package domains_test

import (
	"bytes"
	"context"
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"errors"
	"fmt"
	"log"
	"math/big"
	"net"
	"os"
	"path/filepath"
	"reflect"
	"slices"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/domains"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
)

var ctx = context.Background()

func dirStore(t *testing.T) *release.DirStore {
	t.Helper()
	return release.NewDirStore(t.TempDir())
}

func regWith(t *testing.T, routes ...registry.Route) *registry.Registry {
	t.Helper()
	reg, err := registry.Open(filepath.Join(t.TempDir(), "registry.db"))
	if err != nil {
		t.Fatal(err)
	}
	for _, rt := range routes {
		if err := reg.Upsert(rt); err != nil {
			t.Fatal(err)
		}
	}
	return reg
}

// writeAccountManifest writes the console-shaped account manifest at
// accounts/<sqid>/account.json — the bucket IS where account identity lives,
// and the id in it is taken as given. The sqid is the frozen encoding of the
// id (never anything else), so the helper derives it and hands it back.
func writeAccountManifest(t *testing.T, s release.Store, id int64, name string) string {
	t.Helper()
	sqid := domains.Sqid(id)
	body := []byte(`{"id":` + fmt.Sprint(id) + `,"sqid":"` + sqid + `","name":"` + name +
		`","created_at":"2026-08-02T09:00:00Z"}`)
	if _, err := s.Put(ctx, "accounts/"+sqid+"/account.json", body, ""); err != nil {
		t.Fatal(err)
	}
	return sqid
}

// putKey drops an object at key so the key-path linkage has something to read.
func putKey(t *testing.T, s release.Store, key string) {
	t.Helper()
	if _, err := s.Put(ctx, key, []byte("{}"), ""); err != nil {
		t.Fatal(err)
	}
}

// cfg is the standard reconcile config: apps domain set, a fake resolver
// saying every host points at the edge, DNS/TLS seams otherwise defaulted.
//
// EdgeIPs is a func because the live set moves under the pass (in production
// it folds every box's published edges file each pass); a fixture that
// answers the same one address every time keeps every existing assertion
// here reading exactly as it did when the field was a slice.
func cfg(t *testing.T) domains.Config {
	t.Helper()
	return domains.Config{
		AppsDomain: "oncarlos.test",
		EdgeIPs:    func() []string { return []string{"203.0.113.7"} },
		Resolve:    func(host string) ([]string, error) { return []string{"203.0.113.7"}, nil },
		Now:        func() time.Time { return time.Unix(1754000000, 0) },
	}
}

func mustGet(t *testing.T, reg *registry.Registry, host string) *registry.Route {
	t.Helper()
	rt, err := reg.Get(host)
	if err != nil {
		t.Fatal(err)
	}
	if rt == nil {
		t.Fatalf("route %s missing", host)
	}
	return rt
}

func routeCount(t *testing.T, reg *registry.Registry) int {
	t.Helper()
	routes, err := reg.List()
	if err != nil {
		t.Fatal(err)
	}
	return len(routes)
}

func TestReconcileMintsPlatformDomainUnderOps(t *testing.T) {
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "kass.training", Kind: "instance",
		App: "kass", Status: "ready", Addr: "127.0.0.1:9000"})
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	// No manifest anywhere: the app lives under the built-in ops account
	// (id 1, Sqid "bab" — frozen).
	got := mustGet(t, reg, "kass.bab.oncarlos.test")
	if !got.Platform || got.Addr != "127.0.0.1:9000" || got.Account != "bab" || got.App != "kass" {
		t.Errorf("minted route = %+v", got)
	}
	n := routeCount(t, reg)
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if routeCount(t, reg) != n {
		t.Errorf("second Reconcile changed the route count: %d -> %d", n, routeCount(t, reg))
	}
}

// The durability property, at the reconcile layer: whatever id the bucket
// says, the registry takes as given. It never assigns one of its own, so two
// boxes — or one box rebuilt — materialize identical sqids.
func TestReconcileMaterializesAccountsFromManifests(t *testing.T) {
	s, reg := dirStore(t), regWith(t)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	id, name, _ := reg.AccountBySqid(sqid)
	if id != 793481920157 || name != "Kass" {
		t.Errorf("materialized id=%d name=%q — the bucket's id must be taken as given", id, name)
	}
	// A second pass over the same bucket is a no-op, and a REBUILT registry
	// re-materializes the identical id — the durability property.
	reg2 := regWith(t)
	if err := domains.Reconcile(ctx, s, reg2, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if id2, _, _ := reg2.AccountBySqid(sqid); id2 != id {
		t.Errorf("rebuilt registry materialized id %d, want %d", id2, id)
	}
}

// A tombstoned manifest is materialized nowhere, and un-materializes an account
// this registry already carried. Without the second half, a deletion would take
// effect only in the console that performed it: every other box on the
// deployment would keep listing the account forever.
func TestReconcileRetiresTombstonedAccounts(t *testing.T) {
	s, reg := dirStore(t), regWith(t)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if id, _, _ := reg.AccountBySqid(sqid); id == 0 {
		t.Fatal("the account did not materialize in the first place")
	}
	if err := domains.TombstoneAccount(ctx, s, sqid, time.Now()); err != nil {
		t.Fatal(err)
	}
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if id, name, _ := reg.AccountBySqid(sqid); id != 0 {
		t.Errorf("retired account still in the registry as id=%d name=%q", id, name)
	}
	// A registry built from scratch never learns about it at all.
	reg2 := regWith(t)
	if err := domains.Reconcile(ctx, s, reg2, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if id, _, _ := reg2.AccountBySqid(sqid); id != 0 {
		t.Errorf("a rebuilt registry materialized the retired account as id=%d", id)
	}
	// Ops is never deletable, however the manifest is written.
	if err := domains.TombstoneAccount(ctx, s, domains.Sqid(domains.ReservedAccountID), time.Now()); err == nil {
		t.Error("tombstoning the ops account was allowed")
	}
}

// The app→account linkage IS the bucket key path: an app under
// apps/<sqid>/<app>/… belongs to that account. A legacy unqualified
// apps/<app>/… key is not linkage at all any more — the runtime cannot read
// it, so it says nothing about who owns what. oldapp here still lands under
// ops, but from its ROUTE's default, not from the leftover object.
func TestReconcileDerivesAccountFromKeyPath(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "kass.training", Kind: "instance", App: "kass", Status: "ready", Addr: "127.0.0.1:9000"},
		registry.Route{Host: "old.example.com", Kind: "instance", App: "oldapp", Status: "ready", Addr: "127.0.0.1:9001"})
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/kass/channels/stable.json")
	putKey(t, s, "apps/oldapp/channels/stable.json")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	// kass mints under its account; oldapp mints under bab (ops).
	kass := mustGet(t, reg, "kass."+sqid+".oncarlos.test")
	if !kass.Platform || kass.Account != sqid {
		t.Errorf("kass minted route = %+v, want platform under %s", kass, sqid)
	}
	old := mustGet(t, reg, "oldapp.bab.oncarlos.test")
	if !old.Platform || old.Account != "bab" {
		t.Errorf("oldapp minted route = %+v, want platform under bab", old)
	}
	// The source route carries the sqid too, so adopt builds the right keys.
	if src := mustGet(t, reg, "kass.training"); src.Account != sqid {
		t.Errorf("source route account = %q, want %s", src.Account, sqid)
	}
}

// A leftover legacy object must not claim an app for ops. This is the shape
// every migrated app's bucket is in — the migration copies and deliberately
// never deletes — and the route was added before any of it, so it carries no
// account yet.
//
// It used to go the other way: the legacy leftover made OPS an owner of
// kass's objects, an unstamped route reads as ops, ops was among the owners,
// and the route got stamped ops — pointing adopt at a prefix holding nothing
// but the copy nobody serves. With legacy keys ignored there is exactly one
// owner, the account the app actually lives in.
func TestReconcileIgnoresLeftoverLegacyKeys(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "kass.training", Kind: "static", App: "kass",
			Status: "ready", Channel: "stable"})
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/kass/channels/stable.json")
	putKey(t, s, "apps/kass/channels/stable.json")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if src := mustGet(t, reg, "kass.training"); src.Account != sqid {
		t.Errorf("source route account = %q, want %s — a legacy leftover claimed the app for ops",
			src.Account, sqid)
	}
	mustGet(t, reg, "kass."+sqid+".oncarlos.test") // the apex mints under the real account
}

// A legacy canary pointer mints no canary host. The host would resolve a
// channel the fleet cannot read, so it would serve a 404 under a URL the
// console advertises as live.
func TestReconcileMintsNothingForALegacyCanaryPointer(t *testing.T) {
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "kass.training", Kind: "static",
		App: "kass", Status: "ready", Channel: "stable"})
	putKey(t, s, "apps/kass/channels/canary/pricing.json")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if rt, err := reg.Get("pricing.kass.bab.oncarlos.test"); err != nil || rt != nil {
		t.Errorf("a legacy canary pointer minted %+v (%v) — nothing can serve it", rt, err)
	}
}

// PINNED, NOT ENDORSED. A platform-minted canary host stamped with one
// account while its app's real canary pointer lives under another is removed
// on the next pass. The stamp is what decides, and a single stray object
// under the stamped account is enough to hold it there: resolveRouteAccount's
// first rule is "the row's own account already holds objects: it is right,
// keep it", so step 1b never re-stamps the row onto the account the pointer
// is actually under, and the retirement loop then finds no pointer for the
// (account, app) pair the row names.
//
// This shape predates the fallback's retirement — the retirement only changed
// which pointers count — and a live pre-flight on 2026-08-03 found it does not
// occur on either fleet: tito's reconcile is inert (no apps domain configured)
// and the flagship registry holds zero Platform+Canary rows. It is pinned here
// so the behaviour is known rather than discovered by a deleted host.
//
// If it ever does bite, the fix belongs in the STAMPING rule (a row whose
// stamped account holds no pointer for its own channel is not "right"), never
// in the retirement loop — softening the loop would strand every genuinely
// retired canary host forever.
func TestReconcileRemovesACanaryHostStampedWithTheWrongAccount(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "blog.kass.test", Kind: "static", App: "blog",
			Status: "ready", Channel: "stable", Account: "bab"},
		registry.Route{Host: "pricing.blog.bab.oncarlos.test", Kind: "static", App: "blog",
			Status: "ready", Channel: "canary/pricing", Platform: true, Canary: true, Account: "bab"},
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	// One stray object under ops pins both rows to bab...
	putKey(t, s, "apps/bab/blog/releases/v1/manifest.json")
	// ...while the canary pointer the fleet actually follows is the tenant's.
	putKey(t, s, "apps/"+sqid+"/blog/channels/canary/pricing.json")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if rt, err := reg.Get("pricing.blog.bab.oncarlos.test"); err != nil || rt != nil {
		t.Errorf("canary route survived: %+v %v — if this now passes, the stamping rule changed; "+
			"re-read the comment above before deleting this test", rt, err)
	}
	// The row that pinned it keeps its stamp, which is the mechanism at work.
	if src := mustGet(t, reg, "blog.kass.test"); src.Account != "bab" {
		t.Errorf("source route account = %q, want bab", src.Account)
	}
}

// A platform-minted canary host whose pointer only ever existed at the legacy
// keys is retired like any other pointerless canary. It is the same removal
// rule, reached because legacy keys stopped counting as live pointers: the
// host resolved to a build the fleet cannot install, so keeping it alive
// would advertise a URL that 404s.
func TestReconcileRetiresCanaryHostLeftOnALegacyPointer(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "kass.training", Kind: "static", App: "kass",
			Status: "ready", Channel: "stable"},
		registry.Route{Host: "pricing.kass.bab.oncarlos.test", Kind: "static", App: "kass",
			Status: "ready", Channel: "canary/pricing", Platform: true, Canary: true, Account: "bab"},
	)
	putKey(t, s, "apps/kass/channels/canary/pricing.json")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if rt, err := reg.Get("pricing.kass.bab.oncarlos.test"); err != nil || rt != nil {
		t.Errorf("canary host on a legacy-only pointer survived: %+v %v", rt, err)
	}
}

// A malformed account manifest is one skipped line, never a failed pass, and
// never a guessed id.
func TestReconcileSkipsMalformedAccountManifest(t *testing.T) {
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "kass.training", Kind: "instance",
		App: "kass", Status: "ready", Addr: "127.0.0.1:9000"})
	putKey(t, s, "accounts/bad/account.json") // "{}" — no id, no sqid
	if _, err := s.Put(ctx, "accounts/worse/account.json", []byte("{not json"), ""); err != nil {
		t.Fatal(err)
	}
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatalf("one bad manifest must not fail the pass: %v", err)
	}
	if id, _, _ := reg.AccountBySqid(sqid); id != 793481920157 {
		t.Error("good manifest not processed after the bad ones")
	}
	for _, sqid := range []string{"bad", "worse"} {
		if id, _, _ := reg.AccountBySqid(sqid); id != 0 {
			t.Errorf("materialized a malformed manifest as %s (id %d)", sqid, id)
		}
	}
}

// A manifest whose sqid is not the frozen encoding of its own id is a lie
// about identity — materializing it would put an account at a domain that
// stops resolving the moment anything recomputes the sqid.
func TestReconcileRejectsMismatchedSqid(t *testing.T) {
	s, reg := dirStore(t), regWith(t)
	if _, err := s.Put(ctx, "accounts/kqmv/account.json",
		[]byte(`{"id":42,"sqid":"kqmv","name":"Liar"}`), ""); err != nil {
		t.Fatal(err)
	}
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if id, _, _ := reg.AccountBySqid("kqmv"); id != 0 {
		t.Errorf("materialized a manifest whose sqid isn't Sqid(id): id=%d", id)
	}
}

// A static app deserves an addressable URL as much as an instance does
// (platform-site is exactly that case). Its minted route must carry
// Kind=static AND the source route's Channel — the static handler resolves
// that channel pointer to find the tar, so a channel-less static route has
// nothing to serve.
func TestReconcileMintsStaticAppWithChannel(t *testing.T) {
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "carlosframework.com", Kind: "static",
		App: "platform-site", Status: "ready", Channel: "stable"})
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	got := mustGet(t, reg, "platform-site.bab.oncarlos.test")
	if !got.Platform || got.Kind != "static" || got.Channel != "stable" || got.Account != "bab" {
		t.Errorf("minted static route = %+v, want platform static on channel stable", got)
	}
	// Idempotence with the channel copy in place: the minted route now
	// follows "stable" itself, which must not confuse a second pass into
	// minting again (nor into treating it as a canary follower).
	n := routeCount(t, reg)
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if routeCount(t, reg) != n {
		t.Errorf("second Reconcile changed the route count: %d -> %d", n, routeCount(t, reg))
	}
	if got := mustGet(t, reg, "platform-site.bab.oncarlos.test"); got.Channel != "stable" {
		t.Errorf("second pass lost the minted route's channel: %+v", got)
	}
}

// A static app riding a canary channel mints an apex route ON that channel
// (it must, to serve anything) — and that route must NOT be swept away as a
// "retired canary follower" when the channel goes: only genuinely
// canary-minted hosts are removal candidates.
func TestReconcileKeepsStaticApexOnRetiredCanaryChannel(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "site.custom", Kind: "static", App: "site",
			Status: "ready", Channel: "canary/x"},
		registry.Route{Host: "site.bab.oncarlos.test", Kind: "static", App: "site",
			Status: "ready", Channel: "canary/x", Platform: true},
	)
	// No canary/x pointer exists in the bucket at all (retired).
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	mustGet(t, reg, "site.bab.oncarlos.test") // the apex mint survives
}

// Canary hosts are minted for STATIC apps only, where the copied channel
// genuinely is the backend (the static handler resolves the pointer to find
// the tar). See TestReconcileSkipsCanaryMintForInstanceApps for the other
// half of that rule and why it exists.
func TestReconcileMintsCanaryHost(t *testing.T) {
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "kass.training", Kind: "static",
		App: "kass", Status: "ready", Channel: "stable"})
	// The pointer's existence is what reconcile reads — content is not its
	// business (the edge verifies signatures when serving).
	if _, err := s.Put(ctx, "apps/bab/kass/channels/canary/pricing.json", []byte("{}"), ""); err != nil {
		t.Fatal(err)
	}
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	got := mustGet(t, reg, "pricing.kass.bab.oncarlos.test")
	if !got.Platform || got.Channel != "canary/pricing" || got.Kind != "static" || !got.Canary {
		t.Errorf("minted canary route = %+v", got)
	}
	// A followed canary never doubles up: the minted route follows the
	// channel now, so a second pass mints nothing new.
	n := routeCount(t, reg)
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if routeCount(t, reg) != n {
		t.Errorf("second Reconcile changed the route count: %d -> %d", n, routeCount(t, reg))
	}
}

// An instance app's canary host would be a LIE: a minted route can only
// copy an existing upstream, and the only upstream available is the app's
// stable process — so the "canary" URL would proxy straight to stable while
// the console labeled it with the canary's version. Nothing here spawns a
// per-host canary instance; that gap belongs to the not-yet-built `carlos
// canary`. Minting nothing is the honest answer until then.
func TestReconcileSkipsCanaryMintForInstanceApps(t *testing.T) {
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "kass.training", Kind: "instance",
		App: "kass", Status: "ready", Addr: "127.0.0.1:9000"})
	if _, err := s.Put(ctx, "apps/bab/kass/channels/canary/pricing.json", []byte("{}"), ""); err != nil {
		t.Fatal(err)
	}
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if rt, err := reg.Get("pricing.kass.bab.oncarlos.test"); err != nil || rt != nil {
		t.Errorf("minted a canary host for an instance app: %+v %v — it would serve stable, not the canary", rt, err)
	}
	// The app's ordinary apex still mints: only the canary host is withheld.
	mustGet(t, reg, "kass.bab.oncarlos.test")
}

// An account change (or any hand-edited account column) must never leave an
// app with two live apex domains: minting is additive — the pass never
// removes an apex — so the guard is "already has one", not "has the
// account-correct one".
func TestReconcileNeverMintsASecondApex(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "kass.training", Kind: "instance", App: "kass",
			Status: "ready", Addr: "127.0.0.1:9000"},
		registry.Route{Host: "kass.bab.oncarlos.test", Kind: "instance", App: "kass",
			Status: "ready", Addr: "127.0.0.1:9000", Platform: true, Account: "bab"},
	)
	// The app moves to another account: its objects are now under that sqid.
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/kass/channels/stable.json")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if rt, err := reg.Get("kass." + sqid + ".oncarlos.test"); err != nil || rt != nil {
		t.Errorf("minted a second apex %+v %v — one app, one platform apex", rt, err)
	}
	mustGet(t, reg, "kass.bab.oncarlos.test") // the existing apex stays live
}

func TestReconcileRemovesRetiredCanaryHostOnly(t *testing.T) {
	// The canary/old pointer is GONE from the bucket; its platform-minted
	// follower must be removed, but the custom route following the same
	// channel is owner property — reconciliation never touches it.
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "kass.training", Kind: "instance", App: "kass",
			Status: "ready", Addr: "127.0.0.1:9000"},
		registry.Route{Host: "old.kass.bab.oncarlos.test", Kind: "instance", App: "kass",
			Status: "ready", Addr: "127.0.0.1:9000", Channel: "canary/old", Platform: true, Canary: true},
		registry.Route{Host: "rc.kass.training", Kind: "instance", App: "kass",
			Status: "ready", Addr: "127.0.0.1:9000", Channel: "canary/old"},
	)
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if rt, err := reg.Get("old.kass.bab.oncarlos.test"); err != nil || rt != nil {
		t.Errorf("retired canary's platform route still present: %+v %v", rt, err)
	}
	mustGet(t, reg, "rc.kass.training") // the custom follower survives
}

func TestReconcileNeverTouchesCustomDomains(t *testing.T) {
	// A custom route whose app is dead (nothing ready, nothing shipped):
	// reconciliation must leave it exactly alone — and mint nothing, since
	// there is no ready upstream to copy.
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "kass.training", Kind: "instance",
		App: "kass", Status: "failed", Addr: "127.0.0.1:9000"})
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	mustGet(t, reg, "kass.training")
	if rt, err := reg.Get("kass.bab.oncarlos.test"); err != nil || rt != nil {
		t.Errorf("minted a platform route with no ready upstream: %+v %v", rt, err)
	}
}

func TestReconcileStampsDNS(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "points.test", Kind: "static", Status: "ready"},
		registry.Route{Host: "elsewhere.test", Kind: "static", Status: "ready"},
		registry.Route{Host: "broken.test", Kind: "static", Status: "ready"},
	)
	c := cfg(t)
	c.Resolve = func(host string) ([]string, error) {
		switch host {
		case "points.test":
			return []string{"198.51.100.9", "203.0.113.7"}, nil // edge IP among others
		case "elsewhere.test":
			return []string{"198.51.100.9"}, nil
		default:
			return nil, errors.New("server misbehaving") // not a *net.DNSError: our lookup failed, not an authoritative answer
		}
	}
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	if err := domains.StampHealth(ctx, reg, c, nil); err != nil { // as domainsLoop does after the pass
		t.Fatal(err)
	}
	now := c.Now().Unix()
	for host, want := range map[string]string{
		"points.test":    "pointing",
		"elsewhere.test": "elsewhere",
		// A non-DNSError resolver failure is OURS, not an authoritative
		// "no such name" — it must not read as "the customer has no record".
		"broken.test": "unresolved",
	} {
		got := mustGet(t, reg, host)
		if got.DNSStatus != want {
			t.Errorf("%s dns_status = %q, want %q", host, got.DNSStatus, want)
		}
		if got.DNSCheckedAt != now {
			t.Errorf("%s dns_checked_at = %d, want %d", host, got.DNSCheckedAt, now)
		}
	}
}

// The edge set is now asked for once PER PASS, not fixed at box start: under
// latency steering a correctly-pointed customer domain resolves to whichever
// region's edge is nearest, so a set frozen at boot reads a healthy domain as
// "elsewhere" the moment another region arms. This pins that the pass reads
// the CURRENT answer — a second pass with a widened set restamps.
func TestReconcileReadsTheEdgeSetEveryPass(t *testing.T) {
	reg := regWith(t,
		registry.Route{Host: "faraway.test", Kind: "static", Status: "ready"},
	)
	c := cfg(t)
	c.Resolve = func(host string) ([]string, error) { return []string{"198.51.100.9"}, nil }
	calls := 0
	// A second region's edge arms between the two passes.
	c.EdgeIPs = func() []string {
		calls++
		if calls > 1 {
			return []string{"203.0.113.7", "198.51.100.9"}
		}
		return []string{"203.0.113.7"}
	}
	if err := domains.StampHealth(ctx, reg, c, nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, reg, "faraway.test"); got.DNSStatus != "elsewhere" {
		t.Fatalf("pass 1: dns_status = %q, want elsewhere — that edge is not armed yet", got.DNSStatus)
	}
	if err := domains.StampHealth(ctx, reg, c, nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, reg, "faraway.test"); got.DNSStatus != "pointing" {
		t.Fatalf("pass 2: dns_status = %q, want pointing — the set is read per pass, not frozen at arm", got.DNSStatus)
	}
}

// A pass that knows NO edge addresses stands down rather than stamping.
// Stamping against an empty set would mark every host in the deployment
// "elsewhere" at once — a fleet-wide lying red raised by a failed bucket
// read, not by anybody's DNS. Existing stamps are left exactly as they were:
// the last thing this pass actually knew beats a verdict it had to guess.
func TestReconcileStandsDownWithNoEdgeIPs(t *testing.T) {
	reg := regWith(t,
		registry.Route{Host: "points.test", Kind: "static", Status: "ready"},
	)
	if err := domains.StampHealth(ctx, reg, cfg(t), nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, reg, "points.test"); got.DNSStatus != "pointing" {
		t.Fatalf("setup: dns_status = %q, want pointing", got.DNSStatus)
	}

	for name, edge := range map[string]func() []string{
		"an empty fold":  func() []string { return nil },
		"no func at all": nil,
	} {
		c := cfg(t)
		c.EdgeIPs = edge
		if err := domains.StampHealth(ctx, reg, c, nil); err != nil {
			t.Fatalf("%s: %v", name, err)
		}
		if got := mustGet(t, reg, "points.test"); got.DNSStatus != "pointing" {
			t.Errorf("%s: dns_status = %q, want the previous stamp left standing", name, got.DNSStatus)
		}
	}
}

// writeCertBundle writes what autocert's cachePut writes under DirCache key
// <host>: the private key PEM block first, then the CERTIFICATE chain — so
// the parser is exercised on skipping the key block.
func writeCertBundle(t *testing.T, dir, host string, notAfter time.Time) {
	t.Helper()
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Fatal(err)
	}
	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject:      pkix.Name{CommonName: host},
		DNSNames:     []string{host},
		NotBefore:    notAfter.Add(-24 * time.Hour),
		NotAfter:     notAfter,
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		t.Fatal(err)
	}
	kb, err := x509.MarshalECPrivateKey(key)
	if err != nil {
		t.Fatal(err)
	}
	var buf bytes.Buffer
	if err := pem.Encode(&buf, &pem.Block{Type: "EC PRIVATE KEY", Bytes: kb}); err != nil {
		t.Fatal(err)
	}
	if err := pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(dir, host), buf.Bytes(), 0o600); err != nil {
		t.Fatal(err)
	}
}

func TestReconcileStampsCertExpiry(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "kass.training", Kind: "instance", App: "kass",
			Status: "ready", Addr: "127.0.0.1:9000"},
		registry.Route{Host: "junk.test", Kind: "static", Status: "ready"},
	)
	acmeDir := t.TempDir()
	notAfter := time.Date(2026, 10, 12, 0, 0, 0, 0, time.UTC)
	writeCertBundle(t, acmeDir, "kass.training", notAfter)
	// An unparseable cache entry is unknown, same as absent — never a crash,
	// never a guess.
	if err := os.WriteFile(filepath.Join(acmeDir, "junk.test"), []byte("not pem at all"), 0o600); err != nil {
		t.Fatal(err)
	}
	c := cfg(t)
	c.AcmeDir = acmeDir
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	if err := domains.StampHealth(ctx, reg, c, nil); err != nil { // as domainsLoop does after the pass
		t.Fatal(err)
	}
	if got := mustGet(t, reg, "kass.training"); got.CertExpiresAt != notAfter.Unix() {
		t.Errorf("kass.training cert_expires_at = %d, want %d", got.CertExpiresAt, notAfter.Unix())
	}
	if got := mustGet(t, reg, "junk.test"); got.CertExpiresAt != 0 {
		t.Errorf("junk.test cert_expires_at = %d, want 0 (unparseable = unknown)", got.CertExpiresAt)
	}
	// The freshly minted platform route has no cached cert yet: 0.
	if got := mustGet(t, reg, "kass.bab.oncarlos.test"); got.CertExpiresAt != 0 {
		t.Errorf("minted route cert_expires_at = %d, want 0 (absent = unknown)", got.CertExpiresAt)
	}
}

// aliasByName finds an alias row by hostname among reg.ListAliases(), the
// same read-back-from-the-registry shape mustGet uses for routes.
func aliasByName(t *testing.T, reg *registry.Registry, alias string) registry.RouteAlias {
	t.Helper()
	aliases, err := reg.ListAliases()
	if err != nil {
		t.Fatal(err)
	}
	for _, a := range aliases {
		if a.Alias == alias {
			return a
		}
	}
	t.Fatalf("alias %s missing", alias)
	return registry.RouteAlias{}
}

func TestReconcileStampsAliasDNS(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "app.test", Kind: "static", Status: "ready"},
	)
	for _, a := range []string{"points-alias.test", "elsewhere-alias.test", "broken-alias.test"} {
		if err := reg.UpsertAlias(registry.RouteAlias{Alias: a, Host: "app.test"}); err != nil {
			t.Fatal(err)
		}
	}
	c := cfg(t)
	c.Resolve = func(host string) ([]string, error) {
		switch host {
		case "points-alias.test":
			return []string{"198.51.100.9", "203.0.113.7"}, nil // edge IP among others
		case "elsewhere-alias.test":
			return []string{"198.51.100.9"}, nil
		default:
			return nil, errors.New("server misbehaving") // not a *net.DNSError: our lookup failed, not an authoritative answer
		}
	}
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	if err := domains.StampHealth(ctx, reg, c, nil); err != nil { // as domainsLoop does after the pass
		t.Fatal(err)
	}
	now := c.Now().Unix()
	for alias, want := range map[string]string{
		"points-alias.test":    "pointing",
		"elsewhere-alias.test": "elsewhere",
		// A non-DNSError resolver failure is OURS, not an authoritative
		// "no such name" — it must not read as "the customer has no record".
		"broken-alias.test": "unresolved",
	} {
		got := aliasByName(t, reg, alias)
		if got.DNSStatus != want {
			t.Errorf("%s dns_status = %q, want %q", alias, got.DNSStatus, want)
		}
		if got.DNSCheckedAt != now {
			t.Errorf("%s dns_checked_at = %d, want %d", alias, got.DNSCheckedAt, now)
		}
	}
}

func TestReconcileStampsAliasCert(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "kass.training", Kind: "instance", App: "kass",
			Status: "ready", Addr: "127.0.0.1:9000"},
	)
	if err := reg.UpsertAlias(registry.RouteAlias{Alias: "kass-alias.training", Host: "kass.training"}); err != nil {
		t.Fatal(err)
	}
	acmeDir := t.TempDir()
	notAfter := time.Date(2026, 10, 12, 0, 0, 0, 0, time.UTC)
	writeCertBundle(t, acmeDir, "kass-alias.training", notAfter)
	c := cfg(t)
	c.AcmeDir = acmeDir
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	if err := domains.StampHealth(ctx, reg, c, nil); err != nil { // as domainsLoop does after the pass
		t.Fatal(err)
	}
	if got := aliasByName(t, reg, "kass-alias.training"); got.CertExpiresAt != notAfter.Unix() {
		t.Errorf("kass-alias.training cert_expires_at = %d, want %d", got.CertExpiresAt, notAfter.Unix())
	}
}

func TestReconcileInertWithoutAppsDomain(t *testing.T) {
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "kass.training", Kind: "instance",
		App: "kass", Status: "ready", Addr: "127.0.0.1:9000"})
	writeAccountManifest(t, s, 793481920157, "Kass") // present but must not be read
	before, err := reg.List()
	if err != nil {
		t.Fatal(err)
	}
	c := cfg(t)
	c.AppsDomain = ""
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	after, err := reg.List()
	if err != nil {
		t.Fatal(err)
	}
	if !reflect.DeepEqual(before, after) {
		t.Errorf("unconfigured Reconcile changed the registry:\nbefore %+v\nafter  %+v", before, after)
	}
	if accts, _ := reg.Accounts(); len(accts) != 1 {
		t.Errorf("unconfigured Reconcile materialized accounts: %+v (want only ops)", accts)
	}
}

// routesFor returns every route in the registry whose App is app — the shape
// the trash tests assert on, since "stops serving" means EVERY route, not one
// named host.
func routesFor(t *testing.T, reg *registry.Registry, app string) []registry.Route {
	t.Helper()
	routes, err := reg.List()
	if err != nil {
		t.Fatal(err)
	}
	var out []registry.Route
	for _, rt := range routes {
		if rt.App == app {
			out = append(out, rt)
		}
	}
	return out
}

// A trash marker is the owner saying "stop serving this app", so reconcile
// removes ALL of its routes — the custom domain included, which is the one
// destructive move inference alone would never be allowed. A custom domain
// still serving a "deleted" app would be the worse betrayal. And nothing
// re-mints: no apex, no canary host, on this pass or any later one.
func TestReconcileTrashedAppDropsAllRoutesAndMintsNothing(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
		registry.Route{Host: "derp." + domains.Sqid(793481920157) + ".oncarlos.test", Kind: "static",
			App: "derp", Status: "ready", Channel: "stable", Platform: true,
			Account: domains.Sqid(793481920157)},
		registry.Route{Host: "keep.custom", Kind: "static", App: "keep",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/derp/channels/canary/x.json")
	putKey(t, s, "apps/"+sqid+"/keep/channels/stable.json")
	if err := release.TrashApp(ctx, s, sqid, "derp", "paul@keymail.dev", time.Unix(1753900000, 0)); err != nil {
		t.Fatal(err)
	}

	for pass := 1; pass <= 2; pass++ {
		if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
			t.Fatalf("pass %d: %v", pass, err)
		}
		if got := routesFor(t, reg, "derp"); len(got) != 0 {
			t.Errorf("pass %d: trashed app still routed: %+v", pass, got)
		}
		// The neighbour in the same account is untouched by every pass: its
		// custom route stands and its apex mints as it always would.
		mustGet(t, reg, "keep.custom")
		if apex := mustGet(t, reg, "keep."+sqid+".oncarlos.test"); !apex.Platform || apex.Account != sqid {
			t.Errorf("pass %d: neighbour apex = %+v", pass, apex)
		}
	}
}

// "ALL of them" includes a route that never got its account column stamped.
// Such a row reads as ops until step 1b stamps it, so the removal lookup would
// miss a marker written under the tenant's account — the app would keep
// serving from its custom domain forever. The stamp has to land FIRST, from
// the account the bucket actually asserts, and then the removal matches.
func TestReconcileTrashedAppWithUnstampedRouteStillDrops(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable"}, // no Account column at all
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/derp/channels/stable.json")
	if err := release.TrashApp(ctx, s, sqid, "derp", "paul@keymail.dev", time.Unix(1753900000, 0)); err != nil {
		t.Fatal(err)
	}
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if got := routesFor(t, reg, "derp"); len(got) != 0 {
		t.Errorf("unstamped route of a trashed app survived: %+v", got)
	}
}

// THE safety property of the whole trash mechanism: app names are unique
// within an account and never globally, so two tenants legitimately both run a
// "derp". The removal key is (account, app) — one `release.RouteAccount(rt)`
// away from being a name-only match, and that one word is the difference
// between deleting an app and deleting a stranger's. Account A trashing its
// derp must leave B's derp exactly as it found it.
func TestReconcileTrashMarkerNeverCrossesAccounts(t *testing.T) {
	a, b := domains.Sqid(793481920157), domains.Sqid(555000111222)
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.a.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: a},
		registry.Route{Host: "derp." + a + ".oncarlos.test", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Platform: true, Account: a},
		registry.Route{Host: "derp.b.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: b},
		registry.Route{Host: "derp." + b + ".oncarlos.test", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Platform: true, Account: b},
	)
	if got := writeAccountManifest(t, s, 793481920157, "Ayy"); got != a {
		t.Fatalf("account A sqid = %q, want %q", got, a)
	}
	if got := writeAccountManifest(t, s, 555000111222, "Bee"); got != b {
		t.Fatalf("account B sqid = %q, want %q", got, b)
	}
	putKey(t, s, "apps/"+a+"/derp/channels/stable.json")
	putKey(t, s, "apps/"+b+"/derp/channels/stable.json")
	// Only A trashes its derp.
	if err := release.TrashApp(ctx, s, a, "derp", "paul@keymail.dev", time.Unix(1753900000, 0)); err != nil {
		t.Fatal(err)
	}

	wantHosts := []string{"derp.b.custom", "derp." + b + ".oncarlos.test"}
	slices.Sort(wantHosts) // reg.List returns hosts in sorted order
	var first []registry.Route
	for pass := 1; pass <= 2; pass++ {
		if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
			t.Fatalf("pass %d: %v", pass, err)
		}
		got := routesFor(t, reg, "derp")
		var hosts []string
		for _, rt := range got {
			hosts = append(hosts, rt.Host)
			if rt.Account != b {
				t.Errorf("pass %d: surviving route %s stamped %q, want B (%s)", pass, rt.Host, rt.Account, b)
			}
		}
		if !reflect.DeepEqual(hosts, wantHosts) {
			t.Fatalf("pass %d: derp routes = %v, want exactly B's %v — A's marker must not reach B",
				pass, hosts, wantHosts)
		}
		if pass == 1 {
			first = got
			continue
		}
		// Byte-identical across the second pass too: no re-stamp, no re-mint,
		// no field quietly rewritten under B.
		if !reflect.DeepEqual(first, got) {
			t.Errorf("second pass changed B's routes:\nfirst  %+v\nsecond %+v", first, got)
		}
	}
}

// A marker we cannot fully believe must not destroy routes: ReadAppTombstone
// errors, reconcile logs it and treats the app as live, every pass, until
// someone fixes or removes the object.
func TestReconcileMalformedTrashMarkerIsIgnoredLoudly(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/derp/channels/stable.json")
	// The body claims a different app than the path it sits at.
	if _, err := s.Put(ctx, release.AppTombstoneKey(sqid, "derp"),
		[]byte(`{"schema":1,"account":"`+sqid+`","app":"elsewhere","deleted_at":"2026-08-04T09:00:00Z"}`), ""); err != nil {
		t.Fatal(err)
	}
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	mustGet(t, reg, "derp.custom") // routes stay
	// ...and minting proceeds exactly as if no marker existed.
	if apex := mustGet(t, reg, "derp."+sqid+".oncarlos.test"); !apex.Platform || apex.Account != sqid {
		t.Errorf("apex = %+v — an unbelievable marker must change nothing", apex)
	}
}

// A retired apps/<app>/account.json (the domains spec's linkage manifest,
// superseded by the key path) is just another object in the bucket now — it
// must not be read, and above all must not re-home an app.
func TestReconcileIgnoresRetiredAppAccountManifests(t *testing.T) {
	s, reg := dirStore(t), regWith(t, registry.Route{Host: "kass.training", Kind: "instance",
		App: "kass", Status: "ready", Addr: "127.0.0.1:9000"})
	if _, err := s.Put(ctx, "apps/kass/account.json",
		[]byte(`{"account":"paul@keymail.dev","owner":"paul@keymail.dev"}`), ""); err != nil {
		t.Fatal(err)
	}
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if src := mustGet(t, reg, "kass.training"); src.Account != "bab" {
		t.Errorf("retired linkage manifest re-homed the app: %+v", src)
	}
	mustGet(t, reg, "kass.bab.oncarlos.test")
}

// releaseKeys mints a root release key pair the way the deployment does, so
// the purge pass has something real to verify a production flag against.
func releaseKeys(t *testing.T) (ed25519.PrivateKey, ed25519.PublicKey) {
	t.Helper()
	seedB64, pubB64, err := release.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	priv, err := release.ParseSigningKey(seedB64, "test")
	if err != nil {
		t.Fatal(err)
	}
	pub, err := release.ParsePublicKey(pubB64, "test")
	if err != nil {
		t.Fatal(err)
	}
	return priv, pub
}

// appKeysLeft is what is still in the bucket under an app — the purge's only
// observable effect.
func appKeysLeft(t *testing.T, s release.Store, acct, app string) []string {
	t.Helper()
	keys, err := s.List(ctx, "apps/"+acct+"/"+app+"/")
	if err != nil {
		t.Fatal(err)
	}
	slices.Sort(keys)
	return keys
}

// Past the cooloff, the pass DESTROYS: the app's objects and, last, its
// marker. The neighbour app in the same account is untouched, and the pass
// converges — a second run over an empty prefix changes nothing and does not
// error.
func TestReconcilePurgesAppsPastTheCooloff(t *testing.T) {
	_, pub := releaseKeys(t)
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/derp/channels/stable.json")
	putKey(t, s, "apps/"+sqid+"/derp/releases/1.0.0/manifest.json")
	putKey(t, s, "apps/"+sqid+"/keep/channels/stable.json")
	// Trashed 31 days before the config's clock.
	deleted := time.Unix(1754000000, 0).Add(-31 * 24 * time.Hour)
	if err := release.TrashApp(ctx, s, sqid, "derp", "paul@keymail.dev", deleted); err != nil {
		t.Fatal(err)
	}

	c := cfg(t)
	c.ReleasePub = pub
	for pass := 1; pass <= 2; pass++ {
		if err := domains.Reconcile(ctx, s, reg, c); err != nil {
			t.Fatalf("pass %d: %v", pass, err)
		}
		if got := appKeysLeft(t, s, sqid, "derp"); len(got) != 0 {
			t.Fatalf("pass %d: purge left objects behind: %v", pass, got)
		}
		if got := routesFor(t, reg, "derp"); len(got) != 0 {
			t.Errorf("pass %d: purged app still routed: %+v", pass, got)
		}
		if got := appKeysLeft(t, s, sqid, "keep"); len(got) != 1 {
			t.Fatalf("pass %d: the purge reached the neighbour app: %v", pass, got)
		}
	}
}

// Inside the cooloff the app is hidden but INTACT — that window is the whole
// point of a trash, and restoring it must give the owner their bytes back.
func TestReconcileDoesNotPurgeInsideTheCooloff(t *testing.T) {
	_, pub := releaseKeys(t)
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/derp/channels/stable.json")
	deleted := time.Unix(1754000000, 0).Add(-29 * 24 * time.Hour)
	if err := release.TrashApp(ctx, s, sqid, "derp", "paul@keymail.dev", deleted); err != nil {
		t.Fatal(err)
	}

	c := cfg(t)
	c.ReleasePub = pub
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	// Routes gone (the app is hidden), objects and marker still there.
	if got := routesFor(t, reg, "derp"); len(got) != 0 {
		t.Errorf("trashed app still routed: %+v", got)
	}
	want := []string{
		"apps/" + sqid + "/derp/channels/stable.json",
		release.AppTombstoneKey(sqid, "derp"),
	}
	slices.Sort(want)
	if got := appKeysLeft(t, s, sqid, "derp"); !reflect.DeepEqual(got, want) {
		t.Fatalf("inside the cooloff the bucket = %v, want %v — nothing may be destroyed yet", got, want)
	}
	if tomb, err := release.ReadAppTombstone(ctx, s, sqid, "derp"); err != nil || tomb == nil {
		t.Fatalf("marker gone inside the cooloff: %v, %v", tomb, err)
	}
}

// A box with no release public key cannot verify a production flag, so it
// cannot prove an app is safe to destroy: purging is OFF. Hiding still
// happens — that is reversible, destruction is not.
func TestReconcileWithoutAReleaseKeyHidesButNeverDestroys(t *testing.T) {
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/derp/channels/stable.json")
	deleted := time.Unix(1754000000, 0).Add(-31 * 24 * time.Hour)
	if err := release.TrashApp(ctx, s, sqid, "derp", "paul@keymail.dev", deleted); err != nil {
		t.Fatal(err)
	}

	c := cfg(t) // no ReleasePub
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	if got := routesFor(t, reg, "derp"); len(got) != 0 {
		t.Errorf("trashed app still routed: %+v", got)
	}
	if got := appKeysLeft(t, s, sqid, "derp"); len(got) != 2 {
		t.Fatalf("a keyless box destroyed objects: %v", got)
	}
}

// A trashed app that is ALSO flagged production is a contradiction the
// console refuses to create — but if one ever exists in a bucket, the flag
// wins and the bytes stay. Same for a flag that will not verify.
func TestReconcileNeverPurgesAProductionFlaggedApp(t *testing.T) {
	priv, pub := releaseKeys(t)
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/derp/channels/stable.json")
	// The flag goes on FIRST: SetProduction refuses a trashed app.
	if err := release.SetProduction(ctx, s, priv, sqid, "derp", true, "paul@keymail.dev"); err != nil {
		t.Fatal(err)
	}
	deleted := time.Unix(1754000000, 0).Add(-31 * 24 * time.Hour)
	if err := release.TrashApp(ctx, s, sqid, "derp", "paul@keymail.dev", deleted); err != nil {
		t.Fatal(err)
	}

	c := cfg(t)
	c.ReleasePub = pub
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	if got := appKeysLeft(t, s, sqid, "derp"); len(got) != 3 {
		t.Fatalf("a production-flagged app was purged: %v", got)
	}
	if tomb, err := release.ReadAppTombstone(ctx, s, sqid, "derp"); err != nil || tomb == nil {
		t.Fatalf("marker gone: %v, %v", tomb, err)
	}
}

// The route-drop is as dangerous as the purge, and cheaper to reach: a trash
// marker is UNSIGNED, so anyone holding PutObject can write one. If a marker
// alone could take a production app's routes down, a bucket writer with no
// signing key would have a fleet-wide outage button. So on a box that can
// verify, the flag outranks the marker: nothing is dropped, nothing is
// destroyed, and the contradiction is said out loud every pass.
func TestReconcileNeverDropsRoutesOfAProductionFlaggedApp(t *testing.T) {
	priv, pub := releaseKeys(t)
	s, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
	)
	sqid := writeAccountManifest(t, s, 793481920157, "Kass")
	putKey(t, s, "apps/"+sqid+"/derp/channels/stable.json")
	// The flag goes on FIRST: SetProduction refuses a trashed app.
	if err := release.SetProduction(ctx, s, priv, sqid, "derp", true, "paul@keymail.dev"); err != nil {
		t.Fatal(err)
	}
	// Past the cooloff too, so a guard that only covered hiding would show up
	// here as destroyed bytes.
	deleted := time.Unix(1754000000, 0).Add(-31 * 24 * time.Hour)
	if err := release.TrashApp(ctx, s, sqid, "derp", "eve@evil.example", deleted); err != nil {
		t.Fatal(err)
	}

	var logged bytes.Buffer
	log.SetOutput(&logged)
	t.Cleanup(func() { log.SetOutput(os.Stderr) })

	c := cfg(t)
	c.ReleasePub = pub
	apex := "derp." + sqid + ".oncarlos.test"
	for pass := 1; pass <= 2; pass++ {
		if err := domains.Reconcile(ctx, s, reg, c); err != nil {
			t.Fatalf("pass %d: %v", pass, err)
		}
		// The custom domain survives, and the app is treated as live in every
		// other respect — its platform apex mints once and is not re-minted.
		mustGet(t, reg, "derp.custom")
		mustGet(t, reg, apex)
		if got := routesFor(t, reg, "derp"); len(got) != 2 {
			t.Fatalf("pass %d: routes = %+v, want the custom domain and exactly one apex", pass, got)
		}
		if got := appKeysLeft(t, s, sqid, "derp"); len(got) != 3 {
			t.Fatalf("pass %d: bytes destroyed under a production flag: %v", pass, got)
		}
	}
	// The refusal is the contract, not a side effect of some later check: an
	// operator who wrote that marker on purpose has to be told why nothing
	// happened, every pass, or they will assume deletion is broken.
	if !strings.Contains(logged.String(), "trash marker on production app") {
		t.Errorf("no refusal logged; log was:\n%s", logged.String())
	}
}

// flagUnreadableStore breaks exactly one read — the app's production flag —
// the way an attacker with delete-but-not-sign, or a half-broken bucket,
// would. Everything else reads normally, so the marker is perfectly valid
// and only the flag is in doubt.
type flagUnreadableStore struct {
	release.Store
	key string
}

func (s flagUnreadableStore) Get(ctx context.Context, key string) ([]byte, string, error) {
	if key == s.key {
		return nil, "", errors.New("bucket refused the read")
	}
	return s.Store.Get(ctx, key)
}

// An UNREADABLE flag refuses in the same direction as an ON one. "Cannot
// prove it is not production" and "is production" get the same answer on
// every destructive path in this platform, because the state an attacker can
// manufacture is exactly the unreadable one.
func TestReconcileDoesNotDropRoutesWhenTheProductionFlagIsUnreadable(t *testing.T) {
	_, pub := releaseKeys(t)
	dir, reg := dirStore(t), regWith(t,
		registry.Route{Host: "derp.custom", Kind: "static", App: "derp",
			Status: "ready", Channel: "stable", Account: domains.Sqid(793481920157)},
	)
	sqid := writeAccountManifest(t, dir, 793481920157, "Kass")
	putKey(t, dir, "apps/"+sqid+"/derp/channels/stable.json")
	deleted := time.Unix(1754000000, 0).Add(-31 * 24 * time.Hour)
	if err := release.TrashApp(ctx, dir, sqid, "derp", "paul@keymail.dev", deleted); err != nil {
		t.Fatal(err)
	}
	s := flagUnreadableStore{Store: dir, key: release.ProductionKey(sqid, "derp")}

	var logged bytes.Buffer
	log.SetOutput(&logged)
	t.Cleanup(func() { log.SetOutput(os.Stderr) })

	c := cfg(t)
	c.ReleasePub = pub
	if err := domains.Reconcile(ctx, s, reg, c); err != nil {
		t.Fatal(err)
	}
	mustGet(t, reg, "derp.custom")
	if got := appKeysLeft(t, dir, sqid, "derp"); len(got) != 2 {
		t.Fatalf("bytes destroyed while the flag was unreadable: %v", got)
	}
	if !strings.Contains(logged.String(), "cannot read the production flag") {
		t.Errorf("no refusal logged; log was:\n%s", logged.String())
	}
}

// #303: the health stamps are a per-box pass with no lease involved —
// callable on their own, stamping routes AND aliases from this box's view,
// and a no-op with nothing configured.
func TestStampHealthStandsAlone(t *testing.T) {
	reg := regWith(t, registry.Route{Host: "app.acct.oncarlos.test", Kind: "service", Addr: "10.0.0.1:1", Status: "ready"})
	if err := reg.UpsertAlias(registry.RouteAlias{Alias: "www.customer.test", Host: "app.acct.oncarlos.test", Account: "acct", App: "app"}); err != nil {
		t.Fatal(err)
	}
	cfg := domains.Config{
		AppsDomain: "oncarlos.test",
		EdgeIPs:    func() []string { return []string{"203.0.113.7"} },
		Resolve: func(host string) ([]string, error) {
			if host == "www.customer.test" {
				return []string{"203.0.113.7"}, nil
			}
			return []string{"198.51.100.1"}, nil
		},
	}
	if err := domains.StampHealth(context.Background(), reg, cfg, nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, reg, "app.acct.oncarlos.test"); got.DNSStatus != "elsewhere" {
		t.Errorf("route dns_status = %q; want elsewhere", got.DNSStatus)
	}
	aliases, err := reg.ListAliases()
	if err != nil || len(aliases) != 1 || aliases[0].DNSStatus != "pointing" {
		t.Errorf("alias dns_status: %+v, %v; want pointing", aliases, err)
	}
	// Nothing configured: nothing stamped, no error.
	reg2 := regWith(t, registry.Route{Host: "x.test", Kind: "service", Addr: "10.0.0.1:1", Status: "ready"})
	if err := domains.StampHealth(context.Background(), reg2, domains.Config{AppsDomain: "oncarlos.test"}, nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, reg2, "x.test"); got.DNSStatus != "" || got.DNSCheckedAt != 0 {
		t.Errorf("unconfigured pass stamped %+v", got)
	}
}

// OUR failure never overwrites a verdict: the last known verdict and its
// stamp time stay, so a bad DNS tick cannot unpublish a working custom
// domain (#287's gate) or launder staleness into "never checked".
//
// An authoritative NXDOMAIN is the opposite case and DOES stamp — the
// resolver answered, and the answer is that the record is gone.
func TestStampHealthHoldsLastVerdictOnResolverFailure(t *testing.T) {
	reg := regWith(t, registry.Route{Host: "app.acct.oncarlos.test", Kind: "service", Addr: "10.0.0.1:1", Status: "ready"})
	if err := reg.UpsertAlias(registry.RouteAlias{Alias: "www.customer.test", Host: "app.acct.oncarlos.test", Account: "acct", App: "app"}); err != nil {
		t.Fatal(err)
	}
	good := domains.Config{AppsDomain: "oncarlos.test", EdgeIPs: func() []string { return []string{"203.0.113.7"} },
		Resolve: func(string) ([]string, error) { return []string{"203.0.113.7"}, nil },
		Now:     func() time.Time { return time.Unix(1000, 0) }}
	if err := domains.StampHealth(context.Background(), reg, good, nil); err != nil {
		t.Fatal(err)
	}
	broken := good
	broken.Resolve = func(string) ([]string, error) { return nil, errors.New("SERVFAIL") }
	broken.Now = func() time.Time { return time.Unix(2000, 0) }
	if err := domains.StampHealth(context.Background(), reg, broken, nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, reg, "app.acct.oncarlos.test"); got.DNSStatus != "pointing" || got.DNSCheckedAt != 1000 {
		t.Errorf("route after resolver failure = %q @%d; want pointing @1000", got.DNSStatus, got.DNSCheckedAt)
	}
	aliases, _ := reg.ListAliases()
	if len(aliases) != 1 || aliases[0].DNSStatus != "pointing" || aliases[0].DNSCheckedAt != 1000 {
		t.Errorf("alias after resolver failure = %+v; want pointing @1000", aliases)
	}
	// A never-checked row records that we could not check — "unresolved",
	// not "" — so the operator can tell our outage from a missing record.
	fresh := regWith(t, registry.Route{Host: "new.acct.oncarlos.test", Kind: "service", Addr: "10.0.0.1:1", Status: "ready"})
	if err := domains.StampHealth(context.Background(), fresh, broken, nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, fresh, "new.acct.oncarlos.test"); got.DNSStatus != "unresolved" || got.DNSCheckedAt != 2000 {
		t.Errorf("fresh row = %q @%d; want unresolved @2000", got.DNSStatus, got.DNSCheckedAt)
	}

	// And the case the guard must NOT swallow: the customer deleted the
	// record. NXDOMAIN is an answer, so "pointing" gives way to it. Without
	// this, a domain that stopped resolving would read "pointing" forever.
	gone := good
	gone.Resolve = func(string) ([]string, error) {
		return nil, &net.DNSError{Err: "no such host", IsNotFound: true}
	}
	gone.Now = func() time.Time { return time.Unix(3000, 0) }
	if err := domains.StampHealth(context.Background(), reg, gone, nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, reg, "app.acct.oncarlos.test"); got.DNSStatus != "" || got.DNSCheckedAt != 3000 {
		t.Errorf("route after NXDOMAIN = %q @%d; want \"\" @3000 — an authoritative answer is news", got.DNSStatus, got.DNSCheckedAt)
	}
}

// Back-to-back passes are idempotent: a second StampHealth with the same
// view changes nothing but dns_checked_at.
func TestStampHealthIsIdempotent(t *testing.T) {
	reg := regWith(t, registry.Route{Host: "app.acct.oncarlos.test", Kind: "service", Addr: "10.0.0.1:1", Status: "ready"})
	c := cfg(t)
	for i := 0; i < 2; i++ {
		if err := domains.StampHealth(context.Background(), reg, c, nil); err != nil {
			t.Fatal(err)
		}
	}
	if got := mustGet(t, reg, "app.acct.oncarlos.test"); got.DNSStatus != "pointing" || got.DNSCheckedAt != c.Now().Unix() {
		t.Errorf("after two passes: %q @%d", got.DNSStatus, got.DNSCheckedAt)
	}
	// And inert with no apps domain, per Config's contract.
	if err := domains.StampHealth(context.Background(), reg, domains.Config{Resolve: c.Resolve, Now: func() time.Time { return time.Unix(9, 0) }}, nil); err != nil {
		t.Fatal(err)
	}
	if got := mustGet(t, reg, "app.acct.oncarlos.test"); got.DNSCheckedAt == 9 {
		t.Error("a pass with no AppsDomain wrote a stamp")
	}
}

// The #344 shape, live on the flagship 2026-08-28: a route with an EMPTY
// account column, for an app whose name holds objects under ops (a stray
// pipeline.json from an abandoned attempt) AND under the tenant that
// actually ships it. The ops fallback used to win the tie; the host's own
// sqid label — birthday-alarm.<sqid>.oncarlos.com literally names its
// owner — must win instead. The mis-stamp deleted the tenant's delivered
// config (syncexec keyed apps/bab/...) and the app died on every wake.
func TestReconcileStampsTheHostsOwnAccountNotOpsOnATie(t *testing.T) {
	sqidNum := int64(793481920157)
	s, reg := dirStore(t), regWith(t)
	sqid := writeAccountManifest(t, s, sqidNum, "Paulca")
	if err := reg.Upsert(registry.Route{Host: "birthday-alarm." + sqid + ".oncarlos.test",
		Kind: "instance", App: "birthday-alarm", Status: "ready",
		Socket: "/run/carlos/birthday-alarm.sock"}); err != nil {
		t.Fatal(err)
	}
	putKey(t, s, "apps/bab/birthday-alarm/pipeline.json") // the stray
	putKey(t, s, "apps/"+sqid+"/birthday-alarm/config.json")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if rt := mustGet(t, reg, "birthday-alarm."+sqid+".oncarlos.test"); rt.Account != sqid {
		t.Errorf("account = %q, want %s — the ops fallback won a tie the host itself decides", rt.Account, sqid)
	}
}

// The same tie on a host that names NO account (a custom domain): the pass
// must leave the row alone rather than defaulting it onto ops — an
// unstamped row already reads as ops at runtime, so stamping buys nothing
// and a wrong stamp deletes config (#344).
func TestReconcileLeavesAnAmbiguousCustomDomainUnstamped(t *testing.T) {
	s, reg := dirStore(t), regWith(t)
	sqid := writeAccountManifest(t, s, 793481920157, "Paulca")
	if err := reg.Upsert(registry.Route{Host: "birthdays.example.com",
		Kind: "instance", App: "birthday-alarm", Status: "ready",
		Socket: "/run/carlos/birthdays.sock"}); err != nil {
		t.Fatal(err)
	}
	putKey(t, s, "apps/bab/birthday-alarm/pipeline.json")
	putKey(t, s, "apps/"+sqid+"/birthday-alarm/config.json")
	if err := domains.Reconcile(ctx, s, reg, cfg(t)); err != nil {
		t.Fatal(err)
	}
	if rt := mustGet(t, reg, "birthdays.example.com"); rt.Account != "" {
		t.Errorf("account = %q, want unstamped — ambiguity is not ops's to win", rt.Account)
	}
}

// The plans limits record lives beside the manifest, at
// accounts/<sqid>/limits.json. It must never be mistaken for one.
func TestAccountManifestSqidIgnoresLimitsRecord(t *testing.T) {
	if _, ok := domains.AccountManifestSqid("accounts/abc/limits.json"); ok {
		t.Fatal("accounts/abc/limits.json parsed as an account manifest")
	}
}