fix(auth): bound the per-user lock wait and make closure evidence attributable

[remyluslosius]

Partial. This PR lands part of the closure scope for bugs/OW-069 and bugs/doing/OW-073 and closes neither. Both close only against the single matrix in bugs/doing/OW-062 section 14.7, run as integrated acceptance on main. #878 merged as 6284496e; this PR is reconciled onto it and now targets main.

Changes

Credential operations are limited (C-43, AC-73, AC-81, AC-82). Two limits, and neither proves why a wait was long.

Limit	What it covers	What it does not cover
lock_timeout 5 s (LockWaitBound), set transaction-local by LockUser	Each lock acquisition in the transaction, separately, later implicit row locks included	Pool acquisition, the transaction as a whole, the request
Context deadline 15 s (OperationDeadline)	Starts at the identity binder. Covers cookie verification, and on the credential and account-mutation routes is handed to the handler, so its reads and its transaction (pool acquisition, statements, commit, retries) spend one budget. RunSerialized and the users service apply it again only as a ceiling. Never extends an earlier caller deadline	Handlers on other routes, which keep their own context (reports, the event stream)

Outcome	Answer
Per-user lock not acquired, any path but logout	503 server.error, retryable. Nothing changed
Per-user lock not acquired, logout	503 server.error, not retryable, cookies cleared, message names the account lock and says nothing was revoked
A later lock times out	Rolled back. Logout 500 auth.logout_incomplete; others 503 retryable. No message claims the account lock was not acquired
Deadline expires during a commit	Unknown outcome (ErrCommitUnknown), in RunSerialized and in the users service
Admin commit outcome unknown	503 server.error, not retryable, "may or may not have been applied", even when a deadline interrupted the commit
Admin transaction never began (no connection free before the deadline)	503 server.error, retryable, "could not start"
Admin deadline after the transaction began, before its commit	Rolled back; 503 server.error, retryable, "did not complete in time"

Admin failures are classified by the stage the transaction reached, with the commit stage tested first.

Cleanup (AC-91). The rollback after a failure runs on a context detached from the expired operation, keeping its values, with its own 2 s limit (RollbackCleanupLimit). Cleanup can therefore add up to 2 s beyond the 15 s operation deadline; it is not contained within it. Its result never changes the reported outcome: a transaction that never reached COMMIT cannot have committed, so an unconfirmed rollback leaves only lock release uncertain. A real rollback failure in the driver (backend terminated, SQLSTATE 57P01) closes the connection, shown against pgx v5.9.2 itself rather than a mock.

The admin mapping covers disable, enable, reset and soft delete. Soft delete now uses the shared mapping.

SSO audit reasons (system-sso C-05, AC-12, AC-13). A refused federated sign-in records sso_account_disabled or sso_account_deleted on both refusal paths. The sign-in page stays /login?sso_error=signin.

Audit contract (C-11, AC-80). auth.login.failure declared five reasons while the code records 36, and it sent three undeclared keys. The event now declares all of them. AC-80's source scan proves declared coverage only. Whether each request emits the right reason is asserted separately, by the request-correlated tests (AC-34, AC-36, AC-44, AC-54, AC-57, system-sso AC-12, AC-13).

Correlated audit reads (bugs/OW-075) and promoted regressions (AC-73 to AC-79) with writes attributed by row ID.

OpenAPI declares the 403, 500 and 503 responses these endpoints return.

OW-077: cookie verification is bounded (C-44, AC-83 to AC-88)

Found while testing this PR: the binder's idle slide waited without limit on a locked session row. GET /auth/me waited 12 s; logout about 21 s. Founder decision: bound the wait, do not skip the slide.

• The slide runs in its own short transaction with the per-lock limit, and its UPDATE re-checks revocation and both expiry deadlines. A session revoked or expired during the wait is refused with the reason the row now shows.
• A verification that cannot complete answers 503 server.error: no handler, no cookie change, no refresh.
• Logout verifies without sliding, then reaches its hash lookup, CSRF check and bounded revocation. Background requests stay non-sliding.

Committed admin changes and role lookups (1f08433)

A committed change is reported as committed (api-users C-08, AC-21). Disable and Enable used to commit, audit, then re-read the user; a failure of that read became "not applied", or 404 after a concurrent delete. DisableUser and EnableUser now read the user inside the locked transaction and return it only after the commit is confirmed. No read follows the commit.

A failed role lookup answers 503 (C-45, AC-92). The cookie binder mapped every role-lookup error to a refused credential (401). Only the confirmed identity.ErrNoRoles still refuses; any other error answers 503 role_lookup_unavailable, with no handler, no cookie change and no refresh. RolesForUser now checks rows.Err(), so an error that ends the rows is not an empty role list.

AC-91 asserts the driver's real rollback error, SQLSTATE 57P01.

Hosted failure on b0c3f09, kept as evidence

Go CI run 36081673305 failed four AC-73 cases. They answered at 15.0 s, and the logout case's fixture login got a 503. Two separate causes:

1. Fixture assumption. The eight cases ran in parallel on the test pool, whose default size follows the CPU count. On a small pool the lock holders starved the requests of connections, so they hit the operation deadline instead of the lock limit. I did not verify the runner's CPU count. Instead I reproduced the same signature locally by running the old parallel test on an explicit 4-connection pool. AC-73 and AC-81 now run one case at a time on a pool explicitly sized to 8, and each case confirms its connections are back before the next.
2. Production defect it exposed. When the deadline expired before an admin transaction began, the handler answered 500 "user operation failed", although nothing was applied. Fixed by the stage mapping above, covered by AC-90.

Also filed, not changed here

bugs/OW-076. authz.permission.denied sends undeclared actor_role and never sends its declared route.

Evidence

• Local, PostgreSQL 16 test database: go test -race -p 1 ./... passed (65 packages). make spec-check passed: 121 specs, structural coverage 100%. tsc --noEmit passed; Vitest passed 408 tests in 60 files.
• Mutation checks, each applied alone, restored and verified by file hash:

Mutation	Tests that went red
No lock limit	AC-73, every path
RunSerialized sets no deadline	AC-82 establishes a deadline
The deadline extends the caller's	AC-82 preserves the caller's deadline (identity), and the users-service AC-82
Admin lock-timeout mapping removed	AC-73 disable, enable, reset, soft delete; AC-81 disable
Soft delete back to its own 500	AC-73 soft delete
Logout timeout marked retryable	AC-73 logout
Logout treats any lock timeout as the account lock	AC-81 logout
55P03 not mapped to the typed error	AC-42 lock-timeout case
Login skips account state / password recheck / OTP	AC-77, AC-78; AC-78 reset; AC-76
Refresh skips the account-state check	None of the new tests (Disable also revokes the token); existing AC-41 catches it on both paths
SSO skips the state check / reasons collapsed	system-sso AC-10, AC-13 / AC-12, AC-13
Commit error swallowed	AC-79, AC-77
Bearer lookup failure answered 401	AC-36
Undeclared reason added	AC-80
Each asserted reason renamed	AC-44, AC-54, AC-57
Idle slide not revalidated	AC-85
Idle slide without the lock limit	AC-83
Logout slides	AC-86
Binder deadline not handed to the handler	AC-87 one budget
Binder verification with no deadline	AC-87 one budget
Background requests slide	AC-88
Users-service commit error unclassified	AC-89 durable and non-durable
Users-service transaction without a deadline	AC-89 default deadline
"Never began" not mapped	AC-90 pool exhausted, AC-90 mapping
Deadline tested before the uncertain commit	AC-90 mapping, AC-90 deadline during the commit
Begin failure not tagged as never began	AC-90 pool exhausted
Cleanup not detached from the expired context	AC-91 cleanup context
Cleanup drops the caller's values	AC-91 cleanup context
Cleanup with no deadline	AC-91 cleanup context
Cleanup limit above 2 s	AC-91 cleanup context
A failed cleanup downgrades an uncertain commit to "not applied"	AC-91 uncertain commit with failed cleanup
A failed cleanup upgrades a pre-commit failure to uncertain	AC-91 pre-commit with failed cleanup
Disable re-reads the user after the commit	api-users AC-21 disable
Enable re-reads the user after the commit	api-users AC-21 enable
Every role-lookup error treated alike	AC-92 lookup fails (the mutation authenticated the request with an empty role: 200)
rows.Err() not checked	AC-92 rows end with an error (a real canceled query surfaces at Query, so this case uses a querier seam)
The rollback error hidden	AC-91 real driver failure

Test gaps from the previous review, now closed: the users service's default deadline (AC-89) and HTTP handling of durable and non-durable unknown commits on an administrative mutation (AC-89).

Manual, reported separately: the structural review behind OW-062 AC-77. Every reachable write to sessions or refresh_tokens sits in the locked protocol, except the idle slide, which is now bounded and revalidating but still outside the per-user lock. This review is not enforcement of lock ordering.

make lint cannot run locally (pinned golangci-lint 1.64.8 against Go 1.26).

Refs: bugs/OW-069, bugs/doing/OW-073, bugs/OW-075, bugs/OW-076, bugs/OW-077, bugs/doing/OW-062 sections 14.7 and 14.8 and AC-54.