package host

// The moves park providers in production (moves Plan 5 Task 9a; the delta's
// findings M5, M6, M9, M10 and M17, the Task 9a rulings, and the rulings
// after claim Plan 12: Q1, Q10). Two things are built here and registered
// with the claim at agent start, before newClaimWiring:
//
//   - the park view (movesParkView): the spec's authoritative-region table
//     (§5.1), the exact-version generation marker, and the pins;
//   - Task 5's retirement evidence (movesRetirementEvidence), which also
//     answers VerifyMovesSweep.
//
// The lease set for moves scopes (M6) is the claim's own,
// hostbox.ReplicaParkLeaseSet, which the claim's MoveParks engine resolves
// through hostbox.AggregateLeases; moves registers none.
//
// The moves arms then take the claim's own regional engine through
// ClaimProviders.MoveParks (armMovesParks): its leases, view and authorizer,
// after checking that its bucket and region are this box's own (M17), with
// park.Engine.RunHeld over those leases (M5) and the MoveParks local
// authorizer (M9).
//
// Registration and arming happen only with both CARLOS_MOVES_PHASE1 and
// CARLOS_HOST_CLAIM on, and both default to off. Even then one gate,
// movesWakeSourceRegistered, stands in front of both: it opens only once
// this box's moves source (the wake owners, Plan 5 Task 9b,
// moveswakesource.go) is registered with the claim through
// registerMovesWakeSource, which the agent does right after the parks. The
// conditions production arming still needs are listed in
// moveswakesource.go. While the gate is shut:
//
//   - the registered view refuses every call with a *ClaimDependencyError
//     naming Task 9b, so the claim's regional worker and its at-rest sweep
//     queue and run nothing through it;
//   - armMovesParks leaves every park hook unset, so every moves arm stays
//     unarmed and logs its standing notice.

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"sort"
	"strings"
	"sync"
	"time"

	"github.com/carlosframework/platform/internal/activator"
	"github.com/carlosframework/platform/internal/genselect"
	"github.com/carlosframework/platform/internal/hostbox"
	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/hostfiles"
	"github.com/carlosframework/platform/internal/hostwrite"
	"github.com/carlosframework/platform/internal/lease"
	"github.com/carlosframework/platform/internal/moves"
	"github.com/carlosframework/platform/internal/park"
	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/release"
)

// movesNoLiveRegion is the authoritative region the view names when the
// spec's table says none: a claim with no holder, or a creating, deleting,
// parking or purging op. The "@" keeps it outside the placement-code
// alphabet (provision.ValidRegion; "none" itself is a valid code) and apart
// from park.HomeRegion, so no box's region is ever it and the engine protects
// nothing in any region, which is what "nothing is live" means.
const movesNoLiveRegion = "@none"

// parkRegion is this box's engine region: its placement code through
// park.PlacementRegion, so the home's "" is park.HomeRegion (home-region
// parks, part 1). Every park engine a moves arm builds, every chore it looks
// for or queues in its own region, and the region its claim's engine must
// have go through it. An invalid code maps to "", which arms nothing and
// which every engine entry refuses.
func (c moveCfg) parkRegion() string { return park.PlacementRegion(c.Region) }

// movesBoxRegion refuses a placement that disagrees with the verified roster.
// productionRosterRegion maps home only after checking the signed designation.
func movesBoxRegion(placement string, resolve func(context.Context) (string, error)) func(context.Context) (string, error) {
	return func(ctx context.Context) (string, error) {
		want := park.PlacementRegion(placement)
		if want == "" {
			return "", fmt.Errorf("%w: this box's placement %q is not a placement code", park.ErrUnsafe, placement)
		}
		got, err := resolve(ctx)
		if err != nil {
			return "", err
		}
		if got != want {
			return "", fmt.Errorf("%w: the claim names this box's region %q, its placement's engine region is %q", park.ErrUnsafe, got, want)
		}
		return got, nil
	}
}

// movesWakeSourceContract is what the gate names while it is shut.
const movesWakeSourceContract = "moves wake owners and C8 files manifest provider (Plan 5 Task 9b)"

// movesWakeSourceRegistration is this box's moves source as registered with
// the claim: a pointer of moves' own, so the gate can tell the claim's
// registered source is this one and not another.
type movesWakeSourceRegistration struct{ ClaimProductionMoveSources }

// movesWakeSource is what registerMovesWakeSource registered, nil before.
var movesWakeSource struct {
	sync.Mutex
	registered *movesWakeSourceRegistration
}

// registerMovesWakeSource registers src, this box's moves source (the wake
// owners and the C8 files manifest provider, Plan 5 Task 9b), with the claim
// (RegisterProductionClaimMoveSources), and records it for the gate. It is
// one-shot, as the claim's slot is; any refusal records nothing. In
// production registerProductionMovesWakeSource calls it, with both
// switches on, and so arms the parks (Plan 5 Task 9b).
func registerMovesWakeSource(src ClaimProductionMoveSources) error {
	if src == nil {
		return hostwrite.ErrUnavailable
	}
	movesWakeSource.Lock()
	defer movesWakeSource.Unlock()
	if movesWakeSource.registered != nil {
		return hostwrite.ErrUnavailable
	}
	reg := &movesWakeSourceRegistration{src}
	if err := RegisterProductionClaimMoveSources(reg); err != nil {
		return err
	}
	movesWakeSource.registered = reg
	return nil
}

// movesWakeSourceRegistered is the one gate between the moves parks and
// production (Q1): nil only once registerMovesWakeSource succeeded and the
// claim's registered move source is still that registration; otherwise a
// *ClaimDependencyError naming Task 9b. The parks then arm in the same agent
// start as the wake owners, never before, and until then the registered
// view refuses, so the claim's sweep is not widened to every host.
func movesWakeSourceRegistered() error {
	movesWakeSource.Lock()
	reg := movesWakeSource.registered
	movesWakeSource.Unlock()
	if reg != nil {
		claimMoveSources.Lock()
		ours := claimMoveSources.Source == ClaimProductionMoveSources(reg)
		claimMoveSources.Unlock()
		if ours {
			return nil
		}
	}
	return &ClaimDependencyError{Contracts: []string{movesWakeSourceContract}}
}

// movesRunHeld is the moves arms' RunHeld (M5): park.Engine.RunHeld, which
// runs one chore under a lease the caller already holds, the build's
// own-location lease, which a landing keeps from checking through published
// (spec §7.6). The engine's leases must lend it (AcquireHeld, the claim's
// hostbox.AggregateLeases); Engine.Run would take the same lock again and
// wait on the build itself.
func movesRunHeld(ctx context.Context, e park.Engine, w park.Work, held park.HeldLease) error {
	return e.RunHeld(ctx, w, held)
}

// heldLender is what park.Engine.RunHeld needs of an engine's leases to
// borrow the caller's held lease (hostbox.AggregateLeases).
type heldLender interface {
	AcquireHeld(ctx context.Context, bucket, scope string, own park.HeldLease) (park.HeldLease, error)
}

// movesParkView is the park view the claim's engine and the moves arms read
// (park.View): bound to the observation's ETag, seen from region (in
// production the claim's own region, movesParkViewAt), naming
// the authoritative region by the spec's table (§5.1, movesAuthoritative).
// In the authoritative region it reads the location's generation.json by
// exact version (MarkerKnown, MarkerGeneration, Marker; absent is the origin)
// and pins the snapshot version the marker names, the installed root.
// GenerationOf is the landing's classifier over the holder's location.
// Anything it cannot read or place is an error, never a smaller live set.
func movesParkView(records MovesRecordReader, data genselect.Reader, bucket, region string) func(context.Context, hostclaim.Observed) (park.View, error) {
	return movesParkViewAt(records, data, bucket, fixedRegion(region))
}

// fixedRegion is a region resolver that always answers region.
func fixedRegion(region string) func(context.Context) (string, error) {
	return func(context.Context) (string, error) { return region, nil }
}

// cachedRegion resolves once and keeps the first success; a failure is
// returned and asked again next time. A box's roster region does not change
// under a running agent; if it did, the engine's own check (the view's
// region against its own) refuses.
func cachedRegion(resolve func(context.Context) (string, error)) func(context.Context) (string, error) {
	var mu sync.Mutex
	var cached *string
	return func(ctx context.Context) (string, error) {
		mu.Lock()
		defer mu.Unlock()
		if cached != nil {
			return *cached, nil
		}
		r, err := resolve(ctx)
		if err != nil {
			return "", err
		}
		cached = &r
		return r, nil
	}
}

// movesParkViewAt is movesParkView seen from the region regionOf answers.
// Production's is the claim's verified roster row's region
// (productionRosterRegion), the region the claim's engine runs in, so the
// view's region is the claim's by construction (M17; fix round 1), held to
// this box's placement by movesBoxRegion. Every region it names is an engine
// region: the home is park.HomeRegion, never "", and a region of "" (unset)
// refuses. The record's placement codes are mapped once, in
// movesAuthoritative.
func movesParkViewAt(records MovesRecordReader, data genselect.Reader, bucket string, regionOf func(context.Context) (string, error)) func(context.Context, hostclaim.Observed) (park.View, error) {
	return func(ctx context.Context, obs hostclaim.Observed) (park.View, error) {
		if ctx == nil || records == nil || data == nil || bucket == "" || regionOf == nil {
			return park.View{}, hostwrite.ErrUnavailable
		}
		if obs.Absent || obs.Claim == nil || obs.ETag == "" || obs.Host == "" || obs.Claim.Host != obs.Host {
			return park.View{}, park.ErrUnsafe
		}
		region, err := regionOf(ctx)
		if err != nil {
			return park.View{}, fmt.Errorf("this box's region: %w", err)
		}
		if region == "" {
			return park.View{}, fmt.Errorf("%w: this box's region is unset", park.ErrUnsafe)
		}
		auth, err := movesAuthoritative(ctx, records, obs, region)
		if err != nil {
			return park.View{}, err
		}
		v := park.View{HomeRegion: obs.Claim.Op.Intent["home_region"], ClaimETag: obs.ETag, Region: region, AuthoritativeRegion: auth}
		h := obs.Claim.Holder
		if h == nil {
			return v, nil
		}
		location := strings.TrimSuffix(h.Location, "/")
		v.GenerationOf = func(r park.Ref) (string, bool) { return landingGenerationOf(location, r.Key) }
		if !park.SameRegion(v.HomeRegion, auth, region) {
			return v, nil
		}
		listing, err := data.ListVersions(ctx, bucket, location+"/")
		if err != nil {
			return park.View{}, fmt.Errorf("list %s: %w", location, err)
		}
		if err := readMarker(ctx, data, bucket, obs.Host, location, *h, listing, &v); err != nil {
			return park.View{}, err
		}
		if err := pinFilesLiveSet(ctx, data, bucket, location, listing, &v, liveGenerations(obs.Claim, v)...); err != nil {
			return park.View{}, err
		}
		return v, nil
	}
}

// liveGenerations are the generations whose files manifests are live
// (fix round 1, I2): the holder's and the marker's, and every generation
// park.LiveGenerations, the engine's own protected set, names for the
// holder's location, the unfinished admission chain included. When the
// engine refuses that walk it refuses every park of the location too, so
// the holder's and the marker's are enough then. Sorted, for a stable read
// order.
func liveGenerations(c *hostclaim.Claim, v park.View) []string {
	seen := map[string]bool{c.Holder.Generation: true, v.MarkerGeneration: true}
	if live, err := park.LiveGenerations(c, v, c.Holder.Location); err == nil {
		for g := range live {
			seen[g] = true
		}
	}
	out := make([]string, 0, len(seen))
	for g := range seen {
		out = append(out, g)
	}
	sort.Strings(out)
	return out
}

// pinFilesLiveSet pins the files live set (J2/F4, Paul's #236 ruling; M10):
// every exact version an object a live generation's files manifest names,
// read through hostfiles.Load by the version the listing names. The live
// generations are liveGenerations'. The rule is M10's: spec
// §6.6 P6-D3 says a target's manifest never references a source-region
// object, so a manifest in this region's bucket names objects in this
// region's bucket, and a region pins only what its own live manifests name.
// With no manifest, nothing more is pinned. A manifest that names an object
// outside the location, or one the listing does not hold, refuses.
func pinFilesLiveSet(ctx context.Context, data genselect.Reader, bucket, location string, listing []lease.ObjectVersion, v *park.View, generations ...string) error {
	seen := map[string]bool{}
	for _, gen := range generations {
		if gen == "" || gen == hostclaim.RootGeneration || gen == landingMarkerGeneration || seen[gen] {
			continue
		}
		seen[gen] = true
		prefix := movesFilesPrefix(location, gen)
		key := hostfiles.ManifestKey(prefix)
		var current *lease.ObjectVersion
		for i := range listing {
			if listing[i].Key == key && listing[i].IsLatest {
				current = &listing[i]
			}
		}
		if current == nil {
			continue
		}
		if current.DeleteMarker || current.VersionID == "" || current.VersionID == "null" {
			return fmt.Errorf("%w: %s is not a readable version", park.ErrUnsafe, key)
		}
		m, found, err := hostfiles.Load(ctx, versionStore{data: data, bucket: bucket, key: key, version: current.VersionID}, prefix)
		if err != nil || !found {
			return fmt.Errorf("%w: the files manifest %s: %v", park.ErrUnsafe, key, err)
		}
		for _, entries := range []map[string]hostfiles.Entry{m.Entries, m.Platform} {
			for path, e := range entries {
				if e.Object == "" || e.Deleted {
					continue
				}
				if !strings.HasPrefix(e.Object, location+"/") {
					return fmt.Errorf("%w: %s names %s for %s, outside %s", park.ErrUnsafe, key, e.Object, path, location)
				}
				if _, ok := v.GenerationOf(park.Ref{Key: e.Object}); !ok {
					return fmt.Errorf("%w: %s names %s, which belongs to no generation", park.ErrUnsafe, key, e.Object)
				}
				pinned := false
				for _, x := range listing {
					if x.Key == e.Object && !x.DeleteMarker && x.VersionID != "" {
						if v.Pinned == nil {
							v.Pinned = map[park.Ref]bool{}
						}
						v.Pinned[park.Ref{Key: x.Key, VersionID: x.VersionID}] = true
						pinned = true
					}
				}
				if !pinned {
					return fmt.Errorf("%w: %s names %s, which the bucket does not hold", park.ErrUnsafe, key, e.Object)
				}
			}
		}
	}
	return nil
}

// versionStore is a read-only release.Store over one object read by the
// exact version a listing named: hostfiles.Load's reader for a manifest.
type versionStore struct {
	data                 genselect.Reader
	bucket, key, version string
}

func (s versionStore) Get(ctx context.Context, key string) ([]byte, string, error) {
	if key != s.key {
		return nil, "", os.ErrNotExist
	}
	body, err := s.data.GetVersion(ctx, s.bucket, key, s.version)
	return body, s.version, err
}
func (versionStore) Put(context.Context, string, []byte, string) (string, error) {
	return "", errors.New("host: the park view reads only")
}
func (versionStore) List(context.Context, string) ([]string, error) {
	return nil, errors.New("host: the park view reads only")
}
func (versionStore) ListDirs(context.Context, string) ([]string, error) {
	return nil, errors.New("host: the park view reads only")
}
func (versionStore) Delete(context.Context, string) error {
	return errors.New("host: the park view reads only")
}

// readMarker fills the marker and the installed root's pin from the
// location's generation.json, read by the exact version the listing names.
func readMarker(ctx context.Context, data genselect.Reader, bucket, host, location string, h hostclaim.Holder, listing []lease.ObjectVersion, v *park.View) error {
	key := location + "/generation.json"
	var latest *lease.ObjectVersion
	for i := range listing {
		if listing[i].Key == key && listing[i].IsLatest {
			if latest != nil {
				return fmt.Errorf("%w: two current versions of %s", park.ErrUnsafe, key)
			}
			latest = &listing[i]
		}
	}
	if latest == nil {
		// Absent everywhere means origin (§5.1).
		v.MarkerKnown = true
		return nil
	}
	if latest.DeleteMarker || latest.VersionID == "" || latest.VersionID == "null" {
		return fmt.Errorf("%w: %s is not a readable version", park.ErrUnsafe, key)
	}
	raw, err := data.GetVersion(ctx, bucket, key, latest.VersionID)
	if err != nil {
		return fmt.Errorf("read %s: %w", key, err)
	}
	var m genselect.Marker
	if err := json.Unmarshal(raw, &m); err != nil {
		return fmt.Errorf("%w: %s: %v", park.ErrUnsafe, key, err)
	}
	if m.Op == "" || m.Host != host || m.Incarnation != h.Incarnation {
		return fmt.Errorf("%w: %s names %s/%s generation %q, not the holder's", park.ErrUnsafe, key, m.Host, m.Incarnation, m.Op)
	}
	v.MarkerKnown, v.MarkerGeneration, v.Marker = true, m.Op, park.Ref{Key: key, VersionID: latest.VersionID}
	if m.SnapshotKey != "" || m.SnapshotVersion != "" {
		root := park.Ref{Key: m.SnapshotKey, VersionID: m.SnapshotVersion}
		if root.Key == "" || root.VersionID == "" {
			return fmt.Errorf("%w: %s pins %q at %q", park.ErrUnsafe, key, root.Key, root.VersionID)
		}
		if _, ok := v.GenerationOf(root); !ok {
			return fmt.Errorf("%w: %s pins %s outside %s", park.ErrUnsafe, key, root.Key, location)
		}
		v.Pinned = map[park.Ref]bool{root: true}
	}
	return nil
}

// movesAuthoritative is the spec's authoritative-region table (§5.1, claim
// rev 6.5 §6.2a, R4-3): the region of the holder's current installation.
//
//   - no holder, creating, deleting, parking, purging: none (nothing live);
//   - serving, pushing: op.exec's region, which is the region of the newest
//     admission into holder.generation, or, for a holder with no such
//     admission (a legacy installation), the record's region;
//   - moving (before the flip), reverting: the source's, move.from;
//   - landing: the source's until the target's probe is admitted into
//     holder.generation in move.to, the target's from then on, committed or
//     not; a committed landing with no such admission refuses. Seen from
//     the source's own region, the source stays authoritative until the
//     record commits (J2/F4: its files live set is protected on the source
//     until the commit);
//   - restoring: the region of the newest admission into holder.generation,
//     the source's or the target's (a clean return's CAS names the source's
//     generation again, a dirty return keeps the target's until the source's
//     probe is admitted); no admission is the source's pre-move generation.
//     Seen from the source's own region, the source stays authoritative
//     while the target releases (releasing, released), until the source's
//     return (J2/F4, L18 finding 1: a clean return restores the source's
//     retained generation, so its files live set stays protected there).
//     A dirty return's install parks the pre-move generations (D6), so
//     from its return CAS on the newest admission decides again.
//
// For a move kind the record must carry the op's move, or have closed it
// (the record-first close, M4), when the newest admission decides alone. A
// region the claim's history contradicts refuses. So does any other kind
// (placing, relocating): it has no row in the table.
//
// The move's From and To are placement codes; they are compared and
// answered as engine regions (park.PlacementRegion), so a move out of home
// names park.HomeRegion, which no named region equals, and a code that is no
// placement refuses. region is already an engine region. A serving holder
// with no admission still takes the record's region as it is, and a record
// with the home's "" there still refuses: that row is the claim's sweep of
// every legacy home host, not a move's, and is left as it was.
func movesAuthoritative(ctx context.Context, records MovesRecordReader, obs hostclaim.Observed, region string) (string, error) {
	c := obs.Claim
	h := c.Holder
	if h == nil {
		return movesNoLiveRegion, nil
	}
	switch c.Op.Kind {
	case hostclaim.KindCreating, hostclaim.KindDeleting, hostclaim.KindParking, hostclaim.KindPurging:
		return movesNoLiveRegion, nil
	}
	admitted, known := admittedRegion(*h)
	switch c.Op.Kind {
	case hostclaim.KindServing, hostclaim.KindPushing:
		if known {
			return admitted, nil
		}
		rec, err := holderRecord(ctx, records, obs)
		if err != nil {
			return "", err
		}
		if rec.Region == "" {
			return "", fmt.Errorf("%w: %s's record names no region and the claim no admission", park.ErrUnsafe, obs.Host)
		}
		return rec.Region, nil
	case hostclaim.KindMoving, hostclaim.KindReverting, hostclaim.KindLanding, hostclaim.KindRestoring:
	default:
		return "", fmt.Errorf("%w: the authoritative-region table has no row for a %s op", park.ErrUnsafe, c.Op.Kind)
	}
	rec, err := holderRecord(ctx, records, obs)
	if err != nil {
		return "", err
	}
	m := rec.Move
	if m == nil || m.ID != c.Op.ID || m.Legacy() || m.From == m.To {
		if l := rec.LastMove; m == nil && l != nil && l.ID == c.Op.ID && known {
			return admitted, nil // the record closed first (M4); the claim's history decides
		}
		return "", fmt.Errorf("%w: the record does not carry move %s", park.ErrUnsafe, c.Op.ID)
	}
	from, to := park.PlacementRegion(m.From), park.PlacementRegion(m.To)
	if from == "" || to == "" {
		return "", fmt.Errorf("%w: move %s names %q and %q, which are not both placement codes", park.ErrUnsafe, m.ID, m.From, m.To)
	}
	contradicts := func(want ...string) error {
		if !known {
			return nil
		}
		for _, w := range want {
			if park.SameRegion(c.Op.Intent["home_region"], admitted, w) {
				return nil
			}
		}
		return fmt.Errorf("%w: holder.generation was admitted in %s, which a %s op of %s cannot have", park.ErrUnsafe, admitted, c.Op.Kind, m.ID)
	}
	switch c.Op.Kind {
	case hostclaim.KindMoving, hostclaim.KindReverting:
		if err := contradicts(from); err != nil {
			return "", err
		}
		return from, nil
	case hostclaim.KindLanding:
		if err := contradicts(from, to); err != nil {
			return "", err
		}
		if known && park.SameRegion(c.Op.Intent["home_region"], admitted, to) {
			if park.SameRegion(c.Op.Intent["home_region"], region, from) && c.Op.Phase != hostclaim.PhaseCommitted && m.State != provision.MoveCommitted {
				// J2/F4 (Paul's #236 ruling): the source's live set, its
				// files live set among it, stays protected on the source
				// until the record commits. Seen from the source's region the
				// source stays authoritative, so the engine protects there
				// too (and refuses a park of the location, whose current
				// generation the source's marker does not name).
				return from, nil
			}
			return to, nil
		}
		if c.Op.Phase == hostclaim.PhaseCommitted || m.State == provision.MoveCommitted {
			return "", fmt.Errorf("%w: move %s committed with no admission in %s", park.ErrUnsafe, m.ID, to)
		}
		return from, nil
	default: // restoring
		if err := contradicts(from, to); err != nil {
			return "", err
		}
		if known {
			returned := c.Op.Phase != hostclaim.PhaseReleasing && c.Op.Phase != hostclaim.PhaseReleased
			if park.SameRegion(c.Op.Intent["home_region"], admitted, to) && park.SameRegion(c.Op.Intent["home_region"], region, from) && !returned {
				// J2/F4 (Paul's #236 ruling; L18 finding 1): the
				// newest admission is still the target's, but until
				// the source takes the host back a clean return may
				// name the source's retained generation again (a
				// dirty release declared lost becomes clean,
				// MoveRollbackLossCommitted), so seen from the
				// source's region the source stays authoritative, as
				// at landing before the commit. Once the return is
				// written, a clean one is admitted in the source
				// already, and a dirty one's install parks the
				// pre-move generations (D6).
				return from, nil
			}
			return admitted, nil
		}
		return from, nil
	}
}

// admittedRegion is the region of the newest admission into
// holder.generation, the origin included.
func admittedRegion(h hostclaim.Holder) (string, bool) {
	want := h.Generation
	if want == "" {
		want = hostclaim.RootGeneration
	}
	for i := len(h.Admissions) - 1; i >= 0; i-- {
		g := h.Admissions[i].Generation
		if g == "" {
			g = hostclaim.RootGeneration
		}
		if g == want {
			r := h.Admissions[i].Region
			return r, r != ""
		}
	}
	return "", false
}

// holderRecord reads the holder's own record: an instance holder's key, the
// same account, app and host.
func holderRecord(ctx context.Context, records MovesRecordReader, obs hostclaim.Observed) (*provision.Record, error) {
	h := obs.Claim.Holder
	if h.Family != "instance" || h.Key != provision.RecordKey(h.Account, h.App, obs.Host) {
		return nil, fmt.Errorf("%w: the holder of %s is not an instance record", park.ErrUnsafe, obs.Host)
	}
	rec, err := records(ctx, h.Account, h.App, obs.Host)
	if err != nil {
		return nil, fmt.Errorf("read %s's record: %w", obs.Host, err)
	}
	if rec == nil || rec.Account != h.Account || rec.App != h.App || rec.Host != obs.Host {
		return nil, fmt.Errorf("%w: %s's record is not the holder's", park.ErrUnsafe, obs.Host)
	}
	return rec, nil
}

// movesParkSources is what registerMovesParks registers: the view behind
// the wake-source gate, and Task 5's evidence.
type movesParkSources struct {
	View     func(context.Context, hostclaim.Observed) (park.View, error)
	Evidence hostbox.RegionalEvidence
}

// newMovesParkSources builds the two providers. While the gate
// (movesWakeSourceRegistered) is shut the view refuses with its error before
// it reads anything, so nothing is queued or run through it.
func newMovesParkSources(records MovesRecordReader, data genselect.Reader, bucket string, regionOf func(context.Context) (string, error), evidence hostbox.RegionalEvidence) (movesParkSources, error) {
	if records == nil || data == nil || bucket == "" || regionOf == nil || evidence == nil {
		return movesParkSources{}, hostwrite.ErrUnavailable
	}
	view := movesParkViewAt(records, data, bucket, regionOf)
	return movesParkSources{
		View: func(ctx context.Context, obs hostclaim.Observed) (park.View, error) {
			if err := movesWakeSourceRegistered(); err != nil {
				return park.View{}, err
			}
			return view(ctx, obs)
		},
		Evidence: evidence,
	}, nil
}

// registerMovesParks registers the moves park providers with the claim
// (RegisterProductionClaimMoveParks), at agent start before newClaimWiring.
func registerMovesParks(src movesParkSources) error {
	return RegisterProductionClaimMoveParks(src.View, src.Evidence)
}

// armMovesParks sets the moves arms' park hooks from the claim's MoveParks
// capability (M17): its engine's leases, view and authorizer, only when the
// engine's bucket and region are this box's own bucket and its placement's
// engine region (parkRegion, compared through the engine's OwnsRegion; a home
// box only when the claim grants the @home alias, claim Plan 13); RunHeld
// over those leases, which must lend a held lease (M5); and the MoveParks
// local authorizer (M9). An engine region of "" never arms, and nothing
// arms while the wake-source gate is shut (movesWakeSourceRegistered). Any
// refusal leaves every hook unset, so every arm stays unarmed.
func armMovesParks(ctx context.Context, cfg *moveCfg, providers ClaimProviders) error {
	if ctx == nil || cfg == nil {
		return hostwrite.ErrUnavailable
	}
	engine, _, local, err := providers.MoveParks(ctx)
	if err != nil {
		return fmt.Errorf("the claim's MoveParks: %w", err)
	}
	if want := cfg.parkRegion(); want == "" || engine.Bucket != cfg.OwnBucket || !engine.OwnsRegion(want) {
		return fmt.Errorf("%w: the claim's park engine is %s in %q, this box's moves use %s in %q (placement %q)", hostbox.ErrChanged, engine.Bucket, engine.Region, cfg.OwnBucket, want, cfg.Region)
	}
	if cfg.parkRegion() == park.HomeRegion && engine.HomeRegion == "" {
		// A home box arms only when the claim grants it the @home alias
		// (claim Plan 13: its signed roster region is the fleet's signed home
		// designation); any other engine, one naming itself @home included,
		// leaves it unarmed.
		return fmt.Errorf("%w: the claim grants this home box no @home alias (engine %s in %q)", hostbox.ErrChanged, engine.Bucket, engine.Region)
	}
	if engine.Leases == nil || engine.View == nil || engine.Authorize == nil {
		return errors.Join(hostwrite.ErrUnavailable, errors.New("the claim's park engine lacks its leases, view or authorizer"))
	}
	if _, ok := engine.Leases.(heldLender); !ok {
		return errors.Join(hostwrite.ErrUnavailable, errors.New("the claim's park leases cannot lend a held lease to RunHeld"))
	}
	if local == nil {
		return errors.Join(hostwrite.ErrUnavailable, errors.New("the claim's MoveParks has no local authorizer"))
	}
	if err := movesWakeSourceRegistered(); err != nil {
		return err
	}
	cfg.ParkHomeRegion = engine.HomeRegion
	cfg.ParkLeases, cfg.ParkView, cfg.ParkAuthorize = engine.Leases, engine.View, engine.Authorize
	cfg.ParkRunHeld = movesRunHeld
	cfg.ParkLocalAuthorize = local
	return nil
}

// registerProductionMovesParks is the agent's registration, before
// newClaimWiring: only with both CARLOS_HOST_CLAIM and CARLOS_MOVES_PHASE1
// on (ruling H1), over the deployment store's records, this box's data
// bucket read by exact version (lease.NewVersionedS3, through rootaws), and
// the region regionOf answers, behind the wake-source gate
// (movesWakeSourceRegistered): the registered view refuses every host until
// the moves wake source registers right after it
// (registerProductionMovesWakeSource, Plan 5 Task 9b), to which it returns
// the sources it registered. Production's
// regionOf is productionRosterRegion: the claim's verified roster row (fix
// round 1), held by movesBoxRegion to the engine region of this box's own
// placement, CARLOS_REGION. The roster refuses a row with region "", so on
// a home box it names home otherwise than park.HomeRegion, and the view
// refuses there until the claim names home as the engine does (home-region
// parks, part 1). Off, it registers nothing, returns no sources, and the
// claim keeps its named refusals. Task 5's evidence goes through refusals,
// which pages its anomalies once (movesrefusals.go).
func registerProductionMovesParks(ctx context.Context, getenv func(string) string, store release.Store, hib activator.Config, regionOf func(context.Context) (string, error), refusals *movesRefusals) (movesParkSources, error) {
	if !hostwrite.Enabled(getenv) || !moves.Enabled(getenv) {
		return movesParkSources{}, nil
	}
	if ctx == nil || store == nil || hib.Bucket == "" || hib.Region == "" || regionOf == nil || refusals == nil {
		return movesParkSources{}, errors.Join(hostwrite.ErrUnavailable, errors.New("the moves park view needs the deployment store, the data bucket and this box's roster region"))
	}
	data, err := lease.NewVersionedS3(ctx, map[string]string{hib.Bucket: hib.Region})
	if err != nil {
		return movesParkSources{}, err
	}
	records := MovesRecordsFrom(store)
	evidence := refusals.evidence(movesRetirementEvidence{Records: records, Now: time.Now})
	region := movesBoxRegion(strings.TrimSpace(getenv("CARLOS_REGION")), cachedRegion(regionOf))
	src, err := newMovesParkSources(records, data, hib.Bucket, region, evidence)
	if err != nil {
		return movesParkSources{}, err
	}
	if err := registerMovesParks(src); err != nil {
		return movesParkSources{}, err
	}
	return src, nil
}

// productionRosterRegion is this box's region as the claim knows it: the
// region of its verified roster row (readProductionRosterRow), the same row
// OpenClaimOwners builds the claim's identity, and so its engine's region,
// from.
func productionRosterRegion(store release.Store, getenv func(string) string) func(context.Context) (string, error) {
	return func(ctx context.Context) (string, error) {
		rr, err := readProductionRosterRow(ctx, store, getenv)
		if err != nil {
			return "", err
		}
		engine, home, err := claimRegionBinding(rr.row.Region, getenv("CARLOS_REGION"), rr.home)
		if err != nil {
			return "", err
		}
		return park.PlacementRegion(park.HomePlacementCode(home, engine)), nil
	}
}