package registry

import (
	"database/sql"
	"errors"
	"path/filepath"
	"regexp"
	"strings"
	"sync"
	"testing"
)

// Distinct, realistic-shape (64 lowercase hex) token hashes for tests —
// AddFleetBox/SetFleetBoxToken now reject anything else.
var (
	tokenHashA = strings.Repeat("a", 64)
	tokenHashB = strings.Repeat("b", 64)
	tokenHashC = strings.Repeat("c", 64)
)

// TestFleetRoundTrips pins UpsertFleet/GetFleet/ListFleets against the exact
// shape later tasks depend on (task-1-brief.md's Fleet struct).
func TestFleetRoundTrips(t *testing.T) {
	reg := openTestRegistry(t)
	want := Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data", CreatedAt: 1700000000}
	if err := reg.UpsertFleet(want); err != nil {
		t.Fatal(err)
	}
	got, err := reg.GetFleet("acme")
	if err != nil {
		t.Fatal(err)
	}
	if got == nil {
		t.Fatal("GetFleet returned nil for an upserted fleet")
	}
	if *got != want {
		t.Fatalf("round trip mismatch:\n got  %+v\n want %+v", *got, want)
	}
	list, err := reg.ListFleets()
	if err != nil {
		t.Fatal(err)
	}
	if len(list) != 1 || list[0] != want {
		t.Fatalf("ListFleets = %+v, want [%+v]", list, want)
	}
}

func TestGetFleetMissingIsNilNil(t *testing.T) {
	reg := openTestRegistry(t)
	got, err := reg.GetFleet("nope")
	if err != nil || got != nil {
		t.Fatalf("GetFleet(missing) = %v, %v; want nil, nil", got, err)
	}
}

// TestCreateFleetInsertOnly: the ordinary sequential case — first create
// wins, a second with the same name is refused without touching the
// existing row.
func TestCreateFleetInsertOnly(t *testing.T) {
	reg := openTestRegistry(t)
	created, err := reg.CreateFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"})
	if err != nil || !created {
		t.Fatalf("first CreateFleet: created=%v err=%v, want true, nil", created, err)
	}
	created, err = reg.CreateFleet(Fleet{Name: "acme", Account: "intruder", Bucket: "stolen"})
	if err != nil || created {
		t.Fatalf("second CreateFleet (same name): created=%v err=%v, want false, nil", created, err)
	}
	got, err := reg.GetFleet("acme")
	if err != nil || got == nil || got.Account != "amadan" || got.Bucket != "acme-data" {
		t.Fatalf("GetFleet after a refused create = %+v, %v, want the FIRST caller's row untouched", got, err)
	}
}

// TestCreateFleetRaceInsertOnly is the property the console's
// handleAPIFleetNew now depends on entirely (no more read-then-write): two
// callers racing the SAME never-before-seen name — from two DIFFERENT
// accounts — must never both win, and the row that survives must belong to
// whichever one did. This is what makes UpsertFleet's ON CONFLICT DO UPDATE
// (which CreateFleet deliberately does not use) unreachable from a genuine
// race here.
func TestCreateFleetRaceInsertOnly(t *testing.T) {
	reg := openTestRegistry(t)
	var wg sync.WaitGroup
	created := make([]bool, 2)
	errs := make([]error, 2)
	accounts := []string{"aaaa", "bbbb"}
	wg.Add(2)
	for i := 0; i < 2; i++ {
		go func(i int) {
			defer wg.Done()
			created[i], errs[i] = reg.CreateFleet(Fleet{Name: "acme", Account: accounts[i], Bucket: accounts[i] + "-data"})
		}(i)
	}
	wg.Wait()

	for i, err := range errs {
		if err != nil {
			t.Fatalf("CreateFleet[%d]: %v", i, err)
		}
	}
	if created[0] == created[1] {
		t.Fatalf("created = %v, %v — want exactly one true", created[0], created[1])
	}
	winner := accounts[0]
	if created[1] {
		winner = accounts[1]
	}
	got, err := reg.GetFleet("acme")
	if err != nil || got == nil {
		t.Fatalf("GetFleet after the race: %+v, %v", got, err)
	}
	if got.Account != winner {
		t.Fatalf("surviving row account = %q, want the winner's %q", got.Account, winner)
	}
}

// TestFleetBoxRoundTrips pins AddFleetBox/ListFleetBoxes against the exact
// FleetBox shape later tasks depend on.
func TestFleetBoxRoundTrips(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	want := FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "active", AddedAt: 1700000001}
	if err := reg.AddFleetBox(want); err != nil {
		t.Fatal(err)
	}
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	if len(boxes) != 1 || boxes[0] != want {
		t.Fatalf("ListFleetBoxes = %+v, want [%+v]", boxes, want)
	}
}

// TestAddFleetBoxRejectsUnknownFleet: no FK, so this is the only rail
// against an orphan box — one authenticating a channel for a fleet with no
// account/bucket record at all.
func TestAddFleetBoxRejectsUnknownFleet(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.AddFleetBox(FleetBox{Fleet: "ghost", Label: "pi-1", TokenHash: tokenHashA, Status: "active"}); err == nil {
		t.Fatal("AddFleetBox against a never-upserted fleet: got nil error, want one")
	}
}

// TestAddFleetBoxRejectsDuplicateActive is the brief's core invariant: two
// boxes cannot hold the same (fleet, label) channel identity while both are
// active.
func TestAddFleetBoxRejectsDuplicateActive(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	box := FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "active"}
	if err := reg.AddFleetBox(box); err != nil {
		t.Fatal(err)
	}
	err := reg.AddFleetBox(box)
	if err == nil {
		t.Fatal("AddFleetBox on a duplicate active (fleet,label): got nil error, want one")
	}
	// Distinguishable from any other failure via errors.Is, not string
	// matching — the property console/fleets.go's handler now relies on to
	// tell an ordinary conflict apart from a genuine infrastructure error.
	if !errors.Is(err, ErrFleetBoxActive) {
		t.Fatalf("AddFleetBox on a duplicate active: err = %v, want it to wrap ErrFleetBoxActive", err)
	}
}

// TestAddFleetBoxReactivatesADetachedLabel: the brief only forbids a
// duplicate ACTIVE box, implying a detached label can be re-added — the path
// a re-provisioned box takes.
func TestAddFleetBoxReactivatesADetachedLabel(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	box := FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "active"}
	if err := reg.AddFleetBox(box); err != nil {
		t.Fatal(err)
	}
	if err := reg.SetFleetBoxStatus("acme", "pi-1", "detached"); err != nil {
		t.Fatal(err)
	}
	reAdd := FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashB, Status: "active"}
	if err := reg.AddFleetBox(reAdd); err != nil {
		t.Fatalf("AddFleetBox over a detached label: %v", err)
	}
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	if len(boxes) != 1 || boxes[0].TokenHash != tokenHashB || boxes[0].Status != "active" {
		t.Fatalf("re-add over a detached label = %+v, want reactivated with the new token", boxes)
	}
}

// TestFleetChannelAuthOmitsDetachedBoxes pins the exact contract later tasks
// rely on: channel name "<fleet>/<label>" -> TokenHash, ACTIVE boxes only.
func TestFleetChannelAuthOmitsDetachedBoxes(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "active"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "pi-2", TokenHash: tokenHashB, Status: "active"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.SetFleetBoxStatus("acme", "pi-2", "detached"); err != nil {
		t.Fatal(err)
	}
	auth, err := reg.FleetChannelAuth()
	if err != nil {
		t.Fatal(err)
	}
	if _, ok := auth["acme/pi-2"]; ok {
		t.Fatalf("FleetChannelAuth included a detached box: %+v", auth)
	}
	if got, ok := auth["acme/pi-1"]; !ok || got != tokenHashA {
		t.Fatalf("FleetChannelAuth missing/wrong entry for the active box: %+v", auth)
	}
}

func TestSetFleetBoxTokenMissingRowErrors(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.SetFleetBoxToken("acme", "nope", tokenHashA); err == nil {
		t.Fatal("SetFleetBoxToken on a missing row: got nil error, want one")
	}
}

func TestSetFleetBoxStatusMissingRowErrors(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.SetFleetBoxStatus("acme", "nope", "detached"); err == nil {
		t.Fatal("SetFleetBoxStatus on a missing row: got nil error, want one")
	}
}

// TestFleetWritersRejectInvalidNames: every writer validates fleet/label
// names with ValidTunnelName before touching the DB.
func TestFleetWritersRejectInvalidNames(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "UPPER"}); err == nil {
		t.Fatal("UpsertFleet({Name:UPPER}): got nil error, want one")
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "UPPER", Label: "pi-1", TokenHash: tokenHashA}); err == nil {
		t.Fatal("AddFleetBox with an invalid fleet name: got nil error, want one")
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "UPPER", TokenHash: tokenHashA}); err == nil {
		t.Fatal("AddFleetBox with an invalid label: got nil error, want one")
	}
	if err := reg.SetFleetBoxToken("UPPER", "pi-1", tokenHashA); err == nil {
		t.Fatal("SetFleetBoxToken with an invalid fleet name: got nil error, want one")
	}
	if err := reg.SetFleetBoxStatus("acme", "UPPER", "detached"); err == nil {
		t.Fatal("SetFleetBoxStatus with an invalid label: got nil error, want one")
	}
}

// TestFleetBoxWritersRejectInvalidStatus: AddFleetBox and SetFleetBoxStatus
// both reject a status outside {"active","detached"} — a typo'd status
// would otherwise make a live box invisible to AddFleetBox's uniqueness
// guard, which keys off status = 'active'.
func TestFleetBoxWritersRejectInvalidStatus(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "enabled"}); err == nil {
		t.Fatal("AddFleetBox with status \"enabled\": got nil error, want one")
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "active"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.SetFleetBoxStatus("acme", "pi-1", "enabled"); err == nil {
		t.Fatal("SetFleetBoxStatus(\"enabled\"): got nil error, want one")
	}
}

// TestFleetBoxWritersRejectInvalidTokenHash: AddFleetBox and
// SetFleetBoxToken both require exactly 64 lowercase hex characters —
// structurally enforcing "hashes only, never plaintext".
func TestFleetBoxWritersRejectInvalidTokenHash(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	for _, bad := range []string{"", "not-a-hash", strings.Repeat("a", 63), strings.Repeat("A", 64)} {
		if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: bad, Status: "active"}); err == nil {
			t.Fatalf("AddFleetBox with token hash %q: got nil error, want one", bad)
		}
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "active"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.SetFleetBoxToken("acme", "pi-1", "plaintext-token"); err == nil {
		t.Fatal("SetFleetBoxToken with a plaintext-shaped value: got nil error, want one")
	}
}

// TestFingerprintChangesOnFleetMutation: Fingerprint must fold the fleets
// table into its aggregate — mutating a FLEET row (not a route) must still
// change it, which is what lets the edge notice a fleet change later.
func TestFingerprintChangesOnFleetMutation(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	before, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan-longer-name", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	after, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if before == after {
		t.Fatalf("fingerprint unchanged across a fleet mutation: %q", after)
	}
}

// TestFingerprintChangesOnFleetBoxMutation: same guarantee for fleet_boxes —
// a box status flip must change the fingerprint too (SetFleetBoxStatus is
// exactly how a detach reaches the edge in later tasks).
func TestFingerprintChangesOnFleetBoxMutation(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "active"}); err != nil {
		t.Fatal(err)
	}
	before, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if err := reg.SetFleetBoxStatus("acme", "pi-1", "detached"); err != nil {
		t.Fatal(err)
	}
	after, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if before == after {
		t.Fatalf("fingerprint unchanged across a fleet_boxes status flip: %q", after)
	}
}

// TestFingerprintChangesOnTokenRotation is the Critical-1 regression pin: a
// sha256 hex token_hash is ALWAYS 64 characters, so a rotation between two
// same-length, different-content hashes changes no LENGTH, no COUNT, no
// MAX(rowid) — only the rev column moves. Without rev folded into
// Fingerprint, this rotation would be invisible to the edge's poll and a
// revoked token would keep authenticating.
func TestFingerprintChangesOnTokenRotation(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.UpsertFleet(Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.AddFleetBox(FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: tokenHashA, Status: "active"}); err != nil {
		t.Fatal(err)
	}
	if len(tokenHashA) != len(tokenHashC) {
		t.Fatalf("test fixture bug: rotation hashes must be equal length, got %d and %d", len(tokenHashA), len(tokenHashC))
	}
	before, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if err := reg.SetFleetBoxToken("acme", "pi-1", tokenHashC); err != nil {
		t.Fatal(err)
	}
	after, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if before == after {
		t.Fatalf("fingerprint unchanged across a same-length token rotation: %q", after)
	}
}

// TestFingerprintChangesOnFleetBoxRestamp is the Task 10 regression pin —
// the defect the two-box e2e (internal/edge/fleet_e2e_test.go) surfaced. A
// failover restamps routes.fleet_box (ReconcileFleetBindings -> SetFleetBox)
// between two labels of the SAME length, which is the common case for fleet
// box labels ("box-a"/"box-b", "pi-1"/"pi-2"). Before the fleet-placement
// projection was added to Fingerprint, that write changed nothing the
// aggregate looked at — fleet_box is not in the routes weighted sum at all —
// so the edge never reloaded, kept the dead box's label captured in its
// fleet proxy, and dispatched straight back to it the moment it re-dialed.
// Unlike an operator's route edit, a restamp is unattended: there is nobody
// there to SIGHUP.
func TestFingerprintChangesOnFleetBoxRestamp(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.Upsert(Route{Host: "app.example", Kind: "instance", Region: PlacementTarget("pi"), FleetBox: "box-a"}); err != nil {
		t.Fatal(err)
	}
	before, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if err := reg.SetFleetBox("app.example", "box-b"); err != nil {
		t.Fatal(err)
	}
	after, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if before == after {
		t.Fatalf("fingerprint unchanged across a same-length fleet_box restamp: %q — the edge would keep routing to the box that died", after)
	}
}

// TestFingerprintChangesOnPlacement: the same projection covers the OTHER
// column fleet dispatch reads — Region. Placing an existing route on a fleet
// (`carlos apps -place`, a different PROCESS from the edge, so the
// fingerprint poll is the only path in) must be visible too.
func TestFingerprintChangesOnPlacement(t *testing.T) {
	reg := openTestRegistry(t)
	if err := reg.Upsert(Route{Host: "app.example", Kind: "instance"}); err != nil {
		t.Fatal(err)
	}
	before, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if err := reg.SetPlacement("app.example", PlacementTarget("pi")); err != nil {
		t.Fatal(err)
	}
	mid, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if before == mid {
		t.Fatalf("fingerprint unchanged when a route was placed on a fleet: %q", mid)
	}
	// ...and clearing it again is equally visible (the row drops out of the
	// projection rather than lingering as a stale entry).
	if err := reg.SetPlacement("app.example", ""); err != nil {
		t.Fatal(err)
	}
	after, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if after == mid {
		t.Fatalf("fingerprint unchanged when a route left fleet placement: %q", after)
	}
}

// A registry with no fleet-placed routes at all — every deployment in the
// fleet today — must produce a STABLE fingerprint across repeated polls: the
// projection is a GROUP_CONCAT, and one that flapped (or that grew with
// unrelated routes) would make the edge reload every 2s forever.
func TestFingerprintStableWithoutFleetRoutes(t *testing.T) {
	reg := openTestRegistry(t)
	for _, h := range []string{"one.example", "two.example", "three.example"} {
		if err := reg.Upsert(Route{Host: h, Kind: "service", Addr: "127.0.0.1:1", Region: "eu"}); err != nil {
			t.Fatal(err)
		}
	}
	first, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	for i := 0; i < 5; i++ {
		again, err := reg.Fingerprint()
		if err != nil {
			t.Fatal(err)
		}
		if again != first {
			t.Fatalf("fingerprint flapped with no writes at all: %q then %q", first, again)
		}
	}
	// The boundedness claim itself, pinned. This assertion used to read
	// "the placement projection is empty, hence a trailing ':'", because the
	// fingerprint was a concatenation whose last component was a
	// GROUP_CONCAT of fleet-placed rows — a WHERE clause that ever widened
	// would have put hostnames' worth of text through a 2s poll. The merge
	// with main replaced that concatenation with a sha256 over every
	// reload-relevant column (registry.go's Fingerprint), which closes the
	// same hole structurally rather than by scoping: the result is
	// "<route count>:<64 hex>" no matter how many routes are fleet-placed,
	// so no projection can grow and the poll's payload is fixed-size
	// forever. That is what is pinned here now.
	if !fingerprintShape.MatchString(first) {
		t.Fatalf("fingerprint = %q, want the fixed-size %q shape — a poll payload that grows with the route table is the thing this test exists to catch", first, fingerprintShape)
	}
}

// fingerprintShape is Fingerprint's whole contract as a string: a route
// count, a colon, and a sha256 in hex. Nothing about it varies with how many
// routes, fleets or fleet boxes the registry holds.
var fingerprintShape = regexp.MustCompile(`^[0-9]+:[0-9a-f]{64}$`)

// The other half of the stability question, and the one that actually
// exercises the concat: with fleet-placed routes present the projection is
// non-empty and built by GROUP_CONCAT over an ORDER BY subquery. If that
// order were not stable across identical polls, the edge would see a
// "changed" fingerprint every 2 seconds and reload forever — on every box
// running a fleet, permanently. Mixed FleetBox values (one stamped, one
// stamped differently, one placed but unstamped) so a reordering has
// something to reorder.
func TestFingerprintStableWithFleetRoutes(t *testing.T) {
	reg := openTestRegistry(t)
	for _, rt := range []Route{
		{Host: "one.example", Kind: "instance", Region: PlacementTarget("pi"), FleetBox: "box-a"},
		{Host: "two.example", Kind: "instance", Region: PlacementTarget("pi"), FleetBox: "box-b"},
		{Host: "three.example", Kind: "instance", Region: PlacementTarget("eleven"), FleetBox: ""},
		{Host: "four.example", Kind: "service", Addr: "127.0.0.1:1"}, // not fleet-placed
	} {
		if err := reg.Upsert(rt); err != nil {
			t.Fatal(err)
		}
	}
	first, err := reg.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if strings.HasSuffix(first, ":") {
		t.Fatalf("fingerprint = %q, want a NON-empty final component — with three fleet-placed routes the projection this test exists to exercise is empty, so the stability loop below proves nothing", first)
	}
	for i := 0; i < 5; i++ {
		again, err := reg.Fingerprint()
		if err != nil {
			t.Fatal(err)
		}
		if again != first {
			t.Fatalf("fingerprint flapped across identical polls with fleet routes present: %q then %q — every edge running a fleet would reload every 2s forever", first, again)
		}
	}
}

// TestFleetPlacement pins the "fleet/<name>" grammar Route.Region carries
// when a route is bound to a customer fleet: the prefix alone is not enough,
// the name half must also pass ValidTunnelName, and a bare region code (a
// FUTURE placement form this v1 does not parse) must answer false rather
// than partially matching.
func TestFleetPlacement(t *testing.T) {
	cases := []struct {
		region    string
		wantFleet string
		wantOK    bool
	}{
		{"fleet/pi", "pi", true},
		{"", "", false},
		{"eu", "", false},
		{"fleet/UPPER", "", false},
		{"fleet/", "", false},
		{"fleet", "", false},
	}
	for _, c := range cases {
		fleet, ok := FleetPlacement(c.region)
		if fleet != c.wantFleet || ok != c.wantOK {
			t.Errorf("FleetPlacement(%q) = (%q, %v), want (%q, %v)", c.region, fleet, ok, c.wantFleet, c.wantOK)
		}
	}
}

// TestPlacementTarget pins the inverse rendering FleetPlacement parses back.
func TestPlacementTarget(t *testing.T) {
	if got := PlacementTarget("pi"); got != "fleet/pi" {
		t.Errorf("PlacementTarget(%q) = %q, want %q", "pi", got, "fleet/pi")
	}
	fleet, ok := FleetPlacement(PlacementTarget("pi-box"))
	if !ok || fleet != "pi-box" {
		t.Fatalf("FleetPlacement(PlacementTarget(%q)) = (%q, %v), want (%q, true)", "pi-box", fleet, ok, "pi-box")
	}
}

// mustCreateFleet is a tiny helper for tests that don't care about anything
// beyond fixed test values for account/bucket.
func mustCreateFleet(t *testing.T, r *Registry, fleet, account, bucket string) {
	t.Helper()
	if _, err := r.CreateFleet(Fleet{Name: fleet, Account: account, Bucket: bucket}); err != nil {
		t.Fatalf("CreateFleet(%q): %v", fleet, err)
	}
}

// mustAddBox is a tiny helper for tests that don't care about anything
// beyond a fixed test token hash and an "active" status.
func mustAddBox(t *testing.T, r *Registry, fleet, label string) {
	t.Helper()
	if err := r.AddFleetBox(FleetBox{Fleet: fleet, Label: label, TokenHash: tokenHashA, Status: "active"}); err != nil {
		t.Fatalf("AddFleetBox(%q, %q): %v", fleet, label, err)
	}
}

// TestFleetBoxTags pins ValidBoxTags's grammar and SetFleetBoxTags's
// round-trip through ListFleetBoxes, including the invalid-grammar and
// unknown-box refusals and clearing back to "".
func TestFleetBoxTags(t *testing.T) {
	r := openTestRegistry(t)
	mustCreateFleet(t, r, "pi", "acct1", "bkt")
	mustAddBox(t, r, "pi", "box-a")
	// grammar
	for _, bad := range []string{"Office", "a b", "-lead", "toolongtoolongtoolongtoolo", "a,,b",
		"a,b,c,d,e,f,g,h,i"} {
		if ValidBoxTags(bad) {
			t.Errorf("ValidBoxTags(%q) = true, want false", bad)
		}
	}
	for _, good := range []string{"", "office", "office,free", "a-1"} {
		if !ValidBoxTags(good) {
			t.Errorf("ValidBoxTags(%q) = false, want true", good)
		}
	}
	if err := r.SetFleetBoxTags("pi", "box-a", "Office"); err == nil {
		t.Fatal("invalid grammar accepted")
	}
	if err := r.SetFleetBoxTags("pi", "nope", "office"); err == nil {
		t.Fatal("unknown box accepted")
	}
	if err := r.SetFleetBoxTags("pi", "box-a", "office,free"); err != nil {
		t.Fatal(err)
	}
	boxes, err := r.ListFleetBoxes("pi")
	if err != nil || len(boxes) != 1 || boxes[0].Tags != "office,free" {
		t.Fatalf("tags round-trip: %+v err=%v", boxes, err)
	}
	// clearing
	if err := r.SetFleetBoxTags("pi", "box-a", ""); err != nil {
		t.Fatal(err)
	}
}

// TestFleetBoxTagsFingerprintMoves mirrors
// TestFingerprintChangesOnTokenRotation for tags: a tags write must move
// Fingerprint the same way a token rotation does, or the edge would never
// notice a tag change land.
func TestFleetBoxTagsFingerprintMoves(t *testing.T) {
	r := openTestRegistry(t)
	mustCreateFleet(t, r, "pi", "acct1", "bkt")
	mustAddBox(t, r, "pi", "box-a")
	before, err := r.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if err := r.SetFleetBoxTags("pi", "box-a", "office"); err != nil {
		t.Fatal(err)
	}
	after, err := r.Fingerprint()
	if err != nil {
		t.Fatal(err)
	}
	if before == after {
		t.Fatalf("fingerprint unchanged across a fleet_boxes tags write: %q", after)
	}
}

// TestFleetBoxesPreTagsRowsParse mirrors TestFleetBoxMigratesFromPreChangeDB
// (registry_test.go): a fleet_boxes row written before the tags column
// existed is simulated by creating the table without it and inserting a raw
// row, then Open() (which runs migrateFleets) must still open the file and
// ListFleetBoxes must read the row back with Tags == "".
func TestFleetBoxesPreTagsRowsParse(t *testing.T) {
	path := filepath.Join(t.TempDir(), "registry.db")
	db, err := sql.Open("sqlite", path)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := db.Exec(`
CREATE TABLE fleet_boxes (
  fleet      TEXT NOT NULL,
  label      TEXT NOT NULL,
  token_hash TEXT NOT NULL,
  status     TEXT NOT NULL,
  added_at   INTEGER NOT NULL,
  rev        INTEGER NOT NULL DEFAULT 0,
  PRIMARY KEY (fleet, label)
);`); err != nil {
		t.Fatal(err)
	}
	if _, err := db.Exec(`INSERT INTO fleet_boxes (fleet, label, token_hash, status, added_at) VALUES (?, ?, ?, ?, ?)`,
		"pi", "box-a", tokenHashA, "active", 1700000000); err != nil {
		t.Fatal(err)
	}
	if err := db.Close(); err != nil {
		t.Fatal(err)
	}

	r, err := Open(path)
	if err != nil {
		t.Fatalf("Open over a pre-tags DB: %v", err)
	}
	defer r.Close()
	boxes, err := r.ListFleetBoxes("pi")
	if err != nil {
		t.Fatal(err)
	}
	if len(boxes) != 1 || boxes[0].Tags != "" {
		t.Fatalf("pre-tags row should default tags=\"\": %+v", boxes)
	}
}