fix(iwooos): retry expired Wazuh posture claim

apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py

@@ -2764,6 +2764,111 @@ async def test_wazuh_posture_scheduler_queues_one_recipient_transition_per_deplo
     duplicate_collector.assert_not_awaited()
 
 
+@pytest.mark.asyncio
+async def test_wazuh_posture_scheduler_retries_expired_preclaim_recurrence_once_per_deploy(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    from src.jobs import awooop_ansible_candidate_backfill_job as job
+
+    existing_row = {
+        "op_id": "00000000-0000-0000-0000-000000000327",
+        "candidate_status": "dry_run",
+        "automation_run_id": "00000000-0000-0000-0000-000000000327",
+        "source_receipt_ref": "scheduled-wazuh-manager-posture:2026071100",
+        "latest_check_status": None,
+        "latest_apply_status": None,
+        "latest_learning_status": None,
+        "latest_execution_skip_reason": (
+            "scheduled_candidate_identity_chain_not_verified"
+        ),
+        "predecision_evidence_ready": True,
+    }
+
+    class _Mappings:
+        def first(self):
+            return existing_row
+
+    class _Result:
+        def mappings(self):
+            return _Mappings()
+
+    observed_sql: list[str] = []
+
+    class _Db:
+        async def execute(self, statement, _params):
+            observed_sql.append(str(statement))
+            return _Result()
+
+    @asynccontextmanager
+    async def fake_db_context(project_id: str):
+        assert project_id == "awoooi"
+        yield _Db()
+
+    recorder = AsyncMock(return_value=True)
+    monkeypatch.setattr(job, "get_db_context", fake_db_context)
+    monkeypatch.setattr(
+        job.settings,
+        "ENABLE_IWOOOS_WAZUH_MANAGER_POSTURE_EXECUTOR",
+        True,
+    )
+    monkeypatch.setattr(
+        job.settings,
+        "IWOOOS_WAZUH_MANAGER_POSTURE_FRESHNESS_HOURS",
+        6,
+    )
+    monkeypatch.setattr(
+        job,
+        "now_taipei",
+        MagicMock(return_value=datetime.fromisoformat("2026-07-11T05:59:59+08:00")),
+    )
+    monkeypatch.setenv(
+        "AWOOOI_BUILD_COMMIT_SHA",
+        "abcdef1234567890abcdef1234567890abcdef12",
+    )
+
+    result = await job.enqueue_iwooos_wazuh_manager_posture_candidate_once(
+        recorder=recorder,
+        evidence_collector=AsyncMock(return_value=MagicMock(snapshot_id="wazuh-6")),
+        evidence_verifier=AsyncMock(return_value=True),
+        source_recurrence=_current_wazuh_source_recurrence(
+            "2026-07-11T05:59:58+08:00"
+        ),
+    )
+
+    assert result["status"] == "queued_for_controlled_executor_retry"
+    assert result["retry_reason"] == (
+        "scheduled_candidate_recurrence_expired_before_claim"
+    )
+    assert result["retry_of_incomplete_runtime_closure"] is True
+    assert "ansible_execution_skipped" in observed_sql[0]
+    assert "latest_execution_skip_reason" in observed_sql[0]
+    recorded = recorder.await_args.kwargs
+    assert recorded["incident"]["source_receipt_ref"] == (
+        "scheduled-wazuh-manager-posture:2026071100-ABCDEF123456-RECURRENCE"
+    )
+
+    existing_row["automation_run_id"] = result["automation_run_id"]
+    existing_row["source_receipt_ref"] = recorded["incident"]["source_receipt_ref"]
+    duplicate_collector = AsyncMock()
+    duplicate = await job.enqueue_iwooos_wazuh_manager_posture_candidate_once(
+        recorder=recorder,
+        evidence_collector=duplicate_collector,
+        source_recurrence=_current_wazuh_source_recurrence(
+            "2026-07-11T05:59:58+08:00"
+        ),
+    )
+
+    assert duplicate["status"] == (
+        "incomplete_runtime_retry_already_attempted_for_deploy"
+    )
+    assert duplicate["queued"] == 0
+    assert duplicate["retry_reason"] == (
+        "scheduled_candidate_recurrence_expired_before_claim"
+    )
+    recorder.assert_awaited_once()
+    duplicate_collector.assert_not_awaited()
+
+
 @pytest.mark.asyncio
 async def test_wazuh_posture_scheduler_does_not_duplicate_active_candidate(
     monkeypatch: pytest.MonkeyPatch,