package console

// The Overview dashboard's numbers and the Instances tab's one table
// (overview.go). Both assemblers are pure joins over what the app pages
// already read, so they are exercised directly here — the page tests below
// then prove the numbers actually reach a rendered page.
//
// The properties worth pinning are the ones where a plausible-looking number
// would be a lie: an unreadable stable pointer is UNKNOWN and not "not live",
// a sum over instances that reported nothing is nil and not zero, a domain
// mid-issuance needs patience and not attention, and a capped release list
// says so.

import (
	"context"
	"net/http"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/status"
)

// f64 and i64 are the pointer literals InstanceMetrics carries — nil is a
// meaningful value there (unreadable), so the tests need both.
func f64(v float64) *float64 { return &v }
func i64(v int64) *int64     { return &v }

func TestOverviewLiveVersionFromOwnedRoutes(t *testing.T) {
	view := &AppView{App: "kass", Channels: []ChannelView{
		{Name: "beta", Version: "v9"},
		{Name: "stable", Version: "v7", Err: "obsolete unreadable pointer"},
	}, Routes: []RouteView{{Host: "kass.example", Account: "bab", Channel: "edge", Version: "v9"}}}
	st := assembleOverview(view, "bab", nil, nil, boxJoin{})
	if !st.Deployment.HasReportedVersion() {
		t.Fatal("an app with a reported route version is not reported deployed")
	}
	if st.Deployment.UniformVersion() != "v9" {
		t.Fatalf("observed version = %q, want v9", st.Deployment.UniformVersion())
	}

	// A pointer with no owned route is a target, not a deployment.
	st = assembleOverview(&AppView{App: "kass", Channels: []ChannelView{{Name: "stable", Version: "v9"}}}, "bab", nil, nil, boxJoin{})
	if st.Deployment.HasReportedVersion() || st.Deployment.UniformVersion() != "" {
		t.Fatalf("a never-promoted app reads as live: %+v", st)
	}
}

// Unknown is not the same as not live. A stable pointer that will not verify
// says so — claiming "not live" would tell an owner their app is down when the
// only thing broken is this console's read of it.
func TestOverviewUnknownRouteVersionIsUnknownNotOffline(t *testing.T) {
	view := &AppView{App: "kass", Channels: []ChannelView{
		{Name: "stable", Err: "signature does not verify"},
	}, Routes: []RouteView{{Host: "kass.example", Account: "bab", Channel: "stable"}}}
	st := assembleOverview(view, "bab", nil, nil, boxJoin{})
	if st.Deployment.HasReportedVersion() {
		t.Fatal("an unreadable pointer was reported as a known live version")
	}
	if st.Deployment.UniformVersion() != "" {
		t.Fatalf("observed version = %q, want nothing claimed from an unreadable pointer", st.Deployment.UniformVersion())
	}
	if st.Verdict != "unknown" {
		t.Fatalf("Verdict = %q, want unknown for an address with no version report", st.Verdict)
	}
}

// The tiles render an em-dash for "no readings", never zeros — so the sums
// have to stay nil when nothing reported, and must cover only the instances
// that actually did. The instance COUNT comes from the routes, so a failed
// sweep (nil metrics) reads as readings-unavailable, never as a hostless app,
// and another account's same-named routes count for nothing at all.
func TestOverviewSumsOnlyReportingInstances(t *testing.T) {
	view := &AppView{App: "kass", Routes: []RouteView{
		{Host: "a", Account: "bab", Kind: "instance"},
		{Host: "b", Account: "bab", Kind: "instance"},
		{Host: "c", Account: "bab", Kind: "instance"},
		{Host: "d", Account: "bab", Kind: "instance", Hibernate: true},
		{Host: "e", Account: "bab", Kind: "instance"},
		// Another account's same-named app: not this dashboard's instance.
		{Host: "theirs", Account: "cdef", Kind: "instance"},
	}}
	metrics := []InstanceMetrics{
		{Host: "a", Box: "box-1", CPUFrac: f64(0.25), MemBytes: i64(100)},
		{Host: "b", Box: "box-1", CPUFrac: f64(0.5), MemBytes: i64(200)},
		// Reporting, but this metric was unreadable: contributes nothing.
		{Host: "c", Box: "box-2"},
		// Not reporting at all, with numbers that must NOT be counted.
		{Host: "d", CPUFrac: f64(99), MemBytes: i64(99), Hibernate: true},
		{Host: "e"},
	}
	st := assembleOverview(view, "bab", metrics, nil, boxJoin{})
	if st.InstanceTotal != 5 {
		t.Fatalf("InstanceTotal = %d, want 5 (the routes, not the sweep, and never another account's)", st.InstanceTotal)
	}
	if st.InstanceReporting != 3 {
		t.Fatalf("InstanceReporting = %d, want 3", st.InstanceReporting)
	}
	if st.InstanceAsleep != 1 {
		t.Fatalf("InstanceAsleep = %d, want only the hibernating non-reporter", st.InstanceAsleep)
	}
	if st.CPUSum == nil || *st.CPUSum != 0.75 {
		t.Fatalf("CPUSum = %v, want 0.75 — the non-reporters must not be summed", st.CPUSum)
	}
	if st.MemSum == nil || *st.MemSum != 300 {
		t.Fatalf("MemSum = %v, want 300", st.MemSum)
	}
	if st.MetricsUnavailable {
		t.Fatal("a sweep that ran reads as unavailable")
	}

	// Nobody reported: nil, not zero. A zero here would render as "0%" and
	// claim an idle app where there is simply no reading.
	quietView := &AppView{App: "kass", Routes: []RouteView{{Host: "a", Account: "bab", Kind: "instance"}, {Host: "b", Account: "bab", Kind: "instance"}}}
	quiet := assembleOverview(quietView, "bab", []InstanceMetrics{{Host: "a"}, {Host: "b"}}, nil, boxJoin{})
	if quiet.CPUSum != nil || quiet.MemSum != nil {
		t.Fatalf("sums = %v %v with nothing reporting, want nil so the tiles show the em-dash",
			quiet.CPUSum, quiet.MemSum)
	}
	if quiet.InstanceReporting != 0 || quiet.InstanceTotal != 2 {
		t.Fatalf("quiet counts = %d/%d, want 0/2", quiet.InstanceReporting, quiet.InstanceTotal)
	}

	// The sweep FAILED (nil metrics): the count must survive — "readings
	// unavailable" is not "no hosts yet".
	failed := assembleOverview(quietView, "bab", nil, nil, boxJoin{})
	if failed.InstanceTotal != 2 {
		t.Fatalf("InstanceTotal = %d after a failed sweep, want the routes' 2", failed.InstanceTotal)
	}
	if !failed.MetricsUnavailable {
		t.Fatal("a failed sweep does not read as unavailable")
	}
}

// TestOverviewSeparatesNoReadings pins InstanceNoReadings/InstanceCounted:
// a silent instance route the sweep was never told how to sample (no
// Provisioned, Unit or Backing) is honest ignorance, not an outage, and
// must not count against the Running tile's denominator.
func TestOverviewSeparatesNoReadings(t *testing.T) {
	view := &AppView{Routes: []RouteView{
		{Host: "a.x", Kind: "instance", Account: "acct1", Provisioned: true}, // reporting
		{Host: "b.x", Kind: "instance", Account: "acct1", Provisioned: true}, // silent, expected
		{Host: "c.x", Kind: "instance", Account: "acct1"},                    // silent, bespoke-unstamped
		{Host: "d.x", Kind: "instance", Account: "acct1", Hibernate: true},   // asleep
	}, Domains: []DomainView{{}, {}, {}, {}}}
	metrics := []InstanceMetrics{{Host: "a.x", Box: "box1"}}
	st := assembleOverview(view, "acct1", metrics, nil, boxJoin{})
	if st.InstanceExpected != 4 || st.InstanceReporting != 1 || st.InstanceAsleep != 1 ||
		st.InstanceNoReadings != 1 || st.InstanceCounted != 3 {
		t.Fatalf("counts: %+v", st)
	}
}

// TestVerdictIgnoresNoReadings pins that healthVerdict's shortfall case
// compares against InstanceCounted, not InstanceExpected — a no-readings
// row must not trip "attention" (the 2026-08-10 tito false alarm).
func TestVerdictIgnoresNoReadings(t *testing.T) {
	// 1 reporting + 1 asleep + 1 no-readings out of 3 counted... construct an
	// OverviewStats where Reporting+Asleep == InstanceCounted and assert the
	// verdict is NOT "attention" on account of the no-readings row.
	st := OverviewStats{Deployment: DeploymentStatus{RouteCount: 3, ReportableCount: 3, ReportedCount: 3}, InstanceExpected: 3, InstanceCounted: 2,
		InstanceReporting: 1, InstanceAsleep: 1, InstanceNoReadings: 1}
	if v, _ := healthVerdict(st); v != "ok" {
		t.Fatalf("no-readings rows must not trip the verdict: %s", v)
	}
}

// Attention means someone has to do something: DNS that is not pointing here,
// or issuance that failed. A cert mid-issuance is patience, not attention —
// badging it would make every new domain look broken for its first minute.
func TestOverviewDomainAttentionCountsGuidanceAndFailedTLS(t *testing.T) {
	// Domains are counted through their PARALLEL routes (that is where the
	// account lives), so the view carries both — including another tenant's
	// same-named row, whose failed cert must not wave on this dashboard.
	view := &AppView{App: "kass",
		Routes: []RouteView{
			{Host: "a.example.com", Account: "bab"},
			{Host: "b.example.com", Account: "bab"},
			{Host: "c.example.com", Account: "bab"},
			{Host: "d.example.com", Account: "bab"},
			{Host: "e.example.com", Account: "bab"},
			{Host: "f.example.com", Account: "cdef"},
		},
		Domains: []DomainView{
			{Domain: "a.example.com", TLS: "ready · renews 2027-01-01"},
			{Domain: "b.example.com", TLS: "issuing"},
			{Domain: "c.example.com", TLS: ""},
			{Domain: "d.example.com", TLS: "failed: dns-01 timeout"},
			{Domain: "e.example.com", TLS: "ready", Guidance: "Point an A record for e.example.com at ..."},
			{Domain: "f.example.com", TLS: "failed: dns-01 timeout"},
		}}
	st := assembleOverview(view, "bab", nil, nil, boxJoin{})
	if st.DomainTotal != 5 {
		t.Fatalf("DomainTotal = %d, want 5 — the other account's domain is not this tenant's", st.DomainTotal)
	}
	if st.DomainAttention != 2 {
		t.Fatalf("DomainAttention = %d, want 2 (the failed cert and the unpointed domain, never the other tenant's)", st.DomainAttention)
	}
	// The one-bit read on its own, so a miscount above is attributable.
	for _, tc := range []struct {
		name string
		d    DomainView
		want bool
	}{
		{"ready", DomainView{TLS: "ready · renews 2027-01-01"}, false},
		{"issuing", DomainView{TLS: "issuing"}, false},
		{"unknown", DomainView{TLS: ""}, false},
		{"failed", DomainView{TLS: "failed: dns-01 timeout"}, true},
		{"guidance", DomainView{TLS: "ready", Guidance: "point an A record"}, true},
	} {
		if got := domainNeedsAttention(tc.d); got != tc.want {
			t.Errorf("domainNeedsAttention(%s) = %v, want %v", tc.name, got, tc.want)
		}
	}
}

// The versions list is capped, so the tile says "20+" rather than lying with
// a flat 20 — and the latest version is the newest, which is the list's head.
func TestOverviewReleasesCapped(t *testing.T) {
	full := make([]VersionView, versionsCap)
	for i := range full {
		full[i] = VersionView{Version: "v" + string(rune('a'+i))}
	}
	st := assembleOverview(&AppView{App: "kass"}, "bab", nil, full, boxJoin{})
	if st.ReleaseCount != versionsCap || !st.ReleasesCapped {
		t.Fatalf("count/capped = %d/%v, want %d/true", st.ReleaseCount, st.ReleasesCapped, versionsCap)
	}
	if st.LatestVersion != full[0].Version {
		t.Fatalf("LatestVersion = %q, want the head of the newest-first list (%q)", st.LatestVersion, full[0].Version)
	}

	short := assembleOverview(&AppView{App: "kass"}, "bab", nil, full[:versionsCap-1], boxJoin{})
	if short.ReleasesCapped {
		t.Fatalf("a list one short of the cap was reported capped (%d)", short.ReleaseCount)
	}
	none := assembleOverview(&AppView{App: "kass"}, "bab", nil, nil, boxJoin{})
	if none.ReleaseCount != 0 || none.ReleasesCapped || none.LatestVersion != "" {
		t.Fatalf("empty release list = %+v, want zeros and no version", none)
	}
}

// The join key is the host — the one name owners have for an instance — and
// an unswept route still gets its row, with Reporting false rather than zeros.
func TestInstanceRowsJoinMetricsByHost(t *testing.T) {
	acct := &Account{ID: 1, Sqid: "bab"}
	view := &AppView{App: "kass", Routes: []RouteView{
		{Host: "a.example.com", Account: "bab", Channel: "stable", Version: "v1", Kind: "instance", Status: "ready"},
		{Host: "b.example.com", Account: "bab", Channel: "canary/x", Kind: "instance", Status: "", Hibernate: true},
	}}
	metrics := []InstanceMetrics{
		{Host: "b.example.com", Box: "box-1", CPUFrac: f64(0.1)},
		{Host: "ghost.example.com", Box: "box-1", CPUFrac: f64(9)},
	}
	rows := assembleInstanceRows(view, acct, metrics)
	if len(rows) != 2 {
		t.Fatalf("rows = %+v, want one per route (a metrics row for an unrouted host adds nothing)", rows)
	}
	if rows[0].Host != "a.example.com" || rows[0].Metrics.Reporting() {
		t.Fatalf("row[0] = %+v, want the unswept route present and not reporting", rows[0])
	}
	// The registry contract: an empty status means ready, and the table must
	// not print a blank cell for the commonest state there is.
	if rows[1].Status != "ready" {
		t.Fatalf("row[1].Status = %q, want the empty registry status rendered as \"ready\"", rows[1].Status)
	}
	if rows[0].Status != "ready" {
		t.Fatalf("row[0].Status = %q, want its own explicit status kept", rows[0].Status)
	}
	if !rows[1].Hibernate {
		t.Fatal("the route's hibernation setting did not reach its row")
	}
	if !rows[1].Metrics.Reporting() || rows[1].Metrics.CPUFrac == nil || *rows[1].Metrics.CPUFrac != 0.1 {
		t.Fatalf("row[1].Metrics = %+v, want the sweep's reading joined by host", rows[1].Metrics)
	}
	if rows[0].Channel != "stable" || rows[1].Channel != "canary/x" || rows[0].Version != "v1" {
		t.Fatalf("rows lost their route facts: %+v", rows)
	}
}

// The tenant boundary, kept byte-for-byte with appResourceMetrics': routes are
// grouped by app NAME and app names are unique per ACCOUNT, so another
// account's route can legitimately arrive in this view — and must not become a
// row on this page.
func TestInstanceRowsSkipOtherAccountsRoutes(t *testing.T) {
	acct := &Account{ID: 1, Sqid: "bab"}
	view := &AppView{App: "kass", Routes: []RouteView{
		{Host: "mine.example.com", Account: "bab", Channel: "stable"},
		{Host: "theirs.example.com", Account: "cdef", Channel: "stable"},
	}}
	metrics := []InstanceMetrics{{Host: "theirs.example.com", Box: "box-9", CPUFrac: f64(0.9)}}
	rows := assembleInstanceRows(view, acct, metrics)
	if len(rows) != 1 || rows[0].Host != "mine.example.com" {
		t.Fatalf("rows = %+v, want only the viewing account's own route", rows)
	}
}

// healthWord is the Instances table's whole Health column: provisioning
// state and hibernation and liveness folded into the one word an owner
// reads across the table.
func TestInstanceRowHealthWord(t *testing.T) {
	cases := []struct {
		kind, status string
		hibernate    bool
		reporting    bool
		expect       bool
		want         string
	}{
		{"instance", "ready", false, true, true, "Running"},
		{"instance", "ready", true, false, true, "Asleep"},
		{"instance", "ready", false, false, true, "Not responding"},
		{"instance", "starting", false, false, true, "Setting up"},
		{"instance", "pending", false, false, true, "Setting up"},
		{"instance", "creating", false, false, true, "Setting up"},
		{"instance", "issuing", false, false, true, "Setting up"},
		{"instance", "failed", false, false, true, "Failed"},
		{"static", "ready", false, false, true, "Serving"},
		{"service", "ready", false, false, true, "Serving"},
		// silent + expected to report stays the red word
		{kind: "instance", status: "ready", hibernate: false, reporting: false, expect: true, want: "Not responding"},
		// silent + nobody could sample it = honest ignorance, not an outage
		{kind: "instance", status: "ready", hibernate: false, reporting: false, expect: false, want: "No readings"},
		// hibernation still wins over both
		{kind: "instance", status: "ready", hibernate: true, reporting: false, expect: false, want: "Asleep"},
	}
	for _, c := range cases {
		got := healthWord(c.kind, c.status, c.hibernate, c.reporting, c.expect)
		if got != c.want {
			t.Errorf("healthWord(%q,%q,hib=%v,rep=%v,expect=%v) = %q, want %q", c.kind, c.status, c.hibernate, c.reporting, c.expect, got, c.want)
		}
	}
}

// TestSidecarHealthWordVocabulary: a sidecar never serves a request, so
// "Serving" — the catch-all for every non-instance kind — is simply false
// for it (the bug this pins). Sidecars get their own five words instead:
// Running, Asleep, Waking, Crashed, Never started.
func TestSidecarHealthWordVocabulary(t *testing.T) {
	cases := []struct {
		status    string
		hibernate bool
		reporting bool
		expect    bool
		want      string
	}{
		{"ready", false, true, true, "Running"},         // reporting a version over the socket
		{"ready", true, false, true, "Asleep"},          // hibernating, not reporting
		{"ready", false, false, true, "Crashed"},        // platform runs it, silent — presumed crashed
		{"ready", false, false, false, "Never started"}, // never provisioned to run yet
		{"starting", false, false, false, "Waking"},
		{"pending", false, false, false, "Waking"},
		{"creating", false, false, false, "Waking"},
		{"issuing", false, false, false, "Waking"},
		{"failed", false, false, false, "Crashed"},
	}
	for _, c := range cases {
		got := healthWord("sidecar", c.status, c.hibernate, c.reporting, c.expect)
		if got != c.want {
			t.Errorf("healthWord(sidecar,%q,hib=%v,rep=%v,expect=%v) = %q, want %q",
				c.status, c.hibernate, c.reporting, c.expect, got, c.want)
		}
		if got == "Serving" {
			t.Errorf("healthWord(sidecar,...) = Serving — a sidecar never serves a request")
		}
	}
}

// TestSidecarHealthWordsAreFilterable pins listquery.go's contract that
// "a new word joins healthWord, this list, and nothing else" — a sidecar
// word missing from healthWords would silently break the Running tab's
// health filter and its URL slug for that word.
func TestSidecarHealthWordsAreFilterable(t *testing.T) {
	for _, w := range []string{"Waking", "Crashed", "Never started"} {
		if healthFromSlug(healthSlug(w)) != w {
			t.Errorf("healthWords is missing %q — its filter/slug round trip is broken", w)
		}
	}
}

// expectsReadings is the one rule for whether silence from a route's process
// means something: the platform runs the process (provisioned, or a
// carlos-app@ tenant) or a stamped unit tells the sweep where to look.
// Anything else — a manually-added route whose process some bespoke,
// unstamped unit owns — is honest ignorance, not an outage.
func TestExpectsReadings(t *testing.T) {
	cases := []struct {
		provisioned   bool
		unit, backing string
		want          bool
	}{
		{true, "", "", true},                    // instances-API-minted: activator-run
		{false, "titogo@x.service", "", true},   // stamped: the sweep samples it
		{false, "", registry.BackingUnit, true}, // carlos-app@ tenant
		{false, "", "", false},                  // manual exec-shaped row: can't tell
	}
	for _, c := range cases {
		if got := expectsReadings(c.provisioned, c.unit, c.backing); got != c.want {
			t.Fatalf("expectsReadings(%v,%q,%q) = %v", c.provisioned, c.unit, c.backing, got)
		}
	}
}

// The Overview page is the tiles, and only the tiles: the ladder moved to the
// Releases tab, and a copy left behind here would be two places to read the
// same state from.
func TestOverviewPageRendersTiles(t *testing.T) {
	fx := newConsoleFixture(t)
	c := signInPaul(t, fx)

	status, _, body := get(t, c, fx.u("/apps/kass"))
	if status != http.StatusOK {
		t.Fatalf("overview page = %d:\n%s", status, body)
	}
	if !strings.Contains(body, `class="tile"`) {
		t.Fatalf("no tiles on the Overview:\n%s", body)
	}
	// The fixture's stable holds v1 — the number the headline exists to show.
	if !strings.Contains(body, "<code>v1</code>") {
		t.Fatalf("the headline does not show what stable serves:\n%s", body)
	}
	// A channel pointer's promotion time does not say when each route adopted
	// it, so the observed deployment summary must not present that timestamp
	// as adoption provenance.
	if strings.Contains(body, "published") {
		t.Fatalf("the observed deployment invents provenance from a channel pointer:\n%s", body)
	}
	// The fixture's two domains need attention, which outranks everything
	// else in healthVerdict — the headline verdict this page exists to show.
	if !strings.Contains(body, "Needs attention") {
		t.Fatalf("the headline verdict is missing:\n%s", body)
	}
	if !strings.Contains(body, "<h2>Running</h2>") {
		t.Fatalf("no Running tile on the Overview:\n%s", body)
	}
	// "Machines" implied one computer per row when several rows routinely
	// share a box, and its count was byte-for-byte the Web addresses count
	// beside it. Both the word and the duplicate are meant to stay gone.
	if strings.Contains(body, "Machines") || strings.Contains(body, "machines") {
		t.Fatalf("the Overview still talks about machines:\n%s", body)
	}
	if strings.Contains(body, "stable pointer unreadable") {
		t.Fatalf("stale tile copy still rendered:\n%s", body)
	}
	if strings.Contains(body, "Supply-chain bake") {
		t.Fatalf("the Overview still says Supply-chain bake:\n%s", body)
	}
	if strings.Contains(body, `id="rung-`) {
		t.Fatalf("the ladder is still rendered on the Overview:\n%s", body)
	}
}

// flowSection returns just the diagram's markup. The console inlines its
// whole stylesheet into every page, so `.flow-stage.is-carried` and friends
// are present in the CSS on a page that draws no diagram at all — an
// unscoped Contains would assert on the rules instead of the drawing.
func flowSection(t *testing.T, page string) string {
	t.Helper()
	i := strings.Index(page, `<section class="flow"`)
	if i < 0 {
		t.Fatalf("no flow diagram on the page:\n%s", page)
	}
	j := strings.Index(page[i:], "</section>")
	if j < 0 {
		t.Fatalf("the flow section is never closed:\n%s", page[i:])
	}
	return page[i : i+j]
}

// The flow diagram is the Overview's answer to "what is going on" — the
// release path drawn as a path, with each address hanging off the channel
// that feeds it. These assertions cover what a reader has to be able to see;
// flow_test.go covers what the drawing is allowed to claim.
func TestOverviewDrawsTheFlow(t *testing.T) {
	fx := newConsoleFixture(t)
	c := signInPaul(t, fx)
	_, _, page := get(t, c, fx.u("/apps/kass"))

	// Scoped to the section, deliberately: the page carries its stylesheet
	// inline, so every class name this test looks for also appears in the
	// CSS above it, and a whole-body assertion would pass on the rules
	// rather than on the drawing.
	body := flowSection(t, page)
	// The whole path, including the steps this app has not reached: a path
	// drawn only as far as the app has travelled reads as a path with no
	// further to go.
	for _, label := range []string{"you shipped", "edge", "beta", "live"} {
		if !strings.Contains(body, `<p class="flow-label">`+label+"</p>") {
			t.Fatalf("the flow is missing its %q box:\n%s", label, body)
		}
	}
	// The addresses hang off the diagram, each with the same health word the
	// Running tab would give it — and as real links, since the point of an
	// address is that you can go to it.
	if !strings.Contains(body, `<a href="https://kass.carlosapp.dev">kass.carlosapp.dev</a>`) {
		t.Fatalf("the flow does not show the app's address as a link:\n%s", body)
	}
	// The fixture's silent host carries no Backing/Unit/Provisioned — a
	// manually-added-shaped route the sweep was never told how to sample —
	// so its silence is honest ignorance ("No readings"/idle), not an
	// outage ("Not responding"/bad); TestFlowTonesAddressHealth in
	// flow_test.go pins the "Not responding" -> bad mapping directly.
	if !strings.Contains(body, `class="flow-addr flow-tone-idle"`) {
		t.Fatalf("the fixture's silent, unstamped host should be toned idle (honest ignorance):\n%s", body)
	}
	// The fixture ships v2 but only has v1 live, so nothing has travelled the
	// whole path: no step may claim it has.
	if strings.Contains(body, "is-carried") {
		t.Fatalf("v2 is not live, so no step carried it:\n%s", body)
	}
}

// The Instances tab's one table, with the columns an owner reads across.
func TestOverviewInstancesPageRendersTable(t *testing.T) {
	fx := newConsoleFixture(t)
	c := signInPaul(t, fx)

	status, _, body := get(t, c, fx.u("/apps/kass/instances"))
	if status != http.StatusOK {
		t.Fatalf("instances page = %d:\n%s", status, body)
	}
	for _, th := range []string{"Address", "Health", "Version", "Channel", "CPU", "Memory"} {
		if !strings.Contains(body, `<th scope="col">`+th+"</th>") {
			t.Fatalf("the instances table has no %s column:\n%s", th, body)
		}
	}
	// And the fixture's own routes are the rows — a header-only table would
	// pass every assertion above.
	if !strings.Contains(body, "kass.carlosapp.dev") || !strings.Contains(body, "<code>stable</code>") {
		t.Fatalf("the app's routes are not listed in the table:\n%s", body)
	}
}

func TestInstancesPageFilters(t *testing.T) {
	fx := newConsoleFixture(t)
	c := signInPaul(t, fx)
	status, _, body := get(t, c, fx.u("/apps/kass/instances?q=zzz-no-such-host"))
	if status != http.StatusOK || !strings.Contains(body, "No addresses match.") {
		t.Fatalf("filtered-empty state missing (%d):\n%s", status, body)
	}
	status, _, body = get(t, c, fx.u("/apps/kass/instances?health=running"))
	if status != http.StatusOK {
		t.Fatalf("health filter = %d", status)
	}
}

func TestOverviewVerdict(t *testing.T) {
	cases := []struct {
		name    string
		st      OverviewStats
		verdict string
		label   string
	}{
		{"all good", OverviewStats{Deployment: DeploymentStatus{RouteCount: 2, ReportableCount: 2, ReportedCount: 2}, InstanceExpected: 2, InstanceCounted: 2, InstanceReporting: 2}, "ok", "All good"},
		{"asleep counts as accounted for", OverviewStats{Deployment: DeploymentStatus{RouteCount: 2, ReportableCount: 2, ReportedCount: 2}, InstanceExpected: 2, InstanceCounted: 2, InstanceReporting: 1, InstanceAsleep: 1}, "ok", "All good"},
		{"silent instance", OverviewStats{Deployment: DeploymentStatus{RouteCount: 2, ReportableCount: 2, ReportedCount: 2}, InstanceExpected: 2, InstanceCounted: 2, InstanceReporting: 1}, "attention", "Needs attention"},
		{"domain attention", OverviewStats{Deployment: DeploymentStatus{RouteCount: 1, ReportableCount: 1, ReportedCount: 1}, InstanceExpected: 1, InstanceCounted: 1, InstanceReporting: 1, DomainAttention: 1}, "attention", "Needs attention"},
		{"not deployed", OverviewStats{}, "notdeployed", "Not deployed yet"},
		{"route version unknown", OverviewStats{Deployment: DeploymentStatus{RouteCount: 1, ReportableCount: 1, UnknownCount: 1}}, "unknown", "Can't tell right now"},
		{"partial route versions", OverviewStats{Deployment: DeploymentStatus{RouteCount: 2, ReportableCount: 2, ReportedCount: 1, UnknownCount: 1}, InstanceExpected: 2, InstanceCounted: 2, InstanceReporting: 2}, "unknown", "Can't tell right now"},
		{"attention outranks partial versions", OverviewStats{Deployment: DeploymentStatus{RouteCount: 2, ReportableCount: 2, ReportedCount: 1, UnknownCount: 1}, InstanceExpected: 2, InstanceCounted: 2, InstanceReporting: 1}, "attention", "Needs attention"},
		{"sweep failed with instances expected", OverviewStats{Deployment: DeploymentStatus{RouteCount: 1, ReportableCount: 1, ReportedCount: 1}, InstanceExpected: 1, MetricsUnavailable: true}, "unknown", "Can't tell right now"},
		{"static-only app has nothing expected", OverviewStats{Deployment: DeploymentStatus{RouteCount: 1}, InstanceExpected: 0, MetricsUnavailable: true}, "ok", "All good"},
	}
	for _, c := range cases {
		v, l := healthVerdict(c.st)
		if v != c.verdict || l != c.label {
			t.Errorf("%s: got %q/%q, want %q/%q", c.name, v, l, c.verdict, c.label)
		}
	}
}

func TestOverviewAndAppListAgreeWhenFailedRouteHasNoVersion(t *testing.T) {
	view := AppView{App: "kass", Routes: []RouteView{{
		Host: "kass.example", Account: "bab", Kind: "instance", Status: "failed", Provisioned: true,
	}}}
	row := summarize(view, "bab")
	overview := assembleOverview(&view, "bab", []InstanceMetrics{}, nil, boxJoin{})
	if row.Verdict != "attention" || overview.Verdict != "attention" {
		t.Fatalf("list=%q overview=%q, want attention on both pages", row.Verdict, overview.Verdict)
	}
}

func TestOverviewIgnoresPlatformAliasWithoutInventingStaticVersion(t *testing.T) {
	view := AppView{
		App: "site",
		Routes: []RouteView{
			{Host: "site.example", Account: "bab", Kind: "static", Channel: "edge"},
			{Host: "site.bab.oncarlos.com", Account: "bab", Platform: true},
		},
		Channels: []ChannelView{{Name: "edge", Version: "site-v3"}},
	}
	st := assembleOverview(&view, "bab", []InstanceMetrics{}, nil, boxJoin{})
	if st.Verdict != "ok" || st.Deployment.RouteCount != 1 || st.Deployment.ReportableCount != 0 || st.Deployment.HasReportedVersion() {
		t.Fatalf("overview = %+v, want a healthy static deployment with no invented observation", st)
	}
}

func TestServiceOnlyAppIsPresentAndHealthyOnBothPages(t *testing.T) {
	view := AppView{App: "proxy", Routes: []RouteView{{Host: "proxy.example", Account: "bab", Kind: "service", Status: "ready"}}}
	row := summarize(view, "bab")
	overview := assembleOverview(&view, "bab", []InstanceMetrics{}, nil, boxJoin{})
	if row.Verdict != "ok" || overview.Verdict != "ok" || !overview.Deployment.HasRoutes() || overview.Deployment.ReportableCount != 0 {
		t.Fatalf("list=%+v overview=%+v, want a present healthy service with no version report", row, overview)
	}
}

func TestStaticPlusSilentInstanceIsUnknownOnBothPages(t *testing.T) {
	view := AppView{App: "mixed-kind", Routes: []RouteView{
		{Host: "site.example", Account: "bab", Kind: "static"},
		{Host: "app.example", Account: "bab", Kind: "instance"},
	}}
	row := summarize(view, "bab")
	overview := assembleOverview(&view, "bab", []InstanceMetrics{}, nil, boxJoin{})
	if row.Verdict != "unknown" || overview.Verdict != "unknown" {
		t.Fatalf("list=%q overview=%q, want unknown on both pages", row.Verdict, overview.Verdict)
	}
	if got := overview.Deployment.ReportingText(); got != "0 of 1 instances report a version." {
		t.Fatalf("reporting text = %q", got)
	}
}

func TestPlatformOnlyFailureDoesNotCreateCrossPageAttention(t *testing.T) {
	view := AppView{App: "alias", Routes: []RouteView{{
		Host: "alias.bab.oncarlos.com", Account: "bab", Platform: true, Status: "failed",
	}}, Domains: []DomainView{{Guidance: "ignored platform guidance"}}}
	row := summarize(view, "bab")
	overview := assembleOverview(&view, "bab", []InstanceMetrics{}, nil, boxJoin{})
	if row.Verdict != "notdeployed" || overview.Verdict != "notdeployed" {
		t.Fatalf("list=%q overview=%q, want notdeployed on both pages", row.Verdict, overview.Verdict)
	}
}

func TestOverviewExpectedCountsInstanceKindOnly(t *testing.T) {
	view := &AppView{App: "kass", Routes: []RouteView{
		{Host: "a", Account: "bab", Kind: "instance"},
		{Host: "b", Account: "bab", Kind: "static"},
		{Host: "c", Account: "other", Kind: "instance"},
	}}
	st := assembleOverview(view, "bab", []InstanceMetrics{}, nil, boxJoin{})
	if st.InstanceExpected != 1 {
		t.Errorf("InstanceExpected = %d, want 1 (instance-kind, this account only)", st.InstanceExpected)
	}
	if st.Verdict == "" || st.VerdictLabel == "" {
		t.Error("assembleOverview must fill Verdict and VerdictLabel")
	}
}

// TestOverviewCountsSidecarsSeparately: a sidecar is not an "instance" for
// the Running tile's purposes — it never serves a request and is never
// static either, so lumping it into InstanceTotal makes a sidecar-bearing
// app's tile lie (InstanceExpected stays 0, and the template reads that as
// "static — nothing to run"). Sidecars get their own counter instead.
func TestOverviewCountsSidecarsSeparately(t *testing.T) {
	view := &AppView{App: "eleven", Routes: []RouteView{
		{Host: "a", Account: "bab", Kind: "instance"},
		{Host: "bot.eleven.bab.sidecar.internal", Account: "bab", Kind: "sidecar"},
		{Host: "bot2.eleven.bab.sidecar.internal", Account: "bab", Kind: "sidecar"},
		// Another account's sidecar must not count here either.
		{Host: "bot.eleven.other.sidecar.internal", Account: "other", Kind: "sidecar"},
	}}
	st := assembleOverview(view, "bab", []InstanceMetrics{}, nil, boxJoin{})
	if st.InstanceTotal != 1 {
		t.Errorf("InstanceTotal = %d, want 1 — sidecars must not inflate it", st.InstanceTotal)
	}
	if st.SidecarTotal != 2 {
		t.Errorf("SidecarTotal = %d, want 2 (this account's sidecars only)", st.SidecarTotal)
	}
}

// TestOverviewDBSizeSumsEveryRouteRegardlessOfReporting: a hibernating
// instance's database is still sitting on disk even though the metrics
// sweep hears nothing from it, so the Database tile's size must come from
// the account's ROUTES (via dbJoin, the same status.BoxMetrics.RouteDBBytes
// join the instances/routes APIs already use), not be gated on the sweep
// the way CPU/Mem are. It must also stay tenant-scoped like every other
// number assembleOverview produces.
func TestOverviewDBSizeSumsEveryRouteRegardlessOfReporting(t *testing.T) {
	view := &AppView{App: "ips", Routes: []RouteView{
		{Host: "a", Account: "bab", Kind: "instance"},
		{Host: "b", Account: "bab", Kind: "instance", Hibernate: true},
		{Host: "c", Account: "bab", Kind: "instance"}, // no sized database
		{Host: "theirs", Account: "other", Kind: "instance"},
	}}
	join := boxJoin{dbBytes: map[string]int64{
		"a":      1 << 20,
		"b":      2 << 20, // asleep, unreported by the sweep, still on disk
		"theirs": 99 << 20,
	}}
	st := assembleOverview(view, "bab", nil, nil, join)
	if st.DBSizeSum == nil || *st.DBSizeSum != 3<<20 {
		t.Fatalf("DBSizeSum = %v, want 3MiB (a+b only — hibernating counts, another account never does)", st.DBSizeSum)
	}

	none := assembleOverview(&AppView{App: "kass", Routes: []RouteView{{Host: "x", Account: "bab", Kind: "instance"}}}, "bab", nil, nil, boxJoin{})
	if none.DBSizeSum != nil {
		t.Fatalf("DBSizeSum = %v with no route sized, want nil so the tile shows the em-dash", none.DBSizeSum)
	}
}

// TestAppPageShowsPartialMismatchNotFullAlarm guards the boundary
// AllMismatched exists to draw: when only SOME of an app's routes disagree
// with the viewed account, the page must name the disagreeing route(s), not
// claim the whole app is not deploying — the false alarm task 4 was written
// to retire (2026-08-10 tito incident, see the MismatchedRoute doc comment).
func TestAppPageShowsPartialMismatchNotFullAlarm(t *testing.T) {
	fx := newConsoleFixture(t)
	c := signInPaul(t, fx)

	reg, err := registry.Open(fx.regPath)
	if err != nil {
		t.Fatal(err)
	}
	moved := testAccountID()
	sqid := accountSqid(moved)
	if err := fx.st.CreateAccount(moved, sqid, "Kass", "paul@keymail.dev", time.Now()); err != nil {
		t.Fatal(err)
	}
	if err := fx.st.AddMember(moved, "paul@keymail.dev", RoleOwner, time.Now()); err != nil {
		t.Fatal(err)
	}
	// Only ONE of kass's two fixture routes moves (kass.carlosapp.dev);
	// docs.kass.carlosapp.dev stays on ops — a partial mismatch, not a full
	// one.
	if err := reg.SetAccount("kass.carlosapp.dev", sqid); err != nil {
		t.Fatal(err)
	}
	reg.Close()

	_, _, body := get(t, c, fx.u("/apps/kass"))
	if strings.Contains(body, "This app is not deploying") {
		t.Errorf("a partial mismatch must not render the full-alarm copy:\n%s", body)
	}
	if !strings.Contains(body, `/account-review`) {
		t.Errorf("the partial-mismatch banner does not link to diagnostics:\n%s", body)
	}
}

// TestAppOverviewDatabaseTileRenders: the tile shows the sized database from
// a fresh box's status, and says so plainly when nothing has been sized.
func TestAppOverviewDatabaseTileRenders(t *testing.T) {
	fx := newConsoleFixture(t)
	fx.addRoute(t, registry.Route{Host: "owned.example.com", Kind: "instance",
		Status: "ready", App: "kass", Backing: registry.BackingUnit})
	c := signInPaul(t, fx)

	_, _, body := get(t, c, fx.u("/apps/kass"))
	if !strings.Contains(body, "<h2>Database</h2>") || !strings.Contains(body, "no size reported yet") {
		t.Fatalf("unsized app: want the Database tile saying no size yet in:\n%s", body)
	}

	box := status.CollectBox(nil, status.Probes{MachineID: "box1"}, time.Now())
	box.Metrics = &status.BoxMetrics{RouteDBBytes: map[string]int64{"owned.example.com": 3 << 20}}
	if err := status.WriteBox(context.Background(), fx.rel, box); err != nil {
		t.Fatal(err)
	}
	_, _, body = get(t, c, fx.u("/apps/kass"))
	if !strings.Contains(body, "3.0 MB") || !strings.Contains(body, "on disk, including copies that are asleep") {
		t.Fatalf("sized app: want 3.0 MB on the Database tile in:\n%s", body)
	}
}