fix(openapi): harden story 2.1 production lifecycle

apps/admin-api/tests/integration/openapi_import.rs

@@ -81,6 +81,7 @@ async fn previews_openapi_and_creates_draft_operations() {
         .unwrap();
 
     assert_eq!(created.created.len(), 1);
+    assert_eq!(created.created[0].operation_key, "GET /v2/latest");
     assert_eq!(created.created[0].name, "latest_rates");
     assert!(created.skipped.is_empty());
 
@@ -176,6 +177,46 @@ async fn previews_openapi_and_creates_draft_operations() {
     assert_eq!(renamed.findings[0].code, "operation_name_renamed");
 }
 
+#[tokio::test]
+#[serial]
+async fn unknown_selected_operations_are_persisted_in_the_canonical_replay() {
+    let registry = test_registry().await;
+    let service = test_service(
+        registry,
+        test_storage_root("openapi_import_unknown_replay"),
+        test_auth_settings(),
+        test_secret_crypto(),
+    );
+    let workspace_id = WorkspaceId::new("ws_default");
+    let preview = service
+        .preview_openapi_import(&workspace_id, openapi_upload())
+        .await
+        .unwrap();
+    let payload = OpenApiImportCreatePayload {
+        selected_operation_keys: vec!["GET /v2/latest".to_owned(), "GET /missing".to_owned()],
+        server_url: Some("https://api.frankfurter.dev".to_owned()),
+        conflict_mode: "skip".to_owned(),
+    };
+
+    let first = service
+        .create_openapi_import(
+            &workspace_id,
+            &preview.job_id.as_str().into(),
+            payload.clone(),
+        )
+        .await
+        .unwrap();
+    let replayed = service
+        .create_openapi_import(&workspace_id, &preview.job_id.as_str().into(), payload)
+        .await
+        .unwrap();
+
+    assert_eq!(first.created, replayed.created);
+    assert_eq!(first.skipped, replayed.skipped);
+    assert_eq!(first.skipped.len(), 1);
+    assert_eq!(first.skipped[0].operation_key, "GET /missing");
+}
+
 #[tokio::test]
 #[serial]
 async fn concurrent_openapi_import_replays_the_same_atomic_result() {
@@ -231,6 +272,55 @@ async fn concurrent_openapi_import_replays_the_same_atomic_result() {
     assert!(conflicting_replay.is_err());
 }
 
+#[tokio::test]
+#[serial]
+async fn apply_fails_closed_when_the_preview_parser_contract_drifts() {
+    let registry = test_registry().await;
+    let service = test_service(
+        registry.clone(),
+        test_storage_root("openapi_import_parser_drift"),
+        test_auth_settings(),
+        test_secret_crypto(),
+    );
+    let workspace_id = WorkspaceId::new("ws_default");
+    let preview = service
+        .preview_openapi_import(&workspace_id, openapi_upload())
+        .await
+        .unwrap();
+    let job_id: crank_registry::ImportJobId = preview.job_id.as_str().into();
+    sqlx::query(
+        "update import_jobs
+            set preview_payload = jsonb_set(preview_payload, '{preview_digest}', to_jsonb($1::text))
+          where id = $2",
+    )
+    .bind("0".repeat(64))
+    .bind(job_id.as_str())
+    .execute(registry.pool())
+    .await
+    .unwrap();
+
+    let result = service
+        .create_openapi_import(
+            &workspace_id,
+            &job_id,
+            OpenApiImportCreatePayload {
+                selected_operation_keys: vec!["GET /v2/latest".to_owned()],
+                server_url: Some("https://api.frankfurter.dev".to_owned()),
+                conflict_mode: "rename".to_owned(),
+            },
+        )
+        .await;
+
+    assert!(result.is_err());
+    assert!(
+        service
+            .list_operations(&workspace_id)
+            .await
+            .unwrap()
+            .is_empty()
+    );
+}
+
 fn openapi_upload() -> OpenApiUpload {
     OpenApiUpload {
         bytes: OPENAPI3.as_bytes().to_vec(),

apps/admin-api/tests/integration/openapi_source.rs

@@ -385,6 +385,16 @@ async fn multipart_boundary_rejections_are_localized_and_leave_no_entities() {
         Some("no supported methods"),
     )
     .await;
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "select count(*) from artifact_sources where lifecycle = 'active'",
+        )
+        .fetch_one(registry.pool())
+        .await
+        .unwrap(),
+        0,
+        "no_methods must not leave an active source behind",
+    );
     assert_rejected(
         &client,
         &server,
@@ -432,6 +442,42 @@ async fn multipart_boundary_rejections_are_localized_and_leave_no_entities() {
     assert!(!rendered.contains("digest"));
 }
 
+#[tokio::test(flavor = "multi_thread")]
+#[serial]
+async fn cleanup_is_bounded_and_malformed_expired_jobs_do_not_block_later_rows() {
+    let registry = test_registry().await;
+    for index in 0..129 {
+        sqlx::query(
+            "insert into import_jobs (
+                id, workspace_id, kind, source_format, source_version, status,
+                preview_payload, created_operation_ids, error_text, created_at, expires_at, finished_at
+             ) values (
+                $1, 'ws_default', 'openapi', 'openapi', null, 'pending',
+                '{\"source\": {\"source_id\": 1}}'::jsonb, '[]'::jsonb, null,
+                now() - interval '2 hours', now() - interval '1 hour', null
+             )",
+        )
+        .bind(format!("imp_cleanup_{index:03}"))
+        .execute(registry.pool())
+        .await
+        .unwrap();
+    }
+
+    let first = registry.cleanup_expired_import_jobs(128).await.unwrap();
+    assert_eq!(first.deleted_jobs, 128);
+    assert!(first.more_work);
+    let second = registry.cleanup_expired_import_jobs(128).await.unwrap();
+    assert_eq!(second.deleted_jobs, 1);
+    assert!(!second.more_work);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("select count(*) from import_jobs")
+            .fetch_one(registry.pool())
+            .await
+            .unwrap(),
+        0,
+    );
+}
+
 async fn wait_for_source_lifecycle(
     registry: &crank_registry::PostgresRegistry,
     lifecycle: ArtifactSourceLifecycle,
@@ -746,11 +792,15 @@ async fn cancellation_detaches_and_restart_cleanup_recovers_a_dangling_source()
     preview_task.abort();
     let cancellation = preview_task.await.unwrap_err();
     assert!(cancellation.is_cancelled());
-    wait_for_blocked_import_insert_to_stop(&observer).await;
+    // Dropping a sqlx query future does not synchronously cancel the backend
+    // statement. Release the artificial blocker first; the abandoned
+    // transaction can then finish and roll back before the detach fallback
+    // obtains another pooled connection.
     sqlx::query("select pg_advisory_unlock(2147483001)")
         .execute(&mut *lock_connection)
         .await
         .unwrap();
+    wait_for_blocked_import_insert_to_stop(&observer).await;
     wait_for_specific_source_lifecycle(
         &registry,
         &cancelled_source_id,