package main

// The delta has exactly one job — say what changed — and there are two ways to
// fail at it that no single test can cover, because a fix for either is the
// cause of the other:
//
//	MISSES IT    the swapped binary reads as unrelated new-and-gone rows, the
//	             new cron line reads as nothing at all, and the product does not
//	             do the thing it says on the box.
//	CRIES WOLF   a service restart, an apt upgrade, the bastion's own harness
//	             run, or a shell command that lived a second each land in the
//	             findings, and by the second week nobody opens the list.
//
// Every test below is one of those two, named for the behaviour rather than the
// function, so a mutation that breaks the behaviour fails a test whose name
// says what was lost.

import (
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

// ── helpers ─────────────────────────────────────────────────────────────────

func procEntry(digest, user, unit, shape string) baselineEntry {
	return baselineEntry{
		FP:        baselineFP("process", digest, user, unit, shape),
		Kind:      "process",
		ExeDigest: digest, Exe: "/usr/bin/thing", User: user, Unit: unit, ArgvShape: shape,
	}
}

func schedBaseEntry(user, unit, shape string) baselineEntry {
	return baselineEntry{
		FP:   baselineFP("scheduler", "", user, unit, shape),
		Kind: "scheduler", User: user, Unit: unit, ArgvShape: shape,
	}
}

func liveOf(e baselineEntry, pids ...int) deltaLiveEntry {
	return deltaLiveEntry{Entry: e, PIDs: pids}
}

func eventsOfKind(evs []deltaEvent, kind string) []deltaEvent {
	out := []deltaEvent{}
	for _, e := range evs {
		if e.Kind == kind {
			out = append(out, e)
		}
	}
	return out
}

func freshState(t *testing.T) *deltaState {
	t.Helper()
	return &deltaState{Version: deltaStateVersion, Baseline: "b"}
}

// ── missing it ──────────────────────────────────────────────────────────────

// THE CENTRAL CLAIM OF THE WHOLE PLANE. A binary replaced at a post the
// accounting already knows about must be ONE event that says so, carrying both
// digests. Reported as a `proc_new` plus a `proc_gone` it is two rows nobody
// connects, and the design's own `proc_changed` — "same fingerprint, new exe
// digest" — cannot fire at all, because the digest is inside the fingerprint.
func TestASwappedBinaryAtAKnownPostIsOneChangedEventNotTwoHalves(t *testing.T) {
	was := procEntry("aaaaaaaaaaaa", "root", "web.service", "node server.js")
	now := procEntry("bbbbbbbbbbbb", "root", "web.service", "node server.js")
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(now, 41)})
	changed := eventsOfKind(evs, deltaProcChanged)
	if len(changed) != 1 {
		t.Fatalf("a replaced binary produced %d proc_changed events, want 1:\n%+v", len(changed), evs)
	}
	if changed[0].Reason != deltaReasonExeDigest {
		t.Errorf("reason = %q, want %q", changed[0].Reason, deltaReasonExeDigest)
	}
	if changed[0].Was == nil || changed[0].Was.ExeDigest != "aaaaaaaaaaaa" {
		t.Error("the event does not carry what was there before, so a reader cannot " +
			"see what the binary was replaced FROM")
	}
	if n := len(eventsOfKind(evs, deltaProcNew)); n != 0 {
		t.Errorf("%d proc_new events as well — the swap was reported twice, as two "+
			"unrelated halves of one sentence", n)
	}
	if n := len(eventsOfKind(evs, deltaProcGone)); n != 0 {
		t.Errorf("%d proc_gone events as well — same defect from the other side", n)
	}
}

// A program that was never there, in a place nothing was, is NEW. This is the
// other side of the slot rule: it must not be swallowed as a change to
// something else.
func TestAProgramInAPlaceNothingWasReadsAsNew(t *testing.T) {
	was := procEntry("aaaa", "root", "web.service", "node server.js")
	now := procEntry("cccc", "user", "interactive", "/tmp/<tmp> --x")
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(was, 1), liveOf(now, 99)})
	if n := len(eventsOfKind(evs, deltaProcNew)); n != 1 {
		t.Fatalf("got %d proc_new, want 1:\n%+v", n, evs)
	}
	if n := len(eventsOfKind(evs, deltaProcChanged)); n != 0 {
		t.Errorf("the unrelated program was reported as a change to a known one (%d events)", n)
	}
}

// A PROCESS THE ACCOUNTING ALREADY HOLDS THAT HAS STARTED TALKING TO A MODEL.
// Endpoints are deliberately not fingerprinted (baseline.go), so this entry's
// fingerprint is unchanged and this is the only place the fact can be caught.
func TestAKnownProgramThatStartsTalkingToAModelIsReported(t *testing.T) {
	was := procEntry("aaaa", "user", "interactive", "python3 x.py")
	now := was
	now.Endpoints = []string{"api.anthropic.com"}
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(now, 7)})
	changed := eventsOfKind(evs, deltaProcChanged)
	if len(changed) != 1 || changed[0].Reason != deltaReasonEndpoint {
		t.Fatalf("a known process that began talking to a model produced %+v", evs)
	}
	if len(changed[0].Added) != 1 || changed[0].Added[0] != "api.anthropic.com" {
		t.Errorf("the event does not name the endpoint that is new: %+v", changed[0].Added)
	}
	if got := deltaLevel(changed[0]); got != deltaHigh {
		t.Errorf("level = %q, want high — a model endpoint is high", got)
	}
}

// The same endpoints in a different order are not a finding. A scan returns
// connections in whatever order the kernel had them.
func TestTheSameEndpointsInAnotherOrderAreNotAFinding(t *testing.T) {
	was := procEntry("aaaa", "user", "interactive", "python3 x.py")
	was.Endpoints = []string{"api.anthropic.com", "api.openai.com"}
	now := was
	now.Endpoints = []string{"API.OpenAI.com", "api.anthropic.com"}
	if evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(now, 7)}); len(evs) != 0 {
		t.Errorf("re-ordered endpoints produced %d events: %+v", len(evs), evs)
	}
}

// A STANDING JOB IS ITS OWN SLOT. Editing what an existing crontab line runs is
// the persistence move, and it must read as a change to that job — not as an
// unrelated job appearing while another vanishes.
func TestAnEditedCronLineIsAChangeToThatJob(t *testing.T) {
	was := schedBaseEntry("root", "cron:/etc/crontab:4", "/usr/bin/backup.sh")
	now := schedBaseEntry("root", "cron:/etc/crontab:4", "curl <hex> | sh")
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(now)})
	changed := eventsOfKind(evs, deltaSchedChanged)
	if len(changed) != 1 || changed[0].Reason != deltaReasonCommand {
		t.Fatalf("an edited cron line produced %+v", evs)
	}
	if n := len(eventsOfKind(evs, deltaSchedNew)) + len(eventsOfKind(evs, deltaSchedGone)); n != 0 {
		t.Errorf("it was ALSO reported as %d new/gone events — one edit, two rows", n)
	}
}

// A brand new standing job that would run a recognised agent is the persistence
// form of "a new process with an agent signature", which the level table puts at high.
func TestANewScheduledJobRunningAnAgentIsHigh(t *testing.T) {
	plain := deltaEvent{Kind: deltaSchedNew, Entry: schedBaseEntry("root", "cron:x:1", "/usr/bin/backup.sh")}
	agent := deltaEvent{Kind: deltaSchedNew}
	agent.Entry = schedBaseEntry("root", "cron:x:2", "claude -p go")
	agent.Entry.Signature = "claude-code"
	if got := deltaLevel(plain); got != deltaWarn {
		t.Errorf("an ordinary new job is %q, want warn", got)
	}
	if got := deltaLevel(agent); got != deltaHigh {
		t.Errorf("a new job that would start an agent is %q, want high", got)
	}
}

// ── crying wolf ─────────────────────────────────────────────────────────────

// AN UNREADABLE EXECUTABLE IS NOT A SWAPPED ONE. Both produce "the digests
// differ", and one of them is a security finding while the other is this
// process not being able to look. Getting this wrong fills the list with
// alarms every time a scan runs with fewer rights than the accounting did.
func TestLosingSightOfABinaryIsNotReportedAsASwap(t *testing.T) {
	was := procEntry("aaaaaaaaaaaa", "root", "web.service", "node server.js")
	now := procEntry("", "root", "web.service", "node server.js")
	now.DigestNote = "could not be read by this account"
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(now, 3)})
	changed := eventsOfKind(evs, deltaProcChanged)
	if len(changed) != 1 {
		t.Fatalf("got %+v", evs)
	}
	if changed[0].Reason != deltaReasonUnreadable {
		t.Fatalf("reason = %q, want %q — this is a visibility change, not a machine change",
			changed[0].Reason, deltaReasonUnreadable)
	}
	if got := deltaLevel(changed[0]); got != deltaNotice {
		t.Errorf("level = %q, want notice", got)
	}
}

// A packaged binary is ordinary; a packaged binary talking to a model is not.
// The tier must lower the first and never the second — a noise filter that can
// hide the finding is worse than no filter.
func TestTheTierLowersAnOrdinaryNewProgramAndNeverOneTalkingToAModel(t *testing.T) {
	plain := deltaEvent{Kind: deltaProcNew, Entry: procEntry("aaaa", "root", "svc", "thing")}
	if got := deltaLevel(plain); got != deltaWarn {
		t.Errorf("an unexplained new program is %q, want warn", got)
	}
	plain.Tier = tierKnown
	if got := deltaLevel(plain); got != deltaNotice {
		t.Errorf("an explained new program is %q, want notice", got)
	}
	talking := plain
	talking.Entry.Endpoints = []string{"api.anthropic.com"}
	if got := deltaLevel(talking); got != deltaHigh {
		t.Fatalf("a KNOWN-tier program talking to a model is %q, want high. The package "+
			"database shipping /usr/bin/python3 says nothing about what it is doing.", got)
	}
	signed := plain
	signed.Entry.Signature = "claude-code"
	if got := deltaLevel(signed); got != deltaHigh {
		t.Fatalf("a KNOWN-tier program with an agent signature is %q, want high", got)
	}
}

// THE BASTION'S OWN UPDATE MUST NOT BE A CRITICAL. Every machine on this fleet
// takes published updates; a critical that fires on each one is a critical
// nobody reads by the third. A digest that moved WITHOUT the version is the
// swap, and stays critical.
func TestABastionUpdateIsHighAndASilentSwapIsCritical(t *testing.T) {
	upd := deltaBinaryEvent("aaaa", "0.27.0", "bbbb", "0.28.0")
	if upd == nil || upd.Level != deltaHigh {
		t.Fatalf("a bastion self-update levelled %+v, want high", upd)
	}
	swap := deltaBinaryEvent("aaaa", "0.27.0", "bbbb", "0.27.0")
	if swap == nil || swap.Level != deltaCritical {
		t.Fatalf("a binary replaced under the SAME version levelled %+v, want critical", swap)
	}
	if same := deltaBinaryEvent("aaaa", "0.27.0", "aaaa", "0.27.0"); same != nil {
		t.Error("an unchanged binary produced an event")
	}
	if blind := deltaBinaryEvent("", "", "aaaa", "0.27.0"); blind != nil {
		t.Error("a baseline that recorded no digest produced a change event — there is " +
			"nothing to compare, and an absent record is not a difference")
	}
}

// AND THE CRITICAL RUNG SURVIVES THE FIRST LEGITIMATE UPDATE. Compared against
// the ACCOUNTING's version — which nothing retakes when the bastion updates
// itself — every machine on an auto-updating fleet is permanently "newer than
// its baseline", so every later digest change reads as another update and comes
// out high. The rung was disarmed by the very event its own justification was
// written around.
func TestASwapAfterALegitimateUpdateIsStillCritical(t *testing.T) {
	// The accounting was taken at 0.27.0/aaaa. The fleet updates.
	upd := deltaBinaryEvent("aaaa", "0.27.0", "bbbb", "0.28.0")
	if upd == nil || upd.Level != deltaHigh {
		t.Fatalf("the update levelled %+v, want high", upd)
	}
	// Days later, still 0.28.0, and the binary moves again. Compared against
	// what the LAST PASS saw, this is the swap.
	swap := deltaBinaryEvent("bbbb", "0.28.0", "cccc", "0.28.0")
	if swap == nil || swap.Level != deltaCritical {
		t.Fatalf("a binary replaced under an unchanged version, after an earlier update, "+
			"levelled %+v — want critical. Comparing against the accounting's frozen "+
			"version is what switches this rung off for good.", swap)
	}
}

// AN ABSENCE IS NOT A FINDING ON THE STRENGTH OF ONE SCAN. A service restart,
// an upgrade that stops and starts a unit, a reboot: each makes the accounting
// briefly wrong, and reporting on the first miss reports all three.
func TestAnAbsenceIsOnlyReportedOnceItHasOutlastedARestart(t *testing.T) {
	gone := deltaEvent{Kind: deltaProcGone, FP: "fp1"}
	st := freshState(t)
	t0 := time.Now()
	if out := deltaApplyGrace([]deltaEvent{gone}, st, t0); len(out) != 0 {
		t.Fatalf("the FIRST miss was reported: %+v", out)
	}
	if out := deltaApplyGrace([]deltaEvent{gone}, st, t0.Add(deltaGoneGrace-time.Minute)); len(out) != 0 {
		t.Fatalf("an absence inside the grace was reported: %+v", out)
	}
	out := deltaApplyGrace([]deltaEvent{gone}, st, t0.Add(deltaGoneGrace+time.Minute))
	if len(out) != 1 {
		t.Fatalf("an absence past the grace was NOT reported: %+v", out)
	}
	if out[0].FirstSeen == "" {
		t.Error("the reported absence does not say when it started")
	}
}

// A service that bounces must not accumulate. Without clearing the clock when
// it comes back, the SECOND bounce is measured from the first and reports gone
// immediately — for ever after.
func TestAServiceThatComesBackResetsItsClock(t *testing.T) {
	gone := deltaEvent{Kind: deltaProcGone, FP: "fp1"}
	st := freshState(t)
	t0 := time.Now()
	deltaApplyGrace([]deltaEvent{gone}, st, t0)
	deltaApplyGrace(nil, st, t0.Add(time.Minute)) // it is back: no gone event this pass
	if out := deltaApplyGrace([]deltaEvent{gone}, st, t0.Add(deltaGoneGrace+time.Minute)); len(out) != 0 {
		t.Fatalf("after coming back and going again it reported immediately, timed from "+
			"the FIRST disappearance: %+v", out)
	}
}

// A baseline entry whose post is now filled by something else is already
// reported as the change at that post. Reporting it gone as well makes one
// event into two halves of the same sentence — the exact defect the slot key
// exists to remove.
func TestAReplacedEntryIsNotAlsoReportedGone(t *testing.T) {
	was := procEntry("aaaa", "root", "web.service", "node server.js")
	now := procEntry("bbbb", "root", "web.service", "node server.js")
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(now, 5)})
	if n := len(eventsOfKind(evs, deltaProcGone)); n != 0 {
		t.Errorf("%d gone events beside the change: %+v", n, evs)
	}
}

// ── the noise filter ────────────────────────────────────────────────────────

// A PROGRAM REPORTING ITS OWN WORK AS AN INTRUSION IS IGNORED BY WEEK TWO. The
// bastion runs harnesses, labs and session shells; all of them are below it in
// the process tree and none of them is a finding.
func TestWhatThisBastionItselfStartedIsNotAFinding(t *testing.T) {
	ev := deltaEvent{Kind: deltaProcNew, FP: "fp1", PIDs: []int{300},
		Entry: procEntry("aaaa", "root", "svc", "harness run")}
	n := deltaNoise{Self: 100, Parents: map[int]int{300: 200, 200: 100}, Sockets: true}
	findings, filtered := deltaFilter([]deltaEvent{ev}, n, freshState(t), time.Now())
	if len(findings) != 0 || len(filtered) != 1 {
		t.Fatalf("a grandchild of this bastion was reported: findings=%+v", findings)
	}
	if filtered[0].Filtered != deltaFilterBastion {
		t.Errorf("filtered for %q, want %q", filtered[0].Filtered, deltaFilterBastion)
	}
	// And a process that merely SHARES a fingerprint with one of ours is still
	// the user's: `every`, not `any`.
	ev.PIDs = []int{300, 999}
	findings, _ = deltaFilter([]deltaEvent{ev}, n, freshState(t), time.Now())
	if len(findings) != 1 {
		t.Error("an entry with a process that is NOT ours was filtered anyway — a " +
			"binary the bastion runs and the user also runs is still the user's")
	}
}

// Short-lived work is counted, not reported — and only once it has proved it
// was short-lived by being gone next time.
func TestSomethingThatCameAndWentIsCountedNotReported(t *testing.T) {
	st := freshState(t)
	young := deltaEvent{Kind: deltaProcNew, FP: "fp1", PIDs: []int{7},
		Entry: procEntry("aaaa", "user", "interactive", "ls")}
	n := deltaNoise{Self: 1, Parents: map[int]int{7: 2}, Sockets: true,
		Age: func(int) (time.Duration, bool) { return time.Second, true }}
	findings, filtered := deltaFilter([]deltaEvent{young}, n, st, time.Now())
	if len(findings) != 0 || len(filtered) != 1 {
		t.Fatalf("a one-second-old process was reported: %+v", findings)
	}
	if st.ShortLived != 0 {
		t.Error("it was counted while still running — it has not proved anything yet")
	}
	// Next pass: it is gone.
	if _, _ = deltaFilter(nil, n, st, time.Now()); st.ShortLived != 1 {
		t.Errorf("short-lived count = %d, want 1 — the storm counter never moved", st.ShortLived)
	}
	// And one that is still there next pass is a finding after all.
	st2 := freshState(t)
	deltaFilter([]deltaEvent{young}, n, st2, time.Now())
	n.Age = func(int) (time.Duration, bool) { return time.Hour, true }
	findings, _ = deltaFilter([]deltaEvent{young}, n, st2, time.Now())
	if len(findings) != 1 {
		t.Error("a process that survived was still being held back")
	}
	if st2.ShortLived != 0 {
		t.Error("something that survived was counted as short-lived")
	}
}

// The short-lived rule's exemptions are not optional: whatever opened a listening socket or
// reached a model endpoint in its first seconds is the most interesting thing
// on the box, not the least. And where the socket table could not be read at
// all, the rule does not fire — an exemption that cannot be checked is not one.
func TestTheShortLivedRuleNeverSwallowsAListenerOrAModelEndpoint(t *testing.T) {
	base := deltaNoise{Self: 1, Parents: map[int]int{7: 2}, Sockets: true,
		Age: func(int) (time.Duration, bool) { return time.Second, true }}
	young := deltaEvent{Kind: deltaProcNew, FP: "fp1", PIDs: []int{7},
		Entry: procEntry("aaaa", "user", "interactive", "x")}

	talking := young
	talking.Entry.Endpoints = []string{"api.anthropic.com"}
	if f, _ := deltaFilter([]deltaEvent{talking}, base, freshState(t), time.Now()); len(f) != 1 {
		t.Error("a process talking to a model was filtered for being young")
	}
	listening := base
	listening.Listening = map[int]bool{7: true}
	if f, _ := deltaFilter([]deltaEvent{young}, listening, freshState(t), time.Now()); len(f) != 1 {
		t.Error("a process holding a listening socket was filtered for being young")
	}
	blind := base
	blind.Sockets = false
	if f, _ := deltaFilter([]deltaEvent{young}, blind, freshState(t), time.Now()); len(f) != 1 {
		t.Error("the rule fired on a box that could not read its socket table, so it " +
			"could not know whether the exemption applied")
	}
	ageless := base
	ageless.Age = func(int) (time.Duration, bool) { return 0, false }
	if f, _ := deltaFilter([]deltaEvent{young}, ageless, freshState(t), time.Now()); len(f) != 1 {
		t.Error("the rule fired where the platform cannot read a process age — an " +
			"unknown age was treated as a young one")
	}
}

// BEING STARTED BY SOMETHING IN THE ACCOUNTING CHANGES NOTHING ABOUT A FINDING,
// and this is the test for a rule that was BUILT, MEASURED AND THEN TAKEN OUT.
//
// Measured on a live machine: with the parent rule lowering the
// tier, a brand-new root-owned binary at /tmp/brandnewthing and a swapped
// binary at a known post both came out as `notice` — because each had been
// started from a shell that was running when the accounting was taken. On a
// real machine nearly everything is a child of something that was already
// running, so the design's rule minus its declared-children set is not a noise
// filter, it is a way to lose the two findings that matter most.
func TestBeingStartedByAKnownProcessDoesNotLowerAFinding(t *testing.T) {
	ev := deltaEvent{Kind: deltaProcNew, FP: "fp1", PIDs: []int{300},
		Entry: procEntry("aaaa", "root", "web.service", "sh -c curl")}
	n := deltaNoise{Self: 1, Parents: map[int]int{300: 200}, BaselinePIDs: map[int]bool{200: true},
		Sockets: true}
	findings, filtered := deltaFilter([]deltaEvent{ev}, n, freshState(t), time.Now())
	if len(findings) != 1 {
		t.Fatalf("a child of a baseline process was REMOVED from the findings (%d filtered). "+
			"Without the declared children set that is the attack being hidden.", len(filtered))
	}
	if findings[0].Tier == tierKnown {
		t.Fatal("a new program was lowered to `known` for having been started by a " +
			"process that was already running. Every interactive program on a machine " +
			"is a child of a shell that was already running.")
	}
	if got := deltaLevel(findings[0]); got != deltaWarn {
		t.Errorf("level = %q, want warn — nothing here explains the program away", got)
	}
	// The fact still travels, because it is real context for whoever reads it.
	var said bool
	for _, e := range findings[0].Evidence {
		if e.Signal == "child-of-baseline" {
			said = true
			if e.Tier != tierAmbiguous {
				t.Errorf("the evidence line is tier %q; a signal that explains nothing "+
					"must annotate and never promote", e.Tier)
			}
		}
	}
	if !said {
		t.Error("the parentage was dropped entirely — it is context a reader wants even " +
			"though it changes no level")
	}
}

// The package database lowers a row and names the package that shipped it.
func TestAPackagedBinaryIsLoweredAndSaysWhichPackage(t *testing.T) {
	ev := deltaEvent{Kind: deltaProcNew, FP: "fp1", PIDs: []int{300},
		Entry: procEntry("aaaa", "root", "svc", "thing")}
	n := deltaNoise{Self: 1, Parents: map[int]int{300: 2}, Sockets: true,
		Packaged: func(paths []string) map[string]string {
			return map[string]string{paths[0]: "coreutils"}
		}}
	findings, _ := deltaFilter([]deltaEvent{ev}, n, freshState(t), time.Now())
	if len(findings) != 1 || findings[0].Tier != tierKnown {
		t.Fatalf("a packaged binary was not lowered: %+v", findings)
	}
	var said bool
	for _, e := range findings[0].Evidence {
		if strings.Contains(e.Value, "coreutils") {
			said = true
		}
	}
	if !said {
		t.Error("the evidence does not name the package, so the reader cannot check it")
	}
}

// Absences and the bastion's own binary have no process to explain away, and
// must never be filtered as if they did.
func TestAnAbsenceIsNeverFilteredAsNoise(t *testing.T) {
	evs := []deltaEvent{
		{Kind: deltaProcGone, FP: "a"},
		{Kind: deltaBinaryChanged, FP: "b", Level: deltaCritical},
	}
	n := deltaNoise{Self: 1, Parents: map[int]int{}, Sockets: true}
	findings, filtered := deltaFilter(evs, n, freshState(t), time.Now())
	if len(findings) != 2 || len(filtered) != 0 {
		t.Fatalf("findings=%d filtered=%d, want 2 and 0", len(findings), len(filtered))
	}
}

// ── the bookkeeping ─────────────────────────────────────────────────────────

// RETAKING THE ACCOUNTING REDEFINES NORMAL, so every clock kept against the old
// one is timing something that is no longer being compared.
func TestRetakingTheAccountingThrowsAwayTheOldClocks(t *testing.T) {
	isolateConfigDir(t)
	st := &deltaState{Version: deltaStateVersion, Baseline: "digest-one"}
	st.setMissingSince("fp1", time.Now().Add(-time.Hour))
	if err := st.save(); err != nil {
		t.Fatal(err)
	}
	if again := deltaStateLoad("digest-one"); len(again.MissingSince) != 1 {
		t.Fatalf("the state did not survive a save/load: %+v", again)
	}
	after := deltaStateLoad("digest-two")
	if len(after.MissingSince) != 0 {
		t.Error("a clock from the OLD accounting was carried into the new one — a " +
			"process missing from a baseline nobody is comparing against any more " +
			"would report gone the moment the new one was taken")
	}
}

// The state file is the bastion's own, and nothing else's business.
func TestTheDeltaStateIsWrittenPrivate(t *testing.T) {
	dir := isolateConfigDir(t)
	st := &deltaState{Version: deltaStateVersion, Baseline: "d", dirty: true}
	if err := st.save(); err != nil {
		t.Fatal(err)
	}
	fi, err := os.Stat(filepath.Join(dir, "delta-state.json"))
	if err != nil {
		t.Fatal(err)
	}
	if fi.Mode().Perm() != 0o600 {
		t.Errorf("mode %v, want 0600", fi.Mode().Perm())
	}
}

// A corrupt bookkeeping file costs one pass of memory, never the feature.
func TestACorruptStateFileDoesNotStopTheDelta(t *testing.T) {
	dir := isolateConfigDir(t)
	if err := os.MkdirAll(dir, 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(dir, "delta-state.json"), []byte("{not json"), 0o600); err != nil {
		t.Fatal(err)
	}
	st := deltaStateLoad("d")
	if st == nil || st.Version != deltaStateVersion {
		t.Fatalf("a truncated bookkeeping file stopped the plane: %+v", st)
	}
}

// ── the wiring ──────────────────────────────────────────────────────────────

// A BOX WITH NO ACCOUNTING MUST NOT READ AS A BOX WITH NOTHING TO REPORT.
// Zero findings and "nobody ever said what normal is here" are opposite facts
// and they render identically unless the state travels with the counts.
func TestABoxWithNoAccountingSaysSoRatherThanReportingZero(t *testing.T) {
	isolateConfigDir(t)
	if !processIsRoot() {
		t.Skip("the pass refuses without machine authority, which is its own test")
	}
	r := deltaPass(&digestCache{}, time.Now(), deltaRoleOperator)
	if r.Baseline != deltaBaselineNone {
		t.Fatalf("baseline = %q, want %q", r.Baseline, deltaBaselineNone)
	}
	s := r.summary()
	if s.Baseline != deltaBaselineNone {
		t.Errorf("the summary that rides the beat says %q", s.Baseline)
	}
	if len(r.Findings) != 0 {
		t.Errorf("it reported %d findings against an accounting that does not exist", len(r.Findings))
	}
}

// AN ACCOUNTING TAKEN UNDER OTHER FINGERPRINT RULES REPORTS THE WHOLE MACHINE.
// baselineVersion is bumped exactly so old entries cannot match new ones, which
// makes the first pass after such a bump 188 findings that are all one fact
// about a software upgrade. One sentence asking for a retake is the answer.
func TestAnAccountingFromOlderRulesIsNotComparedAtAll(t *testing.T) {
	dir := isolateConfigDir(t)
	if !processIsRoot() {
		t.Skip("the pass refuses without machine authority, which is its own test")
	}
	if err := os.MkdirAll(dir, 0o700); err != nil {
		t.Fatal(err)
	}
	old := baselineFile{Version: "privatae-baseline-v0", TakenAt: "2026-01-01T00:00:00Z",
		Coverage: "processes=all,schedulers=all",
		Entries:  []baselineEntry{procEntry("aaaa", "root", "svc", "thing")}}
	if err := baselineSave(old); err != nil {
		t.Fatal(err)
	}
	r := deltaPass(&digestCache{}, time.Now(), deltaRoleOperator)
	if r.Baseline != deltaBaselineStale {
		t.Fatalf("baseline = %q, want %q", r.Baseline, deltaBaselineStale)
	}
	if len(r.Findings) != 0 {
		t.Fatalf("it reported %d findings against an accounting it cannot compare with", len(r.Findings))
	}
	if !strings.Contains(strings.Join(r.Notes, " "), "taken again") {
		t.Errorf("the notes do not say what to do about it: %v", r.Notes)
	}
}

// The delta refuses to run without machine authority rather than producing a
// page of false findings from a view of the box the accounting never had.
func TestWithoutMachineAuthorityThePassSaysSoInsteadOfGuessing(t *testing.T) {
	if processIsRoot() {
		t.Skip("this test is about the unprivileged path; run the suite as a user for it")
	}
	r := deltaPass(&digestCache{}, time.Now(), deltaRoleOperator)
	if r.Baseline != deltaBaselineNoAuth {
		t.Fatalf("baseline = %q, want %q", r.Baseline, deltaBaselineNoAuth)
	}
}

// THE SUMMARY REACHES THE HOST. A detection plane whose result never leaves the
// box is a detection plane nobody has. This holds the wiring — that
// buildHeartbeatBody actually carries what deltaPayload publishes — rather than
// only that the two functions exist.
func TestTheFindingsSummaryRidesTheHeartbeat(t *testing.T) {
	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
	deltaMu.Lock()
	deltaLast = &deltaSummary{Baseline: deltaBaselineOK, High: 2, Critical: 1,
		NewSince: "2026-09-14T22:00:00Z"}
	deltaMu.Unlock()
	t.Cleanup(func() {
		deltaMu.Lock()
		deltaLast = nil
		deltaMu.Unlock()
	})
	body := buildHeartbeatBody("", "box", "linux", "test", "pub", "fp", "", "", false, nil, nil, nil)
	for _, want := range []string{`"findings"`, `"critical":1`, `"high":2`, `"baseline":"ok"`} {
		if !strings.Contains(body, want) {
			t.Fatalf("the heartbeat does not carry %s:\n%s", want, body)
		}
	}
}

// Before the first pass completes there is no key at all, the way posture does
// it — an absent field is a host that keeps what it had, and a zeroed one is a
// host told this machine is clean.
func TestNoSummaryTravelsBeforeTheFirstPass(t *testing.T) {
	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
	deltaMu.Lock()
	deltaLast = nil
	deltaMu.Unlock()
	if body := buildHeartbeatBody("", "box", "linux", "test", "pub", "fp", "", "", false, nil, nil, nil); strings.Contains(body, `"findings"`) {
		t.Fatalf("a findings key travelled before anything had been measured:\n%s", body)
	}
}

// ── /proc's byte layout ─────────────────────────────────────────────────────

// The comm field is parenthesised and may contain spaces AND parens, which is
// why the fields are counted from the last ')'. A process named ") (" is legal
// and is how a naive split gets the wrong number.
func TestTheProcessStartTimeIsReadFromTheRightField(t *testing.T) {
	// pid comm state ppid ... starttime is field 22.
	fields := []string{"2", "1", "1", "0", "0", "0", "0", "0", "0", "0",
		"0", "0", "0", "0", "0", "0", "0", "0", "914623"}
	line := "1234 (weird ) name) S " + strings.Join(fields, " ") + " 0 0 0"
	got, ok := parseProcStatStartTicks(line)
	if !ok || got != 914623 {
		t.Fatalf("start ticks = %d (%v), want 914623 — a wrong field here makes every "+
			"process read as the wrong age", got, ok)
	}
	if _, ok := parseProcStatStartTicks("garbage with no paren"); ok {
		t.Error("a line with no comm field read as a valid start time")
	}
	if _, ok := parseProcStatStartTicks("1 (x) S 0 0"); ok {
		t.Error("a truncated line read as a valid start time")
	}
}

// ── what a second look found ────────────────────────────────────────────────

// A SECOND PROGRAM BESIDE THE FIRST IS NOT A REPLACEMENT OF IT. The slot rule
// fired on "the slot is known" alone, so a venv or pyenv interpreter starting
// the same script beside the system one — same user, same unit, same masked
// argv — came out as proc_changed at high, carrying `was:` a process that was
// still running. A doorbell that rings for a benign event is what the noise
// filter exists to prevent, and the sentence it rang with was not true.
func TestASecondProgramBesideTheOriginalIsNewNotAReplacement(t *testing.T) {
	was := procEntry("aaaa", "root", "web.service", "python3 x.py")
	second := procEntry("bbbb", "root", "web.service", "python3 x.py")
	// Both running: the original is still there.
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(was, 1), liveOf(second, 2)})
	if n := len(eventsOfKind(evs, deltaProcChanged)); n != 0 {
		t.Fatalf("%d proc_changed while the original was still running: %+v", n, evs)
	}
	if n := len(eventsOfKind(evs, deltaProcNew)); n != 1 {
		t.Fatalf("got %d proc_new, want 1: %+v", n, evs)
	}
	// And when the original HAS gone, it is a replacement again.
	evs = deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(second, 2)})
	if n := len(eventsOfKind(evs, deltaProcChanged)); n != 1 {
		t.Fatalf("with the original gone this must be one proc_changed, got %+v", evs)
	}
}

// THE OTHER HALF OF THE SAME RULE: an entry that leaves must still be reported
// gone when something ELSE happens to share its slot. Suppressing on "is
// anything standing here" lost the departure entirely.
func TestOneOfTwoEntriesSharingASlotLeavingIsStillReported(t *testing.T) {
	a := procEntry("aaaa", "root", "web.service", "python3 x.py")
	b := procEntry("bbbb", "root", "web.service", "python3 x.py")
	// b stays, a goes. They share a slot; a's absence is its own fact.
	evs := deltaCompare([]baselineEntry{a, b}, []deltaLiveEntry{liveOf(b, 2)})
	gone := eventsOfKind(evs, deltaProcGone)
	if len(gone) != 1 || gone[0].FP != a.FP {
		t.Fatalf("the entry that left was not reported gone: %+v", evs)
	}
}

// THE PACKAGE DATABASE EXPLAINS THE BINARY, NEVER THE ENDPOINT. apt upgrades
// node, the service that runs it restarts, and it now talks to api.openai.com:
// the proc_changed branch demoted on the tier alone and landed that at notice,
// while the identical situation as a proc_new came out high. Two branches
// asking the same question about the same machine have to answer the same
// way.
func TestAPackagedReplacementTalkingToAModelIsStillHigh(t *testing.T) {
	was := procEntry("aaaa", "root", "web.service", "node server.js")
	now := procEntry("bbbb", "root", "web.service", "node server.js")
	now.Endpoints = []string{"api.openai.com"}
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(now, 9)})
	changed := eventsOfKind(evs, deltaProcChanged)
	if len(changed) != 1 {
		t.Fatalf("got %+v", evs)
	}
	// The event has to CARRY the endpoint, or no tier could see it.
	if len(changed[0].Added) != 1 || changed[0].Added[0] != "api.openai.com" {
		t.Fatalf("the replacement event does not name the model endpoint it gained: %+v",
			changed[0].Added)
	}
	ev := changed[0]
	ev.Tier = tierKnown // the distribution shipped the new binary
	if got := deltaLevel(ev); got != deltaHigh {
		t.Fatalf("a PACKAGED replacement that also began talking to a model levelled %q, "+
			"want high. The package database explains the binary; it says nothing about "+
			"what the program is doing.", got)
	}
}

// THE TWO SIDES OF THE COMPARISON AGGREGATE THE SAME WAY. The accounting kept
// the first pid's endpoints and the delta's live side unioned them, so four
// workers of one service with only the fourth talking to a model recorded no
// endpoint at baseline and then reported proc_changed[llm_endpoint] at high on
// an unchanged machine, every pass until the accounting was retaken.
func TestTheAccountingUnionsEndpointsTheWayTheDeltaDoes(t *testing.T) {
	obs := []agentObs{
		{PID: 1, User: "root", Cmdline: "worker --port 3001", Origin: "service"},
		{PID: 2, User: "root", Cmdline: "worker --port 3002", Origin: "service",
			LLMEndpoints: []string{"api.openai.com"}},
	}
	entries, _ := baselineFromObservations(obs, func(string) (string, string) { return "d", "" })
	if len(entries) != 1 {
		t.Fatalf("two workers of one service made %d entries", len(entries))
	}
	if len(entries[0].Endpoints) != 1 || entries[0].Endpoints[0] != "api.openai.com" {
		t.Fatalf("the accounting recorded %v — the endpoint belonged to the SECOND pid and "+
			"was dropped, so the next delta reports it as newly appeared on an "+
			"unchanged machine", entries[0].Endpoints)
	}
	// Which is exactly what the live side would build from the same input.
	live, _, _ := deltaCollectLiveFrom(obs, func(string) (string, string) { return "d", "" })
	if len(live) != 1 || len(live[0].Entry.Endpoints) != 1 {
		t.Fatalf("the live side built %+v", live)
	}
	if evs := deltaCompare(entries, live); len(evs) != 0 {
		t.Fatalf("the same machine compared against itself produced %d events: %+v", len(evs), evs)
	}
}

// THE MODEL ENDPOINT REACHES THE WALK AT ALL. The unfiltered /proc walk carries
// pid, user, argv, exe, unit and parent and no endpoints; only the observe
// plane resolves those. So on Linux — the one platform WITH the full walk —
// both sides of every comparison held an empty list and the two rules that rest
// on it could never fire.
func TestTheWalkCarriesTheModelEndpointsItIsJudgedOn(t *testing.T) {
	obs := []agentObs{{PID: 41, User: "user", Cmdline: "python3 agent.py"}}
	got := baselineAttachEndpoints(obs, map[int][]string{41: {"api.anthropic.com"}})
	if len(got[0].LLMEndpoints) != 1 {
		t.Fatal("the join dropped the endpoint, so every level that depends on one is dead")
	}
	// And on this machine, for real: whatever the observe plane can see, the
	// walk the delta is built from must also see.
	seen := map[int][]string{}
	agentsNow, err := scanAgents()
	if err != nil {
		t.Fatal(err)
	}
	for _, a := range agentsNow {
		if len(a.LLMEndpoints) > 0 {
			seen[a.PID] = a.LLMEndpoints
		}
	}
	if len(seen) == 0 {
		t.Skip("nothing on this box is talking to a model right now")
	}
	walked, complete, err := baselineWalk()
	if err != nil {
		t.Fatal(err)
	}
	if !complete {
		t.Skip("this platform has no unfiltered walk, so there is nothing to enrich")
	}
	found := 0
	for _, a := range walked {
		if _, ok := seen[a.PID]; ok && len(a.LLMEndpoints) > 0 {
			found++
		}
	}
	if found == 0 {
		t.Fatalf("the observe plane sees %d processes talking to a model and the walk the "+
			"delta compares carries none of them", len(seen))
	}
}

// THE DAEMON READS ITS BINARY FROM DISK. selfDigest() is a sync.Once frozen at
// process start (enforcing.go:35-38), so a long-running daemon compared its own
// startup digest for ever and could never observe its binary being replaced —
// the one process in a position to notice, unable to.
func TestTheBastionBinaryIsReadFromDiskAndNotFromAFrozenDigest(t *testing.T) {
	p := filepath.Join(t.TempDir(), "privatae-bastion")
	if err := os.WriteFile(p, []byte("version one"), 0o755); err != nil {
		t.Fatal(err)
	}
	old := deltaSelfPath
	deltaSelfPath = p
	t.Cleanup(func() { deltaSelfPath = old })

	dc := &digestCache{}
	before := deltaSelfOnDisk(dc)
	if before == "" {
		t.Fatal("the binary was not digested at all")
	}
	// Replaced the way replaceSelf does it: the old one moved aside, a new one
	// written at the same path (update.go:160-169).
	if err := os.Rename(p, p+".old"); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(p, []byte("version two"), 0o755); err != nil {
		t.Fatal(err)
	}
	after := deltaSelfOnDisk(dc)
	if after == before {
		t.Fatal("the bastion read the same digest after its binary was replaced under it. " +
			"A frozen digest, or one taken from /proc/self/exe — which follows the inode " +
			"to the file that was moved ASIDE — both read like this.")
	}
}

// ONE PASS PER BOX, NOT ONE PER PAIRING. run.go starts a refresher beside every
// heartbeat, so a box serving three hosts ran three full passes a minute and
// three read-modify-writers of one state file — and whether a 40-second process
// was counted or reported depended on how many hosts the box served.
func TestASecondRefresherDoesNotRunItsOwnPass(t *testing.T) {
	deltaMu.Lock()
	oldLast, oldAt, oldRan := deltaLast, deltaAt, deltaRan
	deltaLast, deltaAt, deltaRan = &deltaSummary{Baseline: "sentinel"}, time.Now(), true
	deltaMu.Unlock()
	t.Cleanup(func() {
		deltaMu.Lock()
		deltaLast, deltaAt, deltaRan = oldLast, oldAt, oldRan
		deltaMu.Unlock()
	})
	refreshDelta()
	deltaMu.Lock()
	got := deltaLast.Baseline
	deltaMu.Unlock()
	if got != "sentinel" {
		t.Fatalf("the second refresher ran its own pass (published %q). N pairings would "+
			"mean N passes a minute over one state file.", got)
	}
}

// SOMETHING THAT IS ALWAYS YOUNG IS A PATTERN, NOT SHORT-LIVED WORK. A
// respawner — a crash-looping unit, a beacon relaunched every few seconds — was
// young at every pass, so it was re-held at every pass and, being seen each
// time, never settled into the short-lived count either: no finding, and a
// storm counter reading zero.
func TestARespawnerStopsBeingHeldAndBecomesAFinding(t *testing.T) {
	st := freshState(t)
	ev := deltaEvent{Kind: deltaProcNew, FP: "fp1", PIDs: []int{7},
		Entry: procEntry("aaaa", "user", "interactive", "beacon")}
	n := deltaNoise{Self: 1, Parents: map[int]int{7: 2}, Sockets: true,
		Age: func(int) (time.Duration, bool) { return time.Second, true }}

	start := time.Now()
	for i := 0; i < 4; i++ {
		findings, _ := deltaFilter([]deltaEvent{ev}, n, st, start.Add(time.Duration(i)*time.Minute))
		if len(findings) != 0 {
			t.Fatalf("pass %d reported it before the hold ceiling", i)
		}
	}
	findings, _ := deltaFilter([]deltaEvent{ev}, n, st, start.Add(deltaHoldMax+time.Minute))
	if len(findings) != 1 {
		t.Fatal("a process that has been 'about to go away' for longer than the ceiling " +
			"is still being held. It is never counted either, because it is seen every pass.")
	}
	var said bool
	for _, e := range findings[0].Evidence {
		if e.Signal == "respawning" {
			said = true
		}
	}
	if !said {
		t.Error("the finding does not say WHY it arrived late — that it kept coming back")
	}
}

// THE WIRING OF THE BASTION-BINARY RUNG, DRIVEN THROUGH A REAL PASS.
//
// The two unit tests above hold deltaSelfOnDisk and deltaBinaryEvent in
// isolation, and a mutation that pointed deltaPass back at selfDigest() — or
// back at the accounting's frozen version — passed both of them. That is the
// defect shape this whole plane keeps being caught by: the claim asserted at a
// layer nothing wires to. So this drives the pass itself, three times, and
// watches the rung move.
func TestThePassReadsTheBinaryFromDiskAndRemembersWhatItSaw(t *testing.T) {
	if !processIsRoot() {
		t.Skip("a pass needs machine authority, which is its own test")
	}
	isolateConfigDir(t)

	fixture := filepath.Join(t.TempDir(), "privatae-bastion")
	writeBinary := func(body string) string {
		t.Helper()
		if _, err := os.Stat(fixture); err == nil {
			// Replaced the way replaceSelf does it (update.go:160-169).
			if err := os.Rename(fixture, fixture+".old"); err != nil {
				t.Fatal(err)
			}
		}
		if err := os.WriteFile(fixture, []byte(body), 0o755); err != nil {
			t.Fatal(err)
		}
		d, _ := baselineExeDigest(fixture)
		return d
	}
	oldPath, oldVersion := deltaSelfPath, clientVersion
	deltaSelfPath = fixture
	t.Cleanup(func() { deltaSelfPath, clientVersion = oldPath, oldVersion })

	// An accounting taken by 0.27.0, with that binary on disk.
	clientVersion = "0.27.0"
	first := writeBinary("version one")
	base, _, _, _, err := collectBaseline()
	if err != nil {
		t.Fatal(err)
	}
	base.BastionDigest, base.BastionVersion = first, "0.27.0"
	if err := baselineSave(base); err != nil {
		t.Fatal(err)
	}

	binaryEvent := func(r deltaReport) *deltaEvent {
		for i := range r.Findings {
			if r.Findings[i].Kind == deltaBinaryChanged {
				return &r.Findings[i]
			}
		}
		return nil
	}

	dc := &digestCache{}
	if ev := binaryEvent(deltaPass(dc, time.Now(), deltaRoleDaemon)); ev != nil {
		t.Fatalf("an unchanged binary produced %+v", ev)
	}

	// The fleet update: new binary, new version.
	writeBinary("version two")
	clientVersion = "0.28.0"
	ev := binaryEvent(deltaPass(dc, time.Now(), deltaRoleDaemon))
	if ev == nil {
		t.Fatal("the bastion's binary was replaced on disk and the pass did not notice. " +
			"selfDigest() is frozen at process start, so a pass that asks IT can never see this.")
	}
	if ev.Level != deltaHigh {
		t.Fatalf("the update levelled %q, want high", ev.Level)
	}

	// And now the swap: new binary, SAME version, after that update.
	writeBinary("version three")
	ev = binaryEvent(deltaPass(dc, time.Now(), deltaRoleDaemon))
	if ev == nil {
		t.Fatal("the second replacement was not noticed at all")
	}
	if ev.Level != deltaCritical {
		t.Fatalf("a binary replaced under an unchanged version, after an earlier update, "+
			"levelled %q — want critical. Compared against the ACCOUNTING's version this "+
			"reads as one more update for ever, because nothing retakes the accounting "+
			"when the bastion updates itself.", ev.Level)
	}

	// A FOURTH PASS, WHICH IS WHERE THE DEFECT LIVED. Advancing the remembered
	// pair after reporting a swap makes the swapped binary the new normal, so
	// the critical appears for exactly one beat — into a summary the host does
	// not store — and an operator running observe:delta an hour later is told
	// the machine is clean. A finding this severe is pinned until a human
	// resolves it, which here means retaking the accounting.
	ev = binaryEvent(deltaPass(dc, time.Now(), deltaRoleDaemon))
	if ev == nil {
		t.Fatal("the swap was reported once and then absorbed. The pass that reports it " +
			"must not record the swapped binary as what the machine last saw.")
	}
	if ev.Level != deltaCritical {
		t.Fatalf("the repeat levelled %q, want critical", ev.Level)
	}

	// And the UPDATE is not repeated, which is the other half of the same rule:
	// a legitimate new version becomes the new normal exactly once.
	writeBinary("version four")
	clientVersion = "0.29.0"
	if ev = binaryEvent(deltaPass(dc, time.Now(), deltaRoleDaemon)); ev == nil || ev.Level != deltaHigh {
		t.Fatalf("the second update levelled %+v, want high", ev)
	}
	if ev = binaryEvent(deltaPass(dc, time.Now(), deltaRoleDaemon)); ev != nil {
		t.Fatalf("the update was reported again on the next pass: %+v", ev)
	}
}

// THE SEED FROM THE ACCOUNTING IS WHAT COVERS THE FIRST PASS — on a fresh
// install, after a retake, after a corrupt state file. Nothing held it: deleting
// the seed left the whole suite green, and without it
// the first pass is blind to a swap that happened before it ran.
func TestTheFirstPassComparesAgainstTheAccounting(t *testing.T) {
	if !processIsRoot() {
		t.Skip("a pass needs machine authority, which is its own test")
	}
	isolateConfigDir(t)
	fixture := filepath.Join(t.TempDir(), "privatae-bastion")
	if err := os.WriteFile(fixture, []byte("the one that is here now"), 0o755); err != nil {
		t.Fatal(err)
	}
	oldPath, oldVersion := deltaSelfPath, clientVersion
	deltaSelfPath, clientVersion = fixture, "0.27.0"
	t.Cleanup(func() { deltaSelfPath, clientVersion = oldPath, oldVersion })

	// The accounting recorded a DIFFERENT binary under this same version — the
	// swap happened before this process ever ran a pass.
	base, _, _, _, err := collectBaseline()
	if err != nil {
		t.Fatal(err)
	}
	base.BastionDigest, base.BastionVersion = "a-different-binary-entirely", "0.27.0"
	if err := baselineSave(base); err != nil {
		t.Fatal(err)
	}
	r := deltaPass(&digestCache{}, time.Now(), deltaRoleDaemon)
	found := false
	for _, ev := range r.Findings {
		if ev.Kind == deltaBinaryChanged {
			found = true
			if ev.Level != deltaCritical {
				t.Errorf("levelled %q, want critical", ev.Level)
			}
		}
	}
	if !found {
		t.Fatal("with no prior pass to compare against, the accounting's record is the " +
			"only thing that can catch this, and it was not consulted")
	}
}

// AN OPERATOR'S OWN COMMAND MUST NOT POISON THE DAEMON'S BOOKKEEPING. Running
// observe:delta from a copy of the binary somewhere else would otherwise record
// THAT copy as what the machine last saw, and the daemon's next pass reports a
// swap that never happened.
func TestAnOperatorPassDoesNotRewriteWhatTheMachineLastSaw(t *testing.T) {
	if !processIsRoot() {
		t.Skip("a pass needs machine authority, which is its own test")
	}
	isolateConfigDir(t)
	fixture := filepath.Join(t.TempDir(), "some-other-copy")
	if err := os.WriteFile(fixture, []byte("a developer's build"), 0o755); err != nil {
		t.Fatal(err)
	}
	oldPath, oldVersion := deltaSelfPath, clientVersion
	deltaSelfPath, clientVersion = fixture, "0.27.0"
	t.Cleanup(func() { deltaSelfPath, clientVersion = oldPath, oldVersion })

	// The accounting records THIS copy, so the pass finds nothing to report —
	// which is precisely the case where a daemon pass advances the remembered
	// pair. If the role is ignored, this is where the operator's copy gets
	// written down as what the machine last saw.
	mine, _ := baselineExeDigest(fixture)
	base, _, _, _, err := collectBaseline()
	if err != nil {
		t.Fatal(err)
	}
	base.BastionDigest, base.BastionVersion = mine, "0.27.0"
	if err := baselineSave(base); err != nil {
		t.Fatal(err)
	}
	// THE KEY THE STATE IS FILED UNDER IS THE SAVED FILE'S DIGEST, not the one
	// on the struct that was handed to baselineSave — that function digests its
	// own copy. Reading it back is the difference between this test checking
	// something and this test always passing.
	saved, _, err := baselineLoad()
	if err != nil {
		t.Fatal(err)
	}
	if st := deltaStateLoad(saved.Digest); st.BastionDigest != "" {
		t.Fatalf("the fixture state was not empty to begin with: %q", st.BastionDigest)
	}
	deltaPass(&digestCache{}, time.Now(), deltaRoleOperator)
	if st := deltaStateLoad(saved.Digest); st.BastionDigest != "" {
		t.Fatalf("an operator pass wrote %q into the shared state as what the machine "+
			"last saw. Run from a copy of the binary somewhere else, that is a swap the "+
			"daemon reports on its next pass and nobody made.", st.BastionDigest)
	}
	// And the daemon in the same position DOES advance — otherwise this test
	// would pass against a pass that never writes anything at all.
	deltaPass(&digestCache{}, time.Now(), deltaRoleDaemon)
	if st := deltaStateLoad(saved.Digest); st.BastionDigest != mine {
		t.Fatalf("the daemon's pass recorded %q, want the binary it actually has", st.BastionDigest)
	}
}

// A v1 ACCOUNTING CANNOT BE COMPARED, because its entries mean something
// different: on Linux it holds no model endpoints for anything, while a walk
// now does. The fingerprints still match, so nothing else would have caught it
// — every known process talking to a model would report proc_changed
// [llm_endpoint] at high until somebody retook it.
func TestTheAccountingVersionMovedWithItsMeaning(t *testing.T) {
	dir := isolateConfigDir(t)
	if !processIsRoot() {
		t.Skip("a pass needs machine authority, which is its own test")
	}
	if baselineVersion == "privatae-baseline-v1" {
		t.Fatal("the endpoint join changed what an entry MEANS without moving the version, " +
			"so a baseline taken before it compares as a page of model-endpoint findings")
	}
	if err := os.MkdirAll(dir, 0o700); err != nil {
		t.Fatal(err)
	}
	old := baselineFile{Version: "privatae-baseline-v1", TakenAt: "2026-09-14T23:51:04Z",
		Coverage: "processes=all,schedulers=all",
		Entries:  []baselineEntry{procEntry("aaaa", "root", "svc", "python3 x.py")}}
	if err := baselineSave(old); err != nil {
		t.Fatal(err)
	}
	r := deltaPass(&digestCache{}, time.Now(), deltaRoleOperator)
	if r.Baseline != deltaBaselineStale {
		t.Fatalf("a v1 accounting read as %q, want %q", r.Baseline, deltaBaselineStale)
	}
	if len(r.Findings) != 0 {
		t.Fatalf("it produced %d findings against an accounting it cannot compare with", len(r.Findings))
	}
}

// TWO BASELINE ENTRIES AT ONE SLOT, AND ONE OF THEM UPGRADES. Keeping only the
// first entry per slot made the answer depend on which of them sorted first:
// the upgraded one either read as a replacement or as an unrelated new program
// with the untrue line "neither this program nor anything in its place was in
// the accounting", while its predecessor was separately reported gone. A hash
// order was choosing between two different sentences.
func TestAnUpgradeAtASharedSlotIsAReplacementWhicheverWaySorted(t *testing.T) {
	a := procEntry("aaaa", "root", "web.service", "python3 x.py") // system python
	b := procEntry("bbbb", "root", "web.service", "python3 x.py") // a second one
	upgraded := procEntry("cccc", "root", "web.service", "python3 x.py")

	for _, order := range [][]baselineEntry{{a, b}, {b, a}} {
		// a is still running; b has been upgraded to `upgraded`.
		evs := deltaCompare(order, []deltaLiveEntry{liveOf(a, 1), liveOf(upgraded, 2)})
		changed := eventsOfKind(evs, deltaProcChanged)
		if len(changed) != 1 {
			t.Fatalf("order %v: got %+v", []string{order[0].ExeDigest, order[1].ExeDigest}, evs)
		}
		if changed[0].Was == nil || changed[0].Was.FP != b.FP {
			t.Errorf("the replacement names the wrong predecessor: %+v", changed[0].Was)
		}
		if n := len(eventsOfKind(evs, deltaProcNew)); n != 0 {
			t.Errorf("order %v: %d proc_new as well", []string{order[0].ExeDigest, order[1].ExeDigest}, n)
		}
		if n := len(eventsOfKind(evs, deltaProcGone)); n != 0 {
			t.Errorf("order %v: %d proc_gone as well", []string{order[0].ExeDigest, order[1].ExeDigest}, n)
		}
	}
}

// A BINARY REPLACED AND THEN UNLINKED IS THE MOST DELIBERATE VERSION OF THIS,
// and it digested as empty — the exe path reads " (deleted)", which is stripped,
// and the stat then fails — so it came out as a visibility notice. The
// unreadable shortcut now sits BELOW the endpoint check.
func TestAReplacedBinaryThatWasUnlinkedIsNotJustAVisibilityNotice(t *testing.T) {
	was := procEntry("aaaa", "root", "web.service", "node server.js")
	gone := procEntry("", "root", "web.service", "node server.js")
	gone.DigestNote = "could not be read by this account"
	gone.Endpoints = []string{"api.openai.com"}
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(gone, 3)})
	changed := eventsOfKind(evs, deltaProcChanged)
	if len(changed) != 1 {
		t.Fatalf("got %+v", evs)
	}
	if got := deltaLevel(changed[0]); got != deltaHigh {
		t.Fatalf("a binary replaced at a known post, unlinked, and talking to a model "+
			"levelled %q — want high. An unreadable digest is a visibility change only "+
			"when there is nothing else on the event.", got)
	}
	// With nothing else on it, it is still a notice.
	plain := changed[0]
	plain.Added, plain.Entry.Endpoints, plain.Entry.Signature = nil, nil, ""
	if got := deltaLevel(plain); got != deltaNotice {
		t.Errorf("an unreadable digest with nothing else on it levelled %q, want notice", got)
	}
}

// A PACKAGED UPGRADE OF A SERVICE THAT ALREADY TALKED TO A MODEL IS AN APT
// UPGRADE. Levelling on "has endpoints" rather than "gained endpoints" made
// every one of those high, which is the noise the tier exists to remove.
func TestAPackagedUpgradeOfAModelTalkingServiceIsNotHighOnItsOwn(t *testing.T) {
	was := procEntry("aaaa", "root", "web.service", "node server.js")
	was.Endpoints = []string{"api.openai.com"}
	now := procEntry("bbbb", "root", "web.service", "node server.js")
	now.Endpoints = []string{"api.openai.com"} // the same one, still
	evs := deltaCompare([]baselineEntry{was}, []deltaLiveEntry{liveOf(now, 4)})
	changed := eventsOfKind(evs, deltaProcChanged)
	if len(changed) != 1 {
		t.Fatalf("got %+v", evs)
	}
	ev := changed[0]
	if len(ev.Added) != 0 {
		t.Fatalf("an unchanged endpoint list was reported as added: %v", ev.Added)
	}
	ev.Tier = tierKnown // the distribution shipped the new binary
	if got := deltaLevel(ev); got != deltaNotice {
		t.Errorf("a packaged upgrade of a service whose model endpoint did not change "+
			"levelled %q, want notice", got)
	}
	// Unpackaged, the same replacement is still high.
	ev.Tier = ""
	if got := deltaLevel(ev); got != deltaHigh {
		t.Errorf("an unexplained replacement levelled %q, want high", got)
	}
}

// THE REFRESHERS ARRIVE TOGETHER, because run.go starts every pairing in one
// loop and each calls refreshDelta immediately. A freshness check alone lets
// all of them past — none has finished yet — so a three-host box ran three
// concurrent walks of the machine and three writers of one state file.
func TestRefreshersThatStartTogetherRunOnePass(t *testing.T) {
	// Isolated because the mutation this test exists to kill makes it run a REAL
	// pass — which would write this machine's own delta-state.json, as root,
	// from a test. A test that only misbehaves when
	// it is doing its job is still a test that misbehaves.
	isolateConfigDir(t)
	deltaMu.Lock()
	oldLast, oldAt, oldRan, oldRunning := deltaLast, deltaAt, deltaRan, deltaRunning
	deltaLast, deltaAt, deltaRan, deltaRunning = nil, time.Time{}, false, true
	deltaMu.Unlock()
	t.Cleanup(func() {
		deltaMu.Lock()
		deltaLast, deltaAt, deltaRan, deltaRunning = oldLast, oldAt, oldRan, oldRunning
		deltaMu.Unlock()
	})
	// A pass is in flight. Every other refresher must return at once rather
	// than starting its own — the freshness check cannot help, because nothing
	// has been published yet.
	done := make(chan struct{})
	go func() { refreshDelta(); close(done) }()
	select {
	case <-done:
	case <-time.After(5 * time.Second):
		t.Fatal("a second refresher started its own pass while one was already running")
	}
	deltaMu.Lock()
	published := deltaLast
	deltaMu.Unlock()
	if published != nil {
		t.Fatal("the second refresher published a result of its own")
	}
}

// A v1 ACCOUNTING HAS NOT BEEN EDITED, and both places that report on a
// baseline's integrity said it had. baselineDigestOf prefixes with the CURRENT
// version constant, so every file taken under older rules recomputes to a
// different digest — which after the v2 bump would have read as tampering on
// every machine holding one, in the one place a person goes to check exactly
// that.
func TestAnAccountingFromOlderRulesIsNotCalledTamperedWith(t *testing.T) {
	old := &baselineFile{Version: "privatae-baseline-v1", TakenAt: "2026-09-14T23:51:04Z"}
	note := baselineIntegrityNote(old, false)
	if note == "" {
		t.Fatal("a v1 accounting produced no note at all")
	}
	if strings.Contains(note, "has been changed since it was taken") {
		t.Errorf("the note accuses somebody of editing it: %q", note)
	}
	if !strings.Contains(note, "NOT evidence") {
		t.Errorf("the note does not rule out tampering, which is the whole reason it "+
			"exists — a person reading it still has to wonder: %q", note)
	}
	if !strings.Contains(note, "taken again") {
		t.Errorf("the note does not say what to do about it: %q", note)
	}
	// A file under the CURRENT rules whose digest does not match HAS been
	// edited, and must still say so — that is the whole point of the digest.
	cur := &baselineFile{Version: baselineVersion, TakenAt: "2026-09-15T00:00:00Z"}
	if note := baselineIntegrityNote(cur, false); !strings.Contains(note, "changed since it was taken") {
		t.Errorf("a tampered file under the current rules reads %q", note)
	}
	if note := baselineIntegrityNote(cur, true); note != "" {
		t.Errorf("an intact file produced a warning: %q", note)
	}
}

// A BASTION THAT CANNOT READ ITS OWN BINARY MUST NOT READ LIKE ONE THAT
// CHECKED. An empty digest produces no event, and silence is indistinguishable
// from "checked, unchanged" — the same quiet-versus-blind rule this plane
// applies to the accounting.
func TestABastionThatCannotReadItsOwnBinarySaysSo(t *testing.T) {
	if !processIsRoot() {
		t.Skip("a pass needs machine authority, which is its own test")
	}
	isolateConfigDir(t)
	oldPath := deltaSelfPath
	deltaSelfPath = filepath.Join(t.TempDir(), "not-here")
	t.Cleanup(func() { deltaSelfPath = oldPath })

	base, _, _, _, err := collectBaseline()
	if err != nil {
		t.Fatal(err)
	}
	base.BastionDigest, base.BastionVersion = "something-was-recorded", "0.27.0"
	if err := baselineSave(base); err != nil {
		t.Fatal(err)
	}
	r := deltaPass(&digestCache{}, time.Now(), deltaRoleDaemon)
	for _, ev := range r.Findings {
		if ev.Kind == deltaBinaryChanged {
			t.Fatalf("an unreadable binary produced a change event: %+v", ev)
		}
	}
	if !strings.Contains(strings.Join(r.Notes, " "), "could not read its own binary") {
		t.Fatalf("the pass reported nothing about its own binary and said nothing about "+
			"why. That reads exactly like 'checked, unchanged': %v", r.Notes)
	}
}

// AND BOTH COMMANDS THAT REPORT ON IT ACTUALLY USE THAT SENTENCE. The note
// being right is worth nothing if the two places a person reads it compose
// their own — which is how the pair drifted apart in the first place. Rewriting
// either one to print its own wording leaves this red.
func TestBothBaselineCommandsSayTheRulesMovedRatherThanTampering(t *testing.T) {
	isolateConfigDir(t)
	writeV1Accounting(t)

	// `observe:baseline:show` prints it.
	r, w, err := os.Pipe()
	if err != nil {
		t.Fatal(err)
	}
	stdout := os.Stdout
	os.Stdout = w
	showErr := cmdObserveBaselineShow()
	os.Stdout = stdout
	_ = w.Close()
	var buf strings.Builder
	if _, err := io.Copy(&buf, r); err != nil {
		t.Fatal(err)
	}
	if showErr != nil {
		t.Fatal(showErr)
	}
	shown := buf.String()
	if strings.Contains(shown, "has been changed since it was taken") {
		t.Errorf("observe:baseline:show tells the person their accounting was tampered "+
			"with when the version constant is what moved:\n%s", shown)
	}
	if !strings.Contains(shown, "taken again") {
		t.Errorf("observe:baseline:show does not say what to do:\n%s", shown)
	}

	// `observe:baseline` without --force refuses, and names the same state.
	if !processIsRoot() {
		return // the take path needs machine authority; the show half stands alone
	}
	takeErr := cmdObserveBaseline(false)
	if takeErr == nil {
		t.Fatal("taking a second accounting without --force was allowed")
	}
	if strings.Contains(takeErr.Error(), "has been changed since it was taken") {
		t.Errorf("observe:baseline accuses somebody of editing it: %v", takeErr)
	}
	if !strings.Contains(takeErr.Error(), "taken again") {
		t.Errorf("observe:baseline does not say the rules moved: %v", takeErr)
	}
}

// AND IT DOES NOT CRASH ON THE FILE IT EXISTS TO INSPECT. `observe:baseline:show`
// truncated every digest to twelve characters, which a real sha256 always
// survives and a hand-edited or truncated file does not — so the one command
// for looking at an accounting you suspect has been tampered with panicked on
// exactly that accounting. Found by the test above, written for something else.
func TestShowingATruncatedAccountingDoesNotCrash(t *testing.T) {
	isolateConfigDir(t)
	f := baselineFile{Version: baselineVersion, TakenAt: "2026-09-15T00:00:00Z",
		Coverage: "processes=all,schedulers=all", Entries: []baselineEntry{
			procEntry("aa", "root", "svc", "short"),
			procEntry("", "root", "svc", "none"),
			procEntry(strings.Repeat("f", 64), "root", "svc", "full"),
		}}
	if err := baselineSave(f); err != nil {
		t.Fatal(err)
	}
	if err := cmdObserveBaselineShow(); err != nil {
		t.Fatalf("showing an accounting with a short digest failed: %v", err)
	}
}

// writeV1Accounting writes an accounting the way a v1 BINARY would have: its
// digest computed under the v1 constant, so it is intact by its own rules and
// mismatched by ours. baselineSave cannot make this fixture — it re-digests
// under the current constant, which produces a file no v1 bastion ever wrote
// and which reads as perfectly intact.
func writeV1Accounting(t *testing.T) {
	t.Helper()
	const v1 = "privatae-baseline-v1"
	f := baselineFile{Version: v1, TakenAt: "2026-09-14T23:51:04Z",
		Coverage: "processes=all,schedulers=all",
		Entries:  []baselineEntry{procEntry("aaaa", "root", "svc", "thing")}}
	b, err := json.Marshal(f)
	if err != nil {
		t.Fatal(err)
	}
	sum := sha256.Sum256(append([]byte(v1+"\x00"), b...))
	f.Digest = hex.EncodeToString(sum[:])
	out, err := json.MarshalIndent(f, "", "  ")
	if err != nil {
		t.Fatal(err)
	}
	p, err := baselinePath()
	if err != nil {
		t.Fatal(err)
	}
	if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(p, out, 0o600); err != nil {
		t.Fatal(err)
	}
	// It must be intact under ITS OWN rules and mismatched under ours, or this
	// fixture is not the situation being tested.
	got, ok, err := baselineLoad()
	if err != nil {
		t.Fatal(err)
	}
	if ok {
		t.Fatal("the v1 fixture reads as digest-intact under v2, so nothing below is " +
			"exercising the note at all")
	}
	if got.Version != v1 {
		t.Fatalf("fixture version is %q", got.Version)
	}
}