chore: add all untracked files from VM — scripts, test-results, LLM batch, docs

2026-05-04 06:22:16 +04:00
parent d342b649a8
commit b0895ad498
35 changed files with 8681 additions and 0 deletions
@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE="https://fission.kube5s.ru/console/api"
+COUNT=${1:-10}
+RUN_ID="mt$(date +%s | tail -c 6)"
+ROOT_DIR=$(cd "$(dirname "$0")" && pwd)
+NS_CLEANUP_SCRIPT="${ROOT_DIR}/cleanup_test_namespaces.sh"
+TMP=$(mktemp -d)
+
+declare -a USERS=()
+
+cleanup() {
+    rm -rf "$TMP" 2>/dev/null || true
+    if [ -x "$NS_CLEANUP_SCRIPT" ] && [ ${#USERS[@]} -gt 0 ]; then
+        KUBECTL_DIRECT=1 "$NS_CLEANUP_SCRIPT" "${USERS[@]}" >/dev/null 2>&1 || true
+    fi
+}
+trap cleanup EXIT
+
+json_escape() {
+    python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))'
+}
+
+init_call() {
+    local user="$1"
+    local code=""
+    local try
+    for try in 1 2 3; do
+        code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 -X GET "${BASE}/functions" -H "X-Auth-Token: ${user}" 2>/dev/null || echo 000)
+        echo "INIT_TRY user=${user} try=${try} http=${code}" >&2
+        if [ "$code" = "200" ]; then
+            printf '%s' "$code"
+            return 0
+        fi
+        [ "$try" -lt 3 ] && sleep 2
+    done
+    printf '%s' "$code"
+}
+
+invoke_call() {
+    local user="$1"
+    local fn="$2"
+    local code=""
+    local try
+    for try in 1 2 3 4; do
+        code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 40 -X POST "${BASE}/functions/${fn}/invoke" -H "X-Auth-Token: ${user}" -H "Content-Type: application/json" -d '{}' 2>/dev/null || echo 000)
+        echo "INVOKE_TRY user=${user} fn=${fn} try=${try} http=${code}" >&2
+        if [ "$code" = "200" ]; then
+            printf '%s' "$code"
+            return 0
+        fi
+        [ "$try" -lt 4 ] && sleep 4
+    done
+    printf '%s' "$code"
+}
+
+echo "=== MULTIUSER TEST START run=$RUN_ID count=$COUNT ==="
+
+for i in $(seq 1 "$COUNT"); do
+    USERS+=("${RUN_ID}-u${i}@test.local")
+    (
+        U="${RUN_ID}-u${i}@test.local"
+        CODE=$(init_call "${U}")
+        echo "$i:$CODE:$U" > "${TMP}/init-$i"
+    ) &
+done
+wait
+
+INIT_OK=0
+for i in $(seq 1 "$COUNT"); do
+    R=$(cat "${TMP}/init-$i" 2>/dev/null || echo "$i:000:")
+    C=$(echo "$R" | cut -d: -f2)
+    if [ "$C" = "200" ]; then
+        INIT_OK=$((INIT_OK+1))
+    else
+        echo "INIT_FAIL user$i http=$C"
+    fi
+done
+echo "INIT_OK=$INIT_OK/$COUNT"
+
+for i in $(seq 1 "$COUNT"); do
+    (
+        U="${RUN_ID}-u${i}@test.local"
+        FN="mtfn-${RUN_ID}-${i}"
+        CODE_TEXT=$(printf 'def main():\n    return "ok-%s-%s"\n' "$RUN_ID" "$i")
+        CODE_JSON=$(printf '%s' "$CODE_TEXT" | json_escape)
+        BODY=$(printf '{"name":"%s","language":"python","code":%s}' "$FN" "$CODE_JSON")
+        C=$(curl -s -o /dev/null -w "%{http_code}" --max-time 60 -X POST "${BASE}/functions" -H "X-Auth-Token: ${U}" -H "Content-Type: application/json" -d "$BODY" 2>/dev/null || echo 000)
+        echo "$i:$C:$FN:$U" > "${TMP}/create-$i"
+    ) &
+done
+wait
+
+CREATE_OK=0
+for i in $(seq 1 "$COUNT"); do
+    R=$(cat "${TMP}/create-$i" 2>/dev/null || echo "$i:000::")
+    C=$(echo "$R" | cut -d: -f2)
+    if [ "$C" = "200" ] || [ "$C" = "201" ]; then
+        CREATE_OK=$((CREATE_OK+1))
+    else
+        echo "CREATE_FAIL user$i http=$C"
+    fi
+done
+echo "CREATE_OK=$CREATE_OK/$COUNT"
+
+sleep 8
+
+for i in $(seq 1 "$COUNT"); do
+    (
+        U="${RUN_ID}-u${i}@test.local"
+        FN="mtfn-${RUN_ID}-${i}"
+        C=$(invoke_call "${U}" "${FN}")
+        echo "$i:$C" > "${TMP}/invoke-$i"
+    ) &
+done
+wait
+
+INVOKE_OK=0
+for i in $(seq 1 "$COUNT"); do
+    R=$(cat "${TMP}/invoke-$i" 2>/dev/null || echo "$i:000")
+    C=$(echo "$R" | cut -d: -f2)
+    if [ "$C" = "200" ]; then
+        INVOKE_OK=$((INVOKE_OK+1))
+    else
+        echo "INVOKE_FAIL user$i http=$C"
+    fi
+done
+echo "INVOKE_OK=$INVOKE_OK/$COUNT"
+echo "=== MULTIUSER TEST END ==="
+
+[ "$INIT_OK" = "$COUNT" ]
+[ "$CREATE_OK" = "$COUNT" ]
+[ "$INVOKE_OK" = "$COUNT" ]
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE="https://fission.kube5s.ru/console/api"
+COUNT=${1:-5}
+RUN_ID="journey$(date +%s | tail -c 6)"
+ROOT_DIR=$(cd "$(dirname "$0")" && pwd)
+NS_CLEANUP_SCRIPT="${ROOT_DIR}/cleanup_test_namespaces.sh"
+TMP=$(mktemp -d)
+
+declare -a USERS=()
+
+cleanup() {
+    rm -rf "$TMP" 2>/dev/null || true
+    if [ -x "$NS_CLEANUP_SCRIPT" ] && [ ${#USERS[@]} -gt 0 ]; then
+        KUBECTL_DIRECT=1 "$NS_CLEANUP_SCRIPT" "${USERS[@]}" >/dev/null 2>&1 || true
+    fi
+}
+trap cleanup EXIT
+
+json_field() {
+    local payload="$1"
+    local key="$2"
+    printf '%s' "$payload" | python3 -c 'import json,sys
+key=sys.argv[1]
+try:
+  data=json.load(sys.stdin)
+  value=data.get(key, "")
+  print(value if not isinstance(value, (dict,list)) else json.dumps(value))
+except Exception:
+  print("")' "$key"
+}
+
+json_escape() {
+    python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))'
+}
+
+create_call() {
+    local sub="$1"
+    local body="$2"
+    curl -s -w "\n%{http_code}" --max-time 60 -X POST "${BASE}/functions" \
+      -H "X-Auth-Token: ${sub}" -H 'Content-Type: application/json' -d "$body"
+}
+
+invoke_call() {
+    local sub="$1"
+    local name="$2"
+    curl -s --max-time 45 -X POST "${BASE}/functions/${name}/invoke" \
+      -H "X-Auth-Token: ${sub}" -H 'Content-Type: application/json' -d '{}' || true
+}
+
+echo "=== USER JOURNEYS START run=$RUN_ID count=$COUNT ==="
+
+for i in $(seq 1 "$COUNT"); do
+    USERS+=("${RUN_ID}-u${i}@test.local")
+    (
+        U="${RUN_ID}-u${i}@test.local"
+        FN="journey-${RUN_ID}-${i}"
+        RESULT="PASS"
+
+        AUTH=$(curl -s -w "\n%{http_code}" --max-time 45 -X POST "${BASE}/auth" -H 'Content-Type: application/json' -d "{\"token\":\"${U}\",\"env\":\"test\"}")
+        AUTH_CODE=$(printf '%s' "$AUTH" | tail -1)
+        [ "$AUTH_CODE" = "200" ] || RESULT="FAIL auth=${AUTH_CODE}"
+
+        BAD=$(create_call "$U" '{"name":"bad-lang","language":"cobol","code":"x"}')
+        BAD_CODE=$(printf '%s' "$BAD" | tail -1)
+        [ "$BAD_CODE" = "400" ] || RESULT="FAIL bad_create=${BAD_CODE}"
+
+        CODE_TEXT=$(printf 'def main():\n    return "journey-ok-%s-%s"\n' "$RUN_ID" "$i")
+        CODE_JSON=$(printf '%s' "$CODE_TEXT" | json_escape)
+        GOOD=$(create_call "$U" "{\"name\":\"${FN}\",\"language\":\"python\",\"code\":${CODE_JSON}}")
+        GOOD_CODE=$(printf '%s' "$GOOD" | tail -1)
+        [ "$GOOD_CODE" = "201" ] || RESULT="FAIL create=${GOOD_CODE}"
+
+        DUP=$(create_call "$U" "{\"name\":\"${FN}\",\"language\":\"python\",\"code\":${CODE_JSON}}")
+        DUP_CODE=$(printf '%s' "$DUP" | tail -1)
+        { [ "$DUP_CODE" = "409" ] || [ "$DUP_CODE" = "502" ]; } || RESULT="FAIL dup=${DUP_CODE}"
+
+        INV_STATUS=""
+        INV_RAW=""
+        for try in 1 2 3 4 5 6; do
+            INV=$(invoke_call "$U" "$FN")
+            INV_STATUS=$(json_field "$INV" status)
+            INV_RAW=$(json_field "$INV" response_raw)
+            echo "USER=$i TRY=$try status=$INV_STATUS raw=$INV_RAW"
+            if [ "$INV_STATUS" = "200" ] && printf '%s' "$INV_RAW" | grep -q "journey-ok-${RUN_ID}-${i}"; then
+                break
+            fi
+            [ "$try" -lt 6 ] && sleep 5
+        done
+        [ "$INV_STATUS" = "200" ] || RESULT="FAIL invoke=${INV_STATUS}"
+
+        DEL1=$(curl -s -o /dev/null -w "%{http_code}" --max-time 45 -X DELETE "${BASE}/functions/${FN}" -H "X-Auth-Token: ${U}")
+        [ "$DEL1" = "200" ] || RESULT="FAIL delete1=${DEL1}"
+        DEL2=$(curl -s -o /dev/null -w "%{http_code}" --max-time 45 -X DELETE "${BASE}/functions/${FN}" -H "X-Auth-Token: ${U}")
+        [ "$DEL2" = "404" ] || RESULT="FAIL delete2=${DEL2}"
+
+        echo "$i:$RESULT" > "${TMP}/user-$i"
+    ) &
+done
+wait
+
+PASS=0
+FAIL=0
+for i in $(seq 1 "$COUNT"); do
+    R=$(cat "${TMP}/user-$i" 2>/dev/null || echo "$i:FAIL missing_result")
+    STATUS=$(printf '%s' "$R" | cut -d: -f2-)
+    if [ "$STATUS" = "PASS" ]; then
+        PASS=$((PASS+1))
+        echo "USER_PASS $i"
+    else
+        FAIL=$((FAIL+1))
+        echo "USER_FAIL $i $STATUS"
+    fi
+done
+
+echo "USER_JOURNEYS_PASS=$PASS/$COUNT"
+echo "=== USER JOURNEYS END ==="
+[ "$FAIL" = 0 ]
@@ -0,0 +1,21 @@
+#!/bin/bash
+BASE="https://fission.kube5s.ru/console/api"
+ROOT_DIR=$(cd "$(dirname "$0")" && pwd)
+NS_CLEANUP_SCRIPT="${ROOT_DIR}/cleanup_test_namespaces.sh"
+TEST_SUB="len59direct@test.local"
+
+cleanup() {
+  if [ -x "$NS_CLEANUP_SCRIPT" ]; then
+    "$NS_CLEANUP_SCRIPT" "$TEST_SUB" >/dev/null 2>&1 || true
+  fi
+}
+trap cleanup EXIT
+
+NAME59=$(python3 -c "print('a'*59)")
+echo "Name len: ${#NAME59}"
+echo "Pkg name would be: ${NAME59}-pkg (len=$(python3 -c "print(59+4)"))"
+curl -s -w "\nHTTP:%{http_code}" -X POST "${BASE}/functions" \
+  -H "X-Auth-Token: ${TEST_SUB}" \
+  -H "Content-Type: application/json" \
+  --data-raw "{\"name\":\"${NAME59}\",\"language\":\"nodejs\",\"code\":\"module.exports=async()=>42\"}"
+echo
@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# test_layer1.sh — простой тест пропатченного Fission NSWatcher (Layer 1 only).
+# Без консоли. Только kubectl + fission CLI.
+#
+# Что проверяем:
+#   1. Создаём NS с меткой fission.io/managed=true
+#   2. Executor регистрирует его через NSWatcher (лог)
+#   3. Создаём Python env + function в новом NS
+#   4. Вызываем функцию — должна ответить 200
+#
+# Запуск: bash ~/terra/fission/test_layer1.sh
+
+set -uo pipefail
+
+NS="l1-test-$(date +%s | tail -c 6)"
+PASS=0; FAIL=0
+
+green() { echo -e "\033[32m  PASS: $1\033[0m"; PASS=$((PASS+1)); }
+red()   { echo -e "\033[31m  FAIL: $1\033[0m"; FAIL=$((FAIL+1)); }
+
+echo ""
+echo "========================================"
+echo "  Layer 1 NSWatcher — простой тест"
+echo "  NS: $NS"
+echo "========================================"
+
+# ── 1. Создаём NS с меткой ────────────────────────────────────────────────────
+echo ""
+echo ">>> [1/5] Создаём NS $NS с меткой fission.io/managed=true..."
+kubectl create ns "$NS"
+kubectl label ns "$NS" fission.io/managed=true --overwrite
+
+kubectl get ns "$NS" --show-labels | grep "fission.io/managed"
+if [ $? -eq 0 ]; then
+    green "NS создан с меткой"
+else
+    red "Метка не применилась"
+    exit 1
+fi
+
+# ── 2. Ждём регистрации в executor ────────────────────────────────────────────
+echo ""
+echo ">>> [2/5] Ждём регистрации NS в executor (до 15 сек)..."
+
+DEADLINE=$((SECONDS + 15))
+REGISTERED=false
+while [ $SECONDS -lt $DEADLINE ]; do
+    if kubectl logs -n fission deployment/executor 2>/dev/null | grep "registered namespace" | grep -q "$NS"; then
+        REGISTERED=true
+        break
+    fi
+    sleep 2
+done
+
+if [ "$REGISTERED" = "true" ]; then
+    green "Executor зарегистрировал NS $NS"
+else
+    red "Executor НЕ зарегистрировал NS за 15 сек"
+    echo "  Лог executor (последние строки про namespace):"
+    kubectl logs -n fission deployment/executor 2>/dev/null | grep "namespace" | tail -5
+fi
+
+# ── 3. Создаём environment в новом NS ─────────────────────────────────────────
+echo ""
+echo ">>> [3/5] Создаём Python environment в NS $NS..."
+
+fission env create \
+    --name py-env \
+    --namespace "$NS" \
+    --image ghcr.io/fission/python-env:latest \
+    --poolsize 1 2>&1
+
+if kubectl get environment py-env -n "$NS" &>/dev/null; then
+    green "Environment py-env создан в $NS"
+else
+    red "Environment не создался"
+fi
+
+# ── 4. Создаём функцию ────────────────────────────────────────────────────────
+echo ""
+echo ">>> [4/5] Создаём функцию hello..."
+
+cat > /tmp/hello.py << 'EOF'
+def main():
+    return "hello from layer1"
+EOF
+
+fission fn create \
+    --name hello \
+    --namespace "$NS" \
+    --env py-env \
+    --code /tmp/hello.py 2>&1
+
+fission httptrigger create \
+    --name hello-route \
+    --namespace "$NS" \
+    --function hello \
+    --url "/${NS}/hello" \
+    --method GET 2>&1
+
+if kubectl get httptrigger hello-route -n "$NS" &>/dev/null; then
+    green "Function + HTTPTrigger созданы"
+else
+    red "HTTPTrigger не создался"
+fi
+
+# ── 5. Вызываем функцию через внутренний router с JWT ────────────────────────
+echo ""
+echo ">>> [5/5] Вызываем функцию через internal router + JWT (cold start до 180 сек)..."
+
+ROUTER_INT="http://router.fission.svc.cluster.local"
+DEADLINE=$((SECONDS + 180))
+FN_OK=false
+
+while [ $SECONDS -lt $DEADLINE ]; do
+    RESULT=$(kubectl run fn-probe-$$ --rm -i --restart=Never \
+        --image=curlimages/curl:8.7.1 \
+        --namespace=fission \
+        -- sh -c "
+          TOKEN=\$(curl -sf --max-time 15 -X POST ${ROUTER_INT}/auth/login \
+            -H 'Content-Type: application/json' \
+            -d '{\"username\":\"admin\",\"password\":\"7XG1lSg0EFqPLE4pf3He\"}' \
+            | grep -o '\"accesstoken\":\"[^\"]*' | cut -d'\"' -f4)
+          if [ -z \"\$TOKEN\" ]; then echo 'LOGIN_FAIL|||000'; exit 0; fi
+          curl -s -w '|||%{http_code}' --max-time 90 \
+            -H \"Authorization: Bearer \$TOKEN\" \
+            ${ROUTER_INT}/${NS}/hello
+        " 2>/dev/null | grep "|||" || echo "|||000")
+    CODE=$(echo "$RESULT" | grep -o '|||[0-9]*' | tr -d '|||')
+    BODY=$(echo "$RESULT" | sed 's/|||[0-9]*$//')
+    echo "    HTTP $CODE — $(echo "$BODY" | head -c 80)"
+    [ "$CODE" = "200" ] && FN_OK=true && break
+    sleep 5
+done
+
+if [ "$FN_OK" = "true" ]; then
+    green "Функция ответила 200: $BODY"
+else
+    red "Функция не ответила 200 (timeout)"
+    echo "  Логи router (last 3):"
+    kubectl logs -n fission deployment/router 2>/dev/null | tail -3
+fi
+
+# ── Cleanup ───────────────────────────────────────────────────────────────────
+echo ""
+echo ">>> Cleanup..."
+fission httptrigger delete --name hello-route --namespace "$NS" 2>/dev/null || true
+fission fn delete --name hello --namespace "$NS" 2>/dev/null || true
+fission env delete --name py-env --namespace "$NS" 2>/dev/null || true
+kubectl delete ns "$NS" --wait=false 2>/dev/null || true
+echo "    Готово."
+
+# ── Итог ─────────────────────────────────────────────────────────────────────
+echo ""
+echo "========================================"
+echo "  ИТОГ: PASS=$PASS  FAIL=$FAIL"
+echo "========================================"
+[ $FAIL -eq 0 ] && exit 0 || exit 1
@@ -0,0 +1,214 @@
+#!/usr/bin/env bash
+# test_multitenant_ns.sh — стресс-тест Layer 1 (патченный Fission NSWatcher).
+#
+# Что проверяем:
+#   1. N пользователей создаются параллельно (каждый → свой NS через консоль API)
+#   2. Executor регистрирует каждый NS через NSWatcher (лог: registered namespace)
+#   3. В каждом NS создаётся функция через консоль API
+#   4. Каждая функция вызывается и отвечает правильно
+#   5. Параллельные вызовы всех функций одновременно — нет деградации
+#
+# Запуск: bash test_multitenant_ns.sh [COUNT]
+# COUNT — кол-во параллельных пользователей (default: 10)
+
+set -uo pipefail
+
+if [ "${KUBECTL_DIRECT:-0}" = "1" ]; then
+    EXECUTOR_LOGS_CMD() {
+        kubectl logs -n fission deployment/executor 2>/dev/null
+    }
+else
+    SSH="ssh -i ~/.ssh/naeel_vm_id_ed25519 -o StrictHostKeyChecking=no -o ConnectTimeout=10 naeel@5.172.178.213"
+    EXECUTOR_LOGS_CMD() {
+        $SSH "kubectl logs -n fission deployment/executor 2>/dev/null"
+    }
+fi
+
+BASE="https://fission.kube5s.ru/console/api"
+COUNT=${1:-10}
+RUN_ID="mt$(date +%s | tail -c 6)"
+ROOT_DIR=$(cd "$(dirname "$0")" && pwd)
+NS_CLEANUP_SCRIPT="${ROOT_DIR}/cleanup_test_namespaces.sh"
+PASS=0; FAIL=0
+
+declare -a CREATED_USERS=()
+
+cleanup_namespaces() {
+    rm -rf "${TMPDIR_RESULTS:-}" 2>/dev/null || true
+    if [ -x "$NS_CLEANUP_SCRIPT" ] && [ "${#CREATED_USERS[@]}" -gt 0 ]; then
+        echo ""
+        echo ">>> Cleanup test namespaces..."
+        "$NS_CLEANUP_SCRIPT" "${CREATED_USERS[@]}" || true
+    fi
+}
+trap cleanup_namespaces EXIT
+
+green() { echo -e "\033[32m  PASS: $1\033[0m"; PASS=$((PASS+1)); }
+red()   { echo -e "\033[31m  FAIL: $1\033[0m"; FAIL=$((FAIL+1)); }
+
+echo ""
+echo "========================================"
+echo "  Layer 1 NSWatcher — стресс-тест"
+echo "  Пользователей: $COUNT  run: $RUN_ID"
+echo "========================================"
+
+# Каждый "пользователь" — уникальный X-Auth-Token → уникальный NS
+# Консоль вызывает SetupFissionNamespace → NS получает fission.io/managed=true
+# Executor NSWatcher подхватывает → регистрирует без рестарта
+
+# ── Шаг 1: создаём NS для всех пользователей параллельно ─────────────────────
+echo ""
+echo ">>> [1/4] Создаём NS для $COUNT пользователей параллельно..."
+
+TMPDIR_RESULTS=$(mktemp -d)
+
+for i in $(seq 1 $COUNT); do
+    USER="${RUN_ID}-user${i}@test.local"
+    CREATED_USERS+=("$USER")
+    (
+        CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 \
+            -X GET "${BASE}/functions" \
+            -H "X-Auth-Token: ${USER}" 2>/dev/null || echo 000)
+        echo "$i:$CODE:$USER" > "${TMPDIR_RESULTS}/init-${i}"
+    ) &
+done
+wait
+
+NS_OK=0; NS_FAIL=0
+declare -A USERS
+for i in $(seq 1 $COUNT); do
+    R=$(cat "${TMPDIR_RESULTS}/init-${i}" 2>/dev/null || echo "$i:000:")
+    CODE=$(echo "$R" | cut -d: -f2)
+    USER=$(echo "$R" | cut -d: -f3)
+    USERS[$i]="$USER"
+    if [ "$CODE" = "200" ]; then
+        NS_OK=$((NS_OK+1))
+    else
+        NS_FAIL=$((NS_FAIL+1))
+        echo "    user${i}: HTTP $CODE"
+    fi
+done
+
+if [ $NS_FAIL -eq 0 ]; then
+    green "Все $COUNT NS созданы через консоль API (HTTP 200)"
+else
+    red "$NS_FAIL / $COUNT NS не создались"
+fi
+
+# ── Шаг 2: проверяем что executor зарегистрировал NS ─────────────────────────
+echo ""
+echo ">>> [2/4] Проверяем регистрацию NS в executor..."
+
+# Ждём немного — informer почти мгновенный, но логи могут задержаться
+sleep 5
+
+EXEC_LOGS=$(EXECUTOR_LOGS_CMD | grep 'registered namespace' 2>/dev/null || echo "")
+REGISTERED=0
+for i in $(seq 1 $COUNT); do
+    USER="${USERS[$i]:-}"
+    # NS имя формируется консолью как hash от email
+    # Ищем любые новые registered namespace в логах после старта теста
+    REGISTERED=$(EXECUTOR_LOGS_CMD | grep 'registered namespace' | wc -l 2>/dev/null || echo 0)
+done
+
+echo "    Всего registered namespace событий в executor: $REGISTERED"
+if [ "$REGISTERED" -ge "$COUNT" ]; then
+    green "Executor зарегистрировал минимум $COUNT NS"
+else
+    # Не обязательно FAIL — NS могли быть уже зарегистрированы ранее
+    echo "  INFO: зарегистрировано $REGISTERED (некоторые NS могли существовать до теста)"
+    PASS=$((PASS+1))
+fi
+
+# ── Шаг 3: создаём Python функцию для каждого пользователя ───────────────────
+echo ""
+echo ">>> [3/4] Создаём функции для каждого пользователя параллельно..."
+
+# Простой Python код — не требует компиляции, деплоится мгновенно
+PYTHON_CODE='def main():
+    return "ok-'"${RUN_ID}"'"'
+
+json_escape() {
+    python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))'
+}
+
+for i in $(seq 1 $COUNT); do
+    USER="${USERS[$i]:-${RUN_ID}-user${i}@test.local}"
+    FN_NAME="testfn-${RUN_ID}"
+    (
+        # Создаём функцию
+        CREATE=$(curl -s -w "\n%{http_code}" --max-time 60 \
+            -X POST "${BASE}/functions" \
+            -H "X-Auth-Token: ${USER}" \
+            -H "Content-Type: application/json" \
+            -d "{\"name\":\"${FN_NAME}\",\"language\":\"python\",\"code\":$(printf '%s' \"${PYTHON_CODE}\" | json_escape)}" \
+            2>/dev/null)
+        CODE=$(echo "$CREATE" | tail -1)
+        echo "$i:$CODE" > "${TMPDIR_RESULTS}/create-${i}"
+    ) &
+done
+wait
+
+CREATE_OK=0; CREATE_FAIL=0
+for i in $(seq 1 $COUNT); do
+    R=$(cat "${TMPDIR_RESULTS}/create-${i}" 2>/dev/null || echo "$i:000")
+    CODE=$(echo "$R" | cut -d: -f2)
+    if [ "$CODE" = "200" ] || [ "$CODE" = "201" ]; then
+        CREATE_OK=$((CREATE_OK+1))
+    else
+        CREATE_FAIL=$((CREATE_FAIL+1))
+        echo "    user${i}: create HTTP $CODE"
+    fi
+done
+
+if [ $CREATE_FAIL -eq 0 ]; then
+    green "Все $COUNT функции созданы"
+else
+    red "$CREATE_FAIL / $COUNT функций не создались"
+fi
+
+# ── Шаг 4: вызываем все функции параллельно ──────────────────────────────────
+echo ""
+echo ">>> [4/4] Параллельные вызовы всех $COUNT функций..."
+
+# Ждём прогрева (первый вызов — cold start)
+sleep 5
+
+for i in $(seq 1 $COUNT); do
+    USER="${USERS[$i]:-${RUN_ID}-user${i}@test.local}"
+    FN_NAME="testfn-${RUN_ID}"
+    (
+        CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 \
+            -X POST "${BASE}/functions/${FN_NAME}/invoke" \
+            -H "X-Auth-Token: ${USER}" \
+            -H "Content-Type: application/json" \
+            -d '{}' 2>/dev/null || echo 000)
+        echo "$i:$CODE" > "${TMPDIR_RESULTS}/invoke-${i}"
+    ) &
+done
+wait
+
+INVOKE_OK=0; INVOKE_FAIL=0
+for i in $(seq 1 $COUNT); do
+    R=$(cat "${TMPDIR_RESULTS}/invoke-${i}" 2>/dev/null || echo "$i:000")
+    CODE=$(echo "$R" | cut -d: -f2)
+    if [ "$CODE" = "200" ]; then
+        INVOKE_OK=$((INVOKE_OK+1))
+    else
+        INVOKE_FAIL=$((INVOKE_FAIL+1))
+        echo "    user${i}: invoke HTTP $CODE"
+    fi
+done
+
+if [ $INVOKE_FAIL -eq 0 ]; then
+    green "Все $COUNT функции отвечают HTTP 200 параллельно"
+else
+    red "$INVOKE_FAIL / $COUNT функций не ответили (возможно cold start — повторить тест)"
+fi
+
+# ── Итог ─────────────────────────────────────────────────────────────────────
+echo ""
+echo "========================================"
+echo "  ИТОГ: PASS=$PASS  FAIL=$FAIL"
+echo "========================================"
+[ $FAIL -eq 0 ] && exit 0 || exit 1
@@ -0,0 +1,812 @@
+#!/usr/bin/env bash
+# test_simple_function.sh — интеграционные тесты fission_simple_function
+# Запуск: bash test_simple_function.sh
+# Требования: terraform + kubectl в PATH, kubeconfig в ~/.kube/config
+set -uo pipefail
+
+PASS=0; FAIL=0; SKIP=0
+NAMESPACE="default"
+TESTDIR="/tmp/sless-sf-tests"
+KUBECONFIG_PATH="/home/naeel/.kube/config"
+PROVIDER_NS="default"
+
+# уникальный префикс — не пересекаемся с prod
+RUN_ID="sf$(date +%s | tail -c 6)"
+
+TF_PROVIDER='
+terraform {
+  required_providers {
+    fission = { source = "nail/fission" }
+  }
+}
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+'
+
+green() { echo -e "\033[32m$*\033[0m"; }
+red()   { echo -e "\033[31m$*\033[0m"; }
+yellow(){ echo -e "\033[33m$*\033[0m"; }
+
+pass() { PASS=$((PASS+1)); green "  PASS: $1"; }
+fail() { FAIL=$((FAIL+1)); red   "  FAIL: $1"; }
+skip() { SKIP=$((SKIP+1)); yellow "  SKIP: $1"; }
+
+# ── helpers ──────────────────────────────────────────────────────────────────
+
+kube_exists() {
+  local kind=$1 name=$2
+  kubectl get "${kind}" -n "${NAMESPACE}" "${name}" &>/dev/null
+}
+
+kube_gone() {
+  local kind=$1 name=$2
+  ! kubectl get "${kind}" -n "${NAMESPACE}" "${name}" &>/dev/null
+}
+
+tf_apply() {
+  local dir=$1
+  terraform -chdir="${dir}" apply -auto-approve -no-color 2>&1
+}
+
+tf_destroy() {
+  local dir=$1
+  terraform -chdir="${dir}" destroy -auto-approve -no-color 2>&1
+}
+
+tf_plan_exitcode() {
+  # 0=no-changes, 1=error, 2=changes
+  local dir=$1
+  terraform -chdir="${dir}" plan -detailed-exitcode -no-color 2>&1
+  echo $?
+}
+
+wait_package_ready() {
+  local name=$1 retries=30
+  for ((i=0; i<retries; i++)); do
+    local status
+    status=$(kubectl get packages.fission.io -n "${NAMESPACE}" "${name}" \
+      -o jsonpath='{.status.buildstatus}' 2>/dev/null || echo "")
+    # для literal packages buildstatus пустой — это нормально
+    [[ "$status" == "succeeded" || "$status" == "" ]] && return 0
+    sleep 2
+  done
+  return 1
+}
+
+# ── setup / teardown ─────────────────────────────────────────────────────────
+
+setup_workdir() {
+  local name=$1
+  local dir="${TESTDIR}/${name}"
+  rm -rf "${dir}"
+  mkdir -p "${dir}"
+  echo "${dir}"
+}
+
+write_provider() {
+  local dir=$1
+  cat > "${dir}/main.tf" <<EOF
+${TF_PROVIDER}
+EOF
+}
+
+# ── code fixtures ─────────────────────────────────────────────────────────────
+
+write_js_v1() {
+  local dir=$1
+  mkdir -p "${dir}"
+  cat > "${dir}/main.js" <<'EOF'
+exports.handler = async (ctx) => ({
+  body: JSON.stringify({ msg: "hello-v1", ts: Date.now() }),
+  headers: { "Content-Type": "application/json" },
+});
+EOF
+}
+
+write_js_v2() {
+  local dir=$1
+  mkdir -p "${dir}"
+  cat > "${dir}/main.js" <<'EOF'
+exports.handler = async (ctx) => ({
+  body: JSON.stringify({ msg: "hello-v2-updated", ts: Date.now() }),
+  headers: { "Content-Type": "application/json" },
+});
+EOF
+}
+
+write_python() {
+  local dir=$1
+  mkdir -p "${dir}"
+  cat > "${dir}/main.py" <<'EOF'
+def main():
+    return {"status": 200, "body": '{"msg":"hello-python"}'}
+EOF
+}
+
+write_ruby() {
+  local dir=$1
+  mkdir -p "${dir}"
+  cat > "${dir}/main.rb" <<'EOF'
+def main(ctx)
+  { body: "hello-ruby", status_code: 200 }
+end
+EOF
+}
+
+write_php() {
+  local dir=$1
+  mkdir -p "${dir}"
+  cat > "${dir}/main.php" <<'EOF'
+<?php
+function main($context) {
+    return ["body" => "hello-php"];
+}
+EOF
+}
+
+write_perl() {
+  local dir=$1
+  mkdir -p "${dir}"
+  cat > "${dir}/main.pl" <<'EOF'
+sub main {
+    my ($context) = @_;
+    return { body => "hello-perl" };
+}
+1;
+EOF
+}
+
+EOF
+  cat > "${dir}/go.mod" <<'EOF'
+module fn
+
+go 1.21
+EOF
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+echo ""
+echo "================================================================"
+echo "  fission_simple_function — интеграционные тесты"
+echo "  Run ID: ${RUN_ID}"
+echo "================================================================"
+mkdir -p "${TESTDIR}"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T01: nodejs — create с HTTPTrigger, verify k8s, destroy"
+# ════════════════════════════════════════════════════════════════════════
+T01="${RUN_ID}-node-basic"
+D=$(setup_workdir "t01")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T01}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T01}"
+  methods  = ["GET"]
+}
+EOF
+
+OUT=$(tf_apply "${D}")
+if echo "${OUT}" | grep -q "Apply complete"; then
+  pass "T01: terraform apply OK"
+else
+  fail "T01: terraform apply FAILED"
+  echo "${OUT}" | tail -20
+fi
+
+kube_exists "functions.fission.io" "${T01}" \
+  && pass "T01: Function создана в k8s" || fail "T01: Function не найдена в k8s"
+kube_exists "packages.fission.io" "${T01}-pkg" \
+  && pass "T01: Package создан в k8s"   || fail "T01: Package не найден в k8s"
+kube_exists "httptriggers.fission.io" "${T01}-trigger" \
+  && pass "T01: HTTPTrigger создан в k8s" || fail "T01: HTTPTrigger не найден в k8s"
+kube_exists "environments.fission.io" "simple-nodejs-env" \
+  && pass "T01: Environment simple-nodejs-env создан" || fail "T01: Environment не найден"
+
+OUT=$(tf_destroy "${D}")
+echo "${OUT}" | grep -q "Destroy complete" \
+  && pass "T01: terraform destroy OK" || fail "T01: terraform destroy FAILED"
+
+kube_gone "functions.fission.io"    "${T01}"         && pass "T01: Function удалена после destroy" || fail "T01: Function осталась после destroy"
+kube_gone "packages.fission.io"     "${T01}-pkg"     && pass "T01: Package удалён после destroy"  || fail "T01: Package остался после destroy"
+kube_gone "httptriggers.fission.io" "${T01}-trigger" && pass "T01: Trigger удалён после destroy"  || fail "T01: Trigger остался после destroy"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T02: python — create БЕЗ url (нет HTTPTrigger)"
+# ════════════════════════════════════════════════════════════════════════
+T02="${RUN_ID}-py-notrigger"
+D=$(setup_workdir "t02")
+write_provider "${D}"
+write_python "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T02}"
+  runtime  = "python"
+  code_dir = "\${path.module}/code"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" \
+  && pass "T02: apply OK" || fail "T02: apply FAILED"
+kube_exists "functions.fission.io"  "${T02}"     && pass "T02: Function создана" || fail "T02: Function не найдена"
+kube_exists "packages.fission.io"   "${T02}-pkg" && pass "T02: Package создан"   || fail "T02: Package не найден"
+kube_gone   "httptriggers.fission.io" "${T02}-trigger" \
+  && pass "T02: HTTPTrigger НЕ создан (url не задан)" || fail "T02: HTTPTrigger создан — не должен был"
+kube_exists "environments.fission.io" "simple-python-env" \
+  && pass "T02: Environment simple-python-env создан" || fail "T02: Environment не найден"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T02: destroy OK" || fail "T02: destroy FAILED"
+kube_gone "functions.fission.io" "${T02}" && pass "T02: Function удалена" || fail "T02: Function осталась"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T04: ruby — create с URL"
+# ════════════════════════════════════════════════════════════════════════
+T04="${RUN_ID}-ruby"
+D=$(setup_workdir "t04")
+write_provider "${D}"
+write_ruby "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T04}"
+  runtime  = "ruby"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T04}"
+  methods  = ["GET"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" \
+  && pass "T04: ruby apply OK" || fail "T04: ruby apply FAILED"
+kube_exists "environments.fission.io" "simple-ruby-env" \
+  && pass "T04: simple-ruby-env создан" || fail "T04: simple-ruby-env не найден"
+kube_exists "httptriggers.fission.io" "${T04}-trigger" \
+  && pass "T04: Trigger создан" || fail "T04: Trigger не найден"
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T04: destroy OK" || fail "T04: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T05: php — create с URL"
+# ════════════════════════════════════════════════════════════════════════
+T05="${RUN_ID}-php"
+D=$(setup_workdir "t05")
+write_provider "${D}"
+write_php "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T05}"
+  runtime  = "php"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T05}"
+  methods  = ["GET"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" \
+  && pass "T05: php apply OK" || fail "T05: php apply FAILED"
+kube_exists "environments.fission.io" "simple-php-env" \
+  && pass "T05: simple-php-env создан" || fail "T05: simple-php-env не найден"
+kube_exists "functions.fission.io" "${T05}" \
+  && pass "T05: Function создана" || fail "T05: Function не найдена"
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T05: destroy OK" || fail "T05: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T06: perl — create с URL"
+# ════════════════════════════════════════════════════════════════════════
+T06="${RUN_ID}-perl"
+D=$(setup_workdir "t06")
+write_provider "${D}"
+write_perl "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T06}"
+  runtime  = "perl"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T06}"
+  methods  = ["GET"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" \
+  && pass "T06: perl apply OK" || fail "T06: perl apply FAILED"
+kube_exists "environments.fission.io" "simple-perl-env" \
+  && pass "T06: simple-perl-env создан" || fail "T06: simple-perl-env не найден"
+kube_exists "functions.fission.io" "${T06}" \
+  && pass "T06: Function создана" || fail "T06: Function не найдена"
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T06: destroy OK" || fail "T06: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T07: code_hash drift detection — update пересчитывает хеш и обновляет Package"
+# ════════════════════════════════════════════════════════════════════════
+T07="${RUN_ID}-drift"
+D=$(setup_workdir "t07")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T07}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T07: apply v1 OK" || fail "T07: apply v1 FAILED"
+
+HASH1=$(terraform -chdir="${D}" show -json 2>/dev/null \
+  | python3 -c "import sys,json; r=json.load(sys.stdin)['values']['root_module']['resources']; print(r[0]['values']['code_hash'])" 2>/dev/null || echo "?")
+
+# Обновляем код (v2)
+write_js_v2 "${D}/code"
+
+OUT=$(tf_apply "${D}")
+echo "${OUT}" | grep -q "Apply complete" && pass "T07: apply v2 OK" || fail "T07: apply v2 FAILED"
+
+HASH2=$(terraform -chdir="${D}" show -json 2>/dev/null \
+  | python3 -c "import sys,json; r=json.load(sys.stdin)['values']['root_module']['resources']; print(r[0]['values']['code_hash'])" 2>/dev/null || echo "?")
+
+[ "${HASH1}" != "${HASH2}" ] && [ "${HASH1}" != "?" ] && [ "${HASH2}" != "?" ] \
+  && pass "T07: code_hash изменился (${HASH1:0:8}… → ${HASH2:0:8}…)" \
+  || fail "T07: code_hash не изменился или не читается (h1=${HASH1:0:8}, h2=${HASH2:0:8})"
+
+echo "${OUT}" | grep -qE "fission_simple_function.fn.*updated|updated.*fission_simple_function.fn" \
+  && pass "T07: Package был обновлён (update in apply output)" \
+  || { echo "${OUT}" | grep -q "1 updated" && pass "T07: 1 ресурс обновлён" || fail "T07: Обновление не обнаружено в output"; }
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T07: destroy OK" || fail "T07: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T08: добавление url (update — создание Trigger)"
+# ════════════════════════════════════════════════════════════════════════
+T08="${RUN_ID}-addurl"
+D=$(setup_workdir "t08")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+
+# Apply без url
+cat > "${D}/main.tf" <<EOF
+${TF_PROVIDER}
+resource "fission_simple_function" "fn" {
+  name     = "${T08}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T08: apply (no url) OK" || fail "T08: apply (no url) FAILED"
+kube_gone "httptriggers.fission.io" "${T08}-trigger" \
+  && pass "T08: Trigger не создан (нет url)" || fail "T08: Trigger создан без url"
+
+# Добавляем url
+cat > "${D}/main.tf" <<EOF
+${TF_PROVIDER}
+resource "fission_simple_function" "fn" {
+  name     = "${T08}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T08}"
+  methods  = ["GET", "POST"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T08: apply (with url) OK" || fail "T08: apply (with url) FAILED"
+kube_exists "httptriggers.fission.io" "${T08}-trigger" \
+  && pass "T08: Trigger создан после добавления url" || fail "T08: Trigger не создан после update"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T08: destroy OK" || fail "T08: destroy FAILED"
+kube_gone "httptriggers.fission.io" "${T08}-trigger" \
+  && pass "T08: Trigger удалён при destroy" || fail "T08: Trigger остался"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T09: удаление url (update — удаление Trigger)"
+# ════════════════════════════════════════════════════════════════════════
+T09="${RUN_ID}-rmurl"
+D=$(setup_workdir "t09")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+
+# Apply с url
+cat > "${D}/main.tf" <<EOF
+${TF_PROVIDER}
+resource "fission_simple_function" "fn" {
+  name     = "${T09}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T09}"
+  methods  = ["GET"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T09: apply (with url) OK" || fail "T09: apply (with url) FAILED"
+kube_exists "httptriggers.fission.io" "${T09}-trigger" \
+  && pass "T09: Trigger создан"  || fail "T09: Trigger не создан"
+
+# Убираем url
+cat > "${D}/main.tf" <<EOF
+${TF_PROVIDER}
+resource "fission_simple_function" "fn" {
+  name     = "${T09}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T09: apply (url removed) OK" || fail "T09: apply (url removed) FAILED"
+kube_gone "httptriggers.fission.io" "${T09}-trigger" \
+  && pass "T09: Trigger удалён после убирания url" || fail "T09: Trigger остался после убирания url"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T09: destroy OK" || fail "T09: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T10: изменение url (update Trigger)"
+# ════════════════════════════════════════════════════════════════════════
+T10="${RUN_ID}-churl"
+D=$(setup_workdir "t10")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+
+cat > "${D}/main.tf" <<EOF
+${TF_PROVIDER}
+resource "fission_simple_function" "fn" {
+  name     = "${T10}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T10}/v1"
+  methods  = ["GET"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T10: apply v1 url OK" || fail "T10: apply v1 url FAILED"
+
+URL_BEFORE=$(kubectl get httptriggers.fission.io -n "${NAMESPACE}" "${T10}-trigger" \
+  -o jsonpath='{.spec.relativeurl}' 2>/dev/null || echo "?")
+
+cat > "${D}/main.tf" <<EOF
+${TF_PROVIDER}
+resource "fission_simple_function" "fn" {
+  name     = "${T10}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T10}/v2"
+  methods  = ["GET", "PUT"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T10: apply v2 url OK" || fail "T10: apply v2 url FAILED"
+
+URL_AFTER=$(kubectl get httptriggers.fission.io -n "${NAMESPACE}" "${T10}-trigger" \
+  -o jsonpath='{.spec.relativeurl}' 2>/dev/null || echo "?")
+
+[ "${URL_BEFORE}" = "/test/${T10}/v1" ] && [ "${URL_AFTER}" = "/test/${T10}/v2" ] \
+  && pass "T10: URL обновлён (/v1 → /v2)" \
+  || fail "T10: URL не обновлён (before='${URL_BEFORE}', after='${URL_AFTER}')"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T10: destroy OK" || fail "T10: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T11: plan без изменений → 0 changes"
+# ════════════════════════════════════════════════════════════════════════
+T11="${RUN_ID}-nochange"
+D=$(setup_workdir "t11")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T11}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T11}"
+  methods  = ["GET"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T11: initial apply OK" || fail "T11: initial apply FAILED"
+
+PLAN_OUT=$(terraform -chdir="${D}" plan -no-color 2>&1)
+echo "${PLAN_OUT}" | grep -qE "No changes|0 to add, 0 to change, 0 to destroy" \
+  && pass "T11: повторный plan показывает 0 changes" \
+  || fail "T11: повторный plan показывает изменения (не idempotent)"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T11: destroy OK" || fail "T11: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T12: auto-env idempotency — два ресурса делят один environment"
+# ════════════════════════════════════════════════════════════════════════
+T12A="${RUN_ID}-shared-a"
+T12B="${RUN_ID}-shared-b"
+D=$(setup_workdir "t12")
+write_provider "${D}"
+write_js_v1 "${D}/code-a"
+write_js_v1 "${D}/code-b"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn_a" {
+  name     = "${T12A}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code-a"
+}
+resource "fission_simple_function" "fn_b" {
+  name     = "${T12B}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code-b"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T12: apply двух функций OK" || fail "T12: apply двух функций FAILED"
+kube_exists "functions.fission.io" "${T12A}" && pass "T12: fn_a создана" || fail "T12: fn_a не создана"
+kube_exists "functions.fission.io" "${T12B}" && pass "T12: fn_b создана" || fail "T12: fn_b не создана"
+
+# Environment должен быть один (один simple-nodejs-env)
+ENV_COUNT=$(kubectl get environments.fission.io -n "${NAMESPACE}" -o name 2>/dev/null \
+  | grep -c "simple-nodejs-env" || echo "0")
+[ "${ENV_COUNT}" -eq 1 ] \
+  && pass "T12: ровно 1 экземпляр simple-nodejs-env (shared)" \
+  || fail "T12: ENV_COUNT=${ENV_COUNT} (ожидалось 1)"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T12: destroy OK" || fail "T12: destroy FAILED"
+kube_gone "functions.fission.io" "${T12A}" && pass "T12: fn_a удалена" || fail "T12: fn_a осталась"
+kube_gone "functions.fission.io" "${T12B}" && pass "T12: fn_b удалена" || fail "T12: fn_b осталась"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T13: невалидный runtime → apply завершается ошибкой"
+# ════════════════════════════════════════════════════════════════════════
+T13="${RUN_ID}-badruntime"
+D=$(setup_workdir "t13")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T13}"
+  runtime  = "cobol"
+  code_dir = "\${path.module}/code"
+}
+EOF
+
+OUT=$(tf_apply "${D}" 2>&1 || true)
+echo "${OUT}" | grep -qiE "Error|error|cobol|неподдерживаемый|unsupported" \
+  && pass "T13: apply с runtime=cobol выдал ошибку" \
+  || fail "T13: apply не выдал ошибку для runtime=cobol"
+kube_gone "functions.fission.io" "${T13}" \
+  && pass "T13: Function не создана" || fail "T13: Function создана для плохого runtime"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T14: terraform import (namespace/name)"
+# ════════════════════════════════════════════════════════════════════════
+T14="${RUN_ID}-import"
+D=$(setup_workdir "t14")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T14}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T14}"
+  methods  = ["GET"]
+}
+EOF
+
+# Создаём через apply
+tf_apply "${D}" | grep -q "Apply complete" && pass "T14: initial apply OK" || fail "T14: initial apply FAILED"
+
+# Удаляем state, импортируем обратно
+terraform -chdir="${D}" state rm fission_simple_function.fn &>/dev/null || true
+IMP_OUT=$(terraform -chdir="${D}" import -no-color \
+  fission_simple_function.fn "default/${T14}" 2>&1)
+echo "${IMP_OUT}" | grep -qiE "Import successful|import" \
+  && pass "T14: import выполнен" || fail "T14: import не прошёл: $(echo "${IMP_OUT}" | tail -5)"
+
+# Plan после import должен показать изменения (code_dir/hash не в k8s state)
+# — это нормально, просто убеждаемся что plan не падает с ошибкой
+PLAN_OUT=$(terraform -chdir="${D}" plan -no-color 2>&1)
+echo $? | grep -qE "^[012]$" && pass "T14: plan после import не падает" || fail "T14: plan после import упал"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T14: destroy OK" || fail "T14: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T15: nodejs — методы по умолчанию [GET]"
+# ════════════════════════════════════════════════════════════════════════
+T15="${RUN_ID}-defmethods"
+D=$(setup_workdir "t15")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T15}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T15}"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T15: apply (no methods) OK" || fail "T15: apply FAILED"
+
+METHODS=$(kubectl get httptriggers.fission.io -n "${NAMESPACE}" "${T15}-trigger" \
+  -o jsonpath='{.spec.methods[*]}' 2>/dev/null || echo "?")
+echo "${METHODS}" | grep -q "GET" \
+  && pass "T15: default method=GET в k8s: '${METHODS}'" \
+  || fail "T15: методы не GET: '${METHODS}'"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T15: destroy OK" || fail "T15: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T16: Package.spec для nodejs — deployment (не source)"
+# ════════════════════════════════════════════════════════════════════════
+T16="${RUN_ID}-nodepkg"
+D=$(setup_workdir "t16")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T16}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T16: apply OK" || fail "T16: apply FAILED"
+
+SRC=$(kubectl get packages.fission.io -n "${NAMESPACE}" "${T16}-pkg" \
+  -o jsonpath='{.spec.source.type}' 2>/dev/null || echo "")
+DEP=$(kubectl get packages.fission.io -n "${NAMESPACE}" "${T16}-pkg" \
+  -o jsonpath='{.spec.deployment.type}' 2>/dev/null || echo "")
+[ -z "${SRC}" ] && [ "${DEP}" = "literal" ] \
+  && pass "T16: nodejs Package использует deployment.literal (не source)" \
+  || fail "T16: pkg spec — source.type='${SRC}', deployment.type='${DEP}'"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T16: destroy OK" || fail "T16: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T17: namespace вычисляется из провайдера"
+# ════════════════════════════════════════════════════════════════════════
+T17="${RUN_ID}-ns"
+D=$(setup_workdir "t17")
+write_js_v1 "${D}/code"
+# Провайдер без явного namespace в ресурсе
+cat > "${D}/main.tf" <<EOF
+${TF_PROVIDER}
+resource "fission_simple_function" "fn" {
+  name     = "${T17}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T17: apply OK" || fail "T17: apply FAILED"
+
+NS=$(terraform -chdir="${D}" show -json 2>/dev/null \
+  | python3 -c "import sys,json; r=json.load(sys.stdin)['values']['root_module']['resources']; print(r[0]['values']['namespace'])" 2>/dev/null || echo "?")
+[ "${NS}" = "default" ] \
+  && pass "T17: namespace=default из провайдера (state: ${NS})" \
+  || fail "T17: namespace='${NS}' (ожидалось 'default')"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T17: destroy OK" || fail "T17: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T18: computed поля environment_name/package_name/trigger_name в state"
+# ════════════════════════════════════════════════════════════════════════
+T18="${RUN_ID}-computed"
+D=$(setup_workdir "t18")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T18}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T18}"
+  methods  = ["GET"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T18: apply OK" || fail "T18: apply FAILED"
+
+SHOW=$(terraform -chdir="${D}" show -json 2>/dev/null \
+  | python3 -c "
+import sys, json
+r = json.load(sys.stdin)['values']['root_module']['resources'][0]['values']
+print(r.get('environment_name','?'))
+print(r.get('package_name','?'))
+print(r.get('trigger_name','?'))
+print(r.get('code_hash','?'))
+" 2>/dev/null || echo "?
+?
+?
+?")
+
+ENV_NAME=$(echo "${SHOW}" | sed -n '1p')
+PKG_NAME=$(echo "${SHOW}" | sed -n '2p')
+TRG_NAME=$(echo "${SHOW}" | sed -n '3p')
+HASH_VAL=$(echo "${SHOW}" | sed -n '4p')
+
+[ "${ENV_NAME}" = "simple-nodejs-env" ] && pass "T18: environment_name='${ENV_NAME}'" || fail "T18: environment_name='${ENV_NAME}'"
+[ "${PKG_NAME}" = "${T18}-pkg" ]        && pass "T18: package_name='${PKG_NAME}'"     || fail "T18: package_name='${PKG_NAME}'"
+[ "${TRG_NAME}" = "${T18}-trigger" ]    && pass "T18: trigger_name='${TRG_NAME}'"     || fail "T18: trigger_name='${TRG_NAME}'"
+[[ "${HASH_VAL}" =~ ^[0-9a-f]{64}$ ]]  && pass "T18: code_hash выглядит как sha256" || fail "T18: code_hash='${HASH_VAL}'"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T18: destroy OK" || fail "T18: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T19: повторный apply одного ресурса — idempotency (no drift)"
+# ════════════════════════════════════════════════════════════════════════
+T19="${RUN_ID}-idem"
+D=$(setup_workdir "t19")
+write_provider "${D}"
+write_js_v1 "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T19}"
+  runtime  = "nodejs"
+  code_dir = "\${path.module}/code"
+  url      = "/test/${T19}"
+  methods  = ["GET", "POST"]
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T19: первый apply OK" || fail "T19: первый apply FAILED"
+
+OUT2=$(tf_apply "${D}")
+echo "${OUT2}" | grep -qE "Apply complete.*0 added, 0 changed, 0 destroyed" \
+  && pass "T19: второй apply — 0 changes (idempotent)" \
+  || fail "T19: второй apply не idempotent: $(echo "${OUT2}" | grep -E 'added|changed|destroyed' | tail -2)"
+
+tf_destroy "${D}" | grep -q "Destroy complete" && pass "T19: destroy OK" || fail "T19: destroy FAILED"
+
+# ════════════════════════════════════════════════════════════════════════
+echo ""
+echo ">>> T20: destroy без trigger (url не задан) — нет паники"
+# ════════════════════════════════════════════════════════════════════════
+T20="${RUN_ID}-notrig-del"
+D=$(setup_workdir "t20")
+write_provider "${D}"
+write_python "${D}/code"
+cat >> "${D}/main.tf" <<EOF
+resource "fission_simple_function" "fn" {
+  name     = "${T20}"
+  runtime  = "python"
+  code_dir = "\${path.module}/code"
+}
+EOF
+
+tf_apply "${D}" | grep -q "Apply complete" && pass "T20: apply OK" || fail "T20: apply FAILED"
+OUT=$(tf_destroy "${D}")
+echo "${OUT}" | grep -q "Destroy complete" \
+  && pass "T20: destroy OK (нет паники без trigger)" \
+  || fail "T20: destroy FAILED"
+echo "${OUT}" | grep -qi "panic\|nil pointer" \
+  && fail "T20: PANIC в destroy!" || pass "T20: нет паники при destroy"
+
+# ─────────────────────────────────────────────────────────────────────────────
+echo ""
+echo "================================================================"
+if [ "${FAIL}" -eq 0 ]; then
+  green "  ИТОГ: PASS=${PASS}  FAIL=${FAIL}  SKIP=${SKIP}  — ВСЕ ТЕСТЫ ПРОШЛИ"
+else
+  red   "  ИТОГ: PASS=${PASS}  FAIL=${FAIL}  SKIP=${SKIP}  — ЕСТЬ ПРОВАЛЫ"
+fi
+echo "================================================================"
+echo ""
+
+# Очистка temp dirs
+rm -rf "${TESTDIR}"
+
+[ "${FAIL}" -eq 0 ]
@@ -0,0 +1,326 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE="https://fission.kube5s.ru/console/api"
+ROOT_DIR=$(cd "$(dirname "$0")" && pwd)
+NS_CLEANUP_SCRIPT="${ROOT_DIR}/cleanup_test_namespaces.sh"
+RUN_ID="ui$(date +%s | tail -c 6)"
+PASS=0
+FAIL=0
+
+LOGIN_SUB="ui-login-${RUN_ID}@test.local"
+LANG_SUB="ui-lang-${RUN_ID}@test.local"
+NODE_SUB="ui-node-${RUN_ID}@test.local"
+STACK_SUB="ui-stack-${RUN_ID}@test.local"
+NEG_SUB="ui-neg-${RUN_ID}@test.local"
+
+pass() { PASS=$((PASS+1)); echo "  PASS: $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  FAIL: $1"; }
+
+json_quote() {
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1]))' "$1"
+}
+
+json_field() {
+  local payload="$1"
+  local key="$2"
+  printf '%s' "$payload" | python3 -c 'import json,sys
+key=sys.argv[1]
+try:
+  data=json.load(sys.stdin)
+  value=data.get(key, "")
+  print(value if not isinstance(value, (dict,list)) else json.dumps(value))
+except Exception:
+  print("")' "$key"
+}
+
+cleanup_namespaces() {
+  if [ -x "$NS_CLEANUP_SCRIPT" ]; then
+    echo ""
+    echo ">>> Cleanup UI test namespaces..."
+    KUBECTL_DIRECT=1 "$NS_CLEANUP_SCRIPT" "$LOGIN_SUB" "$LANG_SUB" "$NODE_SUB" "$STACK_SUB" "$NEG_SUB" || true
+  fi
+}
+trap cleanup_namespaces EXIT
+
+auth_call() {
+  local token="$1"
+  local env_name="${2:-test}"
+  curl -s -w "\n%{http_code}" --max-time 45 -X POST "${BASE}/auth" \
+    -H 'Content-Type: application/json' \
+    -d "{\"token\":\"${token}\",\"env\":\"${env_name}\"}"
+}
+
+auth_get() {
+  local path="$1"
+  local token="$2"
+  local env_name="${3:-test}"
+  curl -s -w "\n%{http_code}" --max-time 45 "${BASE}${path}" \
+    -H "X-Auth-Token: ${token}" \
+    -H "X-Auth-Env: ${env_name}"
+}
+
+create_call() {
+  local sub="$1"
+  local body="$2"
+  curl -s -w "\n%{http_code}" --max-time 60 -X POST "${BASE}/functions" \
+    -H "X-Auth-Token: ${sub}" -H 'Content-Type: application/json' -d "$body"
+}
+
+invoke_call() {
+  local sub="$1"
+  local name="$2"
+  local body="${3:-{}}"
+  local out_file err_file http_code rc resp err_text
+  out_file=$(mktemp)
+  err_file=$(mktemp)
+  rc=0
+  http_code=$(curl -sS -o "$out_file" -w "%{http_code}" --max-time 60 -X POST "${BASE}/functions/${name}/invoke" \
+    -H "X-Auth-Token: ${sub}" -H 'Content-Type: application/json' -d "$body" 2>"$err_file") || rc=$?
+  resp=$(cat "$out_file" 2>/dev/null || true)
+  err_text=$(tr '\n' ' ' <"$err_file" | sed 's/[[:space:]]\+/ /g')
+  rm -f "$out_file" "$err_file"
+
+  if [ "$rc" -ne 0 ]; then
+    printf '{"error":%s,"status":"","response_raw":"","http_status":"%s"}\n' \
+      "$(json_quote "curl rc=${rc} http=${http_code}: ${err_text}")" "$http_code"
+    return 0
+  fi
+
+  if printf '%s' "$resp" | python3 -c 'import json,sys; json.load(sys.stdin)' >/dev/null 2>&1; then
+    printf '%s' "$resp"
+    return 0
+  fi
+
+  printf '{"error":%s,"status":"","response_raw":%s,"http_status":"%s"}\n' \
+    "$(json_quote "non-json invoke response http=${http_code}")" "$(json_quote "$resp")" "$http_code"
+}
+
+wait_invoke_ok() {
+  local sub="$1"
+  local name="$2"
+  local expected="$3"
+  local tries="$4"
+  local delay="$5"
+  local try status raw err latency http_status
+  for try in $(seq 1 "$tries"); do
+    resp=$(invoke_call "$sub" "$name")
+    status=$(json_field "$resp" status)
+    raw=$(json_field "$resp" response_raw)
+    err=$(json_field "$resp" error)
+    latency=$(json_field "$resp" latency_ms)
+    http_status=$(json_field "$resp" http_status)
+    echo "    TRY=${try} fn=${name} status=${status} http=${http_status} latency_ms=${latency} raw=${raw} err=${err}"
+    if [ "$status" = "200" ] && printf '%s' "$raw" | grep -q "$expected"; then
+      return 0
+    fi
+    if [ "$try" -lt "$tries" ]; then
+      sleep "$delay"
+    fi
+  done
+  return 1
+}
+
+wait_init_ready() {
+  local token="$1"
+  local env_name="${2:-test}"
+  local tries="$3"
+  local delay="$4"
+  local try debug_raw debug_code debug_body status_raw status_code status_body ready done dbg_ready exec_ready exec_pods router_ready router_pods
+  for try in $(seq 1 "$tries"); do
+    debug_raw=$(auth_get "/ns/debug" "$token" "$env_name")
+    debug_code=$(printf '%s' "$debug_raw" | tail -1)
+    debug_body=$(printf '%s' "$debug_raw" | sed '$d')
+    status_raw=$(auth_get "/ns/status" "$token" "$env_name")
+    status_code=$(printf '%s' "$status_raw" | tail -1)
+    status_body=$(printf '%s' "$status_raw" | sed '$d')
+    ready=$(json_field "$status_body" ready)
+    done=$(printf '%s' "$status_body" | python3 -c 'import json,sys
+try:
+  data=json.load(sys.stdin)
+  print(sum(1 for s in data.get("stages", []) if s.get("done")))
+except Exception:
+  print(0)')
+    dbg_ready=$(printf '%s' "$debug_body" | python3 -c 'import json,sys
+try:
+  data=json.load(sys.stdin)
+  print(str(data.get("controlPlane", {}).get("ready", "")))
+except Exception:
+  print("")')
+    exec_ready=$(printf '%s' "$debug_body" | python3 -c 'import json,sys
+try:
+  data=json.load(sys.stdin)
+  print(str(data.get("controlPlane", {}).get("executor", {}).get("ready", "")))
+except Exception:
+  print("")')
+    exec_pods=$(printf '%s' "$debug_body" | python3 -c 'import json,sys
+try:
+  data=json.load(sys.stdin)
+  print(data.get("controlPlane", {}).get("executor", {}).get("podCount", ""))
+except Exception:
+  print("")')
+    router_ready=$(printf '%s' "$debug_body" | python3 -c 'import json,sys
+try:
+  data=json.load(sys.stdin)
+  print(str(data.get("controlPlane", {}).get("router", {}).get("ready", "")))
+except Exception:
+  print("")')
+    router_pods=$(printf '%s' "$debug_body" | python3 -c 'import json,sys
+try:
+  data=json.load(sys.stdin)
+  print(data.get("controlPlane", {}).get("router", {}).get("podCount", ""))
+except Exception:
+  print("")')
+    echo "    INIT_TRY=${try} status_http=${status_code} debug_http=${debug_code} ready=${ready} done=${done}/3 cp_ready=${dbg_ready} executor_ready=${exec_ready} executor_pods=${exec_pods} router_ready=${router_ready} router_pods=${router_pods}"
+    if [ "$status_code" = "200" ] && [ "$debug_code" = "200" ] && [ "$ready" = "True" -o "$ready" = "true" ]; then
+      return 0
+    fi
+    if [ "$try" -lt "$tries" ]; then
+      sleep "$delay"
+    fi
+  done
+  return 1
+}
+
+echo ""
+echo "========================================"
+echo "  UI-like user flow tests"
+echo "  Run ID: ${RUN_ID}"
+echo "========================================"
+
+echo ""
+echo ">>> T01: login с невалидным токеном"
+R=$(auth_call "not-an-email")
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "401" ] && pass "login invalid token -> 401" || fail "login invalid token -> got $CODE"
+
+echo ""
+echo ">>> T02: login c валидным test token"
+R=$(auth_call "$LOGIN_SUB")
+CODE=$(printf '%s' "$R" | tail -1)
+BODY=$(printf '%s' "$R" | sed '$d')
+NS=$(json_field "$BODY" namespace)
+[ "$CODE" = "200" ] && pass "login valid token -> 200" || fail "login valid token -> got $CODE"
+printf '%s' "$NS" | grep -q '^fission-' && pass "login returns namespace" || fail "login namespace malformed: ${NS}"
+
+echo ""
+echo ">>> T02b: первый вход ждёт init overlay до 3/3"
+if wait_init_ready "$LOGIN_SUB" "test" 12 5; then
+  pass "init overlay path -> namespace ready 3/3"
+else
+  fail "init overlay path did not reach 3/3"
+fi
+
+echo ""
+echo ">>> T03: ошибки create, которые типичны для UI"
+R=$(create_call "$NEG_SUB" '{"name":"","language":"python","code":"def main():\n    return 1"}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "400" ] && pass "empty name -> 400" || fail "empty name -> got $CODE"
+
+R=$(create_call "$NEG_SUB" '{"name":"empty-code","language":"python","code":"   "}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "400" ] && pass "empty code -> 400" || fail "empty code -> got $CODE"
+
+R=$(create_call "$NEG_SUB" '{"name":"bad ttl","language":"python","code":"def main():\n    return 1","ttl":"99z"}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "400" ] && pass "invalid ttl -> 400" || fail "invalid ttl -> got $CODE"
+
+R=$(create_call "$NEG_SUB" '{"name":"bad name fn","language":"python","code":"def main():\n    return 1"}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" != "201" ] && [ "$CODE" != "200" ] && pass "invalid name with spaces rejected" || fail "invalid name unexpectedly created"
+
+R=$(create_call "$NEG_SUB" '{"name":"bad-lang","language":"cobol","code":"x"}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "400" ] && pass "invalid language -> 400" || fail "invalid language -> got $CODE"
+
+echo ""
+echo ">>> T04: duplicate create и повторный delete"
+R=$(create_call "$NEG_SUB" '{"name":"dup-ui","language":"python","entrypoint":"main.main","code":"def main():\n    return \"dup-ui\""}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "201" ] && pass "first create -> 201" || fail "first create -> got $CODE"
+
+R=$(create_call "$NEG_SUB" '{"name":"dup-ui","language":"python","entrypoint":"main.main","code":"def main():\n    return \"dup-ui-2\""}')
+CODE=$(printf '%s' "$R" | tail -1)
+([ "$CODE" = "409" ] || [ "$CODE" = "502" ]) && pass "duplicate create rejected" || fail "duplicate create -> got $CODE"
+
+DC=$(curl -s -o /dev/null -w "%{http_code}" --max-time 45 -X DELETE "${BASE}/functions/dup-ui" -H "X-Auth-Token: ${NEG_SUB}")
+[ "$DC" = "200" ] && pass "first delete -> 200" || fail "first delete -> got $DC"
+DC2=$(curl -s -o /dev/null -w "%{http_code}" --max-time 45 -X DELETE "${BASE}/functions/dup-ui" -H "X-Auth-Token: ${NEG_SUB}")
+[ "$DC2" = "404" ] && pass "second delete -> 404" || fail "second delete -> got $DC2"
+
+echo ""
+echo ">>> T05: Python create/invoke как из UI"
+R=$(create_call "$LANG_SUB" '{"name":"py-ui","language":"python","entrypoint":"main.main","code":"def main():\n    return \"py-ui-ok\""}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "201" ] && pass "python create -> 201" || fail "python create -> got $CODE"
+if wait_invoke_ok "$LANG_SUB" "py-ui" "py-ui-ok" 8 5; then
+  pass "python invoke -> 200"
+else
+  fail "python invoke did not stabilize"
+fi
+
+PY_PAR1=$(invoke_call "$LANG_SUB" "py-ui")
+PY_PAR2=$(invoke_call "$LANG_SUB" "py-ui")
+[ "$(json_field "$PY_PAR1" status)" = "200" ] && [ "$(json_field "$PY_PAR2" status)" = "200" ] && pass "python double invoke -> both 200" || fail "python double invoke did not return two 200s"
+
+echo ""
+echo ">>> T06: NodeJS create/invoke и edit/update"
+R=$(create_call "$NODE_SUB" '{"name":"node-ui","language":"nodejs","entrypoint":"main","code":"module.exports = async function() { return { status: 200, body: \"node-ui-ok\" }; }"}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "201" ] && pass "nodejs create -> 201" || fail "nodejs create -> got $CODE"
+if wait_invoke_ok "$NODE_SUB" "node-ui" "node-ui-ok" 16 5; then
+  pass "nodejs invoke -> 200"
+else
+  fail "nodejs invoke did not stabilize"
+fi
+UPD=$(curl -s -w "\n%{http_code}" --max-time 60 -X PUT "${BASE}/functions/node-ui/code" \
+  -H "X-Auth-Token: ${NODE_SUB}" -H 'Content-Type: application/json' \
+  -d '{"code":"module.exports = async function() { return { status: 200, body: \"node-ui-updated\" }; }"}')
+CODE=$(printf '%s' "$UPD" | tail -1)
+[ "$CODE" = "200" ] && pass "nodejs update -> 200" || fail "nodejs update -> got $CODE"
+if wait_invoke_ok "$NODE_SUB" "node-ui" "node-ui-updated" 16 5; then
+  pass "nodejs invoke after edit -> updated body"
+else
+  fail "nodejs invoke after edit did not return updated body"
+fi
+
+echo ""
+echo ">>> T07: PHP и Ruby в одном namespace"
+PHP_CODE=$(python3 -c 'import json; print(json.dumps("<?php\nfunction handler($context) {\n    $context[\"response\"]->getBody()->write(\"php-ui-ok\");\n}"))')
+RUBY_CODE=$(python3 -c 'import json; print(json.dumps("def handler\n  \"ruby-ui-ok\"\nend"))')
+
+R=$(create_call "$STACK_SUB" "{\"name\":\"php-ui\",\"language\":\"php\",\"entrypoint\":\"main.php::handler\",\"code\":${PHP_CODE}}")
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "201" ] && pass "php create -> 201" || fail "php create -> got $CODE"
+if wait_invoke_ok "$STACK_SUB" "php-ui" "php-ui-ok" 24 10; then
+  pass "php invoke -> 200"
+else
+  fail "php invoke did not stabilize"
+fi
+
+R=$(create_call "$STACK_SUB" "{\"name\":\"ruby-ui\",\"language\":\"ruby\",\"entrypoint\":\"handler\",\"code\":${RUBY_CODE}}")
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "201" ] && pass "ruby create -> 201" || fail "ruby create -> got $CODE"
+if wait_invoke_ok "$STACK_SUB" "ruby-ui" "ruby-ui-ok" 24 10; then
+  pass "ruby invoke -> 200"
+else
+  fail "ruby invoke did not stabilize"
+fi
+
+echo ""
+echo ">>> T08: плохой entrypoint как пользовательский промах"
+R=$(create_call "$NEG_SUB" '{"name":"node-bad-entry","language":"nodejs","entrypoint":"missing","code":"module.exports = async function() { return { status: 200, body: \"bad\" }; }"}')
+CODE=$(printf '%s' "$R" | tail -1)
+[ "$CODE" = "201" ] && pass "bad entrypoint function created" || fail "bad entrypoint create -> got $CODE"
+RESP=$(invoke_call "$NEG_SUB" "node-bad-entry")
+STATUS=$(json_field "$RESP" status)
+ERR=$(json_field "$RESP" error)
+[ "$STATUS" != "200" ] && pass "bad entrypoint invoke fails as expected" || fail "bad entrypoint unexpectedly invoked"
+printf '%s' "$ERR" | grep -Eiq 'timeout|specialization|error|not found' && pass "bad entrypoint error is visible" || fail "bad entrypoint error text weak: ${ERR}"
+
+echo ""
+echo "========================================"
+echo "  RESULT: PASS=${PASS} FAIL=${FAIL}"
+echo "========================================"
+
+[ "$FAIL" -eq 0 ]
@@ -0,0 +1,783 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+BASE="https://fission.kube5s.ru/console/api"
+ROOT_DIR=$(cd "$(dirname "$0")" && pwd)
+NS_CLEANUP_SCRIPT="${ROOT_DIR}/cleanup_test_namespaces.sh"
+PASS=0; FAIL=0
+RUN_ID=$(date +%s%N 2>/dev/null || date +%s)$(od -An -N2 -tu2 /dev/urandom 2>/dev/null | tr -d ' ' || echo "$$")
+RUN_ID=$(echo "$RUN_ID" | sha256sum 2>/dev/null | head -c 8 || echo "${RUN_ID}" | cut -c1-8)
+
+cleanup_namespaces() {
+  local subs=()
+  subs+=("alice@test.local" "routetest-alice@test.local" "routetest-bob@test.local")
+  subs+=("val-user@test.local" "dup-user@test.local" "upd-user@test.local" "get-user@test.local")
+  subs+=("ns-u1@test.local" "ns-u2@test.local" "alice-del@test.local" "carol-del@test.local")
+  subs+=("py-user@test.local" "js-user@test.local" "ttl-user@test.local" "body-user@test.local")
+  subs+=("stress-user@test.local" "brand-new-empty-user-xyzqwerty@test.local" "chain-user@test.local")
+  subs+=("dup2-user-${RUN_ID}@test.local" "name-user-${RUN_ID}@test.local")
+  subs+=("len57-user-${RUN_ID}@test.local" "big-user-${RUN_ID}@test.local" "size-user-${RUN_ID}@test.local")
+  subs+=("ttl-exp-${RUN_ID}@test.local" "race-${RUN_ID}@test.local")
+  subs+=("mfunc-${RUN_ID}@test.local" "victim-${RUN_ID}@test.local" "attacker-${RUN_ID}@test.local")
+  subs+=("lang-multi-${RUN_ID}@test.local" "lang-inv-${RUN_ID}@test.local")
+
+  local uid
+  for uid in $(seq 1 10); do
+    subs+=("u${uid}-${RUN_ID}@test.local")
+  done
+  for uid in $(seq 1 3); do
+    subs+=("fullcycle-u${uid}-${RUN_ID}@test.local")
+  done
+
+  if [ -x "$NS_CLEANUP_SCRIPT" ]; then
+    echo ""
+    echo ">>> Cleanup test namespaces..."
+    "$NS_CLEANUP_SCRIPT" "${subs[@]}" || true
+  fi
+}
+trap cleanup_namespaces EXIT
+
+pass() { PASS=$((PASS+1)); echo "  PASS: $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  FAIL: $1"; }
+check_http() { local got=$1 want=$2 label=$3; [ "$got" = "$want" ] && pass "$label (HTTP $got)" || fail "$label --- got HTTP $got, want $want"; }
+
+echo ""
+echo "========================================"
+echo "  fission-console v0.6.8 — ТЕСТ v2"
+echo "========================================"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК A: Фиксы v0.6.8 — регресс"
+
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions/nonexistent-xyz-abc/invoke \
+  -H "X-Auth-Token: alice@test.local" -H "Content-Type: application/json" -d '{}')
+CODE=$(echo "$R" | tail -1); BODY=$(echo "$R" | head -1)
+check_http "$CODE" "404" "INVOKE nonexistent → 404"
+echo "$BODY" | grep -q "not found" && pass "INVOKE nonexistent — тело содержит 'not found'" || fail "INVOKE nonexistent — тело: $BODY"
+
+R=$(curl -s -w "\n%{http_code}" -X DELETE ${BASE}/functions/nonexistent-xyz-abc \
+  -H "X-Auth-Token: alice@test.local")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "404" "DELETE nonexistent → 404"
+
+# Создаём изолированные функции и проверяем route isolation
+ISO_NAME="iso-${RUN_ID}"
+R_A=$(curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: routetest-alice@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"${ISO_NAME}\",\"language\":\"nodejs\",\"code\":\"module.exports=async(ctx)=>({body:\\\"alice-iso\\\"})\",\"ttl\":\"5m\"}")
+R_B=$(curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: routetest-bob@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"${ISO_NAME}\",\"language\":\"nodejs\",\"code\":\"module.exports=async(ctx)=>({body:\\\"bob-iso\\\"})\",\"ttl\":\"5m\"}")
+ROUTE_A=$(echo "$R_A" | python3 -c "import sys,json; print(json.load(sys.stdin).get('route','?'))" 2>/dev/null)
+ROUTE_B=$(echo "$R_B" | python3 -c "import sys,json; print(json.load(sys.stdin).get('route','?'))" 2>/dev/null)
+[ "$ROUTE_A" != "$ROUTE_B" ] && pass "Route isolation: маршруты различаются ($ROUTE_A vs $ROUTE_B)" || fail "Route collision: маршруты одинаковы: $ROUTE_A"
+
+sleep 10
+
+# Invoke после изоляции
+INV_A=$(curl -s -X POST ${BASE}/functions/${ISO_NAME}/invoke \
+  -H "X-Auth-Token: routetest-alice@test.local" -H "Content-Type: application/json" -d '{}')
+INV_B=$(curl -s -X POST ${BASE}/functions/${ISO_NAME}/invoke \
+  -H "X-Auth-Token: routetest-bob@test.local" -H "Content-Type: application/json" -d '{}')
+BODY_A=$(echo "$INV_A" | python3 -c "import sys,json; print(json.load(sys.stdin).get('response_raw','?'))" 2>/dev/null)
+BODY_B=$(echo "$INV_B" | python3 -c "import sys,json; print(json.load(sys.stdin).get('response_raw','?'))" 2>/dev/null)
+[ "$BODY_A" = "alice-iso" ] && pass "Route isolation invoke — alice получает alice" || fail "Route isolation — alice получила: $BODY_A"
+[ "$BODY_B" = "bob-iso" ] && pass "Route isolation invoke — bob получает bob" || fail "Route isolation — bob получил: $BODY_B"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК B: Валидация входных данных"
+
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: val-user@test.local" -H "Content-Type: application/json" \
+  -d '{"language":"nodejs","code":"x"}')
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "400" "Создание без name → 400"
+
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: val-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"nocode-fn","language":"nodejs"}')
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "400" "Создание без code → 400"
+
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: val-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"nolang-fn","code":"x"}')
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "400" "Создание без language → 400"
+
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: val-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"","language":"nodejs","code":"x"}')
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "400" "Создание с пустым name → 400"
+
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: val-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"bad lang fn","language":"nodejs","code":"x"}')
+# Fission не позволяет пробелы в имени — ожидаем 4xx или 502
+CODE=$(echo "$R" | tail -1)
+( [ "$CODE" = "400" ] || [ "$CODE" = "422" ] || [ "$CODE" = "502" ] ) && pass "Имя с пробелами → не 201 (got $CODE)" || fail "Имя с пробелами → got $CODE"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК C: Дублирующее создание"
+
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: dup-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"dup-fn","language":"nodejs","code":"module.exports=async()=>({body:\"v1\"});","ttl":"5m"}' > /dev/null
+
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: dup-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"dup-fn","language":"nodejs","code":"module.exports=async()=>({body:\"v2\"});","ttl":"5m"}')
+CODE=$(echo "$R" | tail -1)
+( [ "$CODE" = "409" ] || [ "$CODE" = "502" ] ) && pass "Дублирующее создание → конфликт (got $CODE)" || fail "Дублирующее создание → got $CODE"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК D: UPDATE кода и повторный invoke"
+
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: upd-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"upd-fn","language":"nodejs","code":"module.exports=async()=>({body:\"before\"});","ttl":"10m"}' > /dev/null
+
+sleep 3
+
+R=$(curl -s -w "\n%{http_code}" -X PUT ${BASE}/functions/upd-fn/code \
+  -H "X-Auth-Token: upd-user@test.local" -H "Content-Type: application/json" \
+  -d '{"code":"module.exports=async()=>({body:\"after\"});"}')
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "200" "UPDATE code → 200"
+
+sleep 10
+
+INV=$(curl -s -X POST ${BASE}/functions/upd-fn/invoke \
+  -H "X-Auth-Token: upd-user@test.local" -H "Content-Type: application/json" -d '{}')
+BODY=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('response_raw','?'))" 2>/dev/null)
+[ "$BODY" = "after" ] && pass "После UPDATE — invoke возвращает новый код" || fail "После UPDATE — invoke вернул: $BODY"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК E: GET функции"
+
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: get-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"get-fn","language":"nodejs","code":"x","ttl":"5m"}' > /dev/null
+
+R=$(curl -s -w "\n%{http_code}" ${BASE}/functions/get-fn \
+  -H "X-Auth-Token: get-user@test.local")
+CODE=$(echo "$R" | tail -1); BODY=$(echo "$R" | head -1)
+check_http "$CODE" "200" "GET существующей функции → 200"
+echo "$BODY" | python3 -c "import sys,json; d=json.load(sys.stdin); exit(0 if d.get('name')=='get-fn' else 1)" 2>/dev/null \
+  && pass "GET — имя функции в ответе" || fail "GET — имя не найдено: $BODY"
+
+R=$(curl -s -w "\n%{http_code}" ${BASE}/functions/nonexist-get-xyz \
+  -H "X-Auth-Token: get-user@test.local")
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "404" "GET несуществующей → 404"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК F: Namespace изоляция LIST"
+
+# u1 создаёт 3 функции, u2 — 1. LIST u1 должен вернуть только свои
+for i in 1 2 3; do
+  curl -s -X POST ${BASE}/functions \
+    -H "X-Auth-Token: ns-u1@test.local" -H "Content-Type: application/json" \
+    -d "{\"name\":\"ns-fn-$i\",\"language\":\"nodejs\",\"code\":\"x\",\"ttl\":\"5m\"}" > /dev/null
+done
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: ns-u2@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"ns-fn-u2","language":"nodejs","code":"x","ttl":"5m"}' > /dev/null
+
+COUNT_U1=$(curl -s ${BASE}/functions -H "X-Auth-Token: ns-u1@test.local" \
+  | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null)
+COUNT_U2=$(curl -s ${BASE}/functions -H "X-Auth-Token: ns-u2@test.local" \
+  | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null)
+
+[ "$COUNT_U1" -ge 3 ] 2>/dev/null && pass "LIST изоляция: u1 видит $COUNT_U1 функций (>= 3)" || fail "LIST u1 — $COUNT_U1"
+[ "$COUNT_U2" -ge 1 ] && [ "$COUNT_U2" -lt "$COUNT_U1" ] 2>/dev/null && pass "LIST изоляция: u2 видит $COUNT_U2 (меньше чем u1)" || fail "LIST u2 — $COUNT_U2 (u1=$COUNT_U1)"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК G: Namespace изоляция DELETE"
+
+# Carol пытается удалить функцию Alice
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: alice-del@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"alice-secret","language":"nodejs","code":"x","ttl":"5m"}' > /dev/null
+
+R=$(curl -s -w "\n%{http_code}" -X DELETE ${BASE}/functions/alice-secret \
+  -H "X-Auth-Token: carol-del@test.local")
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "404" "Carol DELETE alice функции → 404"
+
+# Alice сама удаляет — должно быть 200
+R=$(curl -s -w "\n%{http_code}" -X DELETE ${BASE}/functions/alice-secret \
+  -H "X-Auth-Token: alice-del@test.local")
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "200" "Alice DELETE своей функции → 200"
+
+# Alice повторно удаляет — 404
+R=$(curl -s -w "\n%{http_code}" -X DELETE ${BASE}/functions/alice-secret \
+  -H "X-Auth-Token: alice-del@test.local")
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "404" "Alice повторный DELETE → 404"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК H: Python — разные форматы кода"
+
+# Формат 1: def main() без аргумента — Fission Python env вызывает main() без аргументов
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: py-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"py-main-'${RUN_ID}'","language":"python","code":"def main():\n    return \"py-main\", 200","ttl":"10m"}' > /dev/null
+
+sleep 15
+
+INV=$(curl -s -X POST ${BASE}/functions/py-main-${RUN_ID}/invoke \
+  -H "X-Auth-Token: py-user@test.local" -H "Content-Type: application/json" -d '{}')
+STATUS=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','?'))" 2>/dev/null)
+[ "$STATUS" = "200" ] && pass "Python def main() (no-arg) → invoke 200" || fail "Python def main → status=$STATUS body=$(echo $INV)"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК I: NodeJS — несколько export-паттернов"
+
+# module.exports = async function
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: js-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"js-anon","language":"nodejs","code":"module.exports=async function(ctx){return {body:\"anon\"};}","ttl":"10m"}' > /dev/null
+
+# exports.handler
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: js-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"js-handler","language":"nodejs","code":"exports.handler=async(ctx)=>({body:\"handler\"});","ttl":"10m"}' > /dev/null
+
+# exports.default
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: js-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"js-default","language":"nodejs","code":"exports.default=async(ctx)=>({body:\"default\"});","ttl":"10m"}' > /dev/null
+
+sleep 10
+
+for fn_name in js-anon js-handler js-default; do
+  INV=$(curl -s -X POST ${BASE}/functions/${fn_name}/invoke \
+    -H "X-Auth-Token: js-user@test.local" -H "Content-Type: application/json" -d '{}')
+  STATUS=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','?'))" 2>/dev/null)
+  [ "$STATUS" = "200" ] && pass "NodeJS $fn_name → 200" || fail "NodeJS $fn_name → status=$STATUS / $(echo $INV)"
+done
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК J: TTL — создание и проверка"
+
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: ttl-user@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"ttl-has-${RUN_ID}\",\"language\":\"nodejs\",\"code\":\"x\",\"ttl\":\"15m\"}" \
+  | python3 -c "import sys,json; d=json.load(sys.stdin); exit(0 if d.get('expires_at') else 1)" 2>/dev/null \
+  && pass "TTL=15m — expires_at присутствует" || fail "TTL=15m — expires_at отсутствует"
+
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: ttl-user@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"ttl-noexp-${RUN_ID}\",\"language\":\"nodejs\",\"code\":\"x\"}" \
+  | python3 -c "import sys,json; d=json.load(sys.stdin); exit(0 if not d.get('expires_at') else 1)" 2>/dev/null \
+  && pass "Без TTL — expires_at отсутствует" || fail "Без TTL — expires_at присутствует (не ожидалось)"
+
+# Невалидный TTL
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: ttl-user@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"ttl-bad-${RUN_ID}\",\"language\":\"nodejs\",\"code\":\"x\",\"ttl\":\"99z\"}")
+CODE=$(echo "$R" | tail -1)
+[ "$CODE" = "400" ] && pass "Невалидный TTL=99z → 400" || fail "Невалидный TTL=99z → got $CODE"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК K: Invoke — тело запроса передаётся в функцию"
+
+# ctx.request.body может быть undefined — тестируем через ctx.request.url (всегда доступен)
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: body-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"echo-url","language":"nodejs","code":"module.exports=async(ctx)=>({body:\"got:\"+ctx.request.url});","ttl":"10m"}' > /dev/null
+
+sleep 12
+
+INV=$(curl -s -X POST ${BASE}/functions/echo-url/invoke \
+  -H "X-Auth-Token: body-user@test.local" -H "Content-Type: application/json" \
+  -d '{"hello":"world"}')
+RESP=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('response_raw','?'))" 2>/dev/null)
+STATUS=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','?'))" 2>/dev/null)
+[ "$STATUS" = "200" ] && pass "NodeJS ctx.request.url доступен — invoke 200" || fail "Echo url — status=$STATUS resp: $RESP"
+echo "$RESP" | grep -q "got:" && pass "NodeJS ctx.request.url содержит данные" || fail "ctx.request.url — ответ: $RESP"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК L: Stress — 10 параллельных invoke"
+
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: stress-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"stress-fn","language":"nodejs","code":"module.exports=async()=>({body:\"ok\"});","ttl":"10m"}' > /dev/null
+sleep 8
+
+STRESS_OK=0
+for i in $(seq 1 10); do
+  ST=$(curl -s -X POST ${BASE}/functions/stress-fn/invoke \
+    -H "X-Auth-Token: stress-user@test.local" -H "Content-Type: application/json" -d '{}' \
+    | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','?'))" 2>/dev/null)
+  [ "$ST" = "200" ] && STRESS_OK=$((STRESS_OK+1))
+done &
+wait
+
+# Run them
+STRESS_OK=0
+PIDS=()
+TMPDIR_S=$(mktemp -d)
+for i in $(seq 1 10); do
+  ( curl -s -X POST ${BASE}/functions/stress-fn/invoke \
+    -H "X-Auth-Token: stress-user@test.local" -H "Content-Type: application/json" -d '{}' \
+    | python3 -c "import sys,json; d=json.load(sys.stdin); exit(0 if d.get('status')==200 else 1)" 2>/dev/null \
+    && touch "${TMPDIR_S}/ok_$i" || true ) &
+done
+wait
+STRESS_OK=$(ls ${TMPDIR_S}/ok_* 2>/dev/null | wc -l)
+rm -rf "${TMPDIR_S}"
+[ "$STRESS_OK" -ge 9 ] && pass "Stress 10 parallel: $STRESS_OK/10 OK" || fail "Stress 10 parallel: $STRESS_OK/10 OK"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК M: LIST пустого namespace"
+
+COUNT=$(curl -s ${BASE}/functions -H "X-Auth-Token: brand-new-empty-user-xyzqwerty@test.local" \
+  | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null)
+[ "$COUNT" = "0" ] && pass "LIST новый пользователь → пустой список" || fail "LIST новый пользователь → $COUNT"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК N: DELETE полная цепочка (fn + pkg + trigger)"
+
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: chain-user@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"chain-fn","language":"nodejs","code":"module.exports=async()=>({body:\"ok\"});","ttl":"5m"}' > /dev/null
+
+# Получаем NS для chain-user из LIST (до DELETE)
+NS_CHAIN=$(curl -s ${BASE}/functions -H "X-Auth-Token: chain-user@test.local" \
+  | python3 -c "import sys,json; items=json.load(sys.stdin); print(items[0]['metadata']['namespace'] if items else '')" 2>/dev/null)
+
+R=$(curl -s -w "\n%{http_code}" -X DELETE ${BASE}/functions/chain-fn \
+  -H "X-Auth-Token: chain-user@test.local")
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "200" "DELETE chain-fn → 200"
+
+# Ждём propagation удаления в k8s
+sleep 3
+# k8s: проверяем через kubectl (или через API если kubectl недоступен)
+FN_RAW=$(kubectl get functions.fission.io chain-fn -n ${NS_CHAIN} 2>&1)
+if echo "$FN_RAW" | grep -q "not found"; then
+  pass "k8s: Function удалена после DELETE"
+elif echo "$FN_RAW" | grep -q "credentials\|logged in\|Unauthorized"; then
+  # kubectl недоступен — проверяем через API (GET должен давать 404)
+  FN_API=$(curl -s -o /dev/null -w "%{http_code}" ${BASE}/functions/chain-fn \
+    -H "X-Auth-Token: chain-user@test.local")
+  [ "$FN_API" = "404" ] && pass "k8s: Function удалена (подтверждено API, kubectl без прав)" || fail "k8s: Function не удалена, API=$FN_API"
+else
+  fail "k8s: Function ещё существует в $NS_CHAIN"
+fi
+TRG_EXISTS=$(kubectl get httptriggers.fission.io -n ${NS_CHAIN} 2>&1 | grep -c "chain-fn" || true)
+
+# После удаления GET должен вернуть 404
+R=$(curl -s -w "\n%{http_code}" ${BASE}/functions/chain-fn \
+  -H "X-Auth-Token: chain-user@test.local")
+CODE=$(echo "$R" | tail -1); check_http "$CODE" "404" "GET после DELETE → 404"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК O: Auth — без заголовка"
+
+R=$(curl -s -w "\n%{http_code}" ${BASE}/functions)
+CODE=$(echo "$R" | tail -1)
+( [ "$CODE" = "401" ] || [ "$CODE" = "403" ] ) && pass "Без X-Auth-Token → 401/403 (got $CODE)" || fail "Без X-Auth-Token → got $CODE"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК P: /console/api/auth"
+
+# POST /auth без токена → 400 bad request
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/auth \
+  -H "Content-Type: application/json" -d '{"token":""}')
+CODE=$(echo "$R" | tail -1); BODY=$(echo "$R" | head -1)
+check_http "$CODE" "400" "POST /auth без токена → 400"
+echo "$BODY" | grep -q "token\|required\|invalid" && pass "/auth — тело содержит ошибку токена" || fail "/auth — тело: $BODY"
+
+# POST /auth с невалидным токеном → 401
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/auth \
+  -H "Content-Type: application/json" -d '{"token":"not.a.real.jwt.token"}')
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "401" "POST /auth с невалидным токеном → 401"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК Q: Дубликат → 409, невалидное имя → 400"
+
+# Создаём функцию, потом снова с тем же именем → 409
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: dup2-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"dup-q-${RUN_ID}\",\"language\":\"nodejs\",\"code\":\"module.exports=async()=>({body:'x'})\"}" > /dev/null
+sleep 3
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: dup2-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"dup-q-${RUN_ID}\",\"language\":\"nodejs\",\"code\":\"module.exports=async()=>({body:'x'})\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "409" "Дубликат → 409 Conflict"
+
+# Имя с заглавной буквой → 400
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: name-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"BadName\",\"language\":\"nodejs\",\"code\":\"x\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "400" "Имя с заглавной буквой → 400"
+
+# Имя начинается с дефиса → 400
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: name-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"-badstart\",\"language\":\"nodejs\",\"code\":\"x\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "400" "Имя с ведущим дефисом → 400"
+
+# Имя заканчивается дефисом → 400
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: name-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"badend-\",\"language\":\"nodejs\",\"code\":\"x\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "400" "Имя с завершающим дефисом → 400"
+
+# Имя с пробелами → 400 (было 502)
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: name-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"bad name\",\"language\":\"nodejs\",\"code\":\"x\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "400" "Имя с пробелом → 400 (не 502)"
+
+# Имя 64 символа → 400
+LONGNAME=$(python3 -c "print('a'*64)")
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: name-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"${LONGNAME}\",\"language\":\"nodejs\",\"code\":\"x\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "400" "Имя 64 символа → 400"
+
+# Имя 58 символов → 400 (route = 64 > 63, Fission webhook отклонит)
+NAME58=$(python3 -c "print('a'*58)")
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: name-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"${NAME58}\",\"language\":\"nodejs\",\"code\":\"x\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "400" "Имя 58 символов → 400 (route будет 64 символа)"
+
+# Имя 57 символов → принято (route = 63 символа, ровно лимит Fission)
+NAME57=$(python3 -c "print('a'*57)")
+# Первый прогрев namespace
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: len57-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"warmup","language":"nodejs","code":"module.exports=async()=>({body:\"w\"})"}' > /dev/null
+sleep 8
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: len57-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"${NAME57}\",\"language\":\"nodejs\",\"code\":\"module.exports=async()=>({body:'ok'})\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "201" "Имя 57 символов → принято (201)"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК R: Лимит размера кода 1MB"
+
+# Код > 1MB → 400
+BIG_TMP=$(mktemp)
+python3 -c "
+import json, sys
+code = 'x' * (1024*1024 + 1)
+body = json.dumps({'name':'big-fn','language':'nodejs','code':code})
+sys.stdout.write(body)
+" > "$BIG_TMP"
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: big-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  --data @"$BIG_TMP")
+rm -f "$BIG_TMP"
+CODE=$(echo "$R" | tail -1)
+# 400 = наш код, 413 = nginx body limit, 000 = connection reset nginx — всё означает "отклонён"
+( [ "$CODE" = "400" ] || [ "$CODE" = "413" ] || [ "$CODE" = "000" ] ) \
+  && pass "Код > 1MB → отклонён (HTTP $CODE)" \
+  || fail "Код > 1MB → got HTTP $CODE (ожидался 400/413)"
+
+# Код ровно 1000 символов → не 400
+CODE1K=$(python3 -c "print('module.exports=async()=>({body:' + '\"x\"' + '});' + ' '*(1000-38))")
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: size-user-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"size-fn-${RUN_ID}\",\"language\":\"nodejs\",\"code\":\"module.exports=async()=>({body:'ok'})\"}")
+CODE=$(echo "$R" | tail -1)
+[ "$CODE" = "201" ] && pass "Код 1000 байт → принят (201)" || fail "Код 1000 байт → got $CODE"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК S: TTL expire + reaper очистка"
+
+# Создаём функцию с TTL=1m
+R=$(curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: ttl-exp-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d "{\"name\":\"expire-fn-${RUN_ID}\",\"language\":\"nodejs\",\"code\":\"module.exports=async()=>({body:'bye'})\",\"ttl\":\"1m\"}")
+CREATED=$(echo "$R" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('name',''))" 2>/dev/null)
+[ "$CREATED" = "expire-fn-${RUN_ID}" ] && pass "TTL=1m функция создана" || fail "TTL=1m создание: $R"
+
+# Сразу должна быть видна в LIST
+COUNT=$(curl -s ${BASE}/functions \
+  -H "X-Auth-Token: ttl-exp-${RUN_ID}@test.local" | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null)
+[ "$COUNT" -ge 1 ] 2>/dev/null && pass "TTL=1m функция видна в LIST" || fail "TTL=1m LIST count=$COUNT"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК T: Параллельное создание одного namespace (race condition)"
+
+# 5 одновременных запросов от одного пользователя (первый раз)
+NS_USER="race-${RUN_ID}@test.local"
+RACE_RESULTS=""
+for i in $(seq 1 5); do
+  RACE_CODE="module.exports=async()=>({body:'r${i}'})"
+  curl -s -X POST ${BASE}/functions \
+    -H "X-Auth-Token: ${NS_USER}" -H "Content-Type: application/json" \
+    -d "{\"name\":\"race-fn-${i}\",\"language\":\"nodejs\",\"code\":\"${RACE_CODE}\"}" &
+done
+wait
+# Проверяем что namespace создался и функции (хоть часть) прошли
+sleep 5
+COUNT=$(curl -s ${BASE}/functions \
+  -H "X-Auth-Token: ${NS_USER}" | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null)
+[ "$COUNT" -ge 1 ] 2>/dev/null && pass "Race condition: namespace создан, функций: $COUNT" || fail "Race condition: functions=$COUNT"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК U: 10 разных пользователей создают функции параллельно"
+
+for uid in $(seq 1 10); do
+  (
+    U="u${uid}-${RUN_ID}@test.local"
+    CODE="module.exports=async()=>({body:'user${uid}'})"
+    curl -s -X POST ${BASE}/functions \
+      -H "X-Auth-Token: ${U}" -H "Content-Type: application/json" \
+      -d "{\"name\":\"fn-${uid}\",\"language\":\"nodejs\",\"code\":\"${CODE}\"}" > /dev/null
+  ) &
+done
+wait
+sleep 3
+
+OK_USERS=0
+for uid in $(seq 1 10); do
+  U="u${uid}-${RUN_ID}@test.local"
+  C=$(curl -s ${BASE}/functions -H "X-Auth-Token: ${U}" | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null)
+  [ "$C" -ge 1 ] 2>/dev/null && OK_USERS=$((OK_USERS+1))
+done
+[ "$OK_USERS" -ge 8 ] && pass "10 юзеров параллельно: ${OK_USERS}/10 создали функции" || fail "10 юзеров параллельно: только ${OK_USERS}/10"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК V: Изоляция — 10 юзеров не видят чужих функций"
+
+ISOLATION_OK=0
+for uid in $(seq 1 10); do
+  U="u${uid}-${RUN_ID}@test.local"
+  LIST=$(curl -s ${BASE}/functions -H "X-Auth-Token: ${U}")
+  # Проверяем что НЕТ чужих функций (fn-X от других пользователей не попадают)
+  # Каждый видит ровно 1 свою (fn-{uid}) и ни одной fn-{other}
+  MY_COUNT=$(echo "$LIST" | python3 -c "import sys,json; fns=json.load(sys.stdin); print(sum(1 for f in fns if f['metadata']['name']=='fn-${uid}'))" 2>/dev/null)
+  OTHER_COUNT=$(echo "$LIST" | python3 -c "import sys,json; fns=json.load(sys.stdin); print(sum(1 for f in fns if f['metadata']['name'].startswith('fn-') and f['metadata']['name']!='fn-${uid}'))" 2>/dev/null)
+  if [ "${MY_COUNT:-0}" -ge 1 ] && [ "${OTHER_COUNT:-0}" -eq 0 ]; then
+    ISOLATION_OK=$((ISOLATION_OK+1))
+  fi
+done
+[ "$ISOLATION_OK" -ge 8 ] && pass "Изоляция 10 юзеров: ${ISOLATION_OK}/10 видят только своё" || fail "Изоляция 10 юзеров: только ${ISOLATION_OK}/10"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК W: 5 юзеров одновременно вызывают свои функции"
+
+for uid in $(seq 1 5); do
+  (
+    U="u${uid}-${RUN_ID}@test.local"
+    NS12=$(curl -s ${BASE}/functions -H "X-Auth-Token: ${U}" \
+      | python3 -c "import sys,json; fns=json.load(sys.stdin); print(fns[0]['route'].split('/')[1] if fns else '')" 2>/dev/null)
+    if [ -n "$NS12" ]; then
+      INVOKE_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+        "https://fission.kube5s.ru/console/proxy/${NS12}/fn-${uid}")
+      echo "U${uid}:${INVOKE_CODE}"
+    else
+      echo "U${uid}:NO_ROUTE"
+    fi
+  ) &
+done
+INVOKE_RESULTS=$(wait; sleep 2)
+# Просто проверяем что invoke не упал совсем (ждём фоновые процессы)
+sleep 3
+pass "5 юзеров параллельный invoke — завершён без паники"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК X: 3 юзера — полный цикл CREATE→LIST→INVOKE→DELETE"
+
+FULL_CYCLE_OK=0
+for uid in $(seq 1 3); do
+  U="fullcycle-u${uid}-${RUN_ID}@test.local"
+  FN="fc-fn-${uid}"
+  CODE="module.exports=async()=>({body:'cycle${uid}'})"
+
+  # CREATE
+  CR=$(curl -s -o /dev/null -w "%{http_code}" -X POST ${BASE}/functions \
+    -H "X-Auth-Token: ${U}" -H "Content-Type: application/json" \
+    -d "{\"name\":\"${FN}\",\"language\":\"nodejs\",\"code\":\"${CODE}\"}")
+
+  # LIST — функция есть (sleep чтобы k8s успел зарегистрировать)
+  sleep 1
+  LC=$(curl -s ${BASE}/functions -H "X-Auth-Token: ${U}" \
+    | python3 -c "import sys,json; fns=json.load(sys.stdin); print(sum(1 for f in fns if f['metadata']['name']=='${FN}'))" 2>/dev/null)
+
+  # DELETE
+  DC=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \
+    "${BASE}/functions/${FN}" -H "X-Auth-Token: ${U}")
+
+  # LIST после DELETE — функции нет
+  LC2=$(curl -s ${BASE}/functions -H "X-Auth-Token: ${U}" \
+    | python3 -c "import sys,json; fns=json.load(sys.stdin); print(sum(1 for f in fns if f['metadata']['name']=='${FN}'))" 2>/dev/null)
+
+  if [ "$CR" = "201" ] && [ "${LC:-0}" -ge 1 ] && [ "$DC" = "200" ] && [ "${LC2:-1}" -eq 0 ]; then
+    FULL_CYCLE_OK=$((FULL_CYCLE_OK+1))
+  else
+    echo "  [U${uid}] CR=$CR LC=$LC DC=$DC LC2=$LC2"
+  fi
+done
+[ "$FULL_CYCLE_OK" -eq 3 ] && pass "3 юзера полный цикл CREATE→LIST→DELETE: ${FULL_CYCLE_OK}/3" || fail "3 юзера полный цикл: только ${FULL_CYCLE_OK}/3"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК Y: Один юзер создаёт 10 функций, проверяем LIST и DELETE all"
+
+MFUNC_USER="mfunc-${RUN_ID}@test.local"
+for i in $(seq 1 10); do
+  curl -s -X POST ${BASE}/functions \
+    -H "X-Auth-Token: ${MFUNC_USER}" -H "Content-Type: application/json" \
+    -d "{\"name\":\"mf-${i}\",\"language\":\"nodejs\",\"code\":\"module.exports=async()=>({body:${i}})\"}" > /dev/null &
+done
+wait
+sleep 3
+
+MFUNC_COUNT=$(curl -s ${BASE}/functions \
+  -H "X-Auth-Token: ${MFUNC_USER}" \
+  | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null)
+[ "${MFUNC_COUNT:-0}" -ge 8 ] && pass "1 юзер создал 10 функций: видно ${MFUNC_COUNT}" || fail "1 юзер: создано только ${MFUNC_COUNT:-0}"
+
+# Удаляем все
+for i in $(seq 1 10); do
+  curl -s -X DELETE "${BASE}/functions/mf-${i}" \
+    -H "X-Auth-Token: ${MFUNC_USER}" > /dev/null &
+done
+wait
+sleep 3
+MFUNC_AFTER=$(curl -s ${BASE}/functions \
+  -H "X-Auth-Token: ${MFUNC_USER}" \
+  | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null)
+[ "${MFUNC_AFTER:-1}" -eq 0 ] && pass "DELETE all: список пуст после удаления 10 функций" || fail "DELETE all: осталось ${MFUNC_AFTER:-?} функций"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК Z: Cross-user attack — юзер пытается DELETE/UPDATE/GET чужую функцию"
+
+VICTIM_USER="victim-${RUN_ID}@test.local"
+ATTACKER_USER="attacker-${RUN_ID}@test.local"
+
+# Жертва создаёт функцию
+curl -s -X POST ${BASE}/functions \
+  -H "X-Auth-Token: ${VICTIM_USER}" -H "Content-Type: application/json" \
+  -d '{"name":"secret-fn","language":"nodejs","code":"module.exports=async()=>({body:42})"}'  > /dev/null
+sleep 2
+
+# Атакующий пытается GET чужой функции
+Z_GET=$(curl -s -o /dev/null -w "%{http_code}" \
+  "${BASE}/functions/secret-fn" -H "X-Auth-Token: ${ATTACKER_USER}")
+[ "$Z_GET" = "404" ] && pass "Cross-user GET чужой функции → 404" || fail "Cross-user GET → ожидали 404, got $Z_GET"
+
+# Атакующий пытается UPDATE чужой функции (PUT /functions/{name}/code)
+Z_PUT=$(curl -s -o /dev/null -w "%{http_code}" -X PUT \
+  "${BASE}/functions/secret-fn/code" \
+  -H "X-Auth-Token: ${ATTACKER_USER}" -H "Content-Type: application/json" \
+  -d '{"code":"module.exports=async()=>({body:\"hacked\"})"}')
+[ "$Z_PUT" = "404" ] && pass "Cross-user UPDATE чужой функции → 404" || fail "Cross-user UPDATE → ожидали 404, got $Z_PUT"
+
+# Атакующий пытается DELETE чужой функции
+Z_DEL=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \
+  "${BASE}/functions/secret-fn" -H "X-Auth-Token: ${ATTACKER_USER}")
+[ "$Z_DEL" = "404" ] && pass "Cross-user DELETE чужой функции → 404" || fail "Cross-user DELETE → ожидали 404, got $Z_DEL"
+
+# Жертва проверяет что функция цела
+Z_VICTIM_LIST=$(curl -s ${BASE}/functions -H "X-Auth-Token: ${VICTIM_USER}" \
+  | python3 -c "import sys,json; fns=json.load(sys.stdin); print(sum(1 for f in fns if f['metadata']['name']=='secret-fn'))" 2>/dev/null)
+[ "${Z_VICTIM_LIST:-0}" -eq 1 ] && pass "Cross-user: функция жертвы цела после атаки" || fail "Cross-user: функция жертвы исчезла!"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК AA: PHP — создание и вызов"
+
+# Оба блока (AA/AB) используют ОДИН namespace, чтобы избежать повторных executor rollouts.
+# Первая функция (PHP) вызывает addNSToFission → executor rollout (~60s).
+# Ruby создаётся в том же namespace → rollout не нужен → пул стартует сразу.
+LANG_NS="lang-multi-${RUN_ID}@test.local"
+
+PHP_CODE=$(python3 -c "import json; print(json.dumps('<?php\nfunction handler(\$context) {\n    \$context[\"response\"]->getBody()->write(\"php-ok\");\n}'))")
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: ${LANG_NS}" -H "Content-Type: application/json" \
+  -d "{\"name\":\"php-fn\",\"language\":\"php\",\"code\":${PHP_CODE},\"ttl\":\"10m\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "201" "PHP: create → 201"
+
+# Ждём пока poolmgr поднимет pod для нового env (retry до 200s).
+# После executor rollout (~60s) + startup pod (~30s) = ~90s до первого invoke.
+STATUS=""; RAW=""
+for _try in $(seq 1 20); do
+  sleep 10
+  INV=$(curl -s -X POST ${BASE}/functions/php-fn/invoke \
+    -H "X-Auth-Token: ${LANG_NS}")
+  STATUS=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','?'))" 2>/dev/null)
+  RAW=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('response_raw','?'))" 2>/dev/null)
+  [ "$STATUS" = "200" ] && break
+done
+[ "$STATUS" = "200" ] && pass "PHP: invoke → 200" || fail "PHP: invoke → got $STATUS (body: $RAW)"
+echo "$RAW" | grep -q "php-ok" && pass "PHP: тело содержит php-ok" || fail "PHP: тело не содержит php-ok (got: $RAW)"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК AB: Ruby — создание и вызов"
+
+RUBY_CODE=$(python3 -c "import json; print(json.dumps('def handler\n  \"ruby-ok\"\nend'))")
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: ${LANG_NS}" -H "Content-Type: application/json" \
+  -d "{\"name\":\"ruby-fn\",\"language\":\"ruby\",\"code\":${RUBY_CODE},\"ttl\":\"10m\"}")
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "201" "Ruby: create → 201"
+
+# Ждём пока poolmgr поднимет pod (retry до 200s).
+# Namespace уже известен executor после PHP-блока → rollout не нужен → пул стартует быстро.
+STATUS=""; RAW=""
+for _try in $(seq 1 20); do
+  sleep 10
+  INV=$(curl -s -X POST ${BASE}/functions/ruby-fn/invoke \
+    -H "X-Auth-Token: ${LANG_NS}")
+  STATUS=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','?'))" 2>/dev/null)
+  RAW=$(echo "$INV" | python3 -c "import sys,json; print(json.load(sys.stdin).get('response_raw','?'))" 2>/dev/null)
+  [ "$STATUS" = "200" ] && break
+done
+[ "$STATUS" = "200" ] && pass "Ruby: invoke → 200" || fail "Ruby: invoke → got $STATUS (body: $RAW)"
+echo "$RAW" | grep -q "ruby-ok" && pass "Ruby: тело содержит ruby-ok" || fail "Ruby: тело не содержит ruby-ok (got: $RAW)"
+
+# ──────────────────────────────────────────────
+echo ""
+echo ">>> БЛОК AD: Невалидный язык → 400"
+
+R=$(curl -s -w "\n%{http_code}" -X POST ${BASE}/functions \
+  -H "X-Auth-Token: lang-inv-${RUN_ID}@test.local" -H "Content-Type: application/json" \
+  -d '{"name":"bad-lang-fn","language":"cobol","code":"x"}')
+CODE=$(echo "$R" | tail -1)
+check_http "$CODE" "400" "Невалидный язык cobol → 400"
+
+# ──────────────────────────────────────────────
+echo ""
+# ──────────────────────────────────────────────
+echo ""
+echo "========================================"
+printf "Итого: PASS=%d  FAIL=%d\n" $PASS $FAIL
+echo "========================================"