package provision

import (
	"strings"
	"testing"
)

func TestPlan14LegacyDeclarationCannotDisappear(t *testing.T) {
	e := classifiedRootRead{rootReadEntry: rootReadEntry{File: "internal/host/agent.go", Unit: "systemctlStartUnit", Kinds: "file:Command@10", Digest: strings.Repeat("a", 64)}, Class: "legacy", Task: "accepted-legacy", Basis: "accepted-legacy;rev3=J1;basis=root-route"}
	key := e.File + ":" + e.Unit
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{key: e}, Legacy: map[string]bool{rootReadLegacyFingerprint(e): true}, Frozen: map[string]classifiedRootRead{key: e}, Removed: map[string]string{}}
	scan := rootReadScan{Declarations: map[string]string{key: e.Digest}}
	if errs := checkRootReadDeclarations(scan, inv); len(errs) != 0 {
		t.Fatal(errs)
	}
	delete(inv.Entries, key)
	scan.Declarations[key] = strings.Repeat("b", 64)
	if errs := checkRootReadDeclarations(scan, inv); len(errs) == 0 {
		t.Fatal("changed declaration with no read sites and no TSV row escaped")
	}
	inv.Entries[key] = e
	if errs := checkRootReadDeclarations(scan, inv); len(errs) == 0 {
		t.Fatal("changed declaration body escaped frozen identity")
	}
	promoted := e
	promoted.Class = "authority"
	promoted.Task = "C"
	promoted.Basis = "reviewed delegation"
	promoted.Kinds = ""
	promoted.Digest = scan.Declarations[key]
	inv.Entries[key] = promoted
	if errs := checkRootReadDeclarations(scan, inv); len(errs) != 0 {
		t.Fatal(errs)
	}
	delete(scan.Declarations, key)
	if errs := checkRootReadDeclarations(scan, inv); len(errs) == 0 {
		t.Fatal("removed declaration needs explicit removal")
	}
	delete(inv.Entries, key)
	inv.Removed[key] = "C; removed obsolete delegate after reviewed root authority conversion"
	if errs := checkRootReadDeclarations(scan, inv); len(errs) != 0 {
		t.Fatal(errs)
	}
	scan.Declarations[key] = e.Digest
	if errs := checkRootReadDeclarations(scan, inv); len(errs) == 0 {
		t.Fatal("removal disposition hid a surviving declaration")
	}
}

func TestPlan14MovesOverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads.tsv", &inv, false); err != nil {
		t.Fatal(err)
	}
	baseline := make(map[string]bool, len(inv.Legacy))
	for hash := range inv.Legacy {
		baseline[hash] = true
	}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-moves.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	for hash := range baseline {
		if !inv.Legacy[hash] {
			t.Fatalf("overlay removed frozen identity %s", hash)
		}
	}
	if got := rootReadLegacySeal(inv); got != "fddd1cfd0391db80770074c47156dca161c5618d0d92da08669aea2cc22dcf9e" {
		t.Fatalf("overlay changed approved legacy set: %s", got)
	}
}

func TestPlan14MergeOverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	original := make(map[string]bool, len(inv.Legacy))
	for hash := range inv.Legacy {
		original[hash] = true
	}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-merge.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	for hash := range original {
		if !inv.Legacy[hash] {
			t.Fatalf("merge removed original freeze %s", hash)
		}
	}
	const seal = "c88a37629c95dd397beeb95f5ef101438fa884ac04dc4435aa55387b897d393c"
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	key := "internal/provision/reconcile.go:routeFor"
	if inv.Removed[key] == "" {
		t.Fatal("renamed declaration lost its explicit removal disposition")
	}
	if _, present := inv.Entries[key]; present {
		t.Fatal("removed declaration still classified")
	}
	inv.Legacy[strings.Repeat("0", 64)] = true
	if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {
		t.Fatal("new freeze entry accepted without a ruling")
	}
}

func TestPlan14Merge3OverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	if errs := checkRootReadLegacy(inv, "c3351f27f6467fc33b319b36a7e64b75b2d992232f956d9c6243cc49e0c05396"); len(errs) != 0 {
		t.Fatal(errs)
	}
	original := make(map[string]bool, len(inv.Legacy))
	for hash := range inv.Legacy {
		original[hash] = true
	}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-merge3.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	for hash := range original {
		if !inv.Legacy[hash] {
			t.Fatalf("merge3 removed original freeze %s", hash)
		}
	}
	if len(inv.Legacy) != len(original)+3 {
		t.Fatal("merge ruling 3 permits exactly three new frozen declarations")
	}
	const seal = "65dba959f80cc47e9fd99be145ba8b24bb3b37ffaf77b47d1b9cc3e01da14b47"
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	for _, key := range []string{"internal/host/instancekeys.go:backfillInstanceKeys", "internal/host/instancekeys.go:keyBackfillInSlot.BackfillInstanceKey", "internal/host/layoutleg.go:activatorStart.Run"} {
		e := inv.Entries[key]
		if e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3=merge-ruling-3;") {
			t.Fatalf("wrong hotfix disposition: %+v", e)
		}
	}
	if inv.Entries["internal/host/agent.go:runAgent"].Class != "authority" {
		t.Fatal("runAgent lost kept authority")
	}
	inv.Legacy[strings.Repeat("0", 64)] = true
	if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {
		t.Fatal("unapproved legacy fingerprint accepted")
	}
}

func TestPlan14Fix4OverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	seal := rootReadLegacySeal(inv)
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-fix4.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	if seal != "65dba959f80cc47e9fd99be145ba8b24bb3b37ffaf77b47d1b9cc3e01da14b47" {
		t.Fatal("unexpected legacy seal", seal)
	}
}

func TestPlan14Fix5OverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	seal := rootReadLegacySeal(inv)
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-fix5.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-fix6.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	if seal != "65dba959f80cc47e9fd99be145ba8b24bb3b37ffaf77b47d1b9cc3e01da14b47" {
		t.Fatal("unexpected legacy seal", seal)
	}
}

// Census ruling zddr3 (#272): the placement shim's overlay, loaded after fix6.
func TestPlan14Zddr3OverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	if errs := checkRootReadLegacy(inv, "65dba959f80cc47e9fd99be145ba8b24bb3b37ffaf77b47d1b9cc3e01da14b47"); len(errs) != 0 {
		t.Fatal(errs)
	}
	original := make(map[string]bool, len(inv.Legacy))
	for hash := range inv.Legacy {
		original[hash] = true
	}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-zddr3.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	for hash := range original {
		if !inv.Legacy[hash] {
			t.Fatalf("zddr3 removed original freeze %s", hash)
		}
	}
	if len(inv.Legacy) != len(original)+13 {
		t.Fatal("census ruling zddr3 permits exactly thirteen new frozen declarations")
	}
	// Census ruling zddr3 seal: ten shim and VerifyPlacement rows plus three
	// refreshed legacy rows (openCleanupAt, StartWorkerStaged, spawnChildFrom).
	const seal = "c748e02bfe907a009ef42eb544b1a44fe813f4f7c13e454be3980aec4fade568"
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	for key, e := range inv.Entries {
		if strings.HasPrefix(key, "internal/cgroup/shim_linux.go:") || strings.HasPrefix(key, "internal/cgroup/verify_linux.go:") {
			if e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3=census-ruling-zddr3;") {
				t.Fatalf("wrong zddr3 disposition: %+v", e)
			}
		}
	}
	for _, key := range []string{"internal/cgroup/cgroup_linux.go:placementLive", "internal/cgroup/cgroup.go:Manager.startIn"} {
		if !strings.HasPrefix(inv.Removed[key], "H3;census-ruling-zddr3: ") {
			t.Fatalf("%s lost its census-ruling removal", key)
		}
		if _, present := inv.Entries[key]; present {
			t.Fatalf("%s still classified", key)
		}
	}
	inv.Legacy[strings.Repeat("0", 64)] = true
	if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {
		t.Fatal("unapproved legacy fingerprint accepted")
	}
}

// Census ruling zddr4 (zero-downtime deploys rev 19, Gate F, #272): the
// generation socket overlay, loaded after hotfix281.
func TestPlan14Zddr4OverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv", "plan14-root-reads-zddr3.tsv", "plan14-root-reads-hotfix281.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	if errs := checkRootReadLegacy(inv, "6da50872e15f7f396d23e5b1b2e044a73cd9e5c07d85c8e22252b0a1a5304bbd"); len(errs) != 0 {
		t.Fatal(errs)
	}
	original := make(map[string]bool, len(inv.Legacy))
	for hash := range inv.Legacy {
		original[hash] = true
	}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-zddr4.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	for hash := range original {
		if !inv.Legacy[hash] {
			t.Fatalf("zddr4 removed original freeze %s", hash)
		}
	}
	if len(inv.Legacy) != len(original)+14 {
		t.Fatal("census ruling zddr4 permits exactly fourteen new frozen declarations")
	}
	// Census ruling zddr4 seal: ten changed activator rows (startGenFrom,
	// GenPaths, StartStaged, genTerminated, handlelessGenEmpty,
	// failedWakeStopped, prepareAt, swapOverlap, foreignRow,
	// holdAdmitLocked) plus four new ones (ExecBackend.GenLayout,
	// SplitBackend.GenLayout, removeGenDir, swapLayout).
	const seal = "e736a5e2652cc546db02c5a385ae7da9fa8a4313d3064f6b431642431974d65d"
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	units := []string{
		"internal/activator/backend_exec.go:ExecBackend.startGenFrom",
		"internal/activator/genbackend.go:ExecBackend.GenPaths",
		"internal/activator/genbackend.go:ExecBackend.StartStaged",
		"internal/activator/opset.go:Service.genTerminated",
		"internal/activator/opset.go:Service.handlelessGenEmpty",
		"internal/activator/opset.go:Service.failedWakeStopped",
		"internal/activator/prepare.go:ExecBackend.prepareAt",
		"internal/activator/swap.go:Service.swapOverlap",
		"internal/activator/swaphold.go:Service.foreignRow",
		"internal/activator/swaphold.go:Service.holdAdmitLocked",
		"internal/activator/genbackend.go:ExecBackend.GenLayout",
		"internal/activator/genbackend.go:SplitBackend.GenLayout",
		"internal/activator/generations.go:removeGenDir",
		"internal/activator/swaphold.go:Service.swapLayout",
	}
	const boundary = "Boundary: agent-side, running as carlos; generation socket directories under the agent's own /run/carlos tree; no root decision; no registry, /data, release or claim read beyond what the unit read before."
	for _, key := range units {
		e, ok := inv.Entries[key]
		if !ok || e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3=census-ruling-zddr4;") || !strings.HasSuffix(e.Basis, boundary) {
			t.Fatalf("wrong zddr4 disposition for %s: %+v", key, e)
		}
		if f, ok := inv.Frozen[key]; !ok || rootReadLegacyFingerprint(f) != rootReadLegacyFingerprint(e) {
			t.Fatalf("%s is not frozen as classified", key)
		}
	}
	inv.Legacy[strings.Repeat("0", 64)] = true
	if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {
		t.Fatal("unapproved legacy fingerprint accepted")
	}
}

// Census ruling 292 (amadan #292, platform-1e, extended): the edge-restart
// lease overlay, loaded after reserved285, the last overlay before it.
func TestPlan14Overlay292PreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv", "plan14-root-reads-zddr3.tsv", "plan14-root-reads-hotfix281.tsv", "plan14-root-reads-zddr4.tsv", "plan14-root-reads-reserved285.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	if errs := checkRootReadLegacy(inv, "e736a5e2652cc546db02c5a385ae7da9fa8a4313d3064f6b431642431974d65d"); len(errs) != 0 {
		t.Fatal(errs)
	}
	original := make(map[string]bool, len(inv.Legacy))
	for hash := range inv.Legacy {
		original[hash] = true
	}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-292.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	for hash := range original {
		if !inv.Legacy[hash] {
			t.Fatalf("292 removed original freeze %s", hash)
		}
	}
	if len(inv.Legacy) != len(original)+12 {
		t.Fatal("census ruling 292 permits exactly twelve new frozen declarations")
	}
	// Census ruling 292 seal: eight changed activator rows (begin,
	// BeginSidecarRequest, doWake, sweepOnce, wake, spawnUnitFrom,
	// cleanupFailedWake, reapUnprovenWake), three new proof units
	// (ExecBackend.LegacyRunGone, SplitBackend.LegacyRunGone,
	// legacyRunGone) and instance-control's Server declaration.
	const seal = "3b2506dd2ab3986d0df0ceda7f596e5a46ea4d1dfbc17b1d0fd8d5f176e8038d"
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	agent := []string{
		"internal/activator/activator.go:Service.BeginSidecarRequest",
		"internal/activator/activator.go:Service.begin",
		"internal/activator/activator.go:Service.doWake",
		"internal/activator/activator.go:Service.sweepOnce",
		"internal/activator/activator.go:Service.wake",
		"internal/activator/backend_exec.go:ExecBackend.spawnUnitFrom",
		"internal/activator/backend_exec.go:ExecBackend.LegacyRunGone",
		"internal/activator/backend_unit.go:SplitBackend.LegacyRunGone",
		"internal/activator/containment.go:Service.legacyRunGone",
		"internal/activator/maintenance.go:Service.cleanupFailedWake",
		"internal/activator/opset.go:Service.reapUnprovenWake",
	}
	const boundary = "Boundary: agent-side shutdown gates running as carlos; they refuse or stop new work once shutdown begins, and a cancelled wake releases its lease; no new read and no root decision; plus the legacy run unit's termination proof (systemctl show state and cgroup.events, as the exit observer reads), and a retried conditional lease delete of the same record."
	const rootClause = "Boundary: root's legacy start/stop serialisation per host: a stop fences, cancels and joins that host's in-flight legacy starts before its systemd stop; stop-only direction, no new start, path or read."
	check := func(key, rev3, suffix string) {
		t.Helper()
		e, ok := inv.Entries[key]
		if !ok || e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3="+rev3+";") || !strings.HasSuffix(e.Basis, suffix) {
			t.Fatalf("wrong 292 disposition for %s: %+v", key, e)
		}
		if f, ok := inv.Frozen[key]; !ok || rootReadLegacyFingerprint(f) != rootReadLegacyFingerprint(e) {
			t.Fatalf("%s is not frozen as classified", key)
		}
	}
	for _, key := range agent {
		check(key, "census-ruling-292", boundary)
	}
	check("internal/instancectl/server.go:type Server", "census-ruling-292,J2,J4", rootClause)
	for _, key := range []string{"internal/activator/activator.go:Service.begin", "internal/activator/activator.go:Service.wake"} {
		if !strings.Contains(inv.Entries[key].Basis, "claim wakes are cancelled at shutdown with swaps off, matching the fence path; stop-only, and the lease is released.") {
			t.Fatalf("%s lacks the claims note", key)
		}
	}
	inv.Legacy[strings.Repeat("0", 64)] = true
	if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {
		t.Fatal("unapproved legacy fingerprint accepted")
	}
}

// Census ruling carlos-run (Plan 14 controller, 2026-10-14): the carlos-run
// branch's overlay (carlos run, #259), loaded last, after census ruling
// owed. It keeps every earlier freeze, adds exactly 59 frozen declarations
// (the 58 it was ruled with, and type Server as census ruling 292 classed
// it), and every row it writes names the ruling. The two units that still exist and no longer
// read are retired under the ruling's name, in the form zddr3 used.
func TestPlan14CarlosRunOverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv", "plan14-root-reads-zddr3.tsv", "plan14-root-reads-hotfix281.tsv", "plan14-root-reads-zddr4.tsv", "plan14-root-reads-reserved285.tsv", "plan14-root-reads-292.tsv", "plan14-root-reads-census-ruling-275.tsv", "plan14-root-reads-census-ruling-owed.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	if errs := checkRootReadLegacy(inv, "79db70c4c396457e563bf792027f98eeed7cef3dc54fff8abedb025e7db1dfbb"); len(errs) != 0 {
		t.Fatal(errs)
	}
	original := make(map[string]bool, len(inv.Legacy))
	for hash := range inv.Legacy {
		original[hash] = true
	}
	before := make(map[string]classifiedRootRead, len(inv.Entries))
	for key, e := range inv.Entries {
		before[key] = e
	}
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-carlos-run.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	for hash := range original {
		if !inv.Legacy[hash] {
			t.Fatalf("carlos-run removed original freeze %s", hash)
		}
	}
	if len(inv.Legacy) != len(original)+59 {
		t.Fatalf("census ruling carlos-run permits exactly 59 new frozen declarations, not %d", len(inv.Legacy)-len(original))
	}
	// Census ruling carlos-run seal: 54 service-user and CLI rows, the four
	// instance-control rows that extend the J4 seed pattern, and type
	// Server re-digested as census ruling 292 classed it.
	const seal = "96e521e60dfc0b55e2bc08adbb7a7682a607a30599a8cf66e7c5689d6cf7fe5a"
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	written := 0
	for key, e := range inv.Entries {
		if e == before[key] {
			continue
		}
		written++
		if !strings.Contains(e.Basis, "rev3=census-ruling-carlos-run;") {
			t.Fatalf("%s does not name the ruling: %+v", key, e)
		}
		if e.Class == "legacy" && (e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3=census-ruling-carlos-run;")) {
			t.Fatalf("wrong carlos-run disposition: %+v", e)
		}
	}
	if written != 61 {
		t.Fatalf("census ruling carlos-run writes 61 rows, not %d", written)
	}
	// Main's authority rows keep their class and family.
	for key, task := range map[string]string{"internal/host/agent.go:runAgent": "B,C,D,F", "internal/host/agent.go:fastConvergeLoop": "B3"} {
		if e := inv.Entries[key]; e.Class != "authority" || e.Task != task {
			t.Fatalf("%s lost main's authority: %+v", key, e)
		}
	}
	if e := inv.Entries["internal/instancectl/server.go:type Server"]; e.Class != "legacy" || e.Task != "accepted-legacy" {
		t.Fatalf("type Server lost census ruling 292's disposition: %+v", e)
	}
	for _, key := range []string{"apimode.go:apiSession.getJSON", "internal/instancectl/hardening.go:ensureExe"} {
		if !strings.HasPrefix(inv.Removed[key], "H3;census-ruling-carlos-run: ") {
			t.Fatalf("%s lost its census-ruling removal", key)
		}
		if _, present := inv.Entries[key]; present {
			t.Fatalf("%s still classified", key)
		}
	}
	inv.Legacy[strings.Repeat("0", 64)] = true
	if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {
		t.Fatal("unapproved legacy fingerprint accepted")
	}
}

// Census ruling seeded-instances (Plan 14 controller, 2026-10-14). The
// overlay is loaded last, after carlos-run's. This pins what the ruling
// writes: 100 new frozen fingerprints, 115 rows, every basis naming the
// ruling, main's authority rows kept, the ruled classes, nothing removed.
// Three rows are the census ruling 292fix block (Plan 14 controller,
// 2026-10-15), an extension of census ruling 292 for the seeded pre-land
// review's P2: Service.doWake (moved there from the seeded rows) and
// #292's cleanupFailedWake and reapUnprovenWake.
func TestPlan14SeededInstancesOverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv", "plan14-root-reads-zddr3.tsv", "plan14-root-reads-hotfix281.tsv", "plan14-root-reads-zddr4.tsv", "plan14-root-reads-reserved285.tsv", "plan14-root-reads-292.tsv", "plan14-root-reads-census-ruling-275.tsv", "plan14-root-reads-census-ruling-owed.tsv", "plan14-root-reads-carlos-run.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	if errs := checkRootReadLegacy(inv, "96e521e60dfc0b55e2bc08adbb7a7682a607a30599a8cf66e7c5689d6cf7fe5a"); len(errs) != 0 {
		t.Fatal(errs)
	}
	original := make(map[string]bool, len(inv.Legacy))
	for hash := range inv.Legacy {
		original[hash] = true
	}
	before := make(map[string]classifiedRootRead, len(inv.Entries))
	for key, e := range inv.Entries {
		before[key] = e
	}
	removed := len(inv.Removed)
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-seeded-instances.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	for hash := range original {
		if !inv.Legacy[hash] {
			t.Fatalf("seeded-instances removed original freeze %s", hash)
		}
	}
	if len(inv.Legacy) != len(original)+100 {
		t.Fatalf("the seeded-instances overlay adds exactly 100 frozen fingerprints, not %d", len(inv.Legacy)-len(original))
	}
	// Census ruling seeded-instances seal: 96 service-user and CLI rows plus
	// activationGuard and activationRule, accepted legacy (J1) as on main,
	// less doWake, which moved to the 292fix block; and that block's
	// three rows.
	const seal = "10e024eccd584f40b64e959a105c551302585e3e14e55104fc250dae5960898a"
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	proposed := map[string]bool{
		"internal/activator/activator.go:Service.doWake":              true,
		"internal/activator/maintenance.go:Service.cleanupFailedWake": true,
		"internal/activator/opset.go:Service.reapUnprovenWake":        true,
	}
	written := 0
	for key, e := range inv.Entries {
		if e == before[key] {
			continue
		}
		written++
		marker := "census-ruling-seeded-instances"
		if proposed[key] {
			// Main's rows, changed by the pre-land fix: their class is
			// kept, under census ruling 292fix.
			marker = "census-ruling-292fix"
			if before[key].Class != "legacy" {
				t.Fatalf("%s was %s on main; the fix's block keeps only legacy rows", key, before[key].Class)
			}
		}
		if !strings.Contains(e.Basis, "rev3="+marker+";") {
			t.Fatalf("%s does not name %s: %+v", key, marker, e)
		}
		if e.Class == "legacy" && (e.Task != "accepted-legacy" || !strings.HasPrefix(e.Basis, "accepted-legacy;rev3="+marker+";")) {
			t.Fatalf("wrong seeded-instances disposition: %+v", e)
		}
		if strings.Contains(e.Basis, "NEEDS RULING") {
			t.Fatalf("%s still waits for a ruling: %+v", key, e)
		}
	}
	if written != 115 {
		t.Fatalf("the seeded-instances overlay writes 115 rows, not %d", written)
	}
	// Main's authority rows keep their class and family. rootJudgeMovesPrev
	// is the body of main's rootJudgePrev under a new name and carries its
	// family; rootJudgePrev is still declared and reads nothing. The ruled
	// rows: the seeds floor's root readers F,J4, the two deny-only
	// activation inputs G, and Upsert's moved code E3.
	for key, task := range map[string]string{
		"internal/host/agent.go:runAgent":                                "B,C,D,F",
		"internal/host/movespass.go:armPhase1":                           "B2,C",
		"internal/provision/reconcile.go:RouteFor":                       "C,E3",
		"internal/registry/registry.go:Registry.Upsert":                  "E3",
		"internal/host/units/carlos-system-recover.service:external":     "F,J4",
		"internal/host/units/carlos-system-update.service:external":      "F,J4",
		"internal/host/movesfloor.go:rootJudgeMovesPrev":                 "F,J4",
		"internal/host/movesfloor.go:rootJudgePrev":                      "F,J4",
		"internal/host/seedsfloor.go:readLocalSeedsFloor":                "F,J4",
		"internal/host/seedsfloor.go:judgeSeedsPrev":                     "F,J4",
		"internal/host/seedsfloor.go:rootJudgeSeedsPrev":                 "F,J4",
		"internal/hostops/backfill_seeds.go:CollectCensusSeeds":          "G",
		"internal/registry/importjournal.go:Registry.ImportJournalHosts": "G",
		"internal/registry/registry.go:normalizeRoute":                   "E3",
		"internal/registry/registry.go:routeArgs":                        "E3",
	} {
		if e := inv.Entries[key]; e.Class != "authority" || e.Task != task {
			t.Fatalf("%s lost its authority: %+v", key, e)
		}
	}
	for _, key := range []string{"internal/host/systemapply.go:systemApplier.activationGuard", "internal/host/systemapply.go:systemApplier.activationRule"} {
		if e := inv.Entries[key]; e.Class != "legacy" || e.Task != "accepted-legacy" {
			t.Fatalf("%s is not accepted legacy, as on main: %+v", key, e)
		}
	}
	if e := inv.Entries["internal/host/movesfloor.go:rootJudgePrev"]; e.Kinds != "" {
		t.Fatalf("rootJudgePrev is recorded with read sites: %+v", e)
	}
	if len(inv.Removed) != removed {
		t.Fatalf("census ruling seeded-instances removes nothing, not %d declarations", len(inv.Removed)-removed)
	}
	inv.Legacy[strings.Repeat("0", 64)] = true
	if errs := checkRootReadLegacy(inv, seal); len(errs) == 0 {
		t.Fatal("unapproved legacy fingerprint accepted")
	}
}

func TestPlan14SeedOverlayPreservesLegacySeal(t *testing.T) {
	root := censusRoot(t)
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	for i, name := range []string{"plan14-root-reads.tsv", "plan14-root-reads-moves.tsv", "plan14-root-reads-merge.tsv", "plan14-root-reads-fix1.tsv", "plan14-root-reads-fix2.tsv", "plan14-root-reads-merge3.tsv", "plan14-root-reads-fix4.tsv", "plan14-root-reads-fix5.tsv", "plan14-root-reads-fix6.tsv", "plan14-root-reads-zddr3.tsv", "plan14-root-reads-hotfix281.tsv", "plan14-root-reads-zddr4.tsv", "plan14-root-reads-reserved285.tsv", "plan14-root-reads-292.tsv", "plan14-root-reads-census-ruling-275.tsv", "plan14-root-reads-census-ruling-owed.tsv", "plan14-root-reads-carlos-run.tsv", "plan14-root-reads-seeded-instances.tsv", "plan14-root-reads-hostfiles-cap-236.tsv", "plan14-root-reads-moves-overcap-cut-236.tsv"} {
		if err := loadRootReadInventory(root+"/internal/provision/testdata/"+name, &inv, i > 0); err != nil {
			t.Fatal(err)
		}
	}
	const seal = "fc38db001ebd8825709a8ca9c41cc0e8f165c1b1967e5967347dc9bd3556afec"
	if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {
		t.Fatal(errs)
	}
	before := len(inv.Legacy)
	if err := loadRootReadInventory(root+"/internal/provision/testdata/plan14-root-reads-seed.tsv", &inv, true); err != nil {
		t.Fatal(err)
	}
	if len(inv.Legacy) != before+7 {
		t.Fatal("FS-R6, FS-R10 and FS-R11 preserve exactly seven additional legacy fingerprints")
	}
	if errs := checkRootReadLegacy(inv, "624e96c0f0fd397d09575e807f7347f86cbcb109b4b713eb8369f0b64622e483"); len(errs) != 0 {
		t.Fatal(errs)
	}
	for _, key := range []string{"internal/activator/servingretry.go:ServingRetries.Wrap", "internal/activator/servingretry.go:ServingRetries.settle", "internal/park/local.go:Local.RetireSuperseded"} {
		if e := inv.Entries[key]; e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.Contains(e.Basis, "census-ruling-FS-R11") {
			t.Fatalf("own-CAS threading changed legacy authority %s: %+v", key, e)
		}
	}
	// FS-R6 keeps these existing legacy classes; the seed cannot promote them.
	for _, key := range []string{"internal/activator/activator.go:Service.sweepOnce", "internal/activator/servingretry.go:ServingRetries.Wrap", "internal/host/relocationflush.go:ReleaseFlushFiles.Flush"} {
		if e := inv.Entries[key]; e.Class != "legacy" || e.Task != "accepted-legacy" || !strings.Contains(e.Basis, "census-ruling-FS-R6") {
			t.Fatalf("unruled legacy disposition %s: %+v", key, e)
		}
	}
	if e := inv.Entries["internal/lease/leasetest/s3server.go:NewS3Server"]; e.Class != "legacy" || !strings.Contains(e.Basis, "census-ruling-FS-R10") {
		t.Fatal("test S3 fixture lost its legacy ruling", e)
	}
	if e := inv.Entries["internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build"]; e.Task != "C,G,J1,J4" {
		t.Fatal("wake assembly lost its owners", e.Task)
	}
	for _, key := range []string{
		"internal/host/claimconstruction.go:OpenProductionClaimAssembly",
		"internal/host/claimproduction.go:ProductionClaimOwnerProvider.OpenClaimOwners",
		"internal/host/claimowners.go:checkClaimServingSources",
		"internal/host/claimowners.go:claimServingOwners.serving",
		"internal/host/claimwakeassembly.go:ClaimWakeAssembly.Build",
		"internal/hostbox/restore.go:ColdRestore.Install",
		"internal/hostbox/restore.go:ColdRestore.InstallEmpty",
		"internal/hostguard/writerstop.go:Guard.CompletedServingStops",
	} {
		e, ok := inv.Entries[key]
		if !ok || e.Class != "authority" || !strings.HasPrefix(e.Basis, "rev3=PROPOSED-seed;") || !rootReadKeptTask(e.Task) {
			t.Fatalf("unproposed or unowned seed authority %s: %+v", key, e)
		}
	}
}