation_paths

            ensure_bundle_reservation_paths(str(self.bundle_root), claims[0])
            partial_a = bundle_partial_path(
                str(self.bundle_root), claims[0]['bundle_id'], claims[0]['reservation_token'],
            )
            Path(partial_a).write_bytes(b'locked-partial')
            harden_private_file(partial_a)
            ensure_bundle_reservation_paths(str(self.bundle_root), claims[1])
            staged_b = stage_result_bundle(
                {
                    'scan_event_id': claims[1]['scan_event_id'], 'target': claims[1]['target'],
                    'scan_type': 'github', 'timestamp': '2026-07-27T00:00:00+00:00',
                    'findings': [], 'errors': [],
                },
                claims[1], str(self.bundle_root), {}, {'queue_status': 'done'},
                candidate_max_items=1, candidate_max_bytes=1024,
            )
            self.assertTrue(source_db.mark_result_bundle_ready(
                claims[1]['reservation_id'], {
                    'bundle_id': staged_b.bundle_id, 'scan_event_id': staged_b.scan_event_id,
                    'scan_event_hash': staged_b.scan_event_hash,
                    'relative_path': staged_b.relative_path, 'actual_bytes': staged_b.actual_bytes,
                    'frame_count': staged_b.frame_count, 'finding_count': staged_b.finding_count,
                    'error_count': staged_b.error_count, 'candidate_count': staged_b.candidate_count,
                },
            ))
            real_unlink = result_ingester.durable_unlink

            def sharing_violation(path):
                if os.path.normcase(os.path.abspath(path)) == os.path.normcase(os.path.abspath(partial_a)):
                    raise OSError('persistent sharing violation')
                return real_unlink(path)

            with mock.patch.object(
                result_ingester, 'exact_process_identity_state', return_value='dead',
            ), mock.patch.object(
                result_ingester, 'durable_unlink', side_effect=sharing_violation,
            ):
                ingester.recover()
                self.assertTrue(ingester.process_one())
            states = source_db.conn.execute(
                '''SELECT id, state, cleanup_attempts FROM result_reservations ORDER BY id'''
            ).fetchall()
            source_db.conn.commit()
            self.assertEqual(states[0]['state'], 'scanning')
            self.assertGreaterEqual(states[0]['cleanup_attempts'], 1)
            self.assertEqual(states[1]['state'], 'acknowledged')
            self.assertEqual(source_db.pipeline_capacity_snapshot()['bundle_items'], 1)
            source_db.conn.execute(
                '''UPDATE result_reservations SET cleanup_available_after = ? WHERE id = ?''',
                ('2000-01-01T00:00:00+00:00', claims[0]['reservation_id']),
            )
            source_db.conn.commit()
            with mock.patch.object(
                result_ingester, 'exact_process_identity_state', return_value='dead',
            ):
                ingester.recover()
            final_a = source_db.conn.execute(
                'SELECT state FROM result_reservations WHERE id = ?',
                (claims[0]['reservation_id'],),
            ).fetchone()
            source_db.conn.commit()
            self.assertEqual(final_a['state'], 'refunded')
            self.assertEqual(source_db.pipeline_capacity_snapshot()['bundle_items'], 0)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            source_db.close()
            ingester_db.close()

    def test_recheck_keyset_cursor_reaches_credentials_after_first_thousand(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            now = '2026-07-27T00:00:00+00:00'
            db.conn.execute(
                '''INSERT INTO keycheck_credentials(
                       service, credential_hash, provider_key_hash, candidate_kind,
                       secret_text, created_at, updated_at
                   ) SELECT 'openai', lpad(to_hex(value), 64, '0'),
                            lpad(to_hex(value), 64, '0'), 'provider_key',
                            'sk-' || value::text, ?, ?
                     FROM generate_series(1, 1505) AS value''',
                (now, now),
            )
            db.conn.execute(
                '''INSERT INTO keycheck_results(
                       service, status, status_group, checked_at, key_hash, secret_hash,
                       key_masked, credential_id, source, query, target, detector_name,
                       found_at, finding_uid, result_source, created_at
                    ) SELECT 'openai', 'DEAD', 'dead', ?, c.provider_key_hash,
                             c.provider_key_hash, '***', c.id, 'package_git', 'fixture-query',
                             'https://example.invalid/repo', 'OpenAI', ?,
                             'fixture-finding-' || c.id::text, 'api_check', ?
                      FROM keycheck_credentials c WHERE c.service = 'openai' ORDER BY c.id''',
                (now, now, now),
            )
            db.conn.execute(
                '''INSERT INTO keycheck_current_state(
                       credential_id, service, status, status_group, last_result_id,
                       result_source, checked_at, state_version, updated_at
                   ) SELECT c.id, c.service, 'DEAD', 'dead', r.id,
                            'api_check', ?, 1, ?
                     FROM keycheck_credentials c
                     JOIN keycheck_results r ON r.credential_id = c.id
                     WHERE c.service = 'openai' ''',
                (now, now),
            )
            db.conn.commit()
            first = db.enqueue_keycheck_rechecks('openai', {'dead'}, max_items=1000)
            second = db.enqueue_keycheck_rechecks('openai', {'dead'}, max_items=1000)
            count = db.conn.execute(
                "SELECT COUNT(*) AS count FROM keycheck_candidates WHERE service = 'openai'"
            ).fetchone()
            cursor = db.conn.execute(
                "SELECT last_credential_id FROM keycheck_recheck_cursors WHERE service = 'openai'"
            ).fetchone()
            candidate = db.conn.execute(
                '''SELECT source, query, target, detector_name, found_at, finding_uid,
                          metadata_json
                      FROM keycheck_candidates WHERE service = 'openai' ORDER BY id LIMIT 1'''
            ).fetchone()
            db.conn.commit()
            self.assertEqual((first, second, count['count']), (1000, 505, 1505))
            self.assertGreaterEqual(cursor['last_credential_id'], 1505)
            self.assertEqual(candidate['source'], 'package_git')
            self.assertEqual(candidate['query'], 'fixture-query')
            self.assertEqual(candidate['target'], 'https://example.invalid/repo')
            self.assertEqual(candidate['detector_name'], 'OpenAI')
            self.assertEqual(candidate['found_at'], now)
            self.assertTrue(candidate['finding_uid'].startswith('fixture-finding-'))
            self.assertEqual(json.loads(candidate['metadata_json'])['provider_hint'], 'openai')
        finally:
            db.close()

    def test_resolver_completion_reassigns_to_canonical_provider_atomically(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            now = '2026-08-16T00:00:00+00:00'
            key = 'sk-' + ('r' * 32)
            provider_key_hash = hashlib.sha256(key.encode('utf-8')).hexdigest()
            resolver_hash = hashlib.sha256(
                f'truf-credential-v2|provider_resolver|{key}'.encode('utf-8')
            ).hexdigest()
            zai_hash = hashlib.sha256(
                f'truf-credential-v2|zai|{key}'.encode('utf-8')
            ).hexdigest()
            resolver_credential_id = db.conn.insert_returning_id(
                '''INSERT INTO keycheck_credentials(
                       service, credential_hash, provider_key_hash, candidate_kind,
                       secret_text, key_masked, metadata_json, created_at, updated_at
                   ) VALUES ('provider_resolver', ?, ?, 'provider_key', ?, 'sk-****', '{}', ?, ?)''',
                (resolver_hash, provider_key_hash, key, now, now),
            )
            candidate_id = db.conn.insert_returning_id(
                '''INSERT INTO keycheck_candidates(
                       candidate_uid, credential_id, service, routed_service,
                       secret_hash, detector_name,
                       state, capacity_bytes, created_at, updated_at
                    ) VALUES (?, ?, 'provider_resolver', 'provider_resolver', ?,
                              'DeepSeek', 'pending', 1024, ?, ?)''',
                ('9' * 64, resolver_credential_id, provider_key_hash, now, now),
            )
            db.conn.execute(
                '''UPDATE pipeline_capacity SET keycheck_items = keycheck_items + 1,
                          keycheck_bytes = keycheck_bytes + 1024 WHERE id = 1'''
            )
            db.conn.commit()

            candidate = db.claim_keycheck_candidate('provider_resolver', 'resolver-test')
            metadata = {
                'resolved_provider': 'zai',
                'provider_resolution': 'matched',
                'authenticated': True,
                'provider_resolution_attempts': [
                    {'provider': 'deepseek', 'outcome': 'no_match', 'status': 'DEAD'},
                    {'provider': 'zai', 'outcome': 'match', 'status': 'VALID'},
                ],
            }
            self.assertIsNone(db.complete_keycheck_candidate(
                candidate_id, 'wrong-fence', 'a' * 64, 'VALID', 'alive',
                metadata=metadata, resolved_service='zai',
            ))
            counts = db.conn.execute(
                '''SELECT
                       (SELECT COUNT(*) FROM keycheck_credentials WHERE service = 'zai') AS credentials,
                       (SELECT COUNT(*) FROM keycheck_results) AS results'''
            ).fetchone()
            db.conn.commit()
            self.assertEqual((counts['credentials'], counts['results']), (0, 0))

            zai_credential_id = db.conn.insert_returning_id(
                '''INSERT INTO keycheck_credentials(
                       service, credential_hash, provider_key_hash, candidate_kind,
                       secret_text, key_masked, metadata_json, created_at, updated_at
                   ) VALUES ('zai', ?, ?, 'provider_key', ?, 'sk-****', '{}', ?, ?)''',
                (zai_hash, provider_key_hash, key, now, now),
            )
            db.conn.commit()
            completed = db.complete_keycheck_candidate(
                candidate_id, candidate['lease_token'], 'b' * 64,
                'VALID', 'alive', message='authenticated models=9',
                metadata=metadata, result_source='provider_resolution',
                resolved_service='zai',
            )
            self.assertTrue(completed['completed'])

            row = db.conn.execute(
                '''SELECT c.state, c.service AS candidate_service, c.routed_service,
                          c.credential_id,
                          kc.service AS credential_service, r.service AS result_service,
                          r.credential_id AS result_credential_id, s.service AS state_service,
                          r.result_source
                     FROM keycheck_candidates c
                     JOIN keycheck_credentials kc ON kc.id = c.credential_id
                     JOIN keycheck_results r ON r.id = c.keycheck_result_id
                     JOIN keycheck_current_state s ON s.credential_id = c.credential_id
                    WHERE c.id = ?''',
                (candidate_id,),
            ).fetchone()
            credential_count = db.conn.execute(
                "SELECT COUNT(*) AS count FROM keycheck_credentials WHERE service = 'zai'"
            ).fetchone()
            stream = db.conn.execute(
                "SELECT stream_name FROM projection_streams WHERE stream_name = 'keycheck:zai:results'"
            ).fetchone()
            db.conn.commit()
            self.assertEqual(row['state'], 'completed')
            self.assertEqual(row['candidate_service'], 'zai')
            self.assertEqual(row['routed_service'], 'provider_resolver')
            self.assertEqual(row['credential_service'], 'zai')
            self.assertEqual(row['result_service'], 'zai')
            self.assertEqual(row['state_service'], 'zai')
            self.assertEqual(row['credential_id'], zai_credential_id)
            self.assertEqual(row['result_credential_id'], zai_credential_id)
            self.assertEqual(row['result_source'], 'provider_resolution')
            self.assertEqual(credential_count['count'], 1)
            self.assertIsNotNone(stream)

            replay = db.complete_keycheck_candidate(
                candidate_id, candidate['lease_token'], 'b' * 64,
                'VALID', 'alive', message='authenticated models=9',
                metadata=metadata, result_source='provider_resolution',
                resolved_service='zai',
            )
            self.assertTrue(replay['duplicate'])
        finally:
            db.close()

    def test_dense_keycheck_input_has_separate_result_projection_capacity(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            now = '2026-07-27T00:00:00+00:00'
            db.conn.execute(
                '''INSERT INTO keycheck_credentials(
                       service, credential_hash, provider_key_hash, candidate_kind,
                       secret_text, key_masked, created_at, updated_at
                   ) SELECT 'xai', lpad(to_hex(value), 64, '0'),
                            lpad(to_hex(value), 64, '0'), 'provider_key',
                            'xai-' || value::text, '***', ?, ?
                     FROM generate_series(1, 2000) AS value''',
                (now, now),
            )
            db.conn.execute(
                '''INSERT INTO keycheck_candidates(
                       candidate_uid, credential_id, service, secret_hash, detector_name,
                       state, capacity_bytes, created_at, updated_at
                   ) SELECT lpad(to_hex(c.id + 10000), 64, '0'), c.id, 'xai',
                            c.provider_key_hash, 'XAI', 'pending', 1024, ?, ?
                     FROM keycheck_credentials c WHERE c.service = 'xai' ''',
                (now, now),
            )
            db.conn.execute(
                '''UPDATE pipeline_capacity SET keycheck_items = 2000,
                          keycheck_bytes = 2048000,
                          projection_items = 10000,
                          quarantine_items = 9999,
                          quarantine_bytes = 1073741823 WHERE id = 1'''
            )
            db.conn.commit()
            blocked = db.claim_keycheck_candidate(
                'xai', 'capacity-blocked', result_projection_reserve_bytes=3145728,
                projection_max_items=10000, projection_max_bytes=2147483648,
            )
            self.assertTrue(blocked['_capacity_blocked'])
            pending = db.conn.execute(
                "SELECT COUNT(*) AS count FROM keycheck_candidates WHERE state = 'pending'"
            ).fetchone()
            db.conn.execute('UPDATE pipeline_capacity SET projection_items = 0 WHERE id = 1')
            db.conn.commit()
            self.assertEqual(pending['count'], 2000)
            poison = db.claim_keycheck_candidate(
                'xai', 'provider-one', result_projection_reserve_bytes=3145728,
                projection_max_items=10000,
                projection_max_bytes=2147483648,
            )
            self.assertEqual(poison['capacity_bytes'], 1024)
            self.assertEqual(poison['result_projection_reserved_bytes'], 3145728)
            self.assertTrue(db.quarantine_keycheck_candidate(
                poison['id'], poison['lease_token'], 'fixture_poison', 'deterministic fixture',
            ))
            saturated = db.pipeline_capacity_snapshot()
            self.assertGreater(saturated['quarantine_items'], 10000)
            self.assertGreater(saturated['quarantine_bytes'], 1073741824)
            healthy = db.claim_keycheck_candidate(
                'xai', 'provider-two', result_projection_reserve_bytes=3145728,
                projection_max_items=10000,
                projection_max_bytes=2147483648,
            )
            metadata = {
                'models': [
                    {
                        'id': f'grok-model-{index}',
                        'context_window': 131072,
                        'capabilities': ['chat', 'tools', 'vision'],
                    }
                    for index in range(20)
                ],
                'probe': {'accepted': True, 'route': '/v1/models'},
            }
            completed = db.complete_keycheck_candidate(
                healthy['id'], healthy['lease_token'], 'e' * 64,
                'ALIVE', 'alive', message='20 model payload accepted', metadata=metadata,
            )
            self.assertTrue(completed['completed'])
            candidate = db.conn.execute(
                '''SELECT capacity_bytes, result_projection_reserved_bytes,
                          result_projection_credit_transferred, state
                   FROM keycheck_candidates WHERE id = ?''',
                (healthy['id'],),
            ).fetchone()
            job = db.conn.execute(
                'SELECT capacity_bytes, status FROM projection_jobs WHERE id = ?',
                (completed['projection_job_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(candidate['capacity_bytes'], 1024)
            self.assertEqual(candidate['result_projection_reserved_bytes'], 3145728)
            self.assertTrue(candidate['result_projection_credit_transferred'])
            self.assertEqual(candidate['state'], 'completed')
            self.assertGreater(job['capacity_bytes'], 1024)
            self.assertLessEqual(job['capacity_bytes'], 3145728)
        finally:
            db.close()

    def test_offline_review_retries_keycheck_candidate_with_exact_capacity(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            now = '2026-07-27T00:00:00+00:00'
            credential_id = db.conn.insert_returning_id(
                '''INSERT INTO keycheck_credentials(
                       service, credential_hash, provider_key_hash, candidate_kind,
                       secret_text, key_masked, created_at, updated_at
                   ) VALUES ('xai', ?, ?, 'provider_key', 'xai-fixture', '***', ?, ?)''',
                ('1' * 64, '2' * 64, now, now),
            )
            candidate_id = db.conn.insert_returning_id(
                '''INSERT INTO keycheck_candidates(
                       candidate_uid, credential_id, service, secret_hash, detector_name,
                       state, capacity_bytes, created_at, updated_at
                   ) VALUES (?, ?, 'xai', ?, 'XAI', 'pending', 1024, ?, ?)''',
                ('3' * 64, credential_id, '4' * 64, now, now),
            )
            db.conn.execute(
                '''UPDATE pipeline_capacity SET keycheck_items = 1,
                           keycheck_bytes = 1024 WHERE id = 1'''
            )
            db.conn.commit()
            claimed = db.claim_keycheck_candidate(
                'xai', 'retry-fixture', result_projection_reserve_bytes=3145728,
                projection_max_items=10, projection_max_bytes=64 * 1024 * 1024,
            )
            self.assertEqual(claimed['id'], candidate_id)
            self.assertTrue(db.quarantine_keycheck_candidate(
                candidate_id, claimed['lease_token'],
                'provider_candidate_unconsumed', 'fixture unconsumed candidate',
            ))
            quarantine = db.conn.execute(
                '''SELECT * FROM pipeline_quarantine
                   WHERE keycheck_candidate_id = ? AND review_status = 'pending' ''',
                (candidate_id,),
            ).fetchone()
            db.conn.commit()
            manifest = self.root / 'keycheck-retry-review.json'
            atomic_write_private_json(str(manifest), {
                'type': 'truf-pipeline-quarantine-review-v1',
                'entries': [{
                    'id': quarantine['id'],
                    'reason_code': quarantine['reason_code'],
                    'payload_sha256': quarantine['payload_sha256'],
                    'action': 'retry',
                }],
            })
            review_pipeline_quarantine_manifest(
                db, str(manifest), max_rows=1,
                config={'global': {
                    'results_dir': str(self.results),
                    'result_bundle_dir': str(self.bundle_root),
                }},
            )
            candidate = db.conn.execute(
                '''SELECT state, attempts, capacity_released,
                          result_projection_credit_transferred,
                          result_projection_reserved_bytes
                   FROM keycheck_candidates WHERE id = ?''',
                (candidate_id,),
            ).fetchone()
            review = db.conn.execute(
                'SELECT review_status FROM pipeline_quarantine WHERE id = ?',
                (quarantine['id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(candidate['state'], 'pending')
            self.assertEqual(candidate['attempts'], 0)
            self.assertFalse(candidate['capacity_released'])
            self.assertFalse(candidate['result_projection_credit_transferred'])
            self.assertEqual(candidate['result_projection_reserved_bytes'], 0)
            self.assertEqual(review['review_status'], 'approved_retry')
            capacity = db.pipeline_capacity_snapshot()
            self.assertEqual(capacity['keycheck_items'], 1)
            self.assertEqual(capacity['keycheck_bytes'], 1024)
            self.assertEqual(capacity['projection_items'], 0)
            self.assertEqual(capacity['projection_bytes'], 0)
            self.assertEqual(capacity['quarantine_items'], 0)
            self.assertEqual(capacity['quarantine_bytes'], 0)
        finally:
            db.close()

    def test_v2_backlog_exists_branches_avoid_historical_primary_key_scan(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.conn.execute(
                '''CREATE UNLOGGED TABLE target_queue_plan_fixture (
                       id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
                       source TEXT NOT NULL, platform TEXT NOT NULL, status TEXT NOT NULL,
                       current_result_reservation_id BIGINT, available_after TEXT,
                       attempts INTEGER NOT NULL DEFAULT 0, resolver_state TEXT
                   )'''
            )
            db.conn.execute(
                '''CREATE INDEX fixture_pending ON target_queue_plan_fixture(source, platform, id)
                   WHERE status = 'pending' AND current_result_reservation_id IS NULL
                     AND (resolver_state IS NULL OR resolver_state = 'resolved')'''
            )
            db.conn.execute(
                '''CREATE INDEX fixture_deferred ON target_queue_plan_fixture(
                       source, platform, available_after, id
                   ) WHERE status = 'deferred' AND current_result_reservation_id IS NULL
                     AND (resolver_state IS NULL OR resolver_state = 'resolved')'''
            )
            db.conn.execute(
                '''INSERT INTO target_queue_plan_fixture(source, platform, status)
                   SELECT 'history', 'github', 'done' FROM generate_series(1, 1000000)'''
            )
            db.conn.execute(
                '''INSERT INTO target_queue_plan_fixture(
                       source, platform, status, available_after, resolver_state
                   ) VALUES ('fixture','github','pending',NULL,'resolved'),
                            ('fixture','github','deferred','2020-01-01T00:00:00+00:00','resolved')'''
            )
            db.conn.execute('ANALYZE target_queue_plan_fixture')
            plan_rows = db.conn.execute(
                'EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) '
                + HAS_CLAIMABLE_TARGETS_V2_SQL.replace(
                    'target_queue.id', 'target_queue_plan_fixture.id',
                ).replace('FROM target_queue', 'FROM target_queue_plan_fixture'),
                (
                    'fixture', 'github', '2026-07-27T00:00:00+00:00', 3, 3,
                    'fixture', 'github', '2026-07-27T00:00:00+00:00', 3, 3,
                ),
            ).fetchall()
            db.conn.commit()
            plan = '\n'.join(str(row['QUERY PLAN']) for row in plan_rows)
            self.assertIn('fixture_pending', plan)
            self.assertIn('fixture_deferred', plan)
            self.assertNotIn('target_queue_plan_fixture_pkey', plan)
            self.assertNotIn('Seq Scan on target_queue_plan_fixture', plan)
        finally:
            db.close()

    def test_repeated_different_projection_tails_recover_and_cleanup_physically(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        projector = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            run_id = db.start_run('integration', selected_source='github')
            cycle_id = db.start_source_cycle(run_id, 'github', 'github', 'integration', 'fixture')

            def add_scan(target, event_id, event_hash):
                target_scan_id = db.record_target_result(
                    run_id, cycle_id, 'github', 'fixture', target,
                    {
                        'target': target, 'scan_type': 'github',
                        'timestamp': '2026-07-27T00:00:00+00:00',
                        'findings': [], 'errors': [],
                    },
                )
                backfill_normalized_raw_results(db, max_rows=1, max_bytes=1024 * 1024)
                db.conn.execute(
                    '''UPDATE pipeline_capacity SET projection_items = projection_items + 1,
                              projection_bytes = projection_bytes + ? WHERE id = 1''',
                    (4 * 1024 * 1024,),
                )
                job_id = db.conn.insert_returning_id(
                    '''INSERT INTO projection_jobs(
                           job_kind, event_id, event_hash, target_scan_id, status,
                           required_stream_mask, capacity_items, capacity_bytes,
                           created_at, updated_at
                       ) VALUES ('scan_event', ?, ?, ?, 'pending', 1, 1, ?, ?, ?)''',
                    (
                        event_id, event_hash, target_scan_id, 4 * 1024 * 1024,
                        '2026-07-27T00:00:00+00:00', '2026-07-27T00:00:00+00:00',
                    ),
                )
                db.conn.commit()
                return job_id

            first_job = add_scan('https://example.invalid/tail-one', 'a' * 64, 'b' * 64)
            second_job = add_scan('https://example.invalid/tail-two', 'c' * 64, 'd' * 64)
            projector = JsonlProjector(
                db, str(self.results), 'integration-supervisor', lease_seconds=300,
                keycheck_dir=str(self.keychecks),
                quarantine_max_items=100, quarantine_max_bytes=16 * 1024 * 1024,
            ).start()
            claimed = db.claim_projection_job(
                projector.lease['generation'], projector.lease['lease_token'], 300,
            )
            self.assertEqual(claimed['id'], first_job)
            streams = projector._serialize(claimed)
            serialized = streams[0]
            state = db.projection_stream_state('scan_results')
            append = db.prepare_projection_append(
                claimed['id'], claimed['lease_token'], 'scan_results', state['generation'],
                serialized.byte_length, serialized.payload_sha256, serialized.record_count,
            )
            active = projector._results_path(state['base_relative_path'], 'scan_results')
            projector._create_private_empty(active)
            quarantine_baseline_items = 99
            quarantine_baseline_bytes = 16 * 1024 * 1024 - 1
            db.conn.execute(
                'UPDATE pipeline_capacity SET quarantine_items = ?, quarantine_bytes = ? WHERE id = 1',
                (quarantine_baseline_items, quarantine_baseline_bytes),
            )
            db.conn.commit()

            def fail_after_recovery(stage, _value):
                if stage == 'after_tail_recovery':
                    raise RuntimeError('injected repeated tail recovery crash')

            projector.fault = fail_after_recovery
            for partial in (b'first-partial', b'second-different-partial'):
                with open(active, 'ab', buffering=0) as handle:
                    handle.write(partial)
                    handle.flush()
                    os.fsync(handle.fileno())
                with self.assertRaisesRegex(RuntimeError, 'repeated tail recovery crash'):
                    projector._append_stream(claimed, serialized)
                self.assertEqual(os.path.getsize(active), int(append['byte_offset']))

            projector.fault = None
            projector._append_stream(claimed, serialized)
            self.assertTrue(db.complete_projection_job(claimed['id'], claimed['lease_token']))
            projector.reconcile_terminal_temps()
            self.assertFalse(os.path.exists(serialized.path))
            tail_rows = db.conn.execute(
                '''SELECT q.id, q.reason_code, q.payload_sha256, q.source_relative_path
                   FROM pipeline_quarantine q
                   WHERE q.object_type = 'projection_tail' ORDER BY q.id'''
            ).fetchall()
            db.conn.commit()
            self.assertEqual(len(tail_rows), 2)
            self.assertEqual(len({row['source_relative_path'] for row in tail_rows}), 2)
            saturated = db.pipeline_capacity_snapshot()
            self.assertGreater(saturated['quarantine_items'], 100)
            self.assertGreater(saturated['quarantine_bytes'], 16 * 1024 * 1024)

            self.assertTrue(projector.process_one())
            second_state = db.conn.execute(
                'SELECT status FROM projection_jobs WHERE id = ?', (second_job,),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(second_state['status'], 'completed')

            manifest_path = self.root / 'quarantine-review.json'
            atomic_write_private_json(str(manifest_path), {
                'type': 'truf-pipeline-quarantine-review-v1',
                'entries': [
                    {
                        'id': row['id'], 'reason_code': row['reason_code'],
                        'payload_sha256': row['payload_sha256'], 'action': 'discard',
                    }
                    for row in tail_rows
                ],
            })
            review_pipeline_quarantine_manifest(
                db, str(manifest_path), max_rows=10,
                config={'global': {
                    'results_dir': str(self.results),
                    'result_bundle_dir': str(self.bundle_root),
                }},
            )
            for row in tail_rows:
                self.assertFalse((self.results / Path(row['source_relative_path'])).exists())
            capacity = db.pipeline_capacity_snapshot()
            self.assertEqual(capacity['quarantine_items'], quarantine_baseline_items)
            self.assertEqual(capacity['quarantine_bytes'], quarantine_baseline_bytes)
        finally:
            if projector is not None and projector.lease is not None:
                projector.stop()
            db.close()

    def test_worker_observability_persistence_is_idempotent_and_non_renewing(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            ingester = ResultIngester(
                db, str(self.bundle_root), 'observability-supervisor',
                lease_seconds=300,
            ).start()
            target = 'https://github.com/example/worker-observability.git'
            self.assertEqual(
                db.enqueue_targets('github', 'github', 'observability', [target]),
                1,
            )
            token_sha256 = hashlib.sha256(b'worker-observability-token').hexdigest()
            device = db.provision_remote_worker_device(
                'observability-user', 'observability-device', token_sha256, 1,
            )
            effective, snapshot = self._remote_execution_snapshot()
            claim = db.reserve_and_claim_target(
                'github', 'github', current_process_identity(),
                'observability-supervisor', 1024 * 1024, 1024 * 1024,
                0, 0, lease_seconds=300, max_attempts=3,
                capacity_limits={
                    'bundle_items': 1, 'bundle_bytes': 1024 * 1024,
                    'projection_items': 1, 'projection_bytes': 1024 * 1024,
                    'keycheck_items': 1, 'keycheck_bytes': 1024 * 1024,
                    'quarantine_items': 1, 'quarantine_bytes': 1024 * 1024,
                },
                reservation_token=hashlib.sha256(b'observability-reservation').hexdigest(),
                bundle_id=hashlib.sha256(b'observability-bundle').hexdigest(),
                scan_event_id=hashlib.sha256(b'observability-scan').hexdigest(),
                claim_order='oldest', final_cutover=True,
                remote_assignment={
                    'user_id': device['user_id'],
                    'device_id': device['device_id'],
                    'effective_config_sha256': effective,
                    'client_compat_sha256': hashlib.sha256(
                        b'observability-client'
                    ).hexdigest(),
                    'token_sha256': token_sha256,
                    'result_upload_body_timeout_seconds': 1800,
                    'execution_snapshot': snapshot,
                },
            )
            before = dict(db.conn.execute(
                '''SELECT r.remote_expires_at,
                          r.remote_result_upload_body_timeout_seconds,
                          r.producer_lease_expires_at,
                          q.lease_expires_at
                     FROM result_reservations r
                     JOIN target_queue q ON q.id = r.queue_id
                    WHERE r.id = ?''',
                (claim['reservation_id'],),
            ).fetchone())
            db.conn.commit()
            self.assertEqual(
                before['remote_result_upload_body_timeout_seconds'], 1800,
            )
            legacy_status = db.remote_assignment_status(
                claim['reservation_id'], device['device_id'], token_sha256,
            )
            self.assertFalse(legacy_status['latest_progress']['available'])
            self.assertFalse(legacy_status['diagnostics']['available'])
            self.assertIsNone(legacy_status['deadlines']['scan_deadline_at'])
            authority_now = datetime.now(timezone.utc)
            issued_for_metrics = authority_now - timedelta(seconds=70)
            base = authority_now - timedelta(seconds=60)
            timestamp = base.isoformat(timespec='milliseconds').replace(
                '+00:00', 'Z',
            )
            phase_started = issued_for_metrics.isoformat(
                timespec='milliseconds',
            ).replace('+00:00', 'Z')
            scan_deadline = (
                authority_now + timedelta(seconds=120)
            ).isoformat(timespec='milliseconds').replace('+00:00', 'Z')
            db.conn.execute(
                'UPDATE result_reservations SET remote_issued_at = ? WHERE id = ?',
                (issued_for_metrics.isoformat(), claim['reservation_id']),
            )
            db.conn.commit()
            event = json.loads(worker_contracts.encode_worker_event(
                worker_contracts.WorkerEvent(
                    schema=worker_contracts.WORKER_EVENT_SCHEMA,
                    sequence=7,
                    timestamp=timestamp,
                    instance_id='observability-instance',
                    slot_id=0,
                    reservation_id=claim['reservation_id'],
                    source='github',
                    type=worker_contracts.WORKER_EVENT_TYPE,
                    phase=worker_contracts.WorkerPhase.PREPARING,
                    phase_started_at=phase_started,
                    scan_deadline_at=scan_deadline,
                    assignment_deadline_at=claim['remote_expires_at'].replace(
                        '+00:00', 'Z'
                    ),
                    progress={},
                )
            ).decode('ascii'))
            persisted = db.record_worker_progress_event(
                claim['reservation_id'], device['device_id'], event,
            )
            replay = db.record_worker_progress_event(
                claim['reservation_id'], device['device_id'], event,
            )
            self.assertFalse(persisted['replayed'])
            self.assertTrue(replay['replayed'])
            gap = dict(event, sequence=9)
            accepted_gap = db.record_worker_progress_event(
                claim['reservation_id'], device['device_id'], gap,
            )
            self.assertEqual(accepted_gap['sequence'], 9)
            status = db.remote_assignment_status(
                claim['reservation_id'], device['device_id'], token_sha256,
            )
            self.assertEqual(status['latest_progress']['event']['sequence'], 9)
            self.assertEqual(status['latest_progress']['event']['phase'], 'preparing')
            self.assertTrue(status['deadlines']['immutable'])
            self.assertEqual(
                status['deadlines']['result_upload_body_timeout_seconds'], 1800,
            )
            self.assertEqual(
                status['deadlines']['result_upload_body_timeout_availability'],
                'persisted',
            )
            self.assertEqual(
                status['deadlines']['assignment_deadline_at'],
                claim['remote_expires_at'],
            )
            self.assertEqual(
                status['deadlines']['scan_deadline_at'], scan_deadline,
            )
            after = dict(db.conn.execute(
                '''SELECT r.remote_expires_at,
                          r.remote_result_upload_body_timeout_seconds,
                          r.producer_lease_expires_at,
                          q.lease_expires_at
                     FROM result_reservations r
                     JOIN target_queue q ON q.id = r.queue_id
                    WHERE r.id = ?''',
                (claim['reservation_id'],),
            ).fetchone())
            db.conn.commit()
            self.assertEqual(after, before)

            target_scan_id = db.conn.insert_returning_id(
                '''INSERT INTO target_scans(
                       scan_event_id, result_reservation_id, source, target,
                       status, started_at, ended_at, created_at
                   ) VALUES (?, ?, 'github', ?, 'error', ?, ?, ?)''',
                (
                    claim['scan_event_id'], claim['reservation_id'], target,
                    timestamp, timestamp, timestamp,
                ),
            )
            db.conn.commit()
            envelope = worker_contracts.build_diagnostic_envelope(
                occurrence_id='observability-occurrence',
                reservation_id=claim['reservation_id'],
                scan_event_id=claim['scan_event_id'],
                slot_id=0,
                source='github',
                phase=worker_contracts.WorkerPhase.SCANNING,
                kind=worker_contracts.DiagnosticKind.ASSIGNMENT,
                category=worker_contracts.DiagnosticCategory.INTERNAL,
                code='worker.observability_fixture',
                summary='integration diagnostic',
                retryable=False,
                attempt=1,
                assignment_outcome=worker_contracts.AssignmentOutcome.ACCEPTED,
                scan_outcome=worker_contracts.ScanOutcome.ERROR,
                occurred_at=timestamp,
                captured_at=timestamp,
            )
            diagnostic = json.loads(
                worker_contracts.encode_diagnostic_envelope(envelope).decode('ascii')
            )
            inserted = db.record_worker_diagnostic(
                claim['reservation_id'], diagnostic, target_scan_id,
            )
            diagnostic_replay = db.record_worker_diagnostic(
                claim['reservation_id'], diagnostic, target_scan_id,
            )
            self.assertFalse(inserted['replayed'])
            self.assertTrue(diagnostic_replay['replayed'])
            progress_rows = db.worker_progress_events(claim['reservation_id'])
            diagnostic_rows = db.worker_diagnostics(claim['reservation_id'])
            self.assertEqual(progress_rows[0]['target_scan_id'], target_scan_id)
            self.assertEqual(progress_rows[0]['queue_status'], 'in_progress')
            self.assertEqual(diagnostic_rows[0]['target_scan_id'], target_scan_id)
            self.assertEqual(diagnostic_rows[0]['scan_status'], 'error')
            status = db.remote_assignment_status(
                claim['reservation_id'], device['device_id'], token_sha256,
            )
            self.assertEqual(status['diagnostics'], {
                'available': True, 'count': 1,
                'projection_version': None,
                'ordered_uid_set_sha256': None,
            })
            admin_snapshot = db.admin_remote_worker_snapshot(
                limit=20, filters={'category': 'internal'},
            )
            assignment = next(
                row for row in admin_snapshot['assignments']
                if row['reservation_id'] == claim['reservation_id']
            )
            self.assertEqual(assignment['assignment_outcome'], 'unfinished')
            self.assertEqual(assignment['scan_outcome'], 'unavailable')
            self.assertEqual(assignment['diagnostic_count'], 1)
            self.assertEqual(assignment['active_phase'], 'preparing')
            self.assertEqual(assignment['slot_id'], 0)
            self.assertEqual(assignment['protocol_version'], '2')
            self.assertEqual(
                assignment['remote_result_upload_body_timeout_seconds'], 1800,
            )
            diagnostic_groups = db.admin_worker_diagnostic_groups(
                limit=20, filters={'category': 'internal'},
            )
            self.assertEqual(diagnostic_groups['groups'][0]['count'], 1)
            self.assertEqual(
                diagnostic_groups['groups'][0]['occurrences'][0]['reservation_id'],
                claim['reservation_id'],
            )
            detail = db.admin_worker_assignment_detail(
                claim['reservation_id'], event_limit=20, diagnostic_limit=20,
            )
            self.assertEqual(detail['assignment']['reservation_id'], claim['reservation_id'])
            self.assertEqual(detail['diagnostics']['availability'], 'current')
            self.assertEqual(detail['deadlines']['upload_timeout_seconds'], 1800)
            self.assertEqual(
                detail['diagnostics']['items'][0]['canonical_envelope_json'],
                worker_contracts.encode_diagnostic_envelope(envelope).decode('ascii'),
            )
            downloaded = db.admin_worker_diagnostic_envelope(
                claim['reservation_id'], diagnostic['diagnostic_uid'],
            )
            self.assertEqual(
                downloaded['canonical_json'],
                worker_contracts.encode_diagnostic_envelope(envelope).decode('ascii'),
            )

            transitions = (
                (10, 10, worker_contracts.WorkerPhase.SCANNING),
                (11, 11, worker_contracts.WorkerPhase.RESOLVING),
                (12, 12, worker_contracts.WorkerPhase.SCANNING),
                (13, 14, worker_contracts.WorkerPhase.RESOLVING),
                (14, 15, worker_contracts.WorkerPhase.SCANNING),
                (15, 18, worker_contracts.WorkerPhase.RESOLVING),
                (16, 19, worker_contracts.WorkerPhase.SCANNING),
                (17, 23, worker_contracts.WorkerPhase.RESOLVING),
                (18, 24, worker_contracts.WorkerPhase.SCANNING),
            )
            for sequence, seconds, phase in transitions:
                observed = (base + timedelta(seconds=seconds)).isoformat().replace(
                    '+00:00', 'Z',
                )
                next_event = dict(
                    event, sequence=sequence, timestamp=observed,
                    phase=phase.value, phase_started_at=observed,
                )
                db.record_worker_progress_event(
                    claim['reservation_id'], device['device_id'], next_event,
                )
            resolved_at = (base + timedelta(seconds=29)).isoformat().replace(
                '+00:00', 'Z',
            )
            db.conn.execute(
                '''UPDATE result_reservations
                      SET remote_resolution_kind = 'expired', remote_resolved_at = ?
                    WHERE id = ?''',
                (resolved_at, claim['reservation_id']),
            )
            db.conn.commit()
            completion_window = (base + timedelta(milliseconds=500)).isoformat()
            issued_at = db.conn.execute(
                'SELECT remote_issued_at FROM result_reservations WHERE id = ?',
                (claim['reservation_id'],),
            ).fetchone()['remote_issued_at']
            db.conn.commit()
            self.assertLess(
                datetime.fromisoformat(str(issued_at).replace('Z', '+00:00')),
                datetime.fromisoformat(completion_window),
            )
            metrics = db.admin_worker_duration_metrics(
                limit=20, filters={
                    'source': 'github', 'phase': 'scanning',
                    'since': completion_window,
                },
            )
            scanning = next(
                item for item in metrics['metrics']
                if item['phase'] == 'scanning' and item['outcome'] == 'expired'
            )
            self.assertEqual(scanning['sample_count'], 5)
            self.assertTrue(scanning['sufficient'])
            self.assertAlmostEqual(scanning['p50_seconds'], 3.0)
            self.assertAlmostEqual(scanning['p95_seconds'], 4.8)
            self.assertAlmostEqual(scanning['p99_seconds'], 4.96)
            preparing_metrics = db.admin_worker_duration_metrics(
                limit=20, filters={
                    'source': 'github', 'phase': 'preparing',
                    'since': completion_window,
                },
            )
            preparing = next(
                item for item in preparing_metrics['metrics']
                if item['phase'] == 'preparing' and item['outcome'] == 'expired'
            )
            self.assertEqual(preparing['sample_count'], 1)
            self.assertAlmostEqual(preparing['p50_seconds'], 20.0, delta=0.001)
            self.assertAlmostEqual(preparing['p95_seconds'], 20.0, delta=0.001)
            self.assertAlmostEqual(preparing['p99_seconds'], 20.0, delta=0.001)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            db.close()

    def test_remote_prebundle_and_expiry_diagnostics_settle_transactionally(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            ingester = ResultIngester(
                db, str(self.bundle_root), 'diagnostic-settlement-supervisor',
                lease_seconds=300,
            ).start()
            targets = [
                'https://github.com/example/prebundle-diagnostic.git',
                'https://github.com/example/expiry-diagnostic.git',
                'https://github.com/example/accepted-diagnostic.git',
            ]
            self.assertEqual(
                db.enqueue_targets('github', 'github', 'diagnostic-settlement', targets),
                3,
            )
            token_sha256 = hashlib.sha256(b'diagnostic-settlement-token').hexdigest()
            device = db.provision_remote_worker_device(
                'diagnostic-settlement-user', 'diagnostic-settlement-device',
                token_sha256, 3,
            )
            effective, snapshot = self._remote_execution_snapshot()

            def install_diagnostic_rejection():
                db.conn.execute('''CREATE OR REPLACE FUNCTION reject_worker_diagnostic()
                    RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN
                    RAISE EXCEPTION 'injected diagnostic rollback'; END $$''')
                db.conn.execute('''CREATE TRIGGER reject_worker_diagnostic_insert
                    BEFORE INSERT ON worker_diagnostics FOR EACH ROW
                    EXECUTE FUNCTION reject_worker_diagnostic()''')
                db.conn.commit()

            def remove_diagnostic_rejection():
                db.conn.execute(
                    'DROP TRIGGER IF EXISTS reject_worker_diagnostic_insert ON worker_diagnostics'
                )
                db.conn.execute('DROP FUNCTION IF EXISTS reject_worker_diagnostic()')
                db.conn.commit()

            def claim(label):
                return db.reserve_and_claim_target(
                    'github', 'github', current_process_identity(),
                    'diagnostic-settlement-supervisor', 4 * 1024 * 1024,
                    2 * 1024 * 1024,
                    0, 0, lease_seconds=300, max_attempts=3,
                    capacity_limits={
                        'bundle_items': 3, 'bundle_bytes': 12 * 1024 * 1024,
                        'projection_items': 3, 'projection_bytes': 6 * 1024 * 1024,
                        'keycheck_items': 3, 'keycheck_bytes': 3 * 1024 * 1024,
                        'quarantine_items': 3, 'quarantine_bytes': 3 * 1024 * 1024,
                    },
                    reservation_token=hashlib.sha256(
                        f'{label}:reservation'.encode('ascii')
                    ).hexdigest(),
                    bundle_id=hashlib.sha256(
                        f'{label}:bundle'.encode('ascii')
                    ).hexdigest(),
                    scan_event_id=hashlib.sha256(
                        f'{label}:scan'.encode('ascii')
                    ).hexdigest(),
                    claim_order='oldest', final_cutover=True,
                    reserved_bundle_bytes=2 * 1024 * 1024,
                    remote_max_active=50,
                    remote_assignment={
                        'user_id': device['user_id'],
                        'device_id': device['device_id'],
                        'effective_config_sha256': effective,
                        'client_compat_sha256': hashlib.sha256(
                            f'{label}:client'.encode('ascii')
                        ).hexdigest(),
                        'token_sha256': token_sha256,
                        'result_upload_body_timeout_seconds': 1800,
                        'execution_snapshot': snapshot,
                    },
                )

            prebundle = claim('prebundle')
            timestamp = '2026-09-24T00:00:00Z'
            envelope = worker_contracts.build_diagnostic_envelope(
                occurrence_id='prebundle-occurrence',
                reservation_id=prebundle['reservation_id'],
                scan_event_id=prebundle['scan_event_id'],
                slot_id=0,
                source='github',
                phase=worker_contracts.WorkerPhase.PREPARING,
                kind=worker_contracts.DiagnosticKind.ASSIGNMENT,
                category=worker_contracts.DiagnosticCategory.INTERNAL,
                code='worker.prebundle_fixture',
                summary='prebundle integration diagnostic',
                retryable=False,
                attempt=1,
                assignment_outcome=worker_contracts.AssignmentOutcome.PREBUNDLE_FAILED,
                scan_outcome=worker_contracts.ScanOutcome.UNAVAILABLE,
                occurred_at=timestamp,
                captured_at=timestamp,
            )
            diagnostic = json.loads(
                worker_contracts.encode_diagnostic_envelope(envelope).decode('ascii')
            )
            report = {
                'failure_code': 'client_process_failed',
                'detail': 'local worker execution failed',
                'diagnostics': [diagnostic],
            }
            install_diagnostic_rejection()
            with self.assertRaisesRegex(Exception, 'injected diagnostic rollback'):
                db.report_remote_prebundle_failure(
                    prebundle['reservation_id'], device['device_id'], token_sha256,
                    report,
                )
            rolled_back = db.conn.execute(
                '''SELECT r.state AS reservation_state,
                          r.remote_resolution_kind, q.status AS queue_status,
                          (SELECT COUNT(*) FROM worker_diagnostics d
                            WHERE d.reservation_id = r.id) AS diagnostic_count
                     FROM result_reservations r
                     JOIN target_queue q ON q.id = r.queue_id WHERE r.id = ?''',
                (prebundle['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    rolled_back['reservation_state'],
                    rolled_back['remote_resolution_kind'],
                    rolled_back['queue_status'],
                    rolled_back['diagnostic_count'],
                ),
                ('scanning', None, 'in_progress', 0),
            )
            remove_diagnostic_rejection()
            receipt = db.report_remote_prebundle_failure(
                prebundle['reservation_id'], device['device_id'], token_sha256,
                report,
            )
            self.assertEqual(receipt['resolution'], 'prebundle_report')
            self.assertEqual(receipt['diagnostics'], {
                'available': True, 'count': 1,
                'projection_version': None,
                'ordered_uid_set_sha256': None,
            })
            self.assertEqual(
                db.report_remote_prebundle_failure(
                    prebundle['reservation_id'], device['device_id'], token_sha256,
                    report,
                ),
                receipt,
            )
            legacy_receipt = {
                key: value for key, value in receipt.items()
                if key not in {
                    'deadlines', 'latest_progress', 'known_reason', 'diagnostics',
                }
            }
            legacy_receipt_json = json.dumps(
                legacy_receipt, ensure_ascii=True, sort_keys=True,
                separators=(',', ':'),
            )
            db.conn.execute(
                '''UPDATE result_reservations SET remote_resolution_json = ?
                   WHERE id = ?''',
                (legacy_receipt_json, prebundle['reservation_id']),
            )
            db.conn.commit()
            legacy_status = db.remote_assignment_status(
                prebundle['reservation_id'], device['device_id'], token_sha256,
            )
            self.assertEqual(
                {key: legacy_status[key] for key in legacy_receipt},
                legacy_receipt,
            )
            self.assertEqual(
                legacy_status['latest_progress'],
                {'available': False, 'event': None},
            )
            self.assertEqual(legacy_status['known_reason'], None)
            self.assertEqual(
                legacy_status['diagnostics'], {
                    'available': True, 'count': 1,
                    'projection_version': None,
                    'ordered_uid_set_sha256': None,
                },
            )
            durable_legacy = db.conn.execute(
                '''SELECT remote_resolution_json FROM result_reservations
                   WHERE id = ?''',
                (prebundle['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(durable_legacy['remote_resolution_json'], legacy_receipt_json)
            authority_before = dict(db.conn.execute(
                '''SELECT remote_expires_at, producer_lease_expires_at,
                          remote_receipt_id, remote_resolution_json
                     FROM result_reservations WHERE id = ?''',
                (prebundle['reservation_id'],),
            ).fetchone())
            late_timestamp = scanner_db.utc_now_iso().replace('+00:00', 'Z')
            late_event = json.loads(worker_contracts.encode_worker_event(
                worker_contracts.WorkerEvent(
                    schema=worker_contracts.WORKER_EVENT_SCHEMA,
                    sequence=100,
                    timestamp=late_timestamp,
                    instance_id='late-progress-instance',
                    slot_id=0,
                    reservation_id=prebundle['reservation_id'],
                    source='github',
                    type=worker_contracts.WORKER_EVENT_TYPE,
                    phase=worker_contracts.WorkerPhase.AWAITING_RECEIPT,
                    phase_started_at=late_timestamp,
                    scan_deadline_at=None,
                    assignment_deadline_at=prebundle['remote_expires_at'].replace(
                        '+00:00', 'Z'
                    ),
                    progress={'reason': 'terminal_report'},
                )
            ).decode('ascii'))
            accepted_late = db.record_remote_worker_progress_event(
                prebundle['reservation_id'], device['device_id'],
                token_sha256, late_event,
            )
            replayed_late = db.record_remote_worker_progress_event(
                prebundle['reservation_id'], device['device_id'],
                token_sha256, late_event,
            )
            authority_after = dict(db.conn.execute(
                '''SELECT remote_expires_at, producer_lease_expires_at,
                          remote_receipt_id, remote_resolution_json
                     FROM result_reservations WHERE id = ?''',
                (prebundle['reservation_id'],),
            ).fetchone())
            db.conn.commit()
            self.assertFalse(accepted_late['replayed'])
            self.assertTrue(replayed_late['replayed'])
            self.assertEqual(authority_after, authority_before)
            resolved_status = db.remote_assignment_status(
                prebundle['reservation_id'], device['device_id'], token_sha256,
            )
            self.assertEqual(
                resolved_status['latest_progress']['event']['sequence'], 100,
            )
            self.assertEqual(
                resolved_status['latest_progress']['event']['received_at'],
                accepted_late['received_at'],
            )
            settled = db.conn.execute(
                '''SELECT r.state AS reservation_state, q.status AS queue_status,
                          d.target_scan_id, d.category
                     FROM result_reservations r
                     JOIN target_queue q ON q.id = r.queue_id
                     JOIN worker_diagnostics d ON d.reservation_id = r.id
                    WHERE r.id = ?''',
                (prebundle['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (settled['reservation_state'], settled['queue_status']),
                ('refunded', 'pending'),
            )
            self.assertIsNone(settled['target_scan_id'])

            expired = claim('expiry')
            deadline = '2026-09-24T00:00:00+00:00'
            db.conn.execute(
                'UPDATE result_reservations SET remote_expires_at = ? WHERE id = ?',
                (deadline, expired['reservation_id']),
            )
            db.conn.commit()
            install_diagnostic_rejection()
            with self.assertRaisesRegex(Exception, 'injected diagnostic rollback'):
                db.expire_remote_assignment(
                    expired['reservation_id'], now='2026-09-24T00:00:01+00:00',
                )
            expiry_rolled_back = db.conn.execute(
                '''SELECT r.state AS reservation_state,
                          r.remote_resolution_kind, q.status AS queue_status,
                          (SELECT COUNT(*) FROM worker_diagnostics d
                            WHERE d.reservation_id = r.id) AS diagnostic_count
                     FROM result_reservations r
                     JOIN target_queue q ON q.id = r.queue_id WHERE r.id = ?''',
                (expired['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    expiry_rolled_back['reservation_state'],
                    expiry_rolled_back['remote_resolution_kind'],
                    expiry_rolled_back['queue_status'],
                    expiry_rolled_back['diagnostic_count'],
                ),
                ('scanning', None, 'in_progress', 0),
            )
            remove_diagnostic_rejection()
            expiry_receipt = db.expire_remote_assignment(
                expired['reservation_id'], now='2026-09-24T00:00:01+00:00',
            )
            self.assertEqual(expiry_receipt['resolution'], 'expired')
            self.assertEqual(
                expiry_receipt['diagnostics'], {
                    'available': True, 'count': 1,
                    'projection_version': None,
                    'ordered_uid_set_sha256': None,
                },
            )
            expiry = db.conn.execute(
                '''SELECT r.state AS reservation_state, q.status AS queue_status,
                          d.category, d.code, d.target_scan_id
                     FROM result_reservations r
                     JOIN target_queue q ON q.id = r.queue_id
                     JOIN worker_diagnostics d ON d.reservation_id = r.id
                    WHERE r.id = ?''',
                (expired['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (expiry['reservation_state'], expiry['queue_status']),
                ('refunded', 'pending'),
            )
            self.assertEqual(expiry['category'], 'assignment_expired')
            self.assertEqual(expiry['code'], 'assignment.deadline_expired')
            self.assertIsNone(expiry['target_scan_id'])

            accepted = claim('accepted')
            resolution = {
                'provider': 'github',
                'repo_url': accepted['target'],
                'repo_path': accepted['target'].split('github.com/', 1)[1].removesuffix('.git'),
                'branch': 'main',
                'ref': 'refs/heads/main',
                'head_sha': 'b' * 40,
                'ref_source': 'provider_default',
            }
            plan = db.bind_git_scan_plan(
                accepted['reservation_id'], accepted['claim_lease_token'],
                resolution, 100,
                remote_credential={
                    'device_id': device['device_id'],
                    'token_sha256': token_sha256,
                },
            )
            plan_sha256 = hashlib.sha256(
                canonical_git_scan_plan_bytes(plan)
            ).hexdigest()
            exact_scope = {
                key: plan.get(key) for key in (
                    'provider', 'ref', 'head_sha', 'base_sha', 'mode',
                    'baseline_depth', 'ref_source',
                )
            }
            result_metadata = {
                    'scan_event_id': accepted['scan_event_id'],
                    'target': accepted['target'],
                    'scan_type': 'github',
                    'timestamp': '2026-09-24T00:02:00+00:00',
                    'scan_started_at': '2026-09-24T00:01:00+00:00',
                    'duration_sec': 60.0,
                    'retryable': False,
                    'git_scan_plan': plan,
                    'git_scan_execution': {
                        'mode': plan['mode'], 'pinned': True, 'success': True,
                        'continuity_reset': False, 'plan_sha256': plan_sha256,
                    },
                    'scan_meta': {'exact_git_scope': exact_scope},
                    'reservation_id': accepted['reservation_id'],
                    'queue_id': accepted['queue_id'],
                    'bundle_id': accepted['bundle_id'],
                    'source': accepted['source'],
                    'platform': accepted['platform'],
                    'query': accepted['query'],
                    'normalized_target': accepted['normalized_target'],
                    'status': 'error',
                    'findings_count': 0,
                    'verified_findings_count': 0,
                    'error_count': 40,
                    'first_error_summary': 'legacy remote error 0',
                    'scan_options': {},
                    'derived_postman_targets': [],
                    'queue_status': 'failed',
                    'queue_error': 'legacy remote error 0',
                }
            with ResultBundleWriter.open(
                str(self.bundle_root), BundleReservation.from_mapping(accepted),
            ) as writer:
                for index in range(40):
                    writer.write_error(
                        f'legacy remote error {index}:' + ('x' * 65536)
                    )
                commit = writer.finish(result_metadata)
            ready_path = self.bundle_root.joinpath(*commit.relative_path.split('/'))
            accepted_reader = ResultBundleReader(str(ready_path))
            metadata = accepted_reader.validate().as_dict()
            metadata['relative_path'] = commit.relative_path
            effective_diagnostics = accepted_reader.effective_diagnostics()
            effective_uids = {
                diagnostic['diagnostic_uid'] for diagnostic in effective_diagnostics
            }
            effective_uid_hash = (
                worker_contracts.ordered_diagnostic_uid_set_sha256(
                    effective_diagnostics
                )
            )
            metadata['effective_diagnostic_projection_version'] = 1
            metadata['effective_diagnostic_count'] = len(effective_diagnostics)
            metadata['effective_diagnostic_uids_sha256'] = effective_uid_hash
            self.assertEqual(metadata['diagnostic_count'], 0)
            self.assertEqual(len(effective_diagnostics), 32)
            accepted_progress_timestamp = datetime.now(timezone.utc).isoformat(
                timespec='milliseconds',
            ).replace('+00:00', 'Z')
            accepted_scan_deadline = (
                datetime.now(timezone.utc) + timedelta(seconds=120)
            ).isoformat(timespec='milliseconds').replace('+00:00', 'Z')
            accepted_progress = dict(
                event,
                reservation_id=accepted['reservation_id'],
                sequence=9,
                timestamp=accepted_progress_timestamp,
                phase='scanning',
                phase_started_at=accepted_progress_timestamp,
                scan_deadline_at=accepted_scan_deadline,
                assignment_deadline_at=accepted['remote_expires_at'].replace(
                    '+00:00', 'Z'
                ),
            )
            db.record_worker_progress_event(
                accepted['reservation_id'], device['device_id'], accepted_progress,
            )
            db.conn.execute(
                '''UPDATE pipeline_capacity SET bundle_bytes = ? WHERE id = 1''',
                (12 * 1024 * 1024,),
            )
            db.conn.commit()
            with self.assertRaises(PipelineCapacityUnavailable):
                db.mark_result_bundle_ready(
                    accepted['reservation_id'], metadata,
                    remote_acceptance={
                        'device_id': device['device_id'],
                        'token_sha256': token_sha256,
                        'payload_sha256': hashlib.sha256(
                            ready_path.read_bytes()
                        ).hexdigest(),
                    },
                    bundle_capacity_bytes=12 * 1024 * 1024,
                )
            deferred_bundle = db.conn.execute(
                '''SELECT reserved_bundle_bytes, remote_resolution_kind
                   FROM result_reservations WHERE id = ?''',
                (accepted['reservation_id'],),
            ).fetchone()
            db.conn.execute(
                '''UPDATE pipeline_capacity SET bundle_bytes = ? WHERE id = 1''',
                (2 * 1024 * 1024,),
            )
            db.conn.commit()
            self.assertEqual(deferred_bundle['reserved_bundle_bytes'], 2 * 1024 * 1024)
            self.assertIsNone(deferred_bundle['remote_resolution_kind'])
            receipt = db.mark_result_bundle_ready(
                accepted['reservation_id'], metadata,
                remote_acceptance={
                    'device_id': device['device_id'],
                    'token_sha256': token_sha256,
                    'payload_sha256': hashlib.sha256(ready_path.read_bytes()).hexdigest(),
                },
                bundle_capacity_bytes=12 * 1024 * 1024,
            )
            expanded = db.conn.execute(
                '''SELECT reserved_bundle_bytes FROM result_reservations
                   WHERE id = ?''',
                (accepted['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertGreater(metadata['actual_bytes'], 2 * 1024 * 1024)
            self.assertEqual(expanded['reserved_bundle_bytes'], metadata['actual_bytes'])
            self.assertEqual(
                db.pipeline_capacity_snapshot()['bundle_bytes'],
                metadata['actual_bytes'],
            )
            self.assertEqual(receipt['diagnostics'], {
                'available': True, 'count': 32,
                'projection_version': 1,
                'ordered_uid_set_sha256': effective_uid_hash,
            })
            self.assertEqual(
                receipt['deadlines']['scan_deadline_at'], accepted_scan_deadline,
            )
            late_timestamp = datetime.now(timezone.utc).isoformat(
                timespec='milliseconds',
            ).replace('+00:00', 'Z')
            late_event = dict(
                accepted_progress,
                sequence=10,
                timestamp=late_timestamp,
                phase='awaiting_receipt',
                phase_started_at=late_timestamp,
                scan_deadline_at=None,
            )
            late_progress = db.record_worker_progress_event(
                accepted['reservation_id'], device['device_id'], late_event,
            )
            self.assertIsNone(late_progress['event']['scan_deadline_at'])
            accepted_status = db.remote_assignment_status(
                accepted['reservation_id'], device['device_id'], token_sha256,
            )
            self.assertEqual(
                accepted_status['latest_progress']['event']['sequence'], 10,
            )
            self.assertEqual(
                accepted_status['latest_progress']['event']['phase'],
                'awaiting_receipt',
            )
            self.assertEqual(accepted_status['deadlines'], receipt['deadlines'])
            self.assertEqual(accepted_status['diagnostics'], receipt['diagnostics'])
            projection_fence = db.conn.execute(
                '''SELECT remote_diagnostic_projection_version,
                          remote_diagnostic_count,
                          remote_diagnostic_uids_sha256
                     FROM result_reservations WHERE id = ?''',
                (accepted['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    projection_fence['remote_diagnostic_projection_version'],
                    projection_fence['remote_diagnostic_count'],
                    projection_fence['remote_diagnostic_uids_sha256'],
                ),
                (1, 32, effective_uid_hash),
            )
            replay_receipt = db.mark_result_bundle_ready(
                accepted['reservation_id'], metadata,
                remote_acceptance={
                    'device_id': device['device_id'],
                    'token_sha256': token_sha256,
                    'payload_sha256': hashlib.sha256(ready_path.read_bytes()).hexdigest(),
                },
                bundle_capacity_bytes=12 * 1024 * 1024,
            )
            self.assertEqual(replay_receipt, receipt)
            self.assertEqual(
                db.pipeline_capacity_snapshot()['bundle_bytes'],
                metadata['actual_bytes'],
            )
            claimed_bundle = db.claim_ready_result_bundle(
                ingester.lease['generation'], ingester.lease['lease_token'], 300,
            )
            conflicting_reader = mock.Mock(wraps=accepted_reader)
            conflicting_reader.effective_diagnostics.return_value = tuple(
                reversed(effective_diagnostics)
            )
            with self.assertRaisesRegex(
                ScanEventConflictError, 'differs from receipt authority',
            ):
                db.ingest_result_bundle(
                    conflicting_reader, claimed_bundle['reservation'],
                    claimed_bundle['bundle'],
                )
            install_diagnostic_rejection()
            with self.assertRaisesRegex(Exception, 'injected diagnostic rollback'):
                db.ingest_result_bundle(
                    accepted_reader, claimed_bundle['reservation'],
                    claimed_bundle['bundle'],
                )
            accepted_rollback = db.conn.execute(
                '''SELECT r.state AS reservation_state, q.status AS queue_status,
                          (SELECT COUNT(*) FROM target_scans s
                            WHERE s.result_reservation_id = r.id) AS scan_count,
                          (SELECT COUNT(*) FROM worker_diagnostics d
                            WHERE d.reservation_id = r.id) AS diagnostic_count
                     FROM result_reservations r
                     JOIN target_queue q ON q.id = r.queue_id WHERE r.id = ?''',
                (accepted['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    accepted_rollback['queue_status'],
                    accepted_rollback['scan_count'],
                    accepted_rollback['diagnostic_count'],
                ),
                ('in_progress', 0, 0),
            )
            self.assertIn(
                accepted_rollback['reservation_state'], ('ready', 'ingesting'),
            )
            remove_diagnostic_rejection()
            committed = db.ingest_result_bundle(
                accepted_reader, claimed_bundle['reservation'],
                claimed_bundle['bundle'],
            )
            replayed = db.ingest_result_bundle(
                accepted_reader, claimed_bundle['reservation'],
                claimed_bundle['bundle'],
            )
            self.assertFalse(committed['duplicate'])
            self.assertTrue(replayed['duplicate'])
            db.conn.execute(
                '''UPDATE result_reservations
                   SET remote_diagnostic_projection_version = 0,
                       remote_diagnostic_count = NULL,
                       remote_diagnostic_uids_sha256 = NULL
                   WHERE id = ?''',
                (accepted['reservation_id'],),
            )
            db.conn.commit()
            legacy_fenced = db.ingest_result_bundle(
                accepted_reader, claimed_bundle['reservation'],
                claimed_bundle['bundle'],
            )
            self.assertTrue(legacy_fenced['duplicate'])
            backfilled_fence = db.conn.execute(
                '''SELECT remote_diagnostic_projection_version,
                          remote_diagnostic_count,
                          remote_diagnostic_uids_sha256
                     FROM result_reservations WHERE id = ?''',
                (accepted['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(
                (
                    backfilled_fence['remote_diagnostic_projection_version'],
                    backfilled_fence['remote_diagnostic_count'],
                    backfilled_fence['remote_diagnostic_uids_sha256'],
                ),
                (1, 32, effective_uid_hash),
            )
            count = db.conn.execute(
                '''SELECT COUNT(*) AS count FROM worker_diagnostics
                   WHERE reservation_id = ?''',
                (accepted['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(count['count'], 32)
            self.assertTrue(ingester.process_one())
            attached = db.conn.execute(
                '''SELECT d.target_scan_id, d.code, d.diagnostic_uid,
                          ts.status AS scan_status,
                          q.status AS queue_status
                     FROM worker_diagnostics d
                     JOIN target_scans ts ON ts.id = d.target_scan_id
                     JOIN result_reservations r ON r.id = d.reservation_id
                     JOIN target_queue q ON q.id = r.queue_id
                    WHERE d.reservation_id = ?''',
                (accepted['reservation_id'],),
            ).fetchall()
            db.conn.commit()
            self.assertEqual(len(attached), 32)
            self.assertEqual(
                {row['diagnostic_uid'] for row in attached}, effective_uids,
            )
            self.assertTrue(all(row['target_scan_id'] for row in attached))
            self.assertTrue(all(
                row['code'] in {'legacy.error_frame', 'legacy.error_frame_aggregate'}
                for row in attached
            ))
            self.assertTrue(all(row['scan_status'] == 'error' for row in attached))
            self.assertTrue(all(row['queue_status'] == 'failed' for row in attached))
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            db.close()

    def test_local_dless_error_bundle_projects_one_transactional_legacy_diagnostic(self):
        db = ScannerDB(db_url=self.dsn, initialize=False)
        ingester = None
        try:
            migrate_runtime_safety_schema(db, initialize_base=True)
            db.record_final_cutover({'test': self.id()})
            ingester = ResultIngester(
                db, str(self.bundle_root), 'local-legacy-diagnostic-supervisor',
                lease_seconds=300,
            ).start()
            target = 'https://github.com/example/local-legacy-diagnostic.git'
            self.assertEqual(
                db.enqueue_targets('github', 'github', 'local-legacy', [target]),
                1,
            )
            claim = db.reserve_and_claim_target(
                'github', 'github', current_process_identity(),
                'local-legacy-diagnostic-supervisor',
                1024 * 1024, 1024 * 1024, 0, 0,
                lease_seconds=300, max_attempts=3,
                capacity_limits={
                    'bundle_items': 1, 'bundle_bytes': 1024 * 1024,
                    'projection_items': 1, 'projection_bytes': 1024 * 1024,
                    'keycheck_items': 1, 'keycheck_bytes': 1024 * 1024,
                    'quarantine_items': 1, 'quarantine_bytes': 1024 * 1024,
                },
                reservation_token=hashlib.sha256(b'local-legacy-reservation').hexdigest(),
                bundle_id=hashlib.sha256(b'local-legacy-bundle').hexdigest(),
                scan_event_id=hashlib.sha256(b'local-legacy-scan').hexdigest(),
                claim_order='oldest', final_cutover=True,
            )
            reservation = BundleReservation.from_mapping(claim)
            with ResultBundleWriter.open(str(self.bundle_root), reservation) as writer:
                writer.write_error('exact legacy E-frame evidence')
                commit = writer.finish({
                    'scan_event_id': claim['scan_event_id'],
                    'target': claim['target'],
                    'scan_type': claim['platform'],
                    'timestamp': '2026-09-24T00:01:00Z',
                    'scan_started_at': '2026-09-24T00:00:00Z',
                    'duration_sec': 60.0,
                    'status': 'error',
                    'queue_status': 'failed',
                    'queue_error': 'exact legacy E-frame evidence',
                    'reservation_id': claim['reservation_id'],
                    'queue_id': claim['queue_id'],
                    'bundle_id': claim['bundle_id'],
                    'source': claim['source'],
                    'platform': claim['platform'],
                    'query': claim['query'],
                    'normalized_target': claim['normalized_target'],
                    'findings_count': 0,
                    'verified_findings_count': 0,
                    'error_count': 1,
                    'first_error_summary': 'exact legacy E-frame evidence',
                    'scan_options': {},
                    'derived_postman_targets': [],
                })
            path = self.bundle_root.joinpath(*commit.relative_path.split('/'))
            reader = ResultBundleReader(str(path))
            metadata = reader.validate().as_dict()
            metadata['relative_path'] = commit.relative_path
            self.assertEqual(reader.validate().diagnostic_count, 0)
            self.assertTrue(db.mark_result_bundle_ready(
                claim['reservation_id'], metadata,
            ))
            lost = {'pending': True}

            def lose_commit(stage, _value):
                if stage == 'after_db_commit' and lost['pending']:
                    lost['pending'] = False
                    raise RuntimeError('injected local legacy diagnostic commit loss')

            ingester.fault = lose_commit
            with self.assertRaisesRegex(
                RuntimeError, 'local legacy diagnostic commit loss',
            ):
                ingester.process_one()
            row = db.conn.execute(
                '''SELECT d.diagnostic_uid, d.code, d.target_scan_id,
                          r.assignment_kind
                     FROM worker_diagnostics d
                     JOIN result_reservations r ON r.id = d.reservation_id
                    WHERE d.reservation_id = ?''',
                (claim['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(row['code'], 'legacy.error_frame')
            self.assertEqual(row['assignment_kind'], 'local')
            self.assertIsNotNone(row['target_scan_id'])
            uid = row['diagnostic_uid']
            ingester.fault = None
            self.assertTrue(ingester.process_one())
            replay = db.conn.execute(
                '''SELECT COUNT(*) AS count, MIN(diagnostic_uid) AS diagnostic_uid
                     FROM worker_diagnostics WHERE reservation_id = ?''',
                (claim['reservation_id'],),
            ).fetchone()
            db.conn.commit()
            self.assertEqual(replay['count'], 1)
            self.assertEqual(replay['diagnostic_uid'], uid)
        finally:
            if ingester is not None and ingester.lease is not None:
                ingester.stop()
            db.close()


if __name__ == '__main__':
    unittest.main()