Refresh tests: pin the refresh owner's endurance and the signing-algorithm check

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ghostlight-dungeon/src/heimdall.rs

@@ -1187,6 +1187,22 @@ mod tests {
         assert!(cache.key("k1", start + JWKS_TTL).is_none(), "stale at the ttl");
     }
 
+    #[tokio::test]
+    async fn a_token_signed_with_another_algorithm_is_refused_before_any_key_fetch() {
+        let token = jsonwebtoken::encode(
+            &jsonwebtoken::Header::new(Algorithm::HS256),
+            &serde_json::json!({"sub": "x"}),
+            &jsonwebtoken::EncodingKey::from_secret(b"secret"),
+        )
+        .unwrap();
+        let error = HeimdallClient::fixture()
+            .verify_access(&token)
+            .await
+            .unwrap_err();
+        assert!(error.to_string().contains("unsupported signing algorithm"), "{error:#}");
+        assert!(error.downcast_ref::<VerificationUnavailable>().is_none());
+    }
+
     #[test]
     fn a_denied_status_is_the_typed_denial_and_any_other_status_passes() {
         let diagnostics = vec!["Idempotency key was reused".to_owned()];

crates/ghostlight-dungeon/src/runtime.rs

@@ -2548,6 +2548,19 @@ mod tests {
         }
     }
 
+    /// The daemon's refresh owner serves until it fails: a body that returns
+    /// at once would be read by `serve` as the owner stopping.
+    #[tokio::test]
+    async fn the_session_refresh_owner_keeps_serving() {
+        let fixture = fixture().await;
+        let ran = tokio::time::timeout(
+            Duration::from_millis(300),
+            maintain_session_refresh(fixture.state.clone()),
+        )
+        .await;
+        assert!(ran.is_err(), "the refresh owner returned: {ran:?}");
+    }
+
     /// PA.f172: `state.play` being `None` — a play table that failed to
     /// open, for any reason, `PlayTurnStore::open` returning `Err` among
     /// them — must be visible on `/health`, the same operator-facing surface