saddle-observability 0.2.0

//! Sealed writer work and deployment filesystem service proofs.

use std::{
    ffi::CString,
    sync::atomic::{AtomicU64, Ordering},
};

use rustix::fs::{self, AtFlags, Mode, OFlags, StatxFlags};
use saddle_admission::{
    CanonicalObservabilityQueueProfileWitness, PreparedObservabilityQueueBinding,
};
use saddle_core::{
    ObservabilityBundleIdentityAuthority, ObservabilityBundleIdentityContinuation,
    SignedDirectoryIssuerError, VerifiedDeploymentDirectoryAuthority,
    VerifiedSignedDirectorySubjectContinuation, issue_observability_bundle_identity,
    verify_observability_bundle_binding, verify_signed_directory_subject,
    verify_signed_directory_subject_deployment_pair,
};
use serde::Deserialize;
use sha2::{Digest, Sha256};

use super::{
    FixedCoreLayout, FixedFileLimits, fixed_core_layout,
    linux_backend::{ROTATION_RETRIES, WRITE_INTERRUPT_RETRIES},
};

const WRITER_COMPONENT_WORK_IDENTITY: [u8; 32] = [0x6f; 32];
const FIXED_FILE_CONFIG_SCHEMA: &[u8] = b"saddle.observability.fixed-file-config/1;rotate_bytes,retained_files,retention_age_ms,sync_bytes,sync_interval_ms";
const FIXED_FILE_CONFIG_IDENTITY_DOMAIN: &[u8] =
    b"saddle.observability.fixed-file-config.identity.v1";
const FIXED_CORE_PROFILE_SCHEMA_IDENTITY: [u8; 32] = [0x71; 32];
const FIXED_CORE_BLOCKS: usize = 4;
const FIXED_CORE_BLOCK_BYTES: usize = 1_024;
const FIXED_CORE_COMMANDS: usize = 6;
const FIXED_CORE_PATH_BYTES: usize = 256;
const FIXED_CORE_DIRENT_BYTES: usize = 4_096;
const FIXED_CORE_ENTRIES: usize = 32;
static DIRECTORY_DEPLOYMENT_GENERATION: AtomicU64 = AtomicU64::new(0);

#[doc(hidden)]
pub(crate) type ProductionProviderFilesystemProofBundle = ProviderFilesystemProofBundle<
    FIXED_CORE_BLOCKS,
    FIXED_CORE_BLOCK_BYTES,
    FIXED_CORE_COMMANDS,
    FIXED_CORE_PATH_BYTES,
    FIXED_CORE_DIRENT_BYTES,
    FIXED_CORE_ENTRIES,
>;

/// Single linear production result. The signed deployment applicability and
/// filesystem bundle cannot be split by a provider or business consumer.
///
/// ```compile_fail
/// use saddle_observability::file::VerifiedSignedProviderFilesystemBundle;
/// fn steal(whole: VerifiedSignedProviderFilesystemBundle) {
///     let _ = whole.subject;
///     let _ = whole.filesystem;
/// }
/// ```
pub struct VerifiedSignedProviderFilesystemBundle {
    subject: VerifiedSignedDirectorySubjectContinuation,
    filesystem: ProductionProviderFilesystemProofBundle,
}

/// Whole directory owner after its subject has been atomically paired with
/// the signed Runtime resource observation.
struct FinalDirectoryPairContinuation {
    filesystem: ProductionProviderFilesystemProofBundle,
}

pub struct FinalPairedSignedProviderFilesystemBundle {
    subject: VerifiedSignedDirectorySubjectContinuation,
    filesystem: ProductionProviderFilesystemProofBundle,
    _seal: saddle_core::VerifiedFinishedFinalDirectorySeal,
}

/// Atomic successful component authority. It intentionally exposes no
/// consuming split: Runtime may only retain this whole inside its final
/// aggregate.
///
/// ```compile_fail
/// use saddle_observability::file::FinalPairedFilesystemCoreOwners;
/// fn split(owner: FinalPairedFilesystemCoreOwners) {
///     let _ = owner.into_runtime_parts();
/// }
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::FinalPairedFilesystemCoreOwners;
/// fn take_time(owner: FinalPairedFilesystemCoreOwners) {
///     let FinalPairedFilesystemCoreOwners { time, .. } = owner;
///     let _ = time;
/// }
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::FinalPairedFilesystemCoreOwners;
/// fn take_gate(owner: FinalPairedFilesystemCoreOwners) {
///     let FinalPairedFilesystemCoreOwners { gate, .. } = owner;
///     let _ = gate;
/// }
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::FinalPairedFilesystemCoreOwners;
/// fn take_scheduler(owner: FinalPairedFilesystemCoreOwners) {
///     let FinalPairedFilesystemCoreOwners { scheduler, .. } = owner;
///     let _ = scheduler;
/// }
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::FinalPairedFilesystemCoreOwners;
/// fn take_supervisor(owner: FinalPairedFilesystemCoreOwners) {
///     let FinalPairedFilesystemCoreOwners { supervisor, .. } = owner;
///     let _ = supervisor;
/// }
/// ```
pub struct FinalPairedFilesystemCoreOwners {
    resource: saddle_core::VerifiedRuntimeResourceParts,
    directory: FinalPairedSignedProviderFilesystemBundle,
    generated: saddle_admission::FinalPairedGeneratedStartupFactsOwner,
    time: saddle_core::VerifiedStartupTimePolicyOwner,
    gate: saddle_core::VerifiedDeploymentGateBuildOwner,
    scheduler: saddle_core::VerifiedDeploymentSchedulerObservationOwner,
    supervisor: saddle_core::VerifiedDeploymentSupervisorStartupOwner,
}

#[doc(hidden)]
#[allow(clippy::result_large_err)]
fn split_signed_filesystem_bundle_for_final_pair(
    bundle: VerifiedSignedProviderFilesystemBundle,
) -> Result<
    (
        saddle_core::VerifiedFinalDirectoryReceiptPair,
        FinalDirectoryPairContinuation,
    ),
    VerifiedSignedProviderFilesystemBundle,
> {
    let VerifiedSignedProviderFilesystemBundle {
        subject,
        mut filesystem,
    } = bundle;
    let authority = match filesystem.termination.bundle_authority.take() {
        Some(authority) => authority,
        None => {
            return Err(VerifiedSignedProviderFilesystemBundle {
                subject,
                filesystem,
            });
        }
    };
    let PhysicalFixedFileStartupOwner {
        service,
        profile,
        directory,
    } = filesystem.physical;
    let VerifiedPhysicalDirectoryOwner { binding, directory } = directory;
    match saddle_core::issue_final_directory_receipts(subject, authority, binding) {
        Ok((authority, binding, directory_pair)) => {
            filesystem.termination.bundle_authority = Some(authority);
            filesystem.physical = PhysicalFixedFileStartupOwner {
                service,
                profile,
                directory: VerifiedPhysicalDirectoryOwner { binding, directory },
            };
            Ok((
                directory_pair,
                FinalDirectoryPairContinuation { filesystem },
            ))
        }
        Err((subject, authority, binding)) => {
            filesystem.termination.bundle_authority = Some(authority);
            filesystem.physical = PhysicalFixedFileStartupOwner {
                service,
                profile,
                directory: VerifiedPhysicalDirectoryOwner { binding, directory },
            };
            Err(VerifiedSignedProviderFilesystemBundle {
                subject,
                filesystem,
            })
        }
    }
}

#[doc(hidden)]
fn restore_signed_filesystem_bundle_after_final_pair_failure(
    pair: saddle_core::VerifiedFinalDirectoryReceiptPair,
    continuation: FinalDirectoryPairContinuation,
) -> VerifiedSignedProviderFilesystemBundle {
    VerifiedSignedProviderFilesystemBundle {
        subject: saddle_core::restore_final_directory_receipt_pair(pair),
        filesystem: continuation.filesystem,
    }
}

#[doc(hidden)]
fn finish_signed_filesystem_bundle_final_pair(
    subject: VerifiedSignedDirectorySubjectContinuation,
    continuation: FinalDirectoryPairContinuation,
    seal: saddle_core::VerifiedFinishedFinalDirectorySeal,
) -> FinalPairedSignedProviderFilesystemBundle {
    FinalPairedSignedProviderFilesystemBundle {
        subject,
        filesystem: continuation.filesystem,
        _seal: seal,
    }
}

#[doc(hidden)]
#[allow(clippy::result_large_err)]
/// Atomically pairs the three outer owners without exposing the directory
/// receipt carrier or its split/restore operations.
///
/// ```compile_fail
/// use saddle_observability::file::split_signed_filesystem_bundle_for_final_pair;
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::restore_signed_filesystem_bundle_after_final_pair_failure;
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::finish_signed_filesystem_bundle_final_pair;
/// ```
pub fn pair_signed_filesystem_bundle_final(
    resource: saddle_core::VerifiedRuntimeResourceParts,
    directory: VerifiedSignedProviderFilesystemBundle,
    generated: saddle_admission::ComposedGeneratedStartupFactsOwner,
    seed: saddle_core::VerifiedDeploymentStartupAuthoritySeed,
    gate_seed: saddle_core::VerifiedDeploymentGateBuildAuthoritySeed,
    scheduler_seed: saddle_core::VerifiedDeploymentSchedulerObservationSeed,
    supervisor_seed: saddle_core::VerifiedDeploymentSupervisorStartupSeed,
) -> Result<
    FinalPairedFilesystemCoreOwners,
    (
        saddle_core::VerifiedRuntimeResourceParts,
        VerifiedSignedProviderFilesystemBundle,
        saddle_admission::ComposedGeneratedStartupFactsOwner,
        saddle_core::VerifiedDeploymentStartupAuthoritySeed,
        saddle_core::VerifiedDeploymentGateBuildAuthoritySeed,
        saddle_core::VerifiedDeploymentSchedulerObservationSeed,
        saddle_core::VerifiedDeploymentSupervisorStartupSeed,
    ),
> {
    let (generated_continuation, generated_half) =
        match saddle_admission::split_generated_owner_for_final_pair(generated) {
            Ok(parts) => parts,
            Err(generated) => {
                return Err((
                    resource,
                    directory,
                    generated,
                    seed,
                    gate_seed,
                    scheduler_seed,
                    supervisor_seed,
                ));
            }
        };
    let (directory_pair, continuation) =
        match split_signed_filesystem_bundle_for_final_pair(directory) {
            Ok(parts) => parts,
            Err(directory) => {
                return Err((
                    resource,
                    directory,
                    saddle_admission::restore_generated_owner_after_final_pair_failure(
                        generated_continuation,
                        generated_half,
                    ),
                    seed,
                    gate_seed,
                    scheduler_seed,
                    supervisor_seed,
                ));
            }
        };
    let receipts = match saddle_core::pair_final_startup_receipts(
        resource,
        directory_pair,
        generated_half,
        seed,
        gate_seed,
        scheduler_seed,
        supervisor_seed,
    ) {
        Ok(receipts) => receipts,
        Err((
            resource,
            directory_pair,
            generated_half,
            seed,
            gate_seed,
            scheduler_seed,
            supervisor_seed,
        )) => {
            return Err((
                resource,
                restore_signed_filesystem_bundle_after_final_pair_failure(
                    directory_pair,
                    continuation,
                ),
                saddle_admission::restore_generated_owner_after_final_pair_failure(
                    generated_continuation,
                    generated_half,
                ),
                seed,
                gate_seed,
                scheduler_seed,
                supervisor_seed,
            ));
        }
    };
    let paired = match saddle_core::consume_final_pairing_receipts(receipts) {
        Ok(paired) => paired,
        Err(receipts) => {
            let (
                resource,
                directory_pair,
                generated_half,
                seed,
                gate_seed,
                scheduler_seed,
                supervisor_seed,
            ) = saddle_core::recover_rejected_final_pairing_receipts(receipts);
            return Err((
                resource,
                restore_signed_filesystem_bundle_after_final_pair_failure(
                    directory_pair,
                    continuation,
                ),
                saddle_admission::restore_generated_owner_after_final_pair_failure(
                    generated_continuation,
                    generated_half,
                ),
                seed,
                gate_seed,
                scheduler_seed,
                supervisor_seed,
            ));
        }
    };
    let (resource, subject, seal, generated_half, time, gate, scheduler, supervisor) =
        saddle_core::finish_final_pairing_parts(paired);
    let generated =
        saddle_admission::finish_generated_owner_final_pair(generated_continuation, generated_half);
    Ok(FinalPairedFilesystemCoreOwners {
        resource,
        directory: finish_signed_filesystem_bundle_final_pair(subject, continuation, seal),
        generated,
        time,
        gate,
        scheduler,
        supervisor,
    })
}

/// Evidence-only result of Facade's subject preflight. It is not startup
/// authority and cannot yield a raw filesystem proof to any consumer.
pub struct PairedSignedProviderFilesystemEvidence {
    subject: VerifiedSignedDirectorySubjectContinuation,
    filesystem: ProductionProviderFilesystemProofBundle,
}

pub struct GenerationPairedFilesystemEvidence {
    receipt: saddle_core::VerifiedComponentGenerationPairingReceipt,
    subject: VerifiedSignedDirectorySubjectContinuation,
    filesystem: ProductionProviderFilesystemProofBundle,
}

/// Evidence-only linear carrier. Runtime may move it only as part of the
/// component-sealed startup input set; it is not independently attachable.
pub struct SignedProviderFilesystemRuntimeEvidence {
    subject: VerifiedSignedDirectorySubjectContinuation,
    physical: ProductionPhysicalFixedFileStartupOwner,
}

pub struct NormalizedSignedProviderFilesystemRuntimeEvidence {
    subject: VerifiedSignedDirectorySubjectContinuation,
    physical: NormalizedProductionPhysicalFixedFileStartupOwner,
}

impl VerifiedSignedProviderFilesystemBundle {
    #[allow(clippy::too_many_arguments, clippy::result_large_err)]
    pub fn verify_deployment_pair(
        self,
        bundle: [u8; 32],
        provider: [u8; 32],
        application: [u8; 32],
        binary: [u8; 32],
        build: [u8; 32],
        source: [u8; 32],
        artifact: [u8; 32],
        routes: [u8; 32],
        deployment: [u8; 32],
        environment: [u8; 32],
        nonce: [u8; 32],
        calibration: [u8; 32],
    ) -> Result<PairedSignedProviderFilesystemEvidence, Self> {
        match verify_signed_directory_subject_deployment_pair(
            self.subject,
            bundle,
            provider,
            application,
            binary,
            build,
            source,
            artifact,
            routes,
            deployment,
            environment,
            nonce,
            calibration,
        ) {
            Ok(subject) => Ok(PairedSignedProviderFilesystemEvidence {
                subject,
                filesystem: self.filesystem,
            }),
            Err(subject) => Err(Self {
                subject,
                filesystem: self.filesystem,
            }),
        }
    }
}

impl PairedSignedProviderFilesystemEvidence {
    pub fn matches_deployment(&self, environment: [u8; 32], build: [u8; 32]) -> bool {
        provider_filesystem_bundle_matches_deployment(&self.filesystem, environment, build)
    }

    #[allow(clippy::result_large_err)]
    pub fn pair_component_generation(
        self,
        generated: saddle_admission::ComposedGeneratedStartupFactsOwner,
    ) -> Result<
        (
            GenerationPairedFilesystemEvidence,
            saddle_admission::ComposedGeneratedStartupFactsOwner,
        ),
        (Self, saddle_admission::ComposedGeneratedStartupFactsOwner),
    > {
        match saddle_admission::pair_composed_generated_signed_directory_generation(
            self.subject,
            generated,
        ) {
            Ok((subject, generated, receipt)) => Ok((
                GenerationPairedFilesystemEvidence {
                    receipt,
                    subject,
                    filesystem: self.filesystem,
                },
                generated,
            )),
            Err((subject, generated)) => Err((
                Self {
                    subject,
                    filesystem: self.filesystem,
                },
                generated,
            )),
        }
    }

    pub fn into_runtime_evidence(
        self,
    ) -> (
        WriterTerminationProof,
        SignedProviderFilesystemRuntimeEvidence,
    ) {
        let (termination, physical) = self.filesystem.into_parts();
        (
            termination,
            SignedProviderFilesystemRuntimeEvidence {
                subject: self.subject,
                physical,
            },
        )
    }
}

impl GenerationPairedFilesystemEvidence {
    #[allow(clippy::result_large_err)]
    pub fn consume_runtime_binding(
        self,
        build: [u8; 32],
    ) -> Result<PairedSignedProviderFilesystemEvidence, Self> {
        if build == [0; 32] || self.filesystem.physical.service.build_identity != build {
            return Err(self);
        }
        match saddle_core::consume_component_generation_pairing(self.receipt) {
            Ok(()) => Ok(PairedSignedProviderFilesystemEvidence {
                subject: self.subject,
                filesystem: self.filesystem,
            }),
            Err(receipt) => Err(Self {
                receipt,
                subject: self.subject,
                filesystem: self.filesystem,
            }),
        }
    }
}

#[doc(hidden)]
pub(crate) type ProductionPhysicalFixedFileStartupOwner = PhysicalFixedFileStartupOwner<
    FIXED_CORE_BLOCKS,
    FIXED_CORE_BLOCK_BYTES,
    FIXED_CORE_COMMANDS,
    FIXED_CORE_PATH_BYTES,
    FIXED_CORE_DIRENT_BYTES,
    FIXED_CORE_ENTRIES,
>;

#[doc(hidden)]
pub type ProductionObservabilityQueueProfileWitness = CanonicalObservabilityQueueProfileWitness;

/// Returns the sole fixed, build-static witness. It carries no startup
/// authority and accepts no caller-selected constants or raw facts.
#[doc(hidden)]
pub fn production_observability_queue_profile_witness() -> ProductionObservabilityQueueProfileWitness
{
    saddle_admission::canonical_observability_queue_profile_witness()
}

/// Physical continuation after the plan-bound witness and the component's
/// private fixed-core proof have both been consumed and matched.
#[doc(hidden)]
pub(crate) struct NormalizedProductionPhysicalFixedFileStartupOwner {
    service: VerifiedFilesystemServiceProof,
    profile: FixedCoreQueueProfileProof<4, 1_024, 6, 256, 4_096, 32>,
    directory: VerifiedLogDirectoryOwner<256>,
}

/// Build-static writer work shape compiled into Observability.
///
/// This proof contains no queue capacity, byte limit, duration, filesystem
/// identity or deployment measurement. Its fields are private and the only
/// value constructor is [`writer_component_work_proof`].
///
/// ```compile_fail
/// use saddle_observability::file::WriterComponentWorkProof;
/// let _ = WriterComponentWorkProof {
///     identity: [1; 32],
///     version: 1,
///     routed_files: 4,
///     reliability_domains: 1,
///     max_parallel_filesystem_ops: 1,
///     shutdown_barrier_files: 4,
///     write_interrupt_retries: 8,
///     rotation_publish_attempts: 8,
///     directory_syncs_per_rotation: 4,
///     hard_link_no_replace: true,
///     rename_ops_per_rotation: 0,
///     bounded_retention_scan: true,
///     shutdown_requires_zero_encoding_owners: true,
///     requires_deployment_filesystem_proof: true,
/// };
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::{
///     WriterComponentWorkProof, writer_component_work_proof,
/// };
/// fn duplicate(proof: &WriterComponentWorkProof) -> WriterComponentWorkProof {
///     proof.clone()
/// }
/// let _ = duplicate(&writer_component_work_proof());
/// ```
#[derive(Debug, Eq, PartialEq)]
pub struct WriterComponentWorkProof {
    identity: [u8; 32],
    version: u8,
    routed_files: u8,
    reliability_domains: u8,
    max_parallel_filesystem_ops: u8,
    shutdown_barrier_files: u8,
    write_interrupt_retries: u8,
    rotation_publish_attempts: u8,
    directory_syncs_per_rotation: u8,
    hard_link_no_replace: bool,
    rename_ops_per_rotation: u8,
    bounded_retention_scan: bool,
    shutdown_requires_zero_encoding_owners: bool,
    requires_deployment_filesystem_proof: bool,
}

/// Component-private owner for the sole 0.2 fixed-file configuration.
/// It is intentionally non-Clone and has no raw accessor.
#[derive(Debug)]
pub(super) struct VerifiedFixedFileConfigOwner {
    schema_identity: [u8; 32],
    config_identity: [u8; 32],
    limits: FixedFileLimits,
}

/// Component-private owner for the backend-checked writer work shape.
/// It is intentionally non-Clone and has no raw accessor.
#[derive(Debug)]
pub(super) struct CanonicalWriterWorkOwner {
    component: WriterComponentWorkProof,
}

fn canonical_fixed_file_owners()
-> Result<(VerifiedFixedFileConfigOwner, CanonicalWriterWorkOwner), FilesystemProofError> {
    let component = writer_component_work_proof();
    if u64::from(component.rotation_publish_attempts()) != ROTATION_RETRIES
        || u64::from(component.write_interrupt_retries()) != WRITE_INTERRUPT_RETRIES
    {
        return Err(FilesystemProofError::InvalidProfile);
    }
    let limits = FixedFileLimits::candidate();
    let mut schema = FixedProfileDigest::new();
    schema.write(b"saddle.observability.fixed-file-config.schema.v1");
    schema.write(FIXED_FILE_CONFIG_SCHEMA);
    let schema_identity = schema.finish();
    let mut identity = FixedProfileDigest::new();
    identity.write(FIXED_FILE_CONFIG_IDENTITY_DOMAIN);
    identity.write(&schema_identity);
    for value in fixed_file_config_values(limits)? {
        identity.write(&value.to_le_bytes());
    }
    Ok((
        VerifiedFixedFileConfigOwner {
            schema_identity,
            config_identity: identity.finish(),
            limits,
        },
        CanonicalWriterWorkOwner { component },
    ))
}

fn fixed_file_config_values(limits: FixedFileLimits) -> Result<[u64; 5], FilesystemProofError> {
    Ok([
        limits.rotate_bytes,
        u64::try_from(limits.retained_files).map_err(|_| FilesystemProofError::Overflow)?,
        u64::try_from(limits.retention_age.as_millis())
            .map_err(|_| FilesystemProofError::Overflow)?,
        limits.sync_bytes,
        u64::try_from(limits.sync_interval.as_millis())
            .map_err(|_| FilesystemProofError::Overflow)?,
    ])
}

/// Returns the versioned writer component work proof without filesystem I/O.
#[doc(hidden)]
pub const fn writer_component_work_proof() -> WriterComponentWorkProof {
    WriterComponentWorkProof {
        identity: WRITER_COMPONENT_WORK_IDENTITY,
        version: 1,
        routed_files: 4,
        reliability_domains: 1,
        max_parallel_filesystem_ops: 1,
        shutdown_barrier_files: 4,
        write_interrupt_retries: 8,
        rotation_publish_attempts: 8,
        directory_syncs_per_rotation: 4,
        hard_link_no_replace: true,
        rename_ops_per_rotation: 0,
        bounded_retention_scan: true,
        shutdown_requires_zero_encoding_owners: true,
        requires_deployment_filesystem_proof: true,
    }
}

impl WriterComponentWorkProof {
    pub const fn identity(&self) -> [u8; 32] {
        self.identity
    }

    pub const fn version(&self) -> u8 {
        self.version
    }

    pub const fn routed_files(&self) -> u8 {
        self.routed_files
    }

    pub const fn reliability_domains(&self) -> u8 {
        self.reliability_domains
    }

    pub const fn max_parallel_filesystem_ops(&self) -> u8 {
        self.max_parallel_filesystem_ops
    }

    pub const fn shutdown_barrier_files(&self) -> u8 {
        self.shutdown_barrier_files
    }

    pub const fn write_interrupt_retries(&self) -> u8 {
        self.write_interrupt_retries
    }

    pub const fn rotation_publish_attempts(&self) -> u8 {
        self.rotation_publish_attempts
    }

    pub const fn directory_syncs_per_rotation(&self) -> u8 {
        self.directory_syncs_per_rotation
    }

    pub const fn hard_link_no_replace(&self) -> bool {
        self.hard_link_no_replace
    }

    pub const fn rename_ops_per_rotation(&self) -> u8 {
        self.rename_ops_per_rotation
    }

    pub const fn bounded_retention_scan(&self) -> bool {
        self.bounded_retention_scan
    }

    pub const fn shutdown_requires_zero_encoding_owners(&self) -> bool {
        self.shutdown_requires_zero_encoding_owners
    }

    pub const fn requires_deployment_filesystem_proof(&self) -> bool {
        self.requires_deployment_filesystem_proof
    }
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum FilesystemTarget {
    LinuxX86_64,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct FilesystemDeploymentIdentity {
    pub target: FilesystemTarget,
    pub environment: [u8; 32],
    pub filesystem: [u8; 32],
    pub mount: [u8; 32],
    pub build: [u8; 32],
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct FilesystemWorkDomain {
    pub max_write_ops: u64,
    pub max_write_bytes: u64,
    pub max_file_sync_ops: u64,
    pub max_file_sync_bytes: u64,
    pub max_directory_sync_ops: u64,
    pub max_hard_link_ops: u64,
    pub max_rename_ops: u64,
    pub max_unlink_ops: u64,
    pub max_create_ops: u64,
    pub max_scan_ops: u64,
    pub max_scan_entries: u64,
    pub max_parallel_filesystem_ops: u64,
    pub advisory_lock: bool,
    pub hard_link_no_replace: bool,
    pub directory_fsync: bool,
    pub data_fsync: bool,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct FilesystemServiceRates {
    pub write_op_nanos: u64,
    pub write_byte_nanos: u64,
    pub file_sync_op_nanos: u64,
    pub file_sync_byte_nanos: u64,
    pub directory_sync_op_nanos: u64,
    pub hard_link_op_nanos: u64,
    pub rename_op_nanos: u64,
    pub unlink_op_nanos: u64,
    pub create_op_nanos: u64,
    pub scan_op_nanos: u64,
    pub scan_entry_nanos: u64,
}

/// Gate-owned deployment observation. Production locks one implementation and
/// assembly; Observability intentionally provides no closure blanket.
pub trait DeploymentFilesystemServiceAttestation: Sized {
    fn target(&self) -> FilesystemTarget;
    fn approved(&self) -> bool;
    fn reproducible_measurement(&self) -> bool;
    fn conservative_upper_bound(&self) -> bool;
    fn work_domain(&self) -> FilesystemWorkDomain;
    fn service_rates(&self) -> FilesystemServiceRates;
    fn calibration_identity(&self) -> [u8; 32];
    fn environment_identity(&self) -> [u8; 32];
    fn filesystem_identity(&self) -> [u8; 32];
    fn mount_identity(&self) -> [u8; 32];
    fn service_attestation(&self) -> [u8; 32];
    fn build_identity(&self) -> [u8; 32];
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum FilesystemProofError {
    Unapproved,
    ComponentMismatch,
    InvalidIdentity,
    InvalidDomain,
    InvalidService,
    DomainMismatch,
    Overflow,
    InvalidProfile,
    ForeignBundle,
    InvalidDirectory,
}

/// Component-private, build-static fixed-core queue/layout proof.
///
/// Const generic parameters are part of the Rust type. Neither this type nor
/// its issuer is visible outside Observability; the only production-shaped
/// path that can carry it is the physical half minted below.
#[derive(Debug)]
pub(super) struct FixedCoreQueueProfileProof<
    const BLOCKS: usize,
    const BYTES: usize,
    const COMMANDS: usize,
    const PATH: usize,
    const DIRENT_BYTES: usize,
    const ENTRIES: usize,
> {
    schema_identity: [u8; 32],
    profile_identity: [u8; 32],
    layout: FixedCoreLayout,
}

impl<
    const BLOCKS: usize,
    const BYTES: usize,
    const COMMANDS: usize,
    const PATH: usize,
    const DIRENT_BYTES: usize,
    const ENTRIES: usize,
> FixedCoreQueueProfileProof<BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES>
{
    pub(super) const fn blocks(&self) -> usize {
        BLOCKS
    }
    pub(super) const fn block_bytes(&self) -> usize {
        BYTES
    }
    pub(super) const fn commands(&self) -> usize {
        COMMANDS
    }
    pub(super) const fn path_bytes(&self) -> usize {
        PATH
    }
    pub(super) const fn directory_entry_bytes(&self) -> usize {
        DIRENT_BYTES
    }
    pub(super) const fn retained_entries(&self) -> usize {
        ENTRIES
    }
    pub(super) const fn layout(&self) -> FixedCoreLayout {
        self.layout
    }
}

/// Signs the one build-static profile used by a concrete fixed-core
/// monomorphization. It performs no deployment observation.
fn fixed_core_queue_profile_proof<
    const BLOCKS: usize,
    const BYTES: usize,
    const COMMANDS: usize,
    const PATH: usize,
    const DIRENT_BYTES: usize,
    const ENTRIES: usize,
>() -> Result<
    FixedCoreQueueProfileProof<BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES>,
    FilesystemProofError,
> {
    if BLOCKS == 0
        || BYTES == 0
        || COMMANDS < BLOCKS.saturating_add(2)
        || PATH == 0
        || DIRENT_BYTES < 256
        || ENTRIES == 0
    {
        return Err(FilesystemProofError::InvalidProfile);
    }
    let layout = fixed_core_layout::<BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES>()
        .map_err(|_| FilesystemProofError::InvalidProfile)?;
    let profile_identity = fixed_profile_identity(
        [BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES],
        layout,
    )?;
    Ok(FixedCoreQueueProfileProof {
        schema_identity: FIXED_CORE_PROFILE_SCHEMA_IDENTITY,
        profile_identity,
        layout,
    })
}

/// Opaque one-shot result of provider filesystem verification. The halves can
/// only be minted together from one verified service and one fixed profile.
///
/// ```compile_fail
/// use saddle_observability::file::ProviderFilesystemProofBundle;
/// fn replay(value: ProviderFilesystemProofBundle<2, 64, 4, 256, 256, 5>) {
///     let _first = value;
///     let _second = value;
/// }
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::ProviderFilesystemProofBundle;
/// let _: ProviderFilesystemProofBundle<2, 64, 4, 256, 256, 5> =
///     ProviderFilesystemProofBundle { termination: panic!(), physical: panic!() };
/// ```
pub struct ProviderFilesystemProofBundle<
    const BLOCKS: usize,
    const BYTES: usize,
    const COMMANDS: usize,
    const PATH: usize,
    const DIRENT_BYTES: usize,
    const ENTRIES: usize,
> {
    termination: WriterTerminationProof,
    physical: PhysicalFixedFileStartupOwner<BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES>,
}

/// Physical half retained for the later fixed-file prepared-start stage.
/// It exposes neither the verified service nor any raw binding digest.
///
/// ```compile_fail
/// use saddle_observability::file::PhysicalFixedFileStartupOwner;
/// fn requires_clone<T: Clone>() {}
/// requires_clone::<PhysicalFixedFileStartupOwner<2, 64, 4, 256, 256, 5>>();
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::PhysicalFixedFileStartupOwner;
/// let _: PhysicalFixedFileStartupOwner<2, 64, 4, 256, 256, 5> =
///     PhysicalFixedFileStartupOwner { service: panic!(), profile: panic!(), binding: panic!() };
/// ```
pub struct PhysicalFixedFileStartupOwner<
    const BLOCKS: usize,
    const BYTES: usize,
    const COMMANDS: usize,
    const PATH: usize,
    const DIRENT_BYTES: usize,
    const ENTRIES: usize,
> {
    service: VerifiedFilesystemServiceProof,
    profile: FixedCoreQueueProfileProof<BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES>,
    directory: VerifiedPhysicalDirectoryOwner<PATH>,
}

/// Opaque, linear authority for the one attested log directory.
///
/// It deliberately has no `Clone`, serialization, debug or raw accessor.
///
/// ```compile_fail
/// use saddle_observability::file::VerifiedLogDirectoryOwner;
/// fn requires_clone<T: Clone>() {}
/// requires_clone::<VerifiedLogDirectoryOwner<256>>();
/// ```
///
/// ```compile_fail
/// use saddle_observability::file::{verify_provider_filesystem_bundle, writer_component_work_proof};
/// # fn example(service: saddle_observability::file::VerifiedFilesystemServiceProof) {
/// let _ = verify_provider_filesystem_bundle(
///     writer_component_work_proof(),
///     service,
///     b"/tmp/saddle",
/// );
/// # }
/// ```
pub(crate) struct VerifiedLogDirectoryOwner<const PATH: usize> {
    bytes: [u8; PATH],
    len: usize,
    device: u64,
    inode: u64,
    mode: u32,
    uid: u32,
    gid: u32,
    mount_id: u64,
}

impl<const PATH: usize> VerifiedLogDirectoryOwner<PATH> {
    pub(super) fn into_backend_parts(self) -> ([u8; PATH], usize, u64, u64, u32, u32, u32, u64) {
        (
            self.bytes,
            self.len,
            self.device,
            self.inode,
            self.mode,
            self.uid,
            self.gid,
            self.mount_id,
        )
    }
}

struct VerifiedPhysicalDirectoryOwner<const PATH: usize> {
    binding: ObservabilityBundleIdentityContinuation,
    directory: VerifiedLogDirectoryOwner<PATH>,
}

impl<
    const BLOCKS: usize,
    const BYTES: usize,
    const COMMANDS: usize,
    const PATH: usize,
    const DIRENT_BYTES: usize,
    const ENTRIES: usize,
> ProviderFilesystemProofBundle<BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES>
{
    /// Linear split for the solver and the future physical startup continuation.
    pub fn into_parts(
        self,
    ) -> (
        WriterTerminationProof,
        PhysicalFixedFileStartupOwner<BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES>,
    ) {
        (self.termination, self.physical)
    }
}

/// Atomically matches the plan-bound canonical witness against the private
/// fixed-core proof carried by the whole physical continuation.
#[doc(hidden)]
// The linear error must return the same inline physical owner without a Box or
// allocation; its size is the approved startup-only fixed resource shape.
#[allow(clippy::result_large_err)]
pub(crate) fn normalize_production_physical_queue_profile(
    binding: PreparedObservabilityQueueBinding,
    physical: ProductionPhysicalFixedFileStartupOwner,
) -> Result<
    NormalizedProductionPhysicalFixedFileStartupOwner,
    (
        PreparedObservabilityQueueBinding,
        ProductionPhysicalFixedFileStartupOwner,
    ),
> {
    let (profile_binding, authority) = match binding.into_pair_parts() {
        Ok(parts) => parts,
        Err(binding) => return Err((binding, physical)),
    };
    if !profile_binding.verify_production_canonical_profile() {
        return Err((profile_binding.restore_authority(authority), physical));
    }
    let expected = match fixed_core_layout::<
        FIXED_CORE_BLOCKS,
        FIXED_CORE_BLOCK_BYTES,
        FIXED_CORE_COMMANDS,
        FIXED_CORE_PATH_BYTES,
        FIXED_CORE_DIRENT_BYTES,
        FIXED_CORE_ENTRIES,
    >() {
        Ok(expected) => expected,
        Err(_) => unreachable!("canonical layout is build-static"),
    };
    if physical.profile.schema_identity != FIXED_CORE_PROFILE_SCHEMA_IDENTITY
        || physical.profile.layout != expected
        || physical.profile.profile_identity
            != match fixed_profile_identity(
                [
                    FIXED_CORE_BLOCKS,
                    FIXED_CORE_BLOCK_BYTES,
                    FIXED_CORE_COMMANDS,
                    FIXED_CORE_PATH_BYTES,
                    FIXED_CORE_DIRENT_BYTES,
                    FIXED_CORE_ENTRIES,
                ],
                expected,
            ) {
                Ok(identity) => identity,
                Err(_) => unreachable!("canonical profile identity is build-static"),
            }
    {
        unreachable!("prepared canonical profile must match build-static layout");
    }
    let PhysicalFixedFileStartupOwner {
        service,
        profile,
        directory,
    } = physical;
    let VerifiedPhysicalDirectoryOwner {
        binding,
        directory: raw_directory,
    } = directory;
    let directory = match verify_observability_bundle_binding(authority, binding) {
        Ok(()) => raw_directory,
        Err((authority, binding)) => {
            return Err((
                profile_binding.restore_authority(authority),
                PhysicalFixedFileStartupOwner {
                    service,
                    profile,
                    directory: VerifiedPhysicalDirectoryOwner {
                        binding,
                        directory: raw_directory,
                    },
                },
            ));
        }
    };
    Ok(NormalizedProductionPhysicalFixedFileStartupOwner {
        service,
        profile,
        directory,
    })
}

#[doc(hidden)]
#[allow(clippy::result_large_err)]
pub fn normalize_signed_provider_filesystem_evidence(
    binding: PreparedObservabilityQueueBinding,
    carrier: SignedProviderFilesystemRuntimeEvidence,
) -> Result<
    NormalizedSignedProviderFilesystemRuntimeEvidence,
    (
        PreparedObservabilityQueueBinding,
        SignedProviderFilesystemRuntimeEvidence,
    ),
> {
    match normalize_production_physical_queue_profile(binding, carrier.physical) {
        Ok(physical) => Ok(NormalizedSignedProviderFilesystemRuntimeEvidence {
            subject: carrier.subject,
            physical,
        }),
        Err((binding, physical)) => Err((
            binding,
            SignedProviderFilesystemRuntimeEvidence {
                subject: carrier.subject,
                physical,
            },
        )),
    }
}

impl NormalizedSignedProviderFilesystemRuntimeEvidence {
    pub(crate) fn into_observability_physical(
        self,
    ) -> NormalizedProductionPhysicalFixedFileStartupOwner {
        let _ = self.subject;
        self.physical
    }
}

impl NormalizedProductionPhysicalFixedFileStartupOwner {
    pub(super) fn into_fixed_core_parts(
        self,
    ) -> (
        VerifiedFilesystemServiceProof,
        FixedCoreQueueProfileProof<4, 1_024, 6, 256, 4_096, 32>,
        VerifiedLogDirectoryOwner<256>,
    ) {
        (self.service, self.profile, self.directory)
    }
}

/// Consuming verified deployment owner; fields have no raw constructor.
#[derive(Debug)]
pub struct VerifiedFilesystemServiceProof {
    target: FilesystemTarget,
    domain: FilesystemWorkDomain,
    rates: FilesystemServiceRates,
    environment_identity: [u8; 32],
    filesystem_identity: [u8; 32],
    mount_identity: [u8; 32],
    calibration_identity: [u8; 32],
    service_attestation: [u8; 32],
    build_identity: [u8; 32],
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct WriterWorkProof {
    schema_identity: [u8; 32],
    work: FilesystemWorkDomain,
    queued_records: u64,
    queued_bytes: u64,
    preexisting_dirty_bytes: u64,
    rotations: u64,
    serial_filesystem: bool,
    shutdown_requires_zero_encoding_owners: bool,
}

impl WriterWorkProof {
    pub const fn schema_identity(&self) -> [u8; 32] {
        self.schema_identity
    }

    pub const fn filesystem_work(&self) -> FilesystemWorkDomain {
        self.work
    }

    pub const fn queued_records(&self) -> u64 {
        self.queued_records
    }

    pub const fn queued_bytes(&self) -> u64 {
        self.queued_bytes
    }

    pub const fn preexisting_dirty_bytes(&self) -> u64 {
        self.preexisting_dirty_bytes
    }

    pub const fn rotations(&self) -> u64 {
        self.rotations
    }

    pub const fn serial_filesystem(&self) -> bool {
        self.serial_filesystem
    }

    pub const fn shutdown_requires_zero_encoding_owners(&self) -> bool {
        self.shutdown_requires_zero_encoding_owners
    }
}

/// Derived owner consumed by Runtime's termination solver.
pub struct WriterTerminationProof {
    basis: WriterTerminationBasis,
    work_identity: [u8; 32],
    max_service_nanos: u64,
    environment_identity: [u8; 32],
    filesystem_identity: [u8; 32],
    mount_identity: [u8; 32],
    calibration_identity: [u8; 32],
    service_attestation: [u8; 32],
    build_identity: [u8; 32],
    bundle_authority: Option<ObservabilityBundleIdentityAuthority>,
}

impl std::fmt::Debug for WriterTerminationProof {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter.write_str("WriterTerminationProof(<redacted>)")
    }
}

#[derive(Debug)]
enum WriterTerminationBasis {
    Actual(WriterWorkProof),
    ProviderDomain(FilesystemWorkDomain),
}

impl WriterTerminationProof {
    /// Returns actual writer work only for a proof produced while preparing
    /// one fixed writer assembly.
    pub const fn actual_work(&self) -> Option<&WriterWorkProof> {
        match &self.basis {
            WriterTerminationBasis::Actual(work) => Some(work),
            WriterTerminationBasis::ProviderDomain(_) => None,
        }
    }

    /// Returns the approved service domain only for a provider-only proof.
    /// This is an upper bound and is not evidence that a writer was built.
    pub const fn provider_domain_upper_bound(&self) -> Option<FilesystemWorkDomain> {
        match self.basis {
            WriterTerminationBasis::Actual(_) => None,
            WriterTerminationBasis::ProviderDomain(domain) => Some(domain),
        }
    }

    pub const fn max_service_nanos(&self) -> u64 {
        self.max_service_nanos
    }

    pub const fn environment_identity(&self) -> [u8; 32] {
        self.environment_identity
    }

    pub const fn filesystem_identity(&self) -> [u8; 32] {
        self.filesystem_identity
    }

    pub const fn mount_identity(&self) -> [u8; 32] {
        self.mount_identity
    }

    pub const fn calibration_identity(&self) -> [u8; 32] {
        self.calibration_identity
    }

    pub const fn service_attestation(&self) -> [u8; 32] {
        self.service_attestation
    }

    pub const fn build_identity(&self) -> [u8; 32] {
        self.build_identity
    }
}

impl saddle_admission::VerifiedFilesystemTerminationServiceProofOwner for WriterTerminationProof {
    fn work_identity(&self) -> [u8; 32] {
        self.work_identity
    }

    fn service_attestation(&self) -> [u8; 32] {
        self.service_attestation()
    }

    fn max_service_nanos(&self) -> u64 {
        self.max_service_nanos()
    }

    fn into_observability_bundle_authority(self) -> Option<ObservabilityBundleIdentityAuthority> {
        self.bundle_authority
    }
}

/// Consumes the build-static writer component proof and one already verified
/// filesystem service owner to issue a provider-only termination owner.
///
/// This function performs no filesystem I/O and accepts no raw attestation,
/// writer configuration, directory, ledger or runtime closure. The returned
/// budget covers the approved service domain itself; it does not claim that an
/// actual writer assembly exists.
///
/// ```compile_fail
/// use saddle_observability::file::VerifiedFilesystemServiceProof;
/// fn replay(service: VerifiedFilesystemServiceProof) {
///     let _first = service;
///     let _second = service;
/// }
/// ```
pub fn verify_provider_writer_termination(
    component: WriterComponentWorkProof,
    service: VerifiedFilesystemServiceProof,
) -> Result<WriterTerminationProof, FilesystemProofError> {
    if component != writer_component_work_proof() {
        return Err(FilesystemProofError::ComponentMismatch);
    }
    derive_provider_domain_proof(component.identity(), service)
}

#[allow(dead_code)]
#[derive(Deserialize)]
#[serde(deny_unknown_fields)]
struct SignedDirectoryDocument {
    schema: String,
    signature_domain: String,
    usage: String,
    key_identity: String,
    bundle_identity: String,
    provider_identity: String,
    application_identity: String,
    binary_identity: String,
    build_identity: String,
    source_identity: String,
    artifact_identity: String,
    routes_identity: String,
    deployment_identity: String,
    environment_identity: String,
    nonce_identity: String,
    calibration_identity: String,
    deployment_generation: u64,
    filesystem_identity: String,
    mount_identity: String,
    service_identity: String,
    canonical_unix_bytes_hex: String,
    canonical_unix_bytes_len: usize,
    st_dev: u64,
    st_ino: u64,
    st_mode: u32,
    st_uid: u32,
    st_gid: u32,
    mount_id: u64,
    mount_root_hex: String,
    mount_point_hex: String,
    filesystem_type_hex: String,
}

struct PhysicalDirectoryIdentities {
    provider: [u8; 32],
    deployment: [u8; 32],
    deployment_generation: u64,
    path: [u8; 32],
    mount_binding: [u8; 32],
}

fn verify_physical_signed_directory<const PATH: usize>(
    evidence: &[u8],
    service: &VerifiedFilesystemServiceProof,
) -> Result<(VerifiedLogDirectoryOwner<PATH>, PhysicalDirectoryIdentities), FilesystemProofError> {
    let doc: SignedDirectoryDocument =
        serde_json::from_slice(evidence).map_err(|_| FilesystemProofError::InvalidDirectory)?;
    let identity = |value: &str| decode_identity(value);
    if service.target != FilesystemTarget::LinuxX86_64
        || identity(&doc.environment_identity) != Some(service.environment_identity)
        || identity(&doc.build_identity) != Some(service.build_identity)
        || identity(&doc.filesystem_identity) != Some(service.filesystem_identity)
        || identity(&doc.mount_identity) != Some(service.mount_identity)
        || identity(&doc.service_identity) != Some(service.service_attestation)
        || [
            service.environment_identity,
            service.build_identity,
            service.filesystem_identity,
            service.mount_identity,
            service.service_attestation,
        ]
        .contains(&[0; 32])
    {
        return Err(FilesystemProofError::InvalidIdentity);
    }
    let path =
        decode_hex(&doc.canonical_unix_bytes_hex).ok_or(FilesystemProofError::InvalidDirectory)?;
    if path.len() != doc.canonical_unix_bytes_len || path.len() >= PATH {
        return Err(FilesystemProofError::InvalidDirectory);
    }
    let mut bytes = [0; PATH];
    bytes[..path.len()].copy_from_slice(&path);
    if !is_canonical_absolute_directory(&bytes, path.len())
        || !live_directory_matches(&path, &doc)
        || doc.st_dev == 0
        || doc.st_ino == 0
        || doc.st_mode == 0
        || doc.mount_id == 0
    {
        return Err(FilesystemProofError::InvalidDirectory);
    }
    let mount_material = [
        doc.mount_root_hex.as_bytes(),
        doc.mount_point_hex.as_bytes(),
        doc.filesystem_type_hex.as_bytes(),
        &doc.mount_id.to_le_bytes(),
    ]
    .concat();
    Ok((
        VerifiedLogDirectoryOwner {
            bytes,
            len: path.len(),
            device: doc.st_dev,
            inode: doc.st_ino,
            mode: doc.st_mode,
            uid: doc.st_uid,
            gid: doc.st_gid,
            mount_id: doc.mount_id,
        },
        PhysicalDirectoryIdentities {
            provider: identity(&doc.provider_identity)
                .ok_or(FilesystemProofError::InvalidIdentity)?,
            deployment: identity(&doc.deployment_identity)
                .ok_or(FilesystemProofError::InvalidIdentity)?,
            deployment_generation: doc.deployment_generation,
            path: sha256(&path),
            mount_binding: sha256(&mount_material),
        },
    ))
}

fn live_directory_matches(path: &[u8], doc: &SignedDirectoryDocument) -> bool {
    let Ok(path) = CString::new(path) else {
        return false;
    };
    let Ok(fd) = fs::openat(
        fs::CWD,
        path.as_c_str(),
        OFlags::RDONLY | OFlags::DIRECTORY | OFlags::CLOEXEC | OFlags::NOFOLLOW,
        Mode::empty(),
    ) else {
        return false;
    };
    let Ok(stat) = fs::fstat(&fd) else {
        return false;
    };
    let Ok(statx) = fs::statx(&fd, c"", AtFlags::EMPTY_PATH, StatxFlags::MNT_ID) else {
        return false;
    };
    stat.st_dev == doc.st_dev
        && stat.st_ino == doc.st_ino
        && stat.st_mode == doc.st_mode
        && stat.st_uid == doc.st_uid
        && stat.st_gid == doc.st_gid
        && statx.stx_mnt_id == doc.mount_id
}

fn is_canonical_absolute_directory<const PATH: usize>(bytes: &[u8; PATH], len: usize) -> bool {
    if len == 0 || len > PATH || bytes[0] != b'/' || bytes[..len].contains(&0) {
        return false;
    }
    if len == 1 {
        return true;
    }
    if bytes[1] == b'/' || bytes[len - 1] == b'/' {
        return false;
    }
    !bytes[..len]
        .split(|byte| *byte == b'/')
        .skip(1)
        .any(|part| part == b"." || part == b".." || part.is_empty())
}

fn decode_identity(value: &str) -> Option<[u8; 32]> {
    decode_hex(value)?.try_into().ok()
}
fn decode_hex(value: &str) -> Option<Vec<u8>> {
    if value.len() % 2 != 0 {
        return None;
    }
    value
        .as_bytes()
        .chunks_exact(2)
        .map(|pair| u8::from_str_radix(std::str::from_utf8(pair).ok()?, 16).ok())
        .collect()
}
fn sha256(value: &[u8]) -> [u8; 32] {
    Sha256::digest(value).into()
}

#[doc(hidden)]
#[allow(clippy::large_enum_variant)]
pub enum SignedProviderFilesystemBundleFailure {
    Directory(
        SignedDirectoryIssuerError,
        VerifiedDeploymentDirectoryAuthority,
        VerifiedFilesystemServiceProof,
    ),
    Bundle(
        FilesystemProofError,
        VerifiedSignedDirectorySubjectContinuation,
        VerifiedFilesystemServiceProof,
    ),
}

/// Sole recoverable bridge from a signed directory subject and one actual
/// verified service observation into the concrete production bundle.
#[doc(hidden)]
#[allow(clippy::result_large_err)]
pub fn verify_signed_provider_filesystem_bundle(
    directory: VerifiedDeploymentDirectoryAuthority,
    evidence: &[u8],
    signature: &[u8],
    service: VerifiedFilesystemServiceProof,
) -> Result<VerifiedSignedProviderFilesystemBundle, SignedProviderFilesystemBundleFailure> {
    let subject = match verify_signed_directory_subject(directory, evidence, signature) {
        Ok(subject) => subject,
        Err((error, directory)) => {
            return Err(SignedProviderFilesystemBundleFailure::Directory(
                error, directory, service,
            ));
        }
    };
    let (directory, identities) =
        match verify_physical_signed_directory::<FIXED_CORE_PATH_BYTES>(evidence, &service) {
            Ok(value) => value,
            Err(error) => {
                return Err(SignedProviderFilesystemBundleFailure::Bundle(
                    error, subject, service,
                ));
            }
        };
    let profile = match fixed_core_queue_profile_proof::<
        FIXED_CORE_BLOCKS,
        FIXED_CORE_BLOCK_BYTES,
        FIXED_CORE_COMMANDS,
        FIXED_CORE_PATH_BYTES,
        FIXED_CORE_DIRENT_BYTES,
        FIXED_CORE_ENTRIES,
    >() {
        Ok(profile) => profile,
        Err(error) => {
            return Err(SignedProviderFilesystemBundleFailure::Bundle(
                error, subject, service,
            ));
        }
    };
    let mut termination = match derive_provider_domain_proof_ref(
        writer_component_work_proof().identity(),
        &service,
    ) {
        Ok(value) => value,
        Err(error) => {
            return Err(SignedProviderFilesystemBundleFailure::Bundle(
                error, subject, service,
            ));
        }
    };
    if DIRECTORY_DEPLOYMENT_GENERATION
        .fetch_update(Ordering::AcqRel, Ordering::Acquire, |current| {
            (identities.deployment_generation > current).then_some(identities.deployment_generation)
        })
        .is_err()
    {
        return Err(SignedProviderFilesystemBundleFailure::Bundle(
            FilesystemProofError::ForeignBundle,
            subject,
            service,
        ));
    }
    let (subject, binding, authority) = match issue_observability_bundle_identity(
        subject,
        identities.provider,
        identities.deployment,
        identities.deployment_generation,
        service.build_identity,
        service.environment_identity,
        service.filesystem_identity,
        service.mount_identity,
        service.service_attestation,
        identities.path,
        identities.mount_binding,
    ) {
        Ok(value) => value,
        Err(subject) => {
            return Err(SignedProviderFilesystemBundleFailure::Bundle(
                FilesystemProofError::InvalidIdentity,
                subject,
                service,
            ));
        }
    };
    termination.bundle_authority = Some(authority);
    Ok(VerifiedSignedProviderFilesystemBundle {
        subject,
        filesystem: ProviderFilesystemProofBundle {
            termination,
            physical: PhysicalFixedFileStartupOwner {
                service,
                profile,
                directory: VerifiedPhysicalDirectoryOwner { binding, directory },
            },
        },
    })
}

/// Mechanical cross-component identity check without exposing any bundle
/// identity or path fact to Facade.
#[doc(hidden)]
pub(crate) fn provider_filesystem_bundle_matches_deployment<
    const BLOCKS: usize,
    const BYTES: usize,
    const COMMANDS: usize,
    const PATH: usize,
    const DIRENT_BYTES: usize,
    const ENTRIES: usize,
>(
    bundle: &ProviderFilesystemProofBundle<BLOCKS, BYTES, COMMANDS, PATH, DIRENT_BYTES, ENTRIES>,
    environment: [u8; 32],
    build: [u8; 32],
) -> bool {
    environment != [0; 32]
        && build != [0; 32]
        && bundle.physical.service.environment_identity == environment
        && bundle.physical.service.build_identity == build
}

fn fixed_profile_identity(
    values: [usize; 6],
    layout: FixedCoreLayout,
) -> Result<[u8; 32], FilesystemProofError> {
    let mut digest = FixedProfileDigest::new();
    digest.write(&FIXED_CORE_PROFILE_SCHEMA_IDENTITY);
    let facts = [
        values[0],
        values[1],
        values[2],
        values[3],
        values[4],
        values[5],
        layout.shared_allocation_upper_bound,
        layout.payload_blocks,
        layout.writer_inline,
        layout.backend_inline,
        layout.termination_inline,
        layout.total,
    ];
    for fact in facts {
        digest.write_usize(fact)?;
    }
    let identity = digest.finish();
    if identity == [0; 32] {
        return Err(FilesystemProofError::InvalidProfile);
    }
    Ok(identity)
}

pub(super) struct FixedProfileDigest([u64; 4]);

impl FixedProfileDigest {
    pub(super) fn new() -> Self {
        Self([
            0xcbf2_9ce4_8422_2325,
            0x9e37_79b9_7f4a_7c15,
            0x6a09_e667_f3bc_c909,
            0xbb67_ae85_84ca_a73b,
        ])
    }

    pub(super) fn write(&mut self, bytes: &[u8]) {
        const PRIMES: [u64; 4] = [
            0x0000_0100_0000_01b3,
            0x9e37_79b1_85eb_ca87,
            0xc2b2_ae3d_27d4_eb4f,
            0x1656_67b1_9e37_79f9,
        ];
        for (index, byte) in bytes.iter().copied().enumerate() {
            for (lane, prime) in self.0.iter_mut().zip(PRIMES) {
                *lane ^= u64::from(byte).wrapping_add(index as u64);
                *lane = lane.wrapping_mul(prime);
                *lane ^= *lane >> 29;
            }
        }
    }

    pub(super) fn write_usize(&mut self, value: usize) -> Result<(), FilesystemProofError> {
        let value = u64::try_from(value).map_err(|_| FilesystemProofError::Overflow)?;
        self.write(&value.to_le_bytes());
        Ok(())
    }

    pub(super) fn finish(self) -> [u8; 32] {
        let mut output = [0; 32];
        for (index, lane) in self.0.into_iter().enumerate() {
            output[index * 8..(index + 1) * 8].copy_from_slice(&lane.to_le_bytes());
        }
        output
    }
}

pub fn verify_filesystem_service<A: DeploymentFilesystemServiceAttestation>(
    attestation: A,
    expected: FilesystemDeploymentIdentity,
) -> Result<VerifiedFilesystemServiceProof, FilesystemProofError> {
    if !attestation.approved()
        || !attestation.reproducible_measurement()
        || !attestation.conservative_upper_bound()
    {
        return Err(FilesystemProofError::Unapproved);
    }
    let target = attestation.target();
    if target != FilesystemTarget::LinuxX86_64 || target != expected.target {
        return Err(FilesystemProofError::InvalidDomain);
    }
    let identities = [
        attestation.environment_identity(),
        attestation.filesystem_identity(),
        attestation.mount_identity(),
        attestation.calibration_identity(),
        attestation.service_attestation(),
        attestation.build_identity(),
    ];
    if identities.contains(&[0; 32])
        || [
            expected.environment,
            expected.filesystem,
            expected.mount,
            expected.build,
        ]
        .contains(&[0; 32])
        || attestation.environment_identity() != expected.environment
        || attestation.filesystem_identity() != expected.filesystem
        || attestation.mount_identity() != expected.mount
        || attestation.build_identity() != expected.build
    {
        return Err(FilesystemProofError::InvalidIdentity);
    }
    let domain = attestation.work_domain();
    if domain.max_write_ops == 0
        || domain.max_write_bytes == 0
        || domain.max_file_sync_ops == 0
        || domain.max_file_sync_bytes == 0
        || domain.max_directory_sync_ops == 0
        || domain.max_hard_link_ops == 0
        || domain.max_unlink_ops == 0
        || domain.max_create_ops == 0
        || domain.max_scan_ops == 0
        || domain.max_scan_entries == 0
        || domain.max_parallel_filesystem_ops != 1
        || !domain.advisory_lock
        || !domain.hard_link_no_replace
        || !domain.directory_fsync
        || !domain.data_fsync
    {
        return Err(FilesystemProofError::InvalidDomain);
    }
    let rates = attestation.service_rates();
    if rates.write_op_nanos == 0
        || rates.write_byte_nanos == 0
        || rates.file_sync_op_nanos == 0
        || rates.file_sync_byte_nanos == 0
        || rates.directory_sync_op_nanos == 0
        || rates.hard_link_op_nanos == 0
        || rates.unlink_op_nanos == 0
        || rates.create_op_nanos == 0
        || rates.scan_op_nanos == 0
        || rates.scan_entry_nanos == 0
        || (domain.max_rename_ops != 0 && rates.rename_op_nanos == 0)
    {
        return Err(FilesystemProofError::InvalidService);
    }
    Ok(VerifiedFilesystemServiceProof {
        target,
        domain,
        rates,
        environment_identity: identities[0],
        filesystem_identity: identities[1],
        mount_identity: identities[2],
        calibration_identity: identities[3],
        service_attestation: identities[4],
        build_identity: identities[5],
    })
}

pub(super) fn writer_work_proof<const BLOCKS: usize, const BYTES: usize, const ENTRIES: usize>(
    limits: FixedFileLimits,
) -> Result<WriterWorkProof, FilesystemProofError> {
    let (config, work_owner) = canonical_fixed_file_owners()?;
    if (!cfg!(test)
        && fixed_file_config_values(limits)? != fixed_file_config_values(config.limits)?)
        || config.schema_identity == [0; 32]
        || config.config_identity == [0; 32]
    {
        return Err(FilesystemProofError::InvalidProfile);
    }
    let records = u64::try_from(BLOCKS).map_err(|_| FilesystemProofError::Overflow)?;
    let record_bytes = u64::try_from(BYTES).map_err(|_| FilesystemProofError::Overflow)?;
    let entries = u64::try_from(ENTRIES).map_err(|_| FilesystemProofError::Overflow)?;
    let retries = u64::from(work_owner.component.rotation_publish_attempts());
    let write_retries = u64::from(work_owner.component.write_interrupt_retries());
    let queued_bytes = records
        .checked_mul(record_bytes)
        .ok_or(FilesystemProofError::Overflow)?;
    let write_ops = queued_bytes
        .checked_add(
            records
                .checked_mul(write_retries)
                .ok_or(FilesystemProofError::Overflow)?,
        )
        .ok_or(FilesystemProofError::Overflow)?;
    let dirty_per_stream = limits
        .sync_bytes
        .saturating_sub(1)
        .min(limits.rotate_bytes.saturating_sub(1));
    let preexisting_dirty_bytes = dirty_per_stream
        .checked_mul(4)
        .ok_or(FilesystemProofError::Overflow)?;
    let file_sync_bytes = preexisting_dirty_bytes
        .checked_add(queued_bytes)
        .ok_or(FilesystemProofError::Overflow)?;
    let file_sync_ops = records
        .checked_add(4)
        .ok_or(FilesystemProofError::Overflow)?;
    let directory_sync_ops = records
        .checked_mul(4)
        .ok_or(FilesystemProofError::Overflow)?;
    let hard_link_ops = records
        .checked_mul(retries)
        .ok_or(FilesystemProofError::Overflow)?;
    let unlink_ops = records
        .checked_mul(
            entries
                .checked_add(1)
                .ok_or(FilesystemProofError::Overflow)?,
        )
        .ok_or(FilesystemProofError::Overflow)?;
    let scan_entries = records
        .checked_mul(entries)
        .ok_or(FilesystemProofError::Overflow)?;
    Ok(WriterWorkProof {
        schema_identity: writer_component_work_proof().identity(),
        work: FilesystemWorkDomain {
            max_write_ops: write_ops,
            max_write_bytes: queued_bytes,
            max_file_sync_ops: file_sync_ops,
            max_file_sync_bytes: file_sync_bytes,
            max_directory_sync_ops: directory_sync_ops,
            max_hard_link_ops: hard_link_ops,
            max_rename_ops: 0,
            max_unlink_ops: unlink_ops,
            max_create_ops: records,
            max_scan_ops: records,
            max_scan_entries: scan_entries,
            max_parallel_filesystem_ops: 1,
            advisory_lock: true,
            hard_link_no_replace: true,
            directory_fsync: true,
            data_fsync: true,
        },
        queued_records: records,
        queued_bytes,
        preexisting_dirty_bytes,
        rotations: records,
        serial_filesystem: true,
        shutdown_requires_zero_encoding_owners: true,
    })
}

pub(super) fn derive_termination_proof(
    work: WriterWorkProof,
    service: VerifiedFilesystemServiceProof,
) -> Result<WriterTerminationProof, FilesystemProofError> {
    if service.target != FilesystemTarget::LinuxX86_64 || !covers(service.domain, work.work) {
        return Err(FilesystemProofError::DomainMismatch);
    }
    let facts = work.work;
    let max_service_nanos = service_nanos(facts, service.rates)?;
    Ok(WriterTerminationProof {
        work_identity: work.schema_identity(),
        basis: WriterTerminationBasis::Actual(work),
        max_service_nanos,
        environment_identity: service.environment_identity,
        filesystem_identity: service.filesystem_identity,
        mount_identity: service.mount_identity,
        calibration_identity: service.calibration_identity,
        service_attestation: service.service_attestation,
        build_identity: service.build_identity,
        bundle_authority: None,
    })
}

fn derive_provider_domain_proof(
    work_identity: [u8; 32],
    service: VerifiedFilesystemServiceProof,
) -> Result<WriterTerminationProof, FilesystemProofError> {
    derive_provider_domain_proof_ref(work_identity, &service)
}

fn derive_provider_domain_proof_ref(
    work_identity: [u8; 32],
    service: &VerifiedFilesystemServiceProof,
) -> Result<WriterTerminationProof, FilesystemProofError> {
    if service.target != FilesystemTarget::LinuxX86_64 || work_identity == [0; 32] {
        return Err(FilesystemProofError::DomainMismatch);
    }
    let max_service_nanos = service_nanos(service.domain, service.rates)?;
    Ok(WriterTerminationProof {
        basis: WriterTerminationBasis::ProviderDomain(service.domain),
        work_identity,
        max_service_nanos,
        environment_identity: service.environment_identity,
        filesystem_identity: service.filesystem_identity,
        mount_identity: service.mount_identity,
        calibration_identity: service.calibration_identity,
        service_attestation: service.service_attestation,
        build_identity: service.build_identity,
        bundle_authority: None,
    })
}

fn service_nanos(
    facts: FilesystemWorkDomain,
    rates: FilesystemServiceRates,
) -> Result<u64, FilesystemProofError> {
    let mut nanos = 0_u128;
    add_product(&mut nanos, facts.max_write_ops, rates.write_op_nanos)?;
    add_product(&mut nanos, facts.max_write_bytes, rates.write_byte_nanos)?;
    add_product(
        &mut nanos,
        facts.max_file_sync_ops,
        rates.file_sync_op_nanos,
    )?;
    add_product(
        &mut nanos,
        facts.max_file_sync_bytes,
        rates.file_sync_byte_nanos,
    )?;
    add_product(
        &mut nanos,
        facts.max_directory_sync_ops,
        rates.directory_sync_op_nanos,
    )?;
    add_product(
        &mut nanos,
        facts.max_hard_link_ops,
        rates.hard_link_op_nanos,
    )?;
    add_product(&mut nanos, facts.max_rename_ops, rates.rename_op_nanos)?;
    add_product(&mut nanos, facts.max_unlink_ops, rates.unlink_op_nanos)?;
    add_product(&mut nanos, facts.max_create_ops, rates.create_op_nanos)?;
    add_product(&mut nanos, facts.max_scan_ops, rates.scan_op_nanos)?;
    add_product(&mut nanos, facts.max_scan_entries, rates.scan_entry_nanos)?;
    u64::try_from(nanos).map_err(|_| FilesystemProofError::Overflow)
}

fn add_product(total: &mut u128, count: u64, nanos: u64) -> Result<(), FilesystemProofError> {
    let cost = u128::from(count)
        .checked_mul(u128::from(nanos))
        .ok_or(FilesystemProofError::Overflow)?;
    *total = total
        .checked_add(cost)
        .ok_or(FilesystemProofError::Overflow)?;
    Ok(())
}

const fn covers(service: FilesystemWorkDomain, work: FilesystemWorkDomain) -> bool {
    service.max_write_ops >= work.max_write_ops
        && service.max_write_bytes >= work.max_write_bytes
        && service.max_file_sync_ops >= work.max_file_sync_ops
        && service.max_file_sync_bytes >= work.max_file_sync_bytes
        && service.max_directory_sync_ops >= work.max_directory_sync_ops
        && service.max_hard_link_ops >= work.max_hard_link_ops
        && service.max_rename_ops >= work.max_rename_ops
        && service.max_unlink_ops >= work.max_unlink_ops
        && service.max_create_ops >= work.max_create_ops
        && service.max_scan_ops >= work.max_scan_ops
        && service.max_scan_entries >= work.max_scan_entries
        && service.max_parallel_filesystem_ops == work.max_parallel_filesystem_ops
        && (!work.advisory_lock || service.advisory_lock)
        && (!work.hard_link_no_replace || service.hard_link_no_replace)
        && (!work.directory_fsync || service.directory_fsync)
        && (!work.data_fsync || service.data_fsync)
}

#[cfg(test)]
mod tests {
    use std::time::Duration;

    use super::*;

    const BUILD: [u8; 32] = [7; 32];

    struct TestAttestation {
        domain: FilesystemWorkDomain,
        rates: FilesystemServiceRates,
        approved: bool,
        reproducible: bool,
        build: [u8; 32],
    }

    impl DeploymentFilesystemServiceAttestation for TestAttestation {
        fn target(&self) -> FilesystemTarget {
            FilesystemTarget::LinuxX86_64
        }

        fn approved(&self) -> bool {
            self.approved
        }

        fn reproducible_measurement(&self) -> bool {
            self.reproducible
        }

        fn conservative_upper_bound(&self) -> bool {
            true
        }

        fn work_domain(&self) -> FilesystemWorkDomain {
            self.domain
        }

        fn service_rates(&self) -> FilesystemServiceRates {
            self.rates
        }

        fn calibration_identity(&self) -> [u8; 32] {
            [1; 32]
        }

        fn environment_identity(&self) -> [u8; 32] {
            [2; 32]
        }

        fn filesystem_identity(&self) -> [u8; 32] {
            [3; 32]
        }

        fn mount_identity(&self) -> [u8; 32] {
            [4; 32]
        }

        fn service_attestation(&self) -> [u8; 32] {
            [5; 32]
        }

        fn build_identity(&self) -> [u8; 32] {
            self.build
        }
    }

    fn limits() -> FixedFileLimits {
        FixedFileLimits {
            rotate_bytes: 1_000,
            retained_files: 2,
            retention_age: Duration::from_secs(60),
            sync_bytes: 100,
            sync_interval: Duration::from_secs(1),
            fail: None,
        }
    }

    const fn rates(multiplier: u64) -> FilesystemServiceRates {
        FilesystemServiceRates {
            write_op_nanos: multiplier,
            write_byte_nanos: multiplier,
            file_sync_op_nanos: multiplier,
            file_sync_byte_nanos: multiplier,
            directory_sync_op_nanos: multiplier,
            hard_link_op_nanos: multiplier,
            rename_op_nanos: 0,
            unlink_op_nanos: multiplier,
            create_op_nanos: multiplier,
            scan_op_nanos: multiplier,
            scan_entry_nanos: multiplier,
        }
    }

    fn attestation(
        domain: FilesystemWorkDomain,
        multiplier: u64,
        build: [u8; 32],
    ) -> TestAttestation {
        TestAttestation {
            domain,
            rates: rates(multiplier),
            approved: true,
            reproducible: true,
            build,
        }
    }

    #[test]
    fn component_work_proof_is_build_static_sealed_and_matches_derived_work() {
        const STATIC: WriterComponentWorkProof = writer_component_work_proof();
        assert_ne!(STATIC.identity(), [0; 32]);
        assert_eq!(STATIC.version(), 1);
        assert_eq!(
            STATIC.routed_files(),
            crate::file::FileStream::ALL.len() as u8
        );
        assert_eq!(STATIC.reliability_domains(), 1);
        assert_eq!(STATIC.max_parallel_filesystem_ops(), 1);
        assert_eq!(STATIC.shutdown_barrier_files(), 4);
        assert_eq!(
            u64::from(STATIC.write_interrupt_retries()),
            crate::file::linux_backend::WRITE_INTERRUPT_RETRIES
        );
        assert_eq!(
            u64::from(STATIC.rotation_publish_attempts()),
            crate::file::linux_backend::ROTATION_RETRIES
        );
        assert_eq!(STATIC.directory_syncs_per_rotation(), 4);
        assert!(STATIC.hard_link_no_replace());
        assert_eq!(STATIC.rename_ops_per_rotation(), 0);
        assert!(STATIC.bounded_retention_scan());
        assert!(STATIC.shutdown_requires_zero_encoding_owners());
        assert!(STATIC.requires_deployment_filesystem_proof());

        let derived = writer_work_proof::<2, 64, 5>(limits()).unwrap();
        assert_eq!(derived.schema_identity(), STATIC.identity());

        let mut drifted = STATIC.identity();
        drifted[31] ^= 1;
        assert_ne!(drifted, derived.schema_identity());
    }

    #[test]
    fn canonical_config_owner_matches_the_generated_leaf_and_backend_work() {
        use crate::file::{ObservabilityGeneratedLayoutSource, observe_release_fixed_core_layout};

        let (config, work) = canonical_fixed_file_owners().unwrap();
        let observed = observe_release_fixed_core_layout().unwrap();
        assert_eq!(config.schema_identity, observed.config_schema_identity());
        assert_eq!(config.config_identity, observed.config_identity());
        assert_eq!(
            fixed_file_config_values(config.limits).unwrap(),
            observed.config()
        );
        assert_eq!(
            u64::from(work.component.write_interrupt_retries()),
            WRITE_INTERRUPT_RETRIES
        );
        assert_eq!(
            u64::from(work.component.rotation_publish_attempts()),
            ROTATION_RETRIES
        );
    }

    const fn expected() -> FilesystemDeploymentIdentity {
        FilesystemDeploymentIdentity {
            target: FilesystemTarget::LinuxX86_64,
            environment: [2; 32],
            filesystem: [3; 32],
            mount: [4; 32],
            build: BUILD,
        }
    }

    #[test]
    fn work_proof_seals_every_serial_backend_upper_bound() {
        let proof = writer_work_proof::<2, 64, 5>(limits()).unwrap();
        let work = proof.filesystem_work();
        assert_eq!(proof.queued_records(), 2);
        assert_eq!(proof.queued_bytes(), 128);
        assert_eq!(proof.preexisting_dirty_bytes(), 396);
        assert_eq!(proof.rotations(), 2);
        assert!(proof.serial_filesystem());
        assert!(proof.shutdown_requires_zero_encoding_owners());
        assert_eq!(work.max_write_ops, 144);
        assert_eq!(work.max_write_bytes, 128);
        assert_eq!(work.max_file_sync_ops, 6);
        assert_eq!(work.max_file_sync_bytes, 524);
        assert_eq!(work.max_directory_sync_ops, 8);
        assert_eq!(work.max_hard_link_ops, 16);
        assert_eq!(work.max_rename_ops, 0);
        assert_eq!(work.max_unlink_ops, 12);
        assert_eq!(work.max_create_ops, 2);
        assert_eq!(work.max_scan_ops, 2);
        assert_eq!(work.max_scan_entries, 10);
        assert_eq!(work.max_parallel_filesystem_ops, 1);
    }

    #[test]
    fn slow_reproducible_service_derives_a_larger_budget_without_runtime_adaptation() {
        let work = writer_work_proof::<2, 64, 5>(limits()).unwrap();
        let domain = work.filesystem_work();
        let normal = verify_filesystem_service(attestation(domain, 1, BUILD), expected()).unwrap();
        let slow = verify_filesystem_service(attestation(domain, 9, BUILD), expected()).unwrap();
        let normal = derive_termination_proof(work, normal).unwrap();
        let slow = derive_termination_proof(writer_work_proof::<2, 64, 5>(limits()).unwrap(), slow)
            .unwrap();
        assert_eq!(normal.max_service_nanos(), 852);
        assert_eq!(slow.max_service_nanos(), 7_668);
        assert_eq!(
            normal
                .actual_work()
                .unwrap()
                .filesystem_work()
                .max_rename_ops,
            0
        );
        assert!(normal.provider_domain_upper_bound().is_none());
    }

    #[test]
    fn provider_owner_consumes_static_component_and_verified_service_without_writer() {
        let domain = writer_work_proof::<2, 64, 5>(limits())
            .unwrap()
            .filesystem_work();
        let service = verify_filesystem_service(attestation(domain, 1, BUILD), expected()).unwrap();
        let proof =
            verify_provider_writer_termination(writer_component_work_proof(), service).unwrap();

        assert!(proof.actual_work().is_none());
        assert_eq!(proof.provider_domain_upper_bound(), Some(domain));
        assert_eq!(proof.max_service_nanos(), 852);
        assert_eq!(proof.environment_identity(), expected().environment);
        assert_eq!(proof.filesystem_identity(), expected().filesystem);
        assert_eq!(proof.mount_identity(), expected().mount);
        assert_eq!(proof.calibration_identity(), [1; 32]);
        assert_eq!(proof.service_attestation(), [5; 32]);
        assert_eq!(proof.build_identity(), BUILD);
        assert_eq!(
            saddle_admission::VerifiedFilesystemTerminationServiceProofOwner::work_identity(&proof),
            writer_component_work_proof().identity()
        );
    }

    #[test]
    fn provider_owner_rejects_foreign_component_drift_and_overflow() {
        let domain = writer_work_proof::<2, 64, 5>(limits())
            .unwrap()
            .filesystem_work();
        let service = verify_filesystem_service(attestation(domain, 1, BUILD), expected()).unwrap();
        let mut foreign = writer_component_work_proof();
        foreign.identity[0] ^= 1;
        assert_eq!(
            verify_provider_writer_termination(foreign, service).unwrap_err(),
            FilesystemProofError::ComponentMismatch
        );

        let drifted = attestation(domain, 1, [8; 32]);
        assert_eq!(
            verify_filesystem_service(drifted, expected()).unwrap_err(),
            FilesystemProofError::InvalidIdentity
        );

        let huge =
            verify_filesystem_service(attestation(domain, u64::MAX, BUILD), expected()).unwrap();
        assert_eq!(
            verify_provider_writer_termination(writer_component_work_proof(), huge).unwrap_err(),
            FilesystemProofError::Overflow
        );
    }

    #[test]
    fn fixed_profile_rejects_invalid_shape() {
        assert_eq!(
            fixed_core_queue_profile_proof::<2, 64, 3, 256, 256, 5>().unwrap_err(),
            FilesystemProofError::InvalidProfile
        );
    }

    #[test]
    fn startup_rejects_unmeasured_domain_shortfall_and_build_identity_drift() {
        let work = writer_work_proof::<2, 64, 5>(limits()).unwrap();
        let mut unmeasured = attestation(work.filesystem_work(), 1, BUILD);
        unmeasured.reproducible = false;
        assert_eq!(
            verify_filesystem_service(unmeasured, expected()).unwrap_err(),
            FilesystemProofError::Unapproved
        );

        let drifted = attestation(work.filesystem_work(), 1, [8; 32]);
        assert_eq!(
            verify_filesystem_service(drifted, expected()).unwrap_err(),
            FilesystemProofError::InvalidIdentity
        );

        let mut mount_drift = expected();
        mount_drift.mount = [9; 32];
        assert_eq!(
            verify_filesystem_service(attestation(work.filesystem_work(), 1, BUILD), mount_drift)
                .unwrap_err(),
            FilesystemProofError::InvalidIdentity
        );

        let mut short = work.filesystem_work();
        short.max_file_sync_ops -= 1;
        let service = verify_filesystem_service(attestation(short, 1, BUILD), expected()).unwrap();
        assert_eq!(
            derive_termination_proof(work, service).unwrap_err(),
            FilesystemProofError::DomainMismatch
        );
    }
}