package console

// The app page's ladder section (pipelines spec §3, §5, §7). Four properties,
// in the order they would hurt if lost: the four rungs say what is on them,
// the promote control is owner-only, `stable` cannot be reached without a
// passkey, and a skip up the ladder is refused however it is posted.

import (
	"bytes"
	"context"
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"net/http"
	"net/url"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
)

// shipVersion adds one more shipped release to the fixture app — fixture
// state, built through the real primitive so the console reads it exactly as
// it reads a real one.
func shipVersion(t *testing.T, fx *consoleFixture, app, version string) {
	t.Helper()
	m := release.Manifest{
		Schema: 1, App: app, Version: version, Kind: "binary",
		BuiltAt:   "2026-07-03T10:00:00Z",
		Artifacts: map[string]release.Artifact{"linux-amd64": {File: app}},
	}
	if err := release.Ship(context.Background(), fx.rel, release.OpsAccount, m,
		map[string][]byte{"linux-amd64": []byte("binary " + version)}); err != nil {
		t.Fatal(err)
	}
}

// seedChannel points a channel at a version through the UNCHECKED primitive.
// That is deliberate: these are arrangements of the world the console then has
// to read and gate, not promotions under test.
func seedChannel(t *testing.T, fx *consoleFixture, app, channel, version string, rec ...release.Promotion) {
	t.Helper()
	if err := release.Promote(context.Background(), fx.rel, fx.priv,
		release.OpsAccount, app, channel, version, rec...); err != nil {
		t.Fatal(err)
	}
}

// rungBlock cuts one rung's markup out of the rendered page, so "the beta rung
// shows v4" is an assertion about the beta rung and not about the page
// containing "v4" somewhere.
func rungBlock(t *testing.T, body, rung string) string {
	t.Helper()
	_, after, ok := strings.Cut(body, `id="rung-`+rung+`"`)
	if !ok {
		t.Fatalf("no %s rung in the ladder:\n%s", rung, body)
	}
	if before, _, ok := strings.Cut(after, `id="rung-`); ok {
		return before
	}
	before, _, _ := strings.Cut(after, "</ol>")
	return before
}

// routeLine narrows further, to the one line a host is listed on.
func routeLine(t *testing.T, block, host string) string {
	t.Helper()
	for _, li := range strings.Split(block, "<li") {
		if strings.Contains(li, ">"+host+"</a>") {
			return li
		}
	}
	t.Fatalf("host %s is not listed in:\n%s", host, block)
	return ""
}

// The four rungs, in order, each saying what it holds, when it got there and
// who put it there. The audit trail is new, so most live pointers have none:
// the rung that has one names the actor, and the rung that does not still
// renders — saying so — rather than crashing or inventing a name.
func TestLadderRendersFourRungs(t *testing.T) {
	fx := newConsoleFixture(t)
	shipVersion(t, fx, "kass", "v3")
	shipVersion(t, fx, "kass", "v4")
	seedChannel(t, fx, "kass", "edge", "v3",
		release.Promotion{Version: "v3", To: "edge", Actor: "ci@keymail.dev"})
	seedChannel(t, fx, "kass", "beta", "v4",
		release.Promotion{Version: "v4", From: "edge", To: "beta", Actor: "kim@keymail.dev"})

	c := signInPaul(t, fx)
	status, _, body := get(t, c, fx.u("/apps/kass/releases"))
	if status != http.StatusOK {
		t.Fatalf("app page = %d", status)
	}
	// Fixture: stable v1 and canary/x v2, both written before the audit trail
	// existed; edge and beta seeded above.
	for rung, version := range map[string]string{
		"canary": "v2", "edge": "v3", "beta": "v4", "stable": "v1",
	} {
		block := rungBlock(t, body, rung)
		if !strings.Contains(block, ">"+version+"<") {
			t.Errorf("the %s rung does not show %s:\n%s", rung, version, block)
		}
	}
	if b := rungBlock(t, body, "beta"); !strings.Contains(b, "kim@keymail.dev") {
		t.Errorf("the beta rung does not say who promoted it:\n%s", b)
	}
	if b := rungBlock(t, body, "edge"); !strings.Contains(b, "ci@keymail.dev") {
		t.Errorf("the edge rung does not say who promoted it:\n%s", b)
	}
	// The pre-audit pointer: rendered, and honest about what it cannot say —
	// the template now omits the "by ..." clause entirely rather than
	// attributing the promotion to anybody, so the dishonest alternative
	// (inventing an actor) is what must not appear.
	if b := rungBlock(t, body, "stable"); strings.Contains(b, "ago by") {
		t.Errorf("a pointer with no audit trail invented an actor:\n%s", b)
	}
	// Routes sit under the rung they subscribe to.
	if b := rungBlock(t, body, "stable"); !strings.Contains(b, "kass.carlosapp.dev") {
		t.Errorf("the stable rung does not list the hosts following it:\n%s", b)
	}
}

// The promote control is the owner's. A member still sees the whole ladder —
// visibility is not the thing being restricted — and is offered no button.
func TestLadderPromoteControlIsOwnerOnly(t *testing.T) {
	fx := newConsoleFixture(t)
	shipVersion(t, fx, "kass", "v3")
	seedChannel(t, fx, "kass", "edge", "v3")

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	if !strings.Contains(body, "Promote v3 to beta") {
		t.Fatalf("owner is offered no edge -> beta control:\n%s", body)
	}
	// The control posts to the app's one promote endpoint — the same door,
	// with the same ladder and step-up gates behind it.
	if !strings.Contains(body, `action="/a/bab/apps/kass/promote"`) {
		t.Fatal("the ladder control does not post to the promote endpoint")
	}

	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	fx.setUser("sam@keymail.dev")
	cm := newBrowser(t)
	signUp(t, fx, cm, "code-sam-ladder")
	status, _, mbody := get(t, cm, fx.u("/apps/kass/releases"))
	if status != http.StatusOK {
		t.Fatalf("member app page = %d, want 200", status)
	}
	if !strings.Contains(mbody, `id="rung-stable"`) {
		t.Fatal("a member cannot see the ladder at all")
	}
	if strings.Contains(mbody, "Promote v3 to beta") {
		t.Error("a member is offered the ladder's promote control")
	}
}

// Stable is the rung that puts a build in front of every user, so a live
// session is not enough on its own. Without the passkey the pointer does not
// move; with it, the held promotion resumes and is recorded.
func TestLadderPromoteToStableNeedsStepUp(t *testing.T) {
	fx := newConsoleFixture(t)
	shipVersion(t, fx, "kass", "v3")
	seedChannel(t, fx, "kass", "beta", "v3")
	c := signInPaul(t, fx)
	csrf := sessionToken(t, fx, c)

	status, loc, _ := postForm(t, c, fx.u("/apps/kass/promote"),
		url.Values{"csrf": {csrf}, "channel": {"stable"}, "version": {"v3"}, "confirmed": {"1"}})
	if status != http.StatusSeeOther || !strings.HasPrefix(loc, fx.fk.srv.URL) {
		t.Fatalf("un-stepped-up stable promotion = %d -> %q, want a redirect into Keymail", status, loc)
	}
	if p := fx.channelVersion(t, "kass", "stable"); p.Version != "v1" {
		t.Fatalf("stable moved to %s with no passkey confirmation", p.Version)
	}

	if status, _, body := completeStepUp(t, fx, c, loc); status != http.StatusSeeOther {
		t.Fatalf("resumed promotion = %d:\n%s", status, body)
	}
	p := fx.channelVersion(t, "kass", "stable")
	if p.Version != "v3" {
		t.Fatalf("stable = %s after a confirmed promotion, want v3", p.Version)
	}
	if len(p.Audit) == 0 {
		t.Fatal("the promotion recorded nothing on the pointer it moved")
	}
	if a := p.Audit[0]; a.Version != "v3" || a.From != "beta" || a.To != "stable" ||
		a.Actor != "paul@keymail.dev" || a.Hotfix {
		t.Fatalf("audit[0] = %+v, want v3 beta->stable by paul, no hotfix", a)
	}
}

// A skip is refused whoever asks and however confirmed: edge -> stable never
// happens through the console, because "it was signed off on beta" is only
// worth anything if everything on stable came through beta.
func TestLadderRefusesASkip(t *testing.T) {
	fx := newConsoleFixture(t)
	shipVersion(t, fx, "kass", "v3")
	seedChannel(t, fx, "kass", "edge", "v3")
	c := signInPaul(t, fx)
	csrf := sessionToken(t, fx, c)

	// postGated walks the passkey round trip, so this is the refusal of a
	// FULLY confirmed owner — the ladder, not the gate, is what stops it.
	postGated(t, fx, c, fx.u("/apps/kass/promote"),
		url.Values{"csrf": {csrf}, "channel": {"stable"}, "version": {"v3"}, "confirmed": {"1"}})
	if p := fx.channelVersion(t, "kass", "stable"); p.Version != "v1" {
		t.Fatalf("a skip from edge moved stable to %s", p.Version)
	}
	if _, _, body := get(t, c, fx.u("/apps/kass")); !strings.Contains(body, "stable is entered from beta only") {
		t.Fatalf("no ladder refusal flash:\n%s", body)
	}
}

// A canary is badged; a canary that binds the SAME ENVIRONMENT as the app's
// stable route is badged unmissably, because that is an unreviewed build
// wired to production glue (spec §4a, §5) — whichever host it happens to be
// on. A canary bound to a genuinely different environment is the ordinary,
// unremarkable case. Both badges are chrome, so both are icons, not glyphs.
func TestProdWiredCanaryIsBadgedDistinctly(t *testing.T) {
	fx := newConsoleFixture(t)
	// The fixture's own kass.carlosapp.dev is already on stable, unbound
	// (Environment ""). A canary that is ALSO unbound binds the same
	// environment as stable ("default" both times) and is prod-wired; one
	// bound to a real, different environment is not — regardless of which
	// host either is on.
	fx.addRoute(t, registry.Route{Host: "rc.kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v2", App: "kass", Channel: "canary/x", Addr: "127.0.0.1:9002"})
	fx.addRoute(t, registry.Route{Host: "side.kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v2", App: "kass", Channel: "canary/x", Environment: "sandbox", Addr: "127.0.0.1:9003"})
	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	block := rungBlock(t, body, "canary")

	sameEnv := routeLine(t, block, "rc.kass.carlosapp.dev")
	if !strings.Contains(sameEnv, "chip-prod") {
		t.Errorf("a canary binding the same (default) environment as stable is not flagged:\n%s", sameEnv)
	}
	diffEnv := routeLine(t, block, "side.kass.carlosapp.dev")
	if !strings.Contains(diffEnv, "chip-canary") {
		t.Errorf("a canary route carries no canary badge:\n%s", diffEnv)
	}
	if strings.Contains(diffEnv, "chip-prod") {
		t.Errorf("a canary bound to a DIFFERENT environment than stable is flagged as production-wired:\n%s", diffEnv)
	}
	if !strings.Contains(sameEnv, "<svg") || !strings.Contains(diffEnv, "<svg") {
		t.Error("the badges are text glyphs, not icons")
	}
}

// A canary on the app's APEX host serves everybody, whatever it binds — so
// it stays flagged even when its environment differs from stable's (review
// IMPORTANT 5). The environment set-membership rule is the honest definition
// of "wired to production glue"; the apex signal is the honest definition of
// "in front of production traffic". Losing the second one when the first
// landed would have shipped a silent reduction in warning coverage.
func TestProdWiredCanaryOnTheApexHostIsFlaggedWhateverItBinds(t *testing.T) {
	fx := newConsoleFixture(t)
	reg, err := registry.Open(fx.regPath)
	if err != nil {
		t.Fatal(err)
	}
	// Put a canary on the apex host, bound to an environment nothing on
	// stable binds; docs.kass.carlosapp.dev stays as the app's stable route.
	if err := reg.Delete("kass.carlosapp.dev"); err != nil {
		t.Fatal(err)
	}
	fx.addRoute(t, registry.Route{Host: "kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v2", App: "kass", Channel: "canary/x", Environment: "sandbox", Addr: "127.0.0.1:9007"})

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	block := rungBlock(t, body, "canary")
	line := routeLine(t, block, "kass.carlosapp.dev")
	if !strings.Contains(line, "chip-prod") {
		t.Errorf("a canary on the apex host is not flagged prod-wired:\n%s", line)
	}
}

// No stable route at all means no production environment to be wired in
// front of — a canary is never flagged by the ENVIRONMENT signal in that
// case, whatever it binds.
func TestProdWiredCanaryNeedsAStableRouteToCompareAgainst(t *testing.T) {
	fx := newConsoleFixture(t)
	reg, err := registry.Open(fx.regPath)
	if err != nil {
		t.Fatal(err)
	}
	// Remove the fixture's two stable-channel kass routes so the app has no
	// stable route left to compare a canary against.
	if err := reg.Delete("kass.carlosapp.dev"); err != nil {
		t.Fatal(err)
	}
	if err := reg.Delete("docs.kass.carlosapp.dev"); err != nil {
		t.Fatal(err)
	}
	// A non-canary route holds the apex, so the OTHER prod-wired signal (the
	// apex-host one, review IMPORTANT 5) cannot fire and this test stays
	// about the environment rule alone.
	fx.addRoute(t, registry.Route{Host: "kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v2", App: "kass", Channel: "beta", Addr: "127.0.0.1:9005"})
	fx.addRoute(t, registry.Route{Host: "rc.kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v2", App: "kass", Channel: "canary/x", Addr: "127.0.0.1:9004"})

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	block := rungBlock(t, body, "canary")
	line := routeLine(t, block, "rc.kass.carlosapp.dev")
	if strings.Contains(line, "chip-prod") {
		t.Errorf("a canary is flagged prod-wired on an app with no stable route:\n%s", line)
	}
}

// Every route on the page shows the environment it is bound to, beside the
// channel it is listed under — "default" for an unbound route, the bundle
// name for a bound one (spec §4a, plan Task 5).
func TestLadderShowsEachRoutesEnvironment(t *testing.T) {
	fx := newConsoleFixture(t)
	fx.addRoute(t, registry.Route{Host: "eu.kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v1", App: "kass", Channel: "stable", Environment: "eu-prod", Addr: "127.0.0.1:9011"})

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	block := rungBlock(t, body, "stable")

	unbound := routeLine(t, block, "kass.carlosapp.dev")
	if !strings.Contains(unbound, "chip-env") || !strings.Contains(unbound, "default") {
		t.Errorf("an unbound route does not show \"default\" as its environment:\n%s", unbound)
	}
	bound := routeLine(t, block, "eu.kass.carlosapp.dev")
	if !strings.Contains(bound, "chip-env") || !strings.Contains(bound, "eu-prod") {
		t.Errorf("a bound route does not show its environment name:\n%s", bound)
	}
}

// The optional read-only capabilities render (app-capabilities design, plan
// Task 9 step 3): a route's operator-granted tokens appear beside its other
// per-route facts, human-legible ("host-role, port:25" rather than the
// registry column's "host-role,port:25"), and a route with nothing granted
// shows no "granted:" text at all — the empty case is silence, not an empty
// chip. Read-only: this is a render of what `carlos route -grant` already
// wrote, nothing here writes it.
func TestLadderShowsGrantedCapabilities(t *testing.T) {
	fx := newConsoleFixture(t)
	fx.addRoute(t, registry.Route{Host: "mx.kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v1", App: "kass", Channel: "stable", Caps: "host-role,port:25", Addr: "127.0.0.1:9013"})

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	block := rungBlock(t, body, "stable")

	granted := routeLine(t, block, "mx.kass.carlosapp.dev")
	if !strings.Contains(granted, "granted: host-role, port:25") {
		t.Errorf("a route with granted capabilities does not render them:\n%s", granted)
	}
	ungranted := routeLine(t, block, "kass.carlosapp.dev")
	if strings.Contains(ungranted, "granted:") {
		t.Errorf("a route with nothing granted rendered a granted: line anyway:\n%s", ungranted)
	}
}

// TestLadderGrantedCapabilitiesNeverCrossAccounts is the scoped guard from the
// 2026-08-03 review (I4). Assemble groups routes by app NAME with no account
// filter, and app names are unique per ACCOUNT rather than globally
// (Store.AppAccounts) — so two accounts each owning an app called "kass" both
// land in one AppView, and every per-route field rides that bleed. Grants are
// the sharpest thing to ride it: "granted: port:587, host-role" says which
// privileged port and which slice of the box's own authority an operator has
// handed ANOTHER tenant's route.
//
// The rest of the bleed (the row itself, its environment chip, its prod-wired
// badge) is pre-existing and stays until Assemble takes a real account filter.
// This pins the one field that was never allowed to cross: A's page renders
// its OWN grants and carries nothing of B's, by any spelling.
func TestLadderGrantedCapabilitiesNeverCrossAccounts(t *testing.T) {
	fx := newConsoleFixture(t)
	if err := fx.st.CreateAccount(42, "cdef", "Rival", "rival@keymail.dev", time.Now()); err != nil {
		t.Fatal(err)
	}
	if _, err := fx.st.CreateAppIn(42, "kass", "rival@keymail.dev", time.Now()); err != nil {
		t.Fatal(err)
	}
	// paul's own route, with a grant of its own — the guard must not silence
	// the render it was added for.
	fx.addRoute(t, registry.Route{Host: "mx.kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v1", App: "kass", Channel: "stable", Caps: "port:25", Addr: "127.0.0.1:9014"})
	// Same app name, another account, paul is not a member of it. Distinct
	// tokens, so a leak cannot hide behind paul's own.
	fx.addRoute(t, registry.Route{Host: "rival.kass.example.com", Kind: "instance", Status: "ready",
		Version: "v1", App: "kass", Channel: "stable", Account: "cdef",
		Caps: "host-role,port:587", Addr: "127.0.0.1:9015"})

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))

	block := rungBlock(t, body, "stable")
	own := routeLine(t, block, "mx.kass.carlosapp.dev")
	if !strings.Contains(own, "granted: port:25") {
		t.Errorf("the viewing account's OWN grants stopped rendering:\n%s", own)
	}
	// Anywhere on the page, not just in the rival's own row: the tokens
	// themselves are the secret, and where they are printed does not change
	// that. (host-role is deliberately not asserted on — paul's fixture is
	// free to grant it too; the port is the unambiguous sentinel.)
	if strings.Contains(body, "port:587") {
		t.Fatalf("the app page leaked another account's grant:\n%s", block)
	}
	// The rival's row itself is still expected on the page (the pre-existing
	// grouping bleed above); it must simply carry no granted: line. Tolerant of
	// the row being gone entirely, which is what the follow-up account filter
	// will do — that is also no leak.
	for _, li := range strings.Split(block, "<li") {
		if strings.Contains(li, ">rival.kass.example.com</a>") && strings.Contains(li, "granted:") {
			t.Fatalf("another account's route rendered a granted: line:\n%s", li)
		}
	}
}

// Visibility, not permission (spec §5): a member sees the same environment
// and prod-wired chrome an owner does. Only the promote control is
// owner-gated — see TestLadderPromoteControlIsOwnerOnly.
func TestLadderEnvironmentAndProdWiredVisibleToNonOwner(t *testing.T) {
	fx := newConsoleFixture(t)
	fx.addRoute(t, registry.Route{Host: "rc.kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v2", App: "kass", Channel: "canary/x", Addr: "127.0.0.1:9002"})
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	fx.setUser("sam@keymail.dev")
	cm := newBrowser(t)
	signUp(t, fx, cm, "code-sam-envs")
	status, _, body := get(t, cm, fx.u("/apps/kass/releases"))
	if status != http.StatusOK {
		t.Fatalf("member app page = %d, want 200", status)
	}
	canaryBlock := rungBlock(t, body, "canary")
	line := routeLine(t, canaryBlock, "rc.kass.carlosapp.dev")
	if !strings.Contains(line, "chip-prod") {
		t.Errorf("a member does not see the prod-wired badge:\n%s", line)
	}
	stableBlock := rungBlock(t, body, "stable")
	if !strings.Contains(stableBlock, "chip-env") {
		t.Errorf("a member does not see route environment chrome:\n%s", stableBlock)
	}
}

// ---- Canary TTL (spec §5 "Canaries expire") --------------------------------

// A canary promoted moments ago — exactly what every real promotion through
// this console produces, Promote always stamping "now" — must carry no
// expired badge. This is the case AGENTS.md's own console route is in on
// every deploy (canary/console, re-promoted each time): a false positive
// here would badge the console's own production traffic as neglected.
func TestLadderFreshCanaryCarriesNoExpiredBadge(t *testing.T) {
	fx := newConsoleFixture(t)
	fx.addRoute(t, registry.Route{Host: "rc.kass.carlosapp.dev", Kind: "instance", Status: "ready",
		Version: "v2", App: "kass", Channel: "canary/x", Addr: "127.0.0.1:9002"})
	seedChannel(t, fx, "kass", "canary/x", "v2") // stamps PromotedAt = now

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	block := rungBlock(t, body, "canary")
	line := routeLine(t, block, "rc.kass.carlosapp.dev")

	if strings.Contains(line, "chip-expired") {
		t.Errorf("a freshly-promoted canary is badged expired:\n%s", line)
	}
	// This route binds the same (default) environment as the fixture's
	// stable route, so it is ALSO prod-wired (TestProdWiredCanaryIsBadgedDistinctly
	// covers that badge on its own) — chip-prod or chip-canary, either is the
	// "this is a canary" badge the expired flag would sit beside; the point
	// of this test is only that neither carries chip-expired.
	if !strings.Contains(line, "chip-prod") && !strings.Contains(line, "chip-canary") {
		t.Errorf("the fresh canary lost its canary-family badge entirely:\n%s", line)
	}
}

// assembleLadder is exercised directly here (no store, no signing) because
// there is no way to get a genuinely aged, verifiably-signed pointer through
// the public Promote path — it always stamps the real clock, deliberately
// (release.TestSignStampsPromotedAt pins that). Constructing the ChannelView
// by hand is the same input assembleChannels would have produced from a
// pointer that really was promoted eight days ago.
func TestLadderExpiredCanaryIsBadgedWithAge(t *testing.T) {
	now := time.Now()
	old := now.Add(-(release.CanaryTTL + 8*24*time.Hour)) // 8 days past the TTL
	channels := []ChannelView{{Name: "canary/x", Version: "v9", PromotedAt: old}}
	// A stable route on a DIFFERENT, non-apex, non-matching-environment host
	// keeps this canary out of BOTH prod-wired signals (prodWiredCanaryHosts
	// is exercised on its own elsewhere) — this test is about the expired
	// badge specifically, so it stays clear of the prod-wired one.
	routes := []RouteView{
		{Host: "a.example.com", Channel: "stable", Environment: "prod-env"},
		{Host: "rc.example.com", Channel: "canary/x"},
	}

	rungs := assembleLadder(channels, routes, nil, now)
	var canary *LadderRung
	for i := range rungs {
		if rungs[i].Rung == release.RungCanary {
			canary = &rungs[i]
		}
	}
	if canary == nil || len(canary.Channels) != 1 || len(canary.Channels[0].Routes) != 1 {
		t.Fatalf("canary rung = %+v, want one channel with one route", canary)
	}
	rt := canary.Channels[0].Routes[0]
	if !rt.Expired {
		t.Fatal("a canary promoted more than CanaryTTL ago must be marked Expired")
	}
	if rt.ExpiredFor != "8d" {
		t.Errorf("ExpiredFor = %q, want \"8d\"", rt.ExpiredFor)
	}
	if !rt.Canary {
		t.Error("an expired canary route must still carry the ordinary canary flag")
	}

	// Render it through the real template — proves the badge actually
	// reaches the page, with the icon and the age, beside the plain canary
	// badge rather than instead of it.
	p := page{Base: "/a/bab", Role: RoleOwner, CanPromote: true,
		Detail: &AppView{App: "demo", Ladder: rungs}}
	var buf bytes.Buffer
	if err := templates.ExecuteTemplate(&buf, "ladder", p); err != nil {
		t.Fatalf("render ladder: %v", err)
	}
	html := buf.String()
	line := routeLine(t, rungBlock(t, html, "canary"), "rc.example.com")
	if !strings.Contains(line, "chip-expired") {
		t.Errorf("rendered route carries no chip-expired badge:\n%s", line)
	}
	if !strings.Contains(line, "8d") {
		t.Errorf("rendered badge does not show the age:\n%s", line)
	}
	if !strings.Contains(line, "chip-canary") {
		t.Errorf("the expired badge replaced the ordinary canary badge instead of sitting beside it:\n%s", line)
	}
	if !strings.Contains(line, "<svg") {
		t.Error("the expired badge is a text glyph, not an icon")
	}
}

// A channel that has not yet reached CanaryTTL contributes nothing to
// canaryExpiry's map — the direct unit-level twin of the fixture-based fresh
// test above, pinned at the function boundary rather than through HTTP.
func TestCanaryExpiryOmitsUnexpiredChannels(t *testing.T) {
	now := time.Now()
	channels := []ChannelView{
		{Name: "canary/fresh", PromotedAt: now},
		{Name: "canary/old", PromotedAt: now.Add(-(release.CanaryTTL + time.Hour))},
		{Name: "stable", PromotedAt: now.Add(-365 * 24 * time.Hour)}, // no TTL at all
		{Name: "canary/broken", PromotedAt: now.Add(-365 * 24 * time.Hour), Err: "unreadable"},
	}
	got := canaryExpiry(channels, now)
	if _, ok := got["canary/fresh"]; ok {
		t.Error("a fresh canary must not appear in the expiry map")
	}
	if _, ok := got["stable"]; ok {
		t.Error("stable carries no TTL and must never appear in the expiry map")
	}
	if _, ok := got["canary/broken"]; ok {
		t.Error("a channel whose pointer errored must not be guessed at as expired")
	}
	if _, ok := got["canary/old"]; !ok {
		t.Error("an old canary must appear in the expiry map")
	}
}

// seedExpiredCanary hand-signs a canary pointer whose lease ran out long
// ago — every public promotion path stamps the real clock, so forging
// PromotedAt in the wrapper is the only way to put an EXPIRED canary in
// front of a console under test (the same technique, for the same reason,
// as internal/release's writeBackdatedPointer, which is deliberately not
// exported).
func seedExpiredCanary(t *testing.T, fx *consoleFixture, app, channel, version string) {
	t.Helper()
	p := &release.ChannelPointer{Schema: 1, App: app, Channel: channel,
		Version: version, PromotedAt: time.Now().Add(-(release.CanaryTTL + 30*24*time.Hour))}
	payload, err := json.Marshal(p)
	if err != nil {
		t.Fatal(err)
	}
	b64 := base64.StdEncoding.EncodeToString(payload)
	wrapper, err := json.Marshal(struct {
		Payload string `json:"payload"`
		Sig     string `json:"sig"`
	}{b64, base64.StdEncoding.EncodeToString(ed25519.Sign(fx.priv, []byte(b64)))})
	if err != nil {
		t.Fatal(err)
	}
	if _, err := fx.rel.Put(context.Background(),
		release.ChannelKey(release.OpsAccount, app, channel), wrapper, ""); err != nil {
		t.Fatal(err)
	}
}

// TestLadderPromotesOntoAnExpiredCanary pins spec §5's visibility-only
// contract at the one surface the release-layer pins cannot reach: the
// console's promote handler. An expired canary is exactly where the next
// build lands when work on that branch resumes, and a "this canary expired"
// gate here — however well-meant a confirmation might look — would turn a
// guard rail into an obstacle at the moment it is least wanted. (2026-08-03
// review, IMPORTANT 1: a mutation gating handlePromote on expiry failed
// zero tests before this one existed.)
func TestLadderPromotesOntoAnExpiredCanary(t *testing.T) {
	fx := newConsoleFixture(t)
	shipVersion(t, fx, "kass", "v8")
	seedExpiredCanary(t, fx, "kass", "canary/old-branch", "v1")
	c := signInPaul(t, fx)
	csrf := sessionToken(t, fx, c)

	status, _, body := postForm(t, c, fx.u("/apps/kass/promote"),
		url.Values{"csrf": {csrf}, "channel": {"canary/old-branch"}, "version": {"v8"}, "confirmed": {"1"}})
	if status != http.StatusSeeOther {
		t.Fatalf("promotion onto an expired canary = %d, want 303:\n%s", status, body)
	}
	if p := fx.channelVersion(t, "kass", "canary/old-branch"); p.Version != "v8" {
		t.Fatalf("expired canary still holds %s — expiry has become a gate", p.Version)
	}
}

// The bake status line and its controls (spec §7): off-by-default says so;
// an owner gets the turn-on/turn-off controls; a held channel row offers
// the owner fast-track; the stable promote form carries the enable_bake
// prompt while the flag is off.
func TestLadderShowsBakeStateAndControls(t *testing.T) {
	fx := newConsoleFixture(t)
	shipVersion(t, fx, "kass", "v3")
	seedChannel(t, fx, "kass", "beta", "v3")
	c := signInPaul(t, fx)

	csrf := sessionToken(t, fx, c)
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	if !strings.Contains(body, "Safety delay") {
		t.Fatalf("no safety-delay status line:\n%s", body)
	}
	if !strings.Contains(body, `action="/a/bab/apps/kass/production"`) {
		t.Fatal("owner is offered no production toggle")
	}
	// Off by default, and the stable promote form asks the question — now on
	// the confirm card the un-confirmed promote returns, not the ladder
	// itself (the checkbox moved there; see confirm.go's confirmPromote).
	_, _, confirmBody := postForm(t, c, fx.u("/apps/kass/promote"),
		url.Values{"csrf": {csrf}, "channel": {"stable"}, "version": {"v3"}})
	if !strings.Contains(confirmBody, `name="enable_bake"`) {
		t.Fatal("the stable promote confirm card does not carry the enable_bake prompt")
	}

	// Flip on; the held beta head now shows its window and the fast-track
	// control appears on it.
	if err := release.SetProduction(context.Background(), fx.rel, fx.priv,
		release.OpsAccount, "kass", true, "test"); err != nil {
		t.Fatal(err)
	}
	_, _, body = get(t, c, fx.u("/apps/kass/releases"))
	if !strings.Contains(body, `action="/a/bab/apps/kass/fasttrack"`) {
		t.Fatalf("no fast-track control on a held head:\n%s", rungBlock(t, body, "beta"))
	}
	if !strings.Contains(body, `name="production" value="off"`) {
		t.Fatal("owner is offered no turn-off control once bake is on")
	}
	// The confirm card's checkbox no longer offers to enable the bake once
	// it's already on.
	_, _, confirmBody = postForm(t, c, fx.u("/apps/kass/promote"),
		url.Values{"csrf": {csrf}, "channel": {"stable"}, "version": {"v3"}})
	if strings.Contains(confirmBody, `name="enable_bake"`) {
		t.Fatal("the enable_bake prompt survived the flag turning on")
	}

	// Waive it; the badge is permanent and the control is gone.
	if _, err := release.FastTrack(context.Background(), fx.rel, fx.priv,
		release.OpsAccount, "kass", "beta", "test"); err != nil {
		t.Fatal(err)
	}
	_, _, body = get(t, c, fx.u("/apps/kass/releases"))
	b := rungBlock(t, body, "beta")
	if !strings.Contains(b, "delay skipped") {
		t.Errorf("no permanent delay-skipped badge:\n%s", b)
	}
	if strings.Contains(b, `action="/a/bab/apps/kass/fasttrack"`) {
		t.Error("a waived head still offers the fast-track control")
	}
}

// A member sees state, never the owner-only controls (off / fast-track) —
// but IS offered turn-on, the safe direction. Off-state alone would make
// the turn-off/fast-track assertions tautological (neither control is
// eligible to render for ANYONE — owner included — when the flag is off
// and no channel is held): so this also flips the flag on and confirms
// through the OWNER's own browser, first, that the controls DO render in
// that state, before checking the member does not get them in the same
// state. That ordering is what keeps the member-side absence checks from
// passing vacuously.
func TestLadderBakeControlsMemberView(t *testing.T) {
	fx := newConsoleFixture(t)
	shipVersion(t, fx, "kass", "v9")
	seedChannel(t, fx, "kass", "beta", "v9")
	c := signInPaul(t, fx)

	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	fx.setUser("sam@keymail.dev")
	cm := newBrowser(t)
	signUp(t, fx, cm, "code-sam-baketpl")

	_, _, mbody := get(t, cm, fx.u("/apps/kass/releases"))
	if !strings.Contains(mbody, "Safety delay") {
		t.Fatal("member sees no safety-delay status")
	}
	if !strings.Contains(mbody, `name="production" value="on"`) {
		t.Error("member is not offered the turn-on control")
	}
	if strings.Contains(mbody, `name="production" value="off"`) {
		t.Error("member is offered the owner-only turn-off control")
	}
	if strings.Contains(mbody, `/fasttrack"`) {
		t.Error("member is offered the owner-only fast-track control")
	}

	// Put the page into the state where turn-off and fast-track are
	// ELIGIBLE to render: flag on, with a held beta head. Confirm the
	// OWNER gets both controls in this state...
	if err := release.SetProduction(context.Background(), fx.rel, fx.priv,
		release.OpsAccount, "kass", true, "test"); err != nil {
		t.Fatal(err)
	}
	_, _, obody := get(t, c, fx.u("/apps/kass/releases"))
	if !strings.Contains(obody, `name="production" value="off"`) {
		t.Fatal("owner is not offered the turn-off control once bake is eligible — the member-only checks below would be vacuous")
	}
	if !strings.Contains(obody, `action="/a/bab/apps/kass/fasttrack"`) {
		t.Fatalf("owner is not offered the fast-track control on a held head — the member-only checks below would be vacuous:\n%s", rungBlock(t, obody, "beta"))
	}

	// ...then confirm the member does NOT, in that same eligible state.
	_, _, mbody = get(t, cm, fx.u("/apps/kass/releases"))
	if strings.Contains(mbody, `name="production" value="off"`) {
		t.Error("member is offered the owner-only turn-off control once bake is on")
	}
	if strings.Contains(mbody, `action="/a/bab/apps/kass/fasttrack"`) {
		t.Error("member is offered the owner-only fast-track control on a held head")
	}
}

// An UNREADABLE flag must not strand the app. The boxes fail toward baking
// (spec §4), so an app whose flag object will not verify — a root key
// rotation makes this every production app at once — bakes forever, and the
// page's error text alone offers no way out. Re-declaring is the repair:
// SetProduction CASes over whatever unverifiable bytes are there.
func TestLadderUnreadableFlagOffersRepair(t *testing.T) {
	fx := newConsoleFixture(t)
	c := signInPaul(t, fx)
	if _, err := fx.rel.Put(context.Background(),
		release.ProductionKey(release.OpsAccount, "kass"), []byte("{not a wrapper"), ""); err != nil {
		t.Fatal(err)
	}
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	if !strings.Contains(body, "Safety delay: this app's setting can't be read right now, so the delay stays on.") {
		t.Fatalf("no error line for an unverifiable flag:\n%s", body)
	}
	if !strings.Contains(body, `action="/a/bab/apps/kass/production"`) ||
		!strings.Contains(body, `name="production" value="on"`) {
		t.Fatalf("an unreadable flag offers no repair form — the app bakes forever:\n%s", body)
	}
	if !strings.Contains(body, "Set it again") {
		t.Fatalf("the repair control is not named as a re-declaration:\n%s", body)
	}
	// The safe direction only: turning OFF over an unverifiable flag is still
	// the owner's, through the ordinary control, and is not offered here.
	if strings.Contains(body, `name="production" value="off"`) {
		t.Error("the error branch offers turn-off; only the safe direction belongs here")
	}
	// And the repair actually lands: a member's plain POST replaces the
	// garbage with a verifiable flag.
	csrf := sessionToken(t, fx, c)
	if status, _, b := postForm(t, c, fx.u("/apps/kass/production"),
		url.Values{"csrf": {csrf}, "production": {"on"}}); status != http.StatusSeeOther {
		t.Fatalf("re-declare = %d, want 303:\n%s", status, b)
	}
	if f, err := release.GetProduction(context.Background(), fx.rel, fx.pub,
		release.OpsAccount, "kass"); err != nil || f == nil || !f.Production {
		t.Fatalf("flag = %+v, %v after the re-declaration, want a verifiable production: true", f, err)
	}
}

// The turning-off branch, through the HTML: an off-flag younger than the
// ratchet on an app with a held channel says hosts are still ratcheting, and
// offers the instant way back on (any member's, the safe direction).
func TestLadderTurningOffOffersTurnBackOn(t *testing.T) {
	fx := newConsoleFixture(t)
	shipVersion(t, fx, "kass", "v3")
	seedChannel(t, fx, "kass", "beta", "v3") // a held channel: beta bakes
	c := signInPaul(t, fx)
	ctx := context.Background()
	if err := release.SetProduction(ctx, fx.rel, fx.priv, release.OpsAccount, "kass", true, "test"); err != nil {
		t.Fatal(err)
	}
	if err := release.SetProduction(ctx, fx.rel, fx.priv, release.OpsAccount, "kass", false, "test"); err != nil {
		t.Fatal(err)
	}
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	if !strings.Contains(body, "turning off") {
		t.Fatalf("a fresh off-flag on a held app does not say hosts are still ratcheting:\n%s", body)
	}
	if !strings.Contains(body, `name="production" value="on"`) ||
		!strings.Contains(body, "Turn back on") {
		t.Fatalf("the turning-off state offers no way back on:\n%s", body)
	}
	// Not the default-off line: this app has an off-flag mid-ratchet, and
	// telling the operator new versions go live immediately would be false
	// for ~72h.
	if strings.Contains(body, "new versions go live as soon as they're promoted") {
		t.Error("mid-ratchet, the page claims new versions already go live immediately")
	}
}

// The prod-wiring nudge: a stable route with bake off gets the persistent
// recommendation line.
func TestLadderNudgesProdWiredBakeOff(t *testing.T) {
	fx := newConsoleFixture(t)
	c := signInPaul(t, fx)
	// The fixture's kass.carlosapp.dev is on stable and the flag is off (the
	// default): that IS the nudge condition.
	_, _, body := get(t, c, fx.u("/apps/kass/releases"))
	if !strings.Contains(body, "new versions go live immediately") {
		t.Fatalf("no prod-wiring nudge:\n%s", body)
	}
	if err := release.SetProduction(context.Background(), fx.rel, fx.priv,
		release.OpsAccount, "kass", true, "test"); err != nil {
		t.Fatal(err)
	}
	if _, _, body := get(t, c, fx.u("/apps/kass/releases")); strings.Contains(body, "new versions go live immediately") {
		t.Fatal("the nudge survived the flag turning on")
	}
}