package engines

import (
	"fmt"
	"math/rand"
	"sort"
)

// The model of the fleet-internal engines (spec
// docs/superpowers/specs/2026-10-21-fleet-internal-engines-design.md). One
// tick is 10 s: a step is a tick. Everything is decided from one seeded
// source; nothing reads the clock, starts a goroutine or lets a map's
// iteration order choose.

const (
	chaosSteps = 400 // faults and every action are eligible
	calmSteps  = 200 // the same walk, then the final oracle
	nBuilds    = 4
)

// The starting world's names.
const (
	eng          = "eng" // the engine group (its owner's host; engine names have no dot)
	engHost      = "eng.acct.apps.example"
	engAlias     = "docs.example" // alias row on box 0, to engHost
	engSite      = "www.example"  // static row on box 0, path map to engHost
	engSitePath  = "/convert"
	shopAlias    = "shop-alias.example" // alias row on box 1, to shop
	shopSite     = "shop-www.example"   // static row on box 1, path map to shop
	shopSitePath = "/app"
)

// build is a platform build: whether it declares the internal-engine
// protocol, and whether the manifest it writes is in place.
type build struct {
	Ver                  int
	Declares, ManifestOK bool
}

// proc is a running process. Slice is the cgroup the peer check reads:
// inst:<group>, exec:<host> or unit:<host>.
//
// Code is the account/app whose code the process runs when that is not its
// group's: code a flat-era tamper planted in the group's instance directory
// (Task 5). Residual names the stated residual the process belongs to, if
// any; a breach it causes is recorded as that residual, not a violation.
type proc struct {
	ID                  int
	Group               string
	Ver                 int
	Slice               string
	Unisolated, OwnPort bool
	Code, Residual      string
}

// row is a host row of a box's table. Kind is instance, service, static or
// alias; Backend is a socket path or an address, "" for static and alias.
// An alias row names its target host in Alias and copies its upstream
// (edge.go:929); PathTo maps a path to the host that serves it (edge.go:1364).
//
// A platform-minted row (Platform) names in Source the host it was minted
// from: the truth the oracle reads. Owner is what the registry has recorded
// (routes.owner), "" for a row minted before owners were recorded; the edge
// then finds the owner by App and backend (spec §5.1, "Platform-minted
// rows"). App is the row's account/app. GrantAt is the registry change that
// recorded the doc-engine grant.
type row struct {
	Host, Kind, Owner, Backend string
	Platform, Grant            bool
	PathTo                     map[string]string
	Alias                      string
	App, Source                string
	GrantAt                    int
}

// mark is a row's exposure mark.
type mark int

const (
	markNull mark = iota
	markPublic
	markInternal
)

func (m mark) String() string {
	switch m {
	case markPublic:
		return "public"
	case markInternal:
		return "internal"
	}
	return "null"
}

// caller names who a request is on behalf of.
type caller struct{ Account, App, Engine string }

// req is a request the box admitted. Row is the row whose mark admitted it;
// Backend the proxy it holds from then on; Reached the process it was
// delivered to (0 for none).
type req struct {
	ID, Epoch    int
	Row, Backend string
	Public       bool
	Caller       *caller
	Held         bool
	Box, Reached int
}

// box is one host of the fleet: box 0 is the engine's home, box 1 a calling
// box.
//
// Rows and Mark are the registry (the intent). EdgeRows and Serving are the
// edge's in-memory map, swapped in only by a successful reload. Wrote counts
// registry mark changes, Fenced is the change the edge has fenced, SetAt the
// change that last closed a group (its fence generation; a group with no key
// has never been fenced closed, spec §5.1, "Setting the mark").
type box struct {
	ID                   int
	Rows                 map[string]*row
	Mark                 map[string]mark
	Wrote, Fenced, Epoch int
	ReloadFails, Armed   bool
	Locked               map[string]bool // the group's lock, held by --public for its whole run
	Live, Good           map[string]int
	Staged               map[string][]int
	Procs                []*proc
	Admitted             []*req

	EdgeRows map[string]row
	Serving  map[string]mark
	SetAt    map[string]int

	// PortGrant is the operator's ports grant by group (the port); Listen the
	// ListenStream sockets the capability pass has rendered, port to group
	// (spec §5.1, "The edge is the only ingress").
	PortGrant, Listen map[string]string

	// Task 5 (calls_test.go). Mirror is the edge's grant mirror (spec §5.3).
	// Armed is `carlos engines arm`; Sockets is whether the edge's listener
	// manager has the engine sockets open (§5.4, §6.2). Unisolated is every
	// route on the box whose tenant code runs outside an instance slice, by
	// kind (flat, foreign, worker). Tampered is a nested group's instance
	// directory written by an unisolated tenant: the planter's app.
	//
	// ReadRev is the oracle's, not the protocol's: the highest revision the
	// box's mirror has read since it was last rebuilt (a restart keeps it), so
	// INV-G can hold a revoke the box has read in force (§6.4).
	Mirror     mirror
	Sockets    bool
	Unisolated map[string]bool
	Tampered   map[string]string
	ReadRev    int
}

type world struct {
	seed       int64
	rng        *rand.Rand
	boxes      []*box
	builds     map[int]build
	step       int
	trace      []string
	violations []string
	residuals  []string
	stats      map[string]int // actions selected, by name
	done       map[string]int // actions whose transition completed, by name
	events     map[string]int // deliveries: public requests and engine calls that reached a process
	nextID     int            // process and request ids

	// clearHook, when set, runs inside operatorPublic at each stage
	// ("locked": step 1 passed; "stopped": step 2 done; "confirmed": step 3
	// passed, before the write of 0), so a scenario or the walk can
	// interleave there.
	clearHook func(b *box, g, stage string)
	// clearStopMisses, when set, makes operatorPublic's stop leave one
	// process of the group behind (a unit or generation whose stop the
	// activator or control service failed to complete).
	clearStopMisses bool

	// Task 5 (calls_test.go): the console's engines record and the bucket
	// that carries it; skew is time that passed without a step (a
	// fast-forward), so now() is step+skew.
	console engConsole
	skew    int

	// The spec's two stated residuals. Off by default and set only by tests:
	// with one on, the walk may generate its sequence, and the breach it
	// causes is recorded in residuals as residual:<name>, never in
	// violations. (A fresh box's replay was a third until ruling R5 bounded
	// it by the freshness bound; INV-G now covers it.)
	unwrittenManifestAcrossUpgrade, flatEraTamper bool

	verbose bool
}

// action is one thing the random walk can do. Tasks 2 to 5 append theirs
// from their own files' init; the walk picks among them by weight.
//
// run reports whether the transition completed: false when the action found
// nothing to act on (no group, no held request, a full table) and returned
// without calling into the model. A refusal by the protocol is a completed
// transition. The walk counts selections (stats) and completions (done)
// apart, so coverage can be checked on what really ran.
type action struct {
	name   string
	weight int
	run    func(*world) bool
}

var actions []action

// stepHooks run at the start of every step, before its action: what happens
// on a timer whatever the walk chooses (Task 5: the mirror's poll).
var stepHooks []func(*world)

func newWorld(seed int64, verbose bool) *world {
	w := &world{
		seed:    seed,
		rng:     rand.New(rand.NewSource(seed)),
		builds:  map[int]build{},
		stats:   map[string]int{},
		done:    map[string]int{},
		events:  map[string]int{},
		verbose: verbose,
	}
	newBox := func(id int) *box {
		return &box{ID: id, Rows: map[string]*row{}, Mark: map[string]mark{}, Live: map[string]int{}, Good: map[string]int{}, Staged: map[string][]int{},
			EdgeRows: map[string]row{}, Serving: map[string]mark{}, SetAt: map[string]int{},
			PortGrant: map[string]string{}, Listen: map[string]string{}, Locked: map[string]bool{},
			Unisolated: map[string]bool{}, Tampered: map[string]string{}}
	}
	home, calling := newBox(0), newBox(1)
	w.boxes = []*box{home, calling}

	// one engine group, eng: its own route and its minted platform row
	home.Rows[eng] = &row{Host: eng, Kind: "instance", App: "acct/eng", Backend: "/run/carlos/eng.sock", PathTo: map[string]string{}}
	home.Rows[engHost] = &row{Host: engHost, Kind: "instance", App: "acct/eng", Owner: eng, Source: eng, Backend: "/run/carlos/eng.sock", Platform: true, PathTo: map[string]string{}}
	home.Mark[eng], home.Mark[engHost] = markInternal, markInternal
	home.SetAt[eng] = 0 // closed from the start, and loaded below
	// one public app group, shop, on the calling box
	calling.Rows["shop"] = &row{Host: "shop", Kind: "instance", App: "acct/shop", Backend: "127.0.0.1:9001", PathTo: map[string]string{}}
	calling.Mark["shop"] = markPublic
	// on each box an alias row and a static row with a path map, both
	// resolving to the box's group: rows of kinds that serve no release, 0
	// by construction (spec §5.1, "What the edge does with it")
	for _, x := range []struct {
		b                     *box
		alias, site, path, to string
	}{{home, engAlias, engSite, engSitePath, engHost}, {calling, shopAlias, shopSite, shopSitePath, "shop"}} {
		x.b.Rows[x.alias] = &row{Host: x.alias, Kind: "alias", Alias: x.to, PathTo: map[string]string{}}
		x.b.Rows[x.site] = &row{Host: x.site, Kind: "static", PathTo: map[string]string{x.path: x.to}}
		x.b.Mark[x.alias], x.b.Mark[x.site] = markPublic, markPublic
	}
	// the edges start with the registry loaded
	for _, b := range w.boxes {
		b.loadEdge()
	}
	w.initEngines() // the console's first record, read by every edge

	for v := 1; v <= nBuilds; v++ {
		w.builds[v] = build{Ver: v, Declares: w.rng.Intn(2) == 0, ManifestOK: w.rng.Intn(2) == 0}
	}
	w.logf("world seed %d: builds %s", seed, w.buildsString())
	return w
}

func (w *world) buildsString() string {
	var out []string
	for v := 1; v <= nBuilds; v++ {
		b := w.builds[v]
		out = append(out, fmt.Sprintf("%d{declares=%v manifest=%v}", v, b.Declares, b.ManifestOK))
	}
	return fmt.Sprint(out)
}

// logf appends a trace line. The trace is always kept: it is what the
// determinism test compares, and what ENGINESIM_SEED prints.
func (w *world) logf(format string, args ...any) {
	w.trace = append(w.trace, fmt.Sprintf("[%d] ", w.step)+fmt.Sprintf(format, args...))
}

// calm is true once the chaos steps are over. doStep counts the step before
// it runs the action, so steps 1 to chaosSteps are chaos and the rest calm.
func (w *world) calm() bool { return w.step > chaosSteps }

// group is a row's group key: its owner for a minted instance row whose
// owner the registry can find, else its own host (spec §5.1,
// "Platform-minted rows"; resolveOwner).
func (w *world) group(b *box, host string) string {
	if r := b.Rows[host]; r != nil && followsOwner(r) {
		if o, ok := b.resolveOwner(r); ok {
			return o
		}
	}
	return host
}

// pick chooses one registered action by weight. The registry is sorted by
// name first, so the order files' init functions ran in never matters.
func (w *world) pick() *action {
	sorted := make([]action, 0, len(actions))
	total := 0
	for _, a := range actions {
		if a.weight > 0 {
			sorted = append(sorted, a)
			total += a.weight
		}
	}
	if total == 0 {
		return nil
	}
	sort.SliceStable(sorted, func(i, j int) bool { return sorted[i].name < sorted[j].name })
	n := w.rng.Intn(total)
	for i := range sorted {
		if n < sorted[i].weight {
			return &sorted[i]
		}
		n -= sorted[i].weight
	}
	return nil
}

// doStep advances one tick: it counts the step, runs one chosen action and
// counts it under its name, in stats when chosen and in done when its
// transition completed.
func (w *world) doStep() {
	w.step++
	for _, h := range stepHooks {
		h(w)
	}
	a := w.pick()
	if a == nil {
		if w.verbose {
			w.logf("idle")
		}
		return
	}
	w.stats[a.name]++
	w.logf("action %s", a.name) // always traced: the determinism test compares the action sequence
	if a.run(w) {
		w.done[a.name]++
	}
	w.check()
}

// final is the end-of-run oracle: what must hold once the calm steps are
// over. Later tasks add their end-state checks here.
//
// The faults are over: every edge's reload works again, and each edge polls
// once, so every row has had its chance to answer. Then INV-AV.
func (w *world) final() {
	for _, b := range w.boxes {
		if b.ReloadFails {
			b.ReloadFails = false
			w.logf("box%d: final: the reload fault has cleared", b.ID)
		}
		w.reload(b)
	}
	w.checkAV()
	w.logf("final: %d steps, %d violations, %d residuals", w.step, len(w.violations), len(w.residuals))
}

func runSeed(seed int64, verbose bool) *world {
	w := newWorld(seed, verbose)
	for i := 0; i < chaosSteps+calmSteps; i++ {
		w.doStep()
	}
	w.final()
	return w
}