package host

import (
	"context"
	"crypto/ed25519"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/activator"
	"github.com/carlosframework/platform/internal/cgroup"
	"github.com/carlosframework/platform/internal/genselect"
	"github.com/carlosframework/platform/internal/hostbox"
	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/hostguard"
	"github.com/carlosframework/platform/internal/hostwrite"
	"github.com/carlosframework/platform/internal/lease"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
)

// These tests drive the real wake assembly, serving retries, launch journal,
// guard and stop coordinator. The kernel below is a fixture that reads the
// real launch journal; it is not privileged cgroup or /proc verification.

const recoveryHost = "shop.bab.oncarlos.com"

var recoveryPolicy = activator.StartPolicy{MaxStarts: 5, Window: 30 * time.Second}

type recoveryHeld struct{}

func (recoveryHeld) Err() error                    { return nil }
func (recoveryHeld) Lost() <-chan struct{}         { return nil }
func (recoveryHeld) Release(context.Context) error { return nil }
func (recoveryHeld) BindGeneration(string, func(context.Context) error) error {
	return hostwrite.ErrUnavailable
}
func (recoveryHeld) Replicate(context.Context, string, time.Duration) (*lease.Replicator, error) {
	return nil, hostwrite.ErrUnavailable
}

type recoveryInputs struct{ f *recoveryFixture }

func (r recoveryInputs) Select(_ context.Context, _ registry.Route, o hostclaim.Observed, _ activator.StartPolicy) (ClaimLaunchInputs, error) {
	h := o.Claim.Holder
	r.f.seq++
	return ClaimLaunchInputs{Roles: []string{"main"}, Identity: hostwrite.Identity{Config: "config", Release: "release"}, Admission: hostclaim.Admission{ObservedSession: h.Session, ObservedGeneration: h.Generation, Box: "box-1", Mode: "cold", NewGeneration: fmt.Sprintf("gen-%d", r.f.seq), Region: "ie", PredecessorRegion: "ie"}, Executable: "/usr/bin/true", ExecutableSHA256: strings.Repeat("a", 64), DBPath: filepath.Join(r.f.guard.DataDir, "state", "data.db"), Empty: true}, nil
}
func (r recoveryInputs) Materialize(ctx context.Context, o hostclaim.Observed, _ ClaimLaunchInputs, _ hostwrite.Work) error {
	if r.f.materialize == nil {
		return nil
	}
	return r.f.materialize(ctx, o)
}
func (r recoveryInputs) EmptyAuthority(context.Context, hostclaim.Observed, ClaimLaunchInputs) error {
	return r.f.restoreFailure
}
func (recoveryInputs) Publish(context.Context, hostclaim.Observed, ClaimLaunchInputs) error {
	return nil
}

type recoveryKernel struct {
	noProcess      bool
	noProcessCalls int
	journal        *hostbox.LaunchJournal
	alive          bool
	verified       []hostguard.FenceTarget
	recovered      []hostguard.FenceTarget
}

func (k *recoveryKernel) evidence(inv StopInventory, j hostbox.StopKernelJournal) StopKernelEvidence {
	groups := []string{}
	for _, g := range j.Cgroups {
		groups = append(groups, fmt.Sprintf("%s:%d:%d", g.RelativePath, g.Device, g.Inode))
	}
	return StopKernelEvidence{ObservedBootID: j.Target.BootID, InventorySHA256: digestStop(inv), LocalJournalSHA256: digestStop(j), CgroupIdentities: groups, UnitInvocationIDs: []string{}}
}
func (k *recoveryKernel) VerifyStopped(ctx context.Context, t hostguard.FenceTarget, inv StopInventory, ack DrainAcknowledgement) (StopKernelEvidence, error) {
	k.verified = append(k.verified, t)
	j, err := k.journal.ReadStopKernelJournal(ctx, t)
	if err != nil {
		return StopKernelEvidence{}, err
	}
	if !j.Settled {
		return StopKernelEvidence{}, ErrClaimStopInventory
	}
	if err := validateClaimDrainProducers(j.ProducerIDs, ack); err != nil {
		return StopKernelEvidence{}, err
	}
	return k.evidence(inv, j), nil
}
func (k *recoveryKernel) RecoverStopped(ctx context.Context, t hostguard.FenceTarget, inv StopInventory) (StopKernelEvidence, DrainAcknowledgement, error) {
	k.recovered = append(k.recovered, t)
	j, err := k.journal.ReadStopKernelJournal(ctx, t)
	if err != nil {
		return StopKernelEvidence{}, DrainAcknowledgement{}, err
	}
	if k.alive {
		return StopKernelEvidence{}, DrainAcknowledgement{}, ErrClaimStopControllerAlive
	}
	if err := k.journal.SettleRecovered(ctx, t); err != nil {
		return StopKernelEvidence{}, DrainAcknowledgement{}, err
	}
	j.Settled = true
	return k.evidence(inv, j), DrainClaimAcknowledgement(t.FenceID, t.ControllerID, j.ProcessStart, j.ProducerIDs), nil
}

type recoveryFixture struct {
	host            string
	journalPath     string
	data            genselect.Reader
	bucket          string
	t               *testing.T
	claims          release.Store
	evidence        release.Store
	signer          ed25519.PrivateKey
	guard           hostguard.Guard
	journal         *hostbox.LaunchJournal
	kernel          *recoveryKernel
	now             time.Time
	seq             int
	peer            StopPeer
	requests        []StopRequest
	materialize     func(context.Context, hostclaim.Observed) error
	restoreFailure  error
	recordPrelaunch bool
	revision        uint64
	// box, enrollment, region and leaseRegion are the controller's box
	// identity: box-1, enrollment-1, ie and eu-west-1 when unset. A moves
	// fixture sets its target box's (home part 2: home-box in its roster
	// region ie).
	box, enrollment, region, leaseRegion string
	// homeRegion is the writer's verified home alias (hostbox.Writer's
	// HomeRegion), "" for none. admissionEvidence, when set, is the
	// writer's AdmissionEvidence: the claim's owner dispatch in production
	// (claimassembly.go), bound before the runtime is built because Build
	// captures the writer. Unset, every admission's evidence passes.
	homeRegion        string
	admissionEvidence func(context.Context, hostclaim.Observed, hostclaim.Admission, *genselect.Plan) error
	// fleetHomeRegion is the fleet's signed home designation the box's
	// actor carries; with homeRegion it is the controller's own stop
	// identity's home binding (park.VerifiedHome). "" for none.
	fleetHomeRegion string
}

// identity is the controller's box identity, the defaults filled in.
func (f *recoveryFixture) identity() (box, enrollment, region, leaseRegion string) {
	box, enrollment, region, leaseRegion = "box-1", "enrollment-1", "ie", "eu-west-1"
	if f.box != "" {
		box = f.box
	}
	if f.enrollment != "" {
		enrollment = f.enrollment
	}
	if f.region != "" {
		region = f.region
	}
	if f.leaseRegion != "" {
		leaseRegion = f.leaseRegion
	}
	return box, enrollment, region, leaseRegion
}

type recoveryController struct {
	local    claimStopLocal
	wake     *ClaimWakeAssembly
	runtime  *activator.ClaimRuntime
	assembly ClaimAssembly
}

func newRecoveryFixture(t *testing.T, hosts ...string) *recoveryFixture {
	host := recoveryHost
	if len(hosts) > 0 {
		host = hosts[0]
	}
	t.Helper()
	ctx := t.Context()
	st := release.NewDirStore(t.TempDir())
	now := time.Date(2026, 10, 6, 12, 0, 0, 0, time.UTC)
	in := hostclaim.NewHolder{Family: "instance", Key: "apps/bab/jam/instances/" + host + ".json", Account: "bab", App: "jam", Host: host, Region: "ie", RecordRegion: "ie", CreatedAt: now}
	body := []byte(strings.ReplaceAll(`{"schema":1,"host":"shop.bab.oncarlos.com","account":"bab","app":"jam","region":"ie","created_at":"2026-10-06T12:00:00Z"}`, recoveryHost, host))
	absent, err := hostclaim.Read(ctx, st, host)
	if err != nil {
		t.Fatal(err)
	}
	o, err := hostclaim.Update(ctx, st, absent, hostclaim.BeginCreate(in, body, "create", "console", now))
	if err != nil {
		t.Fatal(err)
	}
	if _, err = hostclaim.Update(ctx, st, o, hostclaim.CompleteCreate("create", "box-1")); err != nil {
		t.Fatal(err)
	}
	data := t.TempDir()
	if err = os.Mkdir(filepath.Join(data, "hostguard"), 0770); err != nil {
		t.Fatal(err)
	}
	journalPath := filepath.Join(t.TempDir(), "launches.db")
	journal, err := hostbox.OpenLaunchJournal(journalPath)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { journal.Close() })
	return &recoveryFixture{host: host, journalPath: journalPath, t: t, claims: st, evidence: release.NewDirStore(t.TempDir()), signer: ed25519.NewKeyFromSeed(make([]byte, ed25519.SeedSize)), guard: hostguard.Guard{DataDir: data, LockDir: t.TempDir(), Claims: hostguard.StoreReader{Store: st}}, journal: journal, kernel: &recoveryKernel{journal: journal}, now: now, recordPrelaunch: true}
}

func (f *recoveryFixture) newID() string { f.seq++; return fmt.Sprintf("id-%d", f.seq) }

func (f *recoveryFixture) hostName() string {
	if f.host != "" {
		return f.host
	}
	return recoveryHost
}

func (f *recoveryFixture) read() hostclaim.Observed {
	f.t.Helper()
	o, err := hostclaim.Read(f.t.Context(), f.claims, f.hostName())
	if err != nil {
		f.t.Fatal(err)
	}
	return o
}

func (f *recoveryFixture) retry() hostclaim.WakeRetry {
	f.t.Helper()
	o := f.read()
	if o.Claim.Holder.WakeRetry == nil {
		f.t.Fatal("retry episode missing")
	}
	return *o.Claim.Holder.WakeRetry
}

func recoveryTuple(o hostclaim.Observed, l claimStopLocal) hostguard.FenceTarget {
	h := o.Claim.Holder
	// Fixture actors without a binding stamp their numeral (the shorthand of
	// handoverRecoveryIdentity); a production actor stamps its binding.
	stamp := l.Actor.Binding
	if stamp == "" {
		stamp = fmt.Sprint(l.Actor.Revision)
	}
	return hostguard.FenceTarget{Region: l.Actor.Region, Host: o.Host, Incarnation: h.Incarnation, Stamp: h.Stamp, Session: h.Session, Box: l.Actor.Box, Enrollment: l.Actor.Enrollment, BootID: l.BootID, ControllerID: l.ControllerID, ClaimETag: o.ETag, DirectoryRevision: stamp, RosterRevision: l.Actor.Revision}
}

// rosterRevision is root's verified roster read in this fixture: the roster
// the controllers' actors read, at f.revision (7 when unset).
func (f *recoveryFixture) rosterRevision(context.Context) (uint64, error) {
	if f.revision == 0 {
		return 7, nil
	}
	return f.revision, nil
}

// root is instance-control's coordinator for one request. The live peer is
// whichever controller process the fixture most recently started.
func (f *recoveryFixture) root(drain StopDrainer) ClaimStopCoordinator {
	return ClaimStopCoordinator{VerifiedRosterRevision: f.rosterRevision, EvidenceSigner: f.signer, RequestLimit: hostbox.RequestLimit, Guard: f.guard, Claims: hostguard.StoreReader{Store: f.claims}, CarlosUID: 1001, Evidence: f.evidence, Drainer: drain, Kernel: f.kernel, NewID: f.newID, Now: func() time.Time { return f.now },
		Peers: stopPeerFunc(func(context.Context) (StopPeer, error) { return f.peer, nil }),
		Inventory: stopInventoryFunc(func(ctx context.Context, host string) (StopInventory, error) {
			o, err := hostclaim.Read(ctx, f.claims, host)
			if err != nil {
				return StopInventory{}, err
			}
			h := o.Claim.Holder
			box, enrollment, _, _ := f.identity()
			return StopInventory{Complete: true, Host: host, Incarnation: h.Incarnation, InstallationStamp: h.Stamp, Box: box, Enrollment: enrollment, DirectoryRevision: "7"}, nil
		})}
}

// controller starts one agent process: its own wake assembly, retries and stop
// path, sharing the durable claim, guard and launch journal of the box.
// recoveryFixtureBinding is the fixture box's binding (shorthand "7"). A
// controller started after a roster write (f.revision) keeps it: roster
// writes move the counter, not the box's binding.
const recoveryFixtureBinding = "7"

func (f *recoveryFixture) controller(boot, controller string, pid int, start string) *recoveryController {
	t := f.t
	revision := f.revision
	if revision == 0 {
		revision = 7
	}
	box, enrollment, region, leaseRegion := f.identity()
	local := claimStopLocal{Actor: hostbox.Actor{Box: box, Enrollment: enrollment, Revision: revision, Binding: recoveryFixtureBinding, Region: region, HomeRegion: f.homeRegion, FleetHomeRegion: f.fleetHomeRegion}, BootID: boot, ControllerID: controller, PID: pid, ProcessStart: start}
	f.peer = StopPeer{UID: 1001, PID: pid, ProcessStart: start, BootID: boot, ControllerID: controller}
	producers := &ClaimProducerSet{}
	w := &ClaimWakeAssembly{LeaseRegion: leaseRegion, Inputs: recoveryInputs{f}, Manager: new(cgroup.Manager)}
	w.AfterAdmission = func(context.Context, hostclaim.Observed, hostclaim.Observed) error { return nil }
	// The unprivileged state-directory fixture runs under the real selected
	// work; ColdRestore and its generation-marker writes remain unchanged.
	w.PrepareState = func(ctx context.Context, _ hostclaim.Observed, work hostwrite.Work, in ClaimLaunchInputs) error {
		return work.With(ctx, in.Identity, func() error { return os.MkdirAll(filepath.Dir(in.DBPath), 0700) })
	}
	w.RetireArtifacts = func(context.Context, hostclaim.Observed, ClaimLaunchInputs, string) error { return hostbox.ErrChanged }
	w.Retain = func(hostclaim.Observed, activator.Proc, activator.Rep, error) {}
	w.ObserveLoss = func(hostclaim.Observed, error) {}
	w.Producers = func(_ context.Context, o hostclaim.Observed) (*ClaimProducers, error) {
		return producers.Ensure(recoveryTuple(o, local), start, f.journal.RecordProducer)
	}
	w.Launch = func(context.Context, hostclaim.Observed, hostwrite.Work, ClaimLaunchInputs, *activator.RoleLaunch) (*activator.RoleLaunch, error) {
		return nil, hostwrite.ErrUnavailable
	}
	w.Prelaunch = func(ctx context.Context, o hostclaim.Observed, work hostwrite.Work, in ClaimLaunchInputs) (*activator.RoleLaunch, error) {
		target := recoveryTuple(o, local)
		if !f.recordPrelaunch {
			// rev1 placement: nothing is journaled until the launch itself.
			return &activator.RoleLaunch{Target: target, Journal: f.journal}, nil
		}
		err := work.With(ctx, in.Identity, func() error {
			return f.journal.Prelaunch(ctx, hostbox.LaunchInventory{ControllerPID: pid, ProcessStart: start, Target: target, Groups: []hostbox.LaunchGroup{{RelativePath: "carlos/" + claimContainmentName(target), Device: 1, Inode: target.Session}}, NoState: true})
		})
		if err != nil {
			return nil, err
		}
		return &activator.RoleLaunch{Target: target, Journal: f.journal}, nil
	}
	w.Retries = activator.ServingRetries{Claims: f.claims, Box: box, Enrollment: enrollment, BootID: boot, ControllerID: controller, Now: func() time.Time { return f.now }, NewID: f.newID, Inputs: func(context.Context, registry.Route) (string, error) { return "inputs", nil }}
	a := ClaimAssembly{Claims: f.claims, Launches: f.journal, Wake: w, Producers: producers, stopLocal: func(context.Context) (claimStopLocal, error) { return local, nil }}
	a.collectStop = func(ctx context.Context, req StopRequest, drain StopDrainer) (StopResult, error) {
		f.requests = append(f.requests, req)
		result, err := f.root(drain).FenceAndStop(ctx, req)
		if err != nil {
			return result, err
		}
		return validateTransportStop(req, result)
	}
	a.bindClaimWakeStop()
	source := hostbox.WorkSource{Guard: f.guard, Box: box, Region: region, Now: func() time.Time { return f.now }, Policy: func(context.Context, *hostclaim.Claim, hostbox.Selection, hostwrite.Identity) error { return nil }, Local: func(context.Context, *hostclaim.Claim, hostbox.Selection) error { return nil }}
	evidence := f.admissionEvidence
	if evidence == nil {
		evidence = func(context.Context, hostclaim.Observed, hostclaim.Admission, *genselect.Plan) error { return nil }
	}
	writer := hostbox.Writer{HomeRegion: f.homeRegion, Data: f.data, Bucket: f.bucket, Claims: f.claims, Box: box, Region: region, AdmissionEvidence: evidence}
	runtime, err := w.Build(t.Context(), source, writer)
	if err != nil {
		t.Fatal(err)
	}
	return &recoveryController{local: local, wake: w, runtime: runtime, assembly: a}
}

// admit stands in for Prerequisites' S3 lease, then reserves, admits, journals
// the pre-launch record and binds the attempt through the real runtime.
func (c *recoveryController) admit(t *testing.T, f *recoveryFixture) hostclaim.Observed {
	t.Helper()
	live, cancel := context.WithCancel(context.Background())
	t.Cleanup(cancel)
	done := make(chan struct{})
	go func() { <-live.Done(); close(done) }()
	o := f.read()
	c.wake.mu.Lock()
	c.wake.pending[recoveryHost] = &claimWakeAttempt{observed: o, held: recoveryHeld{}, ctx: live, cancel: cancel, done: done}
	c.wake.mu.Unlock()
	admitted, err := c.runtime.Admit(t.Context(), registry.Route{Host: recoveryHost}, o, recoveryPolicy)
	if err != nil {
		t.Fatal(err)
	}
	if r := admitted.Claim.Holder.WakeRetry; r == nil || r.Attempt == nil || r.Attempt.Session != admitted.Claim.Holder.Session || r.Attempt.ControllerID != c.local.ControllerID {
		t.Fatalf("attempt not bound to admitted session: %+v", r)
	}
	return admitted
}

func (f *recoveryFixture) receipts() []StopReceipt {
	f.t.Helper()
	keys, err := f.evidence.List(f.t.Context(), "control/hosts/"+recoveryHost+"/serving-evidence/")
	if err != nil {
		f.t.Fatal(err)
	}
	out := []StopReceipt{}
	for _, key := range keys {
		if strings.HasSuffix(key, ".sig") {
			continue
		}
		body, _, err := f.evidence.Get(f.t.Context(), key)
		if err != nil {
			f.t.Fatal(err)
		}
		var r StopReceipt
		if err = json.Unmarshal(body, &r); err != nil {
			f.t.Fatal(err)
		}
		out = append(out, r)
	}
	return out
}

func TestClaimWakeRestoreFailureSettlesFromPrelaunchRecord(t *testing.T) {
	f := newRecoveryFixture(t)
	ctx := t.Context()
	c := f.controller("boot-1", "controller-1", 4101, "start-1")
	admitted := c.admit(t, f)
	// The record exists before Prepare can hand out a Restore closure.
	record, err := f.journal.Read(ctx, recoveryTuple(admitted, c.local))
	if err != nil || record.ControllerPID != 4101 || record.ProcessStart != "start-1" || len(record.Groups) != 1 || len(record.Reservations) != 0 || !record.NoState {
		t.Fatalf("no recoverable pre-launch record before restore: %+v %v", record, err)
	}
	s, err := c.runtime.Prepare(ctx, registry.Route{Host: recoveryHost}, admitted, recoveryPolicy)
	if err != nil {
		t.Fatal(err)
	}
	// Fail inside the production restore closure after PrepareState, at
	// ColdRestore's empty-authority check. Do not replace that closure.
	failure := errors.New("initial-empty authority unavailable")
	f.restoreFailure = failure
	restoreErr := s.Restore(ctx)
	if !errors.Is(restoreErr, failure) {
		t.Fatalf("restore failure = %v", restoreErr)
	}
	if _, err := os.Stat(filepath.Join(f.guard.DataDir, "state")); err != nil {
		t.Fatalf("PrepareState did not run: %v", err)
	}
	if err = c.runtime.FailedAdmission(ctx, admitted, restoreErr); err != nil {
		t.Fatalf("restore failure stranded the attempt: %v", err)
	}
	retry := f.retry()
	if retry.State != "open" || retry.AttemptsReserved != 1 || retry.Attempt != nil {
		t.Fatalf("restore failure not settled without refund: %+v", retry)
	}
	if c.wake.get(recoveryHost) != nil {
		t.Fatal("failed attempt still pending")
	}
	if len(f.kernel.verified) == 0 || len(f.kernel.recovered) != 0 {
		t.Fatalf("verified=%d recovered=%d", len(f.kernel.verified), len(f.kernel.recovered))
	}
	for _, req := range f.requests {
		if req.Recover || req.ControllerID != "controller-1" || req.WriterSession != admitted.Claim.Holder.Session {
			t.Fatalf("live controller stop used another tuple: %+v", req)
		}
	}
	if got := f.receipts(); len(got) != 1 || got[0].ControllerID != "controller-1" || got[0].WriterSession != admitted.Claim.Holder.Session {
		t.Fatalf("receipts = %+v", got)
	}
}

// Control for the test above: with rev1's placement, nothing is journaled
// before launch, root cannot verify the stop and the attempt stays reserved.
func TestClaimWakeRestoreFailureWithoutPrelaunchRecordStrands(t *testing.T) {
	f := newRecoveryFixture(t)
	f.restoreFailure = errors.New("initial-empty authority unavailable")
	ctx := t.Context()
	f.recordPrelaunch = false
	c := f.controller("boot-1", "controller-1", 4101, "start-1")
	admitted := c.admit(t, f)
	s, err := c.runtime.Prepare(ctx, registry.Route{Host: recoveryHost}, admitted, recoveryPolicy)
	if err != nil {
		t.Fatal(err)
	}
	restoreErr := s.Restore(ctx)
	if err = c.runtime.FailedAdmission(ctx, admitted, restoreErr); err == nil {
		t.Fatal("stop verified without a launch record")
	}
	if retry := f.retry(); retry.State != "attempting" || retry.AttemptsReserved != 1 {
		t.Fatalf("retry = %+v", retry)
	}
	if got := f.receipts(); len(got) != 0 {
		t.Fatalf("evidence without a launch record: %+v", got)
	}
}

func TestClaimWakeMaterializeFailureSettlesFromPrelaunchRecord(t *testing.T) {
	f := newRecoveryFixture(t)
	ctx := t.Context()
	c := f.controller("boot-1", "controller-1", 4101, "start-1")
	admitted := c.admit(t, f)
	failure := errors.New("materialization failed")
	recorded := false
	f.materialize = func(ctx context.Context, o hostclaim.Observed) error {
		_, err := f.journal.Read(ctx, recoveryTuple(o, c.local))
		recorded = err == nil
		return failure
	}
	s, err := c.runtime.Prepare(ctx, registry.Route{Host: recoveryHost}, admitted, recoveryPolicy)
	if err != nil {
		t.Fatal(err)
	}
	if err := s.Restore(ctx); err != nil {
		t.Fatal(err)
	}
	// startAdmitted's loop: validate the reservation, materialize, then Failed.
	if err = s.Reserve(ctx, 0); err != nil {
		t.Fatal(err)
	}
	materializeErr := s.Materialize(ctx)
	if !errors.Is(materializeErr, failure) || !recorded {
		t.Fatalf("materialization ran without the pre-launch record: recorded=%v err=%v", recorded, materializeErr)
	}
	if err = s.Failed(ctx, 0); err != nil {
		t.Fatalf("materialization failure stranded the attempt: %v", err)
	}
	if err = c.runtime.FailedAdmission(ctx, admitted, materializeErr); err != nil {
		t.Fatal(err)
	}
	retry := f.retry()
	if retry.State != "open" || retry.AttemptsReserved != 1 || retry.Attempt != nil {
		t.Fatalf("materialization failure not settled without refund: %+v", retry)
	}
	if len(f.kernel.verified) != 1 {
		t.Fatalf("the repeated stop recollected evidence: %d", len(f.kernel.verified))
	}
}

func TestClaimRetryCrashBeforeLaunchRecoversOriginalTupleAfterRestart(t *testing.T) {
	f := newRecoveryFixture(t)
	ctx := t.Context()
	former := f.controller("boot-1", "controller-1", 4101, "start-1")
	admitted := former.admit(t, f)
	prepared, err := former.runtime.Prepare(ctx, registry.Route{Host: recoveryHost}, admitted, recoveryPolicy)
	if err != nil {
		t.Fatal(err)
	}
	// Run the assembly's real ColdRestore.InstallEmpty, then discard the
	// ClaimStart before materialization or launch.
	materializations := 0
	f.materialize = func(context.Context, hostclaim.Observed) error { materializations++; return nil }
	if err := prepared.Restore(ctx); err != nil {
		t.Fatal(err)
	}
	marker := filepath.Join(f.guard.DataDir, "state", "data.db.gen")
	if raw, err := os.ReadFile(marker); err != nil || strings.TrimSpace(string(raw)) != admitted.Claim.Holder.Generation {
		t.Fatalf("real restore boundary: %q %v", raw, err)
	}
	t.Cleanup(func() {
		if materializations != 0 {
			t.Fatalf("materialization ran across the crash: %d", materializations)
		}
	})
	attempt := *admitted.Claim.Holder.WakeRetry.Attempt
	// The controller crashes after restore and before materialization. A later record
	// for another session must not be touched by recovering this one.
	successor := recoveryTuple(admitted, claimStopLocal{Actor: former.local.Actor, BootID: "boot-1", ControllerID: "controller-2"})
	successor.Session++
	successor.Stamp++
	if err := f.journal.Prelaunch(ctx, hostbox.LaunchInventory{ControllerPID: 4202, ProcessStart: "start-2", Target: successor, Groups: []hostbox.LaunchGroup{{RelativePath: "carlos/successor", Device: 1, Inode: 99}}, NoState: true}); err != nil {
		t.Fatal(err)
	}
	reservation := hostbox.LaunchReservation{ID: "successor:main", Role: "main", InvocationID: "successor-invocation", Inputs: "inputs", Target: successor, Group: hostbox.LaunchGroup{RelativePath: "carlos/successor/role", Device: 1, Inode: 100, InvocationID: "successor-invocation"}, Executable: hostbox.LaunchFile{Device: 1, Inode: 101}}
	if err := f.journal.Reserve(ctx, reservation); err != nil {
		t.Fatal(err)
	}

	restarted := f.controller("boot-1", "controller-2", 4202, "start-2")
	rt := registry.Route{Host: recoveryHost}
	f.kernel.alive = true
	err = restarted.runtime.Prerequisites(ctx, rt, f.read(), recoveryPolicy)
	if !errors.Is(err, ErrClaimStopControllerAlive) {
		t.Fatalf("live former controller = %v", err)
	}
	if retry := f.retry(); retry.State != "attempting" || retry.Attempt == nil || *retry.Attempt != attempt || retry.AttemptsReserved != 1 {
		t.Fatalf("settled before the former controller was proved dead: %+v", retry)
	}
	if got := f.receipts(); len(got) != 0 {
		t.Fatalf("evidence before proof: %+v", got)
	}

	f.kernel.alive = false
	if err = restarted.runtime.Prerequisites(ctx, rt, f.read(), recoveryPolicy); !errors.Is(err, hostbox.ErrChanged) {
		t.Fatalf("settlement after restart = %v", err)
	}
	for _, req := range f.requests {
		if !req.Recover || req.BootID != attempt.BootID || req.ControllerID != attempt.ControllerID || req.WriterSession != attempt.Session {
			t.Fatalf("restarted controller substituted its own tuple: %+v", req)
		}
	}
	if len(f.kernel.verified) != 0 || len(f.kernel.recovered) != 2 || f.kernel.recovered[0].FenceID != f.kernel.recovered[1].FenceID {
		t.Fatalf("verified=%v recovered=%v", f.kernel.verified, f.kernel.recovered)
	}
	for _, target := range f.kernel.recovered {
		if target.ControllerID != "controller-1" || target.BootID != "boot-1" || target.Session != attempt.Session {
			t.Fatalf("recovery target = %+v", target)
		}
	}
	retry := f.retry()
	if retry.State != "open" || retry.AttemptsReserved != 1 || retry.Attempt != nil {
		t.Fatalf("crash attempt not settled without refund: %+v", retry)
	}
	if got := f.receipts(); len(got) != 1 || got[0].ControllerID != "controller-1" || got[0].BootID != "boot-1" {
		t.Fatalf("receipts = %+v", got)
	}
	other, err := f.journal.Read(ctx, successor)
	if err != nil || len(other.Reservations) != 1 || other.Reservations[0].State != "reserved" {
		t.Fatalf("recovery changed another session's record: %+v %v", other, err)
	}
	// The next wake stops its predecessor through the same journaled tuple and
	// reuses the durable evidence instead of being refused for controller-2.
	if err = restarted.wake.Stop(ctx, f.read()); err != nil {
		t.Fatalf("predecessor stop after restart = %v", err)
	}
	if len(f.kernel.recovered) != 2 || len(f.kernel.verified) != 0 {
		t.Fatalf("predecessor stop recollected: recovered=%d verified=%d", len(f.kernel.recovered), len(f.kernel.verified))
	}
}

func TestClaimRetryRecoveryRefusesMissingLaunchRecord(t *testing.T) {
	f := newRecoveryFixture(t)
	ctx := t.Context()
	f.recordPrelaunch = false
	former := f.controller("boot-1", "controller-1", 4101, "start-1")
	admitted := former.admit(t, f)
	attempt := *admitted.Claim.Holder.WakeRetry.Attempt
	restarted := f.controller("boot-2", "controller-2", 4202, "start-2")
	err := restarted.runtime.Prerequisites(ctx, registry.Route{Host: recoveryHost}, f.read(), recoveryPolicy)
	if err == nil || errors.Is(err, hostbox.ErrChanged) {
		t.Fatalf("missing launch record settled: %v", err)
	}
	if len(f.requests) != 1 || !f.requests[0].Recover || f.requests[0].ControllerID != "controller-1" || f.requests[0].BootID != "boot-1" {
		t.Fatalf("stop requests = %+v", f.requests)
	}
	if retry := f.retry(); retry.State != "attempting" || retry.Attempt == nil || *retry.Attempt != attempt || retry.AttemptsReserved != 1 {
		t.Fatalf("retry = %+v", retry)
	}
	if got := f.receipts(); len(got) != 0 {
		t.Fatalf("evidence without a launch record: %+v", got)
	}
}

type recoveryOnlyKernel struct {
	stopKernelFunc
	recover func(context.Context, hostguard.FenceTarget, StopInventory) (StopKernelEvidence, DrainAcknowledgement, error)
}

func (k recoveryOnlyKernel) RecoverStopped(ctx context.Context, t hostguard.FenceTarget, in StopInventory) (StopKernelEvidence, DrainAcknowledgement, error) {
	return k.recover(ctx, t, in)
}

func TestClaimStopRecoveryModeRefusesWithoutRootProof(t *testing.T) {
	c, req, _ := claimStopFixture(t)
	seq := 0
	c.NewID = func() string { seq++; return fmt.Sprintf("id-%d", seq) }
	drained := false
	c.Drainer = stopDrainFunc(func(context.Context, StopRequest, string) (DrainAcknowledgement, error) {
		drained = true
		return DrainAcknowledgement{}, nil
	})
	c.Peers = stopPeerFunc(func(context.Context) (StopPeer, error) {
		return StopPeer{UID: 1001, PID: 43, ProcessStart: "start-43", BootID: "boot-1", ControllerID: "controller-2"}, nil
	})
	if _, err := c.FenceAndStop(t.Context(), req); !errors.Is(err, ErrClaimStopIdentity) {
		t.Fatalf("another tuple without recovery = %v", err)
	}
	req.Recover = true
	if _, err := c.FenceAndStop(t.Context(), req); !errors.Is(err, ErrClaimStopUnavailable) || drained || seq != 0 {
		t.Fatalf("recovery without a recovery kernel = %v drained=%v ids=%d", err, drained, seq)
	}
	if pending, err := c.Guard.PendingFences(t.Context()); err != nil || len(pending) != 0 {
		t.Fatalf("refused recovery installed a fence: %+v %v", pending, err)
	}
	cleanup := req
	cleanup.Cleanup = true
	if _, err := c.FenceAndStop(t.Context(), cleanup); !errors.Is(err, ErrClaimStopUnavailable) {
		t.Fatalf("recovery combined with cleanup = %v", err)
	}
	evidence := StopKernelEvidence{InventorySHA256: strings.Repeat("b", 64), LocalJournalSHA256: strings.Repeat("c", 64), CgroupIdentities: []string{"cg-1"}}
	c.Kernel = recoveryOnlyKernel{recover: func(_ context.Context, target hostguard.FenceTarget, _ StopInventory) (StopKernelEvidence, DrainAcknowledgement, error) {
		return StopKernelEvidence{}, DrainAcknowledgement{}, ErrClaimStopControllerAlive
	}}
	if _, err := c.FenceAndStop(t.Context(), req); !errors.Is(err, ErrClaimStopControllerAlive) {
		t.Fatalf("live former controller = %v", err)
	}
	// The same IDs and process start as the live peer are that peer, not a
	// former controller, whatever the recovery kernel reports.
	c.Peers = stopPeerFunc(func(context.Context) (StopPeer, error) {
		return StopPeer{UID: 1001, PID: 42, ProcessStart: "start-42", BootID: req.BootID, ControllerID: req.ControllerID}, nil
	})
	c.Kernel = recoveryOnlyKernel{recover: func(_ context.Context, target hostguard.FenceTarget, _ StopInventory) (StopKernelEvidence, DrainAcknowledgement, error) {
		return evidence, DrainClaimAcknowledgement(target.FenceID, target.ControllerID, "start-42", nil), nil
	}}
	if _, err := c.FenceAndStop(t.Context(), req); !errors.Is(err, ErrClaimStopIdentity) {
		t.Fatalf("live peer recovered as former controller = %v", err)
	}
	c.Kernel = recoveryOnlyKernel{recover: func(_ context.Context, target hostguard.FenceTarget, _ StopInventory) (StopKernelEvidence, DrainAcknowledgement, error) {
		return evidence, DrainClaimAcknowledgement(target.FenceID, target.ControllerID, "start-41", nil), nil
	}}
	result, err := c.FenceAndStop(t.Context(), req)
	if err != nil || drained {
		t.Fatalf("restarted controller recovery = %v drained=%v", err, drained)
	}
	if result.Target.ControllerID != req.ControllerID || result.Target.BootID != req.BootID {
		t.Fatalf("recovery receipt names %+v", result.Target)
	}
}

func TestClaimRetryRecoveryRetainsRecordedDirectoryRevision(t *testing.T) {
	f := newRecoveryFixture(t)
	former := f.controller("boot-1", "controller-1", 4101, "start-1")
	former.admit(t, f)
	f.revision = 8
	restarted := f.controller("boot-1", "controller-2", 4202, "start-2")
	err := restarted.runtime.Prerequisites(t.Context(), registry.Route{Host: recoveryHost}, f.read(), recoveryPolicy)
	if !errors.Is(err, hostbox.ErrChanged) {
		t.Fatalf("same-enrollment roster change stranded recovery: %v", err)
	}
	if len(f.requests) != 1 || f.requests[0].ExpectedDirectoryRevision != "7" {
		t.Fatalf("recovery substituted current directory: %+v", f.requests)
	}
	if retry := f.retry(); retry.State != "open" || retry.Attempt != nil || retry.AttemptsReserved != 1 {
		t.Fatalf("retry = %+v", retry)
	}
}

func (k *recoveryKernel) VerifyNoProcess(ctx context.Context, target hostguard.FenceTarget, inv StopInventory) (StopKernelEvidence, error) {
	k.noProcessCalls++
	if !k.noProcess {
		return StopKernelEvidence{}, ErrClaimStopInventory
	}
	has, err := k.journal.HasHost(ctx, target.Host)
	if err != nil || has {
		return StopKernelEvidence{}, ErrClaimStopInventory
	}
	return StopKernelEvidence{InventorySHA256: digestStop(inv), LocalJournalSHA256: strings.Repeat("c", 64), CgroupIdentities: []string{"absent:carlos-exec@shop.example"}, UnitInvocationIDs: []string{}}, nil
}