From 5a4caf8414e5aeb6cf83a86d02b53e20b73112e0 Mon Sep 17 00:00:00 2001
From: pt-act <211776491+pt-act@users.noreply.github.com>
Date: Sun, 13 Sep 2026 09:09:29 +0100
Subject: [PATCH] test(sdk): concurrent policy creates get distinct positions

Regression guard for the tool-policy position race: two equally
specific policies created concurrently must land distinct positions.
Upstream #1919 wrapped policiesCreate/policiesUpdate in a transaction;
this pins that guarantee with a discriminating it.live test.

Verified load-bearing both directions: passes with the transaction
wrap (upstream/main), fails with the pre-#1919 unwrapped executor
(duplicate positions: Set size 1 vs 2).
---
 packages/core/sdk/src/policies.test.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/packages/core/sdk/src/policies.test.ts b/packages/core/sdk/src/policies.test.ts
index 1b5683aeb..18c5d29a7 100644
--- a/packages/core/sdk/src/policies.test.ts
+++ b/packages/core/sdk/src/policies.test.ts
@@ -459,6 +459,23 @@ describe("executor.policies", () => {
     }),
   );
 
+  it.live("concurrent creates of equally specific rules get distinct positions", () =>
+    Effect.gen(function* () {
+      const executor = yield* setupExecutor();
+      yield* Effect.all(
+        [
+          executor.policies.create({ owner: "org", pattern: "vercel.dns.create", action: "block" }),
+          executor.policies.create({ owner: "org", pattern: "vercel.dns.delete", action: "block" }),
+        ],
+        { concurrency: "unbounded" },
+      );
+
+      const rules = yield* executor.policies.list();
+      expect(rules).toHaveLength(2);
+      expect(new Set(rules.map((r) => r.position)).size).toBe(2);
+    }),
+  );
+
   it.effect("create stores rules at the requested owner", () =>
     Effect.gen(function* () {
       const executor = yield* setupExecutor();