package console

// Console UI for release pipelines v2 (pipelinepage.go, ladder.go's
// pipeline-aware assembleLadder, app_overview.html's pending card,
// app_releases.html's hidden-vocabulary wrap): the three properties the
// brief pins, in the order they'd hurt if lost — a one-channel app shows
// none of the ladder's vocabulary, a multi-channel pipeline draws its own
// channels (in order, with their own gate sentence) and the settings page
// offers the two starter templates on a still-default pipeline, and the
// pending-changes card shows real quorum progress with working controls.

import (
	"context"
	"net/http"
	"net/url"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/release"
)

func TestOneChannelAppHidesChannelVocabulary(t *testing.T) {
	fx := newConsoleFixture(t)
	token := cliToken(t, fx, "paul@keymail.dev", "code-hide-vocab")
	if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new",
		map[string]string{"name": "solo"}, token); status != http.StatusOK {
		t.Fatalf("create app = %d %v", status, out)
	}

	c := signInPaul(t, fx)
	status, _, body := get(t, c, fx.u("/apps/solo/releases"))
	if status != http.StatusOK {
		t.Fatalf("app page = %d", status)
	}
	assertNoChannelVocabulary(t, body)
	// The releases list and observed-deployment summary are still there —
	// hidden means no CHANNEL vocabulary, not no page.
	if !strings.Contains(body, "Nothing shipped yet") {
		t.Errorf("one-channel app page does not show the releases list:\n%s", body)
	}
	if !strings.Contains(body, `aria-label="Release status"`) {
		t.Errorf("one-channel app page does not show the deployment summary:\n%s", body)
	}

	// Ship TWO builds and land both on the entry channel — still no
	// vocabulary. Two promotions, not one, deliberately: the second gives the
	// pointer a history, which is the state in which the rollback control
	// renders (PR #258 review, I2). Tested with one promotion, this assertion
	// passed only because the page had no rollback form to put a channel name
	// into, so it never exercised the page a real one-channel app shows.
	shipVersion(t, fx, "solo", "v1")
	shipVersion(t, fx, "solo", "v2")
	seedChannel(t, fx, "solo", "edge", "v1")
	seedChannel(t, fx, "solo", "edge", "v2")
	_, _, body2 := get(t, c, fx.u("/apps/solo/releases"))
	if !strings.Contains(body2, "Roll back") {
		t.Fatalf("this app has a rollback control by now — without it the check below proves nothing:\n%s", body2)
	}
	assertNoChannelVocabulary(t, body2)
}

// assertNoChannelVocabulary checks the RENDERED CONTENT — <main>...</main>,
// not the shared chrome above it — for the ladder's hidden words. The page's
// one shared stylesheet (layout.html's `<style>`, included on every page via
// "top") names a `.ladder` CSS class and a code comment describing it, on
// EVERY page regardless of this app's pipeline; that is chrome, not content,
// and is not what spec §5's "hide the vocabulary entirely" is about.
//
// It checks the VISIBLE-TEXT projection, not the markup: spec §5 hides the
// vocabulary from the READER, and a form field the browser never renders is
// not something anybody is shown. The rollback control has to name the
// channel it posts to somewhere — that is the door's parameter, not a word on
// the page — and a raw-markup check would force the page to choose between
// showing a rollback button and passing this test (PR #258 review, I2).
func assertNoChannelVocabulary(t *testing.T, body string) {
	t.Helper()
	_, main, ok := strings.Cut(body, "<main>")
	if !ok {
		t.Fatalf("page has no <main> to scope the check to:\n%s", body)
	}
	text := visibleText(main)
	for _, forbidden := range []string{"Promote", "edge", "ladder"} {
		if strings.Contains(text, forbidden) {
			t.Errorf("one-channel app page SHOWS %q, want the vocabulary hidden entirely.\nvisible text:\n%s", forbidden, text)
		}
	}
}

// visibleText is the crude tag stripper the assertion above needs: everything
// outside <...> and nothing inside one, so attributes, hidden input values and
// form actions drop out while every word a reader can actually see stays. Good
// enough for a rendered console page (no CDATA, no raw "<" in text — the
// templates escape it), and deliberately not a parser: a dependency-free
// assertion helper that anybody can check by eye is worth more here than
// fidelity to malformed markup.
//
// Known blind spot, named so it is a choice rather than an oversight: text
// that reaches a reader THROUGH an attribute — aria-label, alt, title,
// placeholder — is dropped with the rest of the tag, so vocabulary leaking
// via one of those (most seriously to a screen reader, which is a reader) is
// invisible to this check. If a one-channel surface ever grows such a label,
// it wants asserting directly rather than trusting this projection.
func visibleText(html string) string {
	var b strings.Builder
	inTag := false
	for _, r := range html {
		switch {
		case r == '<':
			inTag = true
		case r == '>':
			inTag = false
		case !inTag:
			b.WriteRune(r)
		}
	}
	return b.String()
}

// TestOneChannelAppKeepsCanariesAndRollback pins the other half of "hide the
// vocabulary": what must NOT be hidden with it. The one-channel guard wrapped
// the whole details block on the Releases tab, so opting into the default
// one-channel pipeline also took away the canary table, the create-canary
// form and the rollback control — none of which is channel vocabulary.
// canary/* is "always allowed" and lives outside the pipeline entirely (spec
// §2), and a rollback is a pointer write every app can need; a one-channel
// app is precisely the app with no promote step to fall back on if a bad
// build lands. The ladder, the promote form and the channel table stay gone.
func TestOneChannelAppKeepsCanariesAndRollback(t *testing.T) {
	fx := newConsoleFixture(t)
	token := cliToken(t, fx, "paul@keymail.dev", "code-solo-canary")
	if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new",
		map[string]string{"name": "solocan"}, token); status != http.StatusOK {
		t.Fatalf("create app = %d %v", status, out)
	}
	shipVersion(t, fx, "solocan", "v1")
	shipVersion(t, fx, "solocan", "v2")
	// Two promotions onto the one channel: the second gives the pointer a
	// history, which is what a rollback needs to exist at all.
	seedChannel(t, fx, "solocan", "edge", "v1")
	seedChannel(t, fx, "solocan", "edge", "v2")
	seedChannel(t, fx, "solocan", "canary/rc1", "v1")

	c := signInPaul(t, fx)
	status, _, body := get(t, c, fx.u("/apps/solocan/releases"))
	if status != http.StatusOK {
		t.Fatalf("app page = %d", status)
	}
	_, main, ok := strings.Cut(body, "<main>")
	if !ok {
		t.Fatalf("page has no <main> to scope the check to:\n%s", body)
	}
	// The canary table, with the app's live canary in it.
	if !strings.Contains(main, "canary/rc1") {
		t.Errorf("one-channel app page hides its canary table:\n%s", main)
	}
	if !strings.Contains(main, `/apps/solocan/canary/retire"`) {
		t.Errorf("one-channel app page hides the canary retire control:\n%s", main)
	}
	if !strings.Contains(main, `/apps/solocan/canary"`) {
		t.Errorf("one-channel app page hides the create-canary form:\n%s", main)
	}
	// The rollback control.
	if !strings.Contains(main, `/apps/solocan/rollback"`) {
		t.Errorf("one-channel app page hides the rollback control:\n%s", main)
	}
	if !strings.Contains(main, "Roll back") {
		t.Errorf("one-channel app page has no rollback button:\n%s", main)
	}
	// And still none of the vocabulary the one-channel rule hides: no ladder
	// rungs, no promote form, no channel column. Checked on what the page
	// SHOWS (visibleText), the same projection assertNoChannelVocabulary
	// uses — the rollback form's hidden channel field is the door's
	// parameter, not a word on the page.
	text := visibleText(main)
	for _, forbidden := range []string{"beta", "stable", "Promoting", "Promote", "ladder"} {
		if strings.Contains(text, forbidden) {
			t.Errorf("one-channel app page SHOWS %q, want the vocabulary still hidden.\nvisible text:\n%s", forbidden, text)
		}
	}
}

// TestOneChannelAppOverviewHidesFlowDiagram pins the CRITICAL finding from
// the Task 9 review: the OVERVIEW page (/a/{sqid}/apps/{app}, what spec §5
// calls "the app page") draws its own release-flow diagram
// (app_overview.html's {{template "flow" .}}, flow.go), completely
// independent of the Releases tab's ladder card — and flow.go hardcoded the
// legacy edge/beta/live path unconditionally. A one-channel pipeline must
// hide it exactly as it hides the ladder card, and with real content on the
// entry channel (a fresh, truly empty app never shows the diagram at all,
// legacy or not — Show only goes true once something is actually held or
// addressed — so this only proves the fix with something to leak).
func TestOneChannelAppOverviewHidesFlowDiagram(t *testing.T) {
	fx := newConsoleFixture(t)
	token := cliToken(t, fx, "paul@keymail.dev", "code-hide-flow")
	if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new",
		map[string]string{"name": "soloflow"}, token); status != http.StatusOK {
		t.Fatalf("create app = %d %v", status, out)
	}
	shipVersion(t, fx, "soloflow", "v1")
	seedChannel(t, fx, "soloflow", "edge", "v1")

	c := signInPaul(t, fx)
	status, _, body := get(t, c, fx.u("/apps/soloflow"))
	if status != http.StatusOK {
		t.Fatalf("app overview page = %d", status)
	}
	assertNoChannelVocabulary(t, body)
	if strings.Contains(body, "Promoting is what moves it") {
		t.Errorf("one-channel app overview page still draws the flow diagram:\n%s", body)
	}
}

// TestMultiChannelFlowDrawsPipelineChannels pins the other half of the same
// CRITICAL finding: a MULTI-channel pipelined app's flow diagram must draw
// the app's OWN declared channels, in order — not the frozen edge/beta/live
// path, which a pipeline named edge/production simply does not have.
func TestMultiChannelFlowDrawsPipelineChannels(t *testing.T) {
	fx := newConsoleFixture(t)
	token := cliToken(t, fx, "paul@keymail.dev", "code-flow-multi")
	if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new",
		map[string]string{"name": "multiflow"}, token); status != http.StatusOK {
		t.Fatalf("create app = %d %v", status, out)
	}
	if status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/multiflow/pipeline",
		map[string]any{"channels": []map[string]any{
			{"name": "edge"},
			{"name": "production", "bake": "24h"},
		}}, token); status != http.StatusOK {
		t.Fatalf("pipeline put = %d %v", status, out)
	}
	shipVersion(t, fx, "multiflow", "v1")
	seedChannel(t, fx, "multiflow", "edge", "v1")

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/multiflow"))
	edgeLabel, prodLabel := `<p class="flow-label">edge</p>`, `<p class="flow-label">production</p>`
	if !strings.Contains(body, edgeLabel) {
		t.Fatalf("flow diagram does not draw the entry channel:\n%s", body)
	}
	if !strings.Contains(body, prodLabel) {
		t.Fatalf("flow diagram does not draw the app's own second channel:\n%s", body)
	}
	if strings.Contains(body, `<p class="flow-label">beta</p>`) || strings.Contains(body, `<p class="flow-label">live</p>`) {
		t.Fatalf("flow diagram still draws the legacy edge/beta/live path for a pipelined app:\n%s", body)
	}
	if i, j := strings.Index(body, edgeLabel), strings.Index(body, prodLabel); i < 0 || j < 0 || i > j {
		t.Fatalf("channels are not drawn in pipeline order (edge before production):\n%s", body)
	}
}

// TestChannelsTableAndPipelineCardAgreeOnBakeWindow pins IMPORTANT 2 from
// the Task 9 review: the Channels table and the pipeline card read the SAME
// AppView.Channels slice, and used to disagree about how long an
// app-defined channel bakes for — the table read the legacy 72h fallback
// (release.HoldFor(DefaultHolds, "production") — an unrecognized name gets
// the longest standard window, fail closed), the card read the pipeline's
// own declared window via holdWindow. A 1h bake makes the two answers
// impossible to confuse in their rendered form: the correct one is
// minutes-scale ("~59m", no "d"), the legacy-table bug would show a
// multi-day figure ("~2d23h...").
func TestChannelsTableAndPipelineCardAgreeOnBakeWindow(t *testing.T) {
	fx := newConsoleFixture(t)
	token := cliToken(t, fx, "paul@keymail.dev", "code-bake-agree")
	if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new",
		map[string]string{"name": "bakeapp"}, token); status != http.StatusOK {
		t.Fatalf("create app = %d %v", status, out)
	}
	if status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/bakeapp/pipeline",
		map[string]any{"channels": []map[string]any{
			{"name": "edge"},
			{"name": "production", "bake": "1h"},
		}}, token); status != http.StatusOK {
		t.Fatalf("pipeline put = %d %v", status, out)
	}
	shipVersion(t, fx, "bakeapp", "v1")
	seedChannel(t, fx, "bakeapp", "edge", "v1")
	seedChannel(t, fx, "bakeapp", "production", "v1")

	c := signInPaul(t, fx)
	_, _, body := get(t, c, fx.u("/apps/bakeapp/releases"))

	// The Channels table's own "Goes live" cell for production.
	_, after, ok := strings.Cut(body, "<td>production</td>")
	if !ok {
		t.Fatalf("no Channels-table row for production:\n%s", body)
	}
	rowEnd := strings.Index(after, "</tr>")
	if rowEnd < 0 {
		t.Fatalf("malformed Channels table row:\n%s", after)
	}
	row := after[:rowEnd]
	i := strings.Index(row, "in ~")
	if i < 0 {
		t.Fatalf("Channels table shows no live bake countdown for production:\n%s", row)
	}
	cell := row[i:]
	if k := strings.Index(cell, "<"); k >= 0 {
		cell = cell[:k]
	}
	if strings.Contains(cell, "d") {
		t.Errorf("Channels table shows a multi-day bake window for a 1h pipeline channel — it read the legacy 72h table, not the pipeline's own window: %q", cell)
	}

	// The pipeline card's own rung for production tells the same story.
	prodBlock := rungBlock(t, body, "production")
	if !strings.Contains(prodBlock, "goes live ~") {
		t.Fatalf("pipeline card shows no live bake countdown for production:\n%s", prodBlock)
	}
	if i := strings.Index(prodBlock, "goes live ~"); i >= 0 {
		line := prodBlock[i:]
		if j := strings.Index(line, "<"); j >= 0 {
			line = line[:j]
		}
		if strings.Contains(line, "d") {
			t.Errorf("pipeline card shows a multi-day bake window for a 1h pipeline channel:\n%s", line)
		}
	}
}

func TestPipelineCardAndSettingsTemplates(t *testing.T) {
	fx := newConsoleFixture(t)
	token := cliToken(t, fx, "paul@keymail.dev", "code-pipeline-card")
	if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new",
		map[string]string{"name": "multi"}, token); status != http.StatusOK {
		t.Fatalf("create app = %d %v", status, out)
	}
	c := signInPaul(t, fx)

	// Still the one-channel default: the settings page shows the form, with
	// the single "edge" row, and offers the two starter templates.
	_, _, sbody := get(t, c, fx.u("/apps/multi/pipeline"))
	for _, want := range []string{
		`action="/a/bab/apps/multi/pipeline"`,
		`name="ch.0.name" value="edge"`,
		`value="template-edge-production"`,
		`value="template-full-ladder"`,
	} {
		if !strings.Contains(sbody, want) {
			t.Errorf("settings page missing %q:\n%s", want, sbody)
		}
	}

	// PUT a two-channel pipeline: edge, then production behind a passkey.
	status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/multi/pipeline",
		map[string]any{"channels": []map[string]any{
			{"name": "edge"},
			{"name": "production", "bake": "24h", "rules": map[string]any{"passkey": true}},
		}}, token)
	if status != http.StatusOK {
		t.Fatalf("pipeline put = %d %v", status, out)
	}

	_, _, body := get(t, c, fx.u("/apps/multi/releases"))
	if !strings.Contains(body, `id="rung-edge"`) || !strings.Contains(body, `id="rung-production"`) {
		t.Fatalf("pipeline card does not show both channels:\n%s", body)
	}
	if i, j := strings.Index(body, `id="rung-edge"`), strings.Index(body, `id="rung-production"`); i < 0 || j < 0 || i > j {
		t.Fatalf("channels are not rendered in pipeline order (edge before production):\n%s", body)
	}
	prodBlock := rungBlock(t, body, "production")
	if !strings.Contains(prodBlock, "Needs a passkey.") {
		t.Errorf("production rung does not carry its own gate sentence:\n%s", prodBlock)
	}
	edgeBlock := rungBlock(t, body, "edge")
	if !strings.Contains(edgeBlock, "Anyone on the team promotes here.") {
		t.Errorf("edge rung (no rules) does not say anyone promotes there:\n%s", edgeBlock)
	}

	// The settings page reflects the write, and — no longer the untouched
	// default — stops offering the starter templates.
	_, _, sbody2 := get(t, c, fx.u("/apps/multi/pipeline"))
	if !strings.Contains(sbody2, `name="ch.1.name" value="production"`) {
		t.Errorf("settings page does not show the saved production row:\n%s", sbody2)
	}
	if strings.Contains(sbody2, `value="template-edge-production"`) {
		t.Error("settings page still offers the starter templates once the pipeline is no longer the default")
	}
}

func TestPendingCardShowsQuorumProgress(t *testing.T) {
	fx := newConsoleFixture(t)
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	token := cliToken(t, fx, "paul@keymail.dev", "code-pending-card")
	if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new",
		map[string]string{"name": "queue"}, token); status != http.StatusOK {
		t.Fatalf("create app = %d %v", status, out)
	}
	if status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/queue/pipeline",
		map[string]any{"channels": []map[string]any{
			{"name": "edge"},
			{"name": "prod", "rules": map[string]any{"promote_approvals": 2}},
		}}, token); status != http.StatusOK {
		t.Fatalf("pipeline put = %d %v", status, out)
	}
	shipVersion(t, fx, "queue", "v1")
	seedChannel(t, fx, "queue", "edge", "v1")

	c := signInPaul(t, fx)
	csrf := sessionToken(t, fx, c)
	// The proposer's own step-up earns them the first of the two
	// confirmations (spec §4) — postGated walks that round trip.
	status, _, _ := postGated(t, fx, c, fx.u("/apps/queue/promote"),
		url.Values{"csrf": {csrf}, "channel": {"prod"}, "version": {"v1"}, "confirmed": {"1"}})
	if status != http.StatusSeeOther {
		t.Fatalf("propose promote = %d", status)
	}

	_, _, body := get(t, c, fx.u("/apps/queue"))
	if !strings.Contains(body, "promote v1 to prod") {
		t.Fatalf("pending card does not name the proposed change:\n%s", body)
	}
	if !strings.Contains(body, "1/2 confirmed") {
		t.Fatalf("pending card does not show quorum progress:\n%s", body)
	}
	if !strings.Contains(body, "/confirm") {
		t.Fatalf("pending card has no Confirm control:\n%s", body)
	}
	if !strings.Contains(body, "/reject") {
		t.Fatalf("pending card has no Reject control:\n%s", body)
	}

	// Confirming as the second member carries it out.
	fx.setUser("sam@keymail.dev")
	cm := newBrowser(t)
	signUp(t, fx, cm, "code-sam-confirm")
	_, _, mbody := get(t, cm, fx.u("/apps/queue"))
	id := pendingIDFromBody(t, mbody)
	status2, _, _ := postGated(t, fx, cm, fx.u("/apps/queue/pending/"+id+"/confirm"),
		url.Values{"csrf": {sessionToken(t, fx, cm)}})
	if status2 != http.StatusSeeOther {
		t.Fatalf("member confirm = %d", status2)
	}
	if p := fx.channelVersion(t, "queue", "prod"); p.Version != "v1" {
		t.Fatalf("prod = %s after quorum was met, want v1", p.Version)
	}
	_, _, doneBody := get(t, c, fx.u("/apps/queue"))
	if strings.Contains(doneBody, "1/2 confirmed") || strings.Contains(doneBody, "0/2 confirmed") {
		t.Fatalf("pending card still shows the change after it was carried out:\n%s", doneBody)
	}
}

// pendingIDFromBody pulls the id out of a pending change's confirm-form
// action, so the second member can act on the exact row the first created —
// the card renders the id in the URL and nowhere else structured enough to
// read back.
func pendingIDFromBody(t *testing.T, body string) string {
	t.Helper()
	marker := "/pending/"
	i := strings.Index(body, marker)
	if i < 0 {
		t.Fatalf("no pending id in body:\n%s", body)
	}
	rest := body[i+len(marker):]
	j := strings.Index(rest, "/")
	if j < 0 {
		t.Fatalf("malformed pending action url in body:\n%s", body)
	}
	return rest[:j]
}

// TestPipelineSettingsSavePOST is IMPORTANT 5 from the Task 9 review: the
// settings page's own write door had no test. Three properties, in the
// order they'd hurt if lost:
//   - requireFreshAuth is enforced even for an ordinary, unguarded edit —
//     a plain POST with no step-up redirects into Keymail rather than
//     landing anything (postGated walks the round trip that DOES land it).
//   - An unguarded save writes the pipeline directly once stepped up.
//   - A GUARDED edit (touching a channel the STORED pipeline already
//     protects with change_approvals) becomes a pending change instead of
//     landing — the same propose flow the API PUT takes, reused rather
//     than duplicated (pipelinepage.go's own doc comment).
func TestPipelineSettingsSavePOST(t *testing.T) {
	fx := newConsoleFixture(t)
	token := cliToken(t, fx, "paul@keymail.dev", "code-settings-post")
	if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new",
		map[string]string{"name": "settle"}, token); status != http.StatusOK {
		t.Fatalf("create app = %d %v", status, out)
	}
	c := signInPaul(t, fx)
	csrf := sessionToken(t, fx, c)

	saveForm := url.Values{
		"csrf": {csrf}, "action": {"save"},
		"ch.0.name": {"edge"},
		"ch.1.name": {"production"}, "ch.1.bake": {"24h"},
	}

	// Un-stepped-up: the request is redirected into Keymail, and nothing
	// changes yet — the fixture's default pipeline (one channel, "edge")
	// is still exactly what it was.
	status, loc, _ := postForm(t, c, fx.u("/apps/settle/pipeline"), saveForm)
	if status != http.StatusSeeOther || !strings.HasPrefix(loc, fx.fk.srv.URL) {
		t.Fatalf("un-stepped-up pipeline save = %d -> %q, want a redirect into Keymail", status, loc)
	}
	if pipe, err := release.GetPipeline(context.Background(), fx.rel, fx.pub, release.OpsAccount, "settle"); err != nil {
		t.Fatal(err)
	} else if pipe == nil || len(pipe.Channels) != 1 {
		t.Fatalf("pipeline changed before step-up completed: %+v", pipe)
	}

	// Completing the step-up carries the unguarded edit straight through.
	if status, _, body := completeStepUp(t, fx, c, loc); status != http.StatusSeeOther {
		t.Fatalf("resumed pipeline save = %d:\n%s", status, body)
	}
	pipe, err := release.GetPipeline(context.Background(), fx.rel, fx.pub, release.OpsAccount, "settle")
	if err != nil {
		t.Fatal(err)
	}
	if pipe == nil || len(pipe.Channels) != 2 || pipe.Channels[1].Name != "production" || pipe.Channels[1].Bake != "24h" {
		t.Fatalf("pipeline = %+v, want edge+production(24h)", pipe)
	}

	// Guard production with change_approvals: 2 — via the API PUT, standing
	// in for a previous, separately-confirmed console edit — so the NEXT
	// edit that touches it must propose rather than land. 2, not 1: a
	// quorum of 1 is met by the proposer's own step-up alone (spec §4 — it
	// degenerates to a passkey rule and executes in the same request), which
	// would prove nothing about the propose PATH specifically; a second
	// member (sam) makes 2 a real quorum this account can still reach.
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	if status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/settle/pipeline",
		map[string]any{"channels": []map[string]any{
			{"name": "edge"},
			{"name": "production", "bake": "24h", "rules": map[string]any{"change_approvals": 2}},
		}}, token); status != http.StatusOK {
		t.Fatalf("pipeline put (add change_approvals) = %d %v", status, out)
	}

	guardedForm := url.Values{
		"csrf": {csrf}, "action": {"save"},
		"ch.0.name": {"edge"},
		"ch.1.name": {"production"}, "ch.1.bake": {"48h"}, "ch.1.change_approvals": {"2"},
	}
	status, _, body := postGated(t, fx, c, fx.u("/apps/settle/pipeline"), guardedForm)
	if status != http.StatusSeeOther {
		t.Fatalf("guarded save = %d:\n%s", status, body)
	}
	// Nothing landed — the STORED pipeline still says 24h.
	if pipe, err := release.GetPipeline(context.Background(), fx.rel, fx.pub, release.OpsAccount, "settle"); err != nil {
		t.Fatal(err)
	} else if pipe == nil || pipe.Channels[1].Bake != "24h" {
		t.Fatalf("pipeline = %+v, want the guarded edit to have PROPOSED, not landed", pipe)
	}
	pending, err := fx.st.PendingChangesFor(OpsAccountID, "settle", time.Now())
	if err != nil {
		t.Fatal(err)
	}
	if len(pending) != 1 || pending[0].Kind != kindPolicy {
		t.Fatalf("pending changes = %+v, want exactly one policy proposal", pending)
	}
}