feat: suspend-account / reactivate-account operator verbs (#534)

[mforce]

What changed

• Added production-capable suspend-account and reactivate-account one-shot CLI verbs with optional reasons.
• Added lifecycle audit actions/system actors and writes audit rows in the suspension transaction only on real transitions.
• Added CLI, lifecycle, suspended-farm lock-sweep, and minimal-config coverage; translated audit labels and updated the glossary.

Verification

• dotnet restore Cluckwork.sln --locked-mode: All projects are up-to-date for restore.
• dotnet build Cluckwork.sln --configuration Release --no-restore: Time Elapsed 00:00:04.67
• dotnet test Cluckwork.sln --configuration Release --no-build --verbosity normal: Time Elapsed 00:01:48.34 (1390 tests passed)
• tools/schema-docs/generate.sh --check: docs/schema/ is up to date.
• cd web && npm run typecheck && npm run test:coverage && npm run build && npm run verify:sw: [service worker] dist/sw.js: /api and /health excluded from the navigation fallback, no runtime caching strategy, 22 shell entries precached and no API path among them. (1814 tests passed)

Mutation checks

Mutant	Observed result
M1 duplicate audit write	RED: Assert.Equal expected 1, actual 2 (AccountLifecycleCommandTests.cs:88); restored GREEN.
M2 revoke on active reactivation	RED: Assert.Equal expected 1, actual 0 (AccountLifecycleCommandTests.cs:124); restored GREEN.
M3 unknown suspend slug exits 0	RED: Assert.Equal expected 1, actual 0 (AccountLifecycleCommandTests.cs:140); restored GREEN.
M4 discard audit reason	RED: Assert.Equal expected non-payment drill, actual null (AccountLifecycleCommandTests.cs:69); restored GREEN.
M5 audit after commit	RED: Sequence contains no elements at the audit query (AccountLifecycleCommandTests.cs:64); restored GREEN. This proves the write must precede SaveChanges, and does not prove crash atomicity.
M6 skip suspended farms in lock sweep	RED: Assert.Equal expected Locked, actual Submitted (DailyEntryAdjustTests.cs:605); restored GREEN.

grep -rn "MUTANT" src/ tests/ printed two unrelated third-party DLL matches under ignored bin/; excluding bin and obj produced no source markers.

Closes #534

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 39346d7d55

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Skip the aggregate mutation for lifecycle no-ops

When reactivate-account is retried against an already-active farm, stateChanged is false but this branch still calls Reactivate(), which increments the account's concurrency-token Version before SaveChangesAsync. Consequently, despite reporting that nothing changed, the command invalidates versions held by active users and can make a subsequent Farm Settings save fail with Account.VersionMismatch; an already-suspended retry similarly increments the token. Gate the aggregate call on stateChanged while retaining the independent suspend revocation sweep.

AGENTS.md reference: AGENTS.md:L71-L71

Useful? React with 👍 / 👎.

[mforce]

Confirmed and fixed in a9e4d50b.

You are right about the mechanism: Account.Suspend()/Reactivate() bump Version unconditionally by design (#531, pinned by AccountSlugTests), and Version is the token UpdateFarmSettingsHandler.cs:22 compares a Farm Settings save against — so a no-op operator retry advanced it and the next save from anyone holding that form open failed with Account.VersionMismatch.

Fixed at the service rather than the aggregate, so "every aggregate mutation bumps Version" stays true — on a no-op there is now no mutation:

if (stateChanged)
{
    if (suspending)
        account.Suspend();
    else
        account.Reactivate();
}

The revoke sweep is deliberately not gated by this: a suspend-account re-run still re-revokes (owner decision for this slice), and it touches user and token rows, never the account row.

Verification, driver-run rather than quoted from the implementer:

• dotnet build Cluckwork.sln -c Release — 0 Warning(s), 0 Error(s).
• dotnet test Cluckwork.sln -c Release --no-build — 1886 passed / 0 failed (integration 1390 -> 1394).
• Mutation: removing the new gate turns ReactivateVerb_OnAnAlreadyActiveFarm_DoesNotAdvanceTheFarmSettingsVersion red (Assert.Equal() Failure: Values differ); restored, rebuilt, green.
• Mutation: revokeSessions = suspending || stateChanged -> = stateChanged now kills exactly one test of 26 across both suspension suites. Before this round it killed none — that gap was found by mutation, not by review, and SuspendVerb_RunAgainstAnAlreadySuspendedFarm_StillRevokesALiveSession closes it.

[mforce]

Review round 1 pushed: a9e4d50bbbde728799614cccd6cda4c94f9ea650

• Gate account aggregate lifecycle calls on stateChanged, preserving Account.Version for no-op suspend/reactivate retries while keeping the suspend re-revoke sweep unconditional.
• Add lifecycle CLI coverage for re-revocation, no-op version preservation, both missing-slug verbs, reactivation audit actor/reason, unknown-slug state/version preservation, and invariant uppercase slug lookup.

Verification: Release build clean; full suite 1394/1394 passed. All four prescribed mutants compiled and were killed.

[mforce]

@codex the Account.Version finding is addressed in a9e4d50b — the aggregate mutation is now gated on the pre-mutation transition check, so a no-op suspend-account / reactivate-account retry no longer advances the token a Farm Settings save is compared against. Details and the mutation evidence are on the original thread.

The same commit closes five test gaps found in the same round: the suspend re-run’s re-revoke, the reactivate audit row’s system actor and --reason, the unknown-slug test’s previously unfalsifiable "changed nothing" assertions, the uppercase-slug fold, and the missing---slug guard on the reactivate verb.

Driver-run verification at a9e4d50b: build 0 warnings / 0 errors, 1886 tests passed / 0 failed, and every mutation for this round red on its named test then green after restore.

Please re-review at a9e4d50b — the previous round hit your security-review usage limit, so that pass was partial.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: a9e4d50bbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mforce]

Review round 2 test-only increment: 124fe78

Verification (dotnet build Cluckwork.sln --configuration Release --no-restore):

Build succeeded.
    0 Warning(s)
    0 Error(s)
Time Elapsed 00:00:01.56

Verification (dotnet test Cluckwork.sln --configuration Release --no-build --verbosity normal):

Test Run Successful.
Total tests: 1394
     Passed: 1394
 Total time: 1.7594 Minutes
Build succeeded.
    0 Warning(s)
    0 Error(s)
Time Elapsed 00:01:46.02

Mutation R2-M1 killed: changing if (stateChanged) to if (stateChanged || suspending) compiled, then SuspendVerb_RunTwice_ExitsZero_AndWritesNoSecondAuditRow failed its new version assertion (Expected: 1, Actual: 2, line 106). Restored the production file, touched it, rebuilt cleanly, re-ran the focused test green, and grep -rn "MUTANT" src/ tests/ --include='*.cs' returned no matches.

[mforce]

@codex your last pass was clean against a9e4d50b, but the head has moved to 124fe78a since — please re-review at the current head.

124fe78a is test-only. Round 2 found that the round-1 fix gates the aggregate mutation symmetrically for suspend and reactivate, while only the reactivate side was pinned: a stateChanged || suspending mutant around that gate passed the entire suite. SuspendVerb_RunTwice_ExitsZero_AndWritesNoSecondAuditRow now also asserts Account.Version is unchanged across the second run, and that mutant dies on the new assertion (Expected: 1, Actual: 2).

Driver-run verification at 124fe78a: build 0 warnings / 0 errors, 1886 tests passed / 0 failed.

Also for the record, since it is visible in this diff and is deliberate: the check-then-mint window in login (a suspension committing between the IsActive check and token issuance) is NOT closed here. It was declined in #532 on login-hot-path cost, the credential it produces is inert, and it is now tracked as #579 rather than being silently dropped from #534.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 124fe78a3f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mforce]

Review loop stopped deliberately at 3 rounds. Recording that here so the quiet is not read as an unfinished response.

Count, by confirmed defects in product code:

Round	Head	Product defects	What it found
1	39346d7d	1	Account.Version bumped on a no-op run, breaking open Farm Settings saves (codex). Plus 5 test gaps, and 2 findings rejected with evidence.
2	a9e4d50b	0	The round-1 fix was symmetric but only pinned on the reactivate side — a stateChanged || suspending mutant passed the whole suite. Test-only fix.
3	124fe78a	0	Codex clean at the current head; no line-level findings.

Two consecutive rounds yielding no defect in shipped code is the stop point, so I am not tagging for further rounds. Four reviewers ran across the loop: the Codex connector, two independent agents briefed on distinct defect classes (invariants; false-green/deletable-guard), and a local review model.

Final state, driver-verified rather than quoted from the implementer:

• dotnet build Cluckwork.sln -c Release — 0 Warning(s), 0 Error(s).
• dotnet test Cluckwork.sln -c Release --no-build — 1886 passed / 0 failed.
• 9 mutations run and re-run by the driver; each died on its named test and went green after restore, with the tree verified clean afterwards. The one mutation that survived (round 1: revokeSessions weakened so a suspend re-run stops revoking) is what produced SuspendVerb_RunAgainstAnAlreadySuspendedFarm_StillRevokesALiveSession, and it now dies.
• Deliberately not delivered here and tracked instead: the login check-then-mint window, now Suspension: login can still mint an inert credential in the check-then-mint window #579.

Not merging this myself — that is the owner’s call.