package host

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/hostbox"
	"github.com/carlosframework/platform/internal/hostclaim"
	execlease "github.com/carlosframework/platform/internal/hostexec"
	"github.com/carlosframework/platform/internal/hostfiles"
	"github.com/carlosframework/platform/internal/hostguard"
	"github.com/carlosframework/platform/internal/hostrelocate"
	"github.com/carlosframework/platform/internal/hostwrite"
	"github.com/carlosframework/platform/internal/moves"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
)

// probeFilesFixture is a relocation target at relocating/probing reached
// through a real build, a real install and the claim's own transitions
// (the prepared authority as ToInstalled journals it, RecordLocalInstall,
// ToProbing), with the real C8 provider the production source opens over
// the box's data directory, registry, claim store (Plan 15's origin
// proof) and data bucket (merge round 6), and
// the relocation's wake inputs bound to it.
type probeFilesFixture struct {
	*installFixture
	receipt hostclaim.LocalInstall
	inputs  *RelocationWakeInputs
	// replaced is what the replaced target left when the fixture replaced
	// it (newReplacedProbeFilesFixture): its receipt and its install
	// journal's bytes, at P's build stamp.
	replaced struct {
		receipt hostclaim.LocalInstall
		journal []byte
	}
}

func newProbeFilesFixture(t *testing.T, opts buildOptions) *probeFilesFixture {
	t.Helper()
	f := newProbeFilesInstalled(t, opts)
	f.installAndProbe()
	f.bindProvider()
	return f
}

// newProbeFilesInstalled is the fixture at installed, P built and its
// prepared authority journalled, before any local install. Claim Plan
// 15's origin record is on, as the provider's origin proof
// (ClaimOriginProof) needs: every admission through the claim's CAS, the
// source's g1 and the probe's P, is recorded.
func newProbeFilesInstalled(t *testing.T, opts buildOptions) *probeFilesFixture {
	t.Helper()
	t.Setenv("CARLOS_HOST_CLAIM_ORIGINS", "1")
	return &probeFilesFixture{installFixture: newInstallFixtureWith(t, opts)}
}

// installAndProbe is the executor's local install at the current install
// stamp, its receipt journalled, and its entry into probing.
func (f *probeFilesFixture) installAndProbe() {
	f.t.Helper()
	var err error
	if f.receipt, err = f.install(); err != nil {
		f.t.Fatal(err)
	}
	f.update(hostclaim.RecordLocalInstall("rel-1", f.receipt))
	f.update(hostclaim.ToProbing("rel-1", time.Now()))
}

// newReplacedProbeFilesFixture replaces a terminated target that had made
// its local install, at phase (installed, or probing before P's first
// admission), as hostclaim.ReplaceTarget does for both: install(c, next,
// P, installed) names the replacement box as the executor, keeps P and its
// prepared authority, issues a new install stamp (the CAS's generation)
// and drops the receipt; ToInstalled does not run again. The replacement,
// dst2, is a fresh box with no guard record: its participant's local
// install activates the installation at the new stamp, makes the install,
// records it and enters probing (participate). The replaced target's
// receipt and journal bytes are kept for the negatives.
func newReplacedProbeFilesFixture(t *testing.T, opts buildOptions, phase string) *probeFilesFixture {
	t.Helper()
	f := newProbeFilesInstalled(t, opts)
	var err error
	if f.replaced.receipt, err = f.install(); err != nil {
		t.Fatal(err)
	}
	f.update(hostclaim.RecordLocalInstall("rel-1", f.replaced.receipt))
	if phase == hostclaim.PhaseRelocatingProbing {
		f.update(hostclaim.ToProbing("rel-1", time.Now()))
	}
	if f.read().Claim.Op.Phase != phase {
		t.Fatalf("the replaced target is at %s, not %s", f.read().Claim.Op.Phase, phase)
	}
	path, _ := relocationInstallPath(f.r.DataDir, "rel-1")
	if f.replaced.journal, err = os.ReadFile(path); err != nil {
		t.Fatal(err)
	}
	build := f.read().Claim.Holder.Stamp
	next := hostbox.Actor{Box: "dst2", Enrollment: strings.Repeat("b", 32), Region: "ie", Revision: 4, Binding: "4"}
	f.update(func(c *hostclaim.Claim) error {
		if hostclaim.PreparedOpened(c) {
			return errors.New("P was opened")
		}
		stamp := c.Gen + 1 // hostclaim install(): the CAS's resulting gen
		c.Op.Exec, c.Op.Phase = next.Box, hostclaim.PhaseInstalled
		c.Op.Intent["target_box"], c.Op.Intent["target_enrollment"] = next.Box, next.Enrollment
		c.Op.Participants = []string{"src", next.Box}
		c.Op.Journal["exec_ack."+next.Box] = `{"op":"rel-1"}`
		c.Holder.Stamp = stamp
		c.Op.Journal["install_stamp"] = strconv.FormatUint(stamp, 10)
		delete(c.Op.Journal, "local_install")
		return nil
	})
	c := f.read().Claim
	auth, err := preparedAuthority(c)
	if err != nil || auth.InstallStamp != build || c.Holder.Stamp == build {
		t.Fatalf("the replacement keeps P's authority at the build stamp %d under a new stamp %d: %+v %v", build, c.Holder.Stamp, auth, err)
	}
	f.onBox(claimCensusBox(t), next)
	f.participate()
	f.bindProvider()
	return f
}

// participate drives this box's relocation participant from installed:
// its first pass makes the local install (InstallLocal, which activates a
// replacement's installation at its new stamp; nothing else does) and
// journals the receipt, its second enters probing.
func (f *probeFilesFixture) participate() {
	f.t.Helper()
	e := f.effects()
	incarnation := f.read().Claim.Holder.Incarnation
	e.Participation = func(context.Context, hostclaim.Observed) (execlease.State, error) {
		return execlease.State{Binding: execlease.Binding{Host: buildHost, Incarnation: incarnation, Op: "rel-1"}}, nil
	}
	p := hostrelocate.Participant{Claims: f.claims, Box: f.actor.Box, Enrollment: f.actor.Enrollment, Effects: e, Now: time.Now}
	o, err := p.Step(f.t.Context(), buildHost)
	if err != nil || o.Claim.Op.Journal["local_install"] == "" {
		f.t.Fatalf("the participant's install: %v", err)
	}
	if o, err = p.Step(f.t.Context(), buildHost); err != nil || o.Claim.Op.Phase != hostclaim.PhaseRelocatingProbing {
		f.t.Fatalf("the participant's entry into probing: %v", err)
	}
	if err := json.Unmarshal([]byte(o.Claim.Op.Journal["local_install"]), &f.receipt); err != nil {
		f.t.Fatal(err)
	}
	f.obs = o
}

// bindProvider opens the real C8 provider the production source opens
// and binds the relocation's wake inputs to it.
func (f *probeFilesFixture) bindProvider() {
	t := f.t
	ctx := t.Context()
	src := &movesFilesSource{DataDir: f.r.DataDir, Routes: f.reg, newFiles: func(context.Context, string, string) (release.Store, error) {
		return bucketStore{b: f.bucket, bucket: "data"}, nil
	}}
	c8, err := src.Open(ctx, f.claims, f.bucket, hostbox.Actor{Box: f.actor.Box, Region: "ie", Bucket: "data", Cloud: hostbox.CloudIdentity{Region: "eu-west-1"}})
	if err != nil {
		t.Fatal(err)
	}
	seq := 0
	f.inputs = &RelocationWakeInputs{
		Launch: func(context.Context, registry.Route) (ClaimServingLaunch, error) {
			return ClaimServingLaunch{Identity: hostwrite.Identity{Config: "sha256:config", Release: "sha256:release"}, Executable: "/opt/carlos/live/" + buildHost, ExecutableSHA256: strings.Repeat("b", 64), Version: "v1"}, nil
		},
		FilesManifest: c8, Markers: plan9D5Markers{f.bucket}, Claims: f.claims, FilesStore: f.files, Data: f.bucket, Bucket: "data", Region: "ie", Box: f.actor.Box,
		NewID: func() string { seq++; return fmt.Sprintf("fresh%d", seq) }, Now: time.Now, Releases: &roReleases{}}
}

func (f *probeFilesFixture) update(tr func(*hostclaim.Claim) error) {
	f.t.Helper()
	o, err := hostclaim.Update(f.t.Context(), f.claims, f.read(), tr)
	if err != nil {
		f.t.Fatal(err)
	}
	f.obs = o
}

// probe runs the relocation's first probe up to the app's launch: Select
// on the host's row, the attempt counted and the admission applied with
// the claim's own CAS, then Materialize under the start's work, which
// establishes the files manifest through the real provider. Before
// Materialize the launch source's key mint is stood for by env, written
// over the nested env file the install placed.
func (f *probeFilesFixture) probe(env string) (ClaimLaunchInputs, error) {
	f.t.Helper()
	ctx := f.t.Context()
	o := f.read()
	row, err := f.reg.Get(buildHost)
	if err != nil || row == nil {
		f.t.Fatalf("row: %v", err)
	}
	in, err := f.inputs.Select(ctx, *row, o, roProbe)
	if err != nil {
		return in, err
	}
	counted, err := hostclaim.Update(ctx, f.claims, o, hostclaim.BeginProbeAttempt("rel-1", f.actor.Box))
	if err != nil {
		f.t.Fatal(err)
	}
	in.Admission.ObservedSession, in.Admission.ObservedGeneration = counted.Claim.Holder.Session, counted.Claim.Holder.Generation
	admitted, err := hostclaim.Update(ctx, f.claims, counted, hostclaim.AdmitWriter(in.Admission))
	if err != nil {
		f.t.Fatal(err)
	}
	if err := os.WriteFile(f.paths().EnvPath, []byte(env), 0o600); err != nil {
		f.t.Fatal(err)
	}
	return in, f.inputs.Materialize(ctx, admitted, in, passWork{})
}

// established is P's current files manifest and whether its prepared
// sequence-0 version is still readable by the exact version the install
// bound.
func (f *probeFilesFixture) established() (hostfiles.Manifest, preparedManifest) {
	f.t.Helper()
	location := f.read().Claim.Holder.Location
	m, found, err := hostfiles.Load(f.t.Context(), f.files, movesFilesPrefix(location, "p1"))
	if err != nil || !found {
		f.t.Fatalf("P's manifest: found=%v %v", found, err)
	}
	path, _ := relocationInstallPath(f.r.DataDir, "rel-1")
	raw, err := os.ReadFile(path)
	if err != nil {
		f.t.Fatal(err)
	}
	var j relocationInstallJournal
	if err := json.Unmarshal(raw, &j); err != nil {
		f.t.Fatal(err)
	}
	var pm preparedManifest
	if err := json.Unmarshal([]byte(j.Steps[relocationStepFilesManifest]), &pm); err != nil {
		f.t.Fatal(err)
	}
	return m, pm
}

const firstProbeEnv = installEnv + "CARLOS_INSTANCE_KEY=minted-by-the-launch-source\n"

// Merge round 6, findings 2 and 3: relocation's first probe of a host with
// a database establishes its files manifest through main's real C8
// provider. The provider reads the env file the launch source minted into
// the nested instance directory (never a stale flat <host>.env), and
// reads P's prepared manifest by the binding relocation's install
// journalled (no moves op journal exists), replacing it by compare-and-
// swap: P's entries carried, the env file's bytes on disk, the sequence-0
// version still readable at the exact version the install bound.
func TestRelocationFirstProbeEstablishesThroughTheC8Provider(t *testing.T) {
	f := newProbeFilesFixture(t, buildOptions{DB: true, Files: map[string]string{"public/index.html": "<h1>shop</h1>"}, Platform: map[string]string{hostfiles.EnvItem: installEnv, hostfiles.WakeItem: installWake()}})
	stale := filepath.Join(f.r.DataDir, buildHost+".env")
	if err := os.WriteFile(stale, []byte("STALE=flat\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(moves.JournalFile(f.r.DataDir, buildHost, "p1")); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("a moves op journal exists for P: %v", err)
	}
	in, err := f.probe(firstProbeEnv)
	if err != nil {
		t.Fatalf("the first probe: %v", err)
	}
	if !in.Prepared || in.Empty {
		t.Fatalf("prepared=%v empty=%v", in.Prepared, in.Empty)
	}
	m, pm := f.established()
	if m.Platform[hostfiles.EnvItem].SHA256 != hostfilesSum([]byte(firstProbeEnv)) {
		t.Fatalf("the manifest carries env %s, not the nested env file's bytes (stale flat %s)", m.Platform[hostfiles.EnvItem].SHA256, hostfilesSum([]byte("STALE=flat\n")))
	}
	if _, ok := m.Entries["public/index.html"]; !ok || m.Seq == 0 {
		t.Fatalf("P's entries were not carried into the establishment: %+v", m)
	}
	exact, err := f.bucket.GetVersion(t.Context(), "data", pm.Key, pm.Version)
	if err != nil || hostfilesSum(exact) != pm.SHA256 {
		t.Fatalf("the prepared version the install bound: %v", err)
	}
	// A retry of the same establishment finds its own revision.
	if err := f.inputs.FilesManifest.Establish(t.Context(), f.read(), in, passWork{}); err != nil {
		t.Fatalf("a retry of the establishment: %v", err)
	}
}

// Merge round 6, finding 4: an empty database still consumes P's files.
// The relocation's first probe of a host whose pin evidences an empty
// database (in.Empty) establishes from P's prepared manifest, which
// relocation always builds, by compare-and-swap over it: no create-only
// commit collides with it, and P's files and platform items are carried.
func TestRelocationEmptyDatabaseProbeConsumesPsFiles(t *testing.T) {
	f := newProbeFilesFixture(t, buildOptions{DB: false, Files: map[string]string{"uploads/a.txt": "kept"}, Platform: map[string]string{hostfiles.EnvItem: installEnv, hostfiles.WakeItem: installWake()}})
	in, err := f.probe(firstProbeEnv)
	if err != nil {
		t.Fatalf("the empty database's first probe: %v", err)
	}
	if !in.Empty || in.Prepared {
		t.Fatalf("prepared=%v empty=%v", in.Prepared, in.Empty)
	}
	m, _ := f.established()
	if _, ok := m.Entries["uploads/a.txt"]; !ok || m.Platform[hostfiles.WakeItem].SHA256 == "" || m.Platform[hostfiles.EnvItem].SHA256 != hostfilesSum([]byte(firstProbeEnv)) {
		t.Fatalf("P's files were not consumed: %+v", m)
	}
}

// Merge round 6, finding 3: the reader is chosen by the claim's op kind,
// and relocation's binding is held as strongly as a move's. A moves op
// journal for P is never read for a relocating op; the install journal
// must be the one the claim's receipt names by digest; its binding must
// carry the prepared authority's digest; and with no install journal the
// probe refuses rather than reading the absence as an empty start.
func TestRelocationPreparedBindingIsRelocationsOwn(t *testing.T) {
	opts := buildOptions{DB: true, Files: map[string]string{"public/index.html": "<h1>shop</h1>"}, Platform: map[string]string{hostfiles.EnvItem: installEnv, hostfiles.WakeItem: installWake()}}
	installJournal := func(f *probeFilesFixture) string {
		path, _ := relocationInstallPath(f.r.DataDir, "rel-1")
		return path
	}
	t.Run("no install journal", func(t *testing.T) {
		f := newProbeFilesFixture(t, opts)
		if err := os.Remove(installJournal(f)); err != nil {
			t.Fatal(err)
		}
		if _, err := f.probe(firstProbeEnv); err == nil {
			t.Fatal("a probe with no install journal established")
		}
		if m, _, _ := hostfiles.Load(t.Context(), f.files, movesFilesPrefix(f.read().Claim.Holder.Location, "p1")); m.Seq != 0 {
			t.Fatalf("P's manifest was replaced: %+v", m)
		}
	})
	t.Run("an install journal the receipt does not name", func(t *testing.T) {
		f := newProbeFilesFixture(t, opts)
		path := installJournal(f)
		raw, err := os.ReadFile(path)
		if err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(path, append(raw, ' '), 0o600); err != nil {
			t.Fatal(err)
		}
		if _, err := f.probe(firstProbeEnv); !errors.Is(err, hostbox.ErrChanged) {
			t.Fatalf("a changed install journal: %v", err)
		}
	})
	t.Run("a binding that is not the prepared authority's", func(t *testing.T) {
		f := newProbeFilesFixture(t, opts)
		f.update(func(c *hostclaim.Claim) error {
			auth, err := preparedAuthority(c)
			if err != nil {
				return err
			}
			auth.FilesManifestSHA256 = strings.Repeat("0", 64)
			c.Op.Journal["prepared_authority"] = string(mustJSON(t, auth))
			return nil
		})
		if _, err := f.probe(firstProbeEnv); !errors.Is(err, hostbox.ErrChanged) {
			t.Fatalf("a binding with another digest: %v", err)
		}
	})
	t.Run("a moves op journal is never read for a relocating op", func(t *testing.T) {
		f := newProbeFilesFixture(t, opts)
		location := f.read().Claim.Holder.Location
		key := hostfiles.ManifestKey(movesFilesPrefix(location, "p1"))
		// A moves op journal binding P at a version that does not exist:
		// read, it would refuse; the relocation's own binding is read.
		j, err := moves.ReadJournal(f.r.DataDir, buildHost, "p1")
		if err != nil {
			t.Fatal(err)
		}
		j.Mark(landStepFilesManifest, string(mustJSON(t, preparedManifest{Key: key, SHA256: strings.Repeat("1", 64), Version: "v-none", Op: "rel-1", Stamp: f.read().Claim.Holder.Stamp})))
		if err := j.Commit(f.r.DataDir); err != nil {
			t.Fatal(err)
		}
		if _, err := f.probe(firstProbeEnv); err != nil {
			t.Fatalf("the relocation's own binding: %v", err)
		}
	})
}

// Merge round 7: a replacement target keeps P and its prepared authority
// at P's build stamp while it installs under a new install stamp (at
// installed, or in probing before P's first admission). Its first probe
// establishes P's files through the real provider: P's manifest bound at
// the build stamp, its own receipt and install journal at the new one.
// The replacement's install journal records P's build stamp in its
// files_manifest step and its own stamp as the journal's install stamp.
func TestRelocationReplacementProbeEstablishesPsFiles(t *testing.T) {
	opts := buildOptions{DB: true, Files: map[string]string{"public/index.html": "<h1>shop</h1>"}, Platform: map[string]string{hostfiles.EnvItem: installEnv, hostfiles.WakeItem: installWake()}}
	for _, phase := range []string{hostclaim.PhaseInstalled, hostclaim.PhaseRelocatingProbing} {
		t.Run("replaced at "+phase, func(t *testing.T) {
			f := newReplacedProbeFilesFixture(t, opts, phase)
			c := f.read().Claim
			auth, _ := preparedAuthority(c)
			if f.receipt.InstallStamp != c.Holder.Stamp || f.receipt.InstallStamp == auth.InstallStamp {
				t.Fatalf("the replacement's receipt %+v is not at its own install stamp %d", f.receipt, c.Holder.Stamp)
			}
			if _, err := f.probe(firstProbeEnv); err != nil {
				t.Fatalf("the replacement's first probe: %v", err)
			}
			m, pm := f.established()
			if pm.Stamp != auth.InstallStamp || m.Platform[hostfiles.EnvItem].SHA256 != hostfilesSum([]byte(firstProbeEnv)) || m.Entries["public/index.html"].SHA256 == "" {
				t.Fatalf("binding %+v (build stamp %d), manifest %+v", pm, auth.InstallStamp, m)
			}
			path, _ := relocationInstallPath(f.r.DataDir, "rel-1")
			raw, _ := os.ReadFile(path)
			var j relocationInstallJournal
			if err := json.Unmarshal(raw, &j); err != nil || j.InstallStamp != c.Holder.Stamp {
				t.Fatalf("the replacement's journal is at %d, not its install stamp %d: %v", j.InstallStamp, c.Holder.Stamp, err)
			}
		})
	}
}

// Merge round 7: neither stamp stands in for the other. The replaced
// target's install journal (P's build stamp), or its receipt, under the
// replacement's install stamp refuses; a prepared authority whose stamp
// is not the build stamp the install bound, or is past the install
// stamp, refuses; and nothing is established.
func TestRelocationReplacementRefusesTheWrongStamp(t *testing.T) {
	opts := buildOptions{DB: true, Files: map[string]string{"public/index.html": "<h1>shop</h1>"}, Platform: map[string]string{hostfiles.EnvItem: installEnv, hostfiles.WakeItem: installWake()}}
	for name, tamper := range map[string]func(f *probeFilesFixture){
		"the replaced target's install journal": func(f *probeFilesFixture) {
			path, _ := relocationInstallPath(f.r.DataDir, "rel-1")
			if err := os.WriteFile(path, f.replaced.journal, 0o600); err != nil {
				f.t.Fatal(err)
			}
		},
		"the replaced target's install journal and receipt": func(f *probeFilesFixture) {
			path, _ := relocationInstallPath(f.r.DataDir, "rel-1")
			if err := os.WriteFile(path, f.replaced.journal, 0o600); err != nil {
				f.t.Fatal(err)
			}
			f.update(func(c *hostclaim.Claim) error {
				c.Op.Journal["local_install"] = string(mustJSON(f.t, f.replaced.receipt))
				return nil
			})
		},
		"an authority at the install stamp": func(f *probeFilesFixture) {
			f.update(func(c *hostclaim.Claim) error {
				auth, err := preparedAuthority(c)
				if err != nil {
					return err
				}
				auth.InstallStamp = c.Holder.Stamp
				c.Op.Journal["prepared_authority"] = string(mustJSON(f.t, auth))
				return nil
			})
		},
		"an authority past the install stamp": func(f *probeFilesFixture) {
			f.update(func(c *hostclaim.Claim) error {
				auth, err := preparedAuthority(c)
				if err != nil {
					return err
				}
				auth.InstallStamp = c.Holder.Stamp + 1
				c.Op.Journal["prepared_authority"] = string(mustJSON(f.t, auth))
				return nil
			})
		},
	} {
		t.Run(name, func(t *testing.T) {
			f := newReplacedProbeFilesFixture(t, opts, hostclaim.PhaseRelocatingProbing)
			tamper(f)
			if _, err := f.probe(firstProbeEnv); err == nil {
				t.Fatal("established under the wrong stamp")
			}
			if m, _, _ := hostfiles.Load(t.Context(), f.files, movesFilesPrefix(f.read().Claim.Holder.Location, "p1")); m.Seq != 0 {
				t.Fatalf("P's manifest was replaced: %+v", m)
			}
		})
	}
}

// Astra round 8: a replacement's activation is the install's, and no
// broader. The box that runs it must be the claim's executor and named
// target, P must be unopened, and a stamp the guard retired is never
// reactivated; each refusal leaves the guard as it was.
func TestRelocationReplacementActivationRefuses(t *testing.T) {
	opts := buildOptions{DB: true, Files: map[string]string{"public/index.html": "<h1>shop</h1>"}, Platform: map[string]string{hostfiles.EnvItem: installEnv, hostfiles.WakeItem: installWake()}}
	t.Run("a retired stamp", func(t *testing.T) {
		f := newReplacedProbeFilesFixture(t, opts, hostclaim.PhaseInstalled)
		if err := f.a.Guard.RetireInstallation(t.Context(), buildHost, func(*hostclaim.Claim) error { return nil }); err != nil {
			t.Fatal(err)
		}
		f.update(func(c *hostclaim.Claim) error {
			c.Op.Phase = hostclaim.PhaseInstalled
			delete(c.Op.Journal, "local_install")
			return nil
		})
		if _, err := f.effects().InstallLocal(t.Context(), f.read()); !errors.Is(err, hostrelocate.ErrRefused) || !errors.Is(err, hostguard.ErrRetiredStamp) {
			t.Fatalf("a retired stamp was reactivated: %v", err)
		}
		if captured, err := hostguard.Capture(f.a.Guard.DataDir, buildHost); err == nil && captured.Stamp != 0 {
			t.Fatalf("the retired installation is active again: %+v", captured)
		}
	})
	// The claim keeps its executor and named target one box (Validate
	// refuses them apart), so a box that is not named is one of two: the
	// claim names another box, or the replaced box asks after the claim
	// has named its replacement.
	for name, tc := range map[string]struct {
		change func(*hostclaim.Claim)
		box    string
	}{
		"a box the claim does not name": {change: func(c *hostclaim.Claim) { c.Op.Exec, c.Op.Intent["target_box"] = "dst3", "dst3" }},
		"the replaced box":              {change: func(*hostclaim.Claim) {}, box: "dst"},
	} {
		t.Run(name, func(t *testing.T) {
			f := newReplacedNamedFixture(t, opts, tc.change)
			if tc.box != "" {
				f.cfg.Source.Box = tc.box
			}
			if _, err := f.a.relocationActivateInstalled(f.cfg)(t.Context(), f.read()); !errors.Is(err, hostrelocate.ErrRefused) {
				t.Fatalf("activated: %v", err)
			}
			if _, err := f.effects().InstallLocal(t.Context(), f.read()); err == nil {
				t.Fatal("installed")
			}
			if _, err := hostguard.Capture(f.a.Guard.DataDir, buildHost); !errors.Is(err, hostguard.ErrNoRecord) {
				t.Fatalf("a guard record was made: %v", err)
			}
		})
	}
	t.Run("probing after P opened", func(t *testing.T) {
		f := newReplacedProbeFilesFixture(t, opts, hostclaim.PhaseRelocatingProbing)
		if _, err := f.probe(firstProbeEnv); err != nil {
			t.Fatal(err)
		}
		if !hostclaim.PreparedOpened(f.read().Claim) {
			t.Fatal("P is not opened")
		}
		if _, err := f.a.relocationActivateInstalled(f.cfg)(t.Context(), f.read()); !errors.Is(err, hostrelocate.ErrRefused) {
			t.Fatalf("activated after P opened: %v", err)
		}
	})
}

// newReplacedNamedFixture is the replacement at installed of
// newReplacedProbeFilesFixture on a fresh box dst2, stopped before dst2's
// participant runs, with change applied to the claim.
func newReplacedNamedFixture(t *testing.T, opts buildOptions, change func(*hostclaim.Claim)) *probeFilesFixture {
	t.Helper()
	f := newProbeFilesInstalled(t, opts)
	next := hostbox.Actor{Box: "dst2", Enrollment: strings.Repeat("b", 32), Region: "ie", Revision: 4, Binding: "4"}
	f.update(func(c *hostclaim.Claim) error {
		stamp := c.Gen + 1
		c.Op.Exec, c.Op.Phase = next.Box, hostclaim.PhaseInstalled
		c.Op.Intent["target_box"], c.Op.Intent["target_enrollment"] = next.Box, next.Enrollment
		c.Op.Participants = []string{"src", next.Box}
		c.Op.Journal["exec_ack."+next.Box] = `{"op":"rel-1"}`
		c.Holder.Stamp = stamp
		c.Op.Journal["install_stamp"] = strconv.FormatUint(stamp, 10)
		delete(c.Op.Journal, "local_install")
		change(c)
		return nil
	})
	f.onBox(claimCensusBox(t), next)
	return f
}