// Alias reconcile pass — derives the registry's route_aliases table AND its
// wildcard_domains and route_paths tables from the global claims recorded in
// the bucket (#151). A claim contributes an ordinary alias row when it names
// a Route (see the loop below); a Wildcard claim additionally contributes a
// wildcard_domains row (a delegated-ACME wildcard-cert parent), a
// Wildcard+Catchall claim also contributes a "*.<host>" route_aliases row
// pointing at the same primary, and a claim's Paths map contributes one
// route_paths row per prefix (path-based routing). See claims.go for the
// claim shape and registry.go's RouteAlias/WildcardDomain/RoutePath for the
// storage shapes; this file is the seam that turns one into the other.
package domains

import (
	"context"
	"log"
	"slices"
	"sort"
	"strconv"
	"strings"
	"sync"
	"time"

	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
)

// maxWildcardDomains caps wildcard_domains per box: every delegated parent
// shares one ACME account's new-order budget, so an unbounded claim set
// could starve platform issuance. Deterministic (claims come in list
// order); drops are logged, never silent.
const maxWildcardDomains = 32

// sidecarSuffix mirrors provision.SidecarSuffix, pinned here rather than
// imported — the same reason claims.go's hostLabelRe gives: internal/provision
// (its reconcile.go) already imports internal/domains for account/route
// materialization, so importing provision back would be a cycle.
//
// A sidecar host is refused a route at the structural level (edge.go's
// Reload skips Kind=="sidecar"), but that guarantee protects only the
// SIDECAR row itself. This constant guards the other direction, at the ONE
// place that can mint a route_aliases row from nothing: a claim naming a
// reserved-suffix host as either end of an alias would insert that host
// into the edge's routing map serving an ORDINARY route's upstream — which
// Reload's Kind check never sees, because the row it reads is the alias's
// primary, not a Kind=="sidecar" row at all.
const sidecarSuffix = ".sidecar.internal"

// maxInstanceAliases caps the alias rows instance catch-alls derive on one
// box. Every alias row costs a serial DNS lookup in the box's health stamp
// and about 140 bytes in its status snapshot, which readers skip whole
// above 1 MiB — and a skipped box drops out of the deployment's route and
// edge-address folds. The cap keeps a large app from carrying a box past
// that. Deterministic (claims in list order, routes in host order), so a
// rerun keeps the same names; the overflow is logged, never silent.
const maxInstanceAliases = 1000

// instanceCatchallSaid holds the instance catch-alls whose refusal has
// already been logged by this process, keyed by claim host and reason. The
// pass runs every couple of seconds on every box, and a catch-all left
// without its parent claim is a standing state, not an event.
var instanceCatchallSaid sync.Map

func sayInstanceCatchallOnce(host, reason string) {
	if _, said := instanceCatchallSaid.LoadOrStore(host+"\x00"+reason, true); !said {
		log.Printf("domains: instance catch-all %s: %s", host, reason)
	}
}

// deriveInstanceAliases adds the alias rows the instance catch-alls derive
// (Claim.Instances): for each catch-all "*.<parent>", one row
// <label>.<parent> -> <instance host> per LOCAL instance route of the
// claim's account and app, where <label> is the route's Slug — the first
// label of an instance host, which is what the instance create door makes
// it. The rows are the same rows an exact alias claim for each name would
// produce, so every reader of route_aliases (the edge, the edges file, the
// readings sweep, the issuer) treats them exactly as it treats those.
//
// What a derived name never beats, in order:
//
//   - a claim on that exact name, WHOEVER holds it — judged from the
//     bucket LISTING, so a claim whose body failed to read this pass still
//     wins. An exact claim is a
//     decision somebody made about this one name; a derived name is a
//     default. This is also what lets a same-account exact claim (www,
//     auth) or another app's exact claim sit beside the catch-all without
//     a special case.
//   - a real route on this box, or one any live box in the deployment
//     publishes (deploymentRoutes) — "routes always win", as for every
//     alias.
//
// The catch-all itself is honoured only while its parent's own claim is
// held by the same account (AttachInstanceCatchall's door rule, re-checked
// here because the parent claim can be released afterwards). Any other
// field on the claim (Route, Wildcard, Catchall, Paths) means it was not
// written by the door, and it derives nothing.
//
// Instance routes are taken from this box's registry, so each box derives
// the names of the instances it serves — the same per-box scope the plain
// alias half has — and a name follows its instance when the instance moves.
// Only provisioned, non-sidecar, non-replica rows whose Slug is a single
// label prefixing their host count. That excludes hand-added routes (whose
// account column may be a legacy name that reads as ops), replica rows (a
// replica serves its home's account from another box under its own host;
// the name belongs to the home) and first-route static rows (no Slug).
//
// A label two of the app's instances share derives NO name. That can only
// happen after an operator changed the app's manifest domain between them
// (every host under one domain has its own label), and the two instances
// may well be homed on different boxes: a rule each box applied to its own
// routes would map the one name to two databases depending on which edge a
// request landed on. The duplicate is seen deployment-wide, from the app's
// instance records in the bucket (labelHosts), so every box refuses alike,
// and the refusal is logged.
//
// labelHosts is asked once per catch-all, and only when this box has an
// instance it could name. If it fails, the catch-all's existing rows are
// kept as they are for this pass rather than dropped: a listing blip must
// not take every team's name down.
func deriveInstanceAliases(claims []Claim, listed map[string]bool, routes []registry.Route, byHost map[string]registry.Route, existing []registry.RouteAlias, deploymentRoutes map[string]bool, desired map[string]bool, labelHosts func(account, app string) (map[string]int, error), reg *registry.Registry, now func() time.Time) {
	claimed := make(map[string]Claim, len(claims))
	for _, c := range claims {
		claimed[c.Host] = c
	}
	derived := 0
	have := make(map[string]registry.RouteAlias, len(existing))
	for _, a := range existing {
		have[a.Alias] = a
	}
	for _, c := range claims {
		if !c.Instances {
			continue
		}
		parent, ok := ParseInstanceCatchallHost(c.Host)
		if !ok || InstanceCatchallHost(parent) != c.Host {
			sayInstanceCatchallOnce(c.Host, "refused: not a normalised *.<parent> hostname")
			continue
		}
		if c.Route != "" || c.Wildcard || c.Catchall || len(c.Paths) > 0 {
			sayInstanceCatchallOnce(c.Host, "refused: the claim carries a route, wildcard, catchall or paths, which no door writes on a catch-all")
			continue
		}
		if strings.HasSuffix(parent, sidecarSuffix) {
			sayInstanceCatchallOnce(c.Host, "refused: reserved sidecar suffix")
			continue
		}
		// A pending parent (#215) is not held: nobody has proved they
		// control it, so it cannot lend a catch-all its names either.
		if apex, held := claimed[parent]; !held || apex.Account != c.Account || apex.Pending {
			sayInstanceCatchallOnce(c.Host, "inert: its parent "+parent+" is not claimed by account "+c.Account)
			continue
		}
		var hostsOf map[string]int
		for _, rt := range routes {
			if !rt.Provisioned || rt.IsSidecar() || rt.Replica || rt.App != c.App || release.RouteAccount(rt) != c.Account {
				continue
			}
			label := rt.Slug
			if !hostLabelRe.MatchString(label) || !strings.HasPrefix(rt.Host, label+".") {
				continue
			}
			if hostsOf == nil {
				counts, err := labelHosts(c.Account, c.App)
				if err != nil {
					log.Printf("domains: instance catch-all %s: list the app's instances: %v — keeping its names as they are this pass", c.Host, err)
					for _, a := range existing {
						if a.Account == c.Account && a.App == c.App && strings.HasSuffix(a.Alias, "."+parent) &&
							!strings.Contains(strings.TrimSuffix(a.Alias, "."+parent), ".") {
							desired[a.Alias] = true
						}
					}
					break
				}
				hostsOf = counts
			}
			if hostsOf[label] > 1 {
				sayInstanceCatchallOnce(c.Host, "label "+label+" is shared by "+strconv.Itoa(hostsOf[label])+" instances of "+c.App+" (its instance domain was changed); "+label+"."+parent+" serves none of them until one is deleted")
				continue
			}
			name := label + "." + parent
			if n, ok := NormalizeAliasHost(name); !ok || n != name {
				continue // too long once joined to parent
			}
			// listed, not claimed: a claim whose body could not be read this
			// pass is still a claim (ClaimCache.listWithHosts).
			if listed[name] {
				continue
			}
			if _, taken := byHost[name]; taken || deploymentRoutes[name] || desired[name] {
				continue
			}
			if derived >= maxInstanceAliases {
				sayInstanceCatchallOnce(c.Host, "this box is at its cap of "+strconv.Itoa(maxInstanceAliases)+" derived names; the rest of the app's instances here serve on their own hosts only")
				break
			}
			derived++
			desired[name] = true
			if a, ok := have[name]; ok && a.Host == rt.Host && a.Account == c.Account && a.App == c.App {
				continue // already the row we want: no write, so no reload
			}
			if err := reg.UpsertAlias(registry.RouteAlias{
				Alias: name, Host: rt.Host, Account: c.Account, App: c.App,
				CreatedAt: now().Unix(),
			}); err != nil {
				log.Printf("domains: upsert instance alias %s: %v", name, err)
			}
		}
	}
}

// ReconcileAliases derives route_aliases, wildcard_domains and route_paths
// from the global claim records. All three tables are wholly pass-owned:
// every row traces to a claim, so removal needs no ownership flag. The
// authoritative tenancy gate is HERE — the door's route check is
// best-effort (it cannot see the registry); a claim only materializes when
// its primary route exists locally AND its account/app match the claim.
// Routes always win a host collision: an alias (plain or catch-all) must
// never shadow a real route.
//
// deploymentRoutes is every hostname a live box in this deployment publishes
// as a REAL route (edgesfile.DeploymentRoutes). It extends "routes always
// win" from this box to the whole fleet, which is the only place the rule
// can be enforced at all: byHost below sees only local routes, and the
// attach door cannot see the registry, because an operator-minted route has
// no instance record to read. nil means "nothing known" and is PERMISSIVE by
// contract — a bucket the fold could not read must never break ordinary
// attach.
// cache, when non-nil, folds the claims through a ClaimCache instead of
// re-reading every claim body. This pass runs on the fast-converge leg — a
// seconds cadence, on every serial bump — so the difference is one bucket
// call against one plus a GET per claim in the deployment, every few
// seconds, on every box. nil is legal and means today's uncached fold.
func ReconcileAliases(ctx context.Context, s release.Store, reg *registry.Registry, now func() time.Time, deploymentRoutes map[string]bool, cache *ClaimCache) error {
	claims, listed, err := cache.listWithHosts(ctx, s)
	if err != nil {
		return err
	}
	routes, err := reg.List()
	if err != nil {
		return err
	}
	byHost := make(map[string]registry.Route, len(routes))
	for _, rt := range routes {
		byHost[rt.Host] = rt
	}
	existing, err := reg.ListAliases()
	if err != nil {
		return err
	}
	desired := map[string]bool{}
	desiredWild := map[string]registry.WildcardDomain{}
	desiredPaths := map[string]registry.RoutePath{} // key: host + "\x00" + prefix
	wildCount := 0
	for _, c := range claims {
		// A pending claim (#215) is a reservation by someone who has not
		// proved they control the hostname, so it derives nothing at all:
		// no alias, no prefix rows, no wildcard parent, no catch-all. That
		// one skip is what keeps an unproven claim from being served and,
		// because the edge orders certificates only for names it routes,
		// from getting a certificate.
		if c.Pending {
			continue
		}
		// Plain alias derivation (#164): a routeless (first-route) claim is
		// not an alias — that skip is scoped to THIS half only, so a
		// routeless Wildcard claim still falls through to the wildcard
		// derivation below.
		if c.Route != "" {
			rt, ok := byHost[c.Route]
			if strings.HasSuffix(c.Route, sidecarSuffix) || strings.HasSuffix(c.Host, sidecarSuffix) {
				// Refused on EITHER end: a reserved-suffix primary must
				// never be given a routable name, and an alias whose OWN
				// name is under the suffix would insert a sidecar
				// hostname into the routing map serving an ordinary
				// route's upstream — the direction edge.go's Kind check
				// cannot see, because this row's Kind is never "sidecar".
				log.Printf("domains: alias %s refused: reserved sidecar suffix (primary %s)", c.Host, c.Route)
			} else if !ok {
				// primary not on this box — another box's claim
			} else if rt.App != c.App || release.RouteAccount(rt) != c.Account {
				log.Printf("domains: alias %s refused: route %s belongs to %s/%s, claim says %s/%s",
					c.Host, c.Route, release.RouteAccount(rt), rt.App, c.Account, c.App)
			} else if _, taken := byHost[c.Host]; taken {
				log.Printf("domains: alias %s skipped: a real route owns that host", c.Host)
			} else if n, ok := NormalizeAliasHost(c.Host); !ok || n != c.Host {
				// The DOOR's own check (NormalizeAliasHost: shape plus an
				// interior dot, already lower-case): both doors normalise,
				// but this row now becomes a key in a file every edge folds
				// (#287), so a hand-written claim must not reach it.
				log.Printf("domains: alias %s refused: not a normalised hostname", c.Host)
			} else if deploymentRoutes[c.Host] {
				// Another box in this deployment serves this hostname as a
				// REAL route. byHost above can only see this box, and the
				// attach door cannot see the registry at all, so this is the
				// only layer that can refuse a claim on someone else's
				// operator-minted route. Because the desired set is rebuilt
				// every pass, a claim that materialized before this rule
				// existed is dropped here too.
				//
				// Ordered AFTER the shape check on purpose: both refusals are
				// log-only (no caller sees them, so there is no ordering
				// oracle here), and a malformed hostname should be named as
				// malformed rather than as somebody else's route.
				log.Printf("domains: alias %s refused: another box serves that hostname as a route", c.Host)
			} else {
				desired[c.Host] = true
				if err := reg.UpsertAlias(registry.RouteAlias{
					Alias: c.Host, Host: c.Route, Account: c.Account, App: c.App,
					CreatedAt: now().Unix(),
				}); err != nil {
					log.Printf("domains: upsert alias %s: %v", c.Host, err)
				}
			}
		}

		// Path derivation (prefix routing). A claim's Paths map splits its own
		// hostname's traffic by leading URL segment; each entry names the
		// hostname of the route that serves that segment.
		//
		// Gated on the claim's host being a LOCAL route whose tenancy matches
		// the claim — the same per-box rule the alias half above follows, and
		// for the same reason: the prefix map belongs to that route, so a box
		// that does not serve the route derives nothing.
		//
		// The TARGET is resolved through the same local byHost, which makes
		// co-location a hard constraint of the feature: a prefix's target
		// route must be homed on the same box as the hostname's own route.
		// There is no backhaul equivalent for a path target — backhaul fires
		// on a host miss, and the host resolves fine here — so a target on
		// another box derives no row anywhere at all. See the unresolved log
		// below, and design spec §6.
		//
		// Ordered BEFORE the wildcard section on purpose: Paths is a third
		// claim capability independent of Wildcard (claims.go's comment on
		// the field), and the wildcard section below `continue`s for every
		// non-Wildcard claim — placed after that, a Paths-only claim would
		// never reach this block.
		if len(c.Paths) > 0 {
			hostRt, ok := byHost[c.Host]
			if strings.HasSuffix(c.Host, sidecarSuffix) {
				// The alias half's refusal, for the table path-based
				// routing added afterwards. A route_paths row keyed on a
				// reserved-suffix hostname is the same mistake in a
				// different table: it inserts a sidecar's name into the
				// edge's routing map, and edge.go's Kind check never sees
				// it because the row it reads is a path row, not a
				// Kind=="sidecar" route.
				log.Printf("domains: paths on %s refused: reserved sidecar suffix", c.Host)
			} else if !ok {
				// The hostname's own route is not on this box; another box
				// derives these rows.
			} else if hostRt.App != c.App || release.RouteAccount(hostRt) != c.Account {
				log.Printf("domains: paths on %s refused: route belongs to %s/%s, claim says %s/%s",
					c.Host, release.RouteAccount(hostRt), hostRt.App, c.Account, c.App)
			} else {
				// Sorted so the cap below truncates DETERMINISTICALLY: every
				// box must derive the identical subset, or the same URL would
				// resolve differently depending on which edge answered.
				prefixes := make([]string, 0, len(c.Paths))
				for p := range c.Paths {
					prefixes = append(prefixes, p)
				}
				sort.Strings(prefixes)
				if len(prefixes) > MaxPathsPerClaim {
					log.Printf("domains: paths on %s: %d prefixes exceeds the cap of %d, dropping %d in sorted order",
						c.Host, len(prefixes), MaxPathsPerClaim, len(prefixes)-MaxPathsPerClaim)
					prefixes = prefixes[:MaxPathsPerClaim]
				}
				// Unresolved targets are counted and named ONCE per host per
				// pass, not logged per prefix: this pass runs every ~2s on
				// every box, and a 10k-entry map whose targets are all
				// elsewhere would otherwise write 10k lines every two
				// seconds. The count is the operator's signal; the first few
				// names are enough to identify which map is wrong.
				unresolved := 0
				var unresolvedEg []string
				for _, prefix := range prefixes {
					target := c.Paths[prefix]
					if !validPathPrefix(prefix) {
						log.Printf("domains: path %s/%s refused: not a bare path segment", c.Host, prefix)
						continue
					}
					if strings.HasSuffix(target, sidecarSuffix) {
						// The sharper half of the same refusal, and the one
						// the account check above cannot make: a sidecar is
						// the claim's OWN account's, so pointing a prefix at
						// it passes every tenancy rule this block has. It
						// must still be refused, because the target is the
						// one field here that becomes a proxied upstream —
						// this is the door through which an account could
						// dial its own undialable member.
						log.Printf("domains: path %s/%s refused: target %s is under the reserved sidecar suffix — nothing routes to a sidecar",
							c.Host, prefix, target)
						continue
					}
					tgtRt, ok := byHost[target]
					// The authorization rule this feature adds: a prefix must
					// never point another tenant's traffic at your backend.
					// Account only — an account routing between its own apps
					// (classic and Go ARE two apps) is the whole use case.
					// Checked before readiness so a cross-tenant target is
					// named as cross-tenant rather than swept into the
					// unresolved count below.
					if ok && release.RouteAccount(tgtRt) != c.Account {
						log.Printf("domains: path %s/%s refused: target %s belongs to %s, claim says %s",
							c.Host, prefix, target, release.RouteAccount(tgtRt), c.Account)
						continue
					}
					if !ok || tgtRt.Status != "ready" {
						// The target is not a local READY route, which has
						// three distinct causes with three different
						// remedies, and the log below cannot tell them apart
						// from here:
						//
						//  1. The target route does not exist anywhere — a
						//     typo in the published map, or a route deleted
						//     out from under it. Remedy: fix the map, or
						//     re-create the route.
						//  2. The target exists but is HOMED ON ANOTHER BOX.
						//     byHost holds this box's routes only, and there
						//     is no backhaul equivalent for a path target
						//     (backhaul fires on a HOST miss), so nothing
						//     derives the row anywhere. Remedy: co-locate —
						//     a prefix's target must be homed on the same box
						//     as the hostname's own route (design spec §6).
						//  3. The target is local but not ready yet — a
						//     route mid-provision. Self-resolving; the row
						//     appears on the pass after it goes ready.
						//
						// No row either way, so the prefix falls through to
						// the host's own route — the right failure direction
						// for a migration: a missing destination serves the
						// ORIGIN, never a 404. Silent traffic is the danger
						// here, not broken traffic, which is why this is
						// logged at all.
						unresolved++
						if len(unresolvedEg) < 3 && !slices.Contains(unresolvedEg, target) {
							unresolvedEg = append(unresolvedEg, target)
						}
						continue
					}
					desiredPaths[c.Host+"\x00"+prefix] = registry.RoutePath{
						Host: c.Host, Prefix: prefix, Target: target,
						Account: c.Account, App: c.App,
					}
				}
				if unresolved > 0 {
					log.Printf("domains: paths on %s: %d prefix(es) name no local ready route (e.g. %s) — the target is missing, or it is homed on another box; a path target must be homed on the SAME box as %s. Those prefixes serve %s's own route.",
						c.Host, unresolved, strings.Join(unresolvedEg, ", "), c.Host, c.Host)
				}
			}
		}

		// Wildcard/catch-all derivation. A claim with Catchall but not
		// Wildcard cannot come from the write path (SetClaimCapabilities
		// refuses it), but a hand-written or pre-migration claim could carry
		// it — tolerated, logged, nothing derived.
		if c.Catchall && !c.Wildcard {
			log.Printf("domains: catch-all %s skipped: claim has catchall without wildcard", c.Host)
		}
		if !c.Wildcard {
			continue
		}
		if !validHostShape(c.Host) {
			log.Printf("domains: wildcard %s refused: invalid host shape", c.Host)
			continue
		}
		primaryHost := c.Route
		if primaryHost == "" {
			primaryHost = c.Host // first-route claim: its own materialized primary
		}
		// A named-Route claim's own Host can itself be a local route (e.g. a
		// domain already routed AND also carrying a wildcard cert opt-in for
		// its subdomains). That's fine when the tenant matches; a mismatched
		// tenant means a different app/account already owns this hostname
		// directly, and the wildcard claim must not shadow it. The
		// empty-Route (first-route) case is safe by construction: there
		// primaryHost == c.Host, so this is the same route checked below.
		if c.Route != "" {
			if hostRt, taken := byHost[c.Host]; taken {
				if hostRt.App != c.App || release.RouteAccount(hostRt) != c.Account {
					log.Printf("domains: wildcard %s refused: a real route owns that host under %s/%s",
						c.Host, release.RouteAccount(hostRt), hostRt.App)
					continue
				}
			}
		}
		rt, ok := byHost[primaryHost]
		if !ok {
			continue // primary not on this box — another box's claim
		}
		if rt.App != c.App || release.RouteAccount(rt) != c.Account {
			log.Printf("domains: wildcard %s refused: route %s belongs to %s/%s, claim says %s/%s",
				c.Host, primaryHost, release.RouteAccount(rt), rt.App, c.Account, c.App)
			continue
		}
		if wildCount >= maxWildcardDomains {
			log.Printf("domains: wildcard %s dropped: per-box cap %d reached", c.Host, maxWildcardDomains)
			continue
		}
		wildCount++
		desiredWild[c.Host] = registry.WildcardDomain{
			Host: c.Host, Account: c.Account, App: c.App, CreatedAt: now().Unix(),
		}
		if c.Catchall {
			star := "*." + c.Host
			if strings.HasSuffix(star, sidecarSuffix) || strings.HasSuffix(primaryHost, sidecarSuffix) {
				// Same both-ends guard as the plain-alias derivation above,
				// through this route_aliases writer's OTHER call site: a
				// catch-all's alias name is star, and star inherits c.Host's
				// suffix, so this also catches a wildcard host minted under
				// the reserved suffix.
				log.Printf("domains: catch-all %s refused: reserved sidecar suffix (primary %s)", star, primaryHost)
			} else if _, taken := byHost[star]; taken {
				log.Printf("domains: catch-all %s skipped: a real route owns that host", star)
			} else if deploymentRoutes[star] {
				// THE STAR, never c.Host. A first-route claim's own host is
				// published as a real (non-alias) route by the claimant's OWN
				// box — that is what "first route" means — so keying this on
				// c.Host would refuse the catch-all for every wildcard
				// first-route claim in the deployment, on the very box that
				// owns it. The woodstar.app class, live today. What must not
				// be shadowed here is a real route literally NAMED "*.<host>",
				// which is what star asks about.
				log.Printf("domains: catch-all %s refused: another box serves that hostname as a route", star)
			} else {
				desired[star] = true
				if err := reg.UpsertAlias(registry.RouteAlias{
					Alias: star, Host: primaryHost, Account: c.Account, App: c.App,
					CreatedAt: now().Unix(),
				}); err != nil {
					log.Printf("domains: upsert catch-all %s: %v", star, err)
				}
			}
		}
	}
	deriveInstanceAliases(claims, listed, routes, byHost, existing, deploymentRoutes, desired,
		func(account, app string) (map[string]int, error) { return InstanceLabelCounts(ctx, s, account, app) }, reg, now)
	for _, a := range existing {
		if !desired[a.Alias] {
			if err := reg.DeleteAlias(a.Alias); err != nil {
				log.Printf("domains: remove alias %s: %v", a.Alias, err)
			}
		}
	}

	// wildcard_domains is wholly pass-owned, like route_aliases.
	existingWild, err := reg.ListWildcardDomains()
	if err != nil {
		return err
	}
	for h, w := range desiredWild {
		cur := false
		for _, e := range existingWild {
			if e.Host == h && e.Account == w.Account && e.App == w.App {
				cur = true
				break
			}
		}
		if !cur {
			if err := reg.UpsertWildcardDomain(w); err != nil {
				log.Printf("domains: upsert wildcard %s: %v", h, err)
			}
		}
	}
	for _, e := range existingWild {
		if _, ok := desiredWild[e.Host]; !ok {
			if err := reg.DeleteWildcardDomain(e.Host); err != nil {
				log.Printf("domains: remove wildcard %s: %v", e.Host, err)
			}
		}
	}

	// route_paths is wholly pass-owned, like route_aliases and
	// wildcard_domains: every row traces to a claim's Paths entry, so a
	// prefix removed from a republished map disappears here with no delete
	// verb anywhere. That is exactly how a per-account rollback reaches the
	// edge.
	existingPaths, err := reg.ListPaths()
	if err != nil {
		return err
	}
	for _, p := range desiredPaths {
		if err := reg.UpsertPath(p); err != nil {
			log.Printf("domains: upsert path %s/%s: %v", p.Host, p.Prefix, err)
		}
	}
	for _, p := range existingPaths {
		if _, ok := desiredPaths[p.Host+"\x00"+p.Prefix]; !ok {
			if err := reg.DeletePath(p.Host, p.Prefix); err != nil {
				log.Printf("domains: remove path %s/%s: %v", p.Host, p.Prefix, err)
			}
		}
	}
	return nil
}