M35: harden the shared public demo

backend/tests/test_auth.py

@@ -67,6 +67,28 @@ def test_operations_manager_can_reset_demo(ops_client):
     assert body["scenario_integrity"]["not_ready"] == []
 
 
+def test_demo_reset_rejects_concurrent_rebuild(ops_client):
+    import app.api.routers.demo as demo_router
+
+    assert demo_router._reset_guard.acquire(blocking=False)
+    try:
+        response = ops_client.post("/api/v1/demo/reset")
+    finally:
+        demo_router._reset_guard.release()
+    assert response.status_code == 409
+
+
+def test_demo_reset_cooldown_returns_retry_after(ops_client, monkeypatch):
+    import app.api.routers.demo as demo_router
+
+    monkeypatch.setattr(demo_router.settings, "demo_reset_cooldown_seconds", 60)
+    monkeypatch.setattr(demo_router, "_last_reset_monotonic", demo_router.time.monotonic())
+    response = ops_client.post("/api/v1/demo/reset")
+    assert response.status_code == 429
+    assert int(response.headers["retry-after"]) >= 1
+    monkeypatch.setattr(demo_router, "_last_reset_monotonic", 0.0)
+
+
 def test_reset_is_rejected_when_demo_allow_reset_is_disabled(ops_client, monkeypatch):
     import app.api.routers.demo as demo_router