test: verify native ledger contention across processes

Author: CompleteDotTech

.github/workflows/ci.yml

@@ -85,7 +85,7 @@ jobs:
               return int(match.group(1)) if match else -1
           print(f'installed: {tests} tests, {skipped} skipped, {failed} failed; '
                 f'native: {count("tests")} tests, {count("skipped")} skipped, {count("fail")} failed')
-          if tests != 27 or skipped or failed or count('tests') != 19 or count('skipped') or count('fail'):
+          if tests != 27 or skipped or failed or count('tests') != 20 or count('skipped') or count('fail'):
               raise SystemExit('required installed/native Node 24 qualification incomplete')
           PY
   native-runner-qualification:

SHA256SUMS

@@ -1,7 +1,7 @@
 4e32ce77e64227b8fed5cb090cc9bf3ee8e87c8d7f31ef7f6c5a162693cfdf7c  .editorconfig
 46a132840194b21580069ef028caaf88891a2d57f9831c43d2c6b49679f4a835  .gitattributes
 1247214797e4439805a0a451bf254fb2e25e233ff7e6891489c986b6b2abd7ee  .github/required-installed-journeys.txt
-f0f46a8b0852aa99709a6370de5fc7176e99cf1513fd0e3a391272267843f12a  .github/workflows/ci.yml
+0fe2d33ef89ae46efb05680596f6cf20498f7a91d99055745fbd6891119f9130  .github/workflows/ci.yml
 d4eb80256172fb98928b1c42a953059b3f934e6f2a61ee469cdd50c932f7b04c  .gitignore
 c6a2f8e9584e6d1c5bd21431a01be1fc1f96aa68749efac4293ae9c2ac8629dd  AGENTS.md
 e9f605dec3962bc7dfe2ed17e4406c780dc7a427f39ca2e5d19614d2a166929c  BRANDING.md
@@ -494,7 +494,7 @@ ac71fada9c932f4926a037f78e4f0f8ca76539256c6740c901e64fbf1f2a169d  references/tem
 bc7c8e5369387eb4ec61c8d62cc84ca8edd1a38f8db25928e9b23bbbbf560526  references/template-delivery-session-v1.md
 282999ed4cbba58e9bae08531165848b5b2aba05c304f88948686b84fe7aad8f  references/template-installation-v1.md
 8255b071076e5b84308324602fb396dbaeecba918d08b46942996e91d0b3ffbc  references/template-node-connected-v1.md
-56c05e1cd7079de3bb8ee07b61a0413bdd6c6ce0b6e2a0b9d51136deef038661  references/template-node-installation-v1.md
+f24fa0bade5b2d2057cf5286541a2cd9b0eb726a26b2b00f209f22fac70f49e7  references/template-node-installation-v1.md
 38bd959ff5ecdca22e6f10ca2fa85316f7583a3281a512c44efdb1e2aa9a54ba  references/template-python-entrypoint-v1.md
 0cb19ac97100d8bde0f484dcb5382f51c6e47bc8b70e47e0012427d9c2e8c7ed  references/use-case-template-matrix-v1.md
 766e3bca7ab51a8ac30bbc0a283b73ffe2354d63dca26325946bc802b30b2ddb  references/windows-source-mutation-v1.md
@@ -830,7 +830,7 @@ c78deab0d89125e1debebfcd300930d00850522953ed3ef3e53bf2c2018d5067  tests/independ
 6551e1fa27fd8dbd093dbc4cdd839613492f866386cfa400cb27c9ab5288b8ca  tests/independent_hosts/work_queue/src/work_queue/runtime.json
 5909e532926cde3f8dcd352b476dc3697d8e79dfd0c589001e8c32cf7df5817e  tests/integration_helpers.py
 50c33d58c287173b673962a0c57ef350d79aaf1e74f70940b5497bfbe8b4604d  tests/js_transform.test.cjs
-7b01af41c0af3962ba970a2a0a09c4fe4892a06d2a2206359e65a6be65dbd994  tests/native_js_runtime.test.cjs
+166604b958321ca7eba8eee8651ab7bb08ceb4abf4603556db29bb0c31845fb8  tests/native_js_runtime.test.cjs
 8d9dbc31c83b66a17cf83add6acfd7995b998daedafedd6e94f1a70bd1320a1f  tests/parent_death_probe.py
 55375adeab12024e5e249b53c2cb0c7ff4261044fa06a64891987bf439c98821  tests/path_corpus/README.md
 523e0a5e55faa7704965e07a01e80e3d8b28cdfd496e6ec0042fb9b7035f9813  tests/path_corpus/deterministic_only/expected.json

references/template-node-installation-v1.md

@@ -420,3 +420,13 @@ Node session adds bounded offline process ownership and observation. Required
 full regressions, connected
 authority, async rejection/cancellation and cross-placement budget coverage
 remain pending before a complete issue #60 claim.
+
+The native runtime test `separate native processes cannot reset a held ledger
+or replay its settled effects` exercises two actual Node 24.18.0 processes
+against one private durable ledger. The peer is refused while the first owner
+holds the SQLite exclusive lock. After release, the peer retains the original
+charge and settled invocation tombstone, consumes the last reservation, and
+refuses further calls; the original process then observes the exhausted budget.
+This is offline ledger contention evidence. It does not establish concurrent
+distributed execution, installed cross-package composition, provider operation,
+or a selected installed application effect.

tests/native_js_runtime.test.cjs

@@ -353,6 +353,65 @@ test('durable native ledger retains charges and refuses unresolved or revoked re
   }
 });
 
+test('separate native processes cannot reset a held ledger or replay its settled effects',
+  {skip: process.platform !== 'linux' || process.version !== 'v24.18.0'}, () => {
+  const {spawnSync} = require('node:child_process');
+  const parent = fs.mkdtempSync(path.join(os.tmpdir(), 'jev-node-contention-'));
+  fs.chmodSync(parent, 0o700);
+  const ledgerPath = path.join(parent, 'ledger.sqlite');
+  const limits = {max_calls: 2, max_cost: 2};
+  const identity = 'a'.repeat(64);
+  const runtime = require.resolve('../jev_integration_evaluator/data/native_js_runtime.cjs');
+  const child = mode => {
+    const result = spawnSync(process.execPath, ['-e', `
+      const assert = require('node:assert/strict');
+      const {DurableSharedBudget} = require(process.argv[1]);
+      const args = JSON.parse(process.argv[2]);
+      if (process.argv[3] === 'contend') {
+        assert.throws(() => new DurableSharedBudget(args), /locked/);
+      } else {
+        const ledger = new DurableSharedBudget(args);
+        try {
+          assert.equal(ledger.calls, 1);
+          assert.equal(ledger.cost, 1);
+          assert.throws(() => ledger.claimInvocation('one', 'first', 'candidate'),
+            /effect_replay_denied/);
+          const reservation = ledger.reserve('two', 1);
+          ledger.finishReservation(reservation);
+          assert.throws(() => ledger.reserve('three', 1), /budget_denied/);
+          assert.equal(ledger.calls, 2);
+          assert.equal(ledger.cost, 2);
+        } finally { ledger.close(); }
+      }
+      process.stdout.write('verified');
+    `, runtime, JSON.stringify({limits, ledgerPath, identity}), mode],
+      {encoding: 'utf8', timeout: 10000, env: {PATH: process.env.PATH}});
+    assert.equal(result.error, undefined);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(result.stdout, 'verified');
+  };
+  let ledger;
+  try {
+    ledger = new DurableSharedBudget({limits, ledgerPath, identity});
+    const reservation = ledger.reserve('one', 1);
+    ledger.finishReservation(reservation);
+    ledger.claimInvocation('one', 'first', 'candidate');
+    ledger.settleInvocation('one', 'first', 'candidate');
+    child('contend'); // a real peer process must fail before it can reserve
+    assert.equal(ledger.calls, 1);
+    assert.equal(ledger.cost, 1);
+    ledger.close(); ledger = null;
+    child('resume'); // release transfers ownership, never a fresh budget
+    ledger = new DurableSharedBudget({limits, ledgerPath, identity});
+    assert.equal(ledger.calls, 2);
+    assert.equal(ledger.cost, 2);
+    assert.throws(() => ledger.reserve('four', 1), /budget_denied/);
+  } finally {
+    if (ledger) ledger.close();
+    fs.rmSync(parent, {recursive: true, force: true});
+  }
+});
+
 test('connected shadow owner checks independent grant and installed bytes before fake transport',
   {skip: process.platform !== 'linux' || process.version !== 'v24.18.0'}, async () => {
   const parent = fs.mkdtempSync(path.join(os.tmpdir(), 'jev-connected-shadow-'));