dracon-system 0.112.50

//! Tests for guard.rs (guard daemon runtime, disk monitoring, process management)
//!
//! These tests verify the guard runtime components after extraction from main.rs.

use super::*;

// ---------------------------------------------------------------------------
// GuardRuntimeState
// ---------------------------------------------------------------------------

#[test]
fn guard_runtime_state_default_is_empty() {
    let state = crate::GuardRuntimeState::default();
    assert!(state.heavy_since.is_empty());
    assert!(state.notify_cooldowns.is_empty());
    assert!(state.last_disk_state.is_empty());
    assert!(state.oom_known_descendants.is_empty());
    assert!(state.oom_pending_descendants.is_empty());
}

#[test]
fn oom_descendant_candidates_only_select_new_untracked_user_processes() {
    let sample = |pid: i32, ppid: i32, starttime: u64, command: &str| ProcSample {
        swap_mb: 0,
        pid,
        ppid,
        cpu_percent: 0.0,
        rss_mb: 1,
        nice: 0,
        command: command.to_string(),
        args: String::new(),
        starttime,
    };
    let samples = vec![
        sample(10, 1, 10, "root"),
        sample(11, 10, 11, "existing-child"),
        sample(12, 10, 12, "new-child"),
        sample(13, 12, 13, "new-grandchild"),
        sample(14, 1, 14, "unrelated"),
        sample(15, 10, 15, "kworker/0:1"),
        sample(16, 10, 16, "editor"),
        sample(17, 10, 17, "tracked-child"),
    ];
    let known = HashSet::from([(11, 11)]);
    let tracked = HashSet::from([10, 17]);
    let exempt = HashSet::from(["editor".to_string()]);

    let descendants = crate::process_descendant_samples(&samples, 10);
    assert_eq!(
        descendants
            .iter()
            .map(|sample| sample.pid)
            .collect::<Vec<_>>(),
        vec![11, 12, 13, 15, 16, 17]
    );
    let candidates = crate::oom_descendant_candidates(&samples, 10, &known, &tracked, &exempt);
    assert_eq!(
        candidates
            .iter()
            .map(|sample| sample.pid)
            .collect::<Vec<_>>(),
        vec![12, 13]
    );
}

#[test]
fn runtime_adjustment_plan_includes_every_reversible_limiter() {
    let mut state = crate::GuardRuntimeState::default();
    state.reniced_pids.insert(
        101,
        crate::LegacyReniceState {
            original_nice: 0,
            applied_nice: 5,
            identity: crate::ProcessIdentity {
                comm: "legacy-worker".to_string(),
                starttime: 1,
            },
        },
    );
    state.memory_reniced_pids.insert(
        102,
        crate::MemoryReniceState {
            original_nice: 3,
            applied_nice: 10,
            identity: crate::ProcessIdentity {
                comm: "memory-worker".to_string(),
                starttime: 2,
            },
        },
    );
    state.oom_biased_pids.insert(
        103,
        (
            -100,
            crate::ProcessIdentity {
                comm: "oom-worker".to_string(),
                starttime: 3,
            },
        ),
    );
    state.capped_pids.insert(
        104,
        (
            "dracon-cap.service".to_string(),
            "user.slice".to_string(),
            crate::ProcessIdentity {
                comm: "cap-worker".to_string(),
                starttime: 4,
            },
        ),
    );

    let plan = crate::runtime_adjustment_plan(&state);
    assert_eq!(plan.len(), 4);
    assert!(plan.contains(&crate::RuntimeAdjustment::Nice {
        pid: 101,
        original_nice: 0,
        identity: crate::ProcessIdentity {
            comm: "legacy-worker".to_string(),
            starttime: 1,
        },
        scope: crate::NiceRestoreScope::Legacy,
    }));
    assert!(plan.contains(&crate::RuntimeAdjustment::Nice {
        pid: 102,
        original_nice: 3,
        identity: crate::ProcessIdentity {
            comm: "memory-worker".to_string(),
            starttime: 2,
        },
        scope: crate::NiceRestoreScope::Memory,
    }));
    assert!(plan.contains(&crate::RuntimeAdjustment::OomBias {
        pid: 103,
        orig_adj: -100,
        identity: crate::ProcessIdentity {
            comm: "oom-worker".to_string(),
            starttime: 3,
        },
    }));
    assert!(plan.contains(&crate::RuntimeAdjustment::CpuCap {
        pid: 104,
        scope: "dracon-cap.service".to_string(),
        orig_cgroup: "user.slice".to_string(),
        identity: crate::ProcessIdentity {
            comm: "cap-worker".to_string(),
            starttime: 4,
        },
    }));
}

#[test]
fn guard_runtime_state_insert_and_retrieve_heavy_process() {
    let mut state = crate::GuardRuntimeState::default();
    state.heavy_since.insert(1234, (Instant::now(), 0));
    assert!(state.heavy_since.contains_key(&1234));
    state.heavy_since.remove(&1234);
    assert!(!state.heavy_since.contains_key(&1234));
}

// ---------------------------------------------------------------------------
// GuardPolicy — disk threshold accessors (pub fields)
// ---------------------------------------------------------------------------

#[test]
fn guard_policy_disk_thresholds_are_public() {
    let guard = GuardPolicy::default();
    assert_eq!(guard.disk_warn_percent, 80);
    assert_eq!(guard.disk_action_percent, 90);
    assert_eq!(guard.disk_critical_percent, 95);
    assert_eq!(guard.disk_early_warn_percent, 70);
}

// ---------------------------------------------------------------------------
// GuardReport
// ---------------------------------------------------------------------------

#[test]
fn guard_report_can_be_created_with_alerts() {
    use crate::GuardProcessAlert;
    use crate::GuardReport;

    let report = GuardReport {
        enabled: true,
        disk_use_percent: 72,
        disk_state: "warn".to_string(),
        sync_frozen: false,
        extra_mounts: Vec::new(),
        relocate_candidates: Vec::new(),
        relocated_count: 0,
        relocated_bytes: 0,
        alerts: vec![GuardProcessAlert {
            pid: 12345,
            ppid: 1,
            command: "cargo".to_string(),
            args: "build".to_string(),
            cpu_percent: 250.0,
            rss_mb: 1024,
            sustained_secs: 35,
            action: "reniced".to_string(),
            nice_value: 5,
        }],
        memory: None,
        zombies: Vec::new(),
        reap_candidates: Vec::new(),
        reaped: Vec::new(),
        disk_fill_gbph: None,
    };
    assert!(report.enabled);
    assert_eq!(report.disk_use_percent, 72);
    assert_eq!(report.alerts.len(), 1);
    assert_eq!(report.alerts[0].pid, 12345);
}

// ---------------------------------------------------------------------------
// graduated_nice_value
// ---------------------------------------------------------------------------

#[test]
fn graduated_nice_value_cpu_tier_180_percent() {
    // CPU >= 180% → nice 5
    assert_eq!(crate::graduated_nice_value(180.0, 0, 5, 0), 5);
    assert_eq!(crate::graduated_nice_value(200.0, 0, 5, 0), 5);
}

#[test]
fn graduated_nice_value_cpu_tier_300_percent() {
    // CPU >= 300% → nice 10
    assert_eq!(crate::graduated_nice_value(300.0, 0, 5, 0), 10);
    assert_eq!(crate::graduated_nice_value(350.0, 0, 5, 0), 10);
}

#[test]
fn graduated_nice_value_cpu_tier_500_percent() {
    // CPU >= 500% → nice 15
    assert_eq!(crate::graduated_nice_value(500.0, 0, 5, 0), 15);
    assert_eq!(crate::graduated_nice_value(600.0, 0, 5, 0), 15);
}

#[test]
fn graduated_nice_value_memory_4gb() {
    // 4 GB in MB = 4096
    assert_eq!(crate::graduated_nice_value(0.0, 4096, 5, 0), 5);
}

#[test]
fn graduated_nice_value_memory_8gb() {
    // 8 GB in MB = 8192
    assert_eq!(crate::graduated_nice_value(0.0, 8192, 10, 0), 10);
}

#[test]
fn graduated_nice_value_below_all_tiers_uses_base() {
    // Below all thresholds → base nice value
    assert_eq!(crate::graduated_nice_value(50.0, 100, 3, 0), 3);
    assert_eq!(crate::graduated_nice_value(100.0, 500, 7, 0), 7);
}

#[test]
fn graduated_nice_value_preserves_current_nice() {
    // A process already at a lower priority must not be raised to a tier's
    // smaller absolute nice value.
    assert_eq!(crate::graduated_nice_value(180.0, 0, 5, 10), 10);
    assert_eq!(crate::graduated_nice_value(50.0, 100, 5, 10), 10);
}

#[test]
fn graduated_nice_value_negative_base_clamped_to_zero() {
    assert_eq!(crate::graduated_nice_value(0.0, 0, -5, 0), 0);
}

#[test]
fn graduated_nice_value_high_base_clamped_to_max() {
    // Nice values are capped at 19
    assert_eq!(crate::graduated_nice_value(0.0, 0, 20, 0), 19);
}

// ---------------------------------------------------------------------------
// ProcSample parsing
// ---------------------------------------------------------------------------

#[test]
fn parse_ps_output_extracts_all_fields() {
    // ps output uses KB for RSS (ps man page: rss: resident set size in KB)
    let output = "12345  1  50.0  1024  3  cargo\n  23456  12345  25.0  2048  7  rustc";
    let samples = crate::parse_ps_output(output);
    assert_eq!(samples.len(), 2);

    assert_eq!(samples[0].pid, 12345);
    assert_eq!(samples[0].ppid, 1);
    assert_eq!(samples[0].cpu_percent, 50.0);
    // RSS is in KB, converted to MB via /1024
    assert_eq!(samples[0].rss_mb, 1024 / 1024); // 1024 KB = 1 MB
    assert_eq!(samples[0].nice, 3);
    assert_eq!(samples[0].command, "cargo");

    assert_eq!(samples[1].pid, 23456);
    assert_eq!(samples[1].ppid, 12345);
    assert_eq!(samples[1].cpu_percent, 25.0);
    assert_eq!(samples[1].rss_mb, 2048 / 1024); // 2048 KB = 2 MB
    assert_eq!(samples[1].nice, 7);
    assert_eq!(samples[1].command, "rustc");
}

#[test]
fn parse_ps_output_empty_input() {
    let samples = crate::parse_ps_output("");
    assert!(samples.is_empty());
}

#[test]
fn parse_ps_output_malformed_lines_skipped() {
    // Malformed lines should be skipped, good lines parsed
    let output = "not_valid\n12345  1  75.0  512  0  cargo";
    let samples = crate::parse_ps_output(output);
    assert_eq!(samples.len(), 1);
    assert_eq!(samples[0].pid, 12345);
    assert_eq!(samples[0].cpu_percent, 75.0);
}

#[test]
fn nice_restore_privilege_requires_root_or_cap_sys_nice() {
    let unprivileged = "Uid:\t1000\t1000\t1000\t1000\nCapEff:\t0000000000000000\n";
    let privileged = "Uid:\t1000\t1000\t1000\t1000\nCapEff:\t0000000000800000\n";
    let root = "Uid:\t0\t0\t0\t0\nCapEff:\t0000000000000000\n";

    assert!(!crate::has_nice_restore_privilege_from_status(unprivileged));
    assert!(crate::has_nice_restore_privilege_from_status(privileged));
    assert!(crate::has_nice_restore_privilege_from_status(root));
}

// ---------------------------------------------------------------------------
// disk_state
// ---------------------------------------------------------------------------

// Note: disk_state() in main.rs doesn't handle early-warn state.
// That state is managed in the guard daemon loop via check_disk_early_warning.
// The basic disk_state() only classifies: critical > action > warn > ok.

#[test]
fn disk_state_ok_below_warn() {
    let guard = GuardPolicy::default();
    assert_eq!(crate::disk_state(50, &guard), "ok");
    assert_eq!(crate::disk_state(79, &guard), "ok");
}

#[test]
fn disk_state_warn_between_warn_and_action() {
    let guard = GuardPolicy::default();
    assert_eq!(crate::disk_state(80, &guard), "warn");
    assert_eq!(crate::disk_state(89, &guard), "warn");
}

#[test]
fn disk_state_action_between_action_and_critical() {
    let guard = GuardPolicy::default();
    assert_eq!(crate::disk_state(90, &guard), "action");
    assert_eq!(crate::disk_state(94, &guard), "action");
}

#[test]
fn disk_state_critical_at_or_above_critical() {
    let guard = GuardPolicy::default();
    assert_eq!(crate::disk_state(95, &guard), "critical");
    assert_eq!(crate::disk_state(100, &guard), "critical");
}

// ---------------------------------------------------------------------------
// df parsing
// ---------------------------------------------------------------------------

#[test]
fn parse_df_use_percent_works() {
    // Typical df -P output
    let output = "Filesystem   1024-blocks    Used Available Capacity Mounted on\n/dev/sda1      19512345  15678901   3823444      80% /";
    assert_eq!(crate::parse_df_use_percent(output), Some(80));
}

#[test]
fn parse_df_use_percent_parses_without_percent_sign() {
    // parse_df_use_percent takes the 4th column and parses it as a number.
    // If the value is "80" without %, it still parses as Some(80).
    // This is normal df output behavior when the Use% column lacks the % sign.
    let output = "Filesystem   1024-blocks    Used Available Capacity Mounted on\n/dev/sda1      19512345  15678901   3823444      80 /";
    assert_eq!(crate::parse_df_use_percent(output), Some(80));
}

#[test]
fn parse_df_use_percent_no_matching_line() {
    assert_eq!(crate::parse_df_use_percent(""), None);
    assert_eq!(crate::parse_df_use_percent("no df output here"), None);
}

// ---------------------------------------------------------------------------
// should_notify cooldown logic
// ---------------------------------------------------------------------------

#[test]
fn should_notify_first_time_allowed() {
    let mut state = crate::GuardRuntimeState::default();
    let result = crate::should_notify(&mut state, "test-key", 300);
    assert!(result);
}

#[test]
fn should_notify_respects_cooldown() {
    let mut state = crate::GuardRuntimeState::default();
    // First call — allowed, records cooldown
    let first = crate::should_notify(&mut state, "my-event", 300);
    assert!(first);

    // Immediate second call — still in cooldown (cooldown recorded with future time)
    let second = crate::should_notify(&mut state, "my-event", 300);
    assert!(!second);

    // Remove the cooldown entry to simulate time passing — should be allowed again
    state.notify_cooldowns.remove("my-event");
    let third = crate::should_notify(&mut state, "my-event", 300);
    assert!(third);
}

#[test]
fn report_state_transition_suppresses_unchanged_events() {
    let mut state = crate::GuardRuntimeState::default();
    let (previous, first) = crate::report_state_transition(&mut state, "memory", "warn", 1800);
    assert!(previous.is_none());
    assert!(first);

    let (previous, repeated) = crate::report_state_transition(&mut state, "memory", "warn", 1800);
    assert_eq!(previous.as_deref(), Some("warn"));
    assert!(!repeated, "unchanged state must not emit every guard cycle");

    let (previous, recovery) = crate::report_state_transition(&mut state, "memory", "ok", 1800);
    assert_eq!(previous.as_deref(), Some("warn"));
    assert!(recovery, "state transitions should emit immediately");
}

#[test]
fn memory_pressure_ignores_swap_occupancy_without_active_pressure() {
    assert_eq!(
        crate::classify_memory_pressure(false, true, false),
        "ok",
        "cold pages in swap are not active pressure"
    );
    assert_eq!(crate::classify_memory_pressure(true, false, false), "warn");
    assert_eq!(
        crate::classify_memory_pressure(true, true, false),
        "critical"
    );
    assert_eq!(crate::classify_memory_pressure(false, false, true), "warn");
}

#[test]
fn swapin_velocity_flags_thrash_at_or_above_threshold() {
    // 2026-10-04: si ran at 100k+ pages/s while PSI sat at 3.9 and the
    // verdict read "ok", because velocity was only measured as a
    // PSI-absent fallback. Velocity is now a first-class thrash signal.
    assert!(!crate::swapin_velocity_thrash(None, 1000));
    assert!(!crate::swapin_velocity_thrash(Some(0.0), 1000));
    assert!(!crate::swapin_velocity_thrash(Some(999.9), 1000));
    assert!(crate::swapin_velocity_thrash(Some(1000.0), 1000));
    assert!(crate::swapin_velocity_thrash(Some(170_000.0), 1000));
}

#[test]
fn swapin_velocity_threshold_defaults_to_the_legacy_fallback() {
    // The old hardcoded PSI-fallback constant was 1000 pages/s; the knob
    // keeps that value, so PSI-absent hosts see no behavior change.
    assert_eq!(
        crate::GuardPolicy::default().mem_swapin_warn_pages_per_sec,
        1000
    );
}

#[test]
fn memory_pressure_requires_persistence_before_transition() {
    let mut state = crate::GuardRuntimeState::default();
    let start = Instant::now();

    let (stable, previous, changed) =
        crate::stabilize_memory_pressure_at(&mut state, "warn", 120, start);
    assert_eq!(stable, "ok");
    assert!(previous.is_none());
    assert!(!changed);

    let (stable, _, changed) = crate::stabilize_memory_pressure_at(
        &mut state,
        "warn",
        120,
        start + Duration::from_secs(119),
    );
    assert_eq!(stable, "ok");
    assert!(!changed);

    let (stable, previous, changed) = crate::stabilize_memory_pressure_at(
        &mut state,
        "warn",
        120,
        start + Duration::from_secs(120),
    );
    assert_eq!(stable, "warn");
    assert_eq!(previous.as_deref(), Some("ok"));
    assert!(changed);

    let (stable, _, changed) = crate::stabilize_memory_pressure_at(
        &mut state,
        "ok",
        120,
        start + Duration::from_secs(121),
    );
    assert_eq!(stable, "warn");
    assert!(!changed);

    let (stable, previous, changed) = crate::stabilize_memory_pressure_at(
        &mut state,
        "ok",
        120,
        start + Duration::from_secs(241),
    );
    assert_eq!(stable, "ok");
    assert_eq!(previous.as_deref(), Some("warn"));
    assert!(changed);
}

// ---------------------------------------------------------------------------
// disk-trend warning
// ---------------------------------------------------------------------------

/// The disk-trend warning must fire for a SLOW fill — the case the
/// rapid-fill threshold misses.
///
/// ADDED 2026-10-25 (audit D8): the prediction used to regress the PERCENT
/// history over a ten-minute window. Below roughly 50 GiB/h the disk does
/// not move a whole percent inside that window (1% of a 907 GiB disk is
/// ~9 GiB), so the predictor found no growth and reported "not filling". The
/// guard therefore stayed silent about a disk that was hours from full.
#[test]
fn a_slow_fill_warns_even_though_it_is_below_the_rapid_fill_threshold() {
    use crate::{disk_trend_warning, DiskFillRate};
    let gib = 1_073_741_824u64;
    // 138 GiB free, filling at 10 GiB/h → 13.8 hours to full, inside the
    // 24-hour horizon, and BELOW the 20 GiB/h rapid-fill threshold.
    let warning = disk_trend_warning(
        DiskFillRate::Filling(10.0),
        138 * gib,
        24,
        20.0,
    )
    .expect("a disk 13.8 hours from full must warn");
    assert!(
        (warning.hours - 13.8).abs() < 0.05,
        "the figure must be the honest one: {}",
        warning.hours
    );
    assert_eq!(warning.gbph, 10.0);
}

/// The rapid-fill alarm owns the fast case: the trend warning must not
/// raise a second alarm saying the same thing.
#[test]
fn the_rapid_fill_alarm_owns_the_fast_case() {
    use crate::{disk_trend_warning, DiskFillRate};
    let gib = 1_073_741_824u64;
    // 138 GiB free at 55.8 GiB/h → 2.5 hours. The rapid-fill alarm (>= 20
    // GiB/h) already says this, with the same figure.
    assert!(
        disk_trend_warning(DiskFillRate::Filling(55.8), 138 * gib, 24, 20.0).is_none(),
        "a fast fill is the rapid-fill alarm's job — two alarms saying one thing is noise"
    );
}

/// A rate that was not measured must never become a deadline.
#[test]
fn an_unmeasured_rate_never_produces_a_deadline() {
    use crate::{disk_trend_warning, DiskFillRate};
    let gib = 1_073_741_824u64;
    // "Unmeasured" is not "not filling" and not "hours until full" (the D1
    // rule): the guard states nothing it has not measured.
    assert!(disk_trend_warning(DiskFillRate::Unmeasured, 138 * gib, 24, 20.0).is_none());
    // A disk that is genuinely not filling has no deadline either.
    assert!(disk_trend_warning(DiskFillRate::NotFilling, 138 * gib, 24, 20.0).is_none());
}

/// The horizon and the "never alert" sentinel both silence the warning.
#[test]
fn the_trend_horizon_bounds_the_warning() {
    use crate::{disk_trend_warning, DiskFillRate};
    let gib = 1_073_741_824u64;
    // 138 GiB free at 10 GiB/h → 13.8 h. Outside a 12-hour horizon → quiet.
    assert!(disk_trend_warning(DiskFillRate::Filling(10.0), 138 * gib, 12, 20.0).is_none());
    // `trend_warn_hours = 0` is the documented "never alert" sentinel.
    assert!(disk_trend_warning(DiskFillRate::Filling(10.0), 138 * gib, 0, 20.0).is_none());
}

/// Every MONITORING capability must leave a RECORD, not just a popup.
///
/// ADDED 2026-10-25 (audit D9): five of the guard's observations reached
/// only a desktop notification — the disk pressure transition, the disk
/// early warning, the heavy-process alert, the inode warning and the
/// large-log warning. A popup is transient and belongs to the desktop: if
/// the operator was away, or the session had no display, the observation
/// was erased completely — the guard had noticed something and there was no
/// way to find out what. The guard's own rule (from the log-directory
/// check) is that "a silent skip is exactly how a monitoring feature
/// disappears without anyone noticing".
///
/// This pins the list: each check must emit an event under a named path, so
/// `dracon-system events` shows what the guard saw.
#[test]
fn every_monitoring_capability_records_an_event() {
    const SOURCE: &str = include_str!("main.rs");
    const CHECKS: &[(&str, &str)] = &[
        ("fn check_disk_state_change(", "disk/state-change"),
        ("fn check_disk_early_warning(", "disk/early-warning"),
        ("fn check_rapid_disk_fill(", "disk/rapid-fill"),
        ("fn check_disk_trends(", "disk/trend-warning"),
        ("fn check_memory_pressure(", "memory/pressure"),
        ("fn check_heavy_processes(", "process/heavy"),
        ("fn check_zombie_processes(", "process/zombies"),
        ("fn check_inode_usage(", "filesystem/inode-warning"),
        ("fn check_large_logs(", "filesystem/log-size"),
        ("fn check_extra_mounts(", "disk/extra-mount"),
        ("fn check_reap_candidates(", "process/reap-candidates"),
        ("fn check_link_drift(", "links-drifted"),
    ];
    for (signature, event_path) in CHECKS {
        let body = top_level_fn_source(SOURCE, signature);
        assert!(
            body.contains("emit_event("),
            "{} must record what it observed — a desktop popup is transient and is erased when the operator is away",
            signature
        );
        assert!(
            body.contains(event_path),
            "{} must record it as `{}` so it can be found in the event stream",
            signature,
            event_path
        );
    }
}

/// The SECONDARY disks must be reported by the DAEMON, not only by the
/// one-shot table.
///
/// ADDED 2026-10-25 (audit D10): `disk_extra_mounts` was read on every pass
/// and the result was thrown away — the daemon discards the `GuardReport`,
/// so the extra mounts were visible to `dracon-system guard once` and to
/// nobody else. It matters because the guard's reclaim strategy leans on
/// that disk: the stash lives on it, and a stash move to a full disk FAILS,
/// so the guard stops reclaiming anything while the reason goes unmentioned.
#[test]
fn the_daemon_reports_the_secondary_mounts() {
    const SOURCE: &str = include_str!("main.rs");

    // The guard PASS calls the reporter — the daemon discards the report, so
    // the check has to be inside the pass to be seen at all.
    let pass = top_level_fn_source(SOURCE, "pub(crate) async fn run_guard_once(");
    assert!(
        pass.contains("disk_details_for(&mount)"),
        "the guard pass must have been located — otherwise the assertion below would pass on an empty region"
    );
    assert!(
        pass.contains("check_extra_mounts("),
        "the guard pass must report the secondary mounts: the daemon discards the GuardReport, so a check outside the pass is invisible"
    );

    // An unreadable mount is collected, not dropped at a verbosity the daemon
    // never prints.
    assert!(
        !pass.contains("veprintln!(1, \"extra mount"),
        "an unreadable secondary mount must be COLLECTED and reported, not dropped at verbosity 1"
    );
}

/// The abandoned dev/test process WORKLIST must be reported by the daemon.
///
/// ADDED 2026-10-25 (audit D11): the candidates went into the `GuardReport`
/// and the daemon DISCARDS the `GuardReport`, so the worklist was visible
/// only to `dracon-system guard once` — a worklist the operator has to ask
/// for is a worklist nobody acts on. The candidates are dev servers that
/// have been alive 24+ hours with almost no CPU, on a host that runs at
/// 1–3% available memory.
#[test]
fn the_daemon_reports_the_abandoned_dev_server_worklist() {
    const SOURCE: &str = include_str!("main.rs");
    let pass = top_level_fn_source(SOURCE, "pub(crate) async fn run_guard_once(");
    assert!(
        pass.contains("reap_candidates(guard)"),
        "the guard pass must have been located — otherwise the assertion below would pass on an empty region"
    );
    assert!(
        pass.contains("check_reap_candidates("),
        "the guard pass must report the abandoned dev/test worklist: the daemon discards the GuardReport, so a check outside the pass is invisible"
    );
}

// ---------------------------------------------------------------------------
// AutoCleanupResult
// ---------------------------------------------------------------------------

#[test]
fn auto_cleanup_result_default() {
    let result = crate::AutoCleanupResult::default();
    assert_eq!(result.cleaned_count, 0);
    assert_eq!(result.reclaimed_bytes, 0);
    assert!(result.cleaned_paths.is_empty());
    assert!(result.protected_paths.is_empty());
}

// ---------------------------------------------------------------------------
// Memory pressure (ADDED 2026-08-10, v0.112.35)
// ---------------------------------------------------------------------------

#[test]
fn parse_meminfo_reads_all_four_fields() {
    let sample = r#"MemTotal:       32754688 kB
MemFree:         1098776 kB
MemAvailable:    9010908 kB
SwapTotal:      32680964 kB
SwapFree:       11556016 kB
"#;
    let m = crate::parse_meminfo(sample).expect("meminfo should parse");
    assert_eq!(m.mem_total_kb, 32754688);
    assert_eq!(m.mem_available_kb, 9010908);
    assert_eq!(m.swap_total_kb, 32680964);
    assert_eq!(m.swap_free_kb, 11556016);
    // 9010908 / 32754688 ≈ 27%
    assert_eq!(m.mem_available_percent(), 27);
    // (32680964 - 11556016) / 32680964 ≈ 64.6%
    assert_eq!(m.swap_used_percent(), 64);
}

#[test]
fn parse_meminfo_missing_swap_reports_zero_used() {
    let sample = "MemTotal:       1048576 kB\nMemAvailable:     65536 kB\n";
    let m = crate::parse_meminfo(sample).expect("meminfo should parse");
    assert_eq!(m.mem_available_percent(), 6);
    assert_eq!(m.swap_used_percent(), 0);
}

#[test]
fn parse_meminfo_garbage_returns_none() {
    assert!(crate::parse_meminfo("not meminfo at all").is_none());
    assert!(crate::parse_meminfo("").is_none());
}

#[test]
fn parse_pressure_memory_extracts_full_and_some() {
    let psi = r#"some avg10=1.23 avg60=2.00 avg300=0.66 total=3743158654
full avg10=4.56 avg60=0.30 avg300=0.65 total=3579061268
"#;
    let (full, some) = crate::parse_pressure_memory(psi).expect("psi should parse");
    assert!((full - 4.56).abs() < 1e-9);
    assert!((some - 1.23).abs() < 1e-9);
}

#[test]
fn parse_pressure_memory_no_full_line_returns_none() {
    assert!(
        crate::parse_pressure_memory("some avg10=1.00 avg60=1.00 avg300=1.00 total=1").is_none()
    );
}

#[test]
fn parse_vmstat_swap_reads_counters() {
    let vmstat = "pswpin 1022648496\npswpout 1187700919\nnr_free_pages 12345\n";
    let (pin, pout) = crate::parse_vmstat_swap(vmstat).expect("vmstat should parse");
    assert_eq!(pin, 1022648496);
    assert_eq!(pout, 1187700919);
}

// ---------------------------------------------------------------------------
// Zombie parsing (ADDED 2026-08-10, v0.112.35)
// ---------------------------------------------------------------------------

#[test]
fn record_swap_counters_preserves_pswpout() {
    let mut state = crate::GuardRuntimeState::default();
    crate::record_swap_counters(&mut state, 123, 456);
    let (_, pswpin, pswpout) = state.prev_swap_counters.expect("counters recorded");
    assert_eq!(pswpin, 123);
    assert_eq!(pswpout, 456);
}

#[test]
fn parse_proc_stat_zombie_detects_z_state() {
    // pid=1234, comm contains a space (valid), state=Z, ppid=567,
    // starttime=999 (field 22, index 19 after pid+comm).
    let line = "1234 (chrome --type=renderer) Z 567 1 567 0 -1 4194304 42 0 0 0 0 0 0 0 20 0 1 0 999 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0";
    let (pid, comm, ppid, starttime) =
        crate::parse_proc_stat_zombie(line).expect("zombie stat should parse");
    assert_eq!(pid, 1234);
    assert_eq!(comm, "chrome --type=renderer");
    assert_eq!(ppid, 567);
    assert_eq!(starttime, 999);
}

#[test]
fn parse_proc_stat_zombie_ignores_non_zombies() {
    let line = "42 (bash) S 1 42 42 0 -1 4194304 100 0 0 0 0 0 0 0 20 0 1 0 123 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0";
    assert!(crate::parse_proc_stat_zombie(line).is_none());
}

// ---------------------------------------------------------------------------
// Trash credential guard (ADDED 2026-08-10, v0.112.35)
// ---------------------------------------------------------------------------

#[test]
fn looks_credential_like_matches_known_patterns() {
    assert!(crate::looks_credential_like("Login Data"));
    assert!(crate::looks_credential_like("CREDENTIALS.md"));
    assert!(crate::looks_credential_like("secrets.rs"));
    assert!(crate::looks_credential_like(".env"));
    assert!(crate::looks_credential_like("github.env"));
    assert!(crate::looks_credential_like("id_ed25519.key"));
    assert!(crate::looks_credential_like("backup.age"));
    assert!(crate::looks_credential_like(".git-credentials"));
    assert!(crate::looks_credential_like(".npmrc"));
    assert!(crate::looks_credential_like("hosts.yml"));
    assert!(crate::looks_credential_like("password-store"));
    // CHANGED 2026-10-25 (audit, operator decision): the loose substring
    // rule is gone, so a name that merely CONTAINS a credential word no
    // longer counts. It kept an entire 5 GiB deleted item alive on its
    // own.
    assert!(!crate::looks_credential_like("wallet-token-cache"));
}

#[test]
fn looks_credential_like_ignores_benign_names() {
    assert!(!crate::looks_credential_like("target"));
    assert!(!crate::looks_credential_like("node_modules"));
    assert!(!crate::looks_credential_like("ai-vid-editor"));
    assert!(!crate::looks_credential_like("nixpkgs"));
    assert!(!crate::looks_credential_like("go"));
    assert!(!crate::looks_credential_like("saved_stuff"));
    assert!(!crate::looks_credential_like("references"));
}

// ---------------------------------------------------------------------------
// Disk fill rate (ADDED 2026-08-10, v0.112.35)
// ---------------------------------------------------------------------------

#[test]
fn disk_fill_rate_computes_sustained_rate() {
    let now = Instant::now();
    // 10 GiB per hour for 2 hours = 20 GiB growth.
    let history: Vec<(Instant, u64)> = vec![
        (now - Duration::from_secs(7200), 500u64 * 1024 * 1024 * 1024),
        (now - Duration::from_secs(3600), 510u64 * 1024 * 1024 * 1024),
        (now, 520u64 * 1024 * 1024 * 1024),
    ];
    let rate = crate::disk_fill_rate(&history)
        .rate_gbph()
        .expect("rate should compute");
    assert!((rate - 10.0).abs() < 0.5, "expected ~10 GiB/h, got {rate}");
}

#[test]
fn disk_fill_rate_requires_minimum_samples_and_span() {
    let now = Instant::now();
    assert_eq!(
        crate::disk_fill_rate(&[]),
        crate::DiskFillRate::Unmeasured,
        "no samples at all is unmeasured, not 'not filling'"
    );
    assert_eq!(
        crate::disk_fill_rate(&[(now, 100), (now, 200)]),
        crate::DiskFillRate::Unmeasured,
        "too few samples is unmeasured"
    );
    // Span too short (10s < 60s).
    let short: Vec<(Instant, u64)> = vec![
        (now - Duration::from_secs(10), 100),
        (now - Duration::from_secs(5), 200),
        (now, 300),
    ];
    assert_eq!(
        crate::disk_fill_rate(&short),
        crate::DiskFillRate::Unmeasured,
        "a window that spans under 60s is unmeasured"
    );
}

#[test]
fn disk_fill_rate_reports_not_filling_when_the_disk_is_flat() {
    let now = Instant::now();
    let gib = 1024u64 * 1024 * 1024;
    // A flat disk: no decrease, so the growth window is the whole history,
    // and the measured slope is zero. That is the ONE case the guard can
    // state as a fact: the disk is not filling.
    let history: Vec<(Instant, u64)> = vec![
        (now - Duration::from_secs(7200), 600 * gib),
        (now - Duration::from_secs(3600), 600 * gib),
        (now, 600 * gib),
    ];
    assert_eq!(
        crate::disk_fill_rate(&history),
        crate::DiskFillRate::NotFilling,
        "a flat disk is genuinely not filling"
    );
}

#[test]
fn a_shrinking_disk_is_unmeasured_because_a_decrease_starts_a_new_window() {
    let now = Instant::now();
    let gib = 1024u64 * 1024 * 1024;
    // Every sample is lower than the last. The reclamation rule starts a
    // fresh growth window at the last decrease, and that window holds a
    // single sample — so the trend cannot be measured. The guard must say
    // "unmeasured" here, NOT "not filling": the disk may be shrinking
    // because something reclaimed space, and the next samples will say.
    let history: Vec<(Instant, u64)> = vec![
        (now - Duration::from_secs(7200), 600 * gib),
        (now - Duration::from_secs(3600), 550 * gib),
        (now, 500 * gib),
    ];
    assert_eq!(
        crate::disk_fill_rate(&history),
        crate::DiskFillRate::Unmeasured
    );
}

/// ADDED 2026-10-24 (audit): a reclamation resets the growth window, so the
/// rate is briefly unmeasurable. That is a THIRD state, distinct from "the
/// disk is not filling", and the report must not conflate them.
#[test]
fn a_reclamation_makes_the_rate_unmeasured_rather_than_not_filling() {
    let now = Instant::now();
    let gib = 1024u64 * 1024 * 1024;
    let history: Vec<(Instant, u64)> = vec![
        (now - Duration::from_secs(600), 600 * gib),
        (now - Duration::from_secs(300), 700 * gib),
        // The sweep reclaimed space: the used bytes drop.
        (now - Duration::from_secs(10), 400 * gib),
        (now, 410 * gib),
    ];
    assert_eq!(
        crate::disk_fill_rate(&history),
        crate::DiskFillRate::Unmeasured,
        "a fresh growth window that is too young to measure is unmeasured"
    );
}

// ── OOM-bias steering (v0.112.36) ────────────────────────────────────────

#[test]
fn oom_bias_target_raises_neutral_values_to_250() {
    assert_eq!(crate::oom_bias_target(0), Some(250));
    assert_eq!(crate::oom_bias_target(100), Some(250));
    assert_eq!(crate::oom_bias_target(-100), Some(250));
    assert_eq!(crate::oom_bias_target(-300), Some(250));
}

#[test]
fn oom_bias_target_never_raises_already_biased_or_protected() {
    // Already at/above the target: leave alone.
    assert_eq!(crate::oom_bias_target(250), None);
    assert_eq!(crate::oom_bias_target(500), None);
    assert_eq!(crate::oom_bias_target(1000), None);
    // Deliberately protected (unkillable or strongly shielded): never touch.
    assert_eq!(crate::oom_bias_target(-500), None);
    assert_eq!(crate::oom_bias_target(-800), None);
    assert_eq!(crate::oom_bias_target(-1000), None);
}

#[test]
fn oom_bias_target_boundaries() {
    assert_eq!(crate::oom_bias_target(249), Some(250));
    assert_eq!(crate::oom_bias_target(250), None);
    assert_eq!(crate::oom_bias_target(-499), Some(250));
    assert_eq!(crate::oom_bias_target(-500), None);
}

// ── Memory-limiter policy defaults (v0.112.36) ──────────────────────────

#[test]
fn memory_limiter_policy_defaults_are_safe() {
    let p = crate::GuardPolicy::default();
    assert!(!p.freeze_sync_at_action, "sync freeze must be opt-in");
    assert!(!p.auto_renice, "CPU priority changes must be opt-in");
    assert!(p.auto_renice_on_memory, "renice-on-memory default on");
    assert!(p.bias_oom_on_pressure, "oom-bias default on");
    assert_eq!(p.memory_pressure_sustain_secs, 120);
    assert_eq!(p.report_repeat_secs, 1800);
    assert_eq!(
        p.cap_offenders_cpu_percent, 0,
        "CPUQuota offender caps default OFF (opt-in)"
    );
}

#[test]
fn normalize_guard_policy_clamps_cpu_cap_percent() {
    let mut policy = crate::GuardPolicy {
        cap_offenders_cpu_percent: u32::MAX,
        ..Default::default()
    };
    crate::normalize_guard_policy(&mut policy);
    assert_eq!(policy.cap_offenders_cpu_percent, 100);

    policy.cap_offenders_cpu_percent = 100;
    crate::normalize_guard_policy(&mut policy);
    assert_eq!(policy.cap_offenders_cpu_percent, 100);
}

#[test]
fn resolve_bin_falls_back_to_bare_name_off_nixos() {
    // The lenient helper preserves the old PATH-relative behavior for
    // non-privilege callers (nix tooling).
    assert_eq!(
        crate::resolve_bin("dracon-definitely-not-a-binary"),
        "dracon-definitely-not-a-binary"
    );
    // A repeated lookup hits the cache and agrees with itself.
    assert_eq!(
        crate::resolve_bin("dracon-definitely-not-a-binary"),
        "dracon-definitely-not-a-binary"
    );
}

#[test]
fn resolve_bin_strict_refuses_unresolvable_names() {
    // Audit falsification round: privilege-adjacent execs (renice,
    // systemctl) must never fall back to a bare PATH-relative name that
    // PATH poisoning could redirect. Unresolvable names are an error.
    let err = crate::resolve_bin_strict("dracon-definitely-not-a-binary").unwrap_err();
    assert!(
        format!("{err:#}").contains("refusing PATH-relative exec"),
        "strict resolve must refuse, not fall back: {err:#}"
    );
}

#[test]
fn reap_policy_from_guard_maps_thresholds_and_shares_exempts() {
    // Audit MEDIUM: the daemon wiring between policy knobs and the reap
    // scanner had zero coverage. The exempt list is shared with pressure
    // mitigation on purpose (too important to renice ⇒ too important to
    // look abandoned), so pin that coupling here.
    let guard = crate::GuardPolicy {
        reap_report_min_idle_hours: 48,
        reap_report_max_cpu_seconds: 120,
        reap_report_signatures: "vite,mytool".to_string(),
        process_exempt_names: "keepme,alsokeep".to_string(),
        ..Default::default()
    };
    let policy = crate::reap_policy_from_guard(&guard);
    assert_eq!(policy.min_idle_hours, 48);
    assert_eq!(policy.max_cpu_seconds, 120);
    assert_eq!(
        policy.signatures,
        vec!["mytool".to_string(), "vite".to_string()]
    );
    assert!(policy.exempt_names.contains(&"keepme".to_string()));
    assert!(policy.exempt_names.contains(&"alsokeep".to_string()));
}

#[test]
fn reap_candidates_runs_against_live_proc_without_panicking() {
    // Shape-only smoke test: the daemon wiring must degrade to an empty
    // (or populated) Vec on a real machine, never panic or block the pass.
    let guard = crate::GuardPolicy::default();
    let found = crate::reap_candidates(&guard);
    for c in &found {
        assert!(c.idle_hours >= guard.reap_report_min_idle_hours);
        assert!(c.cpu_seconds <= guard.reap_report_max_cpu_seconds);
        assert!(!c.args.is_empty());
    }
}

#[test]
fn zombie_since_keys_carry_starttime_and_prune() {
    // A recycled PID must not inherit a dead zombie's age: first-seen is
    // keyed by (pid, starttime), and keys for vanished pids are pruned.
    let mut state = crate::GuardRuntimeState::default();
    state
        .zombies_since
        .insert((999_998, 12345), std::time::Instant::now());
    let _ = crate::zombie_details(&mut state);
    assert!(
        !state.zombies_since.contains_key(&(999_998, 12345)),
        "stale zombie key for a vanished pid must be pruned"
    );
}

#[test]
fn unavailable_identity_defer_drops_at_retry_limit() {
    // The oom-restore and cpu-uncap loops must not retain an entry whose
    // process identity stays unreadable forever (audit LOW: unbounded
    // defer leaks the tracking maps inside the 250 MiB cgroup).
    let mut attempts = std::collections::HashMap::new();
    assert!(!crate::record_unavailable_attempt(&mut attempts, 4242));
    assert!(!crate::record_unavailable_attempt(&mut attempts, 4242));
    assert!(crate::record_unavailable_attempt(&mut attempts, 4242));
    assert_eq!(attempts.get(&4242), Some(&3));
    // A different pid counts independently.
    assert!(!crate::record_unavailable_attempt(&mut attempts, 4243));
}

#[test]
fn clean_node_modules_flag_defaults_true_and_gates_toml_off() {
    // Audit M3 (2026-08-21): node_modules cleanup was the only cleanup
    // kind with no feature flag. The knob must default true (behavior
    // preserved) and parse false from TOML; run_auto_cleanup consults it
    // exactly like its clean_trash / clean_nix_garbage siblings, while
    // explicit `guard clean --node-modules` stays ungated.
    let policy: crate::GuardPolicy = toml::from_str("").expect("empty policy parses with defaults");
    assert!(policy.clean_node_modules);
    let policy: crate::GuardPolicy =
        toml::from_str("clean_node_modules = false\n").expect("flag-off parses");
    assert!(!policy.clean_node_modules);
}

#[test]
fn policy_load_roundtrip_memory_limiter_knobs() {
    // TOML parse → defaults preserved when keys absent.
    let policy: crate::GuardPolicy = toml::from_str("").expect("empty policy parses with defaults");
    assert!(policy.auto_renice_on_memory);
    assert!(policy.bias_oom_on_pressure);
    assert_eq!(policy.cap_offenders_cpu_percent, 0);
    // Explicit values round-trip.
    let policy: crate::GuardPolicy = toml::from_str(
        "auto_renice_on_memory = false\nbias_oom_on_pressure = false\ncap_offenders_cpu_percent = 50\n",
    )
    .expect("explicit knobs parse");
    assert!(!policy.auto_renice_on_memory);
    assert!(!policy.bias_oom_on_pressure);
    assert_eq!(policy.cap_offenders_cpu_percent, 50);
}

// ---------------------------------------------------------------------------
// SIGHUP reload — bounded, and never half-configured
//
// DECIDE #2 follow-up. The reload used to swap the policy unconditionally,
// so a partial restore of process adjustments could pair the NEW policy with
// the OLD policy's leftover runtime state. The concrete harm: if the new
// policy disables the mitigation that made an adjustment, nothing retries it
// and the process stays reniced for the daemon's lifetime.
// ---------------------------------------------------------------------------

fn runtime_with_pending_nice(pid: i32) -> GuardRuntimeState {
    let mut state = GuardRuntimeState::default();
    state.memory_reniced_pids.insert(
        pid,
        MemoryReniceState {
            original_nice: 3,
            applied_nice: 10,
            identity: ProcessIdentity {
                comm: "worker".to_string(),
                starttime: 42,
            },
        },
    );
    state
}

#[test]
fn a_fully_restored_reload_applies_the_new_policy_and_clears_runtime() {
    let mut guard = GuardPolicy::default();
    let mut runtime = runtime_with_pending_nice(4242);
    let new_policy = GuardPolicy {
        disk_warn_percent: 55,
        ..Default::default()
    };

    let outcome = apply_policy_reload(&mut guard, &mut runtime, new_policy, true);

    assert_eq!(outcome, ReloadOutcome::Applied);
    assert_eq!(guard.disk_warn_percent, 55, "new policy must be live");
    assert!(
        runtime.memory_reniced_pids.is_empty(),
        "a clean restore must reset the runtime so no old state survives"
    );
}

#[test]
fn a_partial_restore_keeps_the_previous_policy_live() {
    let mut guard = GuardPolicy {
        disk_warn_percent: 80,
        ..Default::default()
    };
    let mut runtime = runtime_with_pending_nice(4242);
    let new_policy = GuardPolicy {
        disk_warn_percent: 55,
        ..Default::default()
    };

    let outcome = apply_policy_reload(&mut guard, &mut runtime, new_policy, false);

    assert_eq!(outcome, ReloadOutcome::Deferred);
    assert_eq!(
        guard.disk_warn_percent, 80,
        "a deferred reload must not adopt the new policy"
    );
    assert_eq!(
        runtime.memory_reniced_pids.len(),
        1,
        "the pending adjustment must be retained so the still-armed mitigation retries it"
    );
}

/// The exact harm the ordering bug caused: a new policy that turns the
/// renice mitigation OFF, adopted on top of an unrestored adjustment, means
/// nothing ever restores the process.
#[test]
fn a_partial_restore_cannot_strand_an_adjustment_the_new_policy_disables() {
    let mut guard = GuardPolicy {
        auto_renice_on_memory: true,
        ..Default::default()
    };
    let mut runtime = runtime_with_pending_nice(4242);
    let new_policy = GuardPolicy {
        auto_renice_on_memory: false,
        ..Default::default()
    };

    let outcome = apply_policy_reload(&mut guard, &mut runtime, new_policy, false);

    assert_eq!(outcome, ReloadOutcome::Deferred);
    assert!(
        guard.auto_renice_on_memory,
        "the mitigation that produced the outstanding adjustment must stay armed, \
         otherwise the process is reniced forever with no path to restore it"
    );
    assert!(
        runtime.memory_reniced_pids.contains_key(&4242),
        "the outstanding adjustment must survive so it is retried"
    );
}

#[test]
fn a_partial_restore_with_only_threshold_changes_is_also_deferred() {
    // Deferral is not limited to mitigation toggles: any new policy is
    // refused, because the retained state is tied to the old one and we
    // cannot reason about the combination.
    let mut guard = GuardPolicy::default();
    let mut runtime = runtime_with_pending_nice(7);
    let new_policy = GuardPolicy {
        interval_secs: 5,
        ..Default::default()
    };

    assert_eq!(
        apply_policy_reload(&mut guard, &mut runtime, new_policy, false),
        ReloadOutcome::Deferred
    );
    assert_ne!(
        guard.interval_secs, 5,
        "the new interval must not be adopted"
    );
}

#[test]
fn disabling_the_guard_is_applied_even_after_a_partial_restore() {
    // Stopping is the safe direction, and the daemon's shutdown restore
    // re-tries the retained adjustments before it returns — so `enabled =
    // false` must not be blocked by a failed restore.
    let mut guard = GuardPolicy::default();
    let mut runtime = runtime_with_pending_nice(99);
    let new_policy = GuardPolicy {
        enabled: false,
        ..Default::default()
    };

    let outcome = apply_policy_reload(&mut guard, &mut runtime, new_policy, false);

    assert_eq!(outcome, ReloadOutcome::Applied);
    assert!(!guard.enabled, "enabled = false must always take effect");
    assert_eq!(
        runtime.memory_reniced_pids.len(),
        1,
        "state is retained for the shutdown restore, not dropped"
    );
}

#[test]
fn reload_is_idempotent_across_repeated_sighups() {
    let mut guard = GuardPolicy::default();
    let mut runtime = GuardRuntimeState::default();
    for _ in 0..5 {
        let p = GuardPolicy {
            disk_warn_percent: 70,
            ..Default::default()
        };
        assert_eq!(
            apply_policy_reload(&mut guard, &mut runtime, p, true),
            ReloadOutcome::Applied
        );
    }
    assert_eq!(guard.disk_warn_percent, 70);
    assert!(runtime.memory_reniced_pids.is_empty());
}

#[test]
fn a_reload_that_succeeds_after_a_deferred_one_recovers() {
    // A deferred reload must not wedge the daemon: once the restore
    // succeeds, the next SIGHUP applies normally.
    let mut guard = GuardPolicy::default();
    let mut runtime = runtime_with_pending_nice(1);
    let p1 = GuardPolicy {
        disk_warn_percent: 55,
        ..Default::default()
    };
    assert_eq!(
        apply_policy_reload(&mut guard, &mut runtime, p1, false),
        ReloadOutcome::Deferred
    );

    let p2 = GuardPolicy {
        disk_warn_percent: 55,
        ..Default::default()
    };
    assert_eq!(
        apply_policy_reload(&mut guard, &mut runtime, p2, true),
        ReloadOutcome::Applied
    );
    assert_eq!(guard.disk_warn_percent, 55);
    assert!(runtime.memory_reniced_pids.is_empty());
}

/// 2026-10-01 (audit HIGH): the `oom_score_adj` and CPUQuota RELEASES were inside
/// `if pressure == "ok" && can_restore_nice`, but their APPLIES are not gated by
/// that flag. On a host without CAP_SYS_NICE — a manual `guard daemon` run, or a
/// unit predating v0.112.39's `AmbientCapabilities` — the guard wrote
/// `oom_score_adj=250` and a CPUQuota cap under critical pressure and could then
/// never release either: the only recovery was SIGHUP or a restart, while the
/// sole warning printed said "renice mitigation disabled".
///
/// The defect was structural, so the guard is structural: the two release
/// halves must live OUTSIDE the `can_restore_nice` gate, which now wraps only
/// the renice half. Behavioural coverage would need the capability absent,
/// which this process cannot arrange, so `gated_release_markers` is a pure
/// function over the source text and is itself tested (see the next test).
fn gated_release_markers(src: &str) -> Result<Vec<String>, String> {
    let start = src
        .find("if pressure == \"ok\" {")
        .ok_or_else(|| "the pressure-release block was not found".to_string())?;
    let gate = src[start..]
        .find("if can_restore_nice {")
        .map(|i| start + i)
        .ok_or_else(|| {
            "the renice half is no longer gated on the restore capability".to_string()
        })?;
    let body = &src[gate..];

    // Brace-count to the gate's matching close.
    let mut depth = 0i32;
    let mut end = None;
    for (i, ch) in body.char_indices() {
        match ch {
            '{' => depth += 1,
            '}' => {
                depth -= 1;
                if depth == 0 {
                    end = Some(gate + i);
                    break;
                }
            }
            _ => {}
        }
    }
    let end = end.ok_or_else(|| "the capability gate is not brace-balanced".to_string())?;
    let gated = &src[gate..end];

    let mut wrongly_gated = Vec::new();
    for marker in [
        "Restore oom_score_adj after the release window",
        "Lift CPUQuota scopes after the release window",
    ] {
        if gated.contains(marker) {
            wrongly_gated.push(marker.to_string());
        }
        if !src[start..].contains(marker) {
            return Err(format!(
                "'{marker}' no longer exists: the release was deleted, not just ungated"
            ));
        }
    }
    // The renice half must still be inside the gate: it is the one that really
    // needs CAP_SYS_NICE, and its apply is gated too.
    if !gated.contains("mem-unrenice") {
        return Err(
            "the renice release left the can_restore_nice gate, but its apply is still gated"
                .to_string(),
        );
    }
    Ok(wrongly_gated)
}

#[test]
fn oom_and_cpu_releases_are_not_gated_by_the_nice_capability() {
    let wrongly = gated_release_markers(include_str!("main.rs"))
        .expect("the release block must be shaped as the fix requires");
    assert!(
        wrongly.is_empty(),
        "these releases are inside the can_restore_nice gate again, so a host without \
         CAP_SYS_NICE can never release them: {wrongly:?}"
    );
}

/// The guard above is only worth having if it FAILS on the old shape. This
/// feeds it a synthetic snippet with the pre-fix structure and requires it to
/// report both releases as gated.
#[test]
fn the_structural_guard_catches_a_reintroduced_defect() {
    let pre_fix = r#"
    if pressure == "ok" {
        if can_restore_nice {
            eprintln!("mem-unrenice");
        }
        // Restore oom_score_adj after the release window.
        let x = 1;
        // Lift CPUQuota scopes after the release window.
        let y = 2;
    } else {
    }
"#;
    // Nest the two releases back inside the gate, exactly as the old code had it.
    let pre_fix_nested = pre_fix.replace(
        "        if can_restore_nice {\n            eprintln!(\"mem-unrenice\");\n        }\n",
        "        if can_restore_nice {\n            eprintln!(\"mem-unrenice\");\n            // Restore oom_score_adj after the release window.\n            let x = 1;\n            // Lift CPUQuota scopes after the release window.\n            let y = 2;\n        }\n",
    );
    let wrongly = gated_release_markers(&pre_fix_nested)
        .expect("the synthetic snippet must still be parseable");
    assert_eq!(
        wrongly.len(),
        2,
        "the guard must flag both releases when they are nested in the gate: {wrongly:?}"
    );
}

/// 2026-10-01 (audit): the three `deferred += 1` sites in the descendant
/// oom-restoration sweep retried forever, so one child whose identity or
/// `oom_score_adj` was unreadable pinned its root at 250 for the life of the
/// process, grew the pending map without bound, and made every SIGHUP reload
/// permanently `Deferred`. The counter must stop the retries and the entry must
/// be dropped so the root can be released.
#[test]
fn pending_oom_descendant_retries_are_bounded() {
    let mut pending = OomPendingDescendant {
        root_pid: 1,
        original_adj: 0,
        identity: ProcessIdentity {
            starttime: 2,
            comm: "child".to_string(),
        },
        attempts: 0,
    };
    for attempt in 1..OOM_DESCENDANT_RETRY_LIMIT {
        assert!(
            !oom_descendant_attempts_exhausted(&mut pending),
            "attempt {attempt} must still be retried"
        );
        assert_eq!(pending.attempts, attempt);
    }
    assert!(
        oom_descendant_attempts_exhausted(&mut pending),
        "attempt {} must give up so the root is not pinned forever",
        OOM_DESCENDANT_RETRY_LIMIT
    );
    assert_eq!(pending.attempts, OOM_DESCENDANT_RETRY_LIMIT);
}

/// 2026-10-01 (audit): `oom_known_descendants` grew by one entry per descendant
/// incarnation ever seen and was only cleared when the root left
/// `oom_biased_pids`, so a long critical episode under a forking root
/// accumulated thousands of dead keys. The cap must actually prune.
#[test]
fn remembered_oom_descendants_are_pruned_past_the_cap() {
    use std::collections::HashSet;

    // A biased root with many dead descendants and one live one.
    let mut state = GuardRuntimeState::default();
    let identity = ProcessIdentity {
        starttime: 1,
        comm: "root".to_string(),
    };
    state.oom_biased_pids.insert(100, (0, identity.clone()));
    let live = (999, 42u64);
    let mut known: HashSet<(i32, u64)> = HashSet::new();
    known.insert(live);
    for i in 0..OOM_KNOWN_DESCENDANTS_CAP {
        known.insert((1000 + i as i32, u64::MAX - i as u64));
    }
    assert!(
        known.len() > OOM_KNOWN_DESCENDANTS_CAP,
        "the fixture must exceed the cap to exercise the prune"
    );
    state.oom_known_descendants.insert(100, known);
    // An unrelated, unbiased root must be dropped outright.
    state
        .oom_known_descendants
        .insert(200, HashSet::from([(1, 1)]));

    let all_processes = vec![crate::ProcSample {
        swap_mb: 0,
        pid: live.0,
        ppid: 1,
        cpu_percent: 0.0,
        rss_mb: 0,
        nice: 0,
        command: "child".to_string(),
        args: String::new(),
        starttime: live.1,
    }];
    prune_oom_known_descendants(&mut state, &all_processes);

    assert!(
        !state.oom_known_descendants.contains_key(&200),
        "a root that is no longer biased must lose its bookkeeping"
    );
    let kept = &state.oom_known_descendants[&100];
    assert!(
        kept.len() <= OOM_KNOWN_DESCENDANTS_CAP,
        "the set must not stay above the cap, got {}",
        kept.len()
    );
    assert!(
        kept.contains(&live),
        "a descendant that is still alive must be remembered"
    );
}

/// 2026-10-01 (audit): applied mitigations lived only in memory, so a panic or a
/// `MemoryMax=250M` OOM kill during a critical-pressure episode restarted the
/// guard with empty maps and left `nice`/`oom_score_adj`/CPUQuota applied to live
/// processes with no record that they needed restoring. The ledger must survive
/// the round trip that a restart performs.
#[test]
fn the_mitigation_ledger_survives_a_restart() {
    let dir = std::env::temp_dir().join(format!(
        "dracon-system-mitigation-ledger-{}-{}",
        std::process::id(),
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .expect("time")
            .as_nanos()
    ));
    std::fs::create_dir_all(&dir).unwrap();
    let path = dir.join("guard-mitigations.json");

    // The CURRENT process stands in for an adjusted one: its identity is
    // definitely current, so adoption must keep it.
    let me = std::process::id() as i32;
    let live_identity = {
        // Read the real starttime/comm so the identity check passes.
        let stat = std::fs::read_to_string(format!("/proc/{me}/stat")).unwrap_or_default();
        let after = stat.rsplit_once(") ").map(|(_, rest)| rest.to_string());
        let starttime = after
            .as_deref()
            .and_then(|rest| rest.split_whitespace().nth(19))
            .and_then(|v| v.parse::<u64>().ok())
            .unwrap_or(0);
        ProcessIdentity {
            starttime,
            comm: "self".to_string(),
        }
    };

    let mut before = GuardRuntimeState::default();
    before.memory_reniced_pids.insert(
        me,
        MemoryReniceState {
            original_nice: 0,
            applied_nice: 5,
            identity: live_identity.clone(),
        },
    );
    before
        .oom_biased_pids
        .insert(me, (0, live_identity.clone()));
    persist_mitigations_to(&mut before, &path);
    assert!(path.exists(), "the ledger must be written");
    // An unchanged pass must not rewrite the file.
    let first = std::fs::metadata(&path).unwrap().modified().unwrap();
    persist_mitigations_to(&mut before, &path);
    let second = std::fs::metadata(&path).unwrap().modified().unwrap();
    assert_eq!(
        first, second,
        "an unchanged pass must not rewrite the ledger"
    );

    // A fresh process (a restart) adopts them.
    let mut after_restart = GuardRuntimeState::default();
    hydrate_mitigations_from(&path, &mut after_restart);
    assert!(
        after_restart.memory_reniced_pids.contains_key(&me),
        "a renice left applied by the previous run must be adopted"
    );
    assert!(
        after_restart.oom_biased_pids.contains_key(&me),
        "an oom bias left applied by the previous run must be adopted"
    );

    // A RECYCLED pid is never adopted: a wrong starttime must not match.
    let mut recycled = GuardRuntimeState::default();
    let mut bad = std::fs::read_to_string(&path).unwrap();
    bad = bad.replace(
        &format!("\"starttime\":{}", live_identity.starttime),
        "\"starttime\":999999999",
    );
    std::fs::write(&path, bad).unwrap();
    hydrate_mitigations_from(&path, &mut recycled);
    assert!(
        recycled.memory_reniced_pids.is_empty() && recycled.oom_biased_pids.is_empty(),
        "a ledger entry whose identity does not match must be ignored, not adopted"
    );

    // A corrupt ledger is not fatal and not adopted.
    std::fs::write(&path, "{ not json").unwrap();
    let mut corrupt = GuardRuntimeState::default();
    hydrate_mitigations_from(&path, &mut corrupt);
    assert!(
        corrupt.memory_reniced_pids.is_empty(),
        "a corrupt ledger must not block the daemon"
    );

    let _ = std::fs::remove_dir_all(dir);
}

// ---------------------------------------------------------------------------
// Mitigation ledger: CPU-cap cgroup fidelity (audit 2026-10-01)
// ---------------------------------------------------------------------------

/// A unique scratch directory, and this process's real identity so the ledger's
/// identity check matches (same shape as the round-trip test above).
fn cap_cgroup_fixture(label: &str) -> (std::path::PathBuf, i32, ProcessIdentity) {
    let dir = std::env::temp_dir().join(format!(
        "dracon-system-{label}-{}-{}",
        std::process::id(),
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .expect("time")
            .as_nanos()
    ));
    std::fs::create_dir_all(&dir).expect("scratch dir");
    let me = std::process::id() as i32;
    let stat = std::fs::read_to_string(format!("/proc/{me}/stat")).unwrap_or_default();
    let starttime = stat
        .rsplit_once(") ")
        .and_then(|(_, rest)| rest.split_whitespace().nth(19))
        .and_then(|v| v.parse::<u64>().ok())
        .unwrap_or(0);
    let identity = ProcessIdentity {
        starttime,
        comm: "self".to_string(),
    };
    (dir.join("guard-mitigations.json"), me, identity)
}

#[test]
fn mitigation_ledger_round_trips_the_capped_pids_original_cgroup() {
    let (path, me, identity) = cap_cgroup_fixture("ledger-cap-cgroup");
    let orig_cgroup = "user.slice/user-1000.slice/user@1000.service/app.slice";

    let mut before = GuardRuntimeState::default();
    before.capped_pids.insert(
        me,
        (
            "run-r1.service".to_string(),
            orig_cgroup.to_string(),
            identity.clone(),
        ),
    );
    persist_mitigations_to(&mut before, &path);

    let mut after_restart = GuardRuntimeState::default();
    hydrate_mitigations_from(&path, &mut after_restart);
    let (scope, restored_cgroup, _) = after_restart
        .capped_pids
        .get(&me)
        .expect("a cap left applied by the previous run must be adopted");
    assert_eq!(scope, "run-r1.service");
    assert_eq!(
        restored_cgroup, orig_cgroup,
        "the cgroup to restore to must survive the restart, not hydrate empty"
    );

    let _ = std::fs::remove_dir_all(path.parent().unwrap());
}

#[test]
fn a_legacy_ledger_without_the_cgroup_still_hydrates_and_never_guesses_a_path() {
    let (path, me, identity) = cap_cgroup_fixture("ledger-cap-legacy");
    // A ledger written before cap_orig_cgroup existed: the field is absent, and
    // serde must read it as None instead of rejecting the whole file.
    // Built with the real serializer, then asserted to carry no cap_orig_cgroup:
    // this is exactly the shape a ledger written before that field existed has.
    let legacy = serde_json::json!({
        "records": [{
            "pid": me,
            "original_nice": serde_json::Value::Null,
            "original_oom_adj": serde_json::Value::Null,
            "cap_scope": "run-r9.service",
            "identity": {"starttime": identity.starttime, "comm": "self"},
        }]
    })
    .to_string();
    assert!(
        !legacy.contains("cap_orig_cgroup"),
        "the legacy fixture must not contain the newer field"
    );
    std::fs::write(&path, legacy).unwrap();

    let mut after_restart = GuardRuntimeState::default();
    hydrate_mitigations_from(&path, &mut after_restart);
    let (_, restored_cgroup, _) = after_restart
        .capped_pids
        .get(&me)
        .expect("a legacy ledger entry with a matching identity must still be adopted");
    assert_eq!(
        restored_cgroup, "",
        "a legacy ledger has no cgroup, and must be adopted with it empty"
    );

    // The empty value resolves to the transient unit's PARENT cgroup, never to
    // the empty path `/sys/fs/cgroup//cgroup.procs` (the cgroup root).
    let current = "user.slice/user-1000.slice/user@1000.service/run-r9.service";
    assert_eq!(
        restore_cgroup_target("", current).as_deref(),
        Some("user.slice/user-1000.slice/user@1000.service"),
        "with no recorded cgroup the pid goes back to the scope unit's parent"
    );
    // A recorded cgroup always wins.
    assert_eq!(
        restore_cgroup_target("user.slice/app.slice", current).as_deref(),
        Some("user.slice/app.slice")
    );
    // No recorded cgroup AND no parent to derive: refuse rather than guess.
    assert_eq!(restore_cgroup_target("", "run-r9.service"), None);

    let _ = std::fs::remove_dir_all(path.parent().unwrap());
}

#[test]
fn disk_fill_rate_recovers_after_large_reclamation() {
    let now = Instant::now();
    let gib = 1024 * 1024 * 1024;
    let history = [
        (now - Duration::from_secs(120), 800 * gib),
        (now - Duration::from_secs(90), 801 * gib),
        (now - Duration::from_secs(60), 600 * gib),
        (now - Duration::from_secs(30), 601 * gib),
        (now, 602 * gib),
    ];
    let rate = crate::disk_fill_rate(&history).rate_gbph().unwrap();
    assert!((rate - 120.0).abs() < 0.01);
    // Cleanup alone must not manufacture a positive growth observation.
    assert_eq!(
        crate::disk_fill_rate(&history[..3]),
        crate::DiskFillRate::Unmeasured
    );
    assert_eq!(
        crate::disk_fill_rate(&history[..4]),
        crate::DiskFillRate::Unmeasured
    );
}

#[test]
fn rapid_fill_warning_reports_user_available_runway() {
    let message = crate::rapid_disk_fill_message(40.0, 90, 20 * 1024 * 1024 * 1024);
    assert!(message.contains("20.0 GiB available"));
    assert!(message.contains("0.5 hours until full if growth continues"));
    let full = crate::rapid_disk_fill_message(40.0, 100, 0);
    assert!(full.contains("0.0 hours"));
}

#[tokio::test]
async fn disk_reclamation_rearms_the_rapid_fill_notification() {
    let guard = crate::GuardPolicy::default();
    let mut state = crate::GuardRuntimeState::default();
    crate::report_state_transition(&mut state, "disk-rapid-fill", "rapid", 3600);
    let now = Instant::now();
    state.disk_bytes_history = vec![
        (now - Duration::from_secs(60), 800),
        (now - Duration::from_secs(30), 801),
    ];
    assert!(
        crate::check_rapid_disk_fill(&guard, &mut state, 600, 60, 400)
            .await
            .is_none()
    );
    assert_eq!(state.report_states["disk-rapid-fill"].value, "unmeasured");
    let (previous, due) =
        crate::report_state_transition(&mut state, "disk-rapid-fill", "rapid", 3600);
    assert_ne!(previous.as_deref(), Some("rapid"));
    assert!(due);
}

/// ADDED 2026-10-24 (audit): the fill rate is measured ONCE per pass and
/// stored in the state, so the scratch ETA and the rapid-fill alarm quote
/// the SAME figure. They used to be measured twice, from two different
/// sample windows — the scratch one from a frozen clone of the history,
/// taken before the pass's own deletions — and on the live host the scratch
/// line said "the disk is not filling" while the alarm in the same pass
/// reported a 51.3 GiB/h fill.
#[tokio::test]
async fn the_pass_stores_the_measured_fill_rate_for_the_scratch_report() {
    let guard = crate::GuardPolicy::default();
    let mut state = crate::GuardRuntimeState::default();
    let now = Instant::now();
    let gib = 1024u64 * 1024 * 1024;
    // 10 GiB/h over two hours — below the 20 GiB/h alarm threshold, so the
    // test does not send a notification.
    state.disk_bytes_history = vec![
        (now - Duration::from_secs(7200), 500 * gib),
        (now - Duration::from_secs(3600), 510 * gib),
    ];
    let reported = crate::check_rapid_disk_fill(&guard, &mut state, 520 * gib, 50, 100 * gib).await;
    let stored = state
        .disk_fill_rate
        .rate_gbph()
        .expect("the pass must have measured a rate");
    assert!((stored - 10.0).abs() < 0.5, "expected ~10 GiB/h, got {stored}");
    assert_eq!(
        reported,
        Some(stored),
        "the alarm and the stored rate must be the same figure"
    );
}

/// ADDED 2026-10-24 (audit): the scratch line's number is how much writing
/// the held-back scratch would absorb — NOT how long until the disk is full.
/// It must not borrow the rapid-fill alarm's wording for it, or the journal
/// reads "hours until full: 0.3" beside "estimated 2.7 hours until full".
#[test]
fn the_scratch_eta_does_not_claim_to_be_the_hours_until_the_disk_is_full() {
    let gib = 1024u64 * 1024 * 1024;
    let text = crate::scratch_eta_text(16 * gib, crate::DiskFillRate::Filling(51.3));
    assert!(
        !text.contains("hours until full"),
        "the scratch figure must not reuse the alarm's wording: {text}"
    );
    assert!(
        text.contains("0.3 hours of writes at 51.3 GiB/h"),
        "the figure must say what it measures: {text}"
    );

    // A disk that is not filling, and a rate that cannot be measured, are
    // different facts — and neither is "the disk is not filling" unless the
    // disk really is not filling.
    let not_filling = crate::scratch_eta_text(16 * gib, crate::DiskFillRate::NotFilling);
    assert!(
        not_filling.contains("the disk is not filling"),
        "a flat disk says so: {not_filling}"
    );
    let unmeasured = crate::scratch_eta_text(16 * gib, crate::DiskFillRate::Unmeasured);
    assert!(
        unmeasured.contains("cannot be measured yet"),
        "an unmeasurable rate says so: {unmeasured}"
    );
    assert!(
        !unmeasured.contains("the disk is not filling"),
        "an unmeasurable rate must NOT claim the disk is not filling: {unmeasured}"
    );
}

/// ADDED 2026-10-24 (audit): a rate that cannot be measured must not be
/// reported as "the disk is not filling".
#[tokio::test]
async fn an_unmeasurable_rate_is_stored_as_unmeasured_not_as_not_filling() {
    let guard = crate::GuardPolicy::default();
    let mut state = crate::GuardRuntimeState::default();
    // A brand-new state has no history at all.
    assert_eq!(state.disk_fill_rate, crate::DiskFillRate::Unmeasured);
    assert!(crate::check_rapid_disk_fill(&guard, &mut state, 600, 60, 400)
        .await
        .is_none());
    assert_eq!(
        state.disk_fill_rate,
        crate::DiskFillRate::Unmeasured,
        "no history yet is unmeasured — it is NOT 'the disk is not filling'"
    );
}

// ---------------------------------------------------------------------------
// User-namespace aware priority restore (ADDED 2026-10-24)
// ---------------------------------------------------------------------------
//
// `CAP_SYS_NICE` is NAMESPACED: a process holding it in a nested user
// namespace has it in that namespace and in its DESCENDANTS, never in an
// ancestor. The guard's unit runs in a nested user namespace while most
// of the host's processes live in the initial one, so the guard could
// always LOWER a process's priority and could never RAISE it again.
//
// The renice mitigation was therefore a one-way ratchet, and because the
// undo always failed with "Permission denied", every SIGHUP policy reload
// was deferred forever: one unrestorable renice made the whole guard
// impossible to reconfigure.

#[test]
fn the_namespace_link_parses_to_an_inode_number() {
    assert_eq!(
        parse_namespace_inode(Path::new("user:[4026531837]")),
        Some(4026531837)
    );
    assert_eq!(
        parse_namespace_inode(Path::new("user:[4026532749]")),
        Some(4026532749)
    );
    assert_eq!(parse_namespace_inode(Path::new("user:[not-a-number]")), None);
    assert_eq!(parse_namespace_inode(Path::new("pid:[4026531837]")), None);
    assert_eq!(parse_namespace_inode(Path::new("4026531837")), None);
}

#[test]
fn a_capability_in_one_namespace_does_not_reach_another() {
    // The same namespace: the guard's CAP_SYS_NICE reaches the target.
    assert!(nice_restore_namespace_ok(Some(4026531837), Some(4026531837)));
    // A different namespace: it does not. This is the case that made the
    // mitigation one-way on this host.
    assert!(!nice_restore_namespace_ok(Some(4026532749), Some(4026531837)));
    assert!(!nice_restore_namespace_ok(Some(4026531837), Some(4026532749)));
    // Unreadable on either side fails closed.
    assert!(!nice_restore_namespace_ok(None, Some(4026531837)));
    assert!(!nice_restore_namespace_ok(Some(4026531837), None));
    assert!(!nice_restore_namespace_ok(None, None));
}

#[test]
fn a_permission_failure_is_permanent_but_a_transient_one_is_not() {
    assert!(nice_restore_failure_is_permanent(
        "renice exited with status exit status: 1: renice: failed to set priority for 42 (process ID): Permission denied"
    ));
    assert!(nice_restore_failure_is_permanent("Operation not permitted"));
    // A transient failure must keep the OLD policy live so the mitigation
    // is retried on the next pass instead of being forgotten.
    assert!(!nice_restore_failure_is_permanent(
        "renice exited with status exit status: 1"
    ));
    assert!(!nice_restore_failure_is_permanent(
        "failed to invoke /usr/bin/renice"
    ));
}

/// A fake proc tree holding one process, optionally in a user namespace.
fn fake_proc_tree(name: &str, pid: i32, comm: &str, starttime: u64, ns: Option<u64>) -> PathBuf {
    let root = std::env::temp_dir().join(format!("dracon-ns-{}-{name}", std::process::id()));
    let _ = fs::remove_dir_all(&root);
    fs::create_dir_all(root.join("self")).expect("self entry");
    let dir = root.join(pid.to_string());
    fs::create_dir_all(&dir).expect("pid dir");
    fs::write(dir.join("comm"), format!("{comm}\n")).expect("comm");
    let stat = format!(
        "{pid} ({comm}) S 1 {pid} {pid} 0 0 -1 4194304 0 0 0 0 0 0 0 20 0 1 0 {starttime} 0 0 0 0 0 0 0 0 0 0 0 0 17 2 0 0 0 0 0"
    );
    fs::write(dir.join("stat"), stat).expect("stat");
    if let Some(ns) = ns {
        let ns_dir = dir.join("ns");
        fs::create_dir_all(&ns_dir).expect("ns dir");
        symlink(format!("user:[{ns}]"), ns_dir.join("user")).expect("ns symlink");
    }
    root
}

#[test]
fn the_user_namespace_is_read_from_proc() {
    let root = fake_proc_tree("read", 4242, "minimax-code", 424_200, Some(4026531837));
    assert_eq!(user_namespace_inode(&root, 4242), Some(4026531837));
    // A pid with no namespace link is UNREADABLE, not "the same namespace".
    assert_eq!(user_namespace_inode(&root, 9999), None);
    let _ = fs::remove_dir_all(&root);
}

/// THE REGRESSION TEST for 2026-10-24: a nice adjustment the guard cannot
/// restore must not hold the policy reload hostage forever.
///
/// Before the fix this restore failed with "Permission denied", the entry
/// stayed tracked, and `apply_policy_reload` kept the OLD policy live and
/// deferred every later reload — the guard could not be reconfigured at
/// all.
#[tokio::test]
async fn a_sighup_reload_is_not_deferred_by_an_unrestorable_nice_adjustment() {
    let starttime = 424_200;
    // A namespace that is NOT the test's own: the guard must prove it
    // cannot restore this process's priority.
    let own = crate::parse_namespace_inode(&fs::read_link("/proc/self/ns/user").expect("self ns"));
    let other_ns = own.map(|ns| ns.wrapping_add(1)).unwrap_or(4026531837);
    let root = fake_proc_tree("sighup", 4242, "minimax-code", starttime, Some(other_ns));
    let mut state = crate::GuardRuntimeState::default();
    state.reniced_pids.insert(
        4242,
        LegacyReniceState {
            original_nice: 0,
            applied_nice: 5,
            identity: ProcessIdentity {
                comm: "minimax-code".to_string(),
                starttime,
            },
        },
    );

    // The renice binary is never reached: the guard can prove it cannot
    // restore this process, so the adjustment is dropped rather than
    // retried forever. A path that does not exist makes that visible.
    let restored = crate::restore_runtime_adjustments_with_samples(
        &mut state,
        Path::new("/nonexistent/renice"),
        Path::new("/nonexistent/systemctl"),
        &root,
        &[],
    )
    .await;

    assert!(
        restored,
        "an unrestorable adjustment must not defer the policy reload"
    );
    assert!(
        state.reniced_pids.is_empty(),
        "the unrestorable adjustment must be dropped, not retried forever"
    );
    let _ = fs::remove_dir_all(&root);
}

/// THE CREDENTIAL HEURISTIC IS A SUBSTRING MATCH, and it flags files that
/// merely MENTION a credential word.
///
/// Measured on this host on 2026-10-24: 55 top-level trash entries, 11 GiB,
/// kept forever — including a 3.9 GiB web bundle (`android-chrome-192x192.png`),
/// five 865 MiB repository checkouts (test files named `…-token-….test.ts`
/// and `…-chrome.md`), and the operator's own manuscript (a chapter called
/// "borrowed credentials").
///
/// This test PINS that behaviour deliberately: it is a known cost, not an
/// accident, and narrowing the heuristic is a decision that must be made
/// consciously rather than by accident in a refactor. If this test starts
/// failing, the heuristic was narrowed — which is a good outcome, but it
/// must be a deliberate one.
///
/// CHANGED 2026-10-25 (audit, operator decision): the heuristic was
/// narrowed from "a loose substring anywhere in the name" to "the file IS
/// a credential file by its own name". The broad rule protected an ENTIRE
/// deleted item from one matching file anywhere inside it: a Rust build
/// artefact called `trust_token.o` kept 5.0 GiB of `dg-verify`, and a
/// chapter called `02-borrowed-credentials.md` kept 1.8 GiB of `books`.
/// 112 items, 28.0 GiB, on a disk filling at over 100 GiB/h.
///
/// The broad names are now NOT flagged. The genuine ones still are.
#[test]
fn the_credential_heuristic_only_flags_names_that_are_credential_files() {
    // A web asset, not a credential.
    assert!(!crate::looks_credential_like("android-chrome-192x192.png"));
    assert!(!crate::looks_credential_like("chrome.CdV59toY.css"));
    // A test file about a scanner, not a credential.
    assert!(!crate::looks_credential_like(
        "artifact-secret-scan-2026-10-01.test.ts"
    ));
    assert!(!crate::looks_credential_like(
        "aud-271-premium-token-validity-2026-08-05.test.ts"
    ));
    // A chapter title: the strong word is in the MIDDLE of the name.
    assert!(!crate::looks_credential_like("02-borrowed-credentials.md"));
    assert!(!crate::looks_credential_like("01-the-archivists-secret.md"));
    // A compiled build artefact.
    assert!(!crate::looks_credential_like("trust_token.o"));
    assert!(!crate::looks_credential_like("pmbtoken.o"));
    // The genuine ones must keep matching.
    assert!(crate::looks_credential_like("Login Data"));
    assert!(crate::looks_credential_like("id_ed25519.key"));
    assert!(crate::looks_credential_like("cli.key"));
    assert!(crate::looks_credential_like(".env"));
    assert!(crate::looks_credential_like(".env.production"));
    assert!(crate::looks_credential_like("client_secret.json"));
    assert!(crate::looks_credential_like("secrets.yaml"));
    assert!(crate::looks_credential_like("credentials_backup"));
    assert!(crate::looks_credential_like("id_ed25519"));
}

/// A capability that is switched OFF must not look identical to one that
/// has nothing to do.
///
/// ADDED 2026-10-25 (audit): with `auto_cleanup_rust = false` the stale
/// `target/` trees are not reclaimed — on this host 78.2 GiB of rust-build
/// sat on a disk at 84% — and the disk report said nothing at all.
#[test]
fn a_disabled_rust_cleanup_is_reported_once_and_a_recovery_is_confirmed() {
    use crate::proactive_rust_report;
    // The first sighting of "off" is news.
    assert_eq!(proactive_rust_report(None, false), Some("disabled"));
    // Unchanged "off" is not: the guard re-reads the policy on every pass,
    // and an unconditional warning would print thousands of times a day.
    assert_eq!(proactive_rust_report(Some(false), false), None);
    // "off" -> "on" is news: silence would leave the operator unsure.
    assert_eq!(proactive_rust_report(Some(false), true), Some("enabled"));
    // Unchanged "on" is not, and "on" on the first sighting is not either.
    assert_eq!(proactive_rust_report(Some(true), true), None);
    assert_eq!(proactive_rust_report(None, true), None);
    // "on" -> "off" is news.
    assert_eq!(proactive_rust_report(Some(true), false), Some("disabled"));
}

/// The source text of one top-level function, from its signature to the
/// start of the next top-level item.
///
/// A nested function would be indented, so the anchors below can only match
/// a column-0 item.
pub(crate) fn top_level_fn_source(source: &str, signature: &str) -> String {
    let start = source
        .find(signature)
        .unwrap_or_else(|| panic!("{signature} must exist"));
    let rest = &source[start + signature.len()..];
    let end = rest
        .find("\nfn ")
        .or_else(|| rest.find("\npub(crate) fn "))
        .or_else(|| rest.find("\npub(crate) async fn "))
        .or_else(|| rest.find("\nimpl "))
        .unwrap_or(rest.len());
    rest[..end].to_string()
}

/// The "the rust cleanup is switched off" report must NOT be tied to a
/// cleanup TIER.
///
/// ADDED 2026-10-25 (audit D7): the report was first emitted from the
/// proactive cleanup branch. The proactive branch only runs while the disk
/// is BETWEEN `proactive_cleanup_percent` (80%) and `disk_action_percent`
/// (85%) — at the action tier the guard takes the pressure branch instead,
/// so the report went silent at exactly the disk pressure that makes the
/// unreclaimed build trees matter. Measured live on this host: the disk
/// crossed to 85% and the warning the audit had just added stopped
/// appearing.
///
/// The pressure tier honours the same knob (`run_auto_cleanup` only scans
/// the rust targets when `auto_cleanup_rust` is set), so the DISABLED state
/// is equally true there — and equally worth saying.
#[test]
fn the_disabled_rust_cleanup_report_is_not_tied_to_a_cleanup_tier() {
    const SOURCE: &str = include_str!("main.rs");

    // Exactly ONE call site: a second one inside a tier would reintroduce
    // the hole this test exists to close.
    let call = "report_proactive_rust_state(guard.auto_cleanup_rust)";
    assert_eq!(
        SOURCE.matches(call).count(),
        1,
        "the rust-cleanup report must have exactly one call site — the guard pass — so no cleanup tier can skip it"
    );

    // The call site is in the guard PASS.
    let pass = top_level_fn_source(SOURCE, "pub(crate) async fn run_guard_once(");
    assert!(
        pass.contains("disk_details_for"),
        "the guard pass must have been located — otherwise the assertion below would pass on an empty region"
    );
    assert!(
        pass.contains(call),
        "the guard pass must report the rust-cleanup state, so the report appears in every cleanup tier"
    );

    // ... and NOT in the cleanup tier dispatch, which the action tier skips.
    let dispatch = top_level_fn_source(SOURCE, "fn spawn_background_cleanup(");
    assert!(
        dispatch.contains("CleanupMode::Proactive"),
        "the tier dispatch must have been located — otherwise the assertion below would pass on an empty region"
    );
    assert!(
        !dispatch.contains("report_proactive_rust_state("),
        "the rust-cleanup report must not live in the cleanup tier dispatch: the action tier (85%) takes the pressure branch and skips the proactive one"
    );
}

/// A committed `.env` TEMPLATE is not a credential. It ships in every
/// repository that documents its environment, with placeholder values.
#[test]
fn an_env_template_is_not_a_credential_file() {
    assert!(!crate::looks_credential_like(".env.example"));
    assert!(!crate::looks_credential_like(".env.ovh.example"));
    assert!(!crate::looks_credential_like(".env.sample"));
    assert!(!crate::looks_credential_like(".env.template"));
    assert!(!crate::looks_credential_like(".env.dist"));
    // The real ones still match.
    assert!(crate::looks_credential_like(".env"));
    assert!(crate::looks_credential_like(".env.local"));
    assert!(crate::looks_credential_like(".env.production"));
}

/// The strong word must LEAD the name. `credentials_backup` is a
/// credentials file; `02-borrowed-credentials` is a chapter.
#[test]
fn a_credential_word_in_the_middle_of_a_name_is_not_a_credential_file() {
    assert!(crate::looks_credential_like("credentials_backup"));
    assert!(!crate::looks_credential_like("02-borrowed-credentials"));
    assert!(!crate::looks_credential_like("04-miras-secrets"));
    assert!(!crate::looks_credential_like("wallet-token-cache"));
    assert!(crate::looks_credential_like("token"));
}

/// `secret` and `token` are credential words, but they also LEAD ordinary
/// compound names. The cargo artefacts `secret_scan-<hash>` kept a 5.0 GiB
/// build tree alive on the strength of a test name.
#[test]
fn a_credential_word_that_leads_an_ordinary_compound_name_is_not_a_credential_file() {
    assert!(!crate::looks_credential_like("secret_scan-a5b13cc6b5fee239.d"));
    assert!(!crate::looks_credential_like("secret_scan"));
    assert!(!crate::looks_credential_like("token_bucket.rs"));
    assert!(!crate::looks_credential_like("secrets-scan.rs"));
    // The unambiguous ones still qualify when they lead the name.
    assert!(crate::looks_credential_like("credentials_backup"));
    assert!(crate::looks_credential_like("password-store-backup"));
    assert!(crate::looks_credential_like("client_secret.json"));
    // And the whole-stem matches are unaffected.
    assert!(crate::looks_credential_like("secrets.yaml"));
    assert!(crate::looks_credential_like("token.json"));
    assert!(crate::looks_credential_like("password.txt"));
}

/// A guard that KEEPS something must say what keeping it costs.
///
/// The credential guard reported an entry COUNT ("keeping 55 flagged
/// entries") and nothing else. A count looks like a rounding error; the
/// size was 11 GiB. This pins that the cost is measured and reported.
#[tokio::test]
async fn the_credential_guard_reports_the_disk_cost_of_what_it_keeps() {
    let root = std::env::temp_dir().join(format!("dracon-kept-cost-{}", std::process::id()));
    let files = root.join("files");
    let _ = std::fs::remove_dir_all(&root);
    std::fs::create_dir_all(files.join("big")).expect("big entry");
    std::fs::create_dir_all(files.join("small")).expect("small entry");
    // 4 KiB in the big entry, 1 KiB in the small one.
    std::fs::write(files.join("big").join("blob.bin"), vec![0u8; 4096]).expect("blob");
    std::fs::write(files.join("small").join("blob.bin"), vec![0u8; 1024]).expect("blob");

    let mut names = std::collections::HashSet::new();
    names.insert("big".to_string());
    names.insert("small".to_string());
    let (total, sizes) = crate::kept_trash_entry_sizes(&files, &names).await;
    assert_eq!(total, 5120, "the kept entries' size must be measured");
    assert_eq!(sizes.len(), 2);
    assert_eq!(sizes[0].0, "big", "the biggest kept entry must come first");
    assert_eq!(sizes[0].1, 4096);
    assert_eq!(sizes[1].1, 1024);
    let _ = std::fs::remove_dir_all(&root);
}