package callstest

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"io"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"net/url"
	"strconv"
	"strings"
	"sync"
	"testing"
	"time"

	"amadan.net/oficina/calls/internal/calls"
	"gorm.io/gorm"
)

// mintAgent drives Settings as the signed-in member and hands back the
// token that page shows exactly once — the only way an agent token
// ever comes into existence, here as in production.
func mintAgent(t *testing.T, x *harness, c *client, name string) string {
	t.Helper()
	rec := c.post("/settings/agents", url.Values{"name": {name}})
	if rec.Code != http.StatusOK {
		t.Fatalf("POST /settings/agents: %d\n%s", rec.Code, rec.Body.String())
	}
	return extractToken(t, rec.Body.String())
}

// apiAuth is a request to the drive surface with a literal
// Authorization header and no cookies, and — deliberately — no Origin,
// Referer or Sec-Fetch-Site: an agent is not a browser and sends none
// of the three, which is exactly why /api/v1 mounts outside
// csrf.Protect (rastrillo's csrf.SameOrigin refuses a POST carrying
// none of them).
func apiAuth(t *testing.T, x *harness, method, target, authorization, body string) *httptest.ResponseRecorder {
	t.Helper()
	var rdr io.Reader
	if body != "" {
		rdr = strings.NewReader(body)
	}
	req := httptest.NewRequest(method, target, rdr)
	if authorization != "" {
		req.Header.Set("Authorization", authorization)
	}
	if body != "" {
		req.Header.Set("Content-Type", "application/json")
	}
	rec := httptest.NewRecorder()
	x.h.ServeHTTP(rec, req)
	return rec
}

// api is apiAuth with a bearer token.
func api(t *testing.T, x *harness, method, target, token, body string) *httptest.ResponseRecorder {
	t.Helper()
	return apiAuth(t, x, method, target, "Bearer "+token, body)
}

// apiBody asserts the status and the two headers every API answer
// carries, and decodes the JSON.
func apiBody(t *testing.T, rec *httptest.ResponseRecorder, want int) map[string]any {
	t.Helper()
	if rec.Code != want {
		t.Fatalf("status %d, want %d\n%s", rec.Code, want, rec.Body.String())
	}
	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
		t.Fatalf("Content-Type %q, want application/json", ct)
	}
	if cc := rec.Header().Get("Cache-Control"); cc != "no-store" {
		t.Fatalf("Cache-Control %q, want no-store", cc)
	}
	var out map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
		t.Fatalf("decode %q: %v", rec.Body.String(), err)
	}
	return out
}

func apiMeeting(t *testing.T, body map[string]any) map[string]any {
	t.Helper()
	m, ok := body["meeting"].(map[string]any)
	if !ok {
		t.Fatalf("no meeting object in %v", body)
	}
	return m
}

// apiMeetings is the list as the surface answers it, for the tests
// that assert a refused request changed nothing: the list afterwards
// is the state, read the same way an agent would read it.
func apiMeetings(t *testing.T, x *harness, token string) []any {
	t.Helper()
	list := apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings", token, ""), http.StatusOK)
	rows, ok := list["meetings"].([]any)
	if !ok {
		t.Fatalf("meetings %#v, want a list", list["meetings"])
	}
	return rows
}

func apiString(t *testing.T, m map[string]any, key string) string {
	t.Helper()
	s, ok := m[key].(string)
	if !ok {
		t.Fatalf("%s is %#v, want a string", key, m[key])
	}
	return s
}

// unknownSqid is the shape newSqid produces and a value it never has:
// a valid-looking room id belonging to no meeting.
const unknownSqid = "2345678999"

// Spec §8.1 and the slice's ruling: a cookie is never honoured on the
// API and the bearer is the only credential; a missing or malformed
// one is 401, while an unknown token is the not-found body — the same
// bytes an unknown meeting answers, so nothing about whether a token
// exists is observable.
func TestAPIRequiresABearerAndIgnoresCookies(t *testing.T) {
	x, _, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "scheduler")

	// The positive control first: the bearer alone, no cookie, works.
	apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings", token, ""), http.StatusOK)

	for _, tc := range []struct {
		name, header string
	}{
		{"no Authorization header at all", ""},
		{"a Basic credential", "Basic " + base64.StdEncoding.EncodeToString([]byte("paul@example.com:hunter2"))},
		{"the scheme without a token", "Bearer "},
		{"a token with no scheme", token},
	} {
		t.Run(tc.name, func(t *testing.T) {
			rec := apiAuth(t, x, http.MethodGet, "/api/v1/meetings", tc.header, "")
			body := apiBody(t, rec, http.StatusUnauthorized)
			if body["error"] != "unauthorized" {
				t.Fatalf("%v, want error unauthorized", body)
			}
		})
	}

	// A signed-in member's own cookie, carried exactly as the browser
	// carries it to every HTML screen, buys nothing here.
	t.Run("a session cookie alone", func(t *testing.T) {
		rec := c.get("/api/v1/meetings")
		body := apiBody(t, rec, http.StatusUnauthorized)
		if body["error"] != "unauthorized" {
			t.Fatalf("%v, want error unauthorized", body)
		}
	})

	// An unknown token and an unknown meeting are one 404, byte for
	// byte.
	unknownToken := api(t, x, http.MethodGet, "/api/v1/meetings", "nope", "")
	if unknownToken.Code != http.StatusNotFound {
		t.Fatalf("an unknown token: %d, want 404\n%s", unknownToken.Code, unknownToken.Body.String())
	}
	unknownMeeting := api(t, x, http.MethodGet, "/api/v1/meetings/"+unknownSqid, token, "")
	if unknownMeeting.Code != http.StatusNotFound {
		t.Fatalf("an unknown meeting: %d, want 404\n%s", unknownMeeting.Code, unknownMeeting.Body.String())
	}
	if unknownToken.Body.String() != unknownMeeting.Body.String() {
		t.Fatalf("the two 404s differ:\ntoken:   %q\nmeeting: %q",
			unknownToken.Body.String(), unknownMeeting.Body.String())
	}
	if got := apiBody(t, unknownMeeting, http.StatusNotFound)["error"]; got != "not-found" {
		t.Fatalf("not-found body carries error %v", got)
	}

	// A path this surface does not have answers the same not-found body
	// — and only to a caller that already holds a token, so the routes
	// cannot be mapped without one.
	if body := apiBody(t, api(t, x, http.MethodGet, "/api/v1/agents", token, ""), http.StatusNotFound); body["error"] != "not-found" {
		t.Fatalf("an unknown API path: %v, want the not-found body", body)
	}
	if body := apiBody(t, apiAuth(t, x, http.MethodGet, "/api/v1/agents", "", ""), http.StatusUnauthorized); body["error"] != "unauthorized" {
		t.Fatalf("an unknown API path without a bearer: %v, want unauthorized", body)
	}
	if body := apiBody(t, api(t, x, http.MethodDelete, "/api/v1/meetings", token, ""), http.StatusNotFound); body["error"] != "not-found" {
		t.Fatalf("a method this surface does not have: %v, want the not-found body", body)
	}
}

// The other half of the same ruling: an HTML route never honours a
// bearer. A token alone, with no session cookie, is simply a signed-out
// request.
func TestABearerOnAnHTMLRouteIsIgnored(t *testing.T) {
	x, _, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "scheduler")

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Header.Set("Authorization", "Bearer "+token)
	rec := httptest.NewRecorder()
	x.h.ServeHTTP(rec, req)
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/signin" {
		t.Fatalf("GET / with a bearer: %d → %q, want 303 → /signin\n%s",
			rec.Code, rec.Header().Get("Location"), rec.Body.String())
	}

	// And the API's own not-found handler stays on the API: an unknown
	// HTML path is still the router's plain 404, not a JSON body.
	miss := get(t, x.h, "/nope")
	if miss.Code != http.StatusNotFound {
		t.Fatalf("GET /nope: %d, want 404", miss.Code)
	}
	if ct := miss.Header().Get("Content-Type"); strings.Contains(ct, "json") {
		t.Fatalf("an unknown HTML path answers %q\n%s", ct, miss.Body.String())
	}
}

// Spec §8.1 and §13's slice-5 gate: reach is the operator's standing at
// the moment of the request, not at the moment the token was minted. An
// operator dropped from the team takes their agent's reach with them,
// with no revocation step, and gets it back the same way.
func TestAPIReachIsTheOperatorsStandingOnEveryRequest(t *testing.T) {
	x, _, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "scheduler")

	apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings", token, ""), http.StatusOK)

	x.ctl.SetAllowlist("bea@rslw.com")
	gone := api(t, x, http.MethodGet, "/api/v1/meetings", token, "")
	if body := apiBody(t, gone, http.StatusNotFound); body["error"] != "not-found" {
		t.Fatalf("an operator off the team: %v, want the not-found body", body)
	}
	unknown := api(t, x, http.MethodGet, "/api/v1/meetings", "nope", "")
	if gone.Body.String() != unknown.Body.String() {
		t.Fatalf("a reach-less token is distinguishable from an unknown one:\nreach:   %q\nunknown: %q",
			gone.Body.String(), unknown.Body.String())
	}

	x.ctl.SetAllowlist("paul@example.com", "paul@rslw.com")
	apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings", token, ""), http.StatusOK)

	id := agentRevokeID(t, c.get("/settings").Body.String())
	if rec := c.post("/settings/agents/"+id+"/revoke", nil); rec.Code != http.StatusSeeOther {
		t.Fatalf("revoke: %d\n%s", rec.Code, rec.Body.String())
	}
	revoked := api(t, x, http.MethodGet, "/api/v1/meetings", token, "")
	if body := apiBody(t, revoked, http.StatusNotFound); body["error"] != "not-found" {
		t.Fatalf("a revoked token: %v, want the not-found body", body)
	}
	if revoked.Body.String() != unknown.Body.String() {
		t.Fatalf("a revoked token is distinguishable from an unknown one:\nrevoked: %q\nunknown: %q",
			revoked.Body.String(), unknown.Body.String())
	}
}

// Spec §8.2, the whole surface in one run: the five operations, the two
// responses that carry a link token and no others, the admitted count
// while the meeting runs, and the 409 an ended meeting answers.
func TestAPIListsCreatesLinksAndEnds(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")

	created := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		`{"title":"Board meeting","starts_at":"2026-09-12T09:00:00Z"}`), http.StatusCreated)
	m := apiMeeting(t, created)
	sqid := apiString(t, m, "sqid")
	if apiString(t, m, "title") != "Board meeting" {
		t.Fatalf("title %v", m["title"])
	}
	if apiString(t, m, "starts_at") != "2026-09-12T09:00:00Z" {
		t.Fatalf("starts_at %v, want RFC 3339 in UTC", m["starts_at"])
	}
	if m["ended_at"] != nil {
		t.Fatalf("a new meeting has ended_at %v", m["ended_at"])
	}
	if m["link_present"] != true {
		t.Fatalf("link_present %v, want true", m["link_present"])
	}
	if apiString(t, m, "created_by") != "claude~paul@example.com" {
		t.Fatalf("created_by %v, want the agent's principal", m["created_by"])
	}
	link := apiString(t, created, "link")
	if !strings.HasPrefix(link, testOrigin+"/j/") {
		t.Fatalf("link %q, want the configured origin's /j/ URL", link)
	}
	if strings.Contains(link, token) {
		t.Fatal("the link carries the agent token rather than a link token")
	}

	// The meeting, before anyone is in the room. GET never carries a
	// link — that only ever rides on create and replace.
	got := apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+sqid, token, ""), http.StatusOK)
	if got["admitted"] != float64(0) {
		t.Fatalf("admitted %#v, want 0", got["admitted"])
	}
	if _, present := got["link"]; present {
		t.Fatalf("GET carries a link: %v", got)
	}

	// A member joins through the browser and is admitted on standing.
	s := c.stream("/m/" + sqid + "/stream")
	defer s.close()
	peer, _ := s.hello()
	c.signal(sqid, peer, `{"type":"join"}`)
	s.nextOf("roster", 2*time.Second)
	got = apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+sqid, token, ""), http.StatusOK)
	if got["admitted"] != float64(1) {
		t.Fatalf("admitted %#v with one member in the room, want 1", got["admitted"])
	}

	// Replacing the link hands back a new one and kills the old.
	replaced := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/links", token, ""), http.StatusOK)
	newLink := apiString(t, replaced, "link")
	if newLink == link {
		t.Fatal("replace handed back the same link")
	}
	oldToken := strings.TrimPrefix(link, testOrigin+"/j/")
	if rec := x.browser(t).get("/j/" + oldToken); rec.Code != http.StatusNotFound {
		t.Fatalf("the replaced link still works: %d", rec.Code)
	}

	// Ending: the meeting comes back ended, and without a live count or
	// a link — end never returns one.
	ended := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/end", token, ""), http.StatusOK)
	if _, present := ended["admitted"]; present {
		t.Fatalf("an ended meeting still reports admitted: %v", ended)
	}
	if _, present := ended["link"]; present {
		t.Fatalf("the end response carries a link: %v", ended)
	}
	em := apiMeeting(t, ended)
	if em["ended_at"] == nil {
		t.Fatalf("ended_at is null after end: %v", em)
	}
	if em["link_present"] != false {
		t.Fatalf("link_present %v after end, want false", em["link_present"])
	}

	// GET on the now-ended meeting still has no admitted count and no
	// link (the guard is m.EndedAt == nil, checked again independently
	// of the end response above).
	afterEnd := apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+sqid, token, ""), http.StatusOK)
	if _, present := afterEnd["admitted"]; present {
		t.Fatalf("GET on an ended meeting still reports admitted: %v", afterEnd)
	}
	if _, present := afterEnd["link"]; present {
		t.Fatalf("GET on an ended meeting carries a link: %v", afterEnd)
	}

	for _, target := range []string{"/api/v1/meetings/" + sqid + "/end", "/api/v1/meetings/" + sqid + "/links"} {
		body := apiBody(t, api(t, x, http.MethodPost, target, token, ""), http.StatusConflict)
		if body["error"] != "ended" {
			t.Fatalf("POST %s on an ended meeting: %v, want error ended", target, body)
		}
	}

	// And the list, which is what a second agent run would read.
	list := apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings", token, ""), http.StatusOK)
	rows, ok := list["meetings"].([]any)
	if !ok || len(rows) != 1 {
		t.Fatalf("meetings %#v, want one row", list["meetings"])
	}
	row := rows[0].(map[string]any)
	if apiString(t, row, "sqid") != sqid || apiString(t, row, "created_by") != "claude~paul@example.com" {
		t.Fatalf("list row %v", row)
	}
	if row["ended_at"] == nil {
		t.Fatalf("the listed row is not ended: %v", row)
	}
	if _, present := row["link"]; present {
		t.Fatalf("a list row carries a link: %v", row)
	}
	// The meeting object is exactly these six keys — never more, never
	// a link riding along on the list.
	wantKeys := []string{"sqid", "title", "starts_at", "ended_at", "link_present", "created_by"}
	if len(row) != len(wantKeys) {
		t.Fatalf("list row has %d keys, want %d: %v", len(row), len(wantKeys), row)
	}
	for _, k := range wantKeys {
		if _, ok := row[k]; !ok {
			t.Fatalf("list row is missing %q: %v", k, row)
		}
	}
	if strings.Contains(list["meetings"].([]any)[0].(map[string]any)["title"].(string), "mt_") {
		t.Fatal("a token leaked into the title")
	}
}

// Spec's Global Constraints: the body is a typed request read under a
// 16 KB cap with unknown fields refused, and a title is 1..200
// characters. Nothing here is ever bound onto a model.
func TestAPIBodyRules(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")

	for _, tc := range []struct {
		name, body string
		status     int
		err        string
	}{
		{"an unknown field", `{"title":"Standup","meeting_id":7}`, http.StatusBadRequest, "bad-request"},
		{"a title of 201 characters", `{"title":"` + strings.Repeat("a", 201) + `"}`, http.StatusBadRequest, "bad-request"},
		{"an empty title", `{"title":""}`, http.StatusBadRequest, "bad-request"},
		{"a whitespace title", `{"title":"   "}`, http.StatusBadRequest, "bad-request"},
		{"no title at all", `{}`, http.StatusBadRequest, "bad-request"},
		{"a start that is not RFC 3339", `{"title":"Standup","starts_at":"tomorrow"}`, http.StatusBadRequest, "bad-request"},
		{"a start in the form screen's own format", `{"title":"Standup","starts_at":"2026-09-12T09:00"}`, http.StatusBadRequest, "bad-request"},
		{"a title that is not a string", `{"title":7}`, http.StatusBadRequest, "bad-request"},
		{"trailing content after the object", `{"title":"Standup"} {}`, http.StatusBadRequest, "bad-request"},
		// Review S5-1: dec.More() answers "is another array or object
		// element waiting", which these three are not — they got
		// through and created meetings.
		{"a trailing close bracket", `{"title":"Standup"}]`, http.StatusBadRequest, "bad-request"},
		{"a trailing close brace", `{"title":"Standup"}}`, http.StatusBadRequest, "bad-request"},
		{"a trailing scalar", `{"title":"Standup"} 7`, http.StatusBadRequest, "bad-request"},
		{"no body at all", ``, http.StatusBadRequest, "bad-request"},
		{"seventeen kilobytes", `{"title":"` + strings.Repeat("a", 17*1024) + `"}`, http.StatusRequestEntityTooLarge, "too-large"},
		// And the size error survives a valid object: the excess is
		// whitespace the decoder would otherwise have skipped past
		// while swallowing the cap's own error (review S5-1).
		{"a valid object then seventeen kilobytes of space", `{"title":"Standup"}` + strings.Repeat(" ", 17*1024),
			http.StatusRequestEntityTooLarge, "too-large"},
	} {
		t.Run(tc.name, func(t *testing.T) {
			rec := api(t, x, http.MethodPost, "/api/v1/meetings", token, tc.body)
			body := apiBody(t, rec, tc.status)
			if body["error"] != tc.err {
				t.Fatalf("%v, want error %q", body, tc.err)
			}
			// A refused body writes nothing: no meeting exists yet, and
			// the refusal did not make one (review S5-1 — the shapes
			// above used to create meetings and answer 201).
			if n := len(apiMeetings(t, x, token)); n != 0 {
				t.Fatalf("a refused request left %d meetings behind", n)
			}
		})
	}

	// A title of exactly 200 characters is accepted: the boundary is
	// inclusive, and the refusals above are not simply "every title".
	edge := strings.Repeat("b", 200)
	created := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		`{"title":"`+edge+`"}`), http.StatusCreated)
	if apiString(t, apiMeeting(t, created), "title") != edge {
		t.Fatal("a 200-character title came back changed")
	}
	if apiMeeting(t, created)["starts_at"] != nil {
		t.Fatalf("an absent starts_at came back as %v", apiMeeting(t, created)["starts_at"])
	}

	// The 200-character boundary is runes, not bytes (matching the
	// create screen's own "characters" copy, handlers_meetings.go's
	// titleTooLong): 200 multibyte characters are accepted even though
	// they are 600 bytes, and 201 of them are refused exactly as 201
	// ASCII characters are.
	wideOK := strings.Repeat("字", 200)
	createdWide := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		string(mustJSON(t, map[string]string{"title": wideOK}))), http.StatusCreated)
	if apiString(t, apiMeeting(t, createdWide), "title") != wideOK {
		t.Fatal("a 200-rune title came back changed")
	}
	wideRefused := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		string(mustJSON(t, map[string]string{"title": strings.Repeat("字", 201)}))), http.StatusBadRequest)
	if wideRefused["error"] != "bad-request" {
		t.Fatalf("a 201-rune title: %v, want bad-request", wideRefused)
	}

	// A title is data, not markup: it is stored and listed as a plain
	// JSON string, escaped by the encoder and never by an HTML escaper.
	const scriptish = `<script>alert("x")</script>`
	apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		`{"title":`+string(mustJSON(t, scriptish))+`}`), http.StatusCreated)
	rec := api(t, x, http.MethodGet, "/api/v1/meetings", token, "")
	list := apiBody(t, rec, http.StatusOK)
	var found bool
	for _, row := range list["meetings"].([]any) {
		if row.(map[string]any)["title"] == scriptish {
			found = true
		}
	}
	if !found {
		t.Fatalf("the title did not survive the round trip:\n%s", rec.Body.String())
	}
	if strings.Contains(rec.Body.String(), "<script>") {
		t.Fatalf("the raw JSON carries an unescaped tag:\n%s", rec.Body.String())
	}
}

// Review S5-9: the cap is 16,384 bytes and the boundary is inclusive —
// http.MaxBytesReader refuses only when reading encounters a byte
// *beyond* the limit, so a body of exactly 16,384 is within it and
// 16,385 is not. Nothing asserted this before: the other body tests all
// use 17 KB, which is comfortably past the edge and says nothing about
// where the edge is. Both surfaces that read a body are pinned here,
// and the two answer differently on the inside of the boundary: a
// create of exactly the cap is a 201 (its padding is JSON whitespace),
// a bodyless write of exactly the cap is a 400 (it takes no body at
// all) — and one byte more is 413 on both.
func TestAPIBodyCapBoundary(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")

	const limit = 16 * 1024
	create := `{"title":"Standup"}`
	atCap := create + strings.Repeat(" ", limit-len(create))
	overCap := atCap + " "
	if len(atCap) != limit || len(overCap) != limit+1 {
		t.Fatalf("the bodies are %d and %d bytes, want %d and %d", len(atCap), len(overCap), limit, limit+1)
	}

	created := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token, atCap), http.StatusCreated)
	if got := apiString(t, apiMeeting(t, created), "title"); got != "Standup" {
		t.Fatalf("title %q, want Standup", got)
	}
	sqid := apiString(t, apiMeeting(t, created), "sqid")
	if body := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token, overCap), http.StatusRequestEntityTooLarge); body["error"] != "too-large" {
		t.Fatalf("one byte over the cap: %v, want too-large", body)
	}

	// The bodyless writes measure the same cap, and refuse a body of
	// any size — so at the cap they answer 400 for its content and over
	// it 413 for its size.
	for _, op := range []string{"links", "end"} {
		if body := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/"+op, token, atCap), http.StatusBadRequest); body["error"] != "bad-request" {
			t.Fatalf("%s at exactly the cap: %v, want bad-request", op, body)
		}
		if body := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/"+op, token, overCap), http.StatusRequestEntityTooLarge); body["error"] != "too-large" {
			t.Fatalf("%s one byte over the cap: %v, want too-large", op, body)
		}
	}

	// And the refusals wrote nothing: the meeting made by the create at
	// the cap is still running, with its first link.
	m := apiMeeting(t, apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+sqid, token, ""), http.StatusOK))
	if m["ended_at"] != nil || m["link_present"] != true {
		t.Fatalf("a refused body changed the meeting: %v", m)
	}
}

// Review S5-7: requiring EOF after the object is not requiring the
// object to be the last byte. Whitespace is not content — a trailing
// newline is what most tools put on the end of a file, and curl
// --data-binary @file sends it — so a create that ends in one is a 201,
// and so is one padded with spaces and tabs. This is deliberately
// *not* the bodyless rule: `links` and `end` take no body at all, and a
// single space there is a 400 (TestAPIBodylessWritesRefuseABody). The
// asymmetry is that a create's body is parsed as JSON, where trailing
// whitespace is part of the grammar, and the other two are not parsed
// at all.
func TestAPICreateAcceptsTrailingWhitespace(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")

	for _, tc := range []struct{ name, body string }{
		{"a trailing newline", `{"title":"Standup"}` + "\n"},
		{"trailing whitespace", `{"title":"Standup"}` + " \t\r\n  "},
		{"whitespace on both sides", "\n  " + `{"title":"Standup"}` + "\n"},
	} {
		t.Run(tc.name, func(t *testing.T) {
			created := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token, tc.body), http.StatusCreated)
			if got := apiString(t, apiMeeting(t, created), "title"); got != "Standup" {
				t.Fatalf("title %q, want Standup", got)
			}
		})
	}
}

// Review S5-1: `/links` and `/end` take no body, and until this fix
// they read none either — so the 16 KB cap did not apply to them and a
// megabyte posted at `/end` performed the write. Now every request on
// the surface is capped by the group's own middleware, and the two
// bodyless writes refuse anything they are sent: over the cap is 413,
// any other content is 400, and both answer before the write.
func TestAPIBodylessWritesRefuseABody(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")

	created := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		`{"title":"Standup"}`), http.StatusCreated)
	sqid := apiString(t, apiMeeting(t, created), "sqid")
	link := apiString(t, created, "link")

	oversize := strings.Repeat("a", 17*1024)
	for _, tc := range []struct {
		name, op, body string
		status         int
		err            string
	}{
		{"a JSON object at links", "links", `{"title":"x"}`, http.StatusBadRequest, "bad-request"},
		{"a JSON object at end", "end", `{}`, http.StatusBadRequest, "bad-request"},
		{"a single space at links", "links", ` `, http.StatusBadRequest, "bad-request"},
		{"a single space at end", "end", ` `, http.StatusBadRequest, "bad-request"},
		{"seventeen kilobytes at links", "links", oversize, http.StatusRequestEntityTooLarge, "too-large"},
		{"seventeen kilobytes at end", "end", oversize, http.StatusRequestEntityTooLarge, "too-large"},
	} {
		t.Run(tc.name, func(t *testing.T) {
			body := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/"+tc.op, token, tc.body), tc.status)
			if body["error"] != tc.err {
				t.Fatalf("%v, want error %q", body, tc.err)
			}
			// Nothing was written: the meeting still runs and still has
			// exactly the link it was created with.
			m := apiMeeting(t, apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+sqid, token, ""), http.StatusOK))
			if m["ended_at"] != nil {
				t.Fatalf("a refused %s ended the meeting: %v", tc.op, m)
			}
			if m["link_present"] != true {
				t.Fatalf("a refused %s left no live link: %v", tc.op, m)
			}
		})
	}

	// The link the meeting was created with is still the live one: a
	// refused replace minted nothing that could have taken its place.
	if rec := x.browser(t).get("/j/" + strings.TrimPrefix(link, testOrigin+"/j/")); rec.Code == http.StatusNotFound {
		t.Fatal("the original link stopped working after the refusals")
	}

	// The positive control: with no body at all, both writes work.
	replaced := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/links", token, ""), http.StatusOK)
	if apiString(t, replaced, "link") == link {
		t.Fatal("replace handed back the same link")
	}
	ended := apiMeeting(t, apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/end", token, ""), http.StatusOK))
	if ended["ended_at"] == nil {
		t.Fatalf("a bodyless end did not end the meeting: %v", ended)
	}
}

// Review S5-2: both write handlers used to decide "has this meeting
// ended?" from a read taken before the store's transaction, so two
// requests could each read a running meeting and each go on to write.
// The decision now lives inside the write — a conditional UPDATE for
// end, a re-read of ended_at inside the transaction for replace.
//
// This is a smoke test and not a proof (review S5-6). Closing one
// channel makes both goroutines runnable; it does not make either read
// the running meeting before the other writes, and the schedule where
// the first request finishes before the second reads at all satisfies
// every assertion below under the old code too. What it does check is
// that two requests arriving together answer sanely and leave the row
// consistent — worth having, and worth being honest about. The
// interleaving that actually exposes the defect is forced, one read at
// a time, in TestAPIAStaleReadCannotWriteOverAnEnd.
func TestAPIConcurrentEndsAndReplacesSeeTheEndedRow(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")

	// Two ends at once: one 200, one 409, never two of either.
	first := apiString(t, apiMeeting(t, apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		`{"title":"Standup"}`), http.StatusCreated)), "sqid")
	ends := race(t, x, token,
		http.MethodPost, "/api/v1/meetings/"+first+"/end",
		http.MethodPost, "/api/v1/meetings/"+first+"/end")
	codes := []int{ends[0].Code, ends[1].Code}
	if !(codes[0] == http.StatusOK && codes[1] == http.StatusConflict) &&
		!(codes[1] == http.StatusOK && codes[0] == http.StatusConflict) {
		t.Fatalf("two racing ends answered %d and %d, want one 200 and one 409\n%s\n%s",
			codes[0], codes[1], ends[0].Body.String(), ends[1].Body.String())
	}
	for _, rec := range ends {
		if rec.Code == http.StatusConflict {
			if body := apiBody(t, rec, http.StatusConflict); body["error"] != "ended" {
				t.Fatalf("the losing end: %v, want error ended", body)
			}
		}
	}

	// An end and a replacement at once: the replacement either wins
	// outright or is refused as ended, and either way the meeting ends
	// with no live link.
	second := apiString(t, apiMeeting(t, apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		`{"title":"Retro"}`), http.StatusCreated)), "sqid")
	both := race(t, x, token,
		http.MethodPost, "/api/v1/meetings/"+second+"/end",
		http.MethodPost, "/api/v1/meetings/"+second+"/links")
	if both[0].Code != http.StatusOK {
		t.Fatalf("the end lost to the replacement: %d\n%s", both[0].Code, both[0].Body.String())
	}
	if both[1].Code != http.StatusOK && both[1].Code != http.StatusConflict {
		t.Fatalf("the racing replacement: %d, want 200 or 409\n%s", both[1].Code, both[1].Body.String())
	}
	m := apiMeeting(t, apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+second, token, ""), http.StatusOK))
	if m["ended_at"] == nil {
		t.Fatalf("the meeting is not ended after the race: %v", m)
	}
	if m["link_present"] != false {
		t.Fatalf("an ended meeting still has a live link: %v — the replacement landed after the end", m)
	}
}

// Review S5-6: the interleaving that broke both writes, forced rather
// than hoped for. One request is held at the exact point the old code
// went wrong — just after its handler has read the meeting and found it
// running — while a second request ends the meeting and commits. Only
// then is the held request let go, so it reaches its write with a
// snapshot that is now stale, which is the state the old handlers
// trusted.
//
// Under the shipped code both refusals come from inside the write:
// end's conditional UPDATE changes no row, replace's re-read of
// ended_at inside its transaction answers errMeetingEnded, and both
// are 409. Under the old code the held end wrote a second time and
// answered 200, and the held replacement minted a link on a meeting
// that had already ended — both of which this test fails on, every
// run. Proved by mutation: see the round-2 report.
func TestAPIAStaleReadCannotWriteOverAnEnd(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")
	installMeetingReadStall(t, x)

	for _, op := range []string{"end", "links"} {
		t.Run("a stalled "+op, func(t *testing.T) {
			sqid := apiString(t, apiMeeting(t, apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
				`{"title":"Standup"}`), http.StatusCreated)), "sqid")

			// The held request reads the running meeting, then waits.
			// goStalledAPI registers the cleanup that lets it go before
			// it ever starts, so a failure in any assertion below leaves
			// nothing blocked (review S5-8).
			held := goStalledAPI(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/"+op, token)
			held.waitReached(t)

			// With that read held, the meeting ends and commits.
			apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/end", token, ""), http.StatusOK)

			// And now the held request runs on into its write.
			body := apiBody(t, held.response(t), http.StatusConflict)
			if body["error"] != "ended" {
				t.Fatalf("the stalled %s: %v, want error ended", op, body)
			}

			m := apiMeeting(t, apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+sqid, token, ""), http.StatusOK))
			if m["ended_at"] == nil {
				t.Fatalf("the meeting is not ended: %v", m)
			}
			if m["link_present"] != false {
				t.Fatalf("an ended meeting has a live link: %v — the stalled %s wrote over the end", m, op)
			}
		})
	}
}

// stallKey marks a request whose first `meetings` read should block.
// The value is the request's own stall, so the callback stalls only the
// request the test built, and only once.
type stallKey struct{}

type stall struct {
	reached    chan struct{}
	releasing  chan struct{}
	holding    sync.Once
	releasing1 sync.Once
}

func newStall() *stall {
	return &stall{reached: make(chan struct{}), releasing: make(chan struct{})}
}

// release lets the held request go, and may be called any number of
// times (review S5-8): the test calls it on its way to the response,
// and the cleanup calls it again in case the test never got that far.
func (s *stall) release() { s.releasing1.Do(func() { close(s.releasing) }) }

// stallWait bounds every wait in this test. Long enough that a loaded
// machine does not trip it, short enough that a regression is a named
// failure here rather than the package timeout killing the whole run
// with a goroutine dump (review S5-8).
const stallWait = 5 * time.Second

// installMeetingReadStall registers a test-only GORM callback on the
// harness's own *gorm.DB — the seam the round-1 report wrongly said did
// not exist (review S5-3's note, review S5-6's correction) — and takes
// it off again when the test ends.
//
// It runs after gorm:query, so the rows are already scanned and closed
// and the held request is holding no connection: the request that ends
// the meeting behind it can use the same pool. It fires only for a
// request carrying a stall in its context and only for the `meetings`
// table, which on these paths is the handler's own meetingBySqid — the
// read the old code went on to trust. sync.Once keeps it to that first
// read, so the meeting read inside replaceLink's transaction, later in
// the same request, runs unimpeded.
func installMeetingReadStall(t *testing.T, x *harness) {
	t.Helper()
	const name = "callstest:stall_meeting_read"
	err := x.db.G.Callback().Query().After("gorm:query").Register(name, func(tx *gorm.DB) {
		if tx.Statement.Context == nil || tx.Statement.Table != "meetings" {
			return
		}
		s, ok := tx.Statement.Context.Value(stallKey{}).(*stall)
		if !ok {
			return
		}
		s.holding.Do(func() {
			close(s.reached)
			<-s.releasing
		})
	})
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = x.db.G.Callback().Query().Remove(name) })
}

// heldRequest is one bodyless API request running on its own goroutine
// and stalled at its meeting read. Nothing is asserted on that
// goroutine — t.Fatalf from one is not allowed — so the recorder comes
// back to the test's own goroutine through done.
type heldRequest struct {
	stall *stall
	done  chan *httptest.ResponseRecorder

	joined   sync.Once
	rec      *httptest.ResponseRecorder
	stuck    bool
	reported bool
}

// goStalledAPI starts the request, having first registered the cleanup
// that releases and joins it (review S5-8). Order matters: a t.Fatal in
// any assertion between here and the response would otherwise skip the
// release and leave the request parked on the stall channel for the
// rest of the package run, since removing the callback does not unblock
// one already inside it.
func goStalledAPI(t *testing.T, x *harness, method, target, token string) *heldRequest {
	t.Helper()
	h := &heldRequest{stall: newStall(), done: make(chan *httptest.ResponseRecorder, 1)}
	t.Cleanup(func() {
		h.join()
		if h.stuck && !h.reported {
			h.reported = true
			t.Errorf("the held %s %s never finished", method, target)
		}
	})
	req := httptest.NewRequest(method, target, nil)
	req.Header.Set("Authorization", "Bearer "+token)
	req = req.WithContext(context.WithValue(req.Context(), stallKey{}, h.stall))
	go func() {
		rec := httptest.NewRecorder()
		x.h.ServeHTTP(rec, req)
		h.done <- rec
	}()
	return h
}

// waitReached blocks until the request has made its meeting read and is
// being held. A request that never makes one would hang the test, so
// this gives up and says so instead.
func (h *heldRequest) waitReached(t *testing.T) {
	t.Helper()
	select {
	case <-h.stall.reached:
	case <-time.After(stallWait):
		t.Fatal("the request never reached its meeting read")
	}
}

// join releases the held request and waits for it, at most once.
func (h *heldRequest) join() {
	h.joined.Do(func() {
		h.stall.release()
		select {
		case h.rec = <-h.done:
		case <-time.After(stallWait):
			h.stuck = true
		}
	})
}

// response is join for a caller that wants the answer: the same wait,
// bounded the same way, failing here rather than in the cleanup.
func (h *heldRequest) response(t *testing.T) *httptest.ResponseRecorder {
	t.Helper()
	h.join()
	if h.stuck {
		h.reported = true
		t.Fatal("the held request never finished")
	}
	return h.rec
}

// race fires two API requests from two goroutines released together,
// and hands back both recorders. Nothing is asserted in the goroutines
// — t.Fatalf from one is not allowed — so every check happens on the
// test's own goroutine afterwards.
func race(t *testing.T, x *harness, token, m1, t1, m2, t2 string) [2]*httptest.ResponseRecorder {
	t.Helper()
	var out [2]*httptest.ResponseRecorder
	start := make(chan struct{})
	var wg sync.WaitGroup
	for i, call := range [2][2]string{{m1, t1}, {m2, t2}} {
		wg.Add(1)
		go func() {
			defer wg.Done()
			req := httptest.NewRequest(call[0], call[1], nil)
			req.Header.Set("Authorization", "Bearer "+token)
			rec := httptest.NewRecorder()
			<-start
			x.h.ServeHTTP(rec, req)
			out[i] = rec
		}()
	}
	close(start)
	wg.Wait()
	return out
}

func mustJSON(t *testing.T, v any) []byte {
	t.Helper()
	b, err := json.Marshal(v)
	if err != nil {
		t.Fatal(err)
	}
	return b
}

// Spec §0.1 and §8.1: the API's own log lines name the agent and the
// outcome, and nothing else. No token, no hash, no link, no title.
func TestAPILogsCarryNoToken(t *testing.T) {
	var buf bytes.Buffer
	x := newHarnessWithLogger(t, calls.EnvDevelopment,
		slog.New(slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: slog.LevelDebug})),
		"paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")

	// Success is silent, measured around each successful operation
	// rather than before the first one (review S5-3: the mark used to
	// be taken *after* the create, so a line logged by every successful
	// create would have gone unnoticed). silent runs the operation and
	// asserts nothing at all was logged by it.
	silent := func(what string, op func()) {
		t.Helper()
		mark := buf.Len()
		op()
		if n := strings.Count(buf.String()[mark:], "calls: api"); n != 0 {
			t.Fatalf("%s logged %d api lines, want none:\n%s", what, n, buf.String()[mark:])
		}
	}

	var created map[string]any
	silent("a successful create", func() {
		created = apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
			`{"title":"Quarterly review"}`), http.StatusCreated)
	})
	link := apiString(t, created, "link")
	linkToken := strings.TrimPrefix(link, testOrigin+"/j/")
	sqid := apiString(t, apiMeeting(t, created), "sqid")

	silent("a successful list", func() {
		apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings", token, ""), http.StatusOK)
	})
	silent("a successful read", func() {
		apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+sqid, token, ""), http.StatusOK)
	})
	var replaced map[string]any
	silent("a successful link replacement", func() {
		replaced = apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/links", token, ""), http.StatusOK)
	})
	newLinkToken := strings.TrimPrefix(apiString(t, replaced, "link"), testOrigin+"/j/")
	silent("a successful end", func() {
		apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/end", token, ""), http.StatusOK)
	})

	before := buf.Len()
	apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings/"+unknownSqid, token, ""), http.StatusNotFound)
	apiAuth(t, x, http.MethodGet, "/api/v1/meetings", "", "")
	api(t, x, http.MethodGet, "/api/v1/meetings", "nope", "")

	log := buf.String()
	// The operator's own address is a secret this log has no business
	// carrying either (review S5-3): the agent is named by id, and the
	// principal that spells out an operator's address is a rendering
	// for a member's screen, not a log field.
	for _, secret := range []string{token, meetHash(token), linkToken, newLinkToken, "Quarterly review", "paul@example.com"} {
		if secret != "" && strings.Contains(log, secret) {
			t.Fatalf("the log carries a secret (%q):\n%s", secret, log)
		}
	}
	if !strings.Contains(log[before:], "outcome") {
		t.Fatalf("no refusal was logged at all:\n%s", log[before:])
	}
	if !strings.Contains(log[before:], "agent_id") {
		t.Fatalf("a resolved agent's refusal carries no agent_id:\n%s", log[before:])
	}
	// And the refusals log one line each, no more.
	if n := strings.Count(log[before:], "calls: api"); n != 3 {
		t.Fatalf("want exactly three api log lines (one per refusal), got %d:\n%s", n, log[before:])
	}
}

// meetHash is the token hash exactly as the store stores it — hex of
// the SHA-256 of the token, mt_ prefix included — recomputed here
// because callstest is an external test package and cannot call
// hashAgentToken. If the two ever disagree this assertion goes quiet
// rather than wrong, which is why the plaintext token is checked
// alongside it.
func meetHash(token string) string {
	sum := sha256.Sum256([]byte(token))
	return hex.EncodeToString(sum[:])
}

// Spec's Global Constraints: sixty requests a minute per agent, burst
// sixty, and the budget is the agent's own — a second agent minted by
// the same operator is untouched by the first's exhaustion.
func TestAPIRateLimitsPerAgent(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	first := mintAgent(t, x, c, "claude")
	second := mintAgent(t, x, c, "scheduler")

	for i := range 60 {
		rec := api(t, x, http.MethodGet, "/api/v1/meetings", first, "")
		if rec.Code != http.StatusOK {
			t.Fatalf("request %d: %d\n%s", i+1, rec.Code, rec.Body.String())
		}
	}
	rec := api(t, x, http.MethodGet, "/api/v1/meetings", first, "")
	body := apiBody(t, rec, http.StatusTooManyRequests)
	if body["error"] != "rate" {
		t.Fatalf("%v, want error rate", body)
	}
	ra := rec.Header().Get("Retry-After")
	if n, err := strconv.Atoi(ra); err != nil || n < 1 {
		t.Fatalf("Retry-After %q, want a positive number of seconds", ra)
	}

	apiBody(t, api(t, x, http.MethodGet, "/api/v1/meetings", second, ""), http.StatusOK)
}

// Spec §8.1: every write an agent makes is marked as the agent's on the
// list the member reads, with the robot badge and the principal. The
// assertion belongs to this file; the badge itself is Task 4's.
func TestAPIWritesAreMarkedAsTheAgents(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	token := mintAgent(t, x, c, "claude")

	// Neutral titles on both rows (review S5-4): the old agent row was
	// called "Agent meeting", so searching the row for "Agent" passed
	// on the title alone and an empty badge would have gone unnoticed.
	created := apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", token,
		`{"title":"Quarterly review"}`), http.StatusCreated)
	sqid := apiString(t, apiMeeting(t, created), "sqid")
	createMeeting(t, c, "Standup", "")

	body := c.get("/").Body.String()
	agentRow := rowFor(t, body, "Quarterly review")
	memberRow := rowFor(t, body, "Standup")
	if !strings.Contains(agentRow, "claude~paul@example.com") {
		t.Fatalf("the agent's meeting shows no principal:\n%s", agentRow)
	}
	if !strings.Contains(agentRow, "lucide-bot") {
		t.Fatalf("the agent's meeting shows no robot badge:\n%s", agentRow)
	}
	// The icon is decorative (aria-hidden); the badge's own word is
	// what a screen reader actually gets — so the assertion is on the
	// badge element's own text, not on the row containing the word
	// somewhere.
	if got := badgeText(t, agentRow); got != "Agent" {
		t.Fatalf("the badge reads %q, want \"Agent\":\n%s", got, agentRow)
	}
	if strings.Contains(memberRow, "lucide-bot") || strings.Contains(memberRow, "~") {
		t.Fatalf("a member's own meeting is badged as an agent's:\n%s", memberRow)
	}
	if strings.Contains(memberRow, "rst-badge") || strings.Contains(memberRow, "Agent") {
		t.Fatalf("a member's own meeting carries an agent badge:\n%s", memberRow)
	}

	// A create is not the only write an agent makes (review S5-4): the
	// replacement link and the end record the acting agent too, in the
	// same actor shape, read straight out of the rows.
	agentID := agentRevokeID(t, c.get("/settings").Body.String())
	wantActor := "agent:" + agentID

	apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/links", token, ""), http.StatusOK)
	var linkActor string
	if err := x.sqlDB().QueryRow(
		`SELECT created_by FROM meeting_links WHERE meeting_id = (SELECT id FROM meetings WHERE sqid = ?) AND revoked_at IS NULL`,
		sqid).Scan(&linkActor); err != nil {
		t.Fatal(err)
	}
	if linkActor != wantActor {
		t.Fatalf("the replacement link's created_by is %q, want %q", linkActor, wantActor)
	}

	apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings/"+sqid+"/end", token, ""), http.StatusOK)
	var endActor string
	if err := x.sqlDB().QueryRow(`SELECT ended_by FROM meetings WHERE sqid = ?`, sqid).Scan(&endActor); err != nil {
		t.Fatal(err)
	}
	if endActor != wantActor {
		t.Fatalf("the meeting's ended_by is %q, want %q", endActor, wantActor)
	}

	// And the member's own meeting records a person, not an agent — so
	// the two assertions above are about the actor and not about every
	// write recording the same string.
	var memberActor string
	if err := x.sqlDB().QueryRow(`SELECT created_by FROM meetings WHERE sqid <> ?`, sqid).Scan(&memberActor); err != nil {
		t.Fatal(err)
	}
	if !strings.HasPrefix(memberActor, "person:") {
		t.Fatalf("the member's own meeting records %q, want a person actor", memberActor)
	}
}

// badgeText is the text inside the first ui/badge span of a fragment —
// <span rst-badge>Agent</span> — so a badge that renders empty fails
// the assertion the way a missing one does (review S5-4).
func badgeText(t *testing.T, fragment string) string {
	t.Helper()
	i := strings.Index(fragment, "<span rst-badge")
	if i < 0 {
		t.Fatalf("no badge element:\n%s", fragment)
	}
	rest := fragment[i:]
	open := strings.Index(rest, ">")
	end := strings.Index(rest, "</span>")
	if open < 0 || end < 0 || end < open {
		t.Fatalf("the badge element is not closed:\n%s", fragment)
	}
	return rest[open+1 : end]
}

// Spec §8.1's principal is per agent, not per operator: two agents
// minted by the same member must not share a label on the list. This
// pins meetingViewOfCached's label cache key at m.CreatedBy — keying
// it on anything coarser (a constant, the operator) would let the
// first-resolved agent's principal leak onto the second's row.
func TestListShowsEachAgentsOwnPrincipal(t *testing.T) {
	x := newHarness(t, "paul@example.com")
	c := x.browser(t)
	c.signIn("paul@example.com")
	tokenA := mintAgent(t, x, c, "agent-a")
	tokenB := mintAgent(t, x, c, "agent-b")

	apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", tokenA,
		`{"title":"Meeting A"}`), http.StatusCreated)
	apiBody(t, api(t, x, http.MethodPost, "/api/v1/meetings", tokenB,
		`{"title":"Meeting B"}`), http.StatusCreated)

	body := c.get("/").Body.String()
	rowA := rowFor(t, body, "Meeting A")
	rowB := rowFor(t, body, "Meeting B")
	if !strings.Contains(rowA, "agent-a~paul@example.com") {
		t.Fatalf("agent-a's meeting shows the wrong principal:\n%s", rowA)
	}
	if strings.Contains(rowA, "agent-b~paul@example.com") {
		t.Fatalf("agent-a's meeting also shows agent-b's principal:\n%s", rowA)
	}
	if !strings.Contains(rowB, "agent-b~paul@example.com") {
		t.Fatalf("agent-b's meeting shows the wrong principal:\n%s", rowB)
	}
	if strings.Contains(rowB, "agent-a~paul@example.com") {
		t.Fatalf("agent-b's meeting also shows agent-a's principal:\n%s", rowB)
	}
}

// rowFor is one meeting's list row (rst-row) on the list page, so a
// badge can be attributed to the meeting it is actually on rather than
// to the page.
func rowFor(t *testing.T, body, title string) string {
	t.Helper()
	i := strings.Index(body, title)
	if i < 0 {
		t.Fatalf("%q is not on the list:\n%s", title, body)
	}
	start := strings.LastIndex(body[:i], "<div rst-row>")
	end := strings.Index(body[i:], "<div rst-row>")
	if end < 0 {
		end = strings.Index(body[i:], "</section>")
	}
	if start < 0 || end < 0 {
		t.Fatalf("%q is not inside a list row:\n%s", title, body)
	}
	return body[start : i+end]
}