fix(appliance): an expired deadline stops locking the operator out

A verification deadline that is armed disables both the update and the revert
control. The comment above the gate already says why, and already says the right
rule: "A deadline in flight is the one state that blocks both buttons: a second
install would replace the package whose verdict the appliance is still waiting
for." The code did not check in flight. It checked whether a deadline file
exists.

On the appliance that found this, a deadline armed for 0.2.0 sat past its window
with the verdict still pending, and nothing ever judged it. Both controls were
dead. The documented cure is `systemctl start
ems-appliance-manager-verify.service` -- a keyboard at the console, which the
ADR names as the backstop rather than the plan, and which an appliance owner
often does not have. The timer was enabled, its symlink present in
timers.target.wants, and it still never ran; that cause is not diagnosed here.

An expired deadline can no longer revert anything: its window is what gave it
the right to. Holding both controls shut on it protects nothing that the window
could still protect, and takes away the last lever there is. So the gate now
blocks while the window has not passed, and lets go when it has, which is what
the comment said all along.

Judged by the appliance's own clock, not the browser's: that clock belongs to a
different machine, and this board has no real-time clock. A clock the console
cannot read keeps the lock, because a deadline it cannot place in time is one
that may still fire.

The card stops lying too. "Waiting for the deadline" and "nothing else can be
started until it settles" become "the deadline passed and nothing judged it",
saying plainly that nothing was reverted and nothing will be, and naming the
timer to look at when it recurs.

The clock is a parameter rather than a read of `state`. Taking it from the
global broke every test in test_appliance_manager_frontend.py at once, which is
that module's whole point: both decisions are derived from backend values alone,
so they can be evaluated without a page around them. The signature contract now
pins the arity, and two cases pin the rule directly -- one deadline at 999 and
1001 against an epoch of 1000, and a clock of 0, null and "later" that all keep
the lock.

Nothing about what may be installed changes. The deadline is still armed by the
outgoing package, still runs a reverter copied out of it, and still reverts an
install that does not prove itself inside the window.

Author: basecubedev

appliance/static/app.js

@@ -1200,13 +1200,33 @@
      from the backend payload alone. A deadline in flight is the one state that
      blocks both buttons: a second install would replace the package whose
      verdict the appliance is still waiting for. */
-  function managerActions(manager) {
+  /* The appliance's own clock, which is the only one that may judge its
+     deadline: the browser's belongs to a different machine, and this board has
+     no real-time clock. Passed in rather than read from state inside
+     managerActions, so both decisions stay derived from backend values alone
+     and stay testable without a page around them. */
+  function applianceNow() {
+    return Number((((state.data.status || {}).system || {}).time || {}).epoch) || 0;
+  }
+
+  function managerActions(manager, now) {
     var verify = (manager || {}).verify || {};
     var armed = verify.armed === true;
+    /* In flight means the window has not passed, not merely that a deadline is
+       on disk. A deadline whose window expired without a verdict is a mechanism
+       that did not run: it can no longer revert anything, and locking both
+       controls on it removes the operator's last lever on a box whose only
+       documented alternative is a keyboard at the console. An unreadable clock
+       keeps the lock, because a deadline this cannot place may still fire. */
+    var expiry = Number(verify.deadline_epoch) || 0;
+    now = Number(now) || 0;
+    var inFlight = armed && !(now && expiry && now >= expiry);
     return {
       armed: armed,
-      canUpdate: !armed,
-      canRevert: (manager || {}).can_revert === true && !armed
+      inFlight: inFlight,
+      expiredUnjudged: armed && !inFlight,
+      canUpdate: !inFlight,
+      canRevert: (manager || {}).can_revert === true && !inFlight
     };
   }
 
@@ -1239,7 +1259,7 @@
           "data-direction": entry.direction || "",
           title: entry.release_id,
           text: "Install " + managerLabel(entry),
-          disabled: !managerActions(manager).canUpdate,
+          disabled: !managerActions(manager, applianceNow()).canUpdate,
           onclick: function () {
             planOperation({
               endpoint: "/api/manager/plan-update",
@@ -1265,6 +1285,7 @@
      package to every appliance at once. */
   function renderManagerUpdates(main) {
     var manager = state.data.manager;
+    var actions = managerActions(manager, applianceNow());
     if (manager === undefined || manager === null) {
       main.appendChild(el("h2", { class: "section-title", text: "Appliance Manager" }));
       main.appendChild(el("p", { class: "section-hint", text: "Reading the manager state\u2026" }));
@@ -1305,19 +1326,21 @@
       ], "manager-kept"),
       card("Last install", [
         el("p", { class: "status-value" }, [
-          verify.armed
+          actions.inFlight
             ? tone("warn", "waiting for the deadline")
-            : (verdict.settled
-                ? tone(MANAGER_VERDICTS[verdict.verdict] ? MANAGER_VERDICTS[verdict.verdict][0] : "warn",
-                       format(verdict.verdict))
-                : tone("ok", "nothing in flight"))
+            : actions.expiredUnjudged
+              ? tone("bad", "deadline expired without a verdict")
+              : (verdict.settled
+                  ? tone(MANAGER_VERDICTS[verdict.verdict] ? MANAGER_VERDICTS[verdict.verdict][0] : "warn",
+                         format(verdict.verdict))
+                  : tone("ok", "nothing in flight"))
         ]),
         fact("Result", (manager.outcome || {}).outcome),
         verify.armed ? fact("Expecting", verify.expected_version) : null
       ], "manager-verify")
     ]));
 
-    if (verify.armed) {
+    if (actions.inFlight) {
       main.appendChild(el("p", { class: "empty-state", "data-test": "manager-deadline" }, [
         el("strong", { text: "An install is being judged. " }),
         el("span", {
@@ -1326,6 +1349,16 @@
             + "package is installed again. Nothing else can be started until it settles."
         })
       ]));
+    } else if (actions.expiredUnjudged) {
+      main.appendChild(el("p", { class: "empty-state", "data-test": "manager-deadline-expired" }, [
+        el("strong", { text: "The deadline passed and nothing judged it. " }),
+        el("span", {
+          text: "This appliance armed a deadline for " + format(verify.expected_version)
+            + " and its window has closed without a verdict, so nothing was reverted and nothing "
+            + "will be. Installing or reverting is available again; the next install replaces "
+            + "this deadline. Check ems-appliance-manager-verify.timer if it keeps happening."
+        })
+      ]));
     } else if (verdict.settled && verdict.verdict !== "confirmed") {
       main.appendChild(el("p", { class: "empty-state", "data-test": "manager-verdict" }, [
         el("strong", { text: "The last manager install " }),
@@ -1350,7 +1383,7 @@
           el("button", {
             type: "button", class: "ghost-button compact", "data-test": "manager-plan-revert",
             text: "Reinstall " + (manager.can_revert ? format(kept.version) : "\u2014"),
-            disabled: !managerActions(manager).canRevert,
+            disabled: !managerActions(manager, applianceNow()).canRevert,
             onclick: function () {
               planOperation({
                 endpoint: "/api/manager/plan-revert", body: {},

tests/e2e-appliance/appliance.spec.ts

@@ -865,6 +865,28 @@ test.describe("appliance manager @smoke", () => {
     await expect(page.locator('[data-test="manager-plan-revert"]')).toBeDisabled();
   });
 
+  test("a deadline whose window closed without a verdict stops blocking", async ({
+    page,
+    request,
+  }) => {
+    // The lockout is for a deadline in flight. One whose window passed without a
+    // verdict never ran, cannot revert anything any more, and locking the
+    // controls on it leaves an operator with no lever but a keyboard at the
+    // console -- which an appliance owner often does not have.
+    await resetAppliance(request, {
+      manager_package_kept: true,
+      manager_deadline_expired: true,
+    });
+    await signIn(page);
+    await openView(page, "updates");
+
+    await expect(page.locator('[data-test="manager-deadline"]')).toHaveCount(0);
+    const notice = page.locator('[data-test="manager-deadline-expired"]');
+    await expect(notice).toContainText("nothing judged it");
+    await expect(notice).toContainText("0.3.0");
+    await expect(page.locator('[data-test="manager-plan-revert"]')).toBeEnabled();
+  });
+
   test("a reverted install is reported rather than left silent", async ({ page, request }) => {
     await resetAppliance(request, { manager_package_kept: true, manager_verdict: "reverted" });
     await signIn(page);

tests/e2e-appliance/serve_appliance_test.py

@@ -78,7 +78,7 @@ def seed_rescue_account(root, *, changed=False, absent=False):
     )
 
 
-def seed_manager_state(services, *, kept=False, verdict="", armed=False):
+def seed_manager_state(services, *, kept=False, verdict="", armed=False, deadline_expired=False):
     """What the Appliance Manager card reports, written the way the host does."""
 
     from appliance import manager_retention, manager_verify
@@ -130,7 +130,10 @@ def seed_manager_state(services, *, kept=False, verdict="", armed=False):
                     "build_id": "20260901000000",
                     "previous_path": str(packages / manager_retention.PREVIOUS_NAME),
                     "armed_at": 1787000000,
-                    "deadline_epoch": 4000000000,
+                    # In the past when the window is meant to have closed: the
+                    # console judges "in flight" by the appliance's own clock,
+                    # so the fixture has to move the deadline, not the clock.
+                    "deadline_epoch": 1787000900 if deadline_expired else 4000000000,
                     "window_seconds": 900,
                 }
             ),
@@ -335,7 +338,9 @@ def seed_appliance_state(options=None):
             services,
             kept=bool(options.get("manager_package_kept")),
             verdict=str(options.get("manager_verdict") or ""),
-            armed=bool(options.get("manager_deadline_armed")),
+            armed=bool(options.get("manager_deadline_armed"))
+            or bool(options.get("manager_deadline_expired")),
+            deadline_expired=bool(options.get("manager_deadline_expired")),
         )
 
     seed_appliance_state({})

tests/test_appliance_manager_frontend.py

@@ -41,13 +41,12 @@ def extract(name):
     raise AssertionError(f"{name} is not a closed function")
 
 
-def evaluate(name, payload, *, preamble=""):
+def evaluate(name, payload, *arguments, preamble=""):
+    rendered = ", ".join(json.dumps(value) for value in (payload,) + arguments)
     script = (
         preamble
         + extract(name)
-        + f"\nconsole.log(JSON.stringify({name}("
-        + json.dumps(payload)
-        + ")));\n"
+        + f"\nconsole.log(JSON.stringify({name}({rendered})));\n"
     )
     result = subprocess.run(
         [node, "-"], input=script, capture_output=True, text=True, timeout=120
@@ -79,9 +78,16 @@ def manager(**overrides):
 
 
 def test_the_action_gate_is_a_named_function():
-    """A gate buried in a render call cannot be tested at all."""
+    """A gate buried in a render call cannot be tested at all.
 
-    assert "function managerActions(manager)" in APP
+    The clock is a parameter for the same reason. Reading it from ``state``
+    inside the gate made both decisions depend on a page being around them,
+    which is exactly what this module exists to prevent -- and it broke every
+    test here at once.
+    """
+
+    assert "function managerActions(manager, now)" in APP
+    assert "function applianceNow()" in APP
 
 
 @requires_node
@@ -110,6 +116,44 @@ def test_an_armed_deadline_blocks_both_buttons():
     assert result["canRevert"] is False
 
 
+@requires_node
+def test_a_deadline_whose_window_closed_stops_blocking():
+    """The lockout is for a deadline in flight, and one that expired is not.
+
+    It can no longer revert anything, so holding both controls shut on it
+    protects nothing and leaves the operator with the console as the only way
+    on -- which is the backstop, not the plan.
+    """
+
+    armed = manager(
+        can_revert=True,
+        verify={"armed": True, "expected_version": "0.2.0", "deadline_epoch": 1000},
+    )
+
+    assert evaluate("managerActions", armed, 999)["canUpdate"] is False
+    expired = evaluate("managerActions", armed, 1001)
+    assert expired["armed"] is True
+    assert expired["inFlight"] is False
+    assert expired["expiredUnjudged"] is True
+    assert expired["canUpdate"] is True
+    assert expired["canRevert"] is True
+
+
+@requires_node
+def test_a_clock_it_cannot_read_keeps_the_deadline_shut():
+    """Fail closed: a deadline this cannot place in time may still fire."""
+
+    armed = manager(
+        can_revert=True,
+        verify={"armed": True, "expected_version": "0.2.0", "deadline_epoch": 1000},
+    )
+
+    for unusable in (0, None, "later"):
+        result = evaluate("managerActions", armed, unusable)
+        assert result["canUpdate"] is False, unusable
+        assert result["canRevert"] is False, unusable
+
+
 @requires_node
 def test_a_missing_payload_enables_nothing_it_cannot_prove():
     result = evaluate("managerActions", {})