Automate the kill-9 half of #36's lease-reclaim gate

[stephane-segning]

Summary

• app/sms-worker/tests/kill9_reclaim_live.rs — a new live-Postgres regression test that spawns the real sms-worker binary, sends it a genuine SIGKILL mid-submit, and proves reclaim without loss.
• app/sms-worker/Cargo.toml — new dev-dependencies (chrono, serde_json, wiremock) for that test.
• AGENTS.md / docs/runbooks/36-handset-gate.md — status updated to point at the new test, and a stale 'claim_live_postgres tests are flaky under the full workspace live sweep (shared-database test isolation) #102 still open' note corrected (it was fixed in ca653a1).

Intent

Source of truth: #36 ("Gate: real handset delivery, and kill -9 lease reclaim"), part of the M2 epic (#26). #36's own text names the risk directly: "lease reclamation is the kind of code that is easy to write and easy to never actually exercise." The runbook from #106 already covers the two genuinely physical acceptance tests (a real Orange handset, a human-timed kill -9) and says explicitly that neither can run under CI or an agent. But that runbook itself only had one undocumented manual dry run as evidence the kill -9/reclaim mechanic actually works — this PR turns that into a permanent, rerunnable automated test, closing the buildable half of #36 without claiming to close the issue itself.

Scope

• New test spawns the actual compiled sms-worker binary as an OS subprocess (via CARGO_BIN_EXE_sms-worker, only injected for tests in the package defining the [[bin]] — why this lives in app/sms-worker, not crates/sms-worker), against a live Postgres and a wiremock-backed Orange stand-in whose submit endpoint delays its first response for 5s.
• Sequence: seed an accepted message, spawn worker 1, poll until routed (the claim write lands before the provider HTTP call, per dispatch.rs's own tick), sleep 500ms into the delay window, send real SIGKILL (Child::kill() — no Rust destructor runs, unlike claim_live_postgres.rs's in-process leaseUntil-in-the-past simulation), assert the row is stuck routed with no providerMessageRef, force the lease into the past (same technique every other live suite here uses), spawn worker 2 (a real second process, not the same one resuming), and assert it reaches submitted with the same attempts count and a new providerMessageRef.
• Final assertion is deliberately not "no double send": it asserts the mock's submit endpoint was hit exactly twice, matching the runbook's own documented, currently-unmitigated finding that a crash in this exact window produces a real second outbound submission (no DB-level uniqueness on providerMessageRef, no provider-side dedup key). The test is written to surface that gap permanently, not to paper over it.
• Out of scope, same as before: the two actually-physical parts of Gate: real handset delivery, and kill -9 lease reclaim #36 (real Orange account, real handset) are untouched — this PR doesn't and can't close the issue.

Verification

• Ran the new test against a real dockerized Postgres 16 (migrations applied via ci/apply-migrations.sh), 4 consecutive runs, all green and deterministic (~2.5s each) — not just cargo check.
• just check and just lint (fmt + clippy -D warnings) — both green workspace-wide.
• cargo check -p sms-worker-bin --tests and cargo build -p sms-worker-bin — both green before running the live test.
• Cargo.lock diff is +3 lines only (wiremock already resolved elsewhere in the workspace) — no version conflicts introduced.

Screenshots/Evidence

N/A — a new backend integration test, no UI surface.

Risk Assessment

Low. Additive only: a new #[ignore]d test file (never runs in default cargo test/CI unless explicitly invoked with --ignored) and new dev-only dependencies. No production code path changes.

AI Usage Declaration

This PR was implemented by Claude Code (Claude Sonnet 5) under my direction, after researching the existing claim/dispatch/lease code and the prior #106 runbook, then writing and running the test live against a real Postgres instance repeatedly before committing.

• I reviewed the test and understand exactly what it proves and what it deliberately does not (it is not a substitute for the real-handset and real-kill -9-against-Orange acceptance criteria in Gate: real handset delivery, and kill -9 lease reclaim #36).
• I confirmed this was run against a live database rather than trusting a green cargo check, per this repo's own house rule that a compiling test proves nothing about runtime behavior.
• I take responsibility for the accuracy of the AGENTS.md/runbook status updates — in particular that Gate: real handset delivery, and kill -9 lease reclaim #36 is explicitly described as still open pending the two physical tests, not closed by this PR.

Reviewer Focus

• Whether asserting "exactly 2 submit calls" is the right shape for the final assertion, versus something more lenient — this is deliberately pinning down a known gap (no submit-side idempotency), not asserting a happy-path invariant.
• Whether 5s is a safe-enough delay margin for CI/dev-machine variance in subprocess spawn latency, given this test isn't part of the default CI run (ignored by default) but might get picked up by a future live-suite sweep.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b56dda2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR