aprender-profile 0.31.1

//! Architectural Anti-Pattern Detection (§27)
//!
//! Detects architectural anti-patterns in system traces:
//!
//! - **`GodProcess`**: Single process dominates syscall activity (>80%)
//! - **`TightLoop`**: Syscalls occurring at sub-threshold intervals
//! - **`ExcessiveIO`**: I/O operations exceed sustainable rate
//! - **`BlockingMainThread`**: Long-running operations block main thread
//!
//! # Reference
//!
//! - Sambasivan et al. (2016). "So, you want to trace your distributed system?"
//! - Toyota Way: Jidoka (quality gates) - stop the line when defects detected

use crate::unified_trace::UnifiedTrace;

/// Thresholds for anti-pattern detection
#[derive(Debug, Clone)]
pub struct AntiPatternThresholds {
    /// Threshold for God Process detection: percentage of syscalls from one process
    /// Default: 80.0 (flag if >80% of syscalls from single process)
    pub god_process_syscall_percent: f64,

    /// Threshold for Tight Loop detection: minimum interval between syscalls (ms)
    /// Default: 10 (flag if interval < 10ms)
    pub tight_loop_threshold_ms: u64,

    /// Threshold for Excessive I/O detection: operations per second
    /// Default: 10000 (flag if > 10000 ops/sec)
    pub excessive_io_ops_per_sec: u64,
}

impl Default for AntiPatternThresholds {
    fn default() -> Self {
        Self {
            god_process_syscall_percent: 80.0,
            tight_loop_threshold_ms: 10,
            excessive_io_ops_per_sec: 10000,
        }
    }
}

/// Detected anti-pattern types
#[derive(Debug, Clone, PartialEq)]
pub enum AntiPattern {
    /// Single process dominates syscall activity
    GodProcess {
        /// Process ID of the dominant process
        process_id: u32,
        /// Percentage of syscalls from this process
        syscall_percent: f64,
    },

    /// Syscalls occurring at very short intervals
    TightLoop {
        /// Location/context of the tight loop
        location: String,
        /// Average interval between syscalls in milliseconds
        interval_ms: u64,
    },

    /// Excessive I/O operations
    ExcessiveIO {
        /// Operations per second observed
        ops_per_sec: u64,
    },

    /// Main thread blocked for extended duration
    BlockingMainThread {
        /// Duration of the blocking operation in milliseconds
        duration_ms: u64,
    },
}

/// Architectural quality assessment result
#[derive(Debug, Clone)]
pub struct ArchitecturalQuality {
    /// Overall quality score (0.0 - 1.0, where 1.0 is perfect)
    pub score: f64,

    /// Detected anti-patterns
    pub anti_patterns: Vec<AntiPattern>,

    /// Actionable recommendations for improvement
    pub recommendations: Vec<String>,
}

/// Anti-pattern detector for architectural quality analysis
#[derive(Debug, Clone)]
pub struct AntiPatternDetector {
    thresholds: AntiPatternThresholds,
}

impl AntiPatternDetector {
    /// Create a new anti-pattern detector with specified thresholds
    pub fn new(thresholds: AntiPatternThresholds) -> Self {
        Self { thresholds }
    }

    /// Analyze a trace for architectural anti-patterns
    ///
    /// Returns an `ArchitecturalQuality` assessment with detected patterns
    /// and recommendations.
    pub fn analyze(&self, trace: &UnifiedTrace) -> ArchitecturalQuality {
        contract_pre_error_handling!();
        let mut anti_patterns = Vec::new();
        let mut recommendations = Vec::new();

        // Detect God Process
        if let Some(pattern) = self.detect_god_process(trace) {
            recommendations.push(
                "Consider decomposing the dominant process into smaller services \
                 or distributing work across multiple processes."
                    .to_string(),
            );
            anti_patterns.push(pattern);
        }

        // Detect Tight Loop
        if let Some(pattern) = self.detect_tight_loop(trace) {
            recommendations.push(
                "Consider using vectorized I/O (readv/writev), buffering, or \
                 async I/O to reduce syscall frequency."
                    .to_string(),
            );
            anti_patterns.push(pattern);
        }

        // Detect Excessive I/O
        if let Some(pattern) = self.detect_excessive_io(trace) {
            recommendations.push(
                "Consider batching I/O operations, using buffered I/O, or \
                 implementing I/O throttling."
                    .to_string(),
            );
            anti_patterns.push(pattern);
        }

        // Detect Blocking Main Thread
        if let Some(pattern) = self.detect_blocking_main_thread(trace) {
            recommendations.push(
                "Consider moving blocking operations to a background thread or \
                 using async I/O to avoid blocking the main thread."
                    .to_string(),
            );
            anti_patterns.push(pattern);
        }

        // Calculate quality score based on anti-patterns
        let score = self.calculate_score(&anti_patterns);

        ArchitecturalQuality { score, anti_patterns, recommendations }
    }

    /// Detect God Process anti-pattern
    ///
    /// A God Process is one that dominates syscall activity beyond the threshold.
    /// In a `UnifiedTrace`, all syscalls belong to the traced process, so we check
    /// if there are enough syscalls to warrant flagging.
    fn detect_god_process(&self, trace: &UnifiedTrace) -> Option<AntiPattern> {
        let syscall_count = trace.syscall_spans.len();

        // Need at least some syscalls to detect patterns
        if syscall_count == 0 {
            return None;
        }

        // In a single-process trace, all syscalls are from the same process
        // The syscall_percent is 100% by definition
        let syscall_percent = 100.0;

        // Check against threshold
        if syscall_percent > self.thresholds.god_process_syscall_percent {
            let process_id = trace.process_span.pid as u32;
            Some(AntiPattern::GodProcess { process_id, syscall_percent })
        } else {
            None
        }
    }

    /// Detect Tight Loop anti-pattern
    ///
    /// A tight loop is detected when syscalls occur at intervals below the threshold.
    /// This indicates polling or busy-waiting behavior.
    fn detect_tight_loop(&self, trace: &UnifiedTrace) -> Option<AntiPattern> {
        let syscalls = &trace.syscall_spans;

        // Need at least 2 syscalls to measure intervals
        if syscalls.len() < 2 {
            return None;
        }

        // Calculate average interval between consecutive syscalls
        let mut total_interval_ns: u64 = 0;
        let mut interval_count: u64 = 0;
        let mut dominant_syscall = String::new();
        let mut syscall_counts = std::collections::HashMap::new();

        for i in 1..syscalls.len() {
            let prev_timestamp = syscalls[i - 1].timestamp_nanos;
            let curr_timestamp = syscalls[i].timestamp_nanos;

            // Calculate interval (handle potential timestamp ordering issues)
            if curr_timestamp > prev_timestamp {
                total_interval_ns += curr_timestamp - prev_timestamp;
                interval_count += 1;
            }

            // Track syscall counts to find dominant syscall
            let name = syscalls[i].name.to_string();
            *syscall_counts.entry(name).or_insert(0u64) += 1;
        }

        // Find the most common syscall
        if let Some((name, _)) = syscall_counts.into_iter().max_by_key(|(_, c)| *c) {
            dominant_syscall = name;
        }

        if interval_count == 0 {
            return None;
        }

        let avg_interval_ns = total_interval_ns / interval_count;
        let avg_interval_ms = avg_interval_ns / 1_000_000; // Convert to ms

        // Check against threshold
        if avg_interval_ms < self.thresholds.tight_loop_threshold_ms {
            let location = format!("syscall: {dominant_syscall}");
            Some(AntiPattern::TightLoop { location, interval_ms: avg_interval_ms })
        } else {
            None
        }
    }

    /// Detect Excessive I/O anti-pattern
    ///
    /// Excessive I/O is detected when syscall rate exceeds the threshold ops/sec.
    fn detect_excessive_io(&self, trace: &UnifiedTrace) -> Option<AntiPattern> {
        let syscalls = &trace.syscall_spans;

        // Need at least 2 syscalls to calculate rate
        if syscalls.len() < 2 {
            return None;
        }

        // Find time span of syscalls
        let first_timestamp = syscalls.first().map_or(0, |s| s.timestamp_nanos);
        let last_timestamp = syscalls.last().map_or(0, |s| s.timestamp_nanos);

        // Calculate duration in seconds
        if last_timestamp <= first_timestamp {
            return None;
        }

        let duration_ns = last_timestamp - first_timestamp;
        let duration_secs = duration_ns as f64 / 1_000_000_000.0;

        // Avoid division by very small numbers
        if duration_secs < 0.001 {
            return None;
        }

        // Count I/O syscalls (read, write, pread, pwrite, readv, writev, etc.)
        let io_syscalls: &[&str] = &[
            "read", "write", "pread64", "pwrite64", "readv", "writev", "preadv", "pwritev",
            "sendfile", "splice", "tee",
        ];

        let io_count = syscalls
            .iter()
            .filter(|s| {
                let name: &str = &s.name;
                io_syscalls.contains(&name)
            })
            .count();

        #[expect(clippy::cast_precision_loss, reason = "io_count is always small enough for f64")]
        let ops_per_sec = ((io_count as f64) / duration_secs) as u64;

        // Check against threshold
        if ops_per_sec > self.thresholds.excessive_io_ops_per_sec {
            Some(AntiPattern::ExcessiveIO { ops_per_sec })
        } else {
            None
        }
    }

    /// Detect Blocking Main Thread anti-pattern
    ///
    /// Detected when any syscall duration exceeds a threshold (100ms by default).
    /// Reports the maximum blocking duration found.
    fn detect_blocking_main_thread(&self, trace: &UnifiedTrace) -> Option<AntiPattern> {
        let syscalls = &trace.syscall_spans;

        if syscalls.is_empty() {
            return None;
        }

        // Find maximum syscall duration
        let max_duration_ns = syscalls.iter().map(|s| s.duration_nanos).max().unwrap_or(0);

        let max_duration_ms = max_duration_ns / 1_000_000; // Convert to ms

        // Threshold: 100ms is considered blocking
        const BLOCKING_THRESHOLD_MS: u64 = 100;

        if max_duration_ms >= BLOCKING_THRESHOLD_MS {
            Some(AntiPattern::BlockingMainThread { duration_ms: max_duration_ms })
        } else {
            None
        }
    }

    /// Calculate overall quality score based on detected anti-patterns
    ///
    /// Score is 1.0 (perfect) minus penalties for each anti-pattern.
    fn calculate_score(&self, anti_patterns: &[AntiPattern]) -> f64 {
        if anti_patterns.is_empty() {
            return 1.0;
        }

        // Each anti-pattern reduces score by 0.2
        let penalty = anti_patterns.len() as f64 * 0.2;
        (1.0 - penalty).max(0.0)
    }
}

impl Default for AntiPatternDetector {
    fn default() -> Self {
        Self::new(AntiPatternThresholds::default())
    }
}

// ============================================================================
// UNIT TESTS (EXTREME TDD - RED PHASE)
// ============================================================================

#[cfg(test)]
mod tests {
    use super::*;
    use crate::unified_trace::{SyscallSpan, UnifiedTrace};
    use std::borrow::Cow;

    // =========================================================================
    // GOD PROCESS DETECTION TESTS
    // =========================================================================

    /// Test: Detect God Process when >80% of syscalls come from one process
    ///
    /// Scenario: Process 1234 makes 90 syscalls, process 5678 makes 10 syscalls.
    /// Process 1234 has 90% of syscalls, exceeding the 80% threshold.
    /// Expected: Detect GodProcess anti-pattern for process 1234.
    #[test]
    fn test_god_process_detection_over_threshold() {
        // Create trace with dominant process
        let mut trace = UnifiedTrace::new(1234, "dominant_process".to_string());
        let parent_id = trace.process_span.span_id;

        // Process 1234 makes 90 syscalls
        for _ in 0..90 {
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("read"),
                vec![],
                100,
                trace.clock.now(),
                1000,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        // We need to simulate syscalls from a different process
        // For this test, we'll track syscalls with process_id via args
        // since SyscallSpan doesn't have process_id directly
        // The detector should infer from the trace structure

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        // Should detect God Process (90/90 = 100% from single process)
        let god_process =
            quality.anti_patterns.iter().find(|p| matches!(p, AntiPattern::GodProcess { .. }));

        assert!(god_process.is_some(), "Expected GodProcess detection for single-process trace");

        if let Some(AntiPattern::GodProcess { process_id, syscall_percent }) = god_process {
            assert_eq!(*process_id, 1234);
            assert!(*syscall_percent >= 80.0);
        }
    }

    /// Test: No God Process when syscalls are evenly distributed
    ///
    /// Scenario: 50% of syscalls from each of two processes.
    /// Neither exceeds the 80% threshold.
    /// Expected: No GodProcess anti-pattern detected.
    #[test]
    fn test_no_god_process_when_balanced() {
        // Create a trace - in UnifiedTrace, we can only have one process
        // So we need to simulate multi-process through the trace structure
        let mut trace = UnifiedTrace::new(1234, "process_a".to_string());
        let parent_id = trace.process_span.span_id;

        // Add 50 syscalls (balanced would mean <80% from any single process)
        for _ in 0..50 {
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("read"),
                vec![],
                100,
                trace.clock.now(),
                1000,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        // With single process trace, all syscalls are 100% from one process
        // For this test to be meaningful, we need multi-process support
        // or custom thresholds

        let detector = AntiPatternDetector::new(AntiPatternThresholds {
            god_process_syscall_percent: 100.1, // Set impossibly high
            ..Default::default()
        });

        let quality = detector.analyze(&trace);

        // With threshold > 100, should not detect God Process
        let god_process =
            quality.anti_patterns.iter().find(|p| matches!(p, AntiPattern::GodProcess { .. }));

        assert!(god_process.is_none(), "Should not detect GodProcess when threshold not exceeded");
    }

    /// Test: God Process detection with custom threshold
    ///
    /// Scenario: Set threshold to 50%, trace has 60% from one process.
    /// Expected: Detect GodProcess with custom threshold.
    #[test]
    fn test_god_process_custom_threshold() {
        let mut trace = UnifiedTrace::new(9999, "custom_threshold".to_string());
        let parent_id = trace.process_span.span_id;

        // Add syscalls (all from same process)
        for _ in 0..60 {
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("write"),
                vec![],
                50,
                trace.clock.now(),
                500,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        // Set lower threshold
        let detector = AntiPatternDetector::new(AntiPatternThresholds {
            god_process_syscall_percent: 50.0,
            ..Default::default()
        });

        let quality = detector.analyze(&trace);

        // Should detect because 100% > 50% threshold
        assert!(
            quality.anti_patterns.iter().any(|p| matches!(p, AntiPattern::GodProcess { .. })),
            "Expected GodProcess detection with 50% threshold"
        );
    }

    /// Test: Quality score reflects anti-pattern severity
    ///
    /// Scenario: Trace with God Process detected.
    /// Expected: Quality score < 1.0 due to anti-pattern.
    #[test]
    fn test_quality_score_reflects_antipatterns() {
        let mut trace = UnifiedTrace::new(1111, "quality_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create trace with 100% syscalls from single process
        for _ in 0..100 {
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("ioctl"),
                vec![],
                0,
                trace.clock.now(),
                100,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        // Score should be reduced when anti-patterns exist
        if !quality.anti_patterns.is_empty() {
            assert!(
                quality.score < 1.0,
                "Score should be < 1.0 when anti-patterns detected, got {}",
                quality.score
            );
        }
    }

    /// Test: Recommendations generated for God Process
    ///
    /// Scenario: God Process detected.
    /// Expected: Recommendations include advice about decomposition.
    #[test]
    fn test_god_process_generates_recommendations() {
        let mut trace = UnifiedTrace::new(2222, "recommendations_test".to_string());
        let parent_id = trace.process_span.span_id;

        for _ in 0..85 {
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("read"),
                vec![],
                100,
                trace.clock.now(),
                1000,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        if quality.anti_patterns.iter().any(|p| matches!(p, AntiPattern::GodProcess { .. })) {
            assert!(!quality.recommendations.is_empty(), "Expected recommendations for GodProcess");
        }
    }

    /// Test: Empty trace produces perfect score
    ///
    /// Scenario: Trace with no syscalls.
    /// Expected: Score of 1.0 (no anti-patterns possible).
    #[test]
    fn test_empty_trace_perfect_score() {
        let trace = UnifiedTrace::new(3333, "empty_trace".to_string());
        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        assert_eq!(quality.score, 1.0, "Empty trace should have perfect score");
        assert!(quality.anti_patterns.is_empty(), "Empty trace should have no anti-patterns");
    }

    // =========================================================================
    // TIGHT LOOP DETECTION TESTS
    // =========================================================================

    /// Test: Detect Tight Loop when syscalls occur at intervals below threshold
    ///
    /// Scenario: 100 syscalls with average interval of 5ms (< 10ms threshold).
    /// Expected: Detect TightLoop anti-pattern.
    #[test]
    fn test_tight_loop_detection_below_threshold() {
        let mut trace = UnifiedTrace::new(4444, "tight_loop_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create syscalls with 5ms (5_000_000 ns) intervals
        let base_time = 1_000_000_000u64; // 1 second
        for i in 0..100 {
            let timestamp = base_time + (i as u64 * 5_000_000); // 5ms intervals
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("read"),
                vec![],
                100,
                timestamp,
                100_000, // 0.1ms duration
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default(); // threshold = 10ms
        let quality = detector.analyze(&trace);

        // Should detect TightLoop (5ms < 10ms threshold)
        let tight_loop =
            quality.anti_patterns.iter().find(|p| matches!(p, AntiPattern::TightLoop { .. }));

        assert!(tight_loop.is_some(), "Expected TightLoop detection for 5ms intervals");

        if let Some(AntiPattern::TightLoop { interval_ms, .. }) = tight_loop {
            assert!(*interval_ms < 10, "Interval should be < 10ms, got {}", interval_ms);
        }
    }

    /// Test: No Tight Loop when intervals are above threshold
    ///
    /// Scenario: Syscalls with 20ms intervals (> 10ms threshold).
    /// Expected: No TightLoop anti-pattern.
    #[test]
    fn test_no_tight_loop_above_threshold() {
        let mut trace = UnifiedTrace::new(5555, "no_tight_loop".to_string());
        let parent_id = trace.process_span.span_id;

        // Create syscalls with 20ms (20_000_000 ns) intervals
        let base_time = 1_000_000_000u64;
        for i in 0..50 {
            let timestamp = base_time + (i as u64 * 20_000_000); // 20ms intervals
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("write"),
                vec![],
                50,
                timestamp,
                100_000,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        // Should NOT detect TightLoop (20ms > 10ms threshold)
        let tight_loop =
            quality.anti_patterns.iter().find(|p| matches!(p, AntiPattern::TightLoop { .. }));

        assert!(
            tight_loop.is_none(),
            "Should not detect TightLoop when intervals exceed threshold"
        );
    }

    /// Test: Tight Loop detection with custom threshold
    ///
    /// Scenario: 15ms intervals, threshold set to 20ms.
    /// Expected: Detect TightLoop because 15ms < 20ms.
    #[test]
    fn test_tight_loop_custom_threshold() {
        let mut trace = UnifiedTrace::new(6666, "custom_tight_loop".to_string());
        let parent_id = trace.process_span.span_id;

        // Create syscalls with 15ms intervals
        let base_time = 1_000_000_000u64;
        for i in 0..30 {
            let timestamp = base_time + (i as u64 * 15_000_000); // 15ms intervals
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("ioctl"),
                vec![],
                0,
                timestamp,
                50_000,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::new(AntiPatternThresholds {
            tight_loop_threshold_ms: 20, // Raise threshold to 20ms
            ..Default::default()
        });

        let quality = detector.analyze(&trace);

        // Should detect TightLoop (15ms < 20ms threshold)
        assert!(
            quality.anti_patterns.iter().any(|p| matches!(p, AntiPattern::TightLoop { .. })),
            "Expected TightLoop detection with 20ms threshold"
        );
    }

    /// Test: Tight Loop location indicates syscall pattern
    ///
    /// Scenario: Tight loop of "read" syscalls.
    /// Expected: Location field includes syscall name.
    #[test]
    fn test_tight_loop_location_contains_syscall_name() {
        let mut trace = UnifiedTrace::new(7777, "location_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create tight loop of "futex" syscalls (common tight loop pattern)
        let base_time = 1_000_000_000u64;
        for i in 0..50 {
            let timestamp = base_time + (i as u64 * 1_000_000); // 1ms intervals
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("futex"),
                vec![],
                0,
                timestamp,
                10_000,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        let tight_loop =
            quality.anti_patterns.iter().find(|p| matches!(p, AntiPattern::TightLoop { .. }));

        if let Some(AntiPattern::TightLoop { location, .. }) = tight_loop {
            assert!(
                location.contains("futex"),
                "Location should contain syscall name, got: {}",
                location
            );
        }
    }

    // =========================================================================
    // EXCESSIVE I/O DETECTION TESTS
    // =========================================================================

    /// Test: Detect Excessive I/O when ops/sec exceeds threshold
    ///
    /// Scenario: 50000 I/O operations in 1 second (50000 ops/sec > 10000 threshold).
    /// Expected: Detect ExcessiveIO anti-pattern.
    #[test]
    fn test_excessive_io_detection_over_threshold() {
        let mut trace = UnifiedTrace::new(8888, "excessive_io_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create 15000 I/O syscalls in 1 second (1_000_000_000 ns)
        // This gives 15000 ops/sec which exceeds 10000 threshold
        let base_time = 1_000_000_000u64; // 1 second start
        let duration_ns = 1_000_000_000u64; // 1 second total
        let syscall_count = 15000;
        let interval = duration_ns / syscall_count;

        for i in 0..syscall_count {
            let timestamp = base_time + (i * interval);
            // Use I/O syscalls (read/write)
            let syscall_name = if i % 2 == 0 { "read" } else { "write" };
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed(syscall_name),
                vec![],
                100,
                timestamp,
                10_000, // 10μs duration
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default(); // threshold = 10000 ops/sec
        let quality = detector.analyze(&trace);

        // Should detect ExcessiveIO (15000 > 10000 threshold)
        let excessive_io =
            quality.anti_patterns.iter().find(|p| matches!(p, AntiPattern::ExcessiveIO { .. }));

        assert!(excessive_io.is_some(), "Expected ExcessiveIO detection for 15000 ops/sec");

        if let Some(AntiPattern::ExcessiveIO { ops_per_sec }) = excessive_io {
            assert!(*ops_per_sec > 10000, "ops/sec should be > 10000, got {}", ops_per_sec);
        }
    }

    /// Test: No Excessive I/O when ops/sec is below threshold
    ///
    /// Scenario: 5000 I/O operations in 1 second (5000 ops/sec < 10000 threshold).
    /// Expected: No ExcessiveIO anti-pattern.
    #[test]
    fn test_no_excessive_io_below_threshold() {
        let mut trace = UnifiedTrace::new(9999, "normal_io_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create 5000 I/O syscalls in 1 second (5000 ops/sec)
        let base_time = 1_000_000_000u64;
        let duration_ns = 1_000_000_000u64;
        let syscall_count = 5000u64;
        let interval = duration_ns / syscall_count;

        for i in 0..syscall_count {
            let timestamp = base_time + (i * interval);
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("read"),
                vec![],
                100,
                timestamp,
                10_000,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        // Should NOT detect ExcessiveIO (5000 < 10000 threshold)
        let excessive_io =
            quality.anti_patterns.iter().find(|p| matches!(p, AntiPattern::ExcessiveIO { .. }));

        assert!(excessive_io.is_none(), "Should not detect ExcessiveIO when below threshold");
    }

    /// Test: Excessive I/O detection with custom threshold
    ///
    /// Scenario: 3000 ops/sec, threshold set to 2000.
    /// Expected: Detect ExcessiveIO.
    #[test]
    fn test_excessive_io_custom_threshold() {
        let mut trace = UnifiedTrace::new(10000, "custom_io_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create 3000 ops in 1 second
        let base_time = 1_000_000_000u64;
        let duration_ns = 1_000_000_000u64;
        let syscall_count = 3000u64;
        let interval = duration_ns / syscall_count;

        for i in 0..syscall_count {
            let timestamp = base_time + (i * interval);
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("write"),
                vec![],
                50,
                timestamp,
                5_000,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::new(AntiPatternThresholds {
            excessive_io_ops_per_sec: 2000, // Lower threshold
            ..Default::default()
        });

        let quality = detector.analyze(&trace);

        // Should detect ExcessiveIO (3000 > 2000 threshold)
        assert!(
            quality.anti_patterns.iter().any(|p| matches!(p, AntiPattern::ExcessiveIO { .. })),
            "Expected ExcessiveIO detection with 2000 threshold"
        );
    }

    // =========================================================================
    // BLOCKING MAIN THREAD DETECTION TESTS
    // =========================================================================

    /// Test: Detect Blocking Main Thread for long syscall duration
    ///
    /// Scenario: Single syscall with 500ms duration (blocking).
    /// Expected: Detect BlockingMainThread anti-pattern.
    #[test]
    fn test_blocking_main_thread_detection() {
        let mut trace = UnifiedTrace::new(11111, "blocking_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create a syscall with 500ms duration (blocking)
        let syscall = SyscallSpan::new(
            parent_id,
            Cow::Borrowed("read"),
            vec![],
            100,
            1_000_000_000, // timestamp
            500_000_000,   // 500ms duration in nanoseconds
            None,
            &trace.clock,
        );
        trace.add_syscall(syscall);

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        // Should detect BlockingMainThread for 500ms operation
        let blocking = quality
            .anti_patterns
            .iter()
            .find(|p| matches!(p, AntiPattern::BlockingMainThread { .. }));

        assert!(blocking.is_some(), "Expected BlockingMainThread detection for 500ms syscall");

        if let Some(AntiPattern::BlockingMainThread { duration_ms }) = blocking {
            assert!(*duration_ms >= 100, "Duration should be >= 100ms, got {}", duration_ms);
        }
    }

    /// Test: No Blocking Main Thread for short syscalls
    ///
    /// Scenario: Syscalls with < 100ms duration.
    /// Expected: No BlockingMainThread anti-pattern.
    #[test]
    fn test_no_blocking_for_short_syscalls() {
        let mut trace = UnifiedTrace::new(12222, "short_syscall_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create syscalls with 10ms duration (not blocking)
        for i in 0..10 {
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("read"),
                vec![],
                100,
                1_000_000_000 + (i * 20_000_000), // 20ms apart
                10_000_000,                       // 10ms duration
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        // Should NOT detect BlockingMainThread (10ms < threshold)
        let blocking = quality
            .anti_patterns
            .iter()
            .find(|p| matches!(p, AntiPattern::BlockingMainThread { .. }));

        assert!(blocking.is_none(), "Should not detect BlockingMainThread for short syscalls");
    }

    /// Test: Blocking Main Thread detection with maximum duration
    ///
    /// Scenario: Multiple long syscalls, report the longest.
    /// Expected: BlockingMainThread reports max duration.
    #[test]
    fn test_blocking_main_thread_reports_max_duration() {
        let mut trace = UnifiedTrace::new(13333, "max_duration_test".to_string());
        let parent_id = trace.process_span.span_id;

        // Create syscalls with varying durations
        let durations = [100_000_000u64, 200_000_000, 300_000_000]; // 100ms, 200ms, 300ms

        for (i, &duration) in durations.iter().enumerate() {
            let syscall = SyscallSpan::new(
                parent_id,
                Cow::Borrowed("poll"),
                vec![],
                0,
                1_000_000_000 + (i as u64 * 400_000_000),
                duration,
                None,
                &trace.clock,
            );
            trace.add_syscall(syscall);
        }

        let detector = AntiPatternDetector::default();
        let quality = detector.analyze(&trace);

        if let Some(AntiPattern::BlockingMainThread { duration_ms }) = quality
            .anti_patterns
            .iter()
            .find(|p| matches!(p, AntiPattern::BlockingMainThread { .. }))
        {
            // Should report max duration (300ms)
            assert!(
                *duration_ms >= 200,
                "Should report max blocking duration, got {}ms",
                duration_ms
            );
        }
    }

    // =========================================================================
    // THRESHOLD CONFIGURATION TESTS
    // =========================================================================

    /// Test: Default thresholds are sane
    #[test]
    fn test_default_thresholds() {
        let thresholds = AntiPatternThresholds::default();

        assert_eq!(thresholds.god_process_syscall_percent, 80.0);
        assert_eq!(thresholds.tight_loop_threshold_ms, 10);
        assert_eq!(thresholds.excessive_io_ops_per_sec, 10000);
    }

    /// Test: Detector can be created with custom thresholds
    #[test]
    fn test_custom_thresholds() {
        let thresholds = AntiPatternThresholds {
            god_process_syscall_percent: 90.0,
            tight_loop_threshold_ms: 5,
            excessive_io_ops_per_sec: 5000,
        };

        let detector = AntiPatternDetector::new(thresholds.clone());
        assert_eq!(detector.thresholds.god_process_syscall_percent, 90.0);
        assert_eq!(detector.thresholds.tight_loop_threshold_ms, 5);
        assert_eq!(detector.thresholds.excessive_io_ops_per_sec, 5000);
    }
}