Document recovered ESO lanes and recognize explicit invalid-token responses

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

tests/test_eso_auth_recovery.py

@@ -39,6 +39,12 @@ class EsoRecoveryTests(unittest.TestCase):
             self.assertEqual(policy.count('path "'),3)
             self.assertIn('path "'+lane['kv_path']+'"',policy)
 
+    def test_expired_token_response_is_distinct_from_authority_failure(self):
+        for code in [400,403]:
+            self.assertTrue(repair.invalid_token_lookup(SimpleNamespace(returncode=2,stderr=f'Code: {code}. Errors: bad token'.encode())))
+        for error in [b'Code: 403. permission denied',b'Code: 500. bad token',b'connection refused']:
+            self.assertFalse(repair.invalid_token_lookup(SimpleNamespace(returncode=2,stderr=error)))
+
 
 if __name__=='__main__':
     unittest.main()

tests/test_state_hub_preflight_lane.py

@@ -96,6 +96,7 @@ class SigningLaneTests(unittest.TestCase):
         import tempfile, yaml
         ccr = copy.deepcopy(self.ccr)
         ccr['status'] = 'approved'
+        ccr['access_frontdoor']['resolvable'] = False
         ccr['openbao']['auth']['bound_claims_confirmed'] = True
         ccr['openbao']['auth']['audience'] = 'kubernetes'
         with tempfile.TemporaryDirectory() as tmp: