refactor: migrate scneario tests

[jinoosss]

Descriptions

Target directory layout (new under scenario/union/)

dir	theme
receive/, send/ (existing)	core token mint / lock flows — a few legacy extras fold in here
client/ (existing)	client lifecycle — add real-cometbls create/update variants
proof/ (new)	light-client membership / non-membership proof verification + error cases
handshake/ (new)	connection / channel open handshake + handshake-proof error cases
batch/ (new)	batch recv, batch acks, large/nested batch
forward/ (new)	forward single/multihop, forward timeout, in-flight tracking, allow-impl deny
intent/ (new)	proofless intent recv, market-maker fill, call dispatch/rejection
settlement/ (new)	ack / timeout / refund / fee / conservation / idempotency lifecycles
decimals/ (new)	decimal-scaling invariants
ratelimit/ (new)	rate-limit isolation, salt dedup
upgrade/ (new)	impl upgrade continuity, bootstrap policy, impl isolation
config/ (new)	impl registration / config introspection

---

Mapping tables

→ proof/ (light-client proof verification)

#	source (realcometbls/scenarios)	target	cat	verifies
1	z33_real_cometbls_membership_fixture	verify_membership_by_real_cometbls_filetest.gno	normal	a valid synthetic membership proof verifies
2	z34_real_cometbls_non_membership_fixture	verify_non_membership_by_real_cometbls_filetest.gno	normal	a valid synthetic non-membership proof verifies
3	z43a_verify_membership_empty_proof	reject_membership_empty_proof_filetest.gno	exception	nil/empty proof rejected
4	z43b_verify_membership_proof_count_mismatch	reject_membership_proof_count_mismatch_filetest.gno	exception	proof count ≠ spec count rejected
5	z43d_verify_non_membership_first_proof_not_nonexistence	reject_non_membership_first_proof_not_absence_filetest.gno	exception	first proof must be a non-existence proof
6	z43e_verify_membership_subroot_mismatch	reject_membership_subroot_mismatch_filetest.gno	exception	computed subroot ≠ spec rejected
7	z43f_verify_membership_malformed_proof	reject_membership_malformed_proof_filetest.gno	exception	unmarshalable proof bytes rejected
8	z43g_verify_membership_final_root_mismatch	reject_membership_root_mismatch_filetest.gno	exception	final root ≠ consensus root rejected
9	z43h_verify_membership_wrong_key	reject_membership_wrong_key_filetest.gno	exception	key ≠ proof key rejected
10	z43i_verify_membership_wrong_value	reject_membership_wrong_value_filetest.gno	exception	value ≠ proof value rejected
11	z44a_verify_membership_frozen_client	reject_membership_frozen_client_filetest.gno	exception	frozen client cannot verify (ties to AGENTS.md status-guard)
12	z44b_verify_membership_expired_client	reject_membership_expired_client_filetest.gno	exception	expired client cannot verify
13	z44c_verify_membership_missing_height	reject_membership_missing_height_filetest.gno	exception	no consensus at height rejected

→ handshake/ (open handshake + proof errors)

#	source	target	cat	verifies
14	realcometbls/scenarios/z35_open_channel	open_channel_by_real_cometbls_filetest.gno	normal	connection+channel open over a real cometbls client
15	z42a_channel_open_ack_wrong_counterparty_id	reject_channel_ack_wrong_counterparty_filetest.gno	exception	channel-ack proof for wrong counterparty id rejected
16	z42b_channel_open_ack_wrong_version	reject_channel_ack_wrong_version_filetest.gno	exception	unsupported channel version rejected
17	z42c_connection_open_ack_wrong_counterparty_id	reject_connection_ack_wrong_counterparty_filetest.gno	exception	connection-ack proof for wrong counterparty id rejected
18	z42d_channel_open_ack_stale_state	reject_channel_ack_stale_state_filetest.gno	exception	channel-ack proof value mismatch (stale) rejected

→ client/ (existing)

#	source	target	cat	verifies
19	z31_real_cometbls_create_update	create_and_update_client_by_real_cometbls_filetest.gno	normal	real cometbls create + update advances height/timestamp
20	z32_real_cometbls_rejects_bad_header	reject_update_bad_header_by_real_cometbls_filetest.gno	exception	tampered header rejected (cometbls: … invalid proof)

→ batch/ (new)

#	source	target	cat	transport / phase	verifies
21	e2e/scenarios/z24_v1_recv_batch_token_order_and_call	recv_batch_token_order_and_call_filetest.gno	normal	mock · A	batch (TokenOrder+Call) dispatches both children, mints + calls
22	e2e/scenarios_batchsend/z26_batch_acks_event	batch_acks_event_filetest.gno	normal	mock · A	async app + BatchAcks writes collective ack, emits events
23	e2e/scenarios_batchsend/zs89_large_batch_current_behavior	large_batch_and_nested_rejection_filetest.gno	variant	mock · A	flat 8-child batch allowed; nested batch child rejected
24	realcometbls/scenarios/z40a_recv_batch_mixed_call_token_order	recv_batch_mixed_call_and_token_by_real_cometbls_filetest.gno	normal	real cometbls · C	mixed batch: call succeeds, token order fails, ack reflects both
25	realcometbls/scenarios/z40b_recv_batch_child_panic_only_maker_propagates	recv_batch_child_panic_only_maker_by_real_cometbls_filetest.gno	variant	real cometbls · C	call-child panic contained; token order ONLY_MAKER ack propagates

→ forward/ (new)

#	source	target	cat	verifies
26	e2e/scenarios_batchsend/z25_forward_allowedimpls_positive	forward_call_creates_child_filetest.gno	normal	forward(Call) creates child packet, parent ack deferred (in-flight)
27	e2e/scenarios_batchsend/z41_forward_multihop_roundtrip	forward_multihop_roundtrip_filetest.gno	normal	multihop forward; child ack hash propagates to parent
28	e2e/scenarios_batchsend/zs54_forward_child_timeout_parent_failure_ack	forward_child_timeout_parent_failure_filetest.gno	variant	child timeout writes parent UNIVERSAL_ERROR ack; dup timeout noop
29	e2e/scenarios_denyimpl/z26_forward_allowedimpls_negative	reject_forward_unauthorized_impl_filetest.gno	exception	// Error: zkgm: caller is not an authorized impl for set in-flight packet: …/v1
30	e2e/scenarios_direct/z1_inflight_events	inflight_packet_events_filetest.gno	normal	SetInFlight/PopInFlight + ZkgmForwardInFlightSet/Popped events

→ intent/ (new)

#	source	target	cat	transport / phase	verifies
31	e2e/scenarios/z27_intent_recv_call_misdispatch	reject_intent_call_misdispatch_filetest.gno	variant	mock · A	forged OP_CALL via intent recv fails closed (ONLY_MAKER), never reaches handler
32	e2e/scenarios_direct/zs24_market_maker_fill_settlement	market_maker_fill_settlement_filetest.gno	normal	mock · A	intent fill by maker, proven ack settles base transfer to maker
33	e2e/scenarios_direct/zs86_intent_frontrun_and_call_failclosed	intent_frontrun_and_call_failclosed_filetest.gno	variant	mock · A	intent token-order fill preempts proven recv; intent call fails closed
34	realcometbls/scenarios/z39a_recv_call_dispatches_via_real_lc	recv_call_dispatches_to_receiver_by_real_cometbls_filetest.gno	normal	real cometbls · C	recv(Call) dispatches to registered receiver, writes receipt/ack
35	realcometbls/scenarios/z39b_recv_call_unregistered_receiver	recv_call_unregistered_receiver_by_real_cometbls_filetest.gno	variant	real cometbls · C	call to unregistered receiver: no panic, ack still issued
36	realcometbls/scenarios/z39c_recv_call_receiver_panic_only_maker	recv_call_receiver_panic_only_maker_by_real_cometbls_filetest.gno	variant	real cometbls · C	receiver panic contained; receipt/ack still issued

→ settlement/ (new)

#	source	target	cat	transport / phase	verifies
37	e2e/scenarios_direct/zs21_lock_mint_unescrow_unlock_conservation	roundtrip_conservation_filetest.gno	normal	mock · A	lock→mint→unescrow→unlock preserves 40 units across channels/native
38	e2e/scenarios_direct/zs22_fee_distribution	fee_distribution_on_recv_filetest.gno	normal	mock · A	escrow recv 100→88/12 split; unescrow recv 55→50/5 split
39	e2e/scenarios_direct/zs23_ack_failure_refund_success_settlement	ack_failure_refund_and_success_settlement_filetest.gno	variant	mock · A	failure ack refunds escrow to sender; success ack settles
40	e2e/scenarios_direct/zs64_voucher_asymmetry_origin_halt_no_recovery	origin_halt_voucher_asymmetry_filetest.gno	variant	mock · A	halted origin: voucher burned but release stuck; native/voucher asymmetry
41	e2e/scenarios_batchsend/zs11_handshake_send_recv_ack_success	send_recv_ack_lifecycle_filetest.gno	normal	mock · A	full open→send→recv(mint)→ack(clear commitment) lifecycle
42	e2e/scenarios_batchsend/zs13_initialize_escrow_voucher_lifecycle	initialize_then_escrow_voucher_lifecycle_filetest.gno	normal	mock · A	initialize mints 33, escrow adds 21; origin tracking
43	e2e/scenarios_batchsend/zs14a_duplicate_success_recv_noop	duplicate_recv_noop_filetest.gno	variant	mock · A	duplicate recv is idempotent (receipt/ack/balance unchanged)
44	e2e/scenarios_batchsend/zs14b_ack_timeout_noops	ack_timeout_idempotency_filetest.gno	variant	custom-LC · A	dup ack, timeout-after-ack, ack-after-timeout all noop
45	e2e/scenarios_batchsend/z23_v1_token_order_roundtrip	token_order_roundtrip_filetest.gno	normal	mock · A	send→recv→ack roundtrip mints wrapped voucher (overlaps receive/send)
46	e2e/scenarios_batchsend/z21_v1_create_client_handshake_send	handshake_and_send_filetest.gno	normal	mock · A	create client + handshake + first BatchSend (overlaps client/send)
47	realcometbls/scenarios/z38a_recv_packet_receipt_dup_guard	idempotent_recv_receipt_guard_by_real_cometbls_filetest.gno	variant	real cometbls · C	duplicate PacketRecv blocked by receipt guard
48	realcometbls/scenarios_batchsend/z36_real_cometbls_ack_token_order	ack_releases_to_maker_by_real_cometbls_filetest.gno	normal	real cometbls · C	proven ack releases voucher to maker, clears commitment
49	realcometbls/scenarios_batchsend/z37_real_cometbls_timeout_non_membership	timeout_refunds_sender_by_real_cometbls_filetest.gno	normal	real cometbls · C	non-membership timeout returns escrow to sender, clears commitment
50	realcometbls/scenarios_batchsend/z38b_ack_double_ack_noop	double_ack_noop_by_real_cometbls_filetest.gno	variant	real cometbls · C	second ack is a no-op
51	realcometbls/scenarios_batchsend/z38c_timeout_after_ack_noop	timeout_after_ack_noop_by_real_cometbls_filetest.gno	variant	real cometbls · C	timeout after ack is a no-op
52	realcometbls/scenarios/z35_real_cometbls_recv_token_order	recv_token_order_by_real_cometbls_filetest.gno	normal	real cometbls · C	token-order recv over a genuine cometbls membership proof

→ decimals/ (new)

#	source	target	cat	verifies
53	e2e/scenarios_direct/zs25_18dec_no_scaling	recv_18dec_no_scaling_filetest.gno	variant	18-dec (wei) initialize/unescrow with no amount scaling
54	e2e/scenarios_direct/zs26_6dec_native_out_no_scaling	send_6dec_native_no_scaling_filetest.gno	variant	native 6-dec send escrow preserves exact amount

→ ratelimit/ (new)

#	source	target	cat	verifies
55	e2e/scenarios_direct/zs88_recv_path_ignores_send_rate_limit	recv_ignores_send_rate_limit_filetest.gno	variant	recv mint bypasses send-side token-bucket rate limit
56	e2e/scenarios/zs87_salt_dedup	recv_salt_dedup_filetest.gno	variant	same sender+salt → same commit (dedup); different salt → distinct receipt

→ config/ (new)

#	source	target	cat	verifies
57	e2e/scenarios_direct/zs33_v1_registration_config	impl_registration_config_filetest.gno	normal	v1 register: bootstrapped, impl path, empty allowlist defaults

→ upgrade/ (new)

#	source	target	cat	verifies
58	upgrade/zs31_impl_upgrade_continuity	state_survives_impl_upgrade_filetest.gno	normal	channel + voucher balances persist across an impl upgrade
59	upgrade/zs32_allowed_impl_upgrade_path	allowed_impl_upgrade_path_filetest.gno	normal	allowed impl self-registers and clears predecessor from allowlist
60	upgrade/zs36_inflight_completion_after_upgrade	inflight_completes_after_upgrade_filetest.gno	normal	in-flight packet stored pre-upgrade pops intact post-upgrade
61	upgrade/zs33_prod_impl_empty_allowed_bootstrap	bootstrap_prod_impl_empty_allowlist_filetest.gno	normal	production impl bootstraps with an empty allowlist
62	upgrade/zs32_removed_allowed_impl_rejected	reject_removed_allowed_impl_filetest.gno	exception	// Error: permission denied for prev realm: …/testing/candidate
63	upgrade/zs32_unallowed_impl_rejected	reject_unallowed_impl_filetest.gno	exception	// Error: permission denied for prev realm: …/testing/not-allowed
64	upgrade/zs33_bootstrap_outside_namespace_rejected	reject_bootstrap_outside_namespace_filetest.gno	exception	// Error: zkgm: bootstrap not permitted for caller: gno.land/r/not-onbloc/…
65	upgrade/zs33_bootstrap_nil_impl_rejected + bootstrap_nil/z1_bootstrap_nil_impl (duplicate)	reject_bootstrap_nil_impl_filetest.gno	exception	// Error: zkgm: bootstrap UpdateImpl must install an impl (consolidate the two)
66	impl_isolation/z50_impl_direct_construct	reject_foreign_impl_construct_filetest.gno	exception	// Error: cannot allocate …/v1.ZkgmV1 in realm … (Gno Phase 3 isolation)
67	impl_isolation/z51_impl_new	reject_impl_new_unauthorized_filetest.gno	exception	// Error: not allowed (impl.New caller auth)

Fixture-only sources — NOT rewritten as scenarios

These print packet commitments / ack bytes to seed other tests; they are data
generators, not behavior tests. Their logic is inlined into the consuming proof
tests rather than ported as standalone files.

source	disposition
realcometbls/scenarios/z39_fixture_inputs	inline into the intent/ real-cometbls call tests (#34–36)
realcometbls/scenarios/z40_fixture_inputs	inline into the batch/ real-cometbls tests (#24–25)
realcometbls/scenarios_batchsend/packet_lifecycle_fixture_inputs	inline into the settlement/ real-cometbls ack/timeout tests (#48–51)

---

Notes, duplicates, and overlaps

• Exact duplicate: bootstrap_nil/z1_bootstrap_nil_impl ≡
  upgrade/zs33_bootstrap_nil_impl_rejected — consolidated into a single file (doc: packet send guide #65).
• Overlaps with existing active tests (kept for their distinct assertion, noted
  in each file's doc comment): Fix core batch port ownership #37 zs21 and bytes-to-string encoding in packet events #45 z23 overlap
  receive/mint_wrapped_voucher_by_ucs03_zkgm and the send/ lock tests, but add
  conservation / roundtrip / fee-split assertions the active tests don't make. zkgm: salt is not hashed with sender, causing packet hash mismatch with Union and salt-stealing risk #46
  z21 overlaps client/ + send/. If the maintainer prefers, these three can be
  folded into the existing receive//send//client/ files as extra scenarios
  instead of new settlement/ files.
• z22_v1_recv_packet_dispatches_token_order is the closest pure duplicate of
  receive/mint_wrapped_voucher_by_ucs03_zkgm (it only adds a relayer fee-split
  assertion). It is folded into settlement/fee_distribution_on_recv (fix(core): enforce ICS-04 packet timeout checks #38) rather
  than given its own file.
• Phase C gating: every by_real_cometbls target (proof/, handshake/, client/
  real-cometbls, and the real-cometbls rows of settlement/ batch/ intent/) is blocked
  on porting the synthetic-proof builders into the active
  scenario/helper/cometbls realm. Track that as a prerequisite task.

⚠️ API reality check (bit-rot) — read before rewriting

The legacy suite was written against an older API surface that has since been
removed, renamed, or made internal. A symbol-existence sweep of the active tree
(excluding ignore/ and _test.gno) found:

Present (portable): core.IntentPacketRecv, core.BatchAcks,
zkgm.RegisterReceiver, z.DeriveSenderSalt, z.PredictWrappedTokenV2,
core.PacketRecv/Acknowledgement/Timeout, zkgm.Send, zkgm.VoucherBalanceOf,
zkgm.SetRateLimitDisabled.

Absent (removed / internalized / renamed): zkgm.SetInFlightPacket,
zkgm.NewInFlightKey/Value, zkgm.PopInFlightPacket, zkgm.GetInFlightPacket
(forward in-flight pokes), zkgm.SetTokenBucket (rate-limit setter),
zkgm.GetTokenOrigin, zkgm.VoucherDecimalsOf, core.HasPacketReceipt/
HasAcknowledgement/HasPacketCommitment, zkgm.SetChannelBalanceV2,
nonimpl.ReleaseNative. The entire allowed-impls upgrade model is gone:
zkgm.NewUpdateRequest, zkgm.Bootstrapped, zkgm.ImplPath, zkgm.AllowedImpls,
zkgm.InAllowedImpls, zkgm.ProductionImplPath, impl.Register, impl.New.
The current upgrade surface is only zkgm.UpdateImpl(cur, path string) (admin-gated,
requires a constructor registered via the impl's init → RegisterImpl) — no
allowlist, no namespace bootstrap check at update time, no introspection getters.

Consequence for the mapping. Three buckets:

1. Portable as-is — behavior + API still exist. Rewrite faithfully. Covers most
   recv/ack/intent/batch/salt flows: fixtures: automate generated byte literals in realcometbls/fixtures.gno via go generate #21, refactor(ibc-core)!: align v1 core with union spec #22, Fix/issue 29 drop cometbls wrapper #31, refactor: remove ibcv2 zkgm stack #32, Simplify combined field/wire-type switch cases in cometbls proof decoder #33, Fix core batch port ownership #37–Make params store readable so the batch state map mirror can be removed #43, bytes-to-string encoding in packet events #45, ci: add gnokey query smoke test against live gnodev #56, and
   the real-cometbls behavior tests if the helper is ported (Phase C).
2. Re-targetable — behavior still exists but the legacy introspection/poke API
   was removed; verify the same behavior via current APIs (e.g. idempotency via
   core.GetBatchReceipts instead of HasPacketReceipt; forward end-to-end via a
   PacketRecv of a forward instruction instead of SetInFlightPacket pokes; decimals
   via balance-diff instead of VoucherDecimalsOf). NOT strictly 1-to-1. Covers
   feat(lightclient): add state-lens ICS23 MPT light client #26–Reconsider cometbls client/consensus state encoding #30 (forward), Add path-keyed sibling queries: QueryCommitmentAtPath / QueryReceiptAtPath #44, fix(core)!: emit packet_data/acknowledgement as hex #47–Register calibrated gas costs for project native bindings #51, Feat/protobuf gen #53–feat(core): add QueryCommitmentAtPath / QueryReceiptAtPath #55.
3. Obsolete model — not portable — the behavior under test no longer exists.
   The allowed-impls upgrade suite and the registration-config introspection:
   Packet acknowledgement clears per-packet commitment mirror while batch commitment state is inconsistent #57 (config), ZKGM native refund can fail during core acknowledgement callback due to impl caller check #58–doc: packet send guide #65 (upgrade allowed-impls/bootstrap-policy), refactor(core): split IBC handlers and harden MPT decoding #67 (impl.New).
   These cannot be rewritten 1-to-1. Options: (a) drop; (b) re-design a small
   upgrade/ suite for the current model (normal: admin re-points UpdateImpl to a
   registered path and state persists; exception: non-admin UpdateImpl → access
   denied; exception: UpdateImpl to an unregistered path → impl constructor not found; exception: re-RegisterImpl → impl already registered). feat(ci): implement auto-labeling for pull requests based on linked issues #66
   (z50 foreign-impl alloc) likely still holds as a Gno Phase-3 guarantee and can be
   kept as an exception test.

Recommendation: rewrite buckets 1 and 2 (re-targeting pokes to current
behavior-level APIs), redesign bucket 3 into a current-model upgrade/ suite, and
gate all real-cometbls files (Phase C) on porting the synthetic-proof helper.

Phase C status update (helper ported, adapter API gone)

• Done: the synthetic-proof helper was ported to the active tree at
  gno.land/r/onbloc/ibc/scenario/helper/realcometbls (copied setup.gno +
  fixtures.gno, fixed the one bit-rotted ref zkgm.ProductionImplPath() → the v1
  impl path, repointed the helper's own code-realm path). It compiles (gno test
  → [no test files]). The real cometbls light-client p-package
  (p/.../lightclient/cometbls: ClientType, Decode*State, NewCometblsLightClient)
  is intact.
• New blocker: the legacy proof/ and handshake/ tests call a direct adapter
  realadapter "gno.land/r/onbloc/ibc/lightclients/cometbls" →
  NewAdapter(cur).VerifyMembership(clientId, height, proof, key, value). That realm
  and the NewAdapter/direct-VerifyMembership API do not exist in the active tree
  (the only active cometbls adapter realm is union/lightclients/cometbls, which
  exposes just RegisterClient). There is no supported way to call a client's
  VerifyMembership directly from a test anymore.
• Consequence: the proof/ (wip: copy from unionlabs/union/gnoland #1–13) and proof-error handshake/ (ics23: NonExistenceProof verification panics on malformed input #15–18) tests are
  bucket 2 / re-target, not 1-to-1. Membership / non-membership verification must be
  exercised through core — e.g. a core.PacketRecv whose crafted proof fails
  verification makes core panic — rather than by poking the adapter. The synthetic
  fixtures in the ported helper provide the proof/key/value bytes, but slotting them
  into a full PacketRecv (with matching packet commitment + channel) is a non-trivial
  redesign per test. Real-cometbls behavior tests that already go through core
  (z35_recv_token_order, z36/z37 ack/timeout, z39a-c call dispatch, z40a/b
  batch) are the more tractable Phase-C starting point.
• Confirmed blocker (token flows). The helper port works and the cometbls channel
  opens (verified: source=2/destination=1), but a packet receive aborts with
  packet timeout expired: the Z3x packet-commitment proof fixtures were generated for
  packets with timeoutTimestamp = 0, which the current model treats as already
  expired, and changing the timeout invalidates the fixture's commitment. Regenerating
  the fixtures needs a live devnet. So z35/z36/z37 and the real-cometbls token flows
  (test(zkgm): add handler/dispatch end-to-end scenario fixture generator #24–25, refactor(ibc): use pkg path as IBC port identifier #34–36, fix(core)!: emit packet_data/acknowledgement as hex #47–52) are blocked until those timeout=0 fixtures are regenerated
  (matches the prior finding "cometbls token flows blocked by bit-rotted timeout=0
  fixtures"). Together with the removed direct adapter (proof/ wip: copy from unionlabs/union/gnoland #1–13, handshake/
  ics23: NonExistenceProof verification panics on malformed input #15–18), Phase C is not rewritable as-is without fixture-regeneration / adapter work.

Obsolete — not rewritable (API/behavior removed)

Confirmed by direct inspection; documented here instead of rewritten:

source / target	reason
#57 config (zs33_v1_registration_config)	introspection getters Bootstrapped/ImplPath/AllowedImpls/InAllowedImpls removed; nothing to assert
#66 z50 (impl direct construct)	the impl type is now unexported (ucs03ZkgmV1); a foreign realm cannot name it, so there is no exported ZkgmV1 to construct — isolation is enforced by Go visibility now
#67 z51 (impl.New)	impl.New/impl.Register removed (replaced by UpdateImpl(path))
#55 zs88 (recv ignores send rate limit)	no exported token-bucket setter (SetTokenBucket is store-internal); only SetRateLimitDisabled is public, so a per-token bucket cannot be planted to test bypass
#29 z26_neg (forward allowedimpls negative)	the allowed-impls model was removed
#30 z1_inflight_events	the in-flight poke API (SetInFlightPacket/NewInFlightKey/PopInFlightPacket) was removed/internalized
forward/ #26–28 (z25/z41/zs54)	forward end-to-end is observed only via the removed in-flight getters (GetInFlightPacket/NewInFlightKey) + zkgm.ImplPath/core.HasAcknowledgement; the forward behavior still runs but is no longer observable from a test, so the whole forward/ category is blocked

The legacy allowed-impls upgrade suite (#58–65) is replaced by the current-model
upgrade/ tests (state-survives-reinstall + two rejections), not ported 1-to-1.