package console

// The instance API (apiinstances.go): the console's provisioning verbs and
// the app-held token that may speak to them. The properties that matter, in
// the order they'd hurt if lost: every refusal before the principal is
// proven is the family's byte-identical 404 (a probe learns nothing — not
// whether an account exists, not whether an app does, not whether an app
// token's binding is close to right), an app token is contained to its own
// account+app and can mint nothing, no host reaches a bucket key without
// passing the label+suffix check, and the rate limiter is consulted only
// AFTER the gate so a 429 can never confirm what a 404 hides.

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"maps"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"slices"
	"sort"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/activator"
	"github.com/carlosframework/platform/internal/metrics"
	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/status"
)

// rawReq is the tests' one-shot request: any method, an optional bearer and
// an optional JSON body, and the response handed back as status + headers +
// bytes so a refusal can be compared to http.NotFound's own output field by
// field rather than merely "looks like a 404".
func rawReq(t *testing.T, method, u, bearer, body string) (int, http.Header, string) {
	t.Helper()
	var rdr io.Reader
	if body != "" {
		rdr = strings.NewReader(body)
	}
	req, err := http.NewRequest(method, u, rdr)
	if err != nil {
		t.Fatal(err)
	}
	if body != "" {
		req.Header.Set("Content-Type", "application/json")
	}
	if bearer != "" {
		req.Header.Set("Authorization", "Bearer "+bearer)
	}
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	defer res.Body.Close()
	out, err := io.ReadAll(res.Body)
	if err != nil {
		t.Fatal(err)
	}
	return res.StatusCode, res.Header, string(out)
}

// notFound404 is one refusal reduced to the parts a prober could read: the
// status, the two headers http.Error sets, and the body.
type notFound404 struct {
	Status  int
	Type    string
	NoSniff string
	Body    string
}

// canonicalNotFound captures what the STDLIB writes, rather than typing the
// expected bytes out here: the property under test is "identical to
// http.NotFound", so http.NotFound is what the tests must compare against.
func canonicalNotFound(t *testing.T) notFound404 {
	t.Helper()
	rec := httptest.NewRecorder()
	http.NotFound(rec, httptest.NewRequest(http.MethodGet, "/", nil))
	return notFound404{rec.Code, rec.Header().Get("Content-Type"),
		rec.Header().Get("X-Content-Type-Options"), rec.Body.String()}
}

func assertNotFound(t *testing.T, what string, want notFound404, status int, h http.Header, body string) {
	t.Helper()
	got := notFound404{status, h.Get("Content-Type"), h.Get("X-Content-Type-Options"), body}
	if got != want {
		t.Errorf("%s\n got: %+v\nwant: the byte-identical %+v", what, got, want)
	}
}

// instanceFixture is a console with titogo claimed in the ops account and a
// MEMBER (not owner) token for it — member-level is exactly the gate these
// verbs grant, the same one promote and the ledger API use.
func instanceFixture(t *testing.T, code string) (*consoleFixture, string) {
	t.Helper()
	fx := newConsoleFixture(t)
	now := time.Now()
	if _, err := fx.st.CreateAppIn(OpsAccountID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if err := fx.st.AddMember(OpsAccountID, "alice@keymail.dev", RoleMember, now); err != nil {
		t.Fatal(err)
	}
	return fx, cliToken(t, fx, "alice@keymail.dev", code)
}

// enableInstances writes the app's manifest — the operator act (`carlos
// instances enable`) whose ABSENCE is what makes the feature not exist.
func enableInstances(t *testing.T, fx *consoleFixture, app string, m provision.Manifest) {
	t.Helper()
	if err := provision.PutManifest(context.Background(), fx.rel, release.OpsAccount, app, m); err != nil {
		t.Fatal(err)
	}
}

func titoManifest() provision.Manifest {
	return provision.Manifest{Schema: 1, App: "titogo", Domain: "go.tito.io",
		Pool: "tito", Channel: "stable", Regions: []string{"ie"}, Seed: []string{"seed"}}
}

func instancesURL(fx *consoleFixture, acct, app string) string {
	return fx.ts.URL + "/api/cli/apps/" + acct + "/" + app + "/instances"
}

// TestAPIInstanceRefusalMatrix: every way of not being allowed here — a
// stranger's token, an app token pointed at a neighbouring account or a
// neighbouring app, an account that does not exist, an app that was never
// claimed — answers with the SAME bytes http.NotFound writes. Asserted
// against the stdlib's own output, on every verb.
func TestAPIInstanceRefusalMatrix(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-refusal")
	enableInstances(t, fx, "titogo", titoManifest())
	want := canonicalNotFound(t)

	// A second account, so the app token's cross-account probe names one
	// that genuinely exists: the refusal must not depend on that.
	now := time.Now()
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if _, err := fx.st.CreateAppIn(42, "titogo", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	// An app token bound to (bab, titogo) — the honest binding.
	appTok, err := fx.st.NewAppToken(OpsAccountID, "titogo", "alice@keymail.dev", "signup", now)
	if err != nil {
		t.Fatal(err)
	}
	// A member of nothing at all.
	eve := cliToken(t, fx, "eve@keymail.dev", "code-inst-eve")

	body := `{"host":"acme.go.tito.io","region":"ie"}`
	cases := []struct {
		what   string
		method string
		url    string
		token  string
		body   string
	}{
		{"non-member list", http.MethodGet, instancesURL(fx, "bab", "titogo"), eve, ""},
		{"non-member create", http.MethodPost, instancesURL(fx, "bab", "titogo"), eve, body},
		{"non-member get", http.MethodGet, instancesURL(fx, "bab", "titogo") + "/acme.go.tito.io", eve, ""},
		{"non-member delete", http.MethodDelete, instancesURL(fx, "bab", "titogo") + "/acme.go.tito.io", eve, ""},
		{"app token, foreign account", http.MethodGet, instancesURL(fx, "cdef", "titogo"), appTok, ""},
		{"app token, foreign account create", http.MethodPost, instancesURL(fx, "cdef", "titogo"), appTok, body},
		{"app token, foreign app", http.MethodGet, instancesURL(fx, "bab", "other"), appTok, ""},
		{"app token, foreign app create", http.MethodPost, instancesURL(fx, "bab", "other"), appTok, body},
		// The account segment resolves by NAME for a user token; an app
		// token holds no memberships to resolve one against, so its own
		// account's name is not a way in either.
		{"app token, own account by name", http.MethodGet, instancesURL(fx, "ops", "titogo"), appTok, ""},
		{"unknown account", http.MethodGet, instancesURL(fx, "zzzz", "titogo"), member, ""},
		{"unclaimed app", http.MethodGet, instancesURL(fx, "bab", "ghost-app"), member, ""},
		{"unclaimed app create", http.MethodPost, instancesURL(fx, "bab", "ghost-app"), member, body},
	}
	for _, c := range cases {
		status, h, out := rawReq(t, c.method, c.url, c.token, c.body)
		assertNotFound(t, c.what, want, status, h, out)
	}

	// None of the refused calls wrote anything.
	if _, _, err := fx.rel.Get(context.Background(),
		provision.RecordKey("bab", "titogo", "acme.go.tito.io")); err == nil {
		t.Fatalf("a record exists after only refused creates")
	}
	if _, _, err := fx.rel.Get(context.Background(),
		provision.RecordKey("cdef", "titogo", "acme.go.tito.io")); err == nil {
		t.Fatalf("a record exists in the neighbouring account after only refused creates")
	}
}

// TestAPIInstanceNoToken: no credential at all is the 401 every CLI door
// gives, on all five routes.
func TestAPIInstanceNoToken(t *testing.T) {
	fx, _ := instanceFixture(t, "code-inst-notoken")
	for _, c := range []struct{ method, url, body string }{
		{http.MethodGet, instancesURL(fx, "bab", "titogo"), ""},
		{http.MethodPost, instancesURL(fx, "bab", "titogo"), `{"host":"a.go.tito.io"}`},
		{http.MethodGet, instancesURL(fx, "bab", "titogo") + "/a.go.tito.io", ""},
		{http.MethodDelete, instancesURL(fx, "bab", "titogo") + "/a.go.tito.io", ""},
		{http.MethodPost, fx.ts.URL + "/api/cli/apps/bab/titogo/instance-token", `{}`},
	} {
		if status, _, out := rawReq(t, c.method, c.url, "", c.body); status != http.StatusUnauthorized {
			t.Errorf("%s %s with no token = %d %s, want 401", c.method, c.url, status, out)
		}
	}
}

// TestAPIInstanceAppTokenContainment: the app token is contained in both
// directions. It cannot speak to the verbs a person's token speaks to
// (promote), it cannot mint another token, and it CAN do exactly the four
// instance verbs on its own app.
func TestAPIInstanceAppTokenContainment(t *testing.T) {
	fx, _ := instanceFixture(t, "code-inst-contain")
	enableInstances(t, fx, "titogo", titoManifest())
	appTok, err := fx.st.NewAppToken(OpsAccountID, "titogo", "alice@keymail.dev", "signup", time.Now())
	if err != nil {
		t.Fatal(err)
	}

	// Promote: the containment is unchanged, the ANSWER moved from 401 to
	// 403 when the role gate landed (service-principals spec §3b, §8). An
	// app token is a service principal holding role `instance`, and promote
	// names `publish` — so cliRoute refuses it out at the wrapper, before
	// the handler and before the account segment is read. 403 discloses
	// nothing the holder does not already know: its own role, and the roles
	// this door wants. It is the same constant answer for every account
	// segment, which is what keeps it from being a membership oracle
	// (TestRoleRefusalIsConstantAcrossAccounts).
	if status, _, out := rawReq(t, http.MethodPost,
		fx.ts.URL+"/api/cli/apps/bab/titogo/promote", appTok,
		`{"version":"1.0.0","channel":"canary/a"}`); status != http.StatusForbidden {
		t.Fatalf("app token on promote = %d %s, want 403", status, out)
	}
	// Minting is a human act: the mint door is registered with the zero
	// Set, so no role reaches it and admin is no escape hatch either
	// (TestNoRoleReachesAMintFleetOrPolicyDoor). Behind it, apiPerson still
	// refuses a non-person outright — the gate is the outer of two walls,
	// not a replacement for the inner one. (apiAccountApp used to be that
	// inner wall by accident, because it resolved through cliUser; since it
	// became principal-aware the refusal is stated rather than inherited.)
	if status, _, out := rawReq(t, http.MethodPost,
		fx.ts.URL+"/api/cli/apps/bab/titogo/instance-token", appTok, `{}`); status != http.StatusForbidden {
		t.Fatalf("app token minting a token = %d %s, want 403", status, out)
	}
	// Its own app's verbs work.
	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), appTok,
		`{"host":"acme.go.tito.io","region":"ie"}`)
	if status != http.StatusCreated {
		t.Fatalf("app token create on its own app = %d %s, want 201", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatalf("create body %s: %v", out, err)
	}
	if rec.CreatedBy != "app:bab/titogo" {
		t.Fatalf("created_by = %q, want the app principal app:bab/titogo", rec.CreatedBy)
	}
	if status, _, out := rawReq(t, http.MethodGet, instancesURL(fx, "bab", "titogo"), appTok, ""); status != http.StatusOK {
		t.Fatalf("app token list = %d %s, want 200", status, out)
	}
	if status, _, out := rawReq(t, http.MethodDelete,
		instancesURL(fx, "bab", "titogo")+"/acme.go.tito.io", appTok, ""); status != http.StatusOK {
		t.Fatalf("app token delete = %d %s, want 200", status, out)
	}
}

// TestAPIInstanceCreateRefusalOrder walks spec §7's order with a member
// token: membership is already proven, so from here on refusals may name
// their cause — and each one must be the RIGHT cause, in the right order.
func TestAPIInstanceCreateRefusalOrder(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-create")
	u := instancesURL(fx, "bab", "titogo")

	// No manifest at all: the feature does not exist for this app.
	status, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"ie"}`)
	if status != http.StatusConflict {
		t.Fatalf("create with no manifest = %d %s, want 409", status, out)
	}
	if !strings.Contains(out, "carlos instances enable") {
		t.Fatalf("no-manifest refusal = %s, want it to name `carlos instances enable`", out)
	}

	enableInstances(t, fx, "titogo", titoManifest())

	for _, c := range []struct{ what, body string }{
		{"bad host shape", `{"host":"-nope-.go.tito.io","region":"ie"}`},
		{"traversal host", `{"host":"../../etc/passwd","region":"ie"}`},
		{"wrong suffix", `{"host":"acme.evil.example","region":"ie"}`},
		{"bare domain, no label", `{"host":"go.tito.io","region":"ie"}`},
		{"region outside the allow-list", `{"host":"acme.go.tito.io","region":"us"}`},
		{"malformed region", `{"host":"acme.go.tito.io","region":"IE/../x"}`},
		{"bad channel", `{"host":"acme.go.tito.io","region":"ie","channel":"../etc"}`},
	} {
		status, _, out := rawReq(t, http.MethodPost, u, token, c.body)
		if status != http.StatusBadRequest {
			t.Errorf("%s = %d %s, want 400", c.what, status, out)
		}
	}
	// Nothing above reached the bucket.
	keys, err := fx.rel.List(context.Background(), provision.RecordsPrefix("bab", "titogo"))
	if err != nil {
		t.Fatal(err)
	}
	if len(keys) != 0 {
		t.Fatalf("refused creates left %v in the bucket", keys)
	}

	// The happy path: channel defaults from the manifest, pool is stamped
	// from it (never from the request), the record comes back whole.
	status, _, out = rawReq(t, http.MethodPost, u, token,
		`{"host":"acme.go.tito.io","region":"ie","pool":"attacker"}`)
	if status != http.StatusCreated {
		t.Fatalf("create = %d %s, want 201", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatalf("create body %s: %v", out, err)
	}
	if rec.Schema != 1 || rec.Host != "acme.go.tito.io" || rec.Slug != "acme" ||
		rec.App != "titogo" || rec.Account != "bab" || rec.Pool != "tito" ||
		rec.Region != "ie" || rec.Channel != "stable" {
		t.Fatalf("record = %+v", rec)
	}
	if rec.CreatedBy != "alice@keymail.dev" {
		t.Fatalf("created_by = %q, want the member's address", rec.CreatedBy)
	}

	// It is in the bucket at exactly the key the reconciler will look for.
	raw, _, err := fx.rel.Get(context.Background(), provision.RecordKey("bab", "titogo", "acme.go.tito.io"))
	if err != nil {
		t.Fatalf("stored record: %v", err)
	}
	var stored provision.Record
	if err := json.Unmarshal(raw, &stored); err != nil {
		t.Fatal(err)
	}
	if stored.CreatedBy != "alice@keymail.dev" || stored.Host != "acme.go.tito.io" {
		t.Fatalf("stored record = %+v", stored)
	}
	if stored.CreatedAt.IsZero() {
		t.Fatalf("stored record has no created_at: %+v", stored)
	}

	// The same host twice is a lost race, not a silent overwrite.
	status, _, out = rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"ie"}`)
	if status != http.StatusConflict {
		t.Fatalf("duplicate create = %d %s, want 409", status, out)
	}
	if !strings.Contains(out, "already exists") {
		t.Fatalf("duplicate refusal = %s, want it to say the instance already exists", out)
	}

	// An explicit channel is honoured over the manifest's default.
	status, _, out = rawReq(t, http.MethodPost, u, token,
		`{"host":"beta.go.tito.io","region":"ie","channel":"canary/beta"}`)
	if status != http.StatusCreated {
		t.Fatalf("create with channel = %d %s, want 201", status, out)
	}
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatal(err)
	}
	if rec.Channel != "canary/beta" {
		t.Fatalf("channel = %q, want the requested canary/beta", rec.Channel)
	}
}

// TestAPIInstanceCreateInheritsFleetPlacement: a fleet-placed app's
// instances inherit the app's placement (customer-fleets plan, spec's "one
// flag on the app, all its instances follow") — the request body's region
// is ignored entirely, and even a region the manifest's allow-list would
// otherwise refuse succeeds, because it is never consulted once the app is
// placed.
//
// A route must already exist for "titogo" before place is called:
// appPlacement (fleets.go) derives an app's placement from its ALREADY
// STAMPED routes, so an app placed before it has any route/instance at all
// has nothing yet to derive from — a known limitation of the routes-derived
// approach, not exercised by this test (see fleets.go's appPlacement doc
// comment). Seeding one here is the realistic shape: an app already
// running (e.g. via `carlos add`) before being placed onto a fleet.
func TestAPIInstanceCreateInheritsFleetPlacement(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-placed")
	enableInstances(t, fx, "titogo", titoManifest()) // Regions: []string{"ie"}

	reg, err := registry.Open(fx.regPath)
	if err != nil {
		t.Fatal(err)
	}
	if err := reg.Upsert(registry.Route{Host: "www.go.tito.io", Kind: "instance", App: "titogo", Account: "bab"}); err != nil {
		t.Fatal(err)
	}

	if status, body := postJSON(t, fx.ts.URL+"/api/cli/fleets/bab/new",
		map[string]string{"name": "pi", "bucket": "pi-fleet-data"}, token); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v, want 200", status, body)
	}
	if status, body := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/titogo/place",
		map[string]string{"target": "fleet/pi"}, token); status != http.StatusOK {
		t.Fatalf("place = %d %v, want 200", status, body)
	}

	u := instancesURL(fx, "bab", "titogo")
	// "us" is outside titoManifest's ["ie"] allow-list — refused on an
	// unplaced app (TestAPIInstanceCreateUnplacedHonorsBodyRegion below),
	// but accepted (and overridden) here.
	status, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"us"}`)
	if status != http.StatusCreated {
		t.Fatalf("create on a placed app = %d %s, want 201", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatalf("create body %s: %v", out, err)
	}
	if rec.Region != "fleet/pi" {
		t.Fatalf("record Region = %q, want the inherited fleet/pi (body region ignored)", rec.Region)
	}

	// The stored record agrees.
	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "acme.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if stored.Region != "fleet/pi" {
		t.Fatalf("stored record Region = %q, want fleet/pi", stored.Region)
	}
}

// TestAPIInstanceCreateInheritsRouteLessPlacedApp is the fix for the
// limitation TestAPIInstanceCreateInheritsFleetPlacement's doc comment used
// to describe: an app placed at CREATE TIME (`carlos apps create -place
// fleet/<f>`, 2026-08-06 ruling) has ZERO routes at the instant of
// placement — nothing for the old route-derived appPlacement to find — yet
// its first instance must still inherit the target, because the store's
// placement column (not routes) is now the source of truth. Unlike
// TestAPIInstanceCreateInheritsFleetPlacement, no route is ever seeded here.
func TestAPIInstanceCreateInheritsRouteLessPlacedApp(t *testing.T) {
	fx := newConsoleFixture(t)
	token := cliToken(t, fx, "paul@keymail.dev", "code-inst-routeless-placed")

	if status, body := postJSON(t, fx.ts.URL+"/api/cli/fleets/"+fx.sqid+"/new",
		map[string]string{"name": "pi", "bucket": "pi-fleet-data"}, token); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v, want 200", status, body)
	}
	// The app itself is created THROUGH the API, carrying place in the same
	// call — the exact CLI surface this test exists for, and the only way an
	// app can reach instance-create with a placement and genuinely zero
	// routes (a pre-seeded fixture app would not prove the store path).
	if status, body := postJSON(t, fx.ts.URL+"/api/cli/apps/"+fx.sqid+"/new",
		map[string]string{"name": "titogo", "place": "fleet/pi"}, token); status != http.StatusOK {
		t.Fatalf("create app with place = %d %v, want 200", status, body)
	}
	enableInstances(t, fx, "titogo", titoManifest()) // Regions: []string{"ie"}

	// Sanity: genuinely zero routes for this app — the case route-derivation
	// alone cannot answer.
	reg, err := registry.Open(fx.regPath)
	if err != nil {
		t.Fatal(err)
	}
	routes, err := reg.List()
	if err != nil {
		t.Fatal(err)
	}
	for _, rt := range routes {
		if rt.Account == fx.sqid && rt.App == "titogo" {
			t.Fatalf("titogo already has a route (%s) — this test needs zero to prove the store path", rt.Host)
		}
	}

	u := instancesURL(fx, fx.sqid, "titogo")
	// "us" is outside titoManifest's ["ie"] allow-list — accepted (and
	// overridden) here only because the store's placement inherits.
	status, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"us"}`)
	if status != http.StatusCreated {
		t.Fatalf("create on a route-less placed app = %d %s, want 201", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatalf("create body %s: %v", out, err)
	}
	if rec.Region != "fleet/pi" {
		t.Fatalf("record Region = %q, want the inherited fleet/pi (body region ignored)", rec.Region)
	}
}

// TestAPIInstanceCreateUnplacedHonorsBodyRegion is the regression guard for
// the inheritance check above: without a placement, the existing contract
// is unchanged — the body's region is validated against the manifest's
// allow-list and stored exactly as before.
func TestAPIInstanceCreateUnplacedHonorsBodyRegion(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-unplaced")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")

	status, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"ie"}`)
	if status != http.StatusCreated {
		t.Fatalf("create = %d %s, want 201", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatal(err)
	}
	if rec.Region != "ie" {
		t.Fatalf("Region = %q, want the body's ie (no placement in play)", rec.Region)
	}

	// A region outside the manifest's allow-list is still refused, exactly
	// as it was before placement inheritance existed.
	status, _, out = rawReq(t, http.MethodPost, u, token, `{"host":"beta.go.tito.io","region":"us"}`)
	if status != http.StatusBadRequest {
		t.Fatalf("create outside the allow-list on an unplaced app = %d %s, want 400", status, out)
	}
}

// TestAPIInstanceCreateEmptyRegionAllowList: an empty allow-list means any
// shape-valid region, per §3.1 — including the unconstrained empty one.
func TestAPIInstanceCreateEmptyRegionAllowList(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-anyregion")
	m := titoManifest()
	m.Regions = nil
	m.Channel = ""
	enableInstances(t, fx, "titogo", m)
	u := instancesURL(fx, "bab", "titogo")

	status, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"us-east"}`)
	if status != http.StatusCreated {
		t.Fatalf("create with an open allow-list = %d %s, want 201", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatal(err)
	}
	// No manifest channel either, and this app has no pipeline, so the
	// record follows the entry channel every app's releases land on.
	// apiinstanceschannel_test.go is where that resolution is pinned; here
	// it is only asserted so an open allow-list cannot quietly change it.
	if rec.Channel != "edge" {
		t.Fatalf("channel = %q, want the entry-channel default", rec.Channel)
	}
	if status, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"beta.go.tito.io"}`); status != http.StatusCreated {
		t.Fatalf("create with no region = %d %s, want 201", status, out)
	}
}

// TestAPIInstanceListAndGet: what was created lists and reads back, and a
// host that isn't there is the byte-identical 404 — a record's existence is
// not something to probe for either.
func TestAPIInstanceListAndGet(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-list")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	for _, h := range []string{"acme.go.tito.io", "beta.go.tito.io"} {
		if status, _, out := rawReq(t, http.MethodPost, u, token,
			fmt.Sprintf(`{"host":%q,"region":"ie"}`, h)); status != http.StatusCreated {
			t.Fatalf("create %s = %d %s", h, status, out)
		}
	}

	status, _, out := rawReq(t, http.MethodGet, u, token, "")
	if status != http.StatusOK {
		t.Fatalf("list = %d %s", status, out)
	}
	var list struct {
		Instances []provision.Record `json:"instances"`
		Truncated bool               `json:"truncated"`
	}
	if err := json.Unmarshal([]byte(out), &list); err != nil {
		t.Fatalf("list body %s: %v", out, err)
	}
	if len(list.Instances) != 2 || list.Truncated {
		t.Fatalf("list = %+v, want both records and truncated false", list)
	}
	if list.Instances[0].Host != "acme.go.tito.io" || list.Instances[1].Host != "beta.go.tito.io" {
		t.Fatalf("list order = %+v, want host order", list.Instances)
	}

	status, _, out = rawReq(t, http.MethodGet, u+"/acme.go.tito.io", token, "")
	if status != http.StatusOK {
		t.Fatalf("get = %d %s", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatal(err)
	}
	if rec.Host != "acme.go.tito.io" || rec.Slug != "acme" {
		t.Fatalf("get = %+v", rec)
	}

	want := canonicalNotFound(t)
	status, h, out := rawReq(t, http.MethodGet, u+"/missing.go.tito.io", token, "")
	assertNotFound(t, "get of a host with no record", want, status, h, out)
	// A hostile host never reaches the key builder: same 404, nothing read.
	status, h, out = rawReq(t, http.MethodGet, u+"/..%2f..%2fchannels", token, "")
	assertNotFound(t, "get of a traversal host", want, status, h, out)
}

// TestAPIInstanceListStagedVersion (issue #78): the list join. A record
// whose host was named in a FRESH box's private status/boxes/<label>.json
// RouteVersions carries that box's reported version as staged_version; a
// record no box has ever reported gets the empty string; a record whose
// only reporting box has gone STALE (status.BoxStale — the same rule the
// operator fleet page's HostRows votes with) is EXCLUDED from the join, not
// served that box's last-known reading as if it were current; and neither a
// garbage object under status/boxes/ nor an entirely absent one turns the
// list into a 500 — the join is best-effort observability layered onto the
// record at read time, never load-bearing for the list itself.
func TestAPIInstanceListStagedVersion(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-staged")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	for _, h := range []string{"acme.go.tito.io", "beta.go.tito.io", "gamma.go.tito.io"} {
		if code, _, out := rawReq(t, http.MethodPost, u, token,
			fmt.Sprintf(`{"host":%q,"region":"ie"}`, h)); code != http.StatusCreated {
			t.Fatalf("create %s = %d %s", h, code, out)
		}
	}

	// No box has reported at all yet: the list must still serve, every
	// record's staged_version empty.
	code, _, out := rawReq(t, http.MethodGet, u, token, "")
	if code != http.StatusOK {
		t.Fatalf("list with no status objects = %d %s, want 200", code, out)
	}
	var list struct {
		Instances []struct {
			Host          string `json:"host"`
			StagedVersion string `json:"staged_version"`
		} `json:"instances"`
	}
	if err := json.Unmarshal([]byte(out), &list); err != nil {
		t.Fatalf("list body %s: %v", out, err)
	}
	for _, r := range list.Instances {
		if r.StagedVersion != "" {
			t.Errorf("%s staged_version = %q before any box reported, want empty", r.Host, r.StagedVersion)
		}
	}

	// Seed a FRESH box snapshot naming acme's staged version, a STALE one
	// (older than status.SnapshotPeriod x 3 — see status.BoxStale) naming
	// gamma's, and a garbage object alongside them that must be skipped, not
	// fatal. beta gets no box at all.
	fresh := status.CollectBox(nil, status.Probes{MachineID: "box1"}, time.Now())
	fresh.Metrics = &status.BoxMetrics{RouteVersions: map[string]string{"acme.go.tito.io": "abc1234"}}
	if err := status.WriteBox(context.Background(), fx.rel, fresh); err != nil {
		t.Fatal(err)
	}
	stale := status.CollectBox(nil, status.Probes{MachineID: "box2"}, time.Now().Add(-time.Hour))
	stale.Metrics = &status.BoxMetrics{RouteVersions: map[string]string{"gamma.go.tito.io": "deadbeef"}}
	if err := status.WriteBox(context.Background(), fx.rel, stale); err != nil {
		t.Fatal(err)
	}
	if _, err := fx.rel.Put(context.Background(), "status/boxes/broken.json", []byte("{not json"), ""); err != nil {
		t.Fatal(err)
	}

	code, _, out = rawReq(t, http.MethodGet, u, token, "")
	if code != http.StatusOK {
		t.Fatalf("list with seeded boxes and a garbage object = %d %s, want 200", code, out)
	}
	if err := json.Unmarshal([]byte(out), &list); err != nil {
		t.Fatalf("list body %s: %v", out, err)
	}
	got := map[string]string{}
	for _, r := range list.Instances {
		got[r.Host] = r.StagedVersion
	}
	if got["acme.go.tito.io"] != "abc1234" {
		t.Errorf("acme staged_version = %q, want abc1234 (its box is fresh)", got["acme.go.tito.io"])
	}
	if got["beta.go.tito.io"] != "" {
		t.Errorf("beta staged_version = %q, want empty (no box has reported it)", got["beta.go.tito.io"])
	}
	if got["gamma.go.tito.io"] != "" {
		t.Errorf("gamma staged_version = %q, want empty — its only reporting box is stale and must not be joined", got["gamma.go.tito.io"])
	}
}

// TestAPIInstanceListHealthAndFilters (Task 9): the list door grows the same
// controls the Running tab has — a health word per record, a substring
// filter, a health filter, and an opaque cursor — computed server-side so the
// CLI, the API and the page can never disagree about an instance's state. The
// growth is ADDITIVE: a client that knows only `instances` + `truncated`
// still parses this body, every pre-existing field byte-identical, and a
// request carrying none of the new params still returns every record it did
// before.
func TestAPIInstanceListHealthAndFilters(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-health")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	// "a" and "ab" share a prefix so q=a proves a SUBSTRING match rather than
	// an accidental equality, and "b" proves it excludes.
	for _, h := range []string{"a.go.tito.io", "ab.go.tito.io", "b.go.tito.io", "run.go.tito.io"} {
		if code, _, out := rawReq(t, http.MethodPost, u, token,
			fmt.Sprintf(`{"host":%q,"region":"ie"}`, h)); code != http.StatusCreated {
			t.Fatalf("create %s = %d %s", h, code, out)
		}
	}
	// a's record has been materialized into a route: ready, instance-kind,
	// not hibernating, no stamped unit and not provisioned — nothing the
	// sweep was ever told how to sample, so its silence is honest ignorance
	// ("No readings"), not an outage.
	fx.addRoute(t, registry.Route{Host: "a.go.tito.io", Kind: "instance", Status: "ready",
		App: "titogo", Account: fx.sqid, Channel: "stable"})
	// ab has no registry row at all: still provisioning, "Setting up".
	//
	// b's host carries a route stamped to ANOTHER account and app, with a
	// bespoke unit that IS reporting in the sweep below. That row is not this
	// record's route — the box's reconcile pass refuses to converge it too —
	// so b must read "Setting up", and the neighbour's unit must never enter
	// the metrics allowlist. If the tenant check were dropped, b would read
	// "Running" off someone else's process.
	fx.addRoute(t, registry.Route{Host: "b.go.tito.io", Kind: "instance", Status: "ready",
		App: "neighbour", Account: "zzz", Unit: "neighbour-canary@b.service"})
	// run is the live case: provisioned, and its carlos-app@ unit is in a
	// fresh sweep — "Running", which is what proves the sweep join is wired
	// rather than every word coming from the registry alone.
	fx.addRoute(t, registry.Route{Host: "run.go.tito.io", Kind: "instance", Status: "ready",
		App: "titogo", Account: fx.sqid, Channel: "stable", Provisioned: true})
	at := time.Now().UTC().Add(-time.Minute)
	if err := metrics.WriteRaw(context.Background(), fx.rel, metrics.RawChunk{
		V: 1, Box: "box-health", Hour: metrics.HourOf(at),
		Samples: []metrics.Sample{{At: at, Units: map[string]metrics.UnitSample{
			activator.UnitName("run.go.tito.io"): {},
			"neighbour-canary@b.service":         {},
		}}},
	}); err != nil {
		t.Fatal(err)
	}

	type listBody struct {
		Instances []struct {
			Host          string `json:"host"`
			Health        string `json:"health"`
			StagedVersion string `json:"staged_version"`
		} `json:"instances"`
		Truncated  bool           `json:"truncated"`
		Total      int            `json:"total"`
		Counts     map[string]int `json:"counts"`
		NextCursor string         `json:"next_cursor"`
	}
	get := func(t *testing.T, query string) (listBody, string) {
		t.Helper()
		code, _, out := rawReq(t, http.MethodGet, u+query, token, "")
		if code != http.StatusOK {
			t.Fatalf("list%s = %d %s, want 200", query, code, out)
		}
		var body listBody
		if err := json.Unmarshal([]byte(out), &body); err != nil {
			t.Fatalf("list%s body %s: %v", query, out, err)
		}
		return body, out
	}
	hostsOf := func(b listBody) []string {
		var out []string
		for _, r := range b.Instances {
			out = append(out, r.Host)
		}
		return out
	}

	order := []string{"a.go.tito.io", "ab.go.tito.io", "b.go.tito.io", "run.go.tito.io"}
	wantCounts := map[string]int{"No readings": 1, "Setting up": 2, "Running": 1}

	// 1) No params: every record, each carrying its health word, plus the
	//    whole-app totals the header states.
	all, _ := get(t, "")
	if got := hostsOf(all); !slices.Equal(got, order) {
		t.Fatalf("unfiltered list = %v, want all four in host order", got)
	}
	wantHealth := map[string]string{
		"a.go.tito.io":   "No readings",
		"ab.go.tito.io":  "Setting up",
		"b.go.tito.io":   "Setting up", // a neighbour's route answers for nobody
		"run.go.tito.io": "Running",
	}
	for _, r := range all.Instances {
		if r.Health != wantHealth[r.Host] {
			t.Errorf("%s health = %q, want %q", r.Host, r.Health, wantHealth[r.Host])
		}
	}
	if all.Total != 4 {
		t.Errorf("total = %d, want 4", all.Total)
	}
	if !maps.Equal(all.Counts, wantCounts) {
		t.Errorf("counts = %v, want %v", all.Counts, wantCounts)
	}
	if all.NextCursor != "" {
		t.Errorf("next_cursor = %q on a single-page list, want empty", all.NextCursor)
	}

	// 2) q is a substring match on the host.
	q, _ := get(t, "?q=a")
	if got := hostsOf(q); !slices.Equal(got, []string{"a.go.tito.io", "ab.go.tito.io"}) {
		t.Errorf("q=a = %v, want a and ab", got)
	}
	if q.Total != 2 {
		t.Errorf("q=a total = %d, want 2", q.Total)
	}
	// Counts are the app's WHOLE health story regardless of the filter —
	// they are the header's chips, and a filtered count would make the chips
	// unable to lead anywhere.
	if !maps.Equal(q.Counts, wantCounts) {
		t.Errorf("q=a counts = %v, want the unfiltered %v", q.Counts, wantCounts)
	}

	// 3) limit + cursor: one record a page, in host order, no overlap, and
	//    the cursor ends on the last page.
	cursor := ""
	for i, want := range order {
		page, _ := get(t, "?limit=1&cursor="+url.QueryEscape(cursor))
		if got := hostsOf(page); !slices.Equal(got, []string{want}) {
			t.Fatalf("limit=1 page %d = %v, want %q alone", i+1, got, want)
		}
		if page.Total != 4 {
			t.Errorf("limit=1 page %d total = %d, want 4 (the match count, not the page length)", i+1, page.Total)
		}
		last := i == len(order)-1
		if last && page.NextCursor != "" {
			t.Errorf("next_cursor = %q on the last page, want empty", page.NextCursor)
		}
		if !last && page.NextCursor == "" {
			t.Fatalf("limit=1 page %d has no next_cursor with records left", i+1)
		}
		cursor = page.NextCursor
	}

	// 4) health filters on the computed word — and a record with no route of
	//    its own reads as "Setting up".
	h, _ := get(t, "?health=setting-up")
	if got := hostsOf(h); !slices.Equal(got, []string{"ab.go.tito.io", "b.go.tito.io"}) {
		t.Errorf("health=setting-up = %v, want the two records with no route of their own", got)
	}
	if h.Total != 2 {
		t.Errorf("health=setting-up total = %d, want 2", h.Total)
	}
	running, _ := get(t, "?health=running")
	if got := hostsOf(running); !slices.Equal(got, []string{"run.go.tito.io"}) {
		t.Errorf("health=running = %v, want only the reporting instance", got)
	}
	// A mistyped word is no filter at all (healthFromSlug), never an empty
	// list a caller would read as "you have no instances".
	unknown, _ := get(t, "?health=nonsense")
	if got := hostsOf(unknown); !slices.Equal(got, order) {
		t.Errorf("health=nonsense = %v, want everything — an unknown word is no filter", got)
	}
	stable, _ := get(t, "?channel=stable")
	if got := hostsOf(stable); !slices.Equal(got, order) || stable.Total != len(order) {
		t.Errorf("channel=stable = %v total %d, want all stable records", got, stable.Total)
	}
	missing, _ := get(t, "?channel=retired")
	if got := hostsOf(missing); len(got) != 0 || missing.Total != 0 {
		t.Errorf("channel=retired widened to %v total %d", got, missing.Total)
	}

	// 5) ADDITIVE: the OLD client's shape still parses, and every field a
	//    record already had is byte-identical. The keys the wire gained are
	//    "health", "staged_version" and "gated".
	_, raw := get(t, "")
	var old struct {
		Instances []provision.Record `json:"instances"`
		Truncated bool               `json:"truncated"`
	}
	if err := json.Unmarshal([]byte(raw), &old); err != nil {
		t.Fatalf("old client shape no longer parses %s: %v", raw, err)
	}
	if len(old.Instances) != len(order) || old.Truncated {
		t.Fatalf("old shape = %d records truncated=%v, want %d and false",
			len(old.Instances), old.Truncated, len(order))
	}
	var wire struct {
		Instances []map[string]json.RawMessage `json:"instances"`
	}
	if err := json.Unmarshal([]byte(raw), &wire); err != nil {
		t.Fatal(err)
	}
	for i, rec := range old.Instances {
		b, err := json.Marshal(rec)
		if err != nil {
			t.Fatal(err)
		}
		var want map[string]json.RawMessage
		if err := json.Unmarshal(b, &want); err != nil {
			t.Fatal(err)
		}
		for k, v := range want {
			if !bytes.Equal(wire.Instances[i][k], v) {
				t.Errorf("%s field %q = %s, want the record's own %s",
					rec.Host, k, wire.Instances[i][k], v)
			}
		}
		var extra []string
		for k := range wire.Instances[i] {
			if _, ok := want[k]; !ok {
				extra = append(extra, k)
			}
		}
		sort.Strings(extra)
		// "gated" joined health and staged_version when the gate landed: the
		// hash itself is shadowed out of the wire (recordView), so what a
		// list gains is the one bit a member may know.
		// "settings_default" joined them with the update settings (plan 5):
		// the one bit the CLI needs to tell an instance on a box that ignores
		// settings from one that never asked for any.
		if !slices.Equal(extra, []string{"gated", "health", "settings_default", "staged_version"}) {
			t.Errorf("%s carries extra keys %v, want exactly gated, health, settings_default and staged_version", rec.Host, extra)
		}
	}
}

// TestAPIInstanceCreateCarriesRouteShape (multi-upstream design, issue
// #152): the create door now carries the record's ROUTE SHAPE — kind, the
// upstream set and the probe config — so an app fronting more than one
// process can be provisioned through the same one write every other instance
// is. Policy is unchanged and stays server-side: pool and channel still come
// from the manifest, and the host still has to be one label under the app's
// own domain (a shape field must never become a way to claim a hostname the
// suffix rule refuses).
func TestAPIInstanceCreateCarriesRouteShape(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-shape")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")

	status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"ha.go.tito.io","region":"ie","kind":"service",`+
			`"addrs":["127.0.0.1:7001","127.0.0.1:7002"],"probe":{"path":"/healthz"}}`)
	if status != http.StatusCreated {
		t.Fatalf("create with a route shape = %d %s, want 201", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatalf("create body %s: %v", out, err)
	}
	if rec.Kind != "service" || !slices.Equal(rec.Addrs, []string{"127.0.0.1:7001", "127.0.0.1:7002"}) {
		t.Fatalf("echoed record = %+v, want the requested kind and upstreams in order", rec)
	}
	if rec.Health == nil || rec.Health.Path != "/healthz" {
		t.Fatalf("echoed probe = %+v, want the requested path", rec.Health)
	}
	// Manifest policy still wins over anything the body could say.
	if rec.Pool != "tito" || rec.Channel != "stable" {
		t.Fatalf("record = %+v, want pool and channel from the manifest", rec)
	}

	// The bucket copy is what the reconcile pass mints from, so it — not just
	// the echo — has to carry the shape, under the record's own wire keys.
	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if stored.Kind != "service" || !slices.Equal(stored.Addrs, rec.Addrs) ||
		stored.Health == nil || stored.Health.Path != "/healthz" {
		t.Fatalf("stored record = %+v", stored)
	}
	raw, _, err := fx.rel.Get(context.Background(), provision.RecordKey("bab", "titogo", "ha.go.tito.io"))
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(raw), `"probe":`) {
		t.Fatalf("stored record does not use the probe wire key: %s", raw)
	}

	// A record shape ValidateShape refuses never reaches the bucket, and the
	// refusal is ValidateShape's own sentence — the caller has to know WHICH
	// upstream was wrong.
	for _, c := range []struct{ what, body, want string }{
		{"bad upstream", `{"host":"bad.go.tito.io","region":"ie","kind":"service",` +
			`"addrs":["127.0.0.1:7001","not-an-addr"]}`, "host:port"},
		{"duplicate upstream", `{"host":"dup.go.tito.io","region":"ie","kind":"service",` +
			`"addrs":["127.0.0.1:7001","127.0.0.1:7001"]}`, "duplicate upstream"},
		{"unknown kind", `{"host":"weird.go.tito.io","region":"ie","kind":"daemon"}`, "instance, service or static"},
		{"service with no upstream", `{"host":"svc.go.tito.io","region":"ie","kind":"service"}`, "must name the upstream"},
		{"static with upstreams", `{"host":"site.go.tito.io","region":"ie","kind":"static",` +
			`"addrs":["127.0.0.1:7001"]}`, "proxies to nothing"},
	} {
		status, _, out := rawReq(t, http.MethodPost, u, token, c.body)
		if status != http.StatusBadRequest {
			t.Errorf("%s = %d %s, want 400", c.what, status, out)
			continue
		}
		if !strings.Contains(out, c.want) {
			t.Errorf("%s refusal = %s, want it to name %q", c.what, out, c.want)
		}
	}
	keys, err := fx.rel.List(context.Background(), provision.RecordsPrefix("bab", "titogo"))
	if err != nil {
		t.Fatal(err)
	}
	if len(keys) != 1 {
		t.Fatalf("refused creates left records in the bucket: %v", keys)
	}

	// A record carrying none of the new fields is byte-identical to what the
	// door wrote before they existed — the additivity rule, at the door.
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"plain.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("plain create = %d %s, want 201", status, out)
	}
	plain, _, err := fx.rel.Get(context.Background(), provision.RecordKey("bab", "titogo", "plain.go.tito.io"))
	if err != nil {
		t.Fatal(err)
	}
	for _, k := range []string{`"kind"`, `"addrs"`, `"probe"`} {
		if strings.Contains(string(plain), k) {
			t.Errorf("a shapeless create wrote %s into the record: %s", k, plain)
		}
	}
}

// updateURL is the PATCH door: one instance's mutable route shape.
func updateURL(fx *consoleFixture, acct, app, host string) string {
	return instancesURL(fx, acct, app) + "/" + host
}

// TestAPIInstanceUpdateUpstreams: the PATCH door rewrites a live record's
// upstream set and probe config in place — the whole point of the
// multi-upstream feature being operable from the CLI — and announces the
// write so boxes converge in seconds. The record is rewritten through the
// canonical marshaler (so upstream ORDER, which shapeMismatch compares
// verbatim, lands stable), everything else about the record is left exactly
// as it was, and a body that asks for nothing is refused rather than costing
// a bucket write and a fleet-wide wake.
func TestAPIInstanceUpdateUpstreams(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-patch")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"ha.go.tito.io","region":"ie","kind":"service","addrs":["127.0.0.1:7001"]}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	created, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	afterCreate := serial(t, fx)
	if afterCreate == 0 {
		t.Fatalf("create did not bump the serial")
	}

	pu := updateURL(fx, "bab", "titogo", "ha.go.tito.io")
	status, _, out := rawReq(t, http.MethodPatch, pu, token,
		`{"addrs":["127.0.0.1:7002","127.0.0.1:7001"],"probe":{"path":"/healthz","fail_after":5}}`)
	if status != http.StatusOK {
		t.Fatalf("patch = %d %s, want 200", status, out)
	}
	var echoed provision.Record
	if err := json.Unmarshal([]byte(out), &echoed); err != nil {
		t.Fatalf("patch body %s: %v", out, err)
	}
	if !slices.Equal(echoed.Addrs, []string{"127.0.0.1:7002", "127.0.0.1:7001"}) {
		t.Fatalf("echoed addrs = %v, want the requested pair IN THE REQUESTED ORDER", echoed.Addrs)
	}

	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(stored.Addrs, []string{"127.0.0.1:7002", "127.0.0.1:7001"}) {
		t.Fatalf("stored addrs = %v, want the requested pair in order", stored.Addrs)
	}
	if stored.Health == nil || stored.Health.Path != "/healthz" || stored.Health.FailAfter != 5 {
		t.Fatalf("stored probe = %+v", stored.Health)
	}
	// Identity, provenance and everything policy owns are untouched: this
	// door speaks for two fields and no others.
	if stored.Host != created.Host || stored.App != created.App || stored.Account != created.Account ||
		stored.Slug != created.Slug || stored.Kind != created.Kind || stored.Pool != created.Pool ||
		stored.Region != created.Region || stored.Channel != created.Channel ||
		stored.CreatedBy != created.CreatedBy || !stored.CreatedAt.Equal(created.CreatedAt) {
		t.Fatalf("patch moved a field it does not own:\n got %+v\nwant %+v", stored, created)
	}
	// The record is what a box's reconcile leg reads, so the write is
	// announced exactly as create's is — once.
	if got := serial(t, fx); got != afterCreate+1 {
		t.Fatalf("serial after patch = %d, want exactly one bump past %d", got, afterCreate)
	}

	// addrs alone leaves the probe standing; probe alone leaves the addrs.
	if status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"addrs":["127.0.0.1:7003"]}`); status != http.StatusOK {
		t.Fatalf("patch addrs only = %d %s, want 200", status, out)
	}
	stored, err = provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(stored.Addrs, []string{"127.0.0.1:7003"}) || stored.Health == nil || stored.Health.Path != "/healthz" {
		t.Fatalf("addrs-only patch = %+v, want the probe left standing", stored)
	}
	if status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"probe":{"path":"/up"}}`); status != http.StatusOK {
		t.Fatalf("patch probe only = %d %s, want 200", status, out)
	}
	stored, err = provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(stored.Addrs, []string{"127.0.0.1:7003"}) || stored.Health.Path != "/up" {
		t.Fatalf("probe-only patch = %+v, want the addrs left standing", stored)
	}

	// Explicit null clears the probe — absent and null are different requests
	// on the wire (the apiConfigApply precedent).
	if status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"probe":null}`); status != http.StatusOK {
		t.Fatalf("patch clearing the probe = %d %s, want 200", status, out)
	}
	stored, err = provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if stored.Health != nil {
		t.Fatalf("probe:null did not clear the probe: %+v", stored.Health)
	}

	before := serial(t, fx)
	for _, c := range []struct{ what, body, want string }{
		{"neither field", `{}`, "addrs"},
		{"bad upstream", `{"addrs":["nope"]}`, "host:port"},
		{"duplicate upstream", `{"addrs":["127.0.0.1:7003","127.0.0.1:7003"]}`, "duplicate upstream"},
	} {
		status, _, out := rawReq(t, http.MethodPatch, pu, token, c.body)
		if status != http.StatusBadRequest {
			t.Errorf("patch with %s = %d %s, want 400", c.what, status, out)
			continue
		}
		if !strings.Contains(out, c.want) {
			t.Errorf("patch with %s refused with %s, want it to name %q", c.what, out, c.want)
		}
	}
	// A refused patch wrote nothing and announced nothing.
	unchanged, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(unchanged.Addrs, []string{"127.0.0.1:7003"}) {
		t.Errorf("a refused patch changed the record: %+v", unchanged)
	}
	if got := serial(t, fx); got != before {
		t.Errorf("serial after refused patches = %d, want it unmoved from %d", got, before)
	}

	// A host with no record is the family's byte-identical 404 — a record's
	// existence is not a thing to probe for through this door either — and so
	// is a host that could never name one.
	want := canonicalNotFound(t)
	status, h, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "missing.go.tito.io"),
		token, `{"addrs":["127.0.0.1:7001"]}`)
	assertNotFound(t, "patch of a host with no record", want, status, h, out)
	status, h, out = rawReq(t, http.MethodPatch, instancesURL(fx, "bab", "titogo")+"/..%2f..%2fchannels",
		token, `{"addrs":["127.0.0.1:7001"]}`)
	assertNotFound(t, "patch of a traversal host", want, status, h, out)
}

// TestAPIInstanceUpdateRefusesShapeTransitions: the patch door repoints
// upstreams; it does not convert one KIND of route into another. Both
// directions across provision.Record.DerivesPaths are refused with a 400 that
// names the way through (delete + create), because a box cannot make either
// change in place: the socket-backed route would go on serving its socket
// while the reconcile pass logged the same shape complaint every tick, and the
// upstream-backed one emptied to nothing would become a route that serves
// nothing at all. A 200 for a change that can never take effect is the worst
// of the three answers.
func TestAPIInstanceUpdateRefusesShapeTransitions(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-patch-shape")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	// A socket-backed instance (the ordinary provisioned tenant) and an
	// upstream-backed service, side by side.
	if code, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"sock.go.tito.io","region":"ie"}`); code != http.StatusCreated {
		t.Fatalf("create socket-backed = %d %s", code, out)
	}
	if code, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"svc.go.tito.io","region":"ie","kind":"service","addrs":["127.0.0.1:7001"]}`); code != http.StatusCreated {
		t.Fatalf("create upstream-backed = %d %s", code, out)
	}
	before := serial(t, fx)

	// Socket-backed -> upstream-backed.
	code, _, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "sock.go.tito.io"),
		token, `{"addrs":["127.0.0.1:7001"]}`)
	if code != http.StatusBadRequest {
		t.Fatalf("giving a socket-backed instance upstreams = %d %s, want 400", code, out)
	}
	if !strings.Contains(out, "delete") {
		t.Errorf("refusal = %s, want it to name the way through (delete and create)", out)
	}
	// Upstream-backed -> socket-backed (an emptied set on an instance-kind
	// record; kind "" derives paths again the moment it has no upstream).
	if code, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"back.go.tito.io","region":"ie","addrs":["127.0.0.1:7002"]}`); code != http.StatusCreated {
		t.Fatalf("create instance-kind upstream-backed = %d %s", code, out)
	}
	code, _, out = rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "back.go.tito.io"),
		token, `{"addrs":[]}`)
	if code != http.StatusBadRequest {
		t.Fatalf("emptying an upstream-backed instance's set = %d %s, want 400", code, out)
	}

	// Neither refusal wrote or announced anything.
	sock, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "sock.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if len(sock.Addrs) != 0 {
		t.Errorf("a refused shape transition reached the record: %+v", sock)
	}
	back, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "back.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(back.Addrs, []string{"127.0.0.1:7002"}) {
		t.Errorf("a refused clear reached the record: %+v", back)
	}
	// One create happened in between, so the serial moved exactly once.
	if got := serial(t, fx); got != before+1 {
		t.Errorf("serial = %d, want %d — a refused patch must not announce", got, before+1)
	}

	// The same-shape patch these guards must NOT catch: an upstream-backed
	// route swapping its upstreams stays upstream-backed and still works.
	if code, _, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "svc.go.tito.io"),
		token, `{"addrs":["127.0.0.1:7003","127.0.0.1:7004"]}`); code != http.StatusOK {
		t.Fatalf("same-shape repoint = %d %s, want 200", code, out)
	}
}

// TestAPIInstanceUpdateRefusalMatrix: the NEW verb joins the family's refusal
// discipline — every way of not being allowed to touch this record answers
// with the bytes http.NotFound writes, so a probe cannot learn that an
// account, an app or an instance exists. This is the gate rule this repo has
// paid for; a new route is exactly where it gets forgotten.
func TestAPIInstanceUpdateRefusalMatrix(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-patch-refuse")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", titoManifest())
	if status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"ha.go.tito.io","region":"ie","kind":"service","addrs":["127.0.0.1:7001"]}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	now := time.Now()
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if _, err := fx.st.CreateAppIn(42, "titogo", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	appTok, err := fx.st.NewAppToken(OpsAccountID, "titogo", "alice@keymail.dev", "signup", now)
	if err != nil {
		t.Fatal(err)
	}
	eve := cliToken(t, fx, "eve@keymail.dev", "code-inst-patch-eve")

	body := `{"addrs":["10.0.0.1:9999"]}`
	want := canonicalNotFound(t)
	for _, c := range []struct{ what, url, token string }{
		{"non-member", updateURL(fx, "bab", "titogo", "ha.go.tito.io"), eve},
		{"app token, foreign account", updateURL(fx, "cdef", "titogo", "ha.go.tito.io"), appTok},
		{"app token, foreign app", updateURL(fx, "bab", "other", "ha.go.tito.io"), appTok},
		{"app token, own account by name", updateURL(fx, "ops", "titogo", "ha.go.tito.io"), appTok},
		{"unknown account", updateURL(fx, "zzzz", "titogo", "ha.go.tito.io"), member},
		{"unclaimed app", updateURL(fx, "bab", "ghost-app", "ha.go.tito.io"), member},
	} {
		status, h, out := rawReq(t, http.MethodPatch, c.url, c.token, body)
		assertNotFound(t, "patch as "+c.what, want, status, h, out)
	}
	// No credential at all is the 401 every CLI door gives.
	if status, _, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "ha.go.tito.io"), "", body); status != http.StatusUnauthorized {
		t.Errorf("patch with no token = %d %s, want 401", status, out)
	}
	// Nothing above touched the record.
	rec, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(rec.Addrs, []string{"127.0.0.1:7001"}) {
		t.Fatalf("a refused patch reached the record: %+v", rec)
	}
	// An app token MAY patch its own app's instance. Stating a NEW upstream
	// is an operator's alone (refuseMemberUpstreams), so it patches the probe.
	if status, _, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "ha.go.tito.io"),
		appTok, `{"probe":{"path":"/up"}}`); status != http.StatusOK {
		t.Fatalf("app token patching its own app = %d %s, want 200", status, out)
	}
	// And a console with no deployment bucket answers 503, not a panic.
	fx.srv.cfg.Releases = nil
	if status, _, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "ha.go.tito.io"),
		member, body); status != http.StatusServiceUnavailable {
		t.Errorf("patch with no bucket = %d %s, want 503", status, out)
	}
}

// staleETagStore hands every reader an etag no stored object carries — what a
// concurrent writer looks like from inside one request: the record was read,
// and by the time the write-back went out the bytes had moved on.
type staleETagStore struct{ release.Store }

func (s staleETagStore) Get(ctx context.Context, key string) ([]byte, string, error) {
	body, _, err := s.Store.Get(ctx, key)
	return body, "moved-on", err
}

// TestAPIInstanceUpdateLostRace: the guarded write-back surfaces a lost race
// as a 409 rather than overwriting whatever landed in between. The read and
// the write are one decision — a member sent the upstream set they wanted
// GIVEN the record they saw — so silently re-applying it to a body nobody
// read would be exactly the clobber the etag exists to prevent. Nothing is
// announced: no write landed, so there is no news.
func TestAPIInstanceUpdateLostRace(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-patch-race")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", titoManifest())
	if status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), token,
		`{"host":"ha.go.tito.io","region":"ie","kind":"service","addrs":["127.0.0.1:7001"]}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	before := serial(t, fx)

	fx.srv.cfg.Releases = staleETagStore{fx.rel}
	status, _, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "ha.go.tito.io"),
		token, `{"addrs":["127.0.0.1:7002"]}`)
	if status != http.StatusConflict {
		t.Fatalf("patch losing the race = %d %s, want 409", status, out)
	}
	fx.srv.cfg.Releases = fx.rel
	rec, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "ha.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(rec.Addrs, []string{"127.0.0.1:7001"}) {
		t.Fatalf("the lost race still overwrote the record: %+v", rec)
	}
	if got := serial(t, fx); got != before {
		t.Fatalf("serial after a failed write = %d, want it unmoved from %d", got, before)
	}
}

// sharedPoolManifest is titoManifest with Pool cleared — the shared-pool
// shape steering requires (v1's pool guardrail), so a test needing a record
// that MAY steer starts here rather than mutating titoManifest in place.
func sharedPoolManifest() provision.Manifest {
	m := titoManifest()
	m.Pool = ""
	return m
}

// TestAPIInstanceUpdateSteeringRoundTrip: the PATCH door's third PATCHable
// field (Task 3) — a shared-pool record may opt into "latency" and back out
// to "", each write bumping the serial exactly once, and neither write
// disturbs the addrs/probe fields this same door already owns.
func TestAPIInstanceUpdateSteeringRoundTrip(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-steer-round")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", sharedPoolManifest())
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"steer.go.tito.io","region":"ie","addrs":["127.0.0.1:7001"]}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	afterCreate := serial(t, fx)

	pu := updateURL(fx, "bab", "titogo", "steer.go.tito.io")
	status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"steering":"latency"}`)
	if status != http.StatusOK {
		t.Fatalf("patch steering on = %d %s, want 200", status, out)
	}
	var echoed provision.Record
	if err := json.Unmarshal([]byte(out), &echoed); err != nil {
		t.Fatalf("patch body %s: %v", out, err)
	}
	if echoed.Steering != "latency" {
		t.Fatalf("echoed steering = %q, want latency", echoed.Steering)
	}
	if !slices.Equal(echoed.Addrs, []string{"127.0.0.1:7001"}) {
		t.Fatalf("steering-only patch moved addrs: %v", echoed.Addrs)
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "steer.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if stored.Steering != "latency" {
		t.Fatalf("stored steering = %q, want latency", stored.Steering)
	}
	if got := serial(t, fx); got != afterCreate+1 {
		t.Fatalf("serial after patch on = %d, want exactly one bump past %d", got, afterCreate)
	}
	afterOn := serial(t, fx)

	status, _, out = rawReq(t, http.MethodPatch, pu, token, `{"steering":""}`)
	if status != http.StatusOK {
		t.Fatalf("patch steering off = %d %s, want 200", status, out)
	}
	stored, err = provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "steer.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if stored.Steering != "" {
		t.Fatalf("stored steering after clearing = %q, want empty", stored.Steering)
	}
	if !slices.Equal(stored.Addrs, []string{"127.0.0.1:7001"}) {
		t.Fatalf("steering-only patch moved addrs: %v", stored.Addrs)
	}
	if got := serial(t, fx); got != afterOn+1 {
		t.Fatalf("serial after patch off = %d, want exactly one bump past %d", got, afterOn)
	}

	// A body naming neither addrs, probe nor steering is still refused — the
	// third field joins the existing "nothing to update" rail rather than
	// making it optional.
	before := serial(t, fx)
	status, _, out = rawReq(t, http.MethodPatch, pu, token, `{}`)
	if status != http.StatusBadRequest {
		t.Fatalf("patch with neither field = %d %s, want 400", status, out)
	}
	if !strings.Contains(out, "steering") {
		t.Errorf("empty-body refusal = %s, want it to name steering among the patchable fields", out)
	}
	if got := serial(t, fx); got != before {
		t.Errorf("serial after a refused empty patch = %d, want it unmoved from %d", got, before)
	}
}

// lastEventDetail returns the most recent instance-update audit row's
// Detail — the field this test cares about — or fails the test if none
// exists. Events is newest-first (the activity tab's own assumption, and
// every other audit test in this file's).
func lastEventDetail(t *testing.T, fx *consoleFixture, app string) string {
	t.Helper()
	events, err := fx.st.Events(OpsAccountID, app, 20)
	if err != nil {
		t.Fatal(err)
	}
	for _, e := range events {
		if e.Action == "instance-update" {
			return e.Detail
		}
	}
	t.Fatalf("events = %v, want an instance-update row", events)
	return ""
}

// TestAPIInstanceUpdateAuditNamesChangedFields: review finding (Task 3
// follow-up) — a field-agnostic "updated instance <host> (cli)" audit line
// collapses three distinct member-facing changes (addrs/probe/steering)
// into one indistinguishable string on a security surface: "did anyone turn
// on steering for this host last week?" must stay answerable from the audit
// log alone. The detail names exactly the fields THIS request carried, built
// from the same req.* nil checks the mutation itself uses, so it can never
// claim a change the request didn't make (or omit one it did).
func TestAPIInstanceUpdateAuditNamesChangedFields(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-audit-fields")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", sharedPoolManifest())
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"audit.go.tito.io","region":"ie","addrs":["127.0.0.1:7001"]}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	pu := updateURL(fx, "bab", "titogo", "audit.go.tito.io")

	// Single-field case: a steering-only patch names ONLY steering — not
	// "upstreams", not addrs, not probe.
	if status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"steering":"latency"}`); status != http.StatusOK {
		t.Fatalf("patch steering = %d %s, want 200", status, out)
	}
	if detail := lastEventDetail(t, fx, "titogo"); detail != "updated instance audit.go.tito.io (steering) (cli)" {
		t.Fatalf("audit detail = %q, want it to name exactly steering", detail)
	}

	// Multi-field case: a patch touching addrs AND steering together names
	// both, in the order the request struct declares them (addrs, probe,
	// steering, environment, gate) — not just one of the two, and not a
	// generic "updated".
	if status, _, out := rawReq(t, http.MethodPatch, pu, token,
		`{"addrs":["127.0.0.1:7002"],"steering":""}`); status != http.StatusOK {
		t.Fatalf("patch addrs+steering = %d %s, want 200", status, out)
	}
	if detail := lastEventDetail(t, fx, "titogo"); detail != "updated instance audit.go.tito.io (addrs, steering) (cli)" {
		t.Fatalf("audit detail = %q, want it to name both addrs and steering", detail)
	}

	// environment-only case: an environment patch names ONLY environment —
	// the mutation applies req.Environment, so the audit line must too.
	if status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"environment":"demo"}`); status != http.StatusOK {
		t.Fatalf("patch environment = %d %s, want 200", status, out)
	}
	if detail := lastEventDetail(t, fx, "titogo"); detail != "updated instance audit.go.tito.io (environment) (cli)" {
		t.Fatalf("audit detail = %q, want it to name exactly environment", detail)
	}

	// Combined case: steering, environment and gate together name all
	// three, in request-struct order.
	if status, _, out := rawReq(t, http.MethodPatch, pu, token,
		`{"steering":"","environment":"","gate":""}`); status != http.StatusOK {
		t.Fatalf("patch steering+environment+gate = %d %s, want 200", status, out)
	}
	if detail := lastEventDetail(t, fx, "titogo"); detail != "updated instance audit.go.tito.io (steering, environment, gate) (cli)" {
		t.Fatalf("audit detail = %q, want it to name steering, environment and gate", detail)
	}
}

// TestAPIInstanceUpdateSteeringInvalidValue: the door's own vocabulary rail
// (provision.ValidateShape -> ValidSteering), surfaced as a 400 with the
// door's own sentence — a caller sending anything but "" or "latency" is
// told exactly that, and nothing is written or announced.
func TestAPIInstanceUpdateSteeringInvalidValue(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-steer-invalid")
	enableInstances(t, fx, "titogo", sharedPoolManifest())
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"badsteer.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	before := serial(t, fx)

	status, _, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "badsteer.go.tito.io"),
		token, `{"steering":"geo"}`)
	if status != http.StatusBadRequest {
		t.Fatalf("patch with invalid steering = %d %s, want 400", status, out)
	}
	var errBody struct {
		Error string `json:"error"`
	}
	if err := json.Unmarshal([]byte(out), &errBody); err != nil {
		t.Fatalf("refusal body %s: %v", out, err)
	}
	if want := `steering "geo": want "" or "latency"`; errBody.Error != want {
		t.Errorf("refusal = %q, want ValidateShape's own sentence %q", errBody.Error, want)
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "badsteer.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if stored.Steering != "" {
		t.Fatalf("a refused patch reached the record: steering = %q", stored.Steering)
	}
	if got := serial(t, fx); got != before {
		t.Fatalf("serial after a refused patch = %d, want it unmoved from %d", got, before)
	}
}

// TestAPIInstanceUpdateSteeringPoolConflict: v1's pool guardrail (plan-2
// ledger) — a route whose Pool != "" cannot opt into latency steering,
// because the latency records would point at edges that structurally
// cannot serve a pool-scoped route. The refusal is a 409 naming the v1
// constraint verbatim, not a 400: the request is well-formed, the record
// merely cannot honour it TODAY.
//
// The self-review point this test is built to settle: the rail reads the
// STORED RECORD's Pool — the field the door itself stamped at create and
// the only copy this handler ever reads — not the app's manifest, which a
// later `instances enable` may have since repointed to a different pool.
// The second half of this test proves that: the record keeps the pool it
// was created with even after the manifest changes underneath it, and the
// 409 keeps firing on that account.
func TestAPIInstanceUpdateSteeringPoolConflict(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-steer-pool")
	enableInstances(t, fx, "titogo", titoManifest()) // Pool: "tito"
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"pooled.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	created, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "pooled.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if created.Pool != "tito" {
		t.Fatalf("created record pool = %q, want tito (test setup)", created.Pool)
	}
	before := serial(t, fx)

	pu := updateURL(fx, "bab", "titogo", "pooled.go.tito.io")
	status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"steering":"latency"}`)
	if status != http.StatusConflict {
		t.Fatalf("patch steering on a pooled route = %d %s, want 409", status, out)
	}
	const wantMsg = "steering requires the shared pool — pool-scoped steering is a recorded future"
	if out != `{"error":"`+wantMsg+`"}`+"\n" && !strings.Contains(out, wantMsg) {
		t.Errorf("refusal = %s, want the v1 constraint named verbatim: %q", out, wantMsg)
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "pooled.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if stored.Steering != "" {
		t.Fatalf("a refused patch reached the record: steering = %q", stored.Steering)
	}
	if got := serial(t, fx); got != before {
		t.Fatalf("serial after a refused patch = %d, want it unmoved from %d", got, before)
	}

	// Clearing steering (turning it off) is never blocked by the pool rail —
	// only an attempt to TURN latency ON is.
	if status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"steering":""}`); status != http.StatusOK {
		t.Fatalf("patch steering off on a pooled route = %d %s, want 200", status, out)
	}

	// The manifest changes to the shared pool AFTER the record was created —
	// the record itself is immutable on this axis (Pool is stamped at
	// create and this door never touches it), so the rail must keep reading
	// the record it fetched, not re-derive the pool from the manifest that
	// happens to be live right now.
	enableInstances(t, fx, "titogo", sharedPoolManifest())
	status, _, out = rawReq(t, http.MethodPatch, pu, token, `{"steering":"latency"}`)
	if status != http.StatusConflict {
		t.Fatalf("patch steering after the MANIFEST moved to the shared pool = %d %s, want 409 still "+
			"(the RECORD's own pool, stamped at create, is what the rail reads)", status, out)
	}
}

// TestAPIInstanceUpdateSteeringLostRace: the steering field goes through
// the exact same CAS write-back as addrs/probe — a concurrent writer means
// the decision to steer was made about bytes that no longer exist, and the
// honest answer is 409, not a silent clobber.
func TestAPIInstanceUpdateSteeringLostRace(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-steer-race")
	enableInstances(t, fx, "titogo", sharedPoolManifest())
	if status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), token,
		`{"host":"steerrace.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	before := serial(t, fx)

	fx.srv.cfg.Releases = staleETagStore{fx.rel}
	status, _, out := rawReq(t, http.MethodPatch, updateURL(fx, "bab", "titogo", "steerrace.go.tito.io"),
		token, `{"steering":"latency"}`)
	if status != http.StatusConflict {
		t.Fatalf("patch steering losing the race = %d %s, want 409", status, out)
	}
	fx.srv.cfg.Releases = fx.rel
	rec, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "steerrace.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if rec.Steering != "" {
		t.Fatalf("the lost race still overwrote the record: steering = %q", rec.Steering)
	}
	if got := serial(t, fx); got != before {
		t.Fatalf("serial after a failed write = %d, want it unmoved from %d", got, before)
	}
}

// TestAPIInstanceListJoinsUpstreams: the list's third join (beside
// staged_version and health) — per-upstream probe state, read from the box
// snapshots the same way and with the same staleness rule, so `carlos
// instances` can say WHICH upstream is down without a box session. Additive:
// the key is absent entirely for a record no box is probing, which is every
// single-upstream record in production today.
func TestAPIInstanceListJoinsUpstreams(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-upstreams")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	for _, h := range []string{"ha.go.tito.io", "plain.go.tito.io", "stale.go.tito.io"} {
		if code, _, out := rawReq(t, http.MethodPost, u, token,
			fmt.Sprintf(`{"host":%q,"region":"ie"}`, h)); code != http.StatusCreated {
			t.Fatalf("create %s = %d %s", h, code, out)
		}
	}
	since := time.Now().UTC().Add(-2 * time.Minute).Truncate(time.Second)
	fresh := status.CollectBox(nil, status.Probes{MachineID: "box1"}, time.Now())
	fresh.Metrics = &status.BoxMetrics{Upstreams: map[string][]status.UpstreamState{
		"ha.go.tito.io": {
			{Addr: "127.0.0.1:7001", Up: true, Since: since},
			{Addr: "127.0.0.1:7002", Up: false, Since: since, Fails: 3, LastError: "dial refused"},
		},
	}}
	if err := status.WriteBox(context.Background(), fx.rel, fresh); err != nil {
		t.Fatal(err)
	}
	stale := status.CollectBox(nil, status.Probes{MachineID: "box2"}, time.Now().Add(-time.Hour))
	stale.Metrics = &status.BoxMetrics{Upstreams: map[string][]status.UpstreamState{
		"stale.go.tito.io": {{Addr: "127.0.0.1:7009", Up: true, Since: since}},
	}}
	if err := status.WriteBox(context.Background(), fx.rel, stale); err != nil {
		t.Fatal(err)
	}

	code, _, out := rawReq(t, http.MethodGet, u, token, "")
	if code != http.StatusOK {
		t.Fatalf("list = %d %s, want 200", code, out)
	}
	var list struct {
		Instances []struct {
			Host      string                 `json:"host"`
			Upstreams []status.UpstreamState `json:"upstreams"`
		} `json:"instances"`
	}
	if err := json.Unmarshal([]byte(out), &list); err != nil {
		t.Fatalf("list body %s: %v", out, err)
	}
	got := map[string][]status.UpstreamState{}
	for _, r := range list.Instances {
		got[r.Host] = r.Upstreams
	}
	ha := got["ha.go.tito.io"]
	if len(ha) != 2 {
		t.Fatalf("ha upstreams = %+v, want both probed addrs", ha)
	}
	if ha[0].Addr != "127.0.0.1:7001" || !ha[0].Up {
		t.Errorf("first upstream = %+v, want 7001 up", ha[0])
	}
	if ha[1].Addr != "127.0.0.1:7002" || ha[1].Up || ha[1].Fails != 3 || ha[1].LastError != "dial refused" {
		t.Errorf("second upstream = %+v, want 7002 down with its fail count and reason", ha[1])
	}
	if len(got["plain.go.tito.io"]) != 0 {
		t.Errorf("an unprobed record carries upstreams: %+v", got["plain.go.tito.io"])
	}
	// A box that stopped reporting drops OUT of the join rather than serving
	// its last-known belief as current — status.BoxStale, the same rule
	// staged_version votes with.
	if len(got["stale.go.tito.io"]) != 0 {
		t.Errorf("a stale box's probe table was joined: %+v", got["stale.go.tito.io"])
	}
	// Absent, never present-and-empty: a client that never heard of this key
	// parses the record exactly as it always did.
	var wire struct {
		Instances []map[string]json.RawMessage `json:"instances"`
	}
	if err := json.Unmarshal([]byte(out), &wire); err != nil {
		t.Fatal(err)
	}
	for i, r := range list.Instances {
		_, present := wire.Instances[i]["upstreams"]
		if present != (r.Host == "ha.go.tito.io") {
			t.Errorf("%s upstreams key present = %v, want it only on the probed record", r.Host, present)
		}
	}
}

// TestAPIInstanceDelete: deletion is idempotent (the caller's goal is "not
// there"), survives the manifest being retired, and still refuses a host
// that isn't one.
func TestAPIInstanceDelete(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-delete")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"acme.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}

	// A hostile host is refused before the key builder, and deletes nothing.
	if status, _, out := rawReq(t, http.MethodDelete, u+"/..%2f..%2finstances.json", token, ""); status != http.StatusBadRequest {
		t.Fatalf("delete of a traversal host = %d %s, want 400", status, out)
	}
	if _, _, err := fx.rel.Get(context.Background(), provision.ManifestKey("bab", "titogo")); err != nil {
		t.Fatalf("the manifest was destroyed by a traversal delete: %v", err)
	}

	req, err := http.NewRequest(http.MethodDelete, u+"/acme.go.tito.io", nil)
	if err != nil {
		t.Fatal(err)
	}
	req.Header.Set("Authorization", "Bearer "+token)
	req.Header.Set(activityMessageHeader, "retire the old web copy")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	outBytes, err := io.ReadAll(res.Body)
	res.Body.Close()
	if err != nil {
		t.Fatal(err)
	}
	status, out := res.StatusCode, string(outBytes)
	if status != http.StatusOK || !strings.Contains(out, "deleted") {
		t.Fatalf("delete = %d %s, want 200 deleted", status, out)
	}
	events, err := fx.st.Events(OpsAccountID, "titogo", 1)
	if err != nil || len(events) != 1 || events[0].Message != "retire the old web copy" {
		t.Fatalf("delete activity = %+v, %v", events, err)
	}
	if _, _, err := fx.rel.Get(context.Background(),
		provision.RecordKey("bab", "titogo", "acme.go.tito.io")); err == nil {
		t.Fatalf("the record survived its delete")
	}
	// Again: still 200. "Already gone" is the goal, reached.
	if status, _, out := rawReq(t, http.MethodDelete, u+"/acme.go.tito.io", token, ""); status != http.StatusOK {
		t.Fatalf("second delete = %d %s, want an idempotent 200", status, out)
	}

	// Deletion outlives the manifest: an app that retired instances must
	// still be able to clean up the records it left behind.
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"beta.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	if err := fx.rel.Delete(context.Background(), provision.ManifestKey("bab", "titogo")); err != nil {
		t.Fatal(err)
	}
	if status, _, out := rawReq(t, http.MethodDelete, u+"/beta.go.tito.io", token, ""); status != http.StatusOK {
		t.Fatalf("delete with the manifest retired = %d %s, want 200", status, out)
	}
	// And the shape check still applies with no domain to check against.
	if status, _, out := rawReq(t, http.MethodDelete, u+"/..%2f..%2fchannels", token, ""); status != http.StatusBadRequest {
		t.Fatalf("traversal delete with no manifest = %d %s, want 400", status, out)
	}
}

// TestAPIInstanceDeleteAfterDomainChange: the suffix check is CREATE-time
// policy — "which hosts may this app claim" — and deletion must outlive it.
// An app that moves domains still has records under the old one, and they
// are exactly the records that must be deletable: refusing them would strand
// provisioned routes with nothing left that can retire them. Delete
// validates SHAPE only, always, which is the whole traversal defence it
// needs.
func TestAPIInstanceDeleteAfterDomainChange(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-redomain")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"acme.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}

	// The app moves to a new domain: new instances land under it, and the
	// old host is now a host this manifest would never have allowed.
	moved := titoManifest()
	moved.Domain = "go.tito.dev"
	enableInstances(t, fx, "titogo", moved)
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"acme.go.tito.io","region":"ie"}`); status != http.StatusBadRequest {
		t.Fatalf("create under the OLD domain = %d %s, want 400 — the suffix rule still governs creates", status, out)
	}

	if status, _, out := rawReq(t, http.MethodDelete, u+"/acme.go.tito.io", token, ""); status != http.StatusOK {
		t.Fatalf("delete of a record created under the old domain = %d %s, want 200", status, out)
	}
	if _, _, err := fx.rel.Get(context.Background(),
		provision.RecordKey("bab", "titogo", "acme.go.tito.io")); err == nil {
		t.Fatalf("the record survived its delete")
	}
	// Shape is still the door: a traversal host is refused whatever the
	// manifest says.
	if status, _, out := rawReq(t, http.MethodDelete, u+"/..%2f..%2finstances.json", token, ""); status != http.StatusBadRequest {
		t.Fatalf("traversal delete after a domain change = %d %s, want 400", status, out)
	}
	if _, _, err := fx.rel.Get(context.Background(), provision.ManifestKey("bab", "titogo")); err != nil {
		t.Fatalf("the manifest was destroyed by a traversal delete: %v", err)
	}
}

// TestAPIInstanceTokenMintEndToEnd is the whole app-token story: a member
// mints one, the raw token is shown exactly once, and it then provisions on
// its own — and every mutation left an audit row naming its principal.
func TestAPIInstanceTokenMintEndToEnd(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-mint")
	enableInstances(t, fx, "titogo", titoManifest())

	status, _, out := rawReq(t, http.MethodPost, fx.ts.URL+"/api/cli/apps/bab/titogo/instance-token",
		token, `{"label":"tito signup"}`)
	if status != http.StatusCreated {
		t.Fatalf("mint = %d %s, want 201", status, out)
	}
	var minted struct {
		Token   string `json:"token"`
		Account string `json:"account"`
		App     string `json:"app"`
	}
	if err := json.Unmarshal([]byte(out), &minted); err != nil {
		t.Fatalf("mint body %s: %v", out, err)
	}
	if minted.Token == "" || minted.Account != "bab" || minted.App != "titogo" {
		t.Fatalf("mint = %+v, want a token bound to bab/titogo", minted)
	}

	// The minted token provisions, and nothing else.
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, minted.Token,
		`{"host":"acme.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("create with the minted token = %d %s, want 201", status, out)
	}
	if status, _, out := rawReq(t, http.MethodDelete, u+"/acme.go.tito.io", minted.Token, ""); status != http.StatusOK {
		t.Fatalf("delete with the minted token = %d %s, want 200", status, out)
	}

	// The audit trail: three actions, each suffixed " (cli)", the create and
	// the delete attributed to the APP principal and the mint to the human.
	events, err := fx.st.Events(OpsAccountID, "titogo", 50)
	if err != nil {
		t.Fatal(err)
	}
	seen := map[string]string{}
	for _, e := range events {
		seen[e.Action] = e.Address
		if !strings.HasSuffix(e.Detail, " (cli)") {
			t.Errorf("audit %s detail = %q, want the family's \" (cli)\" suffix", e.Action, e.Detail)
		}
	}
	if seen["instance-token"] != "alice@keymail.dev" {
		t.Errorf("instance-token actor = %q, want the minting member", seen["instance-token"])
	}
	if seen["instance-create"] != "app:bab/titogo" {
		t.Errorf("instance-create actor = %q, want app:bab/titogo", seen["instance-create"])
	}
	if seen["instance-delete"] != "app:bab/titogo" {
		t.Errorf("instance-delete actor = %q, want app:bab/titogo", seen["instance-delete"])
	}

	// The minted credential lists under the human who minted it — which is
	// what makes revoking it possible at all.
	toks, err := fx.st.CLITokens("alice@keymail.dev")
	if err != nil {
		t.Fatal(err)
	}
	found := false
	for _, tk := range toks {
		if tk.Kind == "app" {
			found = true
			if tk.App != "titogo" {
				t.Errorf("app token row = %+v, want it bound to titogo", tk)
			}
		}
	}
	if !found {
		t.Fatalf("the minted app token does not list under its minter: %+v", toks)
	}
}

// TestAPIInstanceRateLimit: the instance budget is its own, keyed by token,
// and — the property that matters — it is consulted only AFTER the
// principal gate, so a 429 can never confirm what the 404 hides.
func TestAPIInstanceRateLimit(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-ratelimit")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")

	for i := 0; i < cliInstanceBurst; i++ {
		body := fmt.Sprintf(`{"host":"host%d.go.tito.io","region":"ie"}`, i)
		if status, _, out := rawReq(t, http.MethodPost, u, token, body); status != http.StatusCreated {
			t.Fatalf("create %d = %d %s, want 201 inside the budget", i, status, out)
		}
	}
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"over.go.tito.io","region":"ie"}`); status != http.StatusTooManyRequests {
		t.Fatalf("create past the budget = %d %s, want 429", status, out)
	}
	// A stranger's refusal never changes shape, however many times they
	// ask. This is the gate-before-budget ordering asserted from outside:
	// past the burst, a limiter consulted FIRST would start answering 429
	// where the 404 belongs — a different answer on the same door, which is
	// a difference a prober can measure and a refusal that has stopped
	// being byte-identical to every other refusal here.
	eve := cliToken(t, fx, "eve@keymail.dev", "code-inst-rl-eve")
	want := canonicalNotFound(t)
	for i := 0; i < cliInstanceBurst+2; i++ {
		status, h, out := rawReq(t, http.MethodPost, u, eve, `{"host":"x.go.tito.io","region":"ie"}`)
		assertNotFound(t, fmt.Sprintf("non-member probe %d", i), want, status, h, out)
		if t.Failed() {
			break
		}
	}
	// The write budget minting uses is a different one: the member above
	// spent the instance budget, not this.
	if status, _, out := rawReq(t, http.MethodPost, fx.ts.URL+"/api/cli/apps/bab/titogo/instance-token",
		token, `{}`); status != http.StatusCreated {
		t.Fatalf("mint after spending the instance budget = %d %s, want 201", status, out)
	}
}

// TestAPIInstanceNoStore: a console running without a deployment bucket
// answers 503 — the shape promote's key check has — rather than panicking
// on a nil store.
func TestAPIInstanceNoStore(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-nostore")
	fx.srv.cfg.Releases = nil
	u := instancesURL(fx, "bab", "titogo")
	for _, c := range []struct{ what, method, url, body string }{
		{"list", http.MethodGet, u, ""},
		{"create", http.MethodPost, u, `{"host":"acme.go.tito.io","region":"ie"}`},
		{"get", http.MethodGet, u + "/acme.go.tito.io", ""},
		{"delete", http.MethodDelete, u + "/acme.go.tito.io", ""},
	} {
		if status, _, out := rawReq(t, c.method, c.url, token, c.body); status != http.StatusServiceUnavailable {
			t.Errorf("%s with no bucket = %d %s, want 503", c.what, status, out)
		}
	}
}

// unreadableStore is a bucket whose reads fail — distinct from a MISSING
// manifest, which is an answer ("instances are not enabled") rather than a
// failure. Conflating the two would tell an app its feature was switched
// off every time the bucket hiccuped.
type unreadableStore struct{ release.Store }

func (u unreadableStore) Get(context.Context, string) ([]byte, string, error) {
	return nil, "", errors.New(brokenStoreErr)
}

// undeletableStore is a bucket whose object deletes fail. Delete's own store
// call is the only one it makes — it reads no manifest (the suffix rule is
// create-time policy) — so this is what a broken bucket looks like from
// there.
type undeletableStore struct{ release.Store }

func (u undeletableStore) Delete(context.Context, string) error {
	return errors.New(brokenStoreErr)
}

// DeleteIfMatch fails the same way: the delete door deletes a record
// conditionally on the etag its import check read (final review F7).
func (u undeletableStore) DeleteIfMatch(context.Context, string, string) error {
	return errors.New(brokenStoreErr)
}

// TestAPIInstanceStoreFailure: a bucket that cannot be read or written is a
// 502, and its error text — bucket names, request ids — never reaches the
// caller. A read failure is NOT reported as "instances are not enabled".
func TestAPIInstanceStoreFailure(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-broken")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")

	fx.srv.cfg.Releases = brokenStore{fx.rel}
	status, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"ie"}`)
	if status != http.StatusBadGateway {
		t.Fatalf("create against an unwritable bucket = %d %s, want 502", status, out)
	}
	if strings.Contains(out, "carlos-prod-secret-bucket") || strings.Contains(out, "ABC123") {
		t.Fatalf("refusal leaks the store's error text: %s", out)
	}

	fx.srv.cfg.Releases = unreadableStore{fx.rel}
	status, _, out = rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"ie"}`)
	if status != http.StatusBadGateway {
		t.Fatalf("create against an unreadable bucket = %d %s, want 502", status, out)
	}
	if strings.Contains(out, "instances enable") {
		t.Fatalf("a read failure was reported as the feature being disabled: %s", out)
	}
	// The record must exist for a delete to be attempted: a host with no
	// record is the delete's idempotent 200 with nothing deleted (final
	// review F7).
	fx.srv.cfg.Releases = fx.rel
	if status, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	fx.srv.cfg.Releases = undeletableStore{fx.rel}
	status, _, out = rawReq(t, http.MethodDelete, u+"/acme.go.tito.io", token, "")
	if status != http.StatusBadGateway {
		t.Fatalf("delete against a bucket that cannot delete = %d %s, want 502", status, out)
	}
	if strings.Contains(out, "carlos-prod-secret-bucket") {
		t.Fatalf("delete refusal leaks the store's error text: %s", out)
	}
}

// TestAPIInstanceCreateStaticAtOwnApex pins the shape `carlos deploy -kind
// static` mints for an app with no route: a kind:static record at the app's
// OWN platform apex, carrying an explicit channel.
//
// The channel is the half worth a test of its own. An omitted channel is
// defaulted to the manifest's, then to "stable" — and a fresh app's pipeline
// entry is "edge", so a mint that let the default stand would write a route
// that follows a channel nothing ever promotes to, with no door able to
// change it afterwards (the hello.bdn incident, 2026-08-22).
func TestAPIInstanceCreateStaticAtOwnApex(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-static-apex")
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	if status, _, out := rawReq(t, http.MethodPut, enableURL(fx, "bab", "titogo"), member, `{}`); status != http.StatusOK {
		t.Fatalf("enable = %d %s", status, out)
	}
	host := "titogo." + fx.sqid + ".oncarlos.test"

	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","kind":"static","channel":"edge"}`)
	if status != http.StatusCreated {
		t.Fatalf("static apex create = %d %s, want 201", status, out)
	}
	var rec provision.Record
	if err := json.Unmarshal([]byte(out), &rec); err != nil {
		t.Fatalf("create body %s: %v", out, err)
	}
	if rec.Kind != "static" {
		t.Fatalf("echoed Kind = %q, want static", rec.Kind)
	}
	if rec.Channel != "edge" {
		t.Fatalf("echoed Channel = %q, want the requested edge — an omitted channel falls to stable", rec.Channel)
	}

	// The bucket copy is what the reconcile pass mints the route from, so it
	// is the one that has to carry both.
	stored, err := provision.GetRecord(context.Background(), fx.rel, fx.sqid, "titogo", host)
	if err != nil {
		t.Fatal(err)
	}
	if stored.Kind != "static" || stored.Channel != "edge" {
		t.Fatalf("stored record = %+v, want kind static on channel edge", stored)
	}
	// A static record with no upstream and no unit is the shape ValidateShape
	// requires; anything the door let through that carried one would wedge
	// the host.
	if len(stored.Addrs) != 0 || stored.Unit != "" {
		t.Fatalf("stored record = %+v, want no upstream and no unit", stored)
	}
}

// TestAPIInstanceListServedBy (issue #337): each instance carries where it
// is OBSERVED to be served — every box whose control/edges/<box>.json names
// the host, with that box's AWS region — as an additive `served_by` list on
// both the list and the get. The record's own `region` (the REQUESTED
// placement code) is untouched. A host no edges file names carries no key
// at all; a garbage or unversioned object under the prefix is skipped, never
// fatal; an everywhere-class host named by two boxes lists both, box-sorted.
func TestAPIInstanceListServedBy(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-served")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	for _, h := range []string{"acme.go.tito.io", "beta.go.tito.io", "gamma.go.tito.io"} {
		if code, _, out := rawReq(t, http.MethodPost, u, token,
			fmt.Sprintf(`{"host":%q,"region":"ie"}`, h)); code != http.StatusCreated {
			t.Fatalf("create %s = %d %s", h, code, out)
		}
	}
	type served struct {
		Box    string `json:"box"`
		Region string `json:"region"`
	}
	type row struct {
		Host     string          `json:"host"`
		Region   string          `json:"region"`
		ServedBy json.RawMessage `json:"served_by"`
	}
	decodeList := func(out string) map[string]row {
		var list struct {
			Instances []row `json:"instances"`
		}
		if err := json.Unmarshal([]byte(out), &list); err != nil {
			t.Fatalf("list body %s: %v", out, err)
		}
		got := map[string]row{}
		for _, r := range list.Instances {
			got[r.Host] = r
		}
		return got
	}

	// No edges file at all: the list serves, no record carries the key.
	code, _, out := rawReq(t, http.MethodGet, u, token, "")
	if code != http.StatusOK {
		t.Fatalf("list with no edges files = %d %s, want 200", code, out)
	}
	for h, r := range decodeList(out) {
		if r.ServedBy != nil {
			t.Errorf("%s served_by = %s before any edges file, want the key absent", h, r.ServedBy)
		}
	}

	put := func(key, body string) {
		t.Helper()
		if _, err := fx.rel.Put(context.Background(), key, []byte(body), ""); err != nil {
			t.Fatal(err)
		}
	}
	put("control/edges/zed-box.json", `{"v":1,"box":"zed-box","eip":"1.2.3.4","region":"eu-west-2","generation":"g","hosts":{"acme.go.tito.io":{"role":"home"}}}`)
	put("control/edges/annie.json", `{"v":1,"box":"annie","eip":"5.6.7.8","region":"eu-west-1","generation":"g","hosts":{"acme.go.tito.io":{"role":"home"},"gamma.go.tito.io":{"role":"home"}}}`)
	put("control/edges/broken.json", `{not json`)
	put("control/edges/old.json", `{"box":"old","hosts":{"beta.go.tito.io":{"role":"home"}}}`)
	put("control/edges/nested/x.json", `{"v":1,"box":"nested","hosts":{"beta.go.tito.io":{"role":"home"}}}`)

	code, _, out = rawReq(t, http.MethodGet, u, token, "")
	if code != http.StatusOK {
		t.Fatalf("list with seeded edges files = %d %s, want 200", code, out)
	}
	got := decodeList(out)
	want := map[string][]served{
		"acme.go.tito.io":  {{"annie", "eu-west-1"}, {"zed-box", "eu-west-2"}},
		"gamma.go.tito.io": {{"annie", "eu-west-1"}},
	}
	for h, w := range want {
		var s []served
		if err := json.Unmarshal(got[h].ServedBy, &s); err != nil {
			t.Fatalf("%s served_by %s: %v", h, got[h].ServedBy, err)
		}
		if fmt.Sprint(s) != fmt.Sprint(w) {
			t.Errorf("%s served_by = %v, want %v", h, s, w)
		}
		if got[h].Region != "ie" {
			t.Errorf("%s region = %q, want the requested placement code ie untouched", h, got[h].Region)
		}
	}
	if got["beta.go.tito.io"].ServedBy != nil {
		t.Errorf("beta served_by = %s, want absent — only an unversioned and a mis-keyed file name it", got["beta.go.tito.io"].ServedBy)
	}

	// The single-record get carries the same join.
	code, _, out = rawReq(t, http.MethodGet, u+"/acme.go.tito.io", token, "")
	if code != http.StatusOK {
		t.Fatalf("get = %d %s", code, out)
	}
	var one row
	if err := json.Unmarshal([]byte(out), &one); err != nil {
		t.Fatalf("get body %s: %v", out, err)
	}
	var s []served
	if err := json.Unmarshal(one.ServedBy, &s); err != nil || fmt.Sprint(s) != fmt.Sprint(want["acme.go.tito.io"]) {
		t.Errorf("get served_by = %s (%v), want %v", one.ServedBy, err, want["acme.go.tito.io"])
	}
	code, _, out = rawReq(t, http.MethodGet, u+"/beta.go.tito.io", token, "")
	if code != http.StatusOK || strings.Contains(out, "served_by") {
		t.Errorf("get beta = %d %s, want 200 with no served_by key", code, out)
	}
}

// TestAPIInstanceCreateArmedPlacementGate (issue #329): once any box
// publishes a placement code in its edges file, a create naming a region no
// armed box serves is refused with the real choices — a record nothing will
// ever mint is a dark instance, worse than a 400. Dormant before that
// (legacy fleet: behaviour unchanged); a placement without an EIP is not a
// landing target; the unconstrained "" region always passes.
func TestAPIInstanceCreateArmedPlacementGate(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-armed")
	m := titoManifest()
	m.Regions = nil // the manifest allow-list is a separate rail; keep it out
	enableInstances(t, fx, "titogo", m)
	u := instancesURL(fx, "bab", "titogo")
	put := func(key, body string) {
		t.Helper()
		if _, err := fx.rel.Put(context.Background(), key, []byte(body), ""); err != nil {
			t.Fatal(err)
		}
	}

	// DORMANT: no edges file carries a placement — any shape-valid region
	// is accepted, exactly as before the gate existed.
	put("control/edges/legacy.json", `{"v":1,"box":"legacy","eip":"9.9.9.9","hosts":{}}`)
	if code, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"acme.go.tito.io","region":"zz-typo"}`); code != http.StatusCreated {
		t.Fatalf("dormant create = %d %s, want 201", code, out)
	}

	// ARMED: uk has an EIP, se does not, legacy still publishes none.
	put("control/edges/uk-box.json", `{"v":1,"box":"uk-box","eip":"1.2.3.4","region":"eu-west-2","placement":"uk","hosts":{}}`)
	put("control/edges/se-box.json", `{"v":1,"box":"se-box","eip":"","region":"eu-north-1","placement":"se","hosts":{}}`)

	if code, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"beta.go.tito.io","region":"uk"}`); code != http.StatusCreated {
		t.Fatalf("create region uk (armed) = %d %s, want 201", code, out)
	}
	if code, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"gamma.go.tito.io"}`); code != http.StatusCreated {
		t.Fatalf("create with unconstrained region = %d %s, want 201", code, out)
	}
	code, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"delta.go.tito.io","region":"zz-typo"}`)
	if code != http.StatusBadRequest {
		t.Fatalf("create region zz-typo (armed) = %d %s, want 400", code, out)
	}
	if !strings.Contains(out, "armed: uk") {
		t.Fatalf("refusal %q does not name the armed set", out)
	}
	// se published a placement but no EIP: not a landing target.
	if code, _, out := rawReq(t, http.MethodPost, u, token, `{"host":"eps.go.tito.io","region":"se"}`); code != http.StatusBadRequest {
		t.Fatalf("create region se (no EIP) = %d %s, want 400", code, out)
	}
}

// A static site is HA by default. Static is the one serving class every
// platform box materializes unconditionally (provision.everywhereClass):
// no unit, no process, content read from the bucket channel pointer, so a
// far edge serves it with no home box and no backhaul. The content half of
// that was already true and measured — every flagship edge served every
// static host with a valid cert. What was missing was DNS: without an
// opt-in the host resolves to one edge, so four healthy boxes held the site
// and every visitor went to one of them.
//
// The opt-in is inert until a deployment sets CARLOS_STEERING_ZONE_ID, so a
// single-box deployment states the intent harmlessly and becomes HA the day
// it arms a second edge. `carlos steering --app x --host y off` is the
// escape hatch, and nothing here ever converges an existing record.
// shipStaticRelease ships a STATIC release: a "site" artifact and no build
// for any box's platform. That absence is the whole bug — a box stages
// nothing, writes no live symlink, and every wake of an instance route on
// this channel fails forever (skills#29).
func shipStaticRelease(t *testing.T, fx *consoleFixture, app, version string) {
	t.Helper()
	m := release.Manifest{
		Schema: 1, App: app, Version: version, Kind: "static",
		BuiltAt:   "2026-09-01T23:16:21Z",
		Artifacts: map[string]release.Artifact{"site": {File: "site.tar"}},
	}
	if err := release.Ship(context.Background(), fx.rel, release.OpsAccount, m,
		map[string][]byte{"site": []byte("<h1>" + version + "</h1>")}); err != nil {
		t.Fatal(err)
	}
}

// skills#29, at the door that could have prevented it. A member shipped a
// static site, promoted it, and then declared an INSTANCE for it — the kind
// this door defaults to. The record was created happily and the route it
// provisioned could never wake, because a static release carries no binary to
// run. What they saw was "nothing is promoted for this instance's channel"
// against a `carlos channels` showing the promote plainly there.
//
// The refusal has to do more than refuse: an agent that reads it must be able
// to act on it without another round of discovery, so it names both ways out.
func TestAPIInstanceCreateRefusesAnInstanceOnAStaticHead(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-static-head")
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	if status, _, out := rawReq(t, http.MethodPut, enableURL(fx, "bab", "titogo"), member, `{}`); status != http.StatusOK {
		t.Fatalf("enable = %d %s", status, out)
	}
	shipStaticRelease(t, fx, "titogo", "0.1.0")
	seedChannel(t, fx, "titogo", "edge", "0.1.0")
	host := "titogo." + fx.sqid + ".oncarlos.test"

	// No "kind" at all — the CLI's default, and exactly the request that was
	// made in the reported session.
	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","channel":"edge"}`)
	if status != http.StatusUnprocessableEntity {
		t.Fatalf("create = %d %s, want 422 — an instance on a static head can never wake", status, out)
	}
	for _, want := range []string{"static release", "0.1.0", "--kind static", "carlos deploy"} {
		if !strings.Contains(out, want) {
			t.Errorf("refusal %q does not name %q — the member is refused without being told the way out", out, want)
		}
	}
	if _, err := provision.GetRecord(context.Background(), fx.rel, fx.sqid, "titogo", host); err == nil {
		t.Error("the refused create wrote a record anyway")
	}

	// The way out the refusal names actually works, in the same fixture.
	status, _, out = rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","channel":"edge","kind":"static"}`)
	if status != http.StatusCreated {
		t.Fatalf("static create = %d %s, want 201 — the refusal named a door that is shut", status, out)
	}
}

// The guard is about the SHAPE mismatch, not about static apps: an app whose
// channel head is an ordinary binary release still gets an ordinary instance
// with no kind named, which is most creates on the platform.
func TestAPIInstanceCreateAllowsAnInstanceOnABinaryHead(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-binary-head")
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	if status, _, out := rawReq(t, http.MethodPut, enableURL(fx, "bab", "titogo"), member, `{}`); status != http.StatusOK {
		t.Fatalf("enable = %d %s", status, out)
	}
	shipVersion(t, fx, "titogo", "v1")
	seedChannel(t, fx, "titogo", "edge", "v1")
	host := "titogo." + fx.sqid + ".oncarlos.test"

	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","channel":"edge"}`)
	if status != http.StatusCreated {
		t.Fatalf("create = %d %s, want 201", status, out)
	}
}

// A brand-new app with nothing promoted anywhere is the FIRST-instance case,
// and it must stay exactly as it was: nothing to read, nothing to refuse.
func TestAPIInstanceCreateUnaffectedWithNothingPromoted(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-no-head")
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	if status, _, out := rawReq(t, http.MethodPut, enableURL(fx, "bab", "titogo"), member, `{}`); status != http.StatusOK {
		t.Fatalf("enable = %d %s", status, out)
	}
	host := "titogo." + fx.sqid + ".oncarlos.test"

	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","channel":"edge"}`)
	if status != http.StatusCreated {
		t.Fatalf("create = %d %s, want 201 — the first instance of an app that has shipped nothing", status, out)
	}
}

func TestAPIInstanceCreateStaticSteersByDefault(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-static-steer")
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	if status, _, out := rawReq(t, http.MethodPut, enableURL(fx, "bab", "titogo"), member, `{}`); status != http.StatusOK {
		t.Fatalf("enable = %d %s", status, out)
	}
	host := "titogo." + fx.sqid + ".oncarlos.test"

	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","kind":"static","channel":"edge"}`)
	if status != http.StatusCreated {
		t.Fatalf("static apex create = %d %s, want 201", status, out)
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, fx.sqid, "titogo", host)
	if err != nil {
		t.Fatal(err)
	}
	if stored.Steering != "latency" {
		t.Fatalf("stored Steering = %q, want latency — a static platform host is HA by default", stored.Steering)
	}
	// Whatever the door writes has to survive ValidateShape, or the record
	// it just stored is one no box will ever materialize.
	if err := provision.ValidateShape(*stored); err != nil {
		t.Fatalf("the defaulted record does not validate: %v", err)
	}
}

// The default is scoped to the platform namespace, and deliberately so. The
// steering converger only ever writes latency records for hosts under the
// apps domain (internal/steering's steeredHosts), so defaulting a custom
// domain's record to "latency" would write an opt-in that does nothing —
// a claim in the record that no pass will honour, which is #306's shape.
// A custom domain reaches the edges by its owner's own DNS, and the console
// already tells them to CNAME the steering hostname.
func TestAPIInstanceCreateStaticCustomDomainDoesNotSteer(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-static-custom")
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	// The operator-written manifest, pinned to the app's OWN domain rather
	// than the account's platform subdomain — the custom-domain shape.
	enableInstances(t, fx, "titogo", titoManifest())
	host := "site.go.tito.io"

	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","region":"ie","kind":"static","channel":"edge"}`)
	if status != http.StatusCreated {
		t.Fatalf("custom-domain static create = %d %s, want 201", status, out)
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, fx.sqid, "titogo", host)
	if err != nil {
		t.Fatal(err)
	}
	if stored.Steering != "" {
		t.Fatalf("stored Steering = %q, want empty — the converger never steers a host outside the apps domain", stored.Steering)
	}
}

// Only static. A home-boxed instance route reaches a far edge by backhaul,
// which is a different trade with a different cost, and widening this
// default to every kind would make that trade silently for every app on the
// deployment. `carlos steering` remains the door for those, per host.
func TestAPIInstanceCreateNonStaticDoesNotSteer(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-nonstatic-steer")
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	if status, _, out := rawReq(t, http.MethodPut, enableURL(fx, "bab", "titogo"), member, `{}`); status != http.StatusOK {
		t.Fatalf("enable = %d %s", status, out)
	}
	host := "titogo." + fx.sqid + ".oncarlos.test"

	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","channel":"edge"}`) // no kind: the instance default
	if status != http.StatusCreated {
		t.Fatalf("instance create = %d %s, want 201", status, out)
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, fx.sqid, "titogo", host)
	if err != nil {
		t.Fatal(err)
	}
	if stored.Steering != "" {
		t.Fatalf("stored Steering = %q, want empty — only static is steered by default", stored.Steering)
	}
}

// v1's pool rail applies to the default exactly as it applies to the PATCH
// door, which answers 409 for the same request. A default that wrote what
// the update door refuses would put an opt-in in the record that nobody
// could have asked for through the front door — and that the converger
// skips regardless, since a pool's own edges are not the deployment's.
func TestAPIInstanceCreateStaticInAPoolDoesNotSteer(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-static-pooled")
	fx.srv.cfg.AppsDomain = "oncarlos.test"
	// An operator-written manifest can pin BOTH the account's platform
	// subdomain and a pool; the member-facing enable door cannot.
	enableInstances(t, fx, "titogo", provision.Manifest{
		Schema: 1, App: "titogo", Domain: fx.sqid + ".oncarlos.test",
		Pool: "tito", Channel: "stable", Seed: []string{"seed"},
	})
	host := "titogo." + fx.sqid + ".oncarlos.test"

	status, _, out := rawReq(t, http.MethodPost, instancesURL(fx, "bab", "titogo"), member,
		`{"host":"`+host+`","kind":"static","channel":"edge"}`)
	if status != http.StatusCreated {
		t.Fatalf("pooled static create = %d %s, want 201", status, out)
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, fx.sqid, "titogo", host)
	if err != nil {
		t.Fatal(err)
	}
	if stored.Steering != "" {
		t.Fatalf("stored Steering = %q, want empty — steering requires the shared pool", stored.Steering)
	}
}

// TestAPIInstanceUpdateGateRoundTrip: the PATCH takes a PLAINTEXT password,
// hashes it here (spec §5.2) and answers with a record carrying "gated":true
// and no "gate" key at all — the bcrypt hash is written to the bucket and
// never leaves the console again, not on the write reply, not on the list,
// not on the GET. Clearing is `{"gate":""}`, which opens the host and flips
// the same flag back.
func TestAPIInstanceUpdateGateRoundTrip(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-gate-round")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", sharedPoolManifest())
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"gate.go.tito.io","region":"ie","addrs":["127.0.0.1:7001"]}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	pu := updateURL(fx, "bab", "titogo", "gate.go.tito.io")

	status, _, out := rawReq(t, http.MethodPatch, pu, token, `{"gate":"correct horse"}`)
	if status != http.StatusOK {
		t.Fatalf("patch gate = %d %s, want 200", status, out)
	}
	var echoed map[string]any
	if err := json.Unmarshal([]byte(out), &echoed); err != nil {
		t.Fatal(err)
	}
	if _, leaked := echoed["gate"]; leaked {
		t.Fatalf("patch reply carries the gate hash: %s", out)
	}
	if echoed["gated"] != true {
		t.Fatalf("patch reply gated = %v, want true", echoed["gated"])
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "gate.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !strings.HasPrefix(stored.Gate, "$2a$10$") {
		t.Fatalf("stored gate = %q, want a bcrypt hash", stored.Gate)
	}
	if strings.Contains(stored.Gate, "correct horse") {
		t.Fatal("stored gate carries the plaintext")
	}
	if detail := lastEventDetail(t, fx, "titogo"); detail != "updated instance gate.go.tito.io (gate) (cli)" {
		t.Fatalf("audit detail = %q", detail)
	}

	// The list and the GET shadow the hash the same way.
	for _, path := range []string{u, pu} {
		_, _, body := rawReq(t, http.MethodGet, path, token, "")
		if strings.Contains(body, "$2a$") {
			t.Fatalf("GET %s leaks the hash: %s", path, body)
		}
		if !strings.Contains(body, `"gated":true`) {
			t.Fatalf("GET %s lacks gated:true: %s", path, body)
		}
	}

	status, _, out = rawReq(t, http.MethodPatch, pu, token, `{"gate":""}`)
	if status != http.StatusOK {
		t.Fatalf("patch clear = %d %s", status, out)
	}
	stored, _ = provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "gate.go.tito.io")
	if stored.Gate != "" {
		t.Fatalf("stored gate after clear = %q", stored.Gate)
	}
	_, _, body := rawReq(t, http.MethodGet, pu, token, "")
	if !strings.Contains(body, `"gated":false`) {
		t.Fatalf("GET after clear: %s", body)
	}
}

// TestAPIInstanceUpdateGateRefusals: gate.CheckPassword's two bounds are this
// door's own 400, in the caller's terms — and the refusal never echoes the
// password back, because a 400 body is exactly where a rejected password
// would otherwise land in a log or a terminal's scrollback.
func TestAPIInstanceUpdateGateRefusals(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-gate-refuse")
	letStateUpstreams(t, fx, "alice@keymail.dev")
	enableInstances(t, fx, "titogo", sharedPoolManifest())
	u := instancesURL(fx, "bab", "titogo")
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"gr.go.tito.io","region":"ie","addrs":["127.0.0.1:7001"]}`); status != http.StatusCreated {
		t.Fatalf("create = %d %s", status, out)
	}
	pu := updateURL(fx, "bab", "titogo", "gr.go.tito.io")
	for _, body := range []string{`{"gate":"short7!"}`, `{"gate":"` + strings.Repeat("x", 73) + `"}`} {
		status, _, out := rawReq(t, http.MethodPatch, pu, token, body)
		if status != http.StatusBadRequest || !strings.Contains(out, "password") {
			t.Fatalf("%s -> %d %s, want 400 naming the password rule", body, status, out)
		}
		if strings.Contains(out, "short7!") || strings.Contains(out, "xxxxxxxx") {
			t.Fatalf("refusal echoes the password: %s", out)
		}
	}
	// The empty-body rail names gate among the patchable fields.
	if _, _, out := rawReq(t, http.MethodPatch, pu, token, `{}`); !strings.Contains(out, "gate") {
		t.Fatalf("empty-body refusal should name gate: %s", out)
	}
}

// TestAPIInstanceListDBBytes: db_bytes joins from a FRESH box's
// Metrics.RouteDBBytes, is absent (not 0) for a host no box sized, and is
// dropped for a host whose only reporting box has gone stale — the same
// rules as staged_version.
func TestAPIInstanceListDBBytes(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-dbbytes")
	enableInstances(t, fx, "titogo", titoManifest())
	u := instancesURL(fx, "bab", "titogo")
	for _, h := range []string{"acme.go.tito.io", "beta.go.tito.io", "gamma.go.tito.io"} {
		if code, _, out := rawReq(t, http.MethodPost, u, token,
			fmt.Sprintf(`{"host":%q,"region":"ie"}`, h)); code != http.StatusCreated {
			t.Fatalf("create %s = %d %s", h, code, out)
		}
	}
	fresh := status.CollectBox(nil, status.Probes{MachineID: "box1"}, time.Now())
	fresh.Metrics = &status.BoxMetrics{RouteDBBytes: map[string]int64{"acme.go.tito.io": 123456}}
	if err := status.WriteBox(context.Background(), fx.rel, fresh); err != nil {
		t.Fatal(err)
	}
	stale := status.CollectBox(nil, status.Probes{MachineID: "box2"}, time.Now().Add(-time.Hour))
	stale.Metrics = &status.BoxMetrics{RouteDBBytes: map[string]int64{"gamma.go.tito.io": 999}}
	if err := status.WriteBox(context.Background(), fx.rel, stale); err != nil {
		t.Fatal(err)
	}

	code, _, out := rawReq(t, http.MethodGet, u, token, "")
	if code != http.StatusOK {
		t.Fatalf("list = %d %s", code, out)
	}
	var list struct {
		Instances []map[string]any `json:"instances"`
	}
	if err := json.Unmarshal([]byte(out), &list); err != nil {
		t.Fatalf("list body %s: %v", out, err)
	}
	got := map[string]map[string]any{}
	for _, r := range list.Instances {
		got[r["host"].(string)] = r
	}
	if v := got["acme.go.tito.io"]["db_bytes"]; v != float64(123456) {
		t.Errorf("acme db_bytes = %v, want 123456", v)
	}
	for _, h := range []string{"beta.go.tito.io", "gamma.go.tito.io"} {
		if v, ok := got[h]["db_bytes"]; ok {
			t.Errorf("%s db_bytes = %v, want the key absent", h, v)
		}
	}
}

// TestAPIInstanceCreateReplicaFields pins the create door's replica rails
// (#162): role and placement travel together or not at all; a valid replica
// create lands role on the record, in the bucket, canonicalized; the home's
// placement set is deduped and sorted by the door, not by the writer's
// typing; and a record carrying none of the fields writes no replica keys —
// the additivity rule, at the door.
func TestAPIInstanceCreateReplicaFields(t *testing.T) {
	fx, token := instanceFixture(t, "code-inst-replica")
	m := titoManifest()
	m.Regions = []string{"ie", "uk"} // the replica placement must be armed
	enableInstances(t, fx, "titogo", m)
	u := instancesURL(fx, "bab", "titogo")

	// A replica create: role and region together.
	status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"acme-uk.go.tito.io","region":"uk","role":"replica"}`)
	if status != http.StatusCreated {
		t.Fatalf("replica create = %d %s, want 201", status, out)
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "acme-uk.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if stored.Role != "replica" || stored.Region != "uk" {
		t.Fatalf("stored replica record = %+v, want role replica in region uk", stored)
	}

	// The home record's placement set: canonicalized by the door. The set
	// is the HOME's opt-in, carried on a PLAIN record — role stays empty.
	status, _, out = rawReq(t, http.MethodPost, u, token,
		`{"host":"acme.go.tito.io","region":"ie","replicas":["uk"," ie ","uk"]}`)
	if status != http.StatusCreated {
		t.Fatalf("home create = %d %s, want 201", status, out)
	}
	home, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "acme.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if got := strings.Join(home.Replicas, ","); got != "ie,uk" {
		t.Fatalf("stored replica set = %q, want canonical ie,uk", got)
	}

	// Half a decision is refused, each way.
	for _, c := range []struct{ what, body, want string }{
		{"role without region", `{"host":"half1.go.tito.io","role":"replica"}`, "needs a placement"},
		{"replica with a set", `{"host":"half2.go.tito.io","role":"replica","region":"uk","replicas":["uk"]}`, "HOME record's opt-in"},
		{"bad placement", `{"host":"half3.go.tito.io","replicas":["fleet/pi"]}`, "placement code"},
	} {
		status, _, out := rawReq(t, http.MethodPost, u, token, c.body)
		if status != http.StatusBadRequest {
			t.Errorf("%s = %d %s, want 400", c.what, status, out)
			continue
		}
		if !strings.Contains(out, c.want) {
			t.Errorf("%s refusal = %s, want it to name %q", c.what, out, c.want)
		}
	}
	keys, _ := fx.rel.List(context.Background(), provision.RecordsPrefix("bab", "titogo"))
	if len(keys) != 2 {
		t.Fatalf("refused creates left records: %v", keys)
	}

	// A shapeless create writes no replica keys.
	if status, _, out := rawReq(t, http.MethodPost, u, token,
		`{"host":"plain.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("plain create = %d %s, want 201", status, out)
	}
	plain, _, err := fx.rel.Get(context.Background(), provision.RecordKey("bab", "titogo", "plain.go.tito.io"))
	if err != nil {
		t.Fatal(err)
	}
	for _, k := range []string{`"role"`, `"replicas"`, `"replica"`} {
		if strings.Contains(string(plain), k) {
			t.Errorf("a shapeless create wrote %s into the record: %s", k, plain)
		}
	}
}

// letStateUpstreams gives addr the operator bit. Only an operator may point
// an instance at its own backends (refuseMemberUpstreams), so tests about
// something else that need an addr-backed record use this to make one.
func letStateUpstreams(t *testing.T, fx *consoleFixture, addr string) {
	t.Helper()
	if err := fx.st.SetOperator(addr, true); err != nil {
		t.Fatal(err)
	}
}

// TestAPIInstanceUpstreamsAreOperatorOnly: a member may not point an
// instance at its own backends, at any address, public included — the edge
// dials these from inside the platform, and a member's could reach the box's
// own services or another tenant's private upstream (discussion 214, item 4;
// Paul's ruling on discussion 50, option a). Operators keep the old rail,
// which is where the platform's own addr-backed routes point.
//
// Nothing a member already has is taken away: a record an operator pointed
// somewhere keeps its upstreams through a member's unrelated PATCH, and the
// member may restate or drop the addresses already on it.
func TestAPIInstanceUpstreamsAreOperatorOnly(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-internal")
	enableInstances(t, fx, "titogo", titoManifest())
	if err := fx.st.SetOperator("paul@keymail.dev", true); err != nil {
		t.Fatal(err)
	}
	operator := cliToken(t, fx, "paul@keymail.dev", "code-inst-internal-op")
	u := instancesURL(fx, "bab", "titogo")
	const refusal = "only a platform operator can point an instance at its own backends"

	for _, addr := range []string{"203.0.113.7:443", "127.0.0.1:8090", "10.0.0.5:3000", "[fd00::5]:3000"} {
		body := `{"host":"in.go.tito.io","region":"ie","kind":"service","addrs":["` + addr + `"]}`
		status, _, out := rawReq(t, http.MethodPost, u, member, body)
		if status != http.StatusForbidden || !strings.Contains(out, refusal) {
			t.Errorf("member create with %s = %d %s, want 403 %q", addr, status, out, refusal)
		}
	}
	if _, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "in.go.tito.io"); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("a refused create left a record behind: %v", err)
	}
	// A member's create that states no upstream is untouched by the rail.
	if status, _, out := rawReq(t, http.MethodPost, u, member, `{"host":"plain.go.tito.io","region":"ie"}`); status != http.StatusCreated {
		t.Fatalf("member create without addrs = %d %s, want 201", status, out)
	}

	// The operator's create is the platform's own path, unchanged.
	if status, _, out := rawReq(t, http.MethodPost, u, operator,
		`{"host":"in.go.tito.io","region":"ie","kind":"service","addrs":["127.0.0.1:7001","127.0.0.1:7002"]}`); status != http.StatusCreated {
		t.Fatalf("operator create with loopback = %d %s, want 201", status, out)
	}
	pu := updateURL(fx, "bab", "titogo", "in.go.tito.io")

	// A member's PATCH of other fields leaves the upstreams standing.
	for _, body := range []string{`{"probe":{"path":"/up"}}`, `{"environment":"acme"}`, `{"steering":""}`} {
		if status, _, out := rawReq(t, http.MethodPatch, pu, member, body); status != http.StatusOK {
			t.Fatalf("member patch %s on an operator-made route = %d %s, want 200", body, status, out)
		}
	}
	stored, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "in.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(stored.Addrs, []string{"127.0.0.1:7001", "127.0.0.1:7002"}) {
		t.Fatalf("stored addrs after member patches = %v, want the operator's pair untouched", stored.Addrs)
	}
	// It may not add one, public or not...
	for _, body := range []string{`{"addrs":["127.0.0.1:7001","192.168.1.1:7003"]}`, `{"addrs":["127.0.0.1:7001","203.0.113.7:443"]}`} {
		if status, _, out := rawReq(t, http.MethodPatch, pu, member, body); status != http.StatusForbidden || !strings.Contains(out, refusal) {
			t.Fatalf("member patch %s = %d %s, want 403 %q", body, status, out, refusal)
		}
	}
	// ...but may restate what is there, or drop a dead one.
	for _, body := range []string{`{"addrs":["127.0.0.1:7002","127.0.0.1:7001"]}`, `{"addrs":["127.0.0.1:7001"]}`} {
		if status, _, out := rawReq(t, http.MethodPatch, pu, member, body); status != http.StatusOK {
			t.Fatalf("member patch %s = %d %s, want 200", body, status, out)
		}
	}
	// The operator's PATCH keeps the old rail.
	if status, _, out := rawReq(t, http.MethodPatch, pu, operator, `{"addrs":["10.0.0.5:7001"]}`); status != http.StatusOK {
		t.Fatalf("operator patch to a private addr = %d %s, want 200", status, out)
	}
	stored, err = provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "in.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(stored.Addrs, []string{"10.0.0.5:7001"}) {
		t.Fatalf("stored addrs = %v, want the operator's", stored.Addrs)
	}

	// A service credential is not a person, operator or not.
	appTok, err := fx.st.NewAppToken(OpsAccountID, "titogo", "paul@keymail.dev", "ci", time.Now())
	if err != nil {
		t.Fatal(err)
	}
	if status, _, out := rawReq(t, http.MethodPatch, pu, appTok, `{"addrs":["10.0.0.6:7001"]}`); status != http.StatusForbidden {
		t.Fatalf("app token patch to a new addr = %d %s, want 403", status, out)
	}
}

// TestExistingUpstreamRecordsKeepServing: records already in the bucket with
// upstreams — including the legacy single Addr, written before this rail by
// whoever could then — still pass the shape rail the box reconciles with
// (which this branch does not touch; reconcile_test.go's addr-backed
// records cover the minting) and survive a member's PATCH of unrelated
// fields. The rail governs only what a member newly states.
func TestExistingUpstreamRecordsKeepServing(t *testing.T) {
	fx, member := instanceFixture(t, "code-inst-legacy")
	enableInstances(t, fx, "titogo", titoManifest())
	rec := provision.Record{Schema: 1, Host: "legacy.go.tito.io", Slug: "legacy", App: "titogo",
		Account: "bab", Pool: "tito", Region: "ie", Channel: "stable", Kind: "service",
		Addr: "10.0.0.1:8090", CreatedAt: time.Now().UTC(), CreatedBy: "alice@keymail.dev"}
	if err := provision.ValidateShape(rec); err != nil {
		t.Fatalf("an existing private-addr record no longer validates: %v", err)
	}
	if err := provision.CreateRecord(context.Background(), fx.rel, rec); err != nil {
		t.Fatal(err)
	}
	pu := updateURL(fx, "bab", "titogo", "legacy.go.tito.io")
	if status, _, out := rawReq(t, http.MethodPatch, pu, member, `{"probe":{"path":"/up"}}`); status != http.StatusOK {
		t.Fatalf("member probe patch on a legacy addr record = %d %s, want 200", status, out)
	}
	got, err := provision.GetRecord(context.Background(), fx.rel, "bab", "titogo", "legacy.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Equal(got.AddrsOrDefault(), []string{"10.0.0.1:8090"}) {
		t.Fatalf("upstreams after a member probe patch = %v, want the record's own", got.AddrsOrDefault())
	}
	// Restating the legacy addr through the addrs door moves it into the set,
	// as an operator's PATCH would; that is not a new upstream.
	if status, _, out := rawReq(t, http.MethodPatch, pu, member, `{"addrs":["10.0.0.1:8090"]}`); status != http.StatusOK {
		t.Fatalf("member restating the legacy addr = %d %s, want 200", status, out)
	}
}