fix(guard): consume the override sentinel as it's honored

One touch buys exactly one transaction. The maintenance console's forced live update sets the sentinel and clears it afterward, but a caller that dies mid-update would leave the file behind and keep the guard disarmed until reboot. The hook now deletes the sentinel at the moment it honors it, so a missed cleanup costs nothing. The env override is unchanged, and the caller's clear step stays as the belt-and-suspenders for transactions the hook never fires on.

1 files changed, 19 insertions, 0 deletions

diff --git a/tests/hypr-live-update-guard/test_hypr_live_update_guard.py b/tests/hypr-live-update-guard/test_hypr_live_update_guard.py
index 578edc7..a6c6f68 100644
--- a/tests/hypr-live-update-guard/test_hypr_live_update_guard.py
+++ b/tests/hypr-live-update-guard/test_hypr_live_update_guard.py
@@ -137,6 +137,25 @@ class HyprLiveUpdateGuard(unittest.TestCase):
             r = run_guard(stdin="mesa\n", running="1", sentinel=f.name)
             self.assertEqual(r.returncode, 0, r.stderr)
 
+    def test_sentinel_is_consumed_on_use(self):
+        # one touch = one transaction: if the override's cleanup never runs
+        # (a crashed caller), a leftover sentinel must not keep the guard
+        # disarmed until reboot — the hook deletes it as it honors it
+        fd, path = tempfile.mkstemp(prefix="guard-allow-")
+        os.close(fd)
+        try:
+            r = run_guard(stdin="mesa\n", running="1", sentinel=path)
+            self.assertEqual(r.returncode, 0, r.stderr)
+            self.assertFalse(os.path.exists(path))
+        finally:
+            if os.path.exists(path):
+                os.unlink(path)
+
+    def test_env_override_consumes_nothing(self):
+        # the env override isn't a file; nothing to consume, still proceeds
+        r = run_guard(stdin="mesa\n", running="1", allow="1")
+        self.assertEqual(r.returncode, 0, r.stderr)
+
     def test_override_env_zero_does_not_bypass(self):
         r = run_guard(stdin="mesa\n", running="1", allow="0")
         self.assertEqual(r.returncode, 1, r.stderr)