Close prepared-lower identity and reclaim races

crates/lazaret-prepared-lower/tests/prepared_lower.rs

@@ -400,6 +400,44 @@ fn semantic_corpus_preserves_supported_changesets_and_read_only_lower_use() {
     );
 }
 
+#[test]
+fn request_manifest_identity_must_match_verified_layout_manifest() {
+    let fixture = Fixture::new();
+    let bytes = layer(&[Entry {
+        path: "payload",
+        kind: EntryType::Regular,
+        data: b"content",
+        target: None,
+        mode: 0o644,
+    }]);
+    let mut request = fixture.request(3, &[(bytes, OCI_TAR)]);
+    request.selected_manifest_digest = [0xff; 32];
+
+    assert!(fixture.store.prepare(&request).is_err());
+    let snapshot = fixture.catalog.snapshot().unwrap();
+    assert!(snapshot.prepared_artifacts.is_empty());
+    assert!(snapshot.prepare_operations.is_empty());
+}
+
+#[test]
+fn layer_entry_matching_internal_spool_name_is_preserved() {
+    let fixture = Fixture::new();
+    let bytes = layer(&[Entry {
+        path: ".layer-0.tar",
+        kind: EntryType::Regular,
+        data: b"image-owned",
+        target: None,
+        mode: 0o640,
+    }]);
+    let request = fixture.request(4, &[(bytes, OCI_TAR)]);
+
+    let artifact = fixture.store.prepare(&request).unwrap();
+    assert_eq!(
+        std::fs::read(fixture.artifact_root(&artifact).join(".layer-0.tar")).unwrap(),
+        b"image-owned"
+    );
+}
+
 #[test]
 fn root_opaque_whiteout_removes_only_lower_layer_entries() {
     let fixture = Fixture::new();
@@ -641,6 +679,73 @@ fn publication_during_reclaim_preserves_replacement_and_deletes_old_inode() {
     );
 }
 
+#[test]
+fn replacement_winning_before_reclaimer_resumes_still_cleans_old_quarantine() {
+    let fixture = Fixture::new();
+    let bytes = layer(&[Entry {
+        path: "payload",
+        kind: EntryType::Regular,
+        data: b"same",
+        target: None,
+        mode: 0o644,
+    }]);
+    let first_request = fixture.request(52, &[(bytes, OCI_TAR)]);
+    let first = fixture.store.prepare(&first_request).unwrap();
+    let reclaiming = fixture.catalog.begin_reclaim(&first).unwrap();
+    let replacement_request = PrepareRequest {
+        operation_id: PrepareOperationId::new([53; 32]),
+        ..first_request
+    };
+
+    let replacement = fixture.store.prepare(&replacement_request).unwrap();
+    assert_ne!(replacement.inode, first.inode);
+    assert_eq!(
+        fixture.store.resume_reclaim(&reclaiming).unwrap(),
+        ReclaimOutcome::ReplacementPreserved
+    );
+    assert_eq!(
+        fixture.catalog.snapshot().unwrap().prepared_artifacts,
+        vec![replacement.clone()]
+    );
+    assert!(fixture.artifact_root(&replacement).exists());
+    assert!(
+        fixture
+            .root
+            .join("quarantine")
+            .read_dir()
+            .unwrap()
+            .next()
+            .is_none()
+    );
+}
+
+#[test]
+fn reclaim_refuses_preexisting_foreign_quarantine_path() {
+    let fixture = Fixture::new();
+    let bytes = layer(&[Entry {
+        path: "payload",
+        kind: EntryType::Regular,
+        data: b"same",
+        target: None,
+        mode: 0o644,
+    }]);
+    let artifact = fixture
+        .store
+        .prepare(&fixture.request(54, &[(bytes, OCI_TAR)]))
+        .unwrap();
+    let foreign = fixture.root.join("quarantine").join(format!(
+        "{}-{}-{}",
+        hex(artifact.prepared_artifact_id.as_bytes()),
+        artifact.device.get(),
+        artifact.inode.get()
+    ));
+    std::fs::create_dir(&foreign).unwrap();
+
+    assert!(fixture.store.reclaim(&artifact).is_err());
+    assert!(foreign.is_dir());
+    assert!(fixture.artifact_root(&artifact).is_dir());
+}
+
 #[test]
 fn recovery_deletes_only_exact_owned_stage_and_preserves_foreign_stage() {
     let fixture = Fixture::new();