test(orch): cover MemfdIdentitySource.Slice and provisional fallback

Extend the MemfdIdentitySource test to exercise Slice (identity read while
mapped, and BytesNotAvailableError after release), and add a test that
buildProvisionalMemfile declines (returns nil, nil) for a non-memfd-dedup source
or when disabled, so the caller falls back to the deduped header.

Signed-off-by: Nikita Kalyazin <nikita.kalyazin@e2b.dev>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: kalyazin

packages/orchestrator/pkg/sandbox/block/memfd_test.go

@@ -464,12 +464,18 @@ func TestMemfdIdentitySource_ServesThenReleases(t *testing.T) {
 		require.Equal(t, int(ps), n)
 		require.Equal(t, data[page*ps:(page+1)*ps], b)
 	}
+	// Slice takes the same identity path and returns a copy of the memfd bytes.
+	sl, err := src.Slice(2*ps, ps)
+	require.NoError(t, err)
+	require.Equal(t, data[2*ps:3*ps], sl)
 	require.True(t, src.IsCached(t.Context(), 0, ps*4))
 
 	require.NoError(t, d.releaseMemfd())
 
-	_, err := src.ReadAt(make([]byte, ps), 0)
 	var bna BytesNotAvailableError
+	_, err = src.ReadAt(make([]byte, ps), 0)
+	require.ErrorAs(t, err, &bna)
+	_, err = src.Slice(0, ps)
 	require.ErrorAs(t, err, &bna)
 	require.False(t, src.IsCached(t.Context(), 0, ps))
 }

packages/orchestrator/pkg/sandbox/provisional_test.go

@@ -0,0 +1,41 @@
+//go:build linux
+
+package sandbox
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// fakeDiffSource is a block.DiffSource that is not a *block.DedupedMemfdCache,
+// so buildProvisionalMemfile must decline to produce a provisional header.
+type fakeDiffSource struct{}
+
+func (fakeDiffSource) Close() error                            { return nil }
+func (fakeDiffSource) ReadAt([]byte, int64) (int, error)       { return 0, nil }
+func (fakeDiffSource) Slice(int64, int64) ([]byte, error)      { return nil, nil }
+func (fakeDiffSource) Size() (int64, error)                    { return 0, nil }
+func (fakeDiffSource) FileSize(context.Context) (int64, error) { return 0, nil }
+func (fakeDiffSource) BlockSize() int64                        { return 0 }
+func (fakeDiffSource) Path(context.Context) (string, error)    { return "", nil }
+
+// buildProvisionalMemfile must fall back (return nil, nil, nil) when it can't
+// apply, so the caller keeps using the deduped header: a non-memfd-dedup source,
+// and a disabled flag.
+func TestBuildProvisionalMemfile_FallsBack(t *testing.T) {
+	t.Parallel()
+
+	// Source is not a *block.DedupedMemfdCache → no provisional serving.
+	h, d, swapDone := buildProvisionalMemfile(t.Context(), fakeDiffSource{}, true, nil, nil, nil)
+	require.Nil(t, h)
+	require.Nil(t, d)
+	require.Nil(t, swapDone)
+
+	// Disabled flag → no provisional serving.
+	h, d, swapDone = buildProvisionalMemfile(t.Context(), fakeDiffSource{}, false, nil, nil, nil)
+	require.Nil(t, h)
+	require.Nil(t, d)
+	require.Nil(t, swapDone)
+}