package activator

import (
	"context"
	"errors"
	"fmt"
	"path/filepath"
	"slices"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/updatewords"
)

// Settings spec §4.3 rule 3, "The wake checks too" (settings plan 4 Task 7):
// before a held instance spawns, the wake compares the installed build with
// its target and never runs a different installed build.

func heldOn(v string) func(string) HeldWake {
	return func(string) HeldWake { return HeldWake{Target: v, Held: true} }
}

// shrinkWakeWait bounds a held wake's wait for root (wakeWaitBound, the
// bound its waiters have).
func shrinkWakeWait(t *testing.T, d time.Duration) {
	t.Helper()
	old := wakeWaitBound
	wakeWaitBound = d
	t.Cleanup(func() { wakeWaitBound = old })
}

// shrinkHeldPoll sets how often a held wake polls while it waits, for one
// test. It asks for the answer again every heldReask polls, so a test that
// waits for a re-ask waits heldReask*d.
func shrinkHeldPoll(t *testing.T, d time.Duration) {
	t.Helper()
	old := heldPoll
	heldPoll = d
	t.Cleanup(func() { heldPoll = old })
}

// asks records RequestStage calls as host@build.
type asks struct {
	mu   sync.Mutex
	got  []string
	then func(host, build string)
}

func (r *asks) ask(host, build string) {
	r.mu.Lock()
	r.got = append(r.got, host+"@"+build)
	r.mu.Unlock()
	if r.then != nil {
		r.then(host, build)
	}
}

func (r *asks) seen() []string {
	r.mu.Lock()
	defer r.mu.Unlock()
	return append([]string(nil), r.got...)
}

func (a *Service) entryGone(host string) bool {
	a.mu.Lock()
	defer a.mu.Unlock()
	return a.entries[host] == nil
}

// Spec §8 "Returning residence": the wake never runs a stale link. It asks
// root to install the target, waits for it, and runs exactly that.
func TestAHeldWakeNeverRunsAStaleLink(t *testing.T) {
	a, b := identityActivator(t, "v3") // an old live link left on this box
	a.HeldTarget = heldOn("v1")
	r := &asks{then: func(string, string) { b.setLive("v1") }} // root installs v1
	a.RequestStage = r.ask
	l := &execLog{}
	a.BeforeExec = l.hook
	done, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if err != nil {
		t.Fatal(err)
	}
	done()
	if got := r.seen(); !slices.Equal(got, []string{"one.example.com@v1"}) || b.lastExeVersion() != "v1" || b.startCount() != 1 {
		t.Fatalf("asked %v, started %d of %q; want v1 asked for and started, never v3", got, b.startCount(), b.lastExeVersion())
	}
	if calls, _, _ := l.seen(); !slices.Equal(calls, []string{"one.example.com@v1"}) {
		t.Fatalf("records %v, want v1", calls)
	}
}

// The wait is bounded: a root that never installs the target fails the wake
// within the waiters' bound, and nothing runs.
func TestAHeldWakeWaitsOnlyWithinItsBound(t *testing.T) {
	shrinkWakeWait(t, 300*time.Millisecond)
	a, b := identityActivator(t, "v3")
	a.HeldTarget = heldOn("v1")
	r := &asks{}
	a.RequestStage = r.ask
	host := "one.example.com"
	began := time.Now()
	if _, err := a.beginRequest(context.Background(), identityRoute(t, host)); !errors.Is(err, errStaleLink) && !errors.Is(err, errWakeTimeout) {
		t.Fatalf("err = %v; want the wake to fail, not run v3", err)
	}
	waitFor(t, "the held wake to end", func() bool { return a.entryGone(host) })
	if took := time.Since(began); took > 5*time.Second {
		t.Fatalf("the held wake waited %v, past its bound", took)
	}
	if b.startCount() != 0 || b.seedCount() != 0 {
		t.Fatalf("started %d, seeded %d: the stale build ran", b.startCount(), b.seedCount())
	}
	if got := r.seen(); len(got) != 1 {
		t.Fatalf("asked root %v, want once", got)
	}
}

func TestAnUnknownBuildNeverWakes(t *testing.T) {
	a, b := identityActivator(t, "v1")
	a.HeldTarget = func(string) HeldWake { return HeldWake{Held: true, Unknown: true} }
	a.RequestStage = func(string, string) { t.Error("asked root to install an unknown build") }
	_, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if !errors.Is(err, errBuildUnknown) {
		t.Fatalf("err = %v", err)
	}
	if acq, _, starts := b.counts(); acq != 0 || starts != 0 {
		t.Fatalf("acquired %d, started %d: an unknown build woke", acq, starts)
	}
	if got, want := memberSafeWakeReason(err), updatewords.Text("settings.box.reason.unknown"); got != want {
		t.Fatalf("member reads %q, want %q", got, want)
	}
}

func TestAnAutoInstanceIsNotChecked(t *testing.T) {
	a, b := identityActivator(t, "v1")
	a.HeldTarget = func(string) HeldWake { return HeldWake{} }
	a.RequestStage = func(string, string) { t.Error("asked root for an instance that follows its channel") }
	done, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if err != nil {
		t.Fatal(err)
	}
	done()
	if b.startCount() != 1 || b.lastExeVersion() != "v1" {
		t.Fatal("an auto instance's wake changed")
	}
}

// Astra I3 #2: with CARLOS_SWAP off there is no planner. A target root
// reports failed is never run, even while it is still the live link.
func TestWithNoPlannerAFailedTargetIsRefusedAtTheLiveLink(t *testing.T) {
	a, b := identityActivator(t, "v9") // the failed build is still installed; Planner nil
	a.HeldTarget = func(string) HeldWake { return HeldWake{Target: "v9", Held: true, Failed: true} }
	a.RequestStage = func(string, string) { t.Error("asked root to install a build it reports failed") }
	_, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if !errors.Is(err, errTargetFailed) {
		t.Fatalf("err = %v, want errTargetFailed", err)
	}
	if b.startCount() != 0 {
		t.Fatal("a build root reported failed ran again")
	}
	if got, want := memberSafeWakeReason(err), fmt.Sprintf(updatewords.Text("settings.box.reason.failed"), "v9"); got != want {
		t.Fatalf("member reads %q, want %q", got, want)
	}
}

// Astra I3 #5: with no planner, a retained, verified staged copy of the
// target runs directly, recorded first; root's repoint is not needed. Root
// is still asked to install the target, without the wake waiting for it
// (ruling R-RETAINED-NUDGE): here root never repoints, and the wake runs
// the retained file at once.
func TestWithNoPlannerARetainedCopyRunsWithoutARepoint(t *testing.T) {
	shrinkWakeWait(t, 10*time.Second)
	a, b := identityActivator(t, "v3") // stale v3 installed
	retained := stagedID(t, t.TempDir(), "v1")
	a.HeldTarget = func(string) HeldWake { return HeldWake{Target: "v1", Held: true, Staged: &retained} }
	r := &asks{} // records, never repoints
	a.RequestStage = r.ask
	l := &execLog{spawns: b.startCount}
	a.BeforeExec = l.hook
	rt := identityRoute(t, "one.example.com")
	began := time.Now()
	done, err := a.beginRequest(context.Background(), rt)
	if err != nil {
		t.Fatalf("the wake waited for root instead of running the retained copy: %v", err)
	}
	done()
	if took := time.Since(began); took >= time.Second {
		t.Fatalf("the wake took %v: it waited for root", took)
	}
	if got := r.seen(); !slices.Equal(got, []string{"one.example.com@v1"}) {
		t.Fatalf("asked root %v, want v1 asked for once, not waited on", got)
	}
	x, ok := b.lastExe()
	calls, at, _ := l.seen()
	if !ok || x.id != retained || !slices.Equal(calls, []string{"one.example.com@v1"}) || at[0] != 0 {
		t.Fatalf("ran %+v, recorded %v at spawn counts %v; want the retained v1, recorded first", x, calls, at)
	}
	if c, _ := b.identityCounts(); c != 0 || b.liveStarts() != 0 {
		t.Fatalf("%d live-link captures, %d live-link starts: the retained copy is the wake's identity", c, b.liveStarts())
	}
	if g, _ := a.entryGen(rt.Host); g.StagedPath != retained.StagedPath || g.Build != "v1" {
		t.Fatalf("serving generation %+v, want the retained file's", g)
	}
}

// Ruling R-RETAINED-NUDGE: a retained wake runs v1 while the live link
// still names v3, which the sweep's convergence reads as drift and cycles
// after ConvergeGrace. Root, asked at the wake, repoints inside the grace:
// the drift is gone and the instance keeps serving. The control (root never
// repoints) shows the sweep does cycle it.
func TestARetainedWakeIsNotCycledOnceRootRepoints(t *testing.T) {
	t.Parallel()
	for _, repoint := range []bool{true, false} {
		a, b, clk, _ := testActivator(t, time.Hour)
		b.setIdentity("v3")
		retained := stagedID(t, t.TempDir(), "v1")
		a.HeldTarget = func(string) HeldWake { return HeldWake{Target: "v1", Held: true, Staged: &retained} }
		r := &asks{}
		a.RequestStage = r.ask
		host := "one.example.com"
		done, err := a.beginRequest(context.Background(), identityRoute(t, host))
		if err != nil {
			t.Fatal(err)
		}
		done()
		if len(r.seen()) != 1 {
			t.Fatalf("asked root %v, want once", r.seen())
		}
		a.sweepOnce() // the drift is seen: v1 runs, v3 is linked
		clk.advance(ConvergeGrace / 2)
		if repoint {
			b.setLive("v1") // root's pass, asked at the wake, lands inside the grace
		}
		a.sweepOnce()
		clk.advance(ConvergeGrace)
		a.sweepOnce()
		_, awake := a.entryGen(host)
		if repoint && !awake {
			t.Fatal("the retained wake was cycled although root repointed inside the grace")
		}
		if !repoint && awake {
			t.Fatal("control: a retained wake on a link root never moves was not cycled; the sweep fixture proves nothing")
		}
	}
}

// Anchors D18: a retained copy is a staged file run that no plan or pin
// published. The wake publishes it as pending (ruling R-COLDPUBLISH) before
// it records, so root's sweep cannot remove the file between the capture
// and the exec.
//
// The wake goroutine republishes the generations file after the waiting
// request is let go (wake's tail), so the test waits for that goroutine to
// end before t.TempDir's cleanup removes the file's directory; a write still
// in flight there failed the cleanup with "directory not empty" (fix wave 1,
// item 6, about 15 in 200 runs).
func TestARetainedCopyIsPublishedBeforeItIsRecorded(t *testing.T) {
	shrinkWakeWait(t, 2*time.Second)
	a, b := identityActivator(t, "v3")
	a.GenerationsFile = filepath.Join(t.TempDir(), "zdd", "generations.json")
	ended := make(chan struct{}, 1)
	a.wakeEnded = func(string) { ended <- struct{}{} }
	t.Cleanup(func() { // before TempDir's own cleanup, which was registered first
		select {
		case <-ended:
		case <-time.After(10 * time.Second):
			t.Error("the wake goroutine did not end")
		}
	})
	retained := stagedID(t, t.TempDir(), "v1")
	a.HeldTarget = func(string) HeldWake { return HeldWake{Target: "v1", Held: true, Staged: &retained} }
	names := func() bool {
		g, err := release.ReadGenerations(a.GenerationsFile)
		return err == nil && g != nil && slices.Contains(g.Paths["one.example.com"], retained.StagedPath)
	}
	var publishedFirst atomic.Bool
	l := &execLog{}
	a.BeforeExec = func(ctx context.Context, host, build string) error {
		publishedFirst.Store(names())
		return l.hook(ctx, host, build)
	}
	done, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if err != nil {
		t.Fatal(err)
	}
	done()
	if !publishedFirst.Load() {
		t.Fatal("the build state named the retained copy before the generations file did")
	}
	waitForPublications(t, a.GenerationsFile, 2)
	waitFor(t, "the serving generation to stay published", names)
	if b.startCount() != 1 {
		t.Fatalf("starts = %d", b.startCount())
	}
}

// With a planner, a failed target is the planner's call (I2 #4): the wake is
// not refused by the settings rule, and the planner's recovery boots.
func TestWithAPlannerAFailedTargetDefersToIt(t *testing.T) {
	good := stagedID(t, t.TempDir(), "v0")
	a, b, _ := planActivator(t, WakePlan{Boot: good, Mode: ModeOverlap})
	b.fakeBackend.setIdentity("v9")
	a.HeldTarget = func(string) HeldWake { return HeldWake{Target: "v9", Held: true, Failed: true} }
	a.RequestStage = func(string, string) { t.Error("asked root for a target the planner decides") }
	done, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if err != nil {
		t.Fatal(err)
	}
	done()
	if gens := b.started(); len(gens) != 1 || gens[0].Build != "v0" {
		t.Fatalf("started %+v, want the planner's recovery v0", gens)
	}
}

// stampRoutes is the registry row the wake re-reads (RouteLookup); root's
// repoint stamps Version, as adoption does.
type stampRoutes struct {
	mu sync.Mutex
	rt registry.Route
}

func (s *stampRoutes) Get(string) (*registry.Route, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	rt := s.rt
	return &rt, nil
}

func (s *stampRoutes) stamp(v string) { s.mu.Lock(); s.rt.Version = v; s.mu.Unlock() }

// Astra I2 #4: the held wake never pins its target itself. Generations are
// on and the target v1 is staged on this box (the case where the I1 wake
// check set e.pin and skipped the planner), but the failure book blocks v1
// here: the planner, which sees root's install, boots the good build v0.
func TestAHeldWakeGoesThroughTheFailureAwarePlan(t *testing.T) {
	dir := t.TempDir()
	good, target := stagedID(t, dir, "v0"), stagedID(t, dir, "v1")
	a, b, _ := planActivator(t, WakePlan{}) // generations on, a recording GenBackend
	routes := &stampRoutes{rt: identityRoute(t, "one.example.com")}
	routes.rt.Version, routes.rt.GoodVersion = "v3", "v0"
	a.Routes = routes
	b.fakeBackend.setIdentity("v3")
	var mu sync.Mutex
	var planned []string
	a.Planner = func(_ context.Context, rt registry.Route) WakePlan {
		mu.Lock()
		planned = append(planned, rt.Version)
		mu.Unlock()
		return WakePlan{Boot: good, Mode: ModeOverlap} // decideWake's recovery when Blocks(v1)
	}
	// The target's staged copy exists, but a planner is on: the wake asks
	// root and lets the planner choose, never running the copy itself.
	a.HeldTarget = func(string) HeldWake { return HeldWake{Target: "v1", Held: true, Staged: &target} }
	a.RequestStage = func(host, build string) { b.fakeBackend.setLive(build); routes.stamp(build) }
	done, err := a.beginRequest(context.Background(), routes.rt)
	if err != nil {
		t.Fatal(err)
	}
	done()
	mu.Lock()
	defer mu.Unlock()
	if gens := b.started(); len(planned) != 1 || planned[0] != "v1" || len(gens) != 1 || gens[0].Build != "v0" {
		t.Fatalf("planner saw %v, started %+v; want one plan on root's install v1, booting the good v0", planned, gens)
	}
	a.mu.Lock()
	pinned := a.entries["one.example.com"] != nil && a.entries["one.example.com"].pin != nil
	a.mu.Unlock()
	if pinned {
		t.Fatal("the held wake pinned its target")
	}
}

// Astra I2 #4, the race half: root installs something other than the target
// between the wait and the identity; the wake refuses rather than run it,
// and records and publishes nothing.
func TestAHeldWakeRefusesAnIdentityThatIsNotItsTarget(t *testing.T) {
	a, b := identityActivator(t, "v3")
	a.GenerationsFile = filepath.Join(t.TempDir(), "zdd", "generations.json")
	a.HeldTarget = heldOn("v1")
	a.RequestStage = func(string, string) { b.setLive("v1") }
	b.mu.Lock()
	b.ident.onLiveIdentity = func(f *identityFake) { f.live = "v2" } // a repoint after the wait
	b.mu.Unlock()
	l := &execLog{}
	a.BeforeExec = l.hook
	_, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if !errors.Is(err, errStaleLink) {
		t.Fatalf("err = %v, want errStaleLink", err)
	}
	if b.startCount() != 0 || b.seedCount() != 0 {
		t.Fatal("the wake ran a build that is not its target")
	}
	if calls, _, _ := l.seen(); len(calls) != 0 {
		t.Fatalf("records %v: a refused identity was recorded", calls)
	}
	waitFor(t, "the lease to go back", func() bool { return b.releaseCount() == 1 })
	if g, err := release.ReadGenerations(a.GenerationsFile); err == nil && g != nil && len(g.Paths["one.example.com"]) != 0 {
		t.Fatalf("published %v for a refused identity", g.Paths)
	}
	if got := memberSafeWakeReason(err); got != memberSafeWakeReason(ErrFenced) {
		t.Fatalf("member reads %q, want the fence's wording", got)
	}
}

// Ruling R-EXEC-NOVERSION-2: a held wake never takes the unversioned
// live-link fallback, because its target is a version.
func TestAHeldWakeNeverRunsAnUnversionedLink(t *testing.T) {
	a, b := identityActivator(t, "v1") // the link's version reads v1 ...
	b.mu.Lock()
	b.ident.unversioned = true // ... but the file it resolves to is outside the version store
	b.mu.Unlock()
	a.HeldTarget = heldOn("v1")
	_, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if !errors.Is(err, errStaleLink) {
		t.Fatalf("err = %v, want errStaleLink", err)
	}
	if b.startCount() != 0 || b.liveStarts() != 0 {
		t.Fatalf("started %d (live-link %d): a held wake ran an unversioned file", b.startCount(), b.liveStarts())
	}
}

// A hold swap's pinned wake was chosen by the swap from root's install
// (e.pin): the held check does not run for it.
func TestAHoldSwapsPinnedWakeIsNotChecked(t *testing.T) {
	f := newSwapFixture(t)
	f.a.HeldTarget = func(string) HeldWake {
		t.Error("the held check ran for a hold swap's pinned wake")
		return HeldWake{}
	}
	if res := f.a.Swap(context.Background(), f.attempt(ModeHold), f.newest); res.Outcome != SwapDone {
		t.Fatalf("Swap = %+v", res)
	}
}

// Ruling R-WAKEWORDS: members never see the held check's internal text.
func TestTheHeldWakeRefusalsReadInTheMembersTerms(t *testing.T) {
	cases := []struct {
		err  error
		want string
	}{
		{fmt.Errorf("one.example.com: %w", errBuildUnknown), updatewords.Text("settings.box.reason.unknown")},
		{fmt.Errorf("one.example.com: %w", &targetFailedError{host: "one.example.com", build: "v9"}), fmt.Sprintf(updatewords.Text("settings.box.reason.failed"), "v9")},
		{fmt.Errorf("start one.example.com: %w: would run v2, wants v1", errStaleLink), memberSafeWakeReason(ErrFenced)},
	}
	for _, c := range cases {
		if got := memberSafeWakeReason(c.err); got != c.want {
			t.Errorf("memberSafeWakeReason(%v) = %q, want %q", c.err, got, c.want)
		}
	}
	if !errors.Is(&targetFailedError{build: "v9"}, errTargetFailed) {
		t.Fatal("a failed target is not errTargetFailed")
	}
}

// heldIdentityOK: the target, or, under a plan that is not a first wake,
// the good build the planner chose as recovery. Nothing else.
func TestHeldIdentityOK(t *testing.T) {
	rt := registry.Route{GoodVersion: "v0"}
	plan := WakePlan{Boot: release.StagedIdentity{Version: "v0", StagedPath: "/x/v0"}}
	first := plan
	first.FirstWake = true
	for _, c := range []struct {
		target, id string
		plan       WakePlan
		ok         bool
	}{
		{"", "v7", WakePlan{}, true},
		{"v1", "v1", WakePlan{}, true},
		{"v1", "v2", WakePlan{}, false},
		{"v1", "v0", WakePlan{}, false},
		{"v1", "v0", plan, true},
		{"v1", "v0", first, false},
		{"v1", "", WakePlan{}, false},
	} {
		if got := heldIdentityOK(c.target, release.StagedIdentity{Version: c.id}, c.plan, rt); got != c.ok {
			t.Errorf("heldIdentityOK(%q, %q, planned=%v first=%v) = %v, want %v", c.target, c.id, c.plan.planned(), c.plan.FirstWake, got, c.ok)
		}
	}
}

// The wait asks for the answer again: a changed one ends it at once, with
// its own refusal, rather than at the bound onto a stale target.
func TestAHeldWakeEndsItsWaitWhenTheAnswerChanges(t *testing.T) {
	cases := []struct {
		name string
		next HeldWake
		want error
	}{
		{"unknown", HeldWake{Held: true, Unknown: true}, errBuildUnknown},
		{"failed", HeldWake{Target: "v1", Held: true, Failed: true}, errTargetFailed},
		{"another target", HeldWake{Target: "v2", Held: true}, errStaleLink},
		{"no longer held", HeldWake{}, errStaleLink},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			shrinkWakeWait(t, 20*time.Second)
			shrinkHeldPoll(t, 25*time.Millisecond) // the re-ask comes 8 polls in
			a, b := identityActivator(t, "v3")
			var asked atomic.Int32
			a.HeldTarget = func(string) HeldWake {
				if asked.Add(1) == 1 {
					return HeldWake{Target: "v1", Held: true}
				}
				return c.next
			}
			a.RequestStage = func(string, string) {} // root never installs v1
			began := time.Now()
			_, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
			if !errors.Is(err, c.want) {
				t.Fatalf("err = %v, want %v", err, c.want)
			}
			if took := time.Since(began); took >= 10*time.Second {
				t.Fatalf("the wait ran %v: the changed answer did not end it", took)
			}
			if b.startCount() != 0 {
				t.Fatal("a wake whose answer changed ran something")
			}
		})
	}
}

// countingRoutes is a RouteLookup whose nth Get runs a hook.
type countingRoutes struct {
	rt    registry.Route
	n     atomic.Int32
	onGet func(n int32)
}

func (c *countingRoutes) Get(string) (*registry.Route, error) {
	if c.onGet != nil {
		c.onGet(c.n.Add(1))
	}
	rt := c.rt
	return &rt, nil
}

// A held unit-backed row (systemd execs the live link; nothing can pin its
// file): root installs the target, then the link moves after the wait. The
// read just before the start refuses it, and nothing starts.
func TestAHeldUnitRowRefusesALinkThatMovedAfterTheWait(t *testing.T) {
	exec, unit := &fakeBackend{}, &fakeBackend{}
	exec.setIdentity("v3") // live/<host>: SplitBackend.LiveVersion reads the exec half's link
	split := &SplitBackend{Exec: exec, Unit: struct{ Backend }{unit}}
	reg, err := registry.Open(filepath.Join(t.TempDir(), "registry.db"))
	if err != nil {
		t.Fatal(err)
	}
	a := New(Config{Bucket: "test-bucket", Idle: time.Hour}, split, reg)
	ur := identityRoute(t, "u.example.com")
	ur.Backing = registry.BackingUnit
	routes := &countingRoutes{rt: ur}
	// Get 1 is step 0's; Get 2 is the re-read after the wait.
	routes.onGet = func(n int32) {
		if n == 2 {
			exec.setLive("v2")
		}
	}
	a.Routes = routes
	a.HeldTarget = heldOn("v1")
	a.RequestStage = func(string, string) { exec.setLive("v1") }
	_, err = a.beginRequest(context.Background(), ur)
	if !errors.Is(err, errStaleLink) {
		t.Fatalf("err = %v, want errStaleLink", err)
	}
	if unit.startCount() != 0 || exec.startCount() != 0 {
		t.Fatalf("unit starts %d, exec starts %d: a moved link was started", unit.startCount(), exec.startCount())
	}
	waitFor(t, "the lease to go back", func() bool { return unit.releaseCount() == 1 })
}

// The wait's re-ask is bounded by the wait (Task 12a): an answer that is slow
// to come back (the agent's refresh reads the bucket, up to its own 5 s
// budget) never holds the wake past wakeWaitBound.
func TestAHeldWakesReaskNeverOutlastsTheWait(t *testing.T) {
	// The re-ask comes 8 polls (175 ms) into a 400 ms wait, and its answer
	// takes 5 s: the wait must end at its own bound.
	shrinkHeldPoll(t, 25*time.Millisecond)
	shrinkWakeWait(t, 400*time.Millisecond)
	a, b := identityActivator(t, "v3")
	var asked atomic.Int32
	a.HeldTarget = func(string) HeldWake {
		if asked.Add(1) > 1 {
			time.Sleep(5 * time.Second) // the refresh's own budget
		}
		return HeldWake{Target: "v1", Held: true}
	}
	a.RequestStage = func(string, string) {} // root never installs v1
	// The check itself, timed: the request's own waiters give up at the same
	// bound, so through beginRequest an overrun shows only as their timeout
	// while the wake is still stuck in the re-ask.
	began := time.Now()
	_, _, err := a.wakeCheck(context.Background(), "one.example.com", true)
	took := time.Since(began)
	if !errors.Is(err, errStaleLink) {
		t.Fatalf("err = %v, want errStaleLink at the bound", err)
	}
	if asked.Load() < 2 {
		t.Fatalf("asked %d times: the wait never asked again", asked.Load())
	}
	if took >= 3*time.Second {
		t.Fatalf("the wait ran %v, past its 0.4 s bound: the re-ask outlasted it", took)
	}
	if b.startCount() != 0 {
		t.Fatal("a wake that never saw its target ran something")
	}
}

// Astra round 1 finding 1: a wake whose build state could not be read for it
// is refused before anything is acquired, and root is not asked.
func TestAnUnreadBuildStateRefusesTheWake(t *testing.T) {
	a, b := identityActivator(t, "v1")
	a.HeldTarget = func(string) HeldWake { return HeldWake{Held: true, Unread: true} }
	a.RequestStage = func(string, string) { t.Error("asked root for a wake whose build state is unread") }
	_, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if !errors.Is(err, errBuildStateUnwritten) {
		t.Fatalf("err = %v, want errBuildStateUnwritten", err)
	}
	if acq, _, starts := b.counts(); acq != 0 || starts != 0 {
		t.Fatalf("acquired %d, started %d: a wake decided from a stale copy", acq, starts)
	}
}

// Ruling R-HELD-PURE (Astra round 1 finding 4): with no decision from root
// for the current settings the wake holds. Its build state's build runs at
// once when the live link names it, and root is not asked.
func TestAWakeRootHasNotDecidedForRunsItsInstalledBuild(t *testing.T) {
	a, b := identityActivator(t, "v1")
	a.HeldTarget = func(string) HeldWake { return HeldWake{Held: true, AskRoot: true, Target: "v1"} }
	a.RequestStage = func(string, string) { t.Error("asked root although the build state's build is installed") }
	done, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
	if err != nil {
		t.Fatal(err)
	}
	done()
	if b.lastExeVersion() != "v1" || b.startCount() != 1 {
		t.Fatalf("started %d of %q, want v1", b.startCount(), b.lastExeVersion())
	}
}

// Otherwise it never runs the live link it does not know it may run: it asks
// root for a pass (no build named) and waits for root's decision, then
// follows it: a hold on v1 runs v1 once root installs it; a decision that the
// instance is not held is today's wake; no decision within the bound fails
// the wake with nothing run.
func TestAWakeRootHasNotDecidedForWaitsForRoot(t *testing.T) {
	cases := []struct {
		name    string
		decided HeldWake
		install string
		want    string // the build started, "" for none
	}{
		{"held on its build", HeldWake{Held: true, Target: "v1"}, "v1", "v1"},
		{"not held", HeldWake{}, "", "v3"},
		{"never decides", HeldWake{Held: true, AskRoot: true, Target: "v1"}, "", ""},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			// Root's answer is asked again 8 polls (200 ms) in; a wake root
			// never decides for fails at the bound.
			shrinkHeldPoll(t, 25*time.Millisecond)
			shrinkWakeWait(t, time.Second)
			a, b := identityActivator(t, "v3")
			var asked atomic.Bool
			a.HeldTarget = func(string) HeldWake {
				if asked.Load() {
					return c.decided
				}
				return HeldWake{Held: true, AskRoot: true, Target: "v1"}
			}
			r := &asks{then: func(host, build string) {
				asked.Store(true) // root's pass decides
				if c.install != "" && build == c.install {
					b.setLive(c.install)
				}
			}}
			a.RequestStage = r.ask
			done, err := a.beginRequest(context.Background(), identityRoute(t, "one.example.com"))
			if c.want == "" {
				if !errors.Is(err, errStaleLink) && !errors.Is(err, errWakeTimeout) {
					t.Fatalf("err = %v; want the wake to fail", err)
				}
				waitFor(t, "the wake to end", func() bool { return a.entryGone("one.example.com") })
				if b.startCount() != 0 {
					t.Fatalf("started %q with no decision from root", b.lastExeVersion())
				}
				return
			}
			if err != nil {
				t.Fatal(err)
			}
			done()
			if b.lastExeVersion() != c.want || b.startCount() != 1 {
				t.Fatalf("started %d of %q, want %s", b.startCount(), b.lastExeVersion(), c.want)
			}
			if got := r.seen(); len(got) == 0 || got[0] != "one.example.com@" {
				t.Fatalf("asked %v; want a pass asked for first, naming no build", got)
			}
		})
	}
}