feat(sense): add reconciliation safety controls [T-012]

Sense/internal/reconcile/reconciler_test.go

@@ -162,6 +162,86 @@ func TestDisabledDeviceDeletesOnlyItsExactPath(t *testing.T) {
 	}
 }
 
+type lostLeaseRepository struct {
+	completed bool
+	failed    bool
+}
+
+func (r *lostLeaseRepository) ClaimDueReconcile(
+	context.Context,
+	store.ReconcileClaim,
+) ([]store.ReconcileCandidate, error) {
+	return []store.ReconcileCandidate{{Device: device.Device{
+		ID: "camera-lost", DesiredState: device.DesiredEnabled,
+		EndpointRef: "onvif://camera-lost", PathName: "camera-lost", Generation: 1,
+	}}}, nil
+}
+
+func (r *lostLeaseRepository) RenewReconcileLease(
+	context.Context, string, string, string, time.Time, time.Duration,
+) (bool, error) {
+	return false, nil
+}
+
+func (r *lostLeaseRepository) CompleteReconcile(
+	context.Context, string, int64, string, string, time.Time,
+) error {
+	r.completed = true
+	return nil
+}
+
+func (r *lostLeaseRepository) FailReconcile(
+	context.Context, string, int, time.Time, string, string, string, time.Time,
+) error {
+	r.failed = true
+	return nil
+}
+
+func (r *lostLeaseRepository) ConvergenceSnapshot(context.Context) (store.ConvergenceSnapshot, error) {
+	return store.ConvergenceSnapshot{}, nil
+}
+
+func TestLostLeaseSkipsAllExternalAndStoreMutations(t *testing.T) {
+	t.Parallel()
+	repository := &lostLeaseRepository{}
+	media := &recordingMedia{}
+	reconciler := New(repository, onvif.NewFake(nil), media)
+	if err := reconciler.RunOnce(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if media.calls != 0 || repository.completed || repository.failed {
+		t.Fatalf("lost lease performed a side effect: media=%d completed=%v failed=%v",
+			media.calls, repository.completed, repository.failed)
+	}
+}
+
+func TestPerItemTimeoutPersistsRetryWhenParentIsAlive(t *testing.T) {
+	t.Parallel()
+	repository := openRepository(t, filepath.Join(t.TempDir(), "sense.db"))
+	createReconcileDevice(t, repository)
+	discovery := onvif.NewFake(map[string]onvif.FakeScenario{
+		"onvif://camera-1": {
+			DelayMillis: 100,
+			Result:      onvif.ProbeResult{StreamURI: "rtsp://media.invalid/camera-1"},
+		},
+	})
+	reconciler := NewWithOptions(repository, discovery, &recordingMedia{}, Options{
+		InstanceID: "ins_test", LeaseDuration: time.Second, OperationTimeout: 5 * time.Millisecond,
+	})
+	now := time.Date(2026, 8, 7, 0, 0, 0, 0, time.UTC)
+	reconciler.now = func() time.Time { return now }
+	if err := reconciler.RunOnce(context.Background()); err == nil {
+		t.Fatal("expected bounded operation timeout")
+	}
+	candidates, err := repository.ListDueReconcile(context.Background(), now.Add(time.Hour), 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(candidates) != 1 || candidates[0].FailureCount != 1 {
+		t.Fatalf("operation timeout did not persist retry state: %+v", candidates)
+	}
+}
+
 func openRepository(t *testing.T, path string) *store.SQLite {
 	t.Helper()
 	repository, err := store.OpenSQLite(context.Background(), "file:"+filepath.ToSlash(path))