package moves

import (
	"encoding/base64"
	"strings"
	"testing"
)

func TestEnvReportRevealsNamesAndEqualityOnly(t *testing.T) {
	key := []byte("0123456789abcdef0123456789abcdef")
	src := ReportEnv(key, map[string]string{"DATABASE_URL": "sqlite:a", "CARLOS_REGION": "ie", "CARLOS_CONTROL_SOCKET": "/run/x", "INVOCATION_ID": "1", "SECRET": "s3"})
	if src.Vars["SECRET"] == "s3" || len(src.Vars["SECRET"]) != 64 {
		t.Fatal("a value leaked or the mac is not hex sha256")
	}
	same := ReportEnv(key, map[string]string{"DATABASE_URL": "sqlite:a", "CARLOS_REGION": "uk", "CARLOS_CONTROL_SOCKET": "/run/y", "INVOCATION_ID": "2", "SECRET": "s3"})
	if diffs := CompareEnv(src, same, true, false); len(diffs) != 0 {
		t.Fatalf("a matching target reported %v", diffs)
	}
	// Region must differ; layout vars are present iff flat provides them;
	// box vars are never compared; everything else equal.
	sameRegion := ReportEnv(key, map[string]string{"DATABASE_URL": "sqlite:a", "CARLOS_REGION": "ie", "CARLOS_CONTROL_SOCKET": "/run/y", "SECRET": "s3"})
	diffs := CompareEnv(src, sameRegion, true, false)
	if len(diffs) != 1 || diffs[0].Name != "CARLOS_REGION" || diffs[0].Kind != "region-same" {
		t.Fatalf("same region: %v", diffs)
	}
	noRegion := ReportEnv(key, map[string]string{"DATABASE_URL": "sqlite:a", "CARLOS_CONTROL_SOCKET": "/run/y", "SECRET": "s3"})
	if diffs := CompareEnv(src, noRegion, true, false); len(diffs) != 1 || diffs[0].Kind != "region-missing" {
		t.Fatalf("missing region: %v", diffs)
	}
	// the layout variable absent from both: still required of a flat landing
	srcNoLayout := ReportEnv(key, map[string]string{"DATABASE_URL": "sqlite:a", "CARLOS_REGION": "ie"})
	if diffs := CompareEnv(srcNoLayout, ReportEnv(key, map[string]string{"DATABASE_URL": "sqlite:a", "CARLOS_REGION": "uk"}), true, false); len(diffs) != 1 || diffs[0].Name != "CARLOS_CONTROL_SOCKET" || diffs[0].Kind != "layout-missing" {
		t.Fatalf("layout name absent from both: %v", diffs)
	}
	// CARLOS_PURGE is advisory (set iff the box has a cache): a presence
	// difference is a note, never a failure; main omits the variable on a
	// box without a cache (backend_exec.go agentOwnedVars), so neither
	// example above carries it and they compare clean.
	purge := ReportEnv(key, map[string]string{"DATABASE_URL": "sqlite:a", "CARLOS_REGION": "uk", "CARLOS_CONTROL_SOCKET": "/run/y", "SECRET": "s3", "CARLOS_PURGE": "header"})
	if diffs := CompareEnv(src, purge, true, false); len(diffs) != 1 || diffs[0].Name != "CARLOS_PURGE" || diffs[0].Kind != "advisory-differs" || !diffs[0].Note() {
		t.Fatalf("purge presence: %v", diffs)
	}
	drift := ReportEnv(key, map[string]string{"DATABASE_URL": "sqlite:b", "CARLOS_REGION": "uk", "EXTRA": "x"})
	kinds := map[string]string{}
	for _, d := range CompareEnv(src, drift, false, false) {
		kinds[d.Name] = d.Kind
	}
	if kinds["DATABASE_URL"] != "differs" || kinds["SECRET"] != "missing" || kinds["EXTRA"] != "extra" || kinds["CARLOS_CONTROL_SOCKET"] != "" {
		t.Fatalf("drift: %v", kinds)
	}
	if ReportEnv([]byte("another-key-another-key-another!"), map[string]string{"SECRET": "s3"}).Vars["SECRET"] == src.Vars["SECRET"] {
		t.Fatal("the mac does not depend on the key")
	}
	// The digest is the move-portable one (home part 2, Task 2b): src and
	// same differ only in box-owned variables (region, control socket, a
	// box variable), so they pin the same; drift differs in the instance's
	// own variables, so it does not.
	if src.Digest == "" || src.Digest != same.Digest || src.Digest == drift.Digest {
		t.Fatalf("digest: src %s same %s drift %s", src.Digest, same.Digest, drift.Digest)
	}
}

// TestBoxOwnedIsTheOneSharedSet: the box-owned set is the agent-owned
// variables and the box variables, T3 tolerates exactly it (every
// box-owned name has a class other than "equal", every other name is
// "equal"), and the layout, advisory and region classes are inside it.
func TestBoxOwnedIsTheOneSharedSet(t *testing.T) {
	for _, set := range []map[string]bool{AgentOwnedVars, BoxVars, LayoutVars, AdvisoryVars, {RegionVar: true}} {
		for name := range set {
			if !BoxOwned(name) || Class(name) == "equal" {
				t.Errorf("%s: box-owned %v, class %q", name, BoxOwned(name), Class(name))
			}
		}
	}
	for _, name := range []string{"CARLOS_REGION", "CARLOS_CONTROL_SOCKET", "CARLOS_PURGE", "CARLOS_HOST"} {
		if !AgentOwnedVars[name] {
			t.Errorf("%s is not agent-owned", name)
		}
	}
	if Class("CARLOS_HOST") != "box" {
		t.Errorf("CARLOS_HOST is class %q, want box", Class("CARLOS_HOST"))
	}
	for _, name := range []string{"DATABASE_URL", "CARLOS_ADMIN_TOKEN", "CARLOS_INSTANCE_KEY", "APP_MODE", "PATH", "HOME"} {
		if BoxOwned(name) || Class(name) != "equal" {
			t.Errorf("%s: box-owned %v, class %q", name, BoxOwned(name), Class(name))
		}
	}
}

// TestPortableDigestCoversTheInstanceOnly: the pin ignores every
// agent-owned variable, and every box variable the box supplied, present,
// absent or different, and still binds every instance variable: its value,
// its presence, its name. A box variable the instance's own layers
// supplied is the instance's (fix round 2): its value and its presence are
// pinned like an app variable's.
func TestPortableDigestCoversTheInstanceOnly(t *testing.T) {
	key := []byte("0123456789abcdef0123456789abcdef")
	base := map[string]string{"APP_MODE": "prod", "DATABASE_URL": "sqlite:a"}
	pin := PortableDigest(key, base, nil)
	if pin != ReportEnv(key, base).Digest || pin != ReportLaunch(key, base, map[string]bool{"APP_MODE": true}).Digest {
		t.Fatal("PortableDigest is not ReportLaunch's digest")
	}
	with := func(edit func(map[string]string), instance map[string]bool) string {
		env := map[string]string{}
		for k, v := range base {
			env[k] = v
		}
		edit(env)
		return PortableDigest(key, env, instance)
	}
	for name := range AgentOwnedVars {
		// agent-owned and the box's: left out
		if got := with(func(e map[string]string) { e[name] = "box-a" }, nil); got != pin {
			t.Errorf("%s from the box changed the pin", name)
		}
		// the exclusion rule (fix round 4): a box-owned name the instance
		// supplied is pinned. The composer never reports an agent-owned
		// name so (ExecBackend.LaunchLayers), as the agent decides it.
		if got := with(func(e map[string]string) { e[name] = "box-a" }, map[string]bool{name: true}); got == pin {
			t.Errorf("%s supplied by the instance left the pin unchanged", name)
		}
	}
	for name := range BoxVars {
		if got := with(func(e map[string]string) { e[name] = "box-b" }, nil); got != pin {
			t.Errorf("%s inherited from the box changed the pin", name)
		}
		if got := with(func(e map[string]string) { e[name] = "box-b" }, map[string]bool{name: true}); got == pin {
			t.Errorf("%s supplied by the instance left the pin unchanged", name)
		}
	}
	a := with(func(e map[string]string) { e["HOSTNAME"] = "a" }, map[string]bool{"HOSTNAME": true})
	if b := with(func(e map[string]string) { e["HOSTNAME"] = "b" }, map[string]bool{"HOSTNAME": true}); a == b {
		t.Error("an instance HOSTNAME's value is not pinned")
	}
	if inherited := with(func(e map[string]string) { e["HOSTNAME"] = "a" }, nil); inherited == a {
		t.Error("the same HOSTNAME pins the same whether the box or the instance supplied it")
	}
	for name, edit := range map[string]func(map[string]string){
		"a value":   func(e map[string]string) { e["APP_MODE"] = "staging" },
		"an extra":  func(e map[string]string) { e["EXTRA"] = "1" },
		"a missing": func(e map[string]string) { delete(e, "DATABASE_URL") },
		"a rename":  func(e map[string]string) { e["APP_MODE2"] = e["APP_MODE"]; delete(e, "APP_MODE") },
	} {
		if with(edit, nil) == pin {
			t.Errorf("%s instance variable left the pin unchanged", name)
		}
	}
	// The local digest covers everything, box-owned variables included.
	local := LocalDigest(key, base)
	if local == LocalDigest(key, map[string]string{"APP_MODE": "prod", "DATABASE_URL": "sqlite:a", RegionVar: "uk"}) ||
		local == LocalDigest(key, map[string]string{"APP_MODE": "prod", "DATABASE_URL": "sqlite:a", "HOSTNAME": "box"}) {
		t.Error("the local digest ignored a box-owned variable")
	}
}

// TestPinnedRule (fix round 4, platform-1e's exclusion rule): a name is
// left out only when it is box-owned and the instance did not supply it;
// everything else is pinned.
func TestPinnedRule(t *testing.T) {
	for _, c := range []struct {
		name     string
		instance bool
		want     bool
	}{
		{RegionVar, false, false}, {RegionVar, true, true}, {"CARLOS_HOST", false, false}, {"CARLOS_HOST", true, true},
		{"HOSTNAME", false, false}, {"HOSTNAME", true, true}, {"PWD", true, true},
		{"APP_MODE", false, true}, {"APP_MODE", true, true},
	} {
		if got := Pinned(c.name, c.instance); got != c.want {
			t.Errorf("Pinned(%s, %v) = %v, want %v", c.name, c.instance, got, c.want)
		}
	}
}

// TestCompareEnvComparesAnInstanceBoxVariable (fix round 2): T3 compares a
// box variable either side's instance supplied as an app variable, and
// still ignores one both boxes supplied.
func TestCompareEnvComparesAnInstanceBoxVariable(t *testing.T) {
	key := []byte("0123456789abcdef0123456789abcdef")
	src := ReportLaunch(key, map[string]string{"A": "1", RegionVar: "ie", "HOSTNAME": "a"}, map[string]bool{"A": true, "HOSTNAME": true})
	if len(src.Instance) != 1 || src.Instance[0] != "HOSTNAME" {
		t.Fatalf("Instance %v", src.Instance)
	}
	same := ReportLaunch(key, map[string]string{"A": "1", RegionVar: "uk", "HOSTNAME": "a"}, map[string]bool{"A": true, "HOSTNAME": true})
	if diffs := CompareEnv(src, same, false, false); len(diffs) != 0 {
		t.Fatalf("the same instance HOSTNAME: %v", diffs)
	}
	other := ReportLaunch(key, map[string]string{"A": "1", RegionVar: "uk", "HOSTNAME": "b"}, map[string]bool{"A": true, "HOSTNAME": true})
	if diffs := CompareEnv(src, other, false, false); len(diffs) != 1 || diffs[0].Name != "HOSTNAME" || diffs[0].Kind != "differs" {
		t.Fatalf("another instance HOSTNAME: %v", diffs)
	}
	inherited := ReportLaunch(key, map[string]string{"A": "1", RegionVar: "uk", "HOSTNAME": "box"}, map[string]bool{"A": true})
	if diffs := CompareEnv(src, inherited, false, false); len(diffs) != 1 || diffs[0].Kind != "differs" {
		t.Fatalf("the instance's HOSTNAME against the box's: %v", diffs)
	}
	boxSrc := ReportLaunch(key, map[string]string{"A": "1", RegionVar: "ie", "HOSTNAME": "x"}, map[string]bool{"A": true})
	if diffs := CompareEnv(boxSrc, inherited, false, false); len(diffs) != 0 {
		t.Fatalf("two boxes' own HOSTNAMEs: %v", diffs)
	}
	added := ReportLaunch(key, map[string]string{"A": "1", RegionVar: "uk", "HOSTNAME": "b"}, map[string]bool{"A": true, "HOSTNAME": true})
	if diffs := CompareEnv(ReportLaunch(key, map[string]string{"A": "1", RegionVar: "ie"}, nil), added, false, false); len(diffs) != 1 || diffs[0].Kind != "extra" {
		t.Fatalf("a target-only instance HOSTNAME: %v", diffs)
	}
}

func TestEnvReportClassesAndNotes(t *testing.T) {
	for name, want := range map[string]string{
		"CARLOS_REGION": "region", "CARLOS_CONTROL_SOCKET": "layout", "CARLOS_PURGE": "advisory",
		"INVOCATION_ID": "box", "JOURNAL_STREAM": "box", "HOSTNAME": "box", "PWD": "box", "OLDPWD": "box", "SHLVL": "box", "_": "box",
		"DATABASE_URL": "equal", "CARLOS_ADMIN_TOKEN": "equal",
	} {
		if got := Class(name); got != want {
			t.Errorf("Class(%q) = %q, want %q", name, got, want)
		}
	}
	if len(LayoutVars) != 1 || !LayoutVars["CARLOS_CONTROL_SOCKET"] || len(AdvisoryVars) != 1 || !AdvisoryVars["CARLOS_PURGE"] {
		t.Fatalf("layout %v advisory %v", LayoutVars, AdvisoryVars)
	}
	for _, k := range []string{"missing", "extra", "differs", "region-missing", "region-same", "region-present", "layout-missing", "layout-present"} {
		if (EnvDiff{"X", k}).Note() {
			t.Errorf("%s is a note", k)
		}
	}
	if !(EnvDiff{"X", "advisory-differs"}).Note() {
		t.Error("advisory-differs is not a note")
	}
}

func TestCompareEnvNestedLayout(t *testing.T) {
	key := []byte("0123456789abcdef0123456789abcdef")
	src := ReportEnv(key, map[string]string{"A": "1", "CARLOS_REGION": "ie"})
	tgt := ReportEnv(key, map[string]string{"A": "1", "CARLOS_REGION": "uk", "CARLOS_CONTROL_SOCKET": "/run/y"})
	// T3's "present iff the flat layout provides it": a layout variable
	// only the target carries is a diff on a non-flat landing, and
	// nothing on a flat one.
	if diffs := CompareEnv(src, tgt, false, false); len(diffs) != 1 || diffs[0].Name != "CARLOS_CONTROL_SOCKET" || diffs[0].Kind != "layout-present" {
		t.Fatalf("target-only layout var, non-flat: %v", diffs)
	}
	if diffs := CompareEnv(src, tgt, true, false); len(diffs) != 0 {
		t.Fatalf("target-only layout var, flat: %v", diffs)
	}
	src2 := ReportEnv(key, map[string]string{"A": "1", "CARLOS_REGION": "ie", "CARLOS_CONTROL_SOCKET": "/run/x"})
	if diffs := CompareEnv(src2, tgt, false, false); len(diffs) != 1 || diffs[0].Kind != "layout-present" {
		t.Fatalf("layout-present: %v", diffs)
	}
	// neither side carries it, non-flat: clean
	none := ReportEnv(key, map[string]string{"A": "1", "CARLOS_REGION": "uk"})
	if diffs := CompareEnv(src, none, false, false); len(diffs) != 0 {
		t.Fatalf("no layout var anywhere, non-flat: %v", diffs)
	}
	// the advisory exception holds: a target-only CARLOS_PURGE is a note
	purge := ReportEnv(key, map[string]string{"A": "1", "CARLOS_REGION": "uk", "CARLOS_PURGE": "header"})
	if diffs := CompareEnv(src, purge, false, false); len(diffs) != 1 || !diffs[0].Note() {
		t.Fatalf("target-only purge, non-flat: %v", diffs)
	}
}

// T3's home rule (home part 2, Review Focus 2): a home target sets no
// CARLOS_REGION (agentOwnedVars adds it only when the box has a region), so
// absent is no diff; a target in home that does set one is not the home
// box, and fails region-present. The same pair compared as a named target
// keeps today's region-missing.
func TestCompareEnvHomeTargetSetsNoRegion(t *testing.T) {
	key := []byte("0123456789abcdef0123456789abcdef")
	src := ReportEnv(key, map[string]string{"A": "1", "CARLOS_REGION": "uk"})
	noRegion := ReportEnv(key, map[string]string{"A": "1"})
	if diffs := CompareEnv(src, noRegion, false, true); len(diffs) != 0 {
		t.Fatalf("home target without a region: %v", diffs)
	}
	if diffs := CompareEnv(src, noRegion, false, false); len(diffs) != 1 || diffs[0].Name != RegionVar || diffs[0].Kind != "region-missing" {
		t.Fatalf("named target without a region: %v", diffs)
	}
	ie := ReportEnv(key, map[string]string{"A": "1", "CARLOS_REGION": "ie"})
	if diffs := CompareEnv(src, ie, false, true); len(diffs) != 1 || diffs[0].Name != RegionVar || diffs[0].Kind != "region-present" {
		t.Fatalf("home target with a region: %v", diffs)
	}
	// the source's own region value on a home target: present, not same
	uk := ReportEnv(key, map[string]string{"A": "1", "CARLOS_REGION": "uk"})
	if diffs := CompareEnv(src, uk, false, true); len(diffs) != 1 || diffs[0].Kind != "region-present" {
		t.Fatalf("home target with the source's region: %v", diffs)
	}
	// a source without a region (home to home, which the door refuses;
	// T3 does not rely on that): absent on both sides is clean, a
	// target-only region is still region-present
	srcHome := ReportEnv(key, map[string]string{"A": "1"})
	if diffs := CompareEnv(srcHome, noRegion, false, true); len(diffs) != 0 {
		t.Fatalf("no region on either side, home target: %v", diffs)
	}
	if diffs := CompareEnv(srcHome, ie, false, true); len(diffs) != 1 || diffs[0].Name != RegionVar || diffs[0].Kind != "region-present" {
		t.Fatalf("target-only region, home target: %v", diffs)
	}
	// the rest of T3 is unchanged by targetHome
	drift := ReportEnv(key, map[string]string{"A": "2", "EXTRA": "x"})
	kinds := map[string]string{}
	for _, d := range CompareEnv(src, drift, false, true) {
		kinds[d.Name] = d.Kind
	}
	if len(kinds) != 2 || kinds["A"] != "differs" || kinds["EXTRA"] != "extra" {
		t.Fatalf("home target drift: %v", kinds)
	}
	if (EnvDiff{RegionVar, "region-present"}).Note() {
		t.Fatal("region-present is a note")
	}
}

// A named target's T3 region rule is the one before home part 2, with
// targetHome false at every call: the target must set its own region,
// different from the source's; a target-only region (a move out of home)
// is no diff.
func TestNamedTargetT3Unchanged(t *testing.T) {
	key := []byte("0123456789abcdef0123456789abcdef")
	ie := map[string]string{"A": "1", "CARLOS_REGION": "ie"}
	uk := map[string]string{"A": "1", "CARLOS_REGION": "uk"}
	none := map[string]string{"A": "1"}
	for _, tc := range []struct {
		name     string
		src, tgt map[string]string
		want     string
	}{
		{"named to named", ie, uk, ""},
		{"same region", ie, ie, "region-same"},
		{"target sets none", ie, none, "region-missing"},
		{"out of home", none, uk, ""},
		{"neither sets one", none, none, ""},
	} {
		diffs := CompareEnv(ReportEnv(key, tc.src), ReportEnv(key, tc.tgt), false, false)
		got := ""
		if len(diffs) > 1 || (len(diffs) == 1 && diffs[0].Name != RegionVar) {
			t.Fatalf("%s: %v", tc.name, diffs)
		}
		if len(diffs) == 1 {
			got = diffs[0].Kind
		}
		if got != tc.want {
			t.Errorf("%s: %q, want %q", tc.name, got, tc.want)
		}
	}
}

func TestReportEnvIsDeterministicAndDigestCoversNamesAndValues(t *testing.T) {
	key := []byte("0123456789abcdef0123456789abcdef")
	a := ReportEnv(key, map[string]string{"A": "1", "B": "2"})
	b := ReportEnv(key, map[string]string{"B": "2", "A": "1"})
	if a.Digest != b.Digest || a.V != EnvReportVersion || !CurrentEnvReport(a) || !strings.HasPrefix(a.Digest, "env2:sha256:") {
		t.Fatalf("%v %v", a, b)
	}
	// the mac binds the name: the same value under another name differs
	c := ReportEnv(key, map[string]string{"A": "2", "B": "1"})
	if c.Digest == a.Digest || c.Vars["A"] == a.Vars["B"] {
		t.Fatal("the mac does not bind the name")
	}
	// name/value boundary: "AB"+"" is not "A"+"B"
	if ReportEnv(key, map[string]string{"AB": ""}).Vars["AB"] == ReportEnv(key, map[string]string{"A": "B"}).Vars["A"] {
		t.Fatal("name and value run together")
	}
}

func TestReportKeyFromSecrets(t *testing.T) {
	raw := make([]byte, 32)
	for i := range raw {
		raw[i] = byte(i + 1)
	}
	good := base64.StdEncoding.EncodeToString(raw)
	k1, err := ReportKeyFromSecrets(good)
	if err != nil || len(k1) != 32 {
		t.Fatalf("%v %d", err, len(k1))
	}
	k2, _ := ReportKeyFromSecrets(good)
	if string(k1) != string(k2) {
		t.Fatal("not deterministic")
	}
	if string(k1) == string(raw) {
		t.Fatal("the report key is the raw secret")
	}
	raw[0] ^= 1
	k3, err := ReportKeyFromSecrets(base64.StdEncoding.EncodeToString(raw))
	if err != nil || string(k3) == string(k1) {
		t.Fatalf("key does not depend on the secret: %v", err)
	}
	for name, in := range map[string]string{
		"malformed base64": "not base64!!",
		"empty":            "",
		"short":            base64.StdEncoding.EncodeToString(raw[:31]),
		"long":             base64.StdEncoding.EncodeToString(append(append([]byte{}, raw...), 0)),
	} {
		if k, err := ReportKeyFromSecrets(in); err == nil || k != nil {
			t.Errorf("%s: key %v err %v", name, k, err)
		} else if strings.Contains(err.Error(), in) && in != "" {
			t.Errorf("%s: the error echoes the input: %v", name, err)
		}
	}
}

// TestEnvReportVersionTwo (fix round 3): a report is version 2 and its
// digest is a v2 pin. A v1 report, or a v1 pin in either v1 form (main's
// whole-env digest, f4f51ba6's digest without box variables), is not
// current, and no v1 form of the same env equals the v2 pin. The local
// digest keeps its own form.
func TestEnvReportVersionTwo(t *testing.T) {
	key := []byte("0123456789abcdef0123456789abcdef")
	env := map[string]string{"A": "1", "HOSTNAME": "box"}
	r := ReportEnv(key, env)
	if r.V != 2 || !CurrentEnvReport(r) || !CurrentEnvPin(r.Digest) {
		t.Fatalf("not a v2 report: %+v", r)
	}
	old := r
	old.V = 1
	if CurrentEnvReport(old) {
		t.Fatal("a v1 report is current")
	}
	for _, pin := range []string{"", "sha256:" + strings.TrimPrefix(r.Digest, "env2:sha256:"), LocalDigest(key, env), "report"} {
		if CurrentEnvPin(pin) {
			t.Errorf("%q is a current pin", pin)
		}
		if pin == r.Digest {
			t.Errorf("a v1 form %q equals the v2 pin", pin)
		}
	}
	if !strings.HasPrefix(LocalDigest(key, env), "sha256:") {
		t.Fatal("the local digest changed form")
	}
}

// TestBoxVarsCoverTheMeasuredAgentEnvironment pins the non-CARLOS_
// variables read from carlos-edge's process on dev and flagship boxes
// (2026-10-20) that differ from box to box: each must be box-owned, or
// the env pin of every move between two boxes fails.
func TestBoxVarsCoverTheMeasuredAgentEnvironment(t *testing.T) {
	for _, name := range []string{
		"INVOCATION_ID", "JOURNAL_STREAM", "SYSTEMD_EXEC_PID", "MEMORY_PRESSURE_WATCH", "MEMORY_PRESSURE_WRITE",
		"AWS_REGION", "STATUS_BOX_REGION", "PLATFORM_EDGE_IPS", "PLATFORM_APPS_DOMAIN",
		"CONSOLE_DENY_DOMAINS", "CONSOLE_HOME_REGION",
	} {
		if !BoxOwned(name) {
			t.Errorf("%s differs per box but is not box-owned", name)
		}
	}
	for _, name := range []string{"HOME", "LANG", "LOGNAME", "PATH", "USER"} {
		if BoxOwned(name) {
			t.Errorf("%s is the same on every box and must stay pinned", name)
		}
	}
}