//go:build linux

package activator

import (
	"bytes"
	"context"
	"crypto/sha256"
	"database/sql"
	"encoding/hex"
	"errors"
	"io"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/carlosframework/platform/internal/instancectl"
	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/seeds"
)

type fakeSeedObjects struct {
	body  map[string][]byte // id -> snapshot
	err   error
	opens int
	read  int64 // bytes the fallback pulled from the object
	// midway, when set, fails the read after the first 100 bytes.
	midway error
}

func (f *fakeSeedObjects) Open(_ context.Context, host, id string) (io.ReadCloser, error) {
	f.opens++
	if f.err != nil {
		return nil, f.err
	}
	b, ok := f.body[id]
	if !ok {
		return nil, os.ErrNotExist
	}
	var r io.Reader = bytes.NewReader(b)
	if f.midway != nil {
		r = io.MultiReader(bytes.NewReader(b[:100]), &failingReader{f.midway})
	}
	return io.NopCloser(&countingReader{r: r, n: &f.read}), nil
}

type failingReader struct{ err error }

func (f *failingReader) Read([]byte) (int, error) { return 0, f.err }

type countingReader struct {
	r io.Reader
	n *int64
}

func (c *countingReader) Read(p []byte) (int, error) {
	n, err := c.r.Read(p)
	*c.n += int64(n)
	return n, err
}

// seededRoute is nestedBackend's row with a seed column for a snapshot
// made by writeMinimalSQLite.
func seededRoute(t *testing.T, b *ExecBackend, rt registry.Route, state string) (registry.Route, *fakeSeedObjects, string) {
	t.Helper()
	id, _ := seeds.NewID()
	snap := filepath.Join(t.TempDir(), "snap.db")
	if err := writeMinimalSQLite(snap); err != nil {
		t.Fatal(err)
	}
	body, _ := os.ReadFile(snap)
	sum := sha256.Sum256(body)
	rt.SeedSource = seeds.RowSeed{ID: id, Kind: seeds.KindReplica, SHA256: hex.EncodeToString(sum[:]), Bytes: int64(len(body)), State: state}.Encode()
	objs := &fakeSeedObjects{body: map[string][]byte{id: body}}
	b.Seeds = objs
	return rt, objs, id
}

func noOwnReplica(t *testing.T) {
	t.Helper()
	old := hasOwnReplica
	hasOwnReplica = func(context.Context, string, string, string) (bool, error) { return false, nil }
	t.Cleanup(func() { hasOwnReplica = old })
}

func TestSeededRestorePlacesTheSnapshot(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, id := seededRoute(t, b, rt, seeds.StateReady)
	fresh, err := b.Restore(context.Background(), rt)
	if err != nil || fresh {
		t.Fatalf("Restore = fresh %v, %v; want placed, never fresh", fresh, err)
	}
	if objs.opens != 1 {
		t.Fatalf("snapshot opened %d times", objs.opens)
	}
	marker, err := os.ReadFile(rt.DBPath + SeedMarkerSuffix)
	if err != nil || strings.TrimSpace(string(marker)) != id {
		t.Fatalf("marker = %q, %v; want the seed id", marker, err)
	}
	if err := checkSeedDB(context.Background(), rt.DBPath); err != nil {
		t.Fatalf("the placed database does not check: %v", err)
	}
	// Nothing of the fetch is left beside the database.
	ents, _ := os.ReadDir(filepath.Dir(rt.DBPath))
	for _, e := range ents {
		if strings.HasPrefix(e.Name(), ".seed-") {
			t.Errorf("%s left behind", e.Name())
		}
	}
	// A second wake (a crash after the rename, before the first upload)
	// keeps the placed file and does not fetch again.
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh || objs.opens != 1 {
		t.Fatalf("resume: fresh %v err %v opens %d", fresh, err, objs.opens)
	}
}

func TestSeededRestorePurgesAnotherSeedsDatabase(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, _, id := seededRoute(t, b, rt, seeds.StateSwapped)
	os.MkdirAll(filepath.Dir(rt.DBPath), 0o700)
	os.WriteFile(rt.DBPath, []byte("an aborted import's data"), 0o600)
	os.WriteFile(rt.DBPath+"-wal", []byte("w"), 0o600)
	os.WriteFile(rt.DBPath+"-shm", []byte("s"), 0o600)
	os.WriteFile(rt.DBPath+SeedMarkerSuffix, []byte("sd_bbbbbbbbbbbbbbbbbbbbbbbbbb\n"), 0o600)
	meta := filepath.Join(filepath.Dir(rt.DBPath), ".activator-"+filepath.Base(rt.DBPath)+"-litestream")
	os.MkdirAll(meta, 0o700)
	if _, err := b.Restore(context.Background(), rt); err != nil {
		t.Fatal(err)
	}
	for _, p := range []string{rt.DBPath + "-wal", rt.DBPath + "-shm", meta} {
		if _, err := os.Stat(p); !os.IsNotExist(err) {
			t.Errorf("%s survived the purge", p)
		}
	}
	if m, _ := os.ReadFile(rt.DBPath + SeedMarkerSuffix); strings.TrimSpace(string(m)) != id {
		t.Fatalf("marker = %q, want %s", m, id)
	}
	if b, _ := os.ReadFile(rt.DBPath); bytes.Equal(b, []byte("an aborted import's data")) {
		t.Fatal("the other seed's database stood in for this one")
	}
}

func TestSeededRestorePurgesAnUnmarkedDatabase(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, _ := seededRoute(t, b, rt, seeds.StateReady)
	os.MkdirAll(filepath.Dir(rt.DBPath), 0o700)
	os.WriteFile(rt.DBPath, []byte("an unmarked database"), 0o600)
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh || objs.opens != 1 {
		t.Fatalf("fresh %v err %v opens %d; want the unmarked database replaced by the snapshot", fresh, err, objs.opens)
	}
	if got, _ := os.ReadFile(rt.DBPath); !bytes.Equal(got, objs.body[mustSeedID(t, rt)]) {
		t.Fatal("the unmarked database stood in for the seed")
	}
}

func TestSeededRestoreRemovesASymlinkedDatabaseNotItsTarget(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, _, id := seededRoute(t, b, rt, seeds.StateReady)
	os.MkdirAll(filepath.Dir(rt.DBPath), 0o700)
	outside := filepath.Join(t.TempDir(), "outside.db")
	os.WriteFile(outside, []byte("not the instance's"), 0o600)
	outsideMarker := filepath.Join(t.TempDir(), "marker")
	os.WriteFile(outsideMarker, []byte(id+"\n"), 0o600)
	if err := os.Symlink(outside, rt.DBPath); err != nil {
		t.Fatal(err)
	}
	if err := os.Symlink(outsideMarker, rt.DBPath+SeedMarkerSuffix); err != nil {
		t.Fatal(err)
	}
	if _, err := b.Restore(context.Background(), rt); err != nil {
		t.Fatal(err)
	}
	if got, _ := os.ReadFile(outside); string(got) != "not the instance's" {
		t.Fatalf("the link's target was touched: %q", got)
	}
	if fi, err := os.Lstat(rt.DBPath); err != nil || !fi.Mode().IsRegular() {
		t.Fatalf("the database is not a placed file: %v %v", fi, err)
	}
	if err := checkSeedDB(context.Background(), rt.DBPath); err != nil {
		t.Fatalf("the placed database does not check: %v", err)
	}
}

func mustSeedID(t *testing.T, rt registry.Route) string {
	t.Helper()
	src, err := seeds.ParseRowSeed(rt.SeedSource)
	if err != nil || src == nil {
		t.Fatalf("seed column: %v", err)
	}
	return src.ID
}

func TestSeededRestoreRefusesABadSnapshot(t *testing.T) {
	noOwnReplica(t)
	for _, c := range []struct {
		name   string
		mangle func(*fakeSeedObjects, string)
		want   string
	}{
		{"short", func(f *fakeSeedObjects, id string) { f.body[id] = f.body[id][:100] }, "length or sha256"},
		{"long", func(f *fakeSeedObjects, id string) { f.body[id] = append(f.body[id], 'x') }, "length or sha256"},
		{"wrong bytes", func(f *fakeSeedObjects, id string) { f.body[id] = bytes.Repeat([]byte{'x'}, len(f.body[id])) }, "length or sha256"},
		{"unreadable", func(f *fakeSeedObjects, id string) { f.err = errors.New("bucket down") }, "could not be read"},
	} {
		t.Run(c.name, func(t *testing.T) {
			b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
			rt, objs, id := seededRoute(t, b, rt, seeds.StateReady)
			c.mangle(objs, id)
			fresh, err := b.Restore(context.Background(), rt)
			var spe *SeedPlacementError
			if fresh || !errors.As(err, &spe) || !strings.Contains(spe.Sentence, c.want) {
				t.Fatalf("Restore = fresh %v, %v; want a %q refusal", fresh, err, c.want)
			}
			if _, err := os.Stat(rt.DBPath); !os.IsNotExist(err) {
				t.Fatal("a refused snapshot left a database at the row's path")
			}
		})
	}
}

// The object is read through the recorded size and one byte more, never to
// its end: an oversized object costs the box nothing beyond the record.
func TestSeededRestoreReadsNoMoreThanTheRecordedSize(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, id := seededRoute(t, b, rt, seeds.StateReady)
	want := int64(len(objs.body[id]))
	objs.body[id] = append(objs.body[id], make([]byte, 4<<20)...)
	var spe *SeedPlacementError
	if _, err := b.Restore(context.Background(), rt); !errors.As(err, &spe) || !strings.Contains(spe.Sentence, "length or sha256") {
		t.Fatalf("Restore = %v; want the length refusal", err)
	}
	if objs.read > want+1 {
		t.Fatalf("read %d bytes of the object; the record says %d", objs.read, want)
	}
}

func TestSeededRestoreRefusesANonDatabase(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	id, _ := seeds.NewID()
	body := []byte("not sqlite at all, but the right length and hash")
	sum := sha256.Sum256(body)
	rt.SeedSource = seeds.RowSeed{ID: id, Kind: seeds.KindImport, SHA256: hex.EncodeToString(sum[:]), Bytes: int64(len(body)), State: seeds.StateSwapped}.Encode()
	b.Seeds = &fakeSeedObjects{body: map[string][]byte{id: body}}
	_, err := b.Restore(context.Background(), rt)
	var spe *SeedPlacementError
	if !errors.As(err, &spe) || !strings.Contains(spe.Sentence, "integrity check") {
		t.Fatalf("Restore = %v; want the integrity refusal", err)
	}
}

func TestSeededRestoreRefusesClaimAndFlat(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, _, _ = seededRoute(t, b, rt, seeds.StateReady)
	b.ClaimArmed = true
	var spe *SeedPlacementError
	if _, err := b.Restore(context.Background(), rt); !errors.As(err, &spe) || !strings.Contains(spe.Sentence, "claim control") {
		t.Fatalf("claim-armed: %v", err)
	}
	b.ClaimArmed = false
	flat := testExecBackend(t)
	flat.Seeds = b.Seeds
	frt := registry.Route{Host: rt.Host, Kind: "instance", Hibernate: true, SeedSource: rt.SeedSource,
		Socket: filepath.Join(t.TempDir(), "x.sock")} // DBPath empty: the flat default
	if _, err := flat.Restore(context.Background(), frt); !errors.As(err, &spe) || !strings.Contains(spe.Sentence, "nested") {
		t.Fatalf("flat: %v", err)
	}
}

func TestSeededRestoreFailsWhenTheReplicaCannotBeListed(t *testing.T) {
	old := hasOwnReplica
	hasOwnReplica = func(context.Context, string, string, string) (bool, error) {
		return false, errors.New("listing failed")
	}
	defer func() { hasOwnReplica = old }()
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, _ := seededRoute(t, b, rt, seeds.StateReady)
	if fresh, err := b.Restore(context.Background(), rt); err == nil || fresh || objs.opens != 0 {
		t.Fatalf("Restore = fresh %v, %v, opens %d; want a failed wake and no fetch", fresh, err, objs.opens)
	}
}

func TestSeededRestoreUsesItsOwnReplicaOnceItHasOne(t *testing.T) {
	old := hasOwnReplica
	hasOwnReplica = func(context.Context, string, string, string) (bool, error) { return true, nil }
	defer func() { hasOwnReplica = old }()
	oldRestore := restoreReplica
	restored := 0
	restoreReplica = func(_ context.Context, dbPath, _, _, _ string) (bool, error) {
		restored++
		return true, writeMinimalSQLite(dbPath)
	}
	defer func() { restoreReplica = oldRestore }()
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, _ := seededRoute(t, b, rt, seeds.StateReady)
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh || restored != 1 || objs.opens != 0 {
		t.Fatalf("fresh %v err %v restored %d opens %d; want the own replica, not the seed", fresh, err, restored, objs.opens)
	}
}

// A listing that saw a replica and a restore that then found none must not
// come back fresh: fresh would boot the instance empty and run the
// manifest's seed command over a seeded row.
func TestSeededRestoreNeverReportsFreshWhenItsReplicaVanishes(t *testing.T) {
	old := hasOwnReplica
	hasOwnReplica = func(context.Context, string, string, string) (bool, error) { return true, nil }
	defer func() { hasOwnReplica = old }()
	oldRestore := restoreReplica
	restoreReplica = func(context.Context, string, string, string, string) (bool, error) { return false, nil }
	defer func() { restoreReplica = oldRestore }()
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, _ := seededRoute(t, b, rt, seeds.StateReady)
	if fresh, err := b.Restore(context.Background(), rt); err == nil || fresh || objs.opens != 0 {
		t.Fatalf("Restore = fresh %v, %v, opens %d; want a failed wake", fresh, err, objs.opens)
	}
}

func TestMemberSafeWakeReasonPassesTheSeedSentence(t *testing.T) {
	err := fmtWrap(seedRefusedFlat("shop.example.com"))
	if got := memberSafeWakeReason(err); got != "wake failed: shop.example.com could not start from its seed: this box does not run instances nested." {
		t.Fatalf("reason = %q", got)
	}
}

func fmtWrap(err error) error { return errors.Join(errors.New("restore shop.example.com"), err) }

// countOwnReplicaLists stubs hasOwnReplica and counts its calls.
func countOwnReplicaLists(t *testing.T, has bool) *int {
	t.Helper()
	n := 0
	old := hasOwnReplica
	hasOwnReplica = func(context.Context, string, string, string) (bool, error) { n++; return has, nil }
	t.Cleanup(func() { hasOwnReplica = old })
	return &n
}

// A placed seed stays on the row for life. After a move, the destination's
// replica is staged under moves/<host>/, which only the plain path's staging
// fallback promotes: the wake must take it, never the deleted snapshot.
func TestSeededRestoreOfAPlacedSeedPromotesAStagedReplica(t *testing.T) {
	lists := countOwnReplicaLists(t, false)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, _ := seededRoute(t, b, rt, seeds.StatePlaced)
	b.ClaimArmed = true // placed: no claim refusal either
	f := newFakeMirrorStore()
	b.Mirror = f
	f.put(b.Cfg.Bucket, MovesPrefix(rt.Host)+"generations/a/snapshot", "e1")
	oldRestore := restoreReplica
	var restoredFrom []string
	restoreReplica = func(_ context.Context, dbPath, bucket, prefix, _ string) (bool, error) {
		if got, _ := f.List(context.Background(), bucket, prefix); len(got) == 0 {
			return false, nil
		}
		restoredFrom = append(restoredFrom, prefix)
		return true, writeMinimalSQLite(dbPath)
	}
	defer func() { restoreReplica = oldRestore }()
	os.MkdirAll(filepath.Dir(rt.DBPath), 0o700) // lease.Restore's own MkdirAll
	fresh, err := b.Restore(context.Background(), rt)
	if err != nil || fresh || objs.opens != 0 || *lists != 0 || len(restoredFrom) != 1 {
		t.Fatalf("fresh %v err %v opens %d lists %d restored %v; want the promoted staged replica", fresh, err, objs.opens, *lists, restoredFrom)
	}
}

func TestSeededRestoreOfAPlacedSeedKeepsTheWarmCopyWithoutListing(t *testing.T) {
	lists := countOwnReplicaLists(t, true)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, _ := seededRoute(t, b, rt, seeds.StatePlaced)
	b.ClaimArmed = true
	oldRestore := restoreReplica
	restoreReplica = func(context.Context, string, string, string, string) (bool, error) {
		t.Fatal("a warm copy was restored over")
		return false, nil
	}
	defer func() { restoreReplica = oldRestore }()
	os.MkdirAll(filepath.Dir(rt.DBPath), 0o700)
	if err := writeMinimalSQLite(rt.DBPath); err != nil {
		t.Fatal(err)
	}
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh || objs.opens != 0 || *lists != 0 {
		t.Fatalf("fresh %v err %v opens %d lists %d; want the warm copy, no listing, no fetch", fresh, err, objs.opens, *lists)
	}
}

func TestSeededRestoreOfAPlacedSeedWithNothingToRestoreFails(t *testing.T) {
	countOwnReplicaLists(t, false)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, _ := seededRoute(t, b, rt, seeds.StatePlaced)
	oldRestore := restoreReplica
	restoreReplica = func(context.Context, string, string, string, string) (bool, error) { return false, nil }
	defer func() { restoreReplica = oldRestore }()
	if fresh, err := b.Restore(context.Background(), rt); err == nil || fresh || objs.opens != 0 {
		t.Fatalf("fresh %v err %v opens %d; want a failed wake, never fresh", fresh, err, objs.opens)
	}
}

// committedImport is a row whose import is committed: placed first, so
// the host has a replica of its own (preflight M11).
func committedImport(t *testing.T, b *ExecBackend, rt registry.Route) (registry.Route, *fakeSeedObjects) {
	t.Helper()
	rt, objs, _ := seededRoute(t, b, rt, seeds.StateCommitted)
	col, err := seeds.ParseRowSeed(rt.SeedSource)
	if err != nil {
		t.Fatal(err)
	}
	col.Kind = seeds.KindImport
	rt.SeedSource = col.Encode()
	return rt, objs
}

// M11: a committed import restores its own replica, as placed does, and a
// wake that finds none fails. It never boots empty: after commit the app
// retires its old process, so an empty boot would lose the import.
func TestSeededRestoreOfACommittedImportWithNothingToRestoreFails(t *testing.T) {
	lists := countOwnReplicaLists(t, false)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs := committedImport(t, b, rt)
	oldRestore := restoreReplica
	restored := 0
	restoreReplica = func(context.Context, string, string, string, string) (bool, error) { restored++; return false, nil }
	defer func() { restoreReplica = oldRestore }()
	if fresh, err := b.Restore(context.Background(), rt); err == nil || fresh || restored != 1 || objs.opens != 0 || *lists != 0 {
		t.Fatalf("fresh %v err %v restored %d opens %d lists %d; want a failed wake, never fresh", fresh, err, restored, objs.opens, *lists)
	}
}

func TestSeededRestoreOfACommittedImportRestoresItsOwnReplica(t *testing.T) {
	lists := countOwnReplicaLists(t, false)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs := committedImport(t, b, rt)
	b.ClaimArmed = true // as placed: no claim refusal for a restore of its own
	oldRestore := restoreReplica
	restoreReplica = func(_ context.Context, dbPath, _, _, _ string) (bool, error) {
		return true, writeMinimalSQLite(dbPath)
	}
	defer func() { restoreReplica = oldRestore }()
	os.MkdirAll(filepath.Dir(rt.DBPath), 0o700)
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh || objs.opens != 0 || *lists != 0 {
		t.Fatalf("fresh %v err %v opens %d lists %d; want its own replica, no fetch", fresh, err, objs.opens, *lists)
	}
}

// A crash after the marker and before the rename leaves a marker naming
// this seed and no database: the snapshot is fetched again.
func TestSeededRestoreRefetchesWhenOnlyTheMarkerSurvived(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, id := seededRoute(t, b, rt, seeds.StateReady)
	os.MkdirAll(filepath.Dir(rt.DBPath), 0o700)
	os.WriteFile(rt.DBPath+SeedMarkerSuffix, []byte(id+"\n"), 0o600)
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh || objs.opens != 1 {
		t.Fatalf("fresh %v err %v opens %d; want one fetch", fresh, err, objs.opens)
	}
	if got, _ := os.ReadFile(rt.DBPath); !bytes.Equal(got, objs.body[id]) {
		t.Fatal("the snapshot is not at the row's path")
	}
}

func TestSeededRestoreLeavesAnUnplaceableSeedToThePlainPath(t *testing.T) {
	for _, state := range []string{seeds.StateAborted, seeds.StateAwaitingUpload, seeds.StateRolledBack} {
		t.Run(state, func(t *testing.T) {
			lists := countOwnReplicaLists(t, false)
			b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
			rt, objs, _ := seededRoute(t, b, rt, state)
			oldRestore := restoreReplica
			restored := 0
			restoreReplica = func(context.Context, string, string, string, string) (bool, error) { restored++; return false, nil }
			defer func() { restoreReplica = oldRestore }()
			fresh, err := b.Restore(context.Background(), rt)
			if err != nil || !fresh || restored != 1 || objs.opens != 0 || *lists != 0 {
				t.Fatalf("fresh %v err %v restored %d opens %d lists %d; want the plain path", fresh, err, restored, objs.opens, *lists)
			}
		})
	}
}

func TestSeededRestoreFailsOnAMalformedSeedColumn(t *testing.T) {
	for _, col := range []string{`{"id":`, `{"id":"../x","kind":"replica","state":"ready"}`} {
		lists := countOwnReplicaLists(t, false)
		b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
		objs := &fakeSeedObjects{}
		b.Seeds = objs
		oldRestore := restoreReplica
		restoreReplica = func(context.Context, string, string, string, string) (bool, error) { return false, nil }
		rt.SeedSource = col
		fresh, err := b.Restore(context.Background(), rt)
		restoreReplica = oldRestore
		if err == nil || fresh || objs.opens != 0 || *lists != 0 {
			t.Fatalf("column %q: fresh %v err %v; want a failed wake", col, fresh, err)
		}
	}
}

func TestSeededRestoreTellsAReadFailureFromAWriteFailure(t *testing.T) {
	noOwnReplica(t)
	t.Run("read", func(t *testing.T) {
		b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
		rt, objs, _ := seededRoute(t, b, rt, seeds.StateReady)
		objs.midway = errors.New("connection reset")
		var spe *SeedPlacementError
		if _, err := b.Restore(context.Background(), rt); !errors.As(err, &spe) || !strings.Contains(spe.Sentence, "could not be read") {
			t.Fatalf("Restore = %v; want SD-N16", err)
		}
	})
	t.Run("write", func(t *testing.T) {
		if os.Geteuid() == 0 {
			t.Skip("root writes through a read-only directory")
		}
		b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
		rt, _, _ = seededRoute(t, b, rt, seeds.StateReady)
		dir := filepath.Dir(rt.DBPath)
		os.MkdirAll(dir, 0o700)
		os.Chmod(dir, 0o500)
		defer os.Chmod(dir, 0o700)
		var spe *SeedPlacementError
		if _, err := b.Restore(context.Background(), rt); !errors.As(err, &spe) || !strings.Contains(spe.Sentence, "could not be put in place") {
			t.Fatalf("Restore = %v; want SD-N19", err)
		}
	})
}

// A same-uid process that swaps the fetched file around its check gets a
// refusal, and nothing is left at the row's path to be kept as the seed.
// Swapped before the check, the check cannot read the file it was given
// (SQLite resolves the descriptor to the original's name, now gone);
// swapped after it, the identity check refuses the entry at the temp name.
func TestSeededRestoreRefusesASwappedTempFile(t *testing.T) {
	noOwnReplica(t)
	for _, c := range []struct {
		name        string
		swapAfter   bool
		wantPhrases []string
	}{
		{"before the check", false, []string{"integrity check", "could not be put in place"}},
		{"after the check", true, []string{"could not be put in place"}},
	} {
		t.Run(c.name, func(t *testing.T) {
			b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
			rt, _, id := seededRoute(t, b, rt, seeds.StateReady)
			dir := filepath.Dir(rt.DBPath)
			other := filepath.Join(t.TempDir(), "other.db")
			if err := writeMinimalSQLite(other); err != nil {
				t.Fatal(err)
			}
			swap := func() {
				tmp := filepath.Join(dir, ".seed-"+id+".tmp")
				os.Remove(tmp)
				os.Symlink(other, tmp)
			}
			old := checkSeedDB
			readSwapped := false
			checkSeedDB = func(ctx context.Context, path string) error {
				if !c.swapAfter {
					swap()
					// The check is handed the fetched file itself, not a
					// name the swap can redirect.
					fi, err1 := os.Stat(path)
					fo, err2 := os.Stat(other)
					readSwapped = err1 == nil && err2 == nil && os.SameFile(fi, fo)
				}
				err := old(ctx, path)
				if c.swapAfter {
					swap()
				}
				return err
			}
			defer func() { checkSeedDB = old }()
			var spe *SeedPlacementError
			_, err := b.Restore(context.Background(), rt)
			if readSwapped {
				t.Fatal("the integrity check was pointed at the swapped-in file")
			}
			if !errors.As(err, &spe) {
				t.Fatalf("Restore = %v; want a refusal", err)
			}
			matched := false
			for _, w := range c.wantPhrases {
				matched = matched || strings.Contains(spe.Sentence, w)
			}
			if !matched {
				t.Fatalf("Restore = %q; want one of %q", spe.Sentence, c.wantPhrases)
			}
			for _, p := range []string{rt.DBPath, rt.DBPath + SeedMarkerSuffix} {
				if _, err := os.Lstat(p); !os.IsNotExist(err) {
					t.Errorf("%s exists after a refused swap", p)
				}
			}
			if got, _ := os.ReadFile(other); len(got) == 0 {
				t.Error("the swapped-in file's target was touched")
			}
		})
	}
}

// Litestream's sources are WAL-mode databases, so a snapshot's header says
// WAL. The check reads it through a descriptor and must still pass, and
// leave nothing behind.
func TestSeededRestorePlacesAWALModeSnapshot(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	snap := filepath.Join(t.TempDir(), "wal.db")
	db, err := sql.Open("sqlite", snap)
	if err != nil {
		t.Fatal(err)
	}
	for _, q := range []string{"PRAGMA journal_mode=WAL", "create table t(x)", "insert into t values(1)", "PRAGMA wal_checkpoint(TRUNCATE)"} {
		if _, err := db.Exec(q); err != nil {
			t.Fatal(err)
		}
	}
	db.Close()
	body, _ := os.ReadFile(snap)
	if body[18] != 2 || body[19] != 2 {
		t.Fatalf("header bytes 18-19 = %d %d, want WAL", body[18], body[19])
	}
	id, _ := seeds.NewID()
	sum := sha256.Sum256(body)
	rt.SeedSource = seeds.RowSeed{ID: id, Kind: seeds.KindReplica, SHA256: hex.EncodeToString(sum[:]), Bytes: int64(len(body)), State: seeds.StateReady}.Encode()
	b.Seeds = &fakeSeedObjects{body: map[string][]byte{id: body}}
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh {
		t.Fatalf("Restore = fresh %v, %v", fresh, err)
	}
	ents, _ := os.ReadDir(filepath.Dir(rt.DBPath))
	for _, e := range ents {
		if strings.HasPrefix(e.Name(), ".seed-") {
			t.Errorf("%s left behind", e.Name())
		}
	}
}

// syncRep is a Rep that can be asked for its first upload.
type syncRep struct {
	synced int
	err    error
}

func (r *syncRep) Err() error                        { return nil }
func (r *syncRep) Close(context.Context) error       { return nil }
func (r *syncRep) SyncAndWait(context.Context) error { r.synced++; return r.err }

// plainRep is a Rep that cannot be asked for its first upload.
type plainRep struct{}

func (plainRep) Err() error                  { return nil }
func (plainRep) Close(context.Context) error { return nil }

func withSeedState(t *testing.T, rt registry.Route, state string) registry.Route {
	t.Helper()
	src, err := seeds.ParseRowSeed(rt.SeedSource)
	if err != nil || src == nil {
		t.Fatalf("seed column %q: %v", rt.SeedSource, err)
	}
	src.State = state
	rt.SeedSource = src.Encode()
	return rt
}

func TestSeedPlacedWaitsForTheFirstUpload(t *testing.T) {
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, _, id := seededRoute(t, b, rt, seeds.StateReady)
	rt.Account, rt.App = "acct", "shop"
	var calls []string
	b.OnSeedPlaced = func(_ context.Context, acct, app, host, got string) error {
		calls = append(calls, acct+"/"+app+"/"+host+"/"+got)
		return nil
	}
	rep := &syncRep{}
	if err := b.SeedPlaced(context.Background(), rt, rep); err != nil {
		t.Fatal(err)
	}
	if rep.synced != 1 || len(calls) != 1 || calls[0] != "acct/shop/"+rt.Host+"/"+id {
		t.Fatalf("synced %d, calls %q", rep.synced, calls)
	}
	// A failed first upload records nothing.
	rep = &syncRep{err: errors.New("upload failed")}
	calls = nil
	if err := b.SeedPlaced(context.Background(), rt, rep); err == nil || len(calls) != 0 {
		t.Fatalf("after a failed sync: err %v calls %q", err, calls)
	}
	// A replicator that cannot confirm the upload records nothing either:
	// the snapshot must outlive every moment the replica might not exist.
	if err := b.SeedPlaced(context.Background(), rt, plainRep{}); err == nil || len(calls) != 0 {
		t.Fatalf("unconfirmable upload: err %v calls %q", err, calls)
	}
	// A recorder that fails is the caller's to log.
	b.OnSeedPlaced = func(context.Context, string, string, string, string) error { return errors.New("conflict") }
	if err := b.SeedPlaced(context.Background(), rt, &syncRep{}); err == nil {
		t.Fatal("a failed record reported success")
	}
	b.OnSeedPlaced = nil
	if err := b.SeedPlaced(context.Background(), rt, &syncRep{}); err == nil {
		t.Fatal("a box with no recorder reported the seed recorded")
	}
	b.OnSeedPlaced = func(_ context.Context, acct, app, host, got string) error {
		calls = append(calls, got)
		return nil
	}
	// Placed already, not placeable, or no seed: nothing at all.
	for name, r := range map[string]registry.Route{
		"placed":  withSeedState(t, rt, seeds.StatePlaced),
		"aborted": withSeedState(t, rt, seeds.StateAborted),
		"none":    func() registry.Route { r := rt; r.SeedSource = ""; return r }(),
	} {
		rep = &syncRep{}
		if err := b.SeedPlaced(context.Background(), r, rep); err != nil || rep.synced != 0 || len(calls) != 0 {
			t.Fatalf("%s row: err %v synced %d calls %q", name, err, rep.synced, calls)
		}
	}
}

// Review Focus 5: the placed CAS failed after the first upload, so the row
// still reads ready. The next wake finds the host's own replica and
// finishes the placement; a failure there never fails the wake, and the
// wake after that asks again.
func TestSeedPlacedIsFinishedOnTheNextWake(t *testing.T) {
	old := hasOwnReplica
	hasOwnReplica = func(context.Context, string, string, string) (bool, error) { return true, nil }
	defer func() { hasOwnReplica = old }()
	oldRestore := restoreReplica
	restoreReplica = func(_ context.Context, dbPath, _, _, _ string) (bool, error) { return true, writeMinimalSQLite(dbPath) }
	defer func() { restoreReplica = oldRestore }()
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, id := seededRoute(t, b, rt, seeds.StateReady) // the CAS was lost last wake
	rt.Account, rt.App = "acct", "shop"
	var got []string
	var recErr error
	b.OnSeedPlaced = func(_ context.Context, acct, app, host, seed string) error {
		got = append(got, acct+"/"+app+"/"+host+"/"+seed)
		return recErr
	}
	want := "acct/shop/" + rt.Host + "/" + id
	recErr = errors.New("record unreachable")
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh {
		t.Fatalf("Restore with a failing recorder = fresh %v, %v; want a served wake", fresh, err)
	}
	recErr = nil
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh {
		t.Fatalf("Restore = fresh %v, %v", fresh, err)
	}
	if len(got) != 2 || got[0] != want || got[1] != want {
		t.Fatalf("finishPlacement calls = %q, want two for %s", got, want)
	}
	if objs.opens != 0 {
		t.Fatalf("snapshot opened %d times; the own replica wins", objs.opens)
	}
	// No recorder on this box: the wake still serves.
	b.OnSeedPlaced = nil
	if _, err := b.Restore(context.Background(), rt); err != nil {
		t.Fatal(err)
	}
}

// Final review carry item: a placed or committed seed's own-replica
// restore, or its warm copy, leaves a <db>.seed marker naming the seed, so
// the rollback's missing-row purge and an aborted seed's local purge can
// tell the database is the seed's. A marker naming another seed is
// rewritten.
func TestSeededRestoreOfItsOwnReplicaWritesTheMarker(t *testing.T) {
	for _, c := range []struct {
		name  string
		route func(t *testing.T, b *ExecBackend, rt registry.Route) registry.Route
		warm  bool
	}{
		{"committed import, restored", func(t *testing.T, b *ExecBackend, rt registry.Route) registry.Route {
			rt, _ = committedImport(t, b, rt)
			return rt
		}, false},
		{"placed seed, warm copy", func(t *testing.T, b *ExecBackend, rt registry.Route) registry.Route {
			rt, _, _ = seededRoute(t, b, rt, seeds.StatePlaced)
			return rt
		}, true},
	} {
		t.Run(c.name, func(t *testing.T) {
			countOwnReplicaLists(t, false)
			b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
			rt = c.route(t, b, rt)
			col, err := seeds.ParseRowSeed(rt.SeedSource)
			if err != nil {
				t.Fatal(err)
			}
			oldRestore := restoreReplica
			restoreReplica = func(_ context.Context, dbPath, _, _, _ string) (bool, error) {
				return true, writeMinimalSQLite(dbPath)
			}
			defer func() { restoreReplica = oldRestore }()
			os.MkdirAll(filepath.Dir(rt.DBPath), 0o700)
			if c.warm {
				if err := writeMinimalSQLite(rt.DBPath); err != nil {
					t.Fatal(err)
				}
			}
			other, _ := seeds.NewID()
			os.WriteFile(rt.DBPath+SeedMarkerSuffix, []byte(other+"\n"), 0o600)
			if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh {
				t.Fatalf("fresh %v err %v", fresh, err)
			}
			if got, err := ReadSeedMarker(rt.DBPath); err != nil || got != col.ID {
				t.Fatalf("marker after the restore = %q, %v; want %s", got, err, col.ID)
			}
		})
	}
}

// Final review F2b: a database left at a route's path by another seed is
// never this route's warm cache. Its <db>.seed marker names seed A; the
// row has no seed, or seed B. The wake purges it and restores cold: the
// row's own replica when there is one, fresh when the plain path allows
// it. A marker naming the row's own seed keeps the file, as does no
// marker; a marker that cannot be read fails the wake and touches nothing.
func TestPlainRestoreNeverServesAnotherSeedsDatabase(t *testing.T) {
	leftover := []byte("seed A's data")
	for _, c := range []struct {
		name    string
		seed    func(t *testing.T, b *ExecBackend, rt registry.Route) (registry.Route, string) // the row, and the marker's seed
		replica bool                                                                           // the row has a replica of its own
		unread  bool                                                                           // the marker cannot be read
		kept    bool
		fresh   bool
		failed  bool
	}{
		{name: "no seed on the row", seed: func(t *testing.T, _ *ExecBackend, rt registry.Route) (registry.Route, string) {
			a, _ := seeds.NewID()
			return rt, a
		}, fresh: true},
		{name: "the row names seed B", seed: func(t *testing.T, b *ExecBackend, rt registry.Route) (registry.Route, string) {
			rt, _, _ = seededRoute(t, b, rt, seeds.StatePlaced)
			a, _ := seeds.NewID()
			return rt, a
		}, replica: true},
		{name: "the row's own seed", seed: func(t *testing.T, b *ExecBackend, rt registry.Route) (registry.Route, string) {
			rt, _, id := seededRoute(t, b, rt, seeds.StatePlaced)
			return rt, id
		}, kept: true},
		{name: "no marker", seed: func(t *testing.T, _ *ExecBackend, rt registry.Route) (registry.Route, string) {
			return rt, ""
		}, kept: true},
		{name: "unreadable marker", seed: func(t *testing.T, _ *ExecBackend, rt registry.Route) (registry.Route, string) {
			a, _ := seeds.NewID()
			return rt, a
		}, unread: true, failed: true},
	} {
		t.Run(c.name, func(t *testing.T) {
			countOwnReplicaLists(t, c.replica)
			b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
			rt, marker := c.seed(t, b, rt)
			restored := 0
			oldRestore := restoreReplica
			restoreReplica = func(_ context.Context, dbPath, _, _, _ string) (bool, error) {
				restored++
				if !c.replica {
					return false, nil
				}
				return true, writeMinimalSQLite(dbPath)
			}
			defer func() { restoreReplica = oldRestore }()
			if err := os.MkdirAll(filepath.Dir(rt.DBPath), 0o700); err != nil {
				t.Fatal(err)
			}
			if err := os.WriteFile(rt.DBPath, leftover, 0o600); err != nil {
				t.Fatal(err)
			}
			if marker != "" {
				if err := os.WriteFile(rt.DBPath+SeedMarkerSuffix, []byte(marker+"\n"), 0o600); err != nil {
					t.Fatal(err)
				}
			}
			if c.unread {
				if err := os.Chmod(rt.DBPath+SeedMarkerSuffix, 0); err != nil {
					t.Fatal(err)
				}
				t.Cleanup(func() { os.Chmod(rt.DBPath+SeedMarkerSuffix, 0o600) })
				if _, err := ReadSeedMarker(rt.DBPath); err == nil {
					t.Skip("this user reads a mode 0 file (root): the read error cannot be staged")
				}
			}
			fresh, err := b.Restore(context.Background(), rt)
			if (err != nil) != c.failed || fresh != c.fresh {
				t.Fatalf("fresh %v err %v; want fresh %v failed %v", fresh, err, c.fresh, c.failed)
			}
			got, rerr := os.ReadFile(rt.DBPath)
			switch {
			case c.kept || c.failed:
				if rerr != nil || !bytes.Equal(got, leftover) || restored != 0 {
					t.Fatalf("database %q (%v), %d restores; want the file kept as it was and nothing restored", got, rerr, restored)
				}
			case bytes.Equal(got, leftover):
				t.Fatal("the other seed's database was served")
			case c.replica && (rerr != nil || restored != 1):
				t.Fatalf("database %v, %d restores; want the row's own replica", rerr, restored)
			}
			if !c.kept && !c.failed {
				if m, err := ReadSeedMarker(rt.DBPath); err != nil || m == marker {
					t.Fatalf("marker after the purge = %q, %v; want seed A's gone", m, err)
				}
			}
		})
	}
}

// Re-review finding 8: a placement that crashed between its marker and its
// rename leaves seed A's marker with no database. A plain instance later
// created at the host must never be born beside it: its first wake removes
// the marker (and any fetch leftover) before it boots fresh, the instance
// writes, and its second wake keeps those writes as its warm cache.
func TestPlainWakeOverAMarkerOnlyLeftoverKeepsTheReplacementsData(t *testing.T) {
	countOwnReplicaLists(t, false)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	oldRestore := restoreReplica
	restoreReplica = func(context.Context, string, string, string, string) (bool, error) { return false, nil }
	defer func() { restoreReplica = oldRestore }()
	dir := filepath.Dir(rt.DBPath)
	if err := os.MkdirAll(dir, 0o700); err != nil {
		t.Fatal(err)
	}
	a, _ := seeds.NewID()
	tmp := filepath.Join(dir, seedTempName(a))
	for p, body := range map[string]string{rt.DBPath + SeedMarkerSuffix: a + "\n", tmp: "half a fetch"} {
		if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
			t.Fatal(err)
		}
	}
	if fresh, err := b.Restore(context.Background(), rt); err != nil || !fresh {
		t.Fatalf("first wake: fresh %v err %v; want fresh", fresh, err)
	}
	for _, p := range []string{rt.DBPath + SeedMarkerSuffix, tmp} {
		if _, err := os.Lstat(p); !os.IsNotExist(err) {
			t.Fatalf("%s survived the first wake: %v", p, err)
		}
	}
	replacement := []byte("the replacement's own writes")
	if err := os.WriteFile(rt.DBPath, replacement, 0o600); err != nil {
		t.Fatal(err)
	}
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh {
		t.Fatalf("second wake: fresh %v err %v; want the warm cache", fresh, err)
	}
	if got, err := os.ReadFile(rt.DBPath); err != nil || !bytes.Equal(got, replacement) {
		t.Fatalf("database after the second wake = %q, %v; want the replacement's writes", got, err)
	}
}

// A marker that cannot be read fails the wake whether or not a database is
// there, and nothing is created beside it.
func TestPlainWakeFailsOnAnUnreadableMarkerAlone(t *testing.T) {
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	oldRestore := restoreReplica
	restoreReplica = func(context.Context, string, string, string, string) (bool, error) {
		t.Fatal("restored beside an unreadable marker")
		return false, nil
	}
	defer func() { restoreReplica = oldRestore }()
	os.MkdirAll(filepath.Dir(rt.DBPath), 0o700)
	a, _ := seeds.NewID()
	marker := rt.DBPath + SeedMarkerSuffix
	if err := os.WriteFile(marker, []byte(a+"\n"), 0); err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { os.Chmod(marker, 0o600) })
	if _, err := ReadSeedMarker(rt.DBPath); err == nil {
		t.Skip("this user reads a mode 0 file (root): the read error cannot be staged")
	}
	if fresh, err := b.Restore(context.Background(), rt); err == nil || fresh {
		t.Fatalf("fresh %v err %v; want a failed wake", fresh, err)
	}
	if _, err := os.Lstat(rt.DBPath); !os.IsNotExist(err) {
		t.Fatalf("a database was created beside an unreadable marker: %v", err)
	}
}

// Main's seed obligation, under the seed fallback: an earlier first-boot
// seed command at this path whose processes are not proven gone left an
// obligation beside the database. A seeded wake answers it before it
// fetches, purges or places anything. While the proof fails the wake is
// refused with ErrSeedUnproven and the file there is untouched; once it
// holds, the leftover and the obligation go and the snapshot is placed.
func TestSeededRestoreAnswersAnEarlierSeedsObligationFirst(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
	rt, objs, id := seededRoute(t, b, rt, seeds.StateReady)
	ev := &switchableEvents{err: errors.New("cgroup.events: unreadable")}
	b.CgroupEvents = ev.events
	if err := os.MkdirAll(filepath.Dir(rt.DBPath), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(rt.DBPath, []byte("half"), 0o600); err != nil {
		t.Fatal(err)
	}
	if err := recordSeedObligation(rt.Host, rt.DBPath, seedObligation{ownsDB: true, layout: LayoutNested}); err != nil {
		t.Fatal(err)
	}
	ob := rt.DBPath + seedUnprovenSuffix

	if fresh, err := b.Restore(context.Background(), rt); !errors.Is(err, ErrSeedUnproven) || fresh {
		t.Fatalf("Restore = %v, %v; want a refusal while the earlier seed is unproven", fresh, err)
	}
	if objs.opens != 0 {
		t.Fatalf("the snapshot was opened %d times under an unanswered obligation", objs.opens)
	}
	if got, _ := os.ReadFile(rt.DBPath); string(got) != "half" {
		t.Fatalf("database = %q after a refused wake, want it untouched", got)
	}
	if _, err := os.Stat(ob); err != nil {
		t.Fatalf("the obligation went with a proof that failed: %v", err)
	}

	ev.set(nil)
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh {
		t.Fatalf("Restore = %v, %v; want the snapshot placed once the proof holds", fresh, err)
	}
	if _, err := os.Stat(ob); !os.IsNotExist(err) {
		t.Fatalf("obligation still there (%v) after the proof held", err)
	}
	marker, err := os.ReadFile(rt.DBPath + SeedMarkerSuffix)
	if err != nil || strings.TrimSpace(string(marker)) != id || objs.opens != 1 {
		t.Fatalf("marker = %q, %v, opens %d; want this seed placed from one fetch", marker, err, objs.opens)
	}
	if err := checkSeedDB(context.Background(), rt.DBPath); err != nil {
		t.Fatalf("the placed database does not check: %v", err)
	}
}

// Instance key provision under a seed (main's L21 key, minted create-only
// into <host>.env on every launch path): placing a snapshot writes no env
// file, and the seeded row's first launch mints a key of its own into its
// own <host>.env, as any other launch does, and keeps it afterwards. The
// row's seed column names no source host (seeds.RowSeed), so nothing of the
// source's environment can reach the new instance on the box.
func TestASeededRowMintsItsOwnInstanceKeyAtLaunch(t *testing.T) {
	noOwnReplica(t)
	b, rt := nestedBackend(t, &fakeControl{inv: "inv1"}, &fakeUnit{})
	rt, _, _ = seededRoute(t, b, rt, seeds.StateReady)
	if fresh, err := b.Restore(context.Background(), rt); err != nil || fresh {
		t.Fatalf("Restore = fresh %v, %v; want placed", fresh, err)
	}
	dir := provision.InstanceDir(b.DataDir, rt.Host)
	if _, err := os.Lstat(filepath.Join(dir, rt.Host+".env")); !os.IsNotExist(err) {
		t.Fatalf("placing the snapshot left an env file (%v): the key is the launch's to mint", err)
	}
	launch := func() string {
		t.Helper()
		_, ctl, logs, env, err := b.prepare(rt, instancectl.RoleRun)
		if err != nil {
			t.Fatalf("prepare: %v", err)
		}
		logs.Close()
		if ctl != nil {
			ctl.Close()
		}
		own, err := readEnvFileBeneath(dir, rt.Host+".env")
		if err != nil {
			t.Fatal(err)
		}
		if !wellFormedInstanceKey(own[InstanceKeyVar]) || env[InstanceKeyVar] != own[InstanceKeyVar] {
			t.Fatal("the seeded launch does not carry a key minted into its own env file")
		}
		return own[InstanceKeyVar]
	}
	first := launch()
	if again := launch(); again != first {
		t.Fatal("a second launch changed the seeded instance's key")
	}
}