hub v0.44.0: PBS DR tier SLICE 1 — felhom-tenantsync surface (script+client) + hub provisioning flow (consume-once host secret, pbs_dr desired-state descriptor, fail-closed + idempotent, re-issue)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/store/pbsdr_test.go

@@ -0,0 +1,43 @@
+package store
+
+import (
+	"database/sql"
+	"testing"
+)
+
+// The host-scoped consume-once contract (PBS DR SLICE 1): exactly one read per stored value,
+// a re-save resets the consumed flag (re-issue supersedes), absence is sql.ErrNoRows.
+func TestHostPBSSecret_ConsumeOnce(t *testing.T) {
+	s := newTestStore(t)
+
+	if _, err := s.ConsumeHostPBSSecret("h1"); err != sql.ErrNoRows {
+		t.Fatalf("consume with nothing stored = %v, want sql.ErrNoRows", err)
+	}
+
+	if err := s.SaveHostPBSSecret("h1", "secret-1"); err != nil {
+		t.Fatalf("save: %v", err)
+	}
+	got, err := s.ConsumeHostPBSSecret("h1")
+	if err != nil || got != "secret-1" {
+		t.Fatalf("first consume = (%q, %v), want (secret-1, nil)", got, err)
+	}
+	// Single use: the second consume MUST be ErrNoRows (red-proof: dropping the consumed_at
+	// UPDATE in ConsumeHostPBSSecret makes this assert fail with the value returned again).
+	if got, err := s.ConsumeHostPBSSecret("h1"); err != sql.ErrNoRows {
+		t.Fatalf("second consume = (%q, %v), want sql.ErrNoRows — consume-once broken", got, err)
+	}
+
+	// Re-issue path: a fresh save resets consumption and serves the NEW value once.
+	if err := s.SaveHostPBSSecret("h1", "secret-2"); err != nil {
+		t.Fatalf("re-save: %v", err)
+	}
+	got, err = s.ConsumeHostPBSSecret("h1")
+	if err != nil || got != "secret-2" {
+		t.Fatalf("post-reissue consume = (%q, %v), want (secret-2, nil)", got, err)
+	}
+
+	// Host isolation: h2 never sees h1's rows.
+	if _, err := s.ConsumeHostPBSSecret("h2"); err != sql.ErrNoRows {
+		t.Fatalf("foreign host consume = %v, want sql.ErrNoRows", err)
+	}
+}