package status_test

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"reflect"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/status"
)

// flakyPutStore wraps a real release.Store and makes its first N Put calls
// return release.ErrCASConflict before delegating — a stand-in for another
// writer racing in between WriteBox's Get-etag and Put. Every other method
// (Get, List) is the embedded Store's real behavior.
type flakyPutStore struct {
	release.Store
	failCount int // Put calls left to fail before delegating
	putCalls  int
}

func (f *flakyPutStore) Put(ctx context.Context, key string, body []byte, ifMatch string) (string, error) {
	f.putCalls++
	if f.putCalls <= f.failCount {
		return "", release.ErrCASConflict
	}
	return f.Store.Put(ctx, key, body, ifMatch)
}

func TestBandBoundaries(t *testing.T) {
	f := func(v float64) *float64 { return &v }
	cases := []struct {
		frac *float64
		want string
	}{
		{f(0.69), "plenty"}, {f(0.70), "getting-full"},
		{f(0.90), "getting-full"}, {f(0.91), "at-capacity"},
	}
	for _, c := range cases {
		got := status.CollectBox(nil, status.Probes{MachineID: "m", DiskFrac: c.frac}, time.Now()).Capacity
		if got == nil || *got != c.want {
			t.Errorf("frac %v: got %v want %s", *c.frac, got, c.want)
		}
	}
	if b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now()); b.Capacity != nil || b.Load != nil {
		t.Error("unknown fractions must band to null, not a word")
	}
}

func TestAwakeAsleepNullWhenUnreadable(t *testing.T) {
	routes := []registry.Route{{Host: "a", Kind: "instance", Hibernate: true, Socket: "/x.sock"}}
	b := status.CollectBox(routes, status.Probes{MachineID: "m"}, time.Now()) // nil Listening
	if b.Routes.Awake != nil || b.Routes.Asleep != nil {
		t.Error("nil socket probe must publish null, never 0")
	}
}

// TestCollectBoxSkipsPlatformMintedRoutes: a platform domain is a second
// NAME for a route already counted, not a second instance. Counting both
// would roughly double every fleet-wide instance number the moment
// PLATFORM_APPS_DOMAIN is set — the public status page overstating the
// fleet, which is exactly the kind of quiet dishonesty the page's whole
// design exists to prevent.
func TestCollectBoxSkipsPlatformMintedRoutes(t *testing.T) {
	listening := func(string) *bool { v := true; return &v }
	routes := []registry.Route{
		{Host: "kass.training", Kind: "instance", Status: "ready"},
		{Host: "kass.bab.oncarlos.test", Kind: "instance", Status: "ready", Platform: true},
		{Host: "site.custom", Kind: "static"},
		{Host: "site.bab.oncarlos.test", Kind: "static", Platform: true},
		{Host: "sleepy.custom", Kind: "instance", Hibernate: true, Socket: "/s.sock"},
		{Host: "sleepy.bab.oncarlos.test", Kind: "instance", Hibernate: true, Socket: "/s.sock", Platform: true},
	}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", Listening: listening}, time.Now())
	if b.Routes.Resident != 1 || b.Routes.Static != 1 || b.Routes.Hibernating != 1 {
		t.Errorf("counts = %+v, want exactly one of each: aliases must not inflate the fleet", b.Routes)
	}
	if b.Routes.Awake == nil || *b.Routes.Awake != 1 {
		t.Errorf("awake = %v, want 1 — the alias must not be counted awake twice", b.Routes.Awake)
	}
}

// TestCollectBoxSidecarNotResident: a sidecar (Kind "sidecar") is not the
// public fleet page's business — its existence is account-visible, not
// public. Before an explicit branch, it fell into "default: Resident++",
// silently inflating the public resident-app-instance count. It must land
// in neither Resident, Static nor Hibernating (even when it happens to be
// hibernating — a sidecar's Hibernate comes from the app manifest, so it may
// legitimately be either), and Awake/Asleep must not count it — its Socket
// is empty by construction, so probing it would be meaningless.
func TestCollectBoxSidecarNotResident(t *testing.T) {
	listening := func(string) *bool { v := true; return &v }
	routes := []registry.Route{
		{Host: "bot.eleven.bdm.sidecar.internal", Kind: "sidecar", Status: "ready"},
		{Host: "bot2.eleven.bdm.sidecar.internal", Kind: "sidecar", Status: "ready", Hibernate: true},
		{Host: "real.custom", Kind: "instance", Status: "ready"},
	}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", Listening: listening}, time.Now())
	if b.Routes.Resident != 1 {
		t.Errorf("Resident = %d, want 1 — a sidecar must not be counted as a public resident app instance", b.Routes.Resident)
	}
	if b.Routes.Hibernating != 0 {
		t.Errorf("Hibernating = %d, want 0 — a hibernating sidecar still belongs in its own bucket, not this one", b.Routes.Hibernating)
	}
	if b.Sidecars != 2 {
		t.Errorf("Sidecars = %d, want 2 — both sidecars, hibernating or not", b.Sidecars)
	}
}

// TestSidecarsNeverReachFleetJSON is the dryrun.go pattern applied to this
// one field: BuildFleet's per-box copy names Box's public fields one at a
// time (fleet.go), and Sidecars must never be one of them — a sidecar's
// existence is account-visible, not public. Proven by round-tripping through
// the real writer/merger, not just by the FleetBox struct's shape, so a
// future field added to FleetBox that DOES copy it would be caught here too.
func TestSidecarsNeverReachFleetJSON(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	routes := []registry.Route{{Host: "bot.x.sidecar.internal", Kind: "sidecar", Status: "ready"}}
	b := status.CollectBox(routes, status.Probes{MachineID: "leaky"}, now)
	if b.Sidecars != 1 {
		t.Fatalf("Sidecars = %d, want 1 in the private snapshot itself", b.Sidecars)
	}
	if err := status.WriteBox(context.Background(), s, b); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	j, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(strings.ToLower(string(j)), "sidecar") {
		t.Errorf("fleet.json mentions sidecars: %s", j)
	}
}

func TestLabelStableAndOpaque(t *testing.T) {
	a, b := status.Label("machine-1"), status.Label("machine-1")
	if a != b || a == "" || strings.Contains(a, "machine") {
		t.Errorf("label %q must be stable and never contain the machine id", a)
	}
}

func TestSnapshotJSONCarriesNoHostnames(t *testing.T) {
	routes := []registry.Route{{Host: "secret.example.com", Kind: "instance", Status: "ready"}}
	b := status.CollectBox(routes, status.Probes{MachineID: "ip-10-0-0-7"}, time.Now())
	j, _ := json.Marshal(b)
	for _, leak := range []string{"secret", "example.com", "ip-10-0-0-7"} {
		if strings.Contains(string(j), leak) {
			t.Errorf("snapshot leaked %q: %s", leak, j)
		}
	}
}

// TestRouteCountsJSONKeysAreSnakeCase locks RouteCounts' wire shape to the
// design spec's fleet.json example (docs/superpowers/specs/2026-08-01-fleet-
// status-page-design.md §2: {"static":2,"resident":3,"hibernating":4,
// "awake":1,"asleep":3}) — lowercase snake_case, not Go's default
// capitalized field names.
func TestRouteCountsJSONKeysAreSnakeCase(t *testing.T) {
	routes := []registry.Route{
		{Host: "a", Kind: "static"},
		{Host: "b", Kind: "instance"},
		{Host: "c", Kind: "instance", Hibernate: true, Socket: "/c.sock"},
	}
	listening := func(string) *bool { v := true; return &v }
	b := status.CollectBox(routes, status.Probes{MachineID: "m", Listening: listening}, time.Now())
	j, err := json.Marshal(b.Routes)
	if err != nil {
		t.Fatalf("marshal RouteCounts: %v", err)
	}
	for _, key := range []string{`"static"`, `"resident"`, `"hibernating"`, `"awake"`, `"asleep"`} {
		if !strings.Contains(string(j), key) {
			t.Errorf("RouteCounts JSON %s missing key %s", j, key)
		}
	}
	for _, key := range []string{`"Static"`, `"Resident"`, `"Hibernating"`, `"Awake"`, `"Asleep"`} {
		if strings.Contains(string(j), key) {
			t.Errorf("RouteCounts JSON %s carries capitalized Go field name %s", j, key)
		}
	}
}

// TestWriteBoxPutsUnderLabeledKey isn't in the plan's Step-1 listing, but
// WriteBox is part of the exported contract Task 3 relies on — worth locking
// down that it actually lands the box at the key CollectBox's label implies.
func TestWriteBoxPutsUnderLabeledKey(t *testing.T) {
	dir := t.TempDir()
	store := release.NewDirStore(dir)
	b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now())

	if err := status.WriteBox(context.Background(), store, b); err != nil {
		t.Fatalf("WriteBox: %v", err)
	}

	key := "status/boxes/" + b.Label + ".json"
	got, _, err := store.Get(context.Background(), key)
	if err != nil {
		t.Fatalf("Get %s: %v", key, err)
	}
	var round status.Box
	if err := json.Unmarshal(got, &round); err != nil {
		t.Fatalf("unmarshal written box: %v", err)
	}
	if round.Label != b.Label {
		t.Errorf("round-tripped label %q, want %q", round.Label, b.Label)
	}
}

// TestWriteBoxOverwritesOnSecondTick proves WriteBox is last-writer-wins for
// a given label: boxes publish every 5 minutes to the same key, so a
// create-only Put (which fails once the object exists) would break on the
// second tick. Both calls must succeed, and the second call's content must
// be what a reader sees afterward.
func TestWriteBoxOverwritesOnSecondTick(t *testing.T) {
	dir := t.TempDir()
	store := release.NewDirStore(dir)
	ctx := context.Background()

	first := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Unix(1000, 0))
	if err := status.WriteBox(ctx, store, first); err != nil {
		t.Fatalf("first WriteBox: %v", err)
	}

	second := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Unix(2000, 0))
	if err := status.WriteBox(ctx, store, second); err != nil {
		t.Fatalf("second WriteBox (must overwrite, not conflict): %v", err)
	}

	key := "status/boxes/" + second.Label + ".json"
	got, _, err := store.Get(ctx, key)
	if err != nil {
		t.Fatalf("Get %s: %v", key, err)
	}
	var round status.Box
	if err := json.Unmarshal(got, &round); err != nil {
		t.Fatalf("unmarshal written box: %v", err)
	}
	if !round.GeneratedAt.Equal(second.GeneratedAt) {
		t.Errorf("stored box has GeneratedAt %v, want the second write's %v (second write must win)", round.GeneratedAt, second.GeneratedAt)
	}
}

// TestWriteBoxRetriesOnceOnCASConflict exercises the retry branch directly:
// the first Put loses the CAS race (something else wrote between WriteBox's
// Get and its Put), so WriteBox must re-read the etag and retry exactly
// once — and that retry must succeed.
func TestWriteBoxRetriesOnceOnCASConflict(t *testing.T) {
	dir := t.TempDir()
	real := release.NewDirStore(dir)
	flaky := &flakyPutStore{Store: real, failCount: 1}
	b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now())

	if err := status.WriteBox(context.Background(), flaky, b); err != nil {
		t.Fatalf("WriteBox with one transient conflict: %v", err)
	}
	if flaky.putCalls != 2 {
		t.Errorf("Put called %d times, want exactly 2 (fail once, retry once)", flaky.putCalls)
	}

	key := "status/boxes/" + b.Label + ".json"
	if _, _, err := real.Get(context.Background(), key); err != nil {
		t.Fatalf("Get %s after retry: %v", key, err)
	}
}

// ---- Task 5: raw Metrics block (private to the bucket) --------------------

// TestCollectBoxCarriesRawMetrics proves CollectBox attaches an unbanded
// Metrics block straight through from Probes when the six fields are known —
// the one deliberate exception to this package's band-everything rule (see
// snapshot.go's package doc).
func TestCollectBoxCarriesRawMetrics(t *testing.T) {
	mt, ma, df := int64(4056547328), int64(2028273664), int64(9999999)
	l1 := 0.42
	b := status.CollectBox(nil, status.Probes{
		MachineID: "m", MemTotalBytes: &mt, MemAvailBytes: &ma, Load1: &l1, DiskFreeBytes: &df,
		Release: "abc1234", Tunnel: "connected",
	}, time.Now())
	m := b.Metrics
	if m == nil || *m.MemTotalBytes != mt || *m.Load1 != l1 || m.Release != "abc1234" || m.Tunnel != "connected" {
		t.Fatalf("metrics block wrong: %+v", m)
	}
}

// TestCollectBoxOmitsMetricsWhenAllUnknown proves the all-unknown case
// really omits the block rather than attaching an empty-but-present
// BoxMetrics{} — the same "unknown stays absent" rule every other Box field
// follows, and what makes an old parser's absent-key shape and a
// can't-answer box's shape identical on the wire.
func TestCollectBoxOmitsMetricsWhenAllUnknown(t *testing.T) {
	b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now())
	if b.Metrics != nil {
		t.Fatalf("metrics block should be nil when nothing is known, got %+v", b.Metrics)
	}
}

// TestBoxBackCompatParse: yesterday's Box shape (no metrics key) must parse
// today, and a FUTURE box's unknown keys (inside or alongside metrics) must
// not break today's parse either — additive wire shape, per AGENTS.md's
// "consumer = everything that PARSES the shape" rule.
func TestBoxBackCompatParse(t *testing.T) {
	yesterday := []byte(`{"generated_at":"2026-08-03T10:00:00Z","label":"ada-stargazing",
		"routes":{"static":1,"resident":2,"hibernating":3,"awake":null,"asleep":null},
		"load":"comfortable","capacity":"plenty",
		"replication":{"healthy":true,"lag_seconds":5},
		"adoption_running":true,"expired_canaries":0}`)
	var b status.Box
	if err := json.Unmarshal(yesterday, &b); err != nil {
		t.Fatalf("yesterday's shape failed to parse: %v", err)
	}
	if b.Metrics != nil {
		t.Fatal("absent metrics must decode as nil, not zero-value")
	}
	tomorrow := []byte(`{"generated_at":"2026-08-05T10:00:00Z","label":"ada-stargazing",
		"routes":{"static":0,"resident":0,"hibernating":0,"awake":null,"asleep":null},
		"load":null,"capacity":null,"replication":{"healthy":null,"lag_seconds":null},
		"adoption_running":null,"expired_canaries":null,
		"metrics":{"mem_total_bytes":1,"some_future_field":true}}`)
	if err := json.Unmarshal(tomorrow, &b); err != nil {
		t.Fatalf("tomorrow's shape failed to parse: %v", err)
	}
}

// ---- Task 8: staged_version (route versions, private) ----------------------

// TestCollectBoxCarriesRouteVersions proves CollectBox attaches a host ->
// Version map onto the raw Metrics block for every non-platform route that
// carries a Version (registry.Route.Version, stamped by the adopt pass), and
// that WriteBox lands it in status/boxes/<label>.json — while BuildFleet's
// public fleet.json, which never copies Metrics by construction (see
// snapshot.go's package doc), carries no trace of the hostname. A platform-
// minted alias route and a route with no Version yet must not appear in the
// map at all.
func TestCollectBoxCarriesRouteVersions(t *testing.T) {
	routes := []registry.Route{
		{Host: "h.test", Kind: "instance", Status: "ready", Version: "abc1234"},
		{Host: "unversioned.test", Kind: "instance", Status: "ready"},
		{Host: "platform.test", Kind: "instance", Status: "ready", Version: "zzz9999", Platform: true},
	}
	b := status.CollectBox(routes, status.Probes{MachineID: "m"}, time.Now())
	if b.Metrics == nil {
		t.Fatal("metrics block missing — RouteVersions should have attached it")
	}
	if len(b.Metrics.RouteVersions) != 1 || b.Metrics.RouteVersions["h.test"] != "abc1234" {
		t.Fatalf("route_versions = %+v, want exactly {h.test: abc1234}", b.Metrics.RouteVersions)
	}

	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	raw, _, err := s.Get(ctx, "status/boxes/"+b.Label+".json")
	if err != nil {
		t.Fatalf("Get written box: %v", err)
	}
	var round status.Box
	if err := json.Unmarshal(raw, &round); err != nil {
		t.Fatalf("unmarshal written box: %v", err)
	}
	if round.Metrics == nil || round.Metrics.RouteVersions["h.test"] != "abc1234" {
		t.Errorf("written box route_versions = %+v, want {h.test: abc1234}: %s", round.Metrics, raw)
	}

	f, err := status.BuildFleet(ctx, s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(fj), "h.test") {
		t.Errorf("fleet.json leaked a route_versions hostname: %s", fj)
	}
}

// TestCollectBoxRouteVersionsEmptyOmitsField proves a box with no versioned
// route contributes no route_versions key at all — omitted, not an empty
// object — matching the same "unknown/absent stays absent" convention every
// other Metrics field follows.
func TestCollectBoxRouteVersionsEmptyOmitsField(t *testing.T) {
	routes := []registry.Route{{Host: "h.test", Kind: "instance", Status: "ready"}}
	b := status.CollectBox(routes, status.Probes{MachineID: "m"}, time.Now())
	if b.Metrics != nil {
		t.Fatalf("metrics block should stay nil with nothing else known, got %+v", b.Metrics)
	}
}

// ---- Task 6 (multi-upstream plan): per-upstream probe state ----------------

// TestCollectBoxCarriesUpstreams is route_versions' sibling for the probe
// table: CollectBox carries Probes.Upstreams onto the private Metrics block
// verbatim, WriteBox lands it in status/boxes/<label>.json, and BuildFleet's
// public fleet.json shows no trace of either the route host or the upstream
// ADDRESS — the most identifying pair this block has ever carried, and safe
// for exactly the same structural reason (BuildFleet never names Metrics).
func TestCollectBoxCarriesUpstreams(t *testing.T) {
	routes := []registry.Route{{Host: "ha.test", Kind: "service", Status: "ready"}}
	since := time.Now().Add(-time.Minute).UTC().Truncate(time.Second)
	p := status.Probes{MachineID: "m", Upstreams: map[string][]status.UpstreamState{
		"ha.test": {
			{Addr: "10.9.9.11:8080", Up: true, Since: since},
			{Addr: "10.9.9.12:8080", Up: false, Since: since, Fails: 4, LastError: "dial: connection refused"},
		},
	}}

	b := status.CollectBox(routes, p, time.Now())
	if b.Metrics == nil {
		t.Fatal("metrics block missing — Upstreams should have attached it")
	}
	if len(b.Metrics.Upstreams) != 1 || len(b.Metrics.Upstreams["ha.test"]) != 2 {
		t.Fatalf("upstreams = %+v, want one host with two upstreams", b.Metrics.Upstreams)
	}

	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	raw, _, err := s.Get(ctx, "status/boxes/"+b.Label+".json")
	if err != nil {
		t.Fatalf("Get written box: %v", err)
	}
	var round status.Box
	if err := json.Unmarshal(raw, &round); err != nil {
		t.Fatalf("unmarshal written box: %v", err)
	}
	got := round.Metrics.Upstreams["ha.test"]
	if !reflect.DeepEqual(got, p.Upstreams["ha.test"]) {
		t.Errorf("written upstreams = %+v, want %+v: %s", got, p.Upstreams["ha.test"], raw)
	}

	f, err := status.BuildFleet(ctx, s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	for _, needle := range []string{"ha.test", "10.9.9.11:8080", "connection refused"} {
		if strings.Contains(string(fj), needle) {
			t.Errorf("fleet.json leaked %q from the private upstream table: %s", needle, fj)
		}
	}
}

// TestCollectBoxUpstreamsEmptyOmitsField proves a box that probes nothing
// contributes no upstreams key at all — the same "absent, not empty" rule
// route_versions follows, which is what keeps every pre-existing snapshot
// consumer parsing a box written by this build unchanged.
func TestCollectBoxUpstreamsEmptyOmitsField(t *testing.T) {
	routes := []registry.Route{{Host: "h.test", Kind: "instance", Status: "ready"}}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", Upstreams: map[string][]status.UpstreamState{}}, time.Now())
	if b.Metrics != nil {
		t.Fatalf("an empty probe table must not attach a metrics block, got %+v", b.Metrics)
	}
	raw, err := json.Marshal(b)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(raw), "upstreams") {
		t.Errorf("box JSON carries an upstreams key with nothing probed: %s", raw)
	}
}

// ---- Task 6: alias readings (route_aliases DNS/cert stamps, private) -----

// TestCollectBoxAliases proves CollectBox maps Probes.Aliases (registry rows
// carried in by the agent's own reg.ListAliases() call, see agent.go's
// statusTick) onto Box.Metrics.Aliases, keyed by the alias hostname — the
// same private home as RouteVersions (status/boxes/<label>.json only, never
// BuildFleet's public fleet.json) — and that an empty Probes.Aliases omits
// the "aliases" key entirely rather than publishing a present-but-empty map.
func TestCollectBoxAliases(t *testing.T) {
	p := status.Probes{
		MachineID: "m",
		Aliases: []registry.RouteAlias{
			{Alias: "extra.test", Host: "h.test", DNSStatus: "ok", CertExpiresAt: 1234567890},
		},
	}
	b := status.CollectBox(nil, p, time.Now())
	if b.Metrics == nil {
		t.Fatal("metrics block missing — Aliases should have attached it")
	}
	got, ok := b.Metrics.Aliases["extra.test"]
	if !ok || got.Route != "h.test" || got.DNSStatus != "ok" || got.CertExpiresAt != 1234567890 {
		t.Fatalf("aliases[extra.test] = %+v (ok=%v), want {Route:h.test DNSStatus:ok CertExpiresAt:1234567890}", got, ok)
	}

	// Empty Probes.Aliases, but something else known so Metrics still
	// attaches — the omission must be specific to the aliases key, not a
	// side effect of the whole Metrics block being absent.
	mt := int64(1)
	b2 := status.CollectBox(nil, status.Probes{MachineID: "m", MemTotalBytes: &mt}, time.Now())
	j, err := json.Marshal(b2)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(j), "aliases") {
		t.Fatalf("empty Probes.Aliases must omit the aliases key entirely, got: %s", j)
	}
}

// ---- Task 3: fleet merge + publisher --------------------------------------

// teststore is a fresh DirStore over a scratch directory — every fleet test
// gets an isolated bucket so writes in one test can never leak state into
// another.
func teststore(t *testing.T) release.Store {
	t.Helper()
	return release.NewDirStore(t.TempDir())
}

// boxFixture builds a minimal Box for tests that only care about label,
// capacity band, and generation time — the three things BuildFleet's
// worst-of/staleness logic actually looks at.
func boxFixture(label, capacity string, generatedAt time.Time) status.Box {
	c := capacity
	return status.Box{
		GeneratedAt: generatedAt,
		Label:       label,
		Routes:      status.RouteCounts{},
		Capacity:    &c,
	}
}

func TestFleetAppsOptIn(t *testing.T) {
	routes := []registry.Route{
		{Host: "kass.training", Kind: "instance", App: "kass", Status: "ready",
			Channel: "stable", Version: "aedcae3", StatusNamed: true},
		{Host: "hidden.app", Kind: "instance", App: "hidden", Status: "ready"},
		{Host: "svc.pdf.internal", Kind: "service", App: "svc/pdf", Status: "ready"},
	}
	s := teststore(t) // DirStore over t.TempDir(); write one Box via WriteBox first
	if err := status.WriteBox(context.Background(), s, boxFixture("solo", "plenty", time.Now())); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if len(f.Apps) != 1 || f.Apps[0].Name != "kass" || f.Apps[0].Version != "aedcae3" {
		t.Errorf("apps = %+v, want exactly the opted-in kass", f.Apps)
	}
	if f.AppsUnlisted != 1 { // hidden; svc/* routes are services, not apps
		t.Errorf("apps_unlisted = %d, want 1", f.AppsUnlisted)
	}
	if len(f.Services) != 1 || f.Services[0].Name != "svc/pdf" || !f.Services[0].Up {
		t.Errorf("services = %+v", f.Services)
	}
	j, _ := json.Marshal(f)
	if strings.Contains(string(j), "hidden") {
		t.Errorf("un-opted app leaked: %s", j)
	}
}

// App names are unique per ACCOUNT, never globally, so two tenants can both
// run a "blog". Grouping on the name alone would merge them — publishing one
// tenant's outage under the other's name, and letting either tenant's opt-in
// decide whether the other appears at all.
func TestFleetAppsAreGroupedPerAccount(t *testing.T) {
	routes := []registry.Route{
		{Host: "blog.one", Kind: "instance", App: "blog", Account: "bab", Status: "ready",
			Channel: "stable", Version: "v1", StatusNamed: true},
		{Host: "blog.two", Kind: "instance", App: "blog", Account: "kqmv", Status: "failed",
			Channel: "stable", Version: "v9", StatusNamed: true},
	}
	s := teststore(t)
	if err := status.WriteBox(context.Background(), s, boxFixture("solo", "plenty", time.Now())); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if len(f.Apps) != 2 {
		t.Fatalf("apps = %+v, want two separate blogs (one per account)", f.Apps)
	}
	byVersion := map[string]bool{}
	for _, a := range f.Apps {
		if a.Name != "blog" {
			t.Errorf("app name = %q, want the app name (never the sqid)", a.Name)
		}
		byVersion[a.Version] = a.Healthy
	}
	if !byVersion["v1"] {
		t.Error("the healthy account's blog was dragged down by the other's")
	}
	if byVersion["v9"] {
		t.Error("the failing account's blog was reported healthy")
	}
}

// A tenant that did NOT opt in must stay dark even when another account's
// same-named app did — the opt-in is per app, and merging would publish an
// app that never asked to be named.
func TestFleetOptInIsPerAccount(t *testing.T) {
	routes := []registry.Route{
		{Host: "blog.one", Kind: "instance", App: "blog", Account: "bab", Status: "ready",
			Channel: "stable", Version: "v1", StatusNamed: true},
		{Host: "blog.two", Kind: "instance", App: "blog", Account: "kqmv", Status: "ready",
			Channel: "stable", Version: "secret", StatusNamed: false},
	}
	s := teststore(t)
	if err := status.WriteBox(context.Background(), s, boxFixture("solo", "plenty", time.Now())); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if len(f.Apps) != 1 || f.Apps[0].Version != "v1" {
		t.Fatalf("apps = %+v, want only the opted-in account's blog", f.Apps)
	}
	if f.AppsUnlisted != 1 {
		t.Errorf("apps_unlisted = %d, want 1", f.AppsUnlisted)
	}
	j, _ := json.Marshal(f)
	if strings.Contains(string(j), "secret") {
		t.Errorf("un-opted app leaked: %s", j)
	}
}

func TestFleetWorstOfAndStale(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	old, fresh := boxFixture("old", "at-capacity", now.Add(-16*time.Minute)),
		boxFixture("fresh", "plenty", now) // helper: Box with that capacity word
	for _, b := range []status.Box{old, fresh} {
		if err := status.WriteBox(context.Background(), s, b); err != nil {
			t.Fatal(err)
		}
	}
	f, _ := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if f.Capacity.Level == nil || *f.Capacity.Level != "at-capacity" {
		t.Errorf("capacity must be the worst box's band, got %v", f.Capacity.Level)
	}
	var st, fr *status.FleetBox
	for i := range f.Boxes {
		if f.Boxes[i].Label == "old" {
			st = &f.Boxes[i]
		} else {
			fr = &f.Boxes[i]
		}
	}
	if !st.Stale || fr.Stale {
		t.Error("boxes older than 3 periods must mark stale — loudly, never dropped")
	}
}

// TestFleetInstanceSumsNullPropagate proves the "unknowns are null, never 0"
// rule holds through aggregation too: one box with an unreadable socket
// table (Awake/Asleep null) must null the FLEET-WIDE awake/asleep sum, not
// silently drop that box's contribution and report a partial — and
// misleadingly confident — total.
func TestFleetInstanceSumsNullPropagate(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	known := status.CollectBox(
		[]registry.Route{{Host: "a", Kind: "instance", Hibernate: true, Socket: "/a.sock"}},
		status.Probes{MachineID: "known", Listening: func(string) *bool { v := true; return &v }},
		now,
	)
	unknown := status.CollectBox(
		[]registry.Route{{Host: "b", Kind: "instance", Hibernate: true, Socket: "/b.sock"}},
		status.Probes{MachineID: "unknown"}, // nil Listening -> Awake/Asleep null
		now,
	)
	for _, b := range []status.Box{known, unknown} {
		if err := status.WriteBox(context.Background(), s, b); err != nil {
			t.Fatal(err)
		}
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if f.Instances["awake"] != nil {
		t.Errorf("fleet awake = %v, want nil (one box's socket table was unreadable)", *f.Instances["awake"])
	}
	if f.Instances["static"] == nil || *f.Instances["static"] != 0 {
		t.Errorf("fleet static = %v, want 0 (a known, non-null component)", f.Instances["static"])
	}
	if f.Instances["hibernating"] == nil || *f.Instances["hibernating"] != 2 {
		t.Errorf("fleet hibernating = %v, want 2", f.Instances["hibernating"])
	}
}

// TestFleetEmptyIsValid locks down the zero-snapshot state: BuildFleet must
// not error when status/boxes/ is empty, and must report zero counts (not
// null — there's nothing unknown about an empty fleet) with a null capacity
// band (there's no box to have voted on one). This is the console's
// "no snapshots yet" rendering.
func TestFleetEmptyIsValid(t *testing.T) {
	s := teststore(t)
	f, err := status.BuildFleet(context.Background(), s, nil, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if len(f.Boxes) != 0 {
		t.Errorf("boxes = %+v, want none", f.Boxes)
	}
	if f.Capacity.Level != nil {
		t.Errorf("capacity.level = %v, want nil with no boxes to vote", *f.Capacity.Level)
	}
	if f.Instances["total"] == nil || *f.Instances["total"] != 0 {
		t.Errorf("instances.total = %v, want 0", f.Instances["total"])
	}
	if len(f.Apps) != 0 || f.AppsUnlisted != 0 || len(f.Services) != 0 {
		t.Errorf("apps/services must be empty with no routes, got apps=%+v unlisted=%d services=%+v", f.Apps, f.AppsUnlisted, f.Services)
	}
}

// TestFleetSkipsCorruptSnapshot proves a corrupt status/boxes/*.json is a
// logged skip, never a fatal error — one box's bad write must not take the
// whole fleet page down.
func TestFleetSkipsCorruptSnapshot(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	if err := status.WriteBox(context.Background(), s, boxFixture("good", "plenty", now)); err != nil {
		t.Fatal(err)
	}
	if _, err := s.Put(context.Background(), "status/boxes/broken.json", []byte("{not json"), ""); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatalf("BuildFleet must not fail on a corrupt snapshot: %v", err)
	}
	if len(f.Boxes) != 1 || f.Boxes[0].Label != "good" {
		t.Errorf("boxes = %+v, want only the good one (corrupt skipped)", f.Boxes)
	}
}

// TestFleetLoadBoxesCapsKeyCount is I3 (final customer-fleets review):
// status/boxes/ is customer-writable in the fleet case (via
// CARLOS_STATUS_PREFIX), so loadBoxes must bound how many keys it will ever
// process from one listing rather than trusting an untrusted prefix's size.
// Seed one more box than the cap and confirm only the cap's worth land in
// the merged Fleet.
func TestFleetLoadBoxesCapsKeyCount(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	const keyCap = 200
	for i := 0; i < keyCap+1; i++ {
		label := fmt.Sprintf("box-%04d", i)
		if err := status.WriteBox(context.Background(), s, boxFixture(label, "plenty", now)); err != nil {
			t.Fatal(err)
		}
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatalf("BuildFleet must not fail on an oversized key listing: %v", err)
	}
	if len(f.Boxes) != keyCap {
		t.Fatalf("boxes = %d, want exactly the %d-key cap (seeded %d)", len(f.Boxes), keyCap, keyCap+1)
	}
}

// TestFleetLoadBoxesSkipsOversizedBody is I3's other half: a single huge
// object under status/boxes/ (a hostile or misbehaving box parking a large
// body on its own customer-writable prefix) must be skipped, logged, and
// must not prevent a sibling box's snapshot from loading.
func TestFleetLoadBoxesSkipsOversizedBody(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	if err := status.WriteBox(context.Background(), s, boxFixture("good", "plenty", now)); err != nil {
		t.Fatal(err)
	}
	huge := make([]byte, (1<<20)+1) // one byte over the 1MB cap
	for i := range huge {
		huge[i] = ' '
	}
	if _, err := s.Put(context.Background(), "status/boxes/huge.json", huge, ""); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatalf("BuildFleet must not fail on an oversized body: %v", err)
	}
	if len(f.Boxes) != 1 || f.Boxes[0].Label != "good" {
		t.Errorf("boxes = %+v, want only the good one (oversized body skipped)", f.Boxes)
	}
}

// TestPublishFleetWritesAndOverwrites mirrors WriteBox's own overwrite test:
// PublishFleet lands status/fleet.json on every publish pass (every 5
// minutes, per the plan), so a second call must overwrite cleanly rather
// than failing with ErrCASConflict against release.Store's create-only Put.
func TestPublishFleetWritesAndOverwrites(t *testing.T) {
	s := teststore(t)
	ctx := context.Background()

	first := &status.Fleet{GeneratedAt: time.Unix(1000, 0)}
	if err := status.PublishFleet(ctx, s, first); err != nil {
		t.Fatalf("first PublishFleet: %v", err)
	}
	second := &status.Fleet{GeneratedAt: time.Unix(2000, 0)}
	if err := status.PublishFleet(ctx, s, second); err != nil {
		t.Fatalf("second PublishFleet (must overwrite, not conflict): %v", err)
	}

	got, _, err := s.Get(ctx, "status/fleet.json")
	if err != nil {
		t.Fatalf("Get status/fleet.json: %v", err)
	}
	var round status.Fleet
	if err := json.Unmarshal(got, &round); err != nil {
		t.Fatalf("unmarshal published fleet: %v", err)
	}
	if !round.GeneratedAt.Equal(second.GeneratedAt) {
		t.Errorf("stored fleet has GeneratedAt %v, want second publish's %v", round.GeneratedAt, second.GeneratedAt)
	}
}

// ---- Task 4: embedded viewer page -----------------------------------------

// TestPublishWritesPageAssets proves PublishFleet ships the whole viewer —
// fleet.json alongside the embedded index.html and status.css — and that the
// page is same-origin only: no absolute http(s):// URL and no <script src>
// anywhere in the shipped markup. (Simplified from the plan's step-1 text,
// per the operator's ambiguity resolution: the footer's incident-fallback
// URL is injected as text by inline JS from `location` at view time, never
// baked into the HTML as a hardcoded absolute href, so a flat "no
// http(s):// substring, no <script src" check is the honest same-origin
// assertion here — no carve-out needed for a rel="me" link that doesn't
// exist.)
func TestPublishWritesPageAssets(t *testing.T) {
	s := teststore(t)
	f, err := status.BuildFleet(context.Background(), s, nil, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if err := status.PublishFleet(context.Background(), s, f); err != nil {
		t.Fatal(err)
	}
	for _, key := range []string{"status/fleet.json", "status/index.html", "status/status.css"} {
		if _, _, err := s.Get(context.Background(), key); err != nil {
			t.Errorf("%s not published: %v", key, err)
		}
	}
	html, _, err := s.Get(context.Background(), "status/index.html")
	if err != nil {
		t.Fatalf("Get status/index.html: %v", err)
	}
	// The last three entries catch protocol-relative references
	// (src="//cdn...", href="//cdn...", url(//cdn...)) — another way to
	// reach off-origin without ever spelling "http". A bare "//" substring
	// isn't checked: this file's inline script is full of legitimate "//
	// comment" lines, so the assertion targets the actual reference
	// positions (an attribute/url() opening onto "//") instead.
	for _, banned := range []string{"http://", "https://", "<script src", `src="//`, `href="//`, `url(//`} {
		if strings.Contains(string(html), banned) {
			t.Errorf("page must be same-origin only; found %q in index.html", banned)
		}
	}
}

// TestWriteBoxReturnsErrorOnDoubleCASConflict proves WriteBox does NOT retry
// a second time: if the retried Put also loses the race, that error must
// reach the caller rather than being swallowed or retried forever.
func TestWriteBoxReturnsErrorOnDoubleCASConflict(t *testing.T) {
	dir := t.TempDir()
	real := release.NewDirStore(dir)
	flaky := &flakyPutStore{Store: real, failCount: 2}
	b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now())

	err := status.WriteBox(context.Background(), flaky, b)
	if err == nil {
		t.Fatal("WriteBox: want an error after two consecutive CAS conflicts, got nil")
	}
	if !errors.Is(err, release.ErrCASConflict) {
		t.Errorf("WriteBox error = %v, want it to wrap release.ErrCASConflict", err)
	}
	if flaky.putCalls != 2 {
		t.Errorf("Put called %d times, want exactly 2 (no third attempt)", flaky.putCalls)
	}
}

// ---- Task 6: dry-run self-check --------------------------------------------

// TestDryRunSelfChecks is the plan's Step-1 test verbatim: DryRun must run
// the real CollectBox -> WriteBox -> BuildFleet -> PublishFleet path over a
// fixture registry stuffed with needles (hostnames, a machine id, mid-band
// fractions), then read every published object back and prove none of those
// needles survived — the self-hoster's "what would I publish?" check, run
// before ever pointing this binary at a real bucket.
func TestDryRunSelfChecks(t *testing.T) {
	var buf bytes.Buffer
	if err := status.DryRun(t.TempDir(), &buf); err != nil {
		t.Fatalf("dry run: %v\n%s", err, buf.String())
	}
	if !strings.Contains(buf.String(), "no leaks") {
		t.Errorf("dry run must attest the self-check ran: %s", buf.String())
	}
}

// ---- Pipelines Task 5: adoption health -------------------------------------

// TestAdoptionUnknownIsANull pins the honest-unknown half of the pipelines
// spec's §5 ("adoption must actually run"): a box whose probe never managed to
// ask systemd about the adoption timer publishes null, exactly like every
// other unmeasured quantity in this package. The failure this guards against
// is not a wrong reading, it is a REASSURING one — a default true would make
// every box that can't answer look like a box that is adopting fine, which is
// precisely the silence that let carlos-adopt.timer sit enabled-but-never-
// started on the flagship for weeks with nothing on any page to show for it.
func TestAdoptionUnknownIsANull(t *testing.T) {
	b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now()) // nil AdoptRunning
	if b.AdoptionRunning != nil {
		t.Errorf("adoption_running = %v, want null — an unasked question is not a healthy answer", *b.AdoptionRunning)
	}
	for _, want := range []bool{true, false} {
		got := status.CollectBox(nil, status.Probes{MachineID: "m", AdoptRunning: &want}, time.Now()).AdoptionRunning
		if got == nil || *got != want {
			t.Errorf("AdoptRunning=%v: adoption_running = %v, want %v", want, got, want)
		}
	}
}

// TestConfigPathRunningTravelsPerBox pins the issue #44 probe's whole chain:
// whether this box's config-sync trigger unit (carlos-adopt.path) is ACTIVE
// travels from Probes onto the box snapshot and through BuildFleet onto the
// box's public row — the same journey adoption_running makes, and for the
// same reason. An inactive path unit is a box that silently fell back to the
// hourly config floor, which is exactly the class of quiet degradation this
// package exists to make visible. Unknown stays null: an unasked question is
// not a reassuring answer here either.
func TestConfigPathRunningTravelsPerBox(t *testing.T) {
	if b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now()); b.ConfigPathRunning != nil {
		t.Errorf("config_path_running = %v, want null when the probe never answered", *b.ConfigPathRunning)
	}
	for _, want := range []bool{true, false} {
		got := status.CollectBox(nil, status.Probes{MachineID: "m", ConfigPathRunning: &want}, time.Now()).ConfigPathRunning
		if got == nil || *got != want {
			t.Fatalf("ConfigPathRunning=%v: box field = %v, want %v", want, got, want)
		}
	}

	s := teststore(t)
	now := time.Now()
	no := false
	b := status.CollectBox(nil, status.Probes{MachineID: "m", ConfigPathRunning: &no}, now)
	if err := status.WriteBox(context.Background(), s, b); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if len(f.Boxes) != 1 {
		t.Fatalf("fleet boxes = %d, want 1", len(f.Boxes))
	}
	if got := f.Boxes[0].ConfigPathRunning; got == nil || *got {
		t.Fatalf("fleet box config_path_running = %v, want false — knowing WHICH box lost its trigger is the whole value", got)
	}
}

// TestConfigPathRunningIsWireAdditive pins the other half: a snapshot written
// before this field existed (no "config_path_running" key at all) must still
// parse, and must read as unknown rather than as a healthy false. Live
// buckets hold exactly those objects today.
func TestConfigPathRunningIsWireAdditive(t *testing.T) {
	var b status.Box
	old := `{"generated_at":"2026-08-04T00:00:00Z","label":"box-old","routes":{"static":0,"resident":0,"hibernating":0,"awake":null,"asleep":null},"load":null,"capacity":null,"replication":{"healthy":null,"lag_seconds":null},"adoption_running":true,"expired_canaries":null}`
	if err := json.Unmarshal([]byte(old), &b); err != nil {
		t.Fatalf("a pre-#44 snapshot must still parse: %v", err)
	}
	if b.ConfigPathRunning != nil {
		t.Fatalf("config_path_running = %v, want null for a snapshot written before the field existed", *b.ConfigPathRunning)
	}
}

// TestRestartPathRunningTravelsPerBox is TestConfigPathRunningTravelsPerBox's
// issue #113 twin, and it exists for a sharper reason than symmetry: with
// carlos-restart.path unarmed, a member runs `carlos restart` at a wedged
// instance, is told "requested", and waits for a cycle that will not come until
// the hourly pass. Nothing inside the agent can see that — it writes its marker
// either way — so this reading is the only thing that can. Unknown stays null.
func TestRestartPathRunningTravelsPerBox(t *testing.T) {
	if b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now()); b.RestartPathRunning != nil {
		t.Errorf("restart_path_running = %v, want null when the probe never answered", *b.RestartPathRunning)
	}
	for _, want := range []bool{true, false} {
		got := status.CollectBox(nil, status.Probes{MachineID: "m", RestartPathRunning: &want}, time.Now()).RestartPathRunning
		if got == nil || *got != want {
			t.Fatalf("RestartPathRunning=%v: box field = %v, want %v", want, got, want)
		}
	}

	s := teststore(t)
	now := time.Now()
	no := false
	b := status.CollectBox(nil, status.Probes{MachineID: "m", RestartPathRunning: &no}, now)
	if err := status.WriteBox(context.Background(), s, b); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if len(f.Boxes) != 1 {
		t.Fatalf("fleet boxes = %d, want 1", len(f.Boxes))
	}
	if got := f.Boxes[0].RestartPathRunning; got == nil || *got {
		t.Fatalf("fleet box restart_path_running = %v, want false — knowing WHICH box cannot cycle a wedged instance is the whole value", got)
	}

	// Wire-additive, like every field before it: a snapshot written before
	// issue #113 has no such key and must read as unknown, not a healthy false.
	var old status.Box
	raw := `{"generated_at":"2026-08-04T00:00:00Z","label":"box-old","routes":{"static":0,"resident":0,"hibernating":0,"awake":null,"asleep":null},"load":null,"capacity":null,"replication":{"healthy":null,"lag_seconds":null},"adoption_running":true,"config_path_running":true,"expired_canaries":null}`
	if err := json.Unmarshal([]byte(raw), &old); err != nil {
		t.Fatalf("a pre-#113 snapshot must still parse: %v", err)
	}
	if old.RestartPathRunning != nil {
		t.Fatalf("restart_path_running = %v, want null for a snapshot written before the field existed", *old.RestartPathRunning)
	}
}

// TestFleetAdoptionWorstOf covers the aggregate: a box that is KNOWN not to be
// adopting is a defect the fleet number must never hide, so one false outranks
// any number of trues; an unknown box can't be summed into a confident true,
// so it nulls the aggregate instead; and a stale box doesn't vote at all
// (staleness means "we no longer know", the same rule worstReplication uses).
func TestFleetAdoptionWorstOf(t *testing.T) {
	yes, no := true, false
	cases := []struct {
		name  string
		boxes map[string]*bool // machine id -> AdoptRunning
		stale map[string]bool  // machine id -> written 16 minutes ago
		want  *bool
	}{
		{"all running", map[string]*bool{"a": &yes, "b": &yes}, nil, &yes},
		{"one dead timer wins", map[string]*bool{"a": &yes, "b": &no}, nil, &no},
		{"one unknown blocks a cheerful true", map[string]*bool{"a": &yes, "b": nil}, nil, nil},
		{"a known defect beats an unknown", map[string]*bool{"a": nil, "b": &no}, nil, &no},
		{"stale boxes do not vote", map[string]*bool{"a": &yes, "b": &no}, map[string]bool{"b": true}, &yes},
		{"no boxes at all", nil, nil, nil},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			s := teststore(t)
			now := time.Now()
			for id, adopt := range c.boxes {
				at := now
				if c.stale[id] {
					at = now.Add(-16 * time.Minute) // > 3 x the 5-minute period
				}
				b := status.CollectBox(nil, status.Probes{MachineID: id, AdoptRunning: adopt}, at)
				if err := status.WriteBox(context.Background(), s, b); err != nil {
					t.Fatal(err)
				}
			}
			f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
			if err != nil {
				t.Fatal(err)
			}
			switch {
			case c.want == nil && f.AdoptionRunning != nil:
				t.Errorf("fleet adoption_running = %v, want null", *f.AdoptionRunning)
			case c.want != nil && f.AdoptionRunning == nil:
				t.Errorf("fleet adoption_running = null, want %v", *c.want)
			case c.want != nil && *f.AdoptionRunning != *c.want:
				t.Errorf("fleet adoption_running = %v, want %v", *f.AdoptionRunning, *c.want)
			}
		})
	}
}

// TestFleetBoxCarriesAdoption keeps the per-box row honest too: the fleet-wide
// number says SOMETHING is not adopting, the boxes table says which label —
// without it, an operator reading "not running" on a two-box fleet has to go
// SSH into both to find out where the dead timer is.
// ---- Pipelines Task: canary TTL (spec §5 "Canaries expire") ---------------

// TestExpiredCanariesUnknownIsANull mirrors TestAdoptionUnknownIsANull: a box
// whose probe never resolved its canary channel pointers (e.g. no deployment
// store configured) publishes null, exactly like every other unmeasured
// quantity here. A default 0 would read as "no expired canaries on this
// box" when the honest answer is "this box couldn't check" — precisely the
// reassuring-wrong-answer failure the rest of this package refuses to make.
func TestExpiredCanariesUnknownIsANull(t *testing.T) {
	b := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now()) // nil ExpiredCanaries
	if b.ExpiredCanaries != nil {
		t.Errorf("expired_canaries = %v, want null — an unasked question is not a healthy answer", *b.ExpiredCanaries)
	}
	for _, want := range []int{0, 3} {
		got := status.CollectBox(nil, status.Probes{MachineID: "m", ExpiredCanaries: &want}, time.Now()).ExpiredCanaries
		if got == nil || *got != want {
			t.Errorf("ExpiredCanaries=%d: expired_canaries = %v, want %d", want, got, want)
		}
	}
}

// TestFleetExpiredCanariesSums proves the fleet-wide count is the sum across
// boxes when every box's own count is known — the aggregate an operator
// actually wants ("how many expired canaries are running anywhere"), not a
// per-box worst-of.
func TestFleetExpiredCanariesSums(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	two, one := 2, 1
	for _, b := range []status.Box{
		status.CollectBox(nil, status.Probes{MachineID: "a", ExpiredCanaries: &two}, now),
		status.CollectBox(nil, status.Probes{MachineID: "b", ExpiredCanaries: &one}, now),
	} {
		if err := status.WriteBox(context.Background(), s, b); err != nil {
			t.Fatal(err)
		}
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if f.ExpiredCanaries == nil || *f.ExpiredCanaries != 3 {
		t.Errorf("fleet expired_canaries = %v, want 3", f.ExpiredCanaries)
	}
}

// TestFleetExpiredCanariesNullPropagates: one box that couldn't check nulls
// the fleet-wide sum, the same null-propagation rule sumInstances applies to
// Awake/Asleep — a partial sum would read as more certain than it is.
func TestFleetExpiredCanariesNullPropagates(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	two := 2
	known := status.CollectBox(nil, status.Probes{MachineID: "known", ExpiredCanaries: &two}, now)
	unknown := status.CollectBox(nil, status.Probes{MachineID: "unknown"}, now) // nil probe
	for _, b := range []status.Box{known, unknown} {
		if err := status.WriteBox(context.Background(), s, b); err != nil {
			t.Fatal(err)
		}
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if f.ExpiredCanaries != nil {
		t.Errorf("fleet expired_canaries = %v, want nil (one box could not check)", *f.ExpiredCanaries)
	}
}

// TestFleetEmptyExpiredCanariesIsZero: no boxes at all is not "unknown", the
// same rule TestFleetEmptyIsValid pins for instances — there is nothing
// unknown about an empty fleet.
func TestFleetEmptyExpiredCanariesIsZero(t *testing.T) {
	s := teststore(t)
	f, err := status.BuildFleet(context.Background(), s, nil, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if f.ExpiredCanaries == nil || *f.ExpiredCanaries != 0 {
		t.Errorf("expired_canaries = %v, want 0 with no boxes", f.ExpiredCanaries)
	}
}

// TestFleetBoxCarriesExpiredCanaries keeps the per-box row honest too — the
// fleet-wide number says something is expired somewhere, the boxes table
// says which box, the same reasoning TestFleetBoxCarriesAdoption pins for
// the adoption-timer reading.
func TestFleetBoxCarriesExpiredCanaries(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	three := 3
	if err := status.WriteBox(context.Background(), s,
		status.CollectBox(nil, status.Probes{MachineID: "leaky", ExpiredCanaries: &three}, now)); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if len(f.Boxes) != 1 {
		t.Fatalf("boxes = %d, want 1", len(f.Boxes))
	}
	if f.Boxes[0].ExpiredCanaries == nil || *f.Boxes[0].ExpiredCanaries != 3 {
		t.Errorf("boxes[0].expired_canaries = %v, want 3", f.Boxes[0].ExpiredCanaries)
	}
}

func TestFleetBoxCarriesAdoption(t *testing.T) {
	s := teststore(t)
	now := time.Now()
	no := false
	if err := status.WriteBox(context.Background(), s,
		status.CollectBox(nil, status.Probes{MachineID: "dead", AdoptRunning: &no}, now)); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if len(f.Boxes) != 1 {
		t.Fatalf("boxes = %d, want 1", len(f.Boxes))
	}
	if f.Boxes[0].AdoptionRunning == nil || *f.Boxes[0].AdoptionRunning {
		t.Errorf("boxes[0].adoption_running = %v, want false — the row must name the box with the dead timer",
			f.Boxes[0].AdoptionRunning)
	}
}

// ---- Task 7: the exported box loader and the one staleness rule -------------

// TestLoadBoxesAndStaleness pins the two things the console's private host
// detail and `carlos status -live` both read the bucket through: LoadBoxes
// returns every snapshot WITH its private Metrics block intact (the merged
// public feed drops it — this loader must not), and BoxStale answers the same
// "older than 3 periods" question BuildFleet's own boxes table answers, so the
// two renderings can never disagree about which host is dark.
// oneFailingGet fails the read of one key and serves every other.
type oneFailingGet struct {
	release.Store
	key string
}

func (f oneFailingGet) Get(ctx context.Context, key string) ([]byte, string, error) {
	if key == f.key {
		return nil, "", errors.New("read timeout")
	}
	return f.Store.Get(ctx, key)
}

// LoadBoxesComplete returns what LoadBoxes returns and, separately, whether
// every listed snapshot was read: a failed GET or a corrupt body is a
// logged skip for LoadBoxes and an INCOMPLETE read here. The console's
// automatic region placement fails closed on it (nearest-region re-review
// r1): a box whose snapshot could not be read has unknown liveness, which
// is not stale.
func TestLoadBoxesCompleteReportsSkippedReads(t *testing.T) {
	ctx := context.Background()
	s := release.NewDirStore(t.TempDir())
	for _, label := range []string{"alpha", "beta"} {
		if err := status.WriteBox(ctx, s, status.Box{Label: label, GeneratedAt: time.Now()}); err != nil {
			t.Fatal(err)
		}
	}
	boxes, complete, err := status.LoadBoxesComplete(ctx, s)
	if err != nil || !complete || len(boxes) != 2 {
		t.Fatalf("clean store: %d boxes, complete %v, err %v; want 2, true, nil", len(boxes), complete, err)
	}
	boxes, complete, err = status.LoadBoxesComplete(ctx, oneFailingGet{Store: s, key: "status/boxes/beta.json"})
	if err != nil || complete || len(boxes) != 1 {
		t.Fatalf("one failed GET: %d boxes, complete %v, err %v; want 1 (alpha), false, nil", len(boxes), complete, err)
	}
	plain, err := status.LoadBoxes(ctx, oneFailingGet{Store: s, key: "status/boxes/beta.json"})
	if err != nil || len(plain) != 1 {
		t.Fatalf("LoadBoxes under the same failure: %d boxes, err %v; want the unchanged logged-skip behaviour", len(plain), err)
	}
	_, etag, err := s.Get(ctx, "status/boxes/beta.json")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := s.Put(ctx, "status/boxes/beta.json", []byte("{not json"), etag); err != nil {
		t.Fatal(err)
	}
	if boxes, complete, err := status.LoadBoxesComplete(ctx, s); err != nil || complete || len(boxes) != 1 {
		t.Fatalf("corrupt body: %d boxes, complete %v, err %v; want 1, false, nil", len(boxes), complete, err)
	}
	if _, complete, err := status.LoadBoxesComplete(ctx, release.NewDirStore(t.TempDir())); err != nil || !complete {
		t.Fatalf("empty prefix: complete %v, err %v; want true, nil", complete, err)
	}
}

func TestLoadBoxesAndStaleness(t *testing.T) {
	s := teststore(t)
	ctx := context.Background()
	now := time.Now()
	fresh := status.Box{GeneratedAt: now, Label: "ada-stargazing",
		Metrics: &status.BoxMetrics{Release: "abc1234", Tunnel: "connected"}}
	dark := status.Box{GeneratedAt: now.Add(-time.Hour), Label: "grace-kayaking"}
	for _, b := range []status.Box{fresh, dark} {
		if err := status.WriteBox(ctx, s, b); err != nil {
			t.Fatal(err)
		}
	}
	boxes, err := status.LoadBoxes(ctx, s)
	if err != nil || len(boxes) != 2 {
		t.Fatalf("LoadBoxes: %v, %d boxes", err, len(boxes))
	}
	for _, b := range boxes {
		wantStale := b.Label == "grace-kayaking"
		if got := status.BoxStale(b, now, 5*time.Minute); got != wantStale {
			t.Fatalf("%s: stale = %v, want %v", b.Label, got, wantStale)
		}
		if b.Label == "ada-stargazing" {
			if b.Metrics == nil || b.Metrics.Release != "abc1234" || b.Metrics.Tunnel != "connected" {
				t.Fatalf("LoadBoxes dropped the private metrics block: %+v", b.Metrics)
			}
		}
	}
}

// TestBoxStaleMatchesFleetBoxStale is the anti-drift assertion: whatever
// BoxStale says about a box must be exactly what BuildFleet publishes in that
// box's FleetBox.Stale — one rule, one constant, two renderings.
func TestBoxStaleMatchesFleetBoxStale(t *testing.T) {
	s := teststore(t)
	ctx := context.Background()
	now := time.Now()
	const period = 5 * time.Minute
	for _, b := range []status.Box{
		boxFixture("just-now", "plenty", now),
		boxFixture("two-periods", "plenty", now.Add(-2*period)),
		boxFixture("exactly-three", "plenty", now.Add(-3*period)),
		boxFixture("long-dark", "plenty", now.Add(-time.Hour)),
	} {
		if err := status.WriteBox(ctx, s, b); err != nil {
			t.Fatal(err)
		}
	}
	f, err := status.BuildFleet(ctx, s, nil, now, period)
	if err != nil {
		t.Fatal(err)
	}
	boxes, err := status.LoadBoxes(ctx, s)
	if err != nil {
		t.Fatal(err)
	}
	byLabel := map[string]bool{}
	for _, fb := range f.Boxes {
		byLabel[fb.Label] = fb.Stale
	}
	for _, b := range boxes {
		if got, want := status.BoxStale(b, now, period), byLabel[b.Label]; got != want {
			t.Errorf("%s: BoxStale = %v, FleetBox.Stale = %v — the rule has drifted", b.Label, got, want)
		}
	}
}

// A first-route claim materializes a ROUTE, not an alias. Without its stamps
// on the wire the console can never take it past "pending" — which is what
// `carlos deploy -kind static -host <site>` has always shown.
func TestCollectBoxCarriesRouteDNSStampsForNonPlatformRoutes(t *testing.T) {
	routes := []registry.Route{{
		Host: "story.customer.com", Status: "ready", App: "site",
		DNSStatus: "pointing", DNSCheckedAt: 1756300000, CertExpiresAt: 1764000000,
	}}
	box := status.CollectBox(routes, status.Probes{}, time.Unix(1756300060, 0))

	got, ok := box.Metrics.Aliases["story.customer.com"]
	if !ok {
		t.Fatal("a claim-backed route must publish a reading")
	}
	if got.DNSStatus != "pointing" || got.CertExpiresAt != 1764000000 {
		t.Fatalf("reading = %+v", got)
	}
	if got.Route != "story.customer.com" {
		t.Fatalf("Route = %q, want the host as its own primary (an empty claim route means exactly that)", got.Route)
	}
	if got.DNSCheckedAt != 1756300000 {
		t.Fatalf("DNSCheckedAt = %d, want the stamp's own age carried", got.DNSCheckedAt)
	}
}

// Platform routes are the deployment's own hosts, not custom domains, and
// they already have RouteVersions. Keep the map to what the domains surface
// actually joins against.
func TestCollectBoxOmitsPlatformRoutesFromReadings(t *testing.T) {
	routes := []registry.Route{
		{Host: "app.bdk.oncarlos.com", Status: "ready", Platform: true, DNSStatus: "pointing"},
		// A custom domain alongside it, so Metrics attaches at all: Box.Metrics
		// is a POINTER and stays nil when nothing is known (snapshot.go:485-510).
		// Without this row the assertion below would nil-panic rather than
		// testing anything.
		{Host: "shop.customer.com", Status: "ready", DNSStatus: "pointing", DNSCheckedAt: 1756300000},
	}
	box := status.CollectBox(routes, status.Probes{}, time.Unix(1756300060, 0))
	if box.Metrics == nil {
		t.Fatal("Metrics must attach once a custom domain has a reading")
	}
	if _, ok := box.Metrics.Aliases["app.bdk.oncarlos.com"]; ok {
		t.Fatal("a platform route must not appear in the hostname readings")
	}
	if _, ok := box.Metrics.Aliases["shop.customer.com"]; !ok {
		t.Fatal("the custom domain must appear")
	}
}

// TestCollectBoxCarriesRouteDBBytes: every non-platform, non-static route
// with a DBPath is sized through Probes.DBBytes into Metrics.RouteDBBytes. A
// route the probe cannot size is absent rather than 0, and the hostname never
// reaches the public fleet.json.
func TestCollectBoxCarriesRouteDBBytes(t *testing.T) {
	routes := []registry.Route{
		{Host: "sized.test", Kind: "instance", DBPath: "/data/sized.test.db"},
		{Host: "missing.test", Kind: "instance", DBPath: "/data/missing.test.db"},
		{Host: "nodb.test", Kind: "instance"},
		{Host: "static.test", Kind: "static", DBPath: "/data/static.test.db"},
		{Host: "platform.test", Kind: "instance", DBPath: "/data/sized.test.db", Platform: true},
	}
	var asked []string
	probe := func(p string) *int64 {
		asked = append(asked, p)
		if p == "/data/sized.test.db" {
			n := int64(4096)
			return &n
		}
		return nil
	}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", DBBytes: probe}, time.Now())
	if b.Metrics == nil {
		t.Fatal("metrics block missing — RouteDBBytes should have attached it")
	}
	if len(b.Metrics.RouteDBBytes) != 1 || b.Metrics.RouteDBBytes["sized.test"] != 4096 {
		t.Fatalf("route_db_bytes = %v, want exactly {sized.test: 4096}", b.Metrics.RouteDBBytes)
	}
	if strings.Join(asked, ",") != "/data/sized.test.db,/data/missing.test.db" {
		t.Errorf("probed %v, want only the two instance routes with a DBPath", asked)
	}

	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(ctx, s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(fj), "sized.test") {
		t.Errorf("fleet.json leaked a route_db_bytes hostname: %s", fj)
	}

	// No probe at all: nothing sized, and no Metrics block from this alone.
	if b := status.CollectBox(routes[:1], status.Probes{MachineID: "m"}, time.Now()); b.Metrics != nil {
		t.Errorf("metrics = %+v with no DBBytes probe, want absent", b.Metrics)
	}
}

// TestCollectBoxCarriesConfigRefusals (amadan #213): a box that refuses to
// take an instance because it cannot provide that instance's config says so
// in its private Metrics block, where an operator can see which hosts and
// why. The hostnames never reach the public fleet.json, and a box with no
// refusal carries no key at all.
func TestCollectBoxCarriesConfigRefusals(t *testing.T) {
	since := time.Date(2026, 10, 5, 9, 0, 0, 0, time.UTC)
	refusals := []status.ConfigRefusal{
		{Host: "refused-secret.example.com", Reason: "no_key", Since: since, Last: since.Add(time.Minute), Count: 3},
	}
	routes := []registry.Route{{Host: "refused-secret.example.com", Kind: "instance", Hibernate: true}}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", ConfigRefusals: refusals, ConfigRefusalsTotal: 5}, time.Now())
	if b.Metrics == nil {
		t.Fatal("metrics block missing: a refusal alone should attach it")
	}
	if got := b.Metrics.ConfigRefusals; len(got) != 1 || got[0] != refusals[0] {
		t.Fatalf("config_refusals = %+v, want %+v", got, refusals)
	}
	if b.Metrics.ConfigRefusalsTotal != 5 {
		t.Errorf("config_refusals_total = %d, want 5", b.Metrics.ConfigRefusalsTotal)
	}

	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(ctx, s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	for _, needle := range []string{"refused-secret.example.com", "no_key", "config_refusals"} {
		if strings.Contains(string(fj), needle) {
			t.Errorf("fleet.json leaked %q: %s", needle, fj)
		}
	}

	// Nothing refused: no Metrics block from this alone, no key on the wire.
	quiet := status.CollectBox(routes, status.Probes{MachineID: "m"}, time.Now())
	if quiet.Metrics != nil {
		t.Errorf("metrics = %+v with no refusal, want absent", quiet.Metrics)
	}
	raw, _ := json.Marshal(status.CollectBox(routes, status.Probes{MachineID: "m", MemTotalBytes: new(int64)}, time.Now()))
	if strings.Contains(string(raw), "config_refusals") {
		t.Errorf("a box with no refusal publishes config_refusals: %s", raw)
	}
}

// TestCollectBoxCarriesReleaseRefusals (D1): a box that rolled a build back
// says so in its private Metrics block, naming the host, version and reason.
// The hostname never reaches the public fleet.json, and a box with no
// refusal carries no key at all.
func TestCollectBoxCarriesReleaseRefusals(t *testing.T) {
	at := time.Date(2026, 10, 6, 9, 30, 40, 0, time.UTC)
	refusals := []status.ReleaseRefusal{
		{Host: "rolled-back.example.com", Version: "v2-secret-build", Reason: "exited: status=2", RefusedAt: at},
	}
	routes := []registry.Route{{Host: "rolled-back.example.com", Kind: "instance", Hibernate: true}}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", ReleaseRefusals: refusals}, time.Now())
	if b.Metrics == nil {
		t.Fatal("metrics block missing: a release refusal alone should attach it")
	}
	if got := b.Metrics.ReleaseRefusals; len(got) != 1 || got[0] != refusals[0] {
		t.Fatalf("release_refusals = %+v, want %+v", got, refusals)
	}

	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(ctx, s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	for _, needle := range []string{"rolled-back.example.com", "v2-secret-build", "exited: status=2", "release_refusals"} {
		if strings.Contains(string(fj), needle) {
			t.Errorf("fleet.json leaked %q: %s", needle, fj)
		}
	}

	quiet := status.CollectBox(routes, status.Probes{MachineID: "m"}, time.Now())
	if quiet.Metrics != nil {
		t.Errorf("metrics = %+v with no refusal, want absent", quiet.Metrics)
	}
	raw, _ := json.Marshal(status.CollectBox(routes, status.Probes{MachineID: "m", MemTotalBytes: new(int64)}, time.Now()))
	if strings.Contains(string(raw), "release_refusals") {
		t.Errorf("a box with no refusal publishes release_refusals: %s", raw)
	}
}

// TestCollectBoxCarriesProofWaits (D3): a box holding a host on its current
// build for a dev proof says so in its private Metrics block. The hostname
// and build never reach the public fleet.json, and a box with no wait carries
// no key at all.
func TestCollectBoxCarriesProofWaits(t *testing.T) {
	at := time.Date(2026, 10, 6, 9, 30, 40, 0, time.UTC)
	waits := []status.ProofWait{
		{Host: "waiting.example.com", Version: "v3-secret-build", SHA256: "e47fcc1e0123456789abcdef", Prover: "dev",
			Reason: "no proof from dev", Since: at},
	}
	routes := []registry.Route{{Host: "waiting.example.com", Kind: "instance", Hibernate: true}}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", ProofWaits: waits}, time.Now())
	if b.Metrics == nil {
		t.Fatal("metrics block missing: a proof wait alone should attach it")
	}
	if got := b.Metrics.ProofWaits; len(got) != 1 || got[0] != waits[0] {
		t.Fatalf("proof_waits = %+v, want %+v", got, waits)
	}

	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(ctx, s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	for _, needle := range []string{"waiting.example.com", "v3-secret-build", "e47fcc1e", "no proof from dev", "proof_waits"} {
		if strings.Contains(string(fj), needle) {
			t.Errorf("fleet.json leaked %q: %s", needle, fj)
		}
	}

	quiet := status.CollectBox(routes, status.Probes{MachineID: "m"}, time.Now())
	if quiet.Metrics != nil {
		t.Errorf("metrics = %+v with no wait, want absent", quiet.Metrics)
	}
	raw, _ := json.Marshal(status.CollectBox(routes, status.Probes{MachineID: "m", MemTotalBytes: new(int64)}, time.Now()))
	if strings.Contains(string(raw), "proof_waits") {
		t.Errorf("a box with no wait publishes proof_waits: %s", raw)
	}
}

// The config guard's bypass is visible in the private block, and only there.
func TestCollectBoxCarriesTheConfigGuardBypass(t *testing.T) {
	b := status.CollectBox(nil, status.Probes{MachineID: "m", ConfigGuard: "bypassed (CARLOS_NO_SEALED_CONFIG)"}, time.Now())
	if b.Metrics == nil || b.Metrics.ConfigGuard != "bypassed (CARLOS_NO_SEALED_CONFIG)" {
		t.Fatalf("metrics = %+v, want the bypass word", b.Metrics)
	}
	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	f, err := status.BuildFleet(ctx, s, nil, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, _ := json.Marshal(f)
	if strings.Contains(string(fj), "bypass") || strings.Contains(string(fj), "NO_SEALED") {
		t.Errorf("fleet.json carries the bypass: %s", fj)
	}
	if quiet := status.CollectBox(nil, status.Probes{MachineID: "m"}, time.Now()); quiet.Metrics != nil {
		t.Errorf("a box in the normal mode attached metrics: %+v", quiet.Metrics)
	}
}

// TestCollectBoxCarriesBuildStates (settings spec rev 11 §4.4): a box names
// the build-state builds of the instances it hosts in its private Metrics
// block, so the housekeeper can protect them. The hostnames and builds never
// reach the public fleet.json, and a box with none carries no key at all.
func TestCollectBoxCarriesBuildStates(t *testing.T) {
	pins := map[string]status.BuildStatePins{
		"held-secret.example.com": {Account: "bab", App: "km", Builds: []string{"v1-secret-build", "v2-secret-build"}, Complete: true},
	}
	routes := []registry.Route{{Host: "held-secret.example.com", Kind: "instance", Hibernate: true}}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", BuildStates: pins}, time.Now())
	if b.Metrics == nil {
		t.Fatal("metrics block missing: build states alone should attach it")
	}
	if got := b.Metrics.BuildStates; !reflect.DeepEqual(got, pins) {
		t.Fatalf("build_states = %+v, want %+v", got, pins)
	}

	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	boxes, complete, err := status.LoadBoxesComplete(ctx, s)
	if err != nil || !complete || len(boxes) != 1 || boxes[0].Metrics == nil || !reflect.DeepEqual(boxes[0].Metrics.BuildStates, pins) {
		t.Fatalf("read back %+v, %v, %v; want the build states", boxes, complete, err)
	}
	f, err := status.BuildFleet(ctx, s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	for _, needle := range []string{"held-secret.example.com", "v1-secret-build", "build_states"} {
		if strings.Contains(string(fj), needle) {
			t.Errorf("fleet.json leaked %q: %s", needle, fj)
		}
	}

	raw, _ := json.Marshal(status.CollectBox(routes, status.Probes{MachineID: "m", MemTotalBytes: new(int64)}, time.Now()))
	if strings.Contains(string(raw), "build_states") {
		t.Errorf("a box with no build states publishes build_states: %s", raw)
	}
}

// A box that could not collect its build states says so (Astra I2 #5): the
// error alone attaches the Metrics block, so the housekeeper reads "could not
// collect", never an absent map it might take for "nothing to protect".
func TestCollectBoxCarriesABuildStatesFailure(t *testing.T) {
	b := status.CollectBox(nil, status.Probes{MachineID: "m", BuildStatesErr: "listing routes for build states: database is locked"}, time.Now())
	if b.Metrics == nil || b.Metrics.BuildStatesErr != "listing routes for build states: database is locked" {
		t.Fatalf("metrics = %+v, want the collection failure", b.Metrics)
	}
	raw, _ := json.Marshal(b)
	if !strings.Contains(string(raw), `"build_states_err"`) {
		t.Fatalf("the failure is not published: %s", raw)
	}
}

// TestCollectBoxCarriesTheUpdateSettingsProtocolAndDecisions (settings spec
// §4.3, §4.4): a box that enforces update settings says so, and names root's
// last decision per instance in the private Metrics block. The protocol alone
// attaches the block (the console reads it to lift its refusal); the hosts
// and builds never reach the public fleet.json.
func TestCollectBoxCarriesTheUpdateSettingsProtocolAndDecisions(t *testing.T) {
	routes := []registry.Route{{Host: "decided-secret.example.com", Kind: "instance", Hibernate: true}}
	only := status.CollectBox(routes, status.Probes{MachineID: "m", UpdateSettings: status.UpdateSettingsProtocol}, time.Now())
	if only.Metrics == nil || only.Metrics.UpdateSettings != status.UpdateSettingsProtocol {
		t.Fatalf("metrics = %+v, want the protocol alone to attach the block", only.Metrics)
	}
	raw, _ := json.Marshal(only)
	if strings.Contains(string(raw), `"updates"`) {
		t.Errorf("a box with no decisions publishes updates: %s", raw)
	}

	two := 2
	ups := map[string]status.HostUpdates{
		"decided-secret.example.com": {Desired: "v-secret-desired", Reason: "major", Detail: "v1", Baking: "v-secret-baking", Major: &two, Pending: 3, Completed: 2, CompletedFailed: true,
			Account: "acct-secret-tenant", App: "app-secret-tenant"},
	}
	b := status.CollectBox(routes, status.Probes{MachineID: "m", Updates: ups}, time.Now())
	if b.Metrics == nil || !reflect.DeepEqual(b.Metrics.Updates, ups) {
		t.Fatalf("updates = %+v, want %+v", b.Metrics, ups)
	}
	s := teststore(t)
	ctx := context.Background()
	if err := status.WriteBox(ctx, s, b); err != nil {
		t.Fatal(err)
	}
	boxes, complete, err := status.LoadBoxesComplete(ctx, s)
	if err != nil || !complete || len(boxes) != 1 || boxes[0].Metrics == nil || !reflect.DeepEqual(boxes[0].Metrics.Updates, ups) {
		t.Fatalf("read back %+v, %v, %v; want the decisions", boxes, complete, err)
	}
	f, err := status.BuildFleet(ctx, s, routes, time.Now(), 5*time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	fj, _ := json.Marshal(f)
	for _, needle := range []string{"decided-secret.example.com", "v-secret-desired", "v-secret-baking", "acct-secret-tenant", "app-secret-tenant", `"updates"`, "update_settings"} {
		if strings.Contains(string(fj), needle) {
			t.Errorf("fleet.json leaked %q: %s", needle, fj)
		}
	}
}