fix(calendar-sync): run the sync from a timer instead of the agenda hook

The hourly timer armed itself from org-agenda-mode-hook, so a session where
I never opened the agenda never synced at all. After a reboot that is every
session until the first agenda call. I found it with all three calendar
files still frozen at the pre-reboot write, five hours stale.

The deferral had a real reason. Feed URLs behind :secret-host live in
authinfo.gpg, and starting at load would prompt for a passphrase on a cold
gpg-agent. The cost was worse than what it bought.

A user timer owns the schedule now, every ten minutes.
calendar-sync-auto-start defaults to nil so the editor no longer arms its
own. scripts/calendar-sync-run is the batch entry point, and it blocks
until every calendar leaves the syncing state. The pipeline is asynchronous
end to end, so a batch Emacs that returns early exits zero having written
nothing.

Installing it on a machine that resolves its feeds through :secret-host
surfaced two bugs the inline-url machine could never show:

- cj/auth-source-secret-value called auth-source-search behind nothing but
  a declare-function, which quiets the compiler and loads nothing. An
  interactive Emacs always has auth-source in by the time anyone calls, so
  the omission stayed invisible until a batch -Q sync died on a void
  function. The require is guarded on fboundp. An unconditional one reloads
  auth-source over whatever is already there, which replaced a caller's
  stubbed search mid-call and sent an existing test out to the real
  authinfo.

- A synchronous failure in one calendar aborted the whole loop. The async
  callbacks record their own failures, but they never run when the error
  lands before a process starts. Resolving a :secret-host feed signals
  outright on a cold agent. Failures are contained per calendar now, so one
  bad feed no longer costs the other two.

A failed row prints the reason it recorded. Batch Emacs discards the
*Messages* buffer the interactive path logs to, so without it the journal
shows only "error", with no way to tell a cold agent from a revoked token.

7 files changed, 457 insertions, 0 deletions

diff --git a/tests/test-calendar-sync--batch-failures.el b/tests/test-calendar-sync--batch-failures.el
new file mode 100644
index 00000000..3190be21
--- /dev/null
+++ b/tests/test-calendar-sync--batch-failures.el
@@ -0,0 +1,47 @@
+;;; test-calendar-sync--batch-failures.el --- Batch failure filter tests  -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; `calendar-sync--batch-failures' picks the rows that did not finish cleanly.
+;; The batch runner's exit code is derived from it, and systemd reads that exit
+;; code, so the rule is deliberately strict: only `ok' passes.  A calendar left
+;; `syncing' at the timeout, or one that never started, is a failure -- both
+;; states mean the org file on disk is not the calendar's current contents,
+;; which is exactly the silent staleness the timer exists to prevent.
+
+;;; Code:
+
+(require 'ert)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+(require 'calendar-sync)
+
+(ert-deftest test-calendar-sync-batch-failures-keeps-only-non-ok ()
+  "Normal: an errored calendar is returned and a healthy one is not."
+  (should (equal (calendar-sync--batch-failures
+                  '(("google" . ok) ("proton" . error)))
+                 '(("proton" . error)))))
+
+(ert-deftest test-calendar-sync-batch-failures-all-ok-is-empty ()
+  "Normal: a fully successful run reports no failures."
+  (should (equal (calendar-sync--batch-failures
+                  '(("google" . ok) ("proton" . ok)))
+                 '())))
+
+(ert-deftest test-calendar-sync-batch-failures-empty-input-is-empty ()
+  "Boundary: no rows in, no rows out."
+  (should (equal (calendar-sync--batch-failures '()) '())))
+
+(ert-deftest test-calendar-sync-batch-failures-timeout-counts-as-failure ()
+  "Error: a calendar still `syncing' when the wait expired is a failure.
+Its org file was not rewritten, so reporting success would hide the staleness."
+  (should (equal (calendar-sync--batch-failures
+                  '(("google" . ok) ("proton" . syncing)))
+                 '(("proton" . syncing)))))
+
+(ert-deftest test-calendar-sync-batch-failures-never-counts-as-failure ()
+  "Error: a calendar that never started is a failure, not a skip."
+  (should (equal (calendar-sync--batch-failures '(("google" . never)))
+                 '(("google" . never)))))
+
+(provide 'test-calendar-sync--batch-failures)
+;;; test-calendar-sync--batch-failures.el ends here
diff --git a/tests/test-calendar-sync--batch-report.el b/tests/test-calendar-sync--batch-report.el
new file mode 100644
index 00000000..12811200
--- /dev/null
+++ b/tests/test-calendar-sync--batch-report.el
@@ -0,0 +1,89 @@
+;;; test-calendar-sync--batch-report.el --- Batch report output tests  -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; `calendar-sync-batch-run-and-report' is what the systemd timer runs, so its
+;; printed rows are the only record that survives the process.  Batch Emacs
+;; discards *Messages* at exit, which is where the interactive failure path
+;; logs its reason -- so a failed row has to carry its recorded `:last-error'
+;; in the printed output or the journal shows "error" with no way to tell a
+;; cold gpg-agent from a revoked feed token or a dead network.
+
+;;; Code:
+
+(require 'ert)
+(require 'cl-lib)  ;; cl-letf; calendar-sync pulls it in transitively, don't rely on that
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+(require 'calendar-sync)
+
+(defun test-calendar-sync-batch-report--capture (states results)
+  "Return the report's printed output for STATES and RESULTS.
+STATES is an alist of NAME . PLIST seeded into the state table; RESULTS is
+what `calendar-sync-batch-run' is stubbed to return, so the report is
+exercised without driving a real sync."
+  (let ((calendar-sync--calendar-states (make-hash-table :test 'equal)))
+    (dolist (entry states)
+      (puthash (car entry) (cdr entry) calendar-sync--calendar-states))
+    (cl-letf (((symbol-function 'calendar-sync-batch-run)
+               (lambda (&rest _) results)))
+      (with-output-to-string
+        (calendar-sync-batch-run-and-report)))))
+
+;;; Normal
+
+(ert-deftest test-calendar-sync-batch-report-failed-row-carries-its-reason ()
+  "Normal: a failed calendar prints the recorded `:last-error' reason.
+Without it the journal records only \"error\", and the operator cannot tell a
+cold gpg-agent from a revoked token without re-running the sync by hand."
+  (let ((out (test-calendar-sync-batch-report--capture
+              '(("google" . (:status error :last-error "Decryption failed"))
+                ("proton" . (:status ok)))
+              '(("google" . error) ("proton" . ok)))))
+    (should (string-match-p "google: error" out))
+    (should (string-match-p "Decryption failed" out))))
+
+(ert-deftest test-calendar-sync-batch-report-ok-row-stays-bare ()
+  "Normal: a calendar that synced prints its status and nothing more.
+A stale `:last-error' from an earlier failure must not be appended to a row
+that succeeded this run."
+  (let ((out (test-calendar-sync-batch-report--capture
+              '(("google" . (:status ok :last-error "Decryption failed")))
+              '(("google" . ok)))))
+    (should (string-match-p "google: ok" out))
+    (should-not (string-match-p "Decryption failed" out))))
+
+;;; Boundary
+
+(ert-deftest test-calendar-sync-batch-report-failure-without-reason-still-prints ()
+  "Boundary: a failed row with no recorded reason prints its status alone.
+`never' and `syncing' never record a `:last-error', so the reason lookup has
+to tolerate nil rather than printing \"nil\" or signalling."
+  (let ((out (test-calendar-sync-batch-report--capture
+              '(("google" . (:status syncing)))
+              '(("google" . syncing) ("absent" . never)))))
+    (should (string-match-p "google: syncing" out))
+    (should (string-match-p "absent: never" out))
+    (should-not (string-match-p "nil" out))))
+
+;;; Error
+
+(defun test-calendar-sync-batch-report--exit-code (results)
+  "Return the report's exit code for RESULTS, discarding its printed output."
+  (let ((calendar-sync--calendar-states (make-hash-table :test 'equal)))
+    (cl-letf (((symbol-function 'calendar-sync-batch-run)
+               (lambda (&rest _) results)))
+      (with-temp-buffer
+        (let ((standard-output (current-buffer)))
+          (calendar-sync-batch-run-and-report))))))
+
+(ert-deftest test-calendar-sync-batch-report-exit-code-tracks-failures ()
+  "Error: the return value becomes the process exit code, so it stays 1 on any
+non-ok row and 0 only when every calendar synced.  Appending the reason to the
+printed line must not disturb it."
+  (should (equal 1 (test-calendar-sync-batch-report--exit-code '(("google" . error)))))
+  (should (equal 1 (test-calendar-sync-batch-report--exit-code
+                    '(("google" . ok) ("proton" . never)))))
+  (should (equal 0 (test-calendar-sync-batch-report--exit-code '(("google" . ok))))))
+
+(provide 'test-calendar-sync--batch-report)
+;;; test-calendar-sync--batch-report.el ends here
diff --git a/tests/test-calendar-sync--batch-results.el b/tests/test-calendar-sync--batch-results.el
new file mode 100644
index 00000000..03ee2aee
--- /dev/null
+++ b/tests/test-calendar-sync--batch-results.el
@@ -0,0 +1,59 @@
+;;; test-calendar-sync--batch-results.el --- Batch result collection tests  -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; `calendar-sync--batch-results' reads the per-calendar state table and
+;; returns one (NAME . STATUS) pair per requested calendar.  The batch runner
+;; turns that into an exit code, so a calendar that never reached the table at
+;; all has to read as `never' rather than nil -- a nil status would compare
+;; equal to nothing and quietly drop out of the failure count.
+
+;;; Code:
+
+(require 'ert)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+(require 'calendar-sync)
+
+(defun test-calendar-sync-batch-results--with-states (states body)
+  "Run BODY with STATES (an alist of NAME . PLIST) in the state table."
+  (let ((calendar-sync--calendar-states (make-hash-table :test 'equal)))
+    (dolist (entry states)
+      (puthash (car entry) (cdr entry) calendar-sync--calendar-states))
+    (funcall body)))
+
+(ert-deftest test-calendar-sync-batch-results-reports-each-status ()
+  "Normal: every requested calendar comes back with its recorded status."
+  (test-calendar-sync-batch-results--with-states
+   '(("google" . (:status ok))
+     ("proton" . (:status error :last-error "boom")))
+   (lambda ()
+     (should (equal (calendar-sync--batch-results '("google" "proton"))
+                    '(("google" . ok) ("proton" . error)))))))
+
+(ert-deftest test-calendar-sync-batch-results-empty-names-is-empty ()
+  "Boundary: no calendars requested yields no rows, not an error."
+  (test-calendar-sync-batch-results--with-states
+   '(("google" . (:status ok)))
+   (lambda ()
+     (should (equal (calendar-sync--batch-results '()) '())))))
+
+(ert-deftest test-calendar-sync-batch-results-missing-calendar-reads-never ()
+  "Error: a calendar absent from the state table reads `never', never nil.
+A nil status would drop out of the failure count and report success for a
+calendar that never ran."
+  (test-calendar-sync-batch-results--with-states
+   '(("google" . (:status ok)))
+   (lambda ()
+     (should (equal (calendar-sync--batch-results '("google" "absent"))
+                    '(("google" . ok) ("absent" . never)))))))
+
+(ert-deftest test-calendar-sync-batch-results-preserves-request-order ()
+  "Boundary: rows come back in the order asked for, not hash order."
+  (test-calendar-sync-batch-results--with-states
+   '(("a" . (:status ok)) ("b" . (:status ok)) ("c" . (:status ok)))
+   (lambda ()
+     (should (equal (mapcar #'car (calendar-sync--batch-results '("c" "a" "b")))
+                    '("c" "a" "b"))))))
+
+(provide 'test-calendar-sync--batch-results)
+;;; test-calendar-sync--batch-results.el ends here
diff --git a/tests/test-calendar-sync--batch-wait.el b/tests/test-calendar-sync--batch-wait.el
new file mode 100644
index 00000000..7deee5e1
--- /dev/null
+++ b/tests/test-calendar-sync--batch-wait.el
@@ -0,0 +1,68 @@
+;;; test-calendar-sync--batch-wait.el --- Batch wait-loop tests  -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; The sync pipeline is asynchronous end to end: curl runs in one process and
+;; the org conversion in a second batch Emacs.  Under `emacs --batch' the
+;; process exits as soon as the top-level form returns, killing both children
+;; mid-flight -- a run that does nothing and reports success.
+;;
+;; `calendar-sync--batch-wait' is what stops that: it blocks until every
+;; calendar has left the `syncing' state, or until the timeout expires.  These
+;; tests drive it with a stubbed state predicate, so the loop's exit conditions
+;; are covered without a live network fetch.
+
+;;; Code:
+
+(require 'ert)
+(require 'cl-lib)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+(require 'calendar-sync)
+
+(ert-deftest test-calendar-sync-batch-wait-returns-when-nothing-in-flight ()
+  "Normal: with no calendar syncing the wait returns success immediately."
+  (let ((polls 0))
+    (cl-letf (((symbol-function 'calendar-sync--syncing-p) (lambda (_) nil))
+              ((symbol-function 'accept-process-output)
+               (lambda (&rest _) (setq polls (1+ polls)))))
+      (should (calendar-sync--batch-wait '("google" "proton") 5))
+      (should (= polls 0)))))
+
+(ert-deftest test-calendar-sync-batch-wait-blocks-until-settled ()
+  "Normal: the wait polls while a sync is in flight and returns once it lands."
+  (let ((remaining 3)
+        (polls 0))
+    (cl-letf (((symbol-function 'calendar-sync--syncing-p)
+               (lambda (_) (> remaining 0)))
+              ((symbol-function 'accept-process-output)
+               (lambda (&rest _)
+                 (setq polls (1+ polls))
+                 (setq remaining (1- remaining)))))
+      (should (calendar-sync--batch-wait '("google") 5))
+      (should (= polls 3)))))
+
+(ert-deftest test-calendar-sync-batch-wait-empty-names-returns-immediately ()
+  "Boundary: no calendars to wait on settles at once."
+  (let ((polls 0))
+    (cl-letf (((symbol-function 'accept-process-output)
+               (lambda (&rest _) (setq polls (1+ polls)))))
+      (should (calendar-sync--batch-wait '() 5))
+      (should (= polls 0)))))
+
+(ert-deftest test-calendar-sync-batch-wait-times-out-when-stuck ()
+  "Error: a sync that never settles returns nil once the timeout expires.
+Returning nil is what lets the runner exit non-zero instead of reporting a
+success it cannot vouch for."
+  (let ((calendar-sync--batch-poll-seconds 0.01))
+    (cl-letf (((symbol-function 'calendar-sync--syncing-p) (lambda (_) t))
+              ((symbol-function 'accept-process-output) (lambda (&rest _) nil)))
+      (should-not (calendar-sync--batch-wait '("google") 0.05)))))
+
+(ert-deftest test-calendar-sync-batch-wait-zero-timeout-does-not-hang ()
+  "Boundary: a zero timeout returns at once rather than looping forever."
+  (cl-letf (((symbol-function 'calendar-sync--syncing-p) (lambda (_) t))
+            ((symbol-function 'accept-process-output) (lambda (&rest _) nil)))
+    (should-not (calendar-sync--batch-wait '("google") 0))))
+
+(provide 'test-calendar-sync--batch-wait)
+;;; test-calendar-sync--batch-wait.el ends here
diff --git a/tests/test-calendar-sync--sync-dispatch.el b/tests/test-calendar-sync--sync-dispatch.el
index 22deeef0..9b12b167 100644
--- a/tests/test-calendar-sync--sync-dispatch.el
+++ b/tests/test-calendar-sync--sync-dispatch.el
@@ -77,5 +77,44 @@ than crashing."
       (should (equal (list cal) ics-calls))
       (should (null api-calls)))))
 
+(ert-deftest test-calendar-sync--sync-dispatch-error-leaf-signal-is-contained ()
+  "Error: a syncer that signals marks the calendar failed instead of propagating.
+
+Resolving a `:secret-host' feed reads authinfo.gpg, and a cold gpg-agent makes
+that signal a `file-error' before any process starts — so the failure arrives
+synchronously, where the async callbacks that normally record a failure never
+run."
+  (let ((failed '())
+        (calendar-sync--calendar-states (make-hash-table :test 'equal)))
+    (cl-letf (((symbol-function 'calendar-sync--sync-calendar-ics)
+               (lambda (_) (signal 'file-error '("Decryption failed"))))
+              ((symbol-function 'calendar-sync--mark-sync-failed)
+               (lambda (name reason) (push (cons name reason) failed))))
+      (calendar-sync--sync-calendar
+       '(:name "google" :url "https://x/y.ics" :file "/tmp/c.org"))
+      (should (equal "google" (car (car failed)))))))
+
+(ert-deftest test-calendar-sync--sync-all-continues-past-a-failing-calendar ()
+  "Error: one calendar's synchronous failure does not stop the ones after it.
+
+This is the whole cost of leaving the signal uncontained: on a machine whose
+feeds resolve through authinfo, the first calendar's decryption error aborted
+the entire run, so calendars that would have synced fine never got the chance."
+  (let ((synced '())
+        (calendar-sync--calendar-states (make-hash-table :test 'equal))
+        (calendar-sync-calendars
+         '((:name "bad" :url "https://x/a.ics" :file "/tmp/a.org")
+           (:name "good" :url "https://x/b.ics" :file "/tmp/b.org"))))
+    (cl-letf (((symbol-function 'calendar-sync--sync-calendar-ics)
+               (lambda (cal)
+                 (if (equal (plist-get cal :name) "bad")
+                     (signal 'file-error '("Decryption failed"))
+                   (push (plist-get cal :name) synced))))
+              ((symbol-function 'calendar-sync--mark-sync-failed)
+               (lambda (&rest _) nil))
+              ((symbol-function 'message) (lambda (&rest _) nil)))
+      (calendar-sync--sync-all-calendars)
+      (should (equal '("good") synced)))))
+
 (provide 'test-calendar-sync--sync-dispatch)
 ;;; test-calendar-sync--sync-dispatch.el ends here
diff --git a/tests/test-calendar-sync-run.bats b/tests/test-calendar-sync-run.bats
new file mode 100644
index 00000000..da817060
--- /dev/null
+++ b/tests/test-calendar-sync-run.bats
@@ -0,0 +1,116 @@
+#!/usr/bin/env bats
+# Tests for scripts/calendar-sync-run — the batch syncer behind the timer.
+#
+# The elisp tests cover the wait loop and the result tally with the state
+# predicate stubbed.  What only a shell test can cover is the thing that makes
+# the whole script necessary: the sync pipeline is asynchronous end to end
+# (curl in one process, the org conversion in a second batch Emacs), and a
+# batch Emacs exits as soon as its top-level form returns.  A version that
+# launches the fetch and returns would exit zero, write nothing, and look
+# exactly like a success.  Every assertion here that checks the output file
+# exists is really asserting that the script waited.
+#
+# Isolation rules, mirroring test-agenda-render-cache.bats:
+#
+#   EMACS_D points at THIS checkout, so a broken tree cannot pass by running
+#   the installed config's elisp.
+#
+#   CALENDAR_SYNC_CONFIG and CALENDAR_SYNC_STATE point at fixtures, so the run
+#   neither reads Craig's real feed URLs nor writes his persisted sync state.
+#
+#   The feed is a file:// URL served to the script's own curl.  That keeps the
+#   test hermetic -- no network, no live calendar -- while still exercising the
+#   real fetch path rather than a stub.
+
+setup() {
+	SCRIPT="${BATS_TEST_DIRNAME}/../scripts/calendar-sync-run"
+	export EMACS_D="${BATS_TEST_DIRNAME}/.."
+	export CALENDAR_SYNC_STATE="${BATS_TEST_TMPDIR}/state.el"
+	export CALENDAR_SYNC_TIMEOUT=120
+
+	OUT="${BATS_TEST_TMPDIR}/testcal.org"
+	ICS="${BATS_TEST_TMPDIR}/feed.ics"
+	TODAY="$(date +%Y%m%d)"
+
+	cat > "$ICS" <<-EOF
+		BEGIN:VCALENDAR
+		VERSION:2.0
+		PRODID:-//bats//test//EN
+		BEGIN:VEVENT
+		UID:bats-fixture-1
+		DTSTART:${TODAY}T140000Z
+		DTEND:${TODAY}T150000Z
+		SUMMARY:Batch Fixture Event
+		END:VEVENT
+		END:VCALENDAR
+	EOF
+
+	write_config "file://${ICS}"
+}
+
+# The calendar list is normally private config; the test writes its own so the
+# feed URL is a local file and the output lands in the temp dir.
+write_config() {
+	export CALENDAR_SYNC_CONFIG="${BATS_TEST_TMPDIR}/config.el"
+	cat > "$CALENDAR_SYNC_CONFIG" <<-EOF
+		(setq calendar-sync-calendars
+		      (list (list :name "testcal" :url "$1" :file "${OUT}")))
+	EOF
+}
+
+@test "the script is executable" {
+	[ -x "$SCRIPT" ]
+}
+
+@test "waits for the async pipeline and writes the org file" {
+	run "$SCRIPT"
+	[ "$status" -eq 0 ]
+	# The file existing at all is the assertion: it is written by a grandchild
+	# process, so a script that did not wait would have exited before this.
+	[ -f "$OUT" ]
+	grep -q "Batch Fixture Event" "$OUT"
+}
+
+@test "reports the calendar and its status on stdout" {
+	run "$SCRIPT"
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"testcal: ok"* ]]
+}
+
+@test "a failed fetch exits non-zero so systemd records it" {
+	write_config "file://${BATS_TEST_TMPDIR}/does-not-exist.ics"
+	run "$SCRIPT"
+	[ "$status" -ne 0 ]
+	[ ! -f "$OUT" ]
+}
+
+@test "a failed fetch names the calendar rather than failing silently" {
+	write_config "file://${BATS_TEST_TMPDIR}/does-not-exist.ics"
+	run "$SCRIPT"
+	[[ "$output" == *"testcal"* ]]
+	[[ "$output" != *"testcal: ok"* ]]
+}
+
+@test "a failed fetch prints why, not just that it failed" {
+	# The interactive path logs the reason to *Messages*, which batch Emacs
+	# discards at exit.  Without the reason on stdout the journal shows only
+	# "error" -- no way to tell a cold gpg-agent from a revoked feed token.
+	write_config "file://${BATS_TEST_TMPDIR}/does-not-exist.ics"
+	run "$SCRIPT"
+	[[ "$output" == *"testcal: error"* ]]
+	[[ "$output" == *"Fetch failed"* ]]
+}
+
+@test "refuses to run against a checkout with no modules directory" {
+	EMACS_D="${BATS_TEST_TMPDIR}/empty" run "$SCRIPT"
+	[ "$status" -ne 0 ]
+	[[ "$output" == *"no modules directory"* ]]
+}
+
+@test "does not write the real session's sync state" {
+	run "$SCRIPT"
+	[ "$status" -eq 0 ]
+	# The state override is honoured, so a timer run cannot corrupt or race
+	# the interactive session's persisted state.
+	[ -f "$CALENDAR_SYNC_STATE" ]
+}
diff --git a/tests/test-system-lib-auth-source-secret-value.el b/tests/test-system-lib-auth-source-secret-value.el
index ec526cec..27a2696b 100644
--- a/tests/test-system-lib-auth-source-secret-value.el
+++ b/tests/test-system-lib-auth-source-secret-value.el
@@ -63,5 +63,44 @@ Captures the call args in `test-ass--args'."
   (test-ass--with-search (list (list :host "h"))
     (should (null (cj/auth-source-secret-value "h")))))
 
+;;; Error
+
+(ert-deftest test-auth-source-secret-value-loads-auth-source-when-absent ()
+  "Error: with `auth-source-search' unavailable, the helper loads auth-source.
+
+Under `emacs --batch -Q' nothing else pulls auth-source in, so a helper
+carrying only a `declare-function' dies with a void-function on the first
+lookup.  An interactive Emacs hides this completely -- something in init
+always has auth-source loaded by the time anyone calls here -- which is why
+it surfaced only on the batch calendar sync, and only on the machine whose
+feeds resolve through `:secret-host' rather than an inline URL.
+
+The stubbed `require' installs the entry point the way loading auth-source.el
+would, so the call can complete and the return value is checked too."
+  (let ((required nil))
+    (cl-letf (((symbol-function 'auth-source-search) nil)
+              ((symbol-function 'require)
+               (lambda (feature &rest _)
+                 (push feature required)
+                 (fset 'auth-source-search
+                       (lambda (&rest _) (list (list :secret "loaded"))))
+                 feature)))
+      (should (equal "loaded" (cj/auth-source-secret-value "h")))
+      (should (memq 'auth-source required)))))
+
+(ert-deftest test-auth-source-secret-value-does-not-reload-when-present ()
+  "Error: an available `auth-source-search' is used as-is, never re-required.
+
+An unconditional `require' re-loads auth-source.el over whatever is in place,
+replacing a caller's stub mid-call -- which sent a test that meant to fake the
+lookup out to the real authinfo, where it hung for twelve seconds on gpg."
+  (let ((required nil))
+    (cl-letf (((symbol-function 'require)
+               (lambda (feature &rest _) (push feature required) feature))
+              ((symbol-function 'auth-source-search)
+               (lambda (&rest _) (list (list :secret "stubbed")))))
+      (should (equal "stubbed" (cj/auth-source-secret-value "h")))
+      (should-not (memq 'auth-source required)))))
+
 (provide 'test-system-lib-auth-source-secret-value)
 ;;; test-system-lib-auth-source-secret-value.el ends here