trusty-mpm 1.8.2

//! Integration tests for the `tm-<leaf>-NN` naming scheme (issue #1955).
//!
//! Why: `session_manager/tests.rs` is at the 1500-SLOC test cap; the
//! #1955 serial-allocation and backward-compat-reconciliation coverage lives
//! here so neither file grows past its limit. Uses `FakeTmuxDriver` from the
//! sibling `tests` module, mirroring the pattern established by
//! `backfill_tests.rs`/`decommission_worktree_tests.rs`. The PURE naming-logic
//! unit tests (leaf derivation, serial gap-reuse, the >99 exhaustion case) live
//! in `crate::core::names`'s own test module — this file covers the same
//! behavior end-to-end through the real [`SessionManager`] API.
//! What: (1) serial reuse after decommission, exercised through
//! `SessionManager::create`; (2) `reconcile_on_boot` recognizing a live
//! `tm-`-prefixed session exactly like the legacy `tmpm-` prefix.
//! Test: this file IS the test module; run with `cargo test -p trusty-mpm`.

use std::path::PathBuf;

use tempfile::TempDir;

use super::manager::{ManagedTmuxDriver, SessionManager};
use super::record::ManagedSessionState;
use super::tests::FakeTmuxDriver;

/// RAII guard restoring `$HOME` on drop (including panic) — mirrors the
/// identical pattern in `core::session_launch::tests::EnvVarGuard` and
/// siblings (each module needs its own copy; `pub(super)`/module-private
/// visibility does not cross sibling module trees — see those sites' docs).
///
/// Why (#3965): `reconcile_on_boot`'s external-adopt loop, when a pane's cwd
/// resolves, calls `deploy_validate::validate_and_repair(&fw, &workspace,
/// None)` where `fw = FrameworkPaths::for_managed_workspace(&workspace)` —
/// whose root resolves from the REAL process `$HOME` (`core/paths.rs`), not
/// from `workspace`. When the workspace is incomplete (as every bare
/// `TempDir` used by these tests is), that falls through to
/// `preseed_workspace_trust_home`, writing into the operator's real
/// `~/.claude.json`. Pairs with `#[serial_test::serial]`.
/// Test: used by every `reconcile_*` test below that resolves a pane cwd.
struct HomeGuard(Option<String>);
impl Drop for HomeGuard {
    fn drop(&mut self) {
        // SAFETY: paired with `#[serial_test::serial]` — no other thread
        // reads/writes the environment concurrently.
        match self.0 {
            Some(ref p) => unsafe { std::env::set_var("HOME", p) },
            None => unsafe { std::env::remove_var("HOME") },
        }
    }
}

/// Point `$HOME` at `home` for the duration of the caller's scope. Callers
/// MUST be `#[serial_test::serial]` — see [`HomeGuard`].
fn set_home(home: &std::path::Path) -> HomeGuard {
    let prior = std::env::var("HOME").ok();
    // SAFETY: serialized via `#[serial_test::serial]`.
    unsafe { std::env::set_var("HOME", home) };
    HomeGuard(prior)
}

/// The full `tm-<leaf>-NN` naming convention (issue #1955): a `tm-` prefix
/// AND a trailing two-digit numeric serial.
///
/// Why (#1966 review follow-up, moved from `tests.rs` to keep that file under
/// its 1500-SLOC test cap): checking only the `tm-` prefix would not catch a
/// regression that dropped the `-NN` suffix entirely (e.g. a future change
/// that regressed to the pre-#1955 `tm-<leaf>` form with no serial).
/// What: creates one session and asserts its `tmux_name` has the `tm-` prefix
/// AND that the segment after the last dash is exactly two ASCII digits.
/// Test: this function IS the test.
#[tokio::test]
async fn manager_naming_convention() {
    let dir = TempDir::new().unwrap();
    let fake = FakeTmuxDriver::new();
    let mgr = SessionManager::new(dir.path(), fake.clone()).await.unwrap();

    let record = mgr
        .create(
            "task".into(),
            Some(PathBuf::from("/tmp/wt1")),
            None,
            None,
            None,
            None,
        )
        .await
        .expect("create");

    assert!(record.tmux_name.starts_with("tm-"), "has tm- prefix");
    let suffix = record
        .tmux_name
        .rsplit('-')
        .next()
        .expect("name has at least one dash-delimited segment");
    assert_eq!(
        suffix.len(),
        2,
        "serial suffix is exactly 2 digits: {}",
        record.tmux_name
    );
    assert!(
        suffix.bytes().all(|b| b.is_ascii_digit()),
        "serial suffix is numeric: {}",
        record.tmux_name
    );
    // `01`-`99`, never `00` (#1966 review follow-up: a bare length+digit-ness
    // check would also accept "00", which `allocate_serial` never hands out).
    let serial: u8 = suffix.parse().expect("suffix is numeric (checked above)");
    assert!(
        (1..=99).contains(&serial),
        "serial is in 01-99: {}",
        record.tmux_name
    );
}

/// Serial reuse end-to-end (issue #1955 worked example): sessions `-01`,
/// `-02`, `-03` exist for a project; `-02` is decommissioned; the NEXT session
/// created for that project must reuse `-02`, not jump to `-04`.
///
/// Why: this is the ticket's acceptance example, exercised through the real
/// [`SessionManager::create`] path (not just the pure `names` unit tests) so
/// the store-filtering behavior in `names_for_serial_allocation` is covered
/// end-to-end.
/// What: creates three sessions for the same repo-derived leaf, marks the
/// second `Decommissioned` directly in the store (and kills its tmux session,
/// mirroring what real decommission does), creates a fourth, and asserts it
/// reused the `-02` serial.
/// Test: this function IS the test.
#[tokio::test]
async fn manager_serial_reuses_decommissioned_gap() {
    let dir = TempDir::new().unwrap();
    let fake = FakeTmuxDriver::new();
    let mgr = SessionManager::new(dir.path(), fake.clone()).await.unwrap();
    let repo_url = Some("https://github.com/acme/gap-test".to_string());

    let r1 = mgr
        .create(
            "t1".into(),
            Some(PathBuf::from("/tmp/g1")),
            None,
            None,
            repo_url.clone(),
            None,
        )
        .await
        .expect("create r1");
    let r2 = mgr
        .create(
            "t2".into(),
            Some(PathBuf::from("/tmp/g2")),
            None,
            None,
            repo_url.clone(),
            None,
        )
        .await
        .expect("create r2");
    let r3 = mgr
        .create(
            "t3".into(),
            Some(PathBuf::from("/tmp/g3")),
            None,
            None,
            repo_url.clone(),
            None,
        )
        .await
        .expect("create r3");

    assert_eq!(r1.tmux_name, "tm-gap-test-01");
    assert_eq!(r2.tmux_name, "tm-gap-test-02");
    assert_eq!(r3.tmux_name, "tm-gap-test-03");

    // Decommission r2: flip its store state and kill its tmux session (mirrors
    // what the real `decommission` path does to the tmux host).
    {
        let mut store = mgr.store.write().await;
        let mut rec = store.get(&r2.id).await.expect("get r2");
        rec.state = ManagedSessionState::Decommissioned;
        store.upsert(rec).await.expect("upsert decommissioned r2");
    }
    fake.kill_session(&r2.tmux_name).expect("kill r2 tmux");

    let r4 = mgr
        .create(
            "t4".into(),
            Some(PathBuf::from("/tmp/g4")),
            None,
            None,
            repo_url.clone(),
            None,
        )
        .await
        .expect("create r4");
    assert_eq!(
        r4.tmux_name, "tm-gap-test-02",
        "decommissioned serial 02 must be reused, got {}",
        r4.tmux_name
    );
}

/// Live tmux sessions created under the NEW `tm-` prefix (#1955) must be
/// recognized and adopted by boot reconciliation exactly like the legacy
/// `tmpm-` prefix — the daemon must never treat a `tm-<leaf>-NN` session as
/// foreign just because the prefix changed.
///
/// Why: `reconcile_on_boot` used to hardcode `starts_with("tmpm-")`; after
/// #1955 it must use `is_managed_session_name` so sessions created under the
/// new scheme are adopted, not ignored (which would leave them untracked and
/// vulnerable to the orphan-GC).
/// What: seeds a live `tm-`-prefixed tmux session unknown to the store, runs
/// reconcile, and asserts it appears in `external_adopted` as `Active`.
///
/// #6118: the pane resolves a working directory. Adoption now requires that —
/// a pane whose cwd will not resolve is declined, covered by
/// `reconcile_declines_to_adopt_a_pane_whose_cwd_cannot_be_resolved` — so this
/// test uses [`PaneCwdTmux`] rather than the shared `FakeTmuxDriver`, whose
/// `get_pane_cwd` is the trait default (`None`).
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn manager_reconcile_adopts_new_prefix_session() {
    let dir = TempDir::new().unwrap();
    let workspace = TempDir::new().unwrap();
    // #3965: `#[serial]` + `$HOME` override — see `HomeGuard` above.
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec!["tm-trusty-tools-01".into()],
        pane_cwd: Some(workspace.path().to_path_buf()),
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();

    let report = mgr.reconcile_on_boot(false).await.expect("reconcile");
    assert!(
        report
            .external_adopted
            .contains(&"tm-trusty-tools-01".to_string()),
        "a live tm-prefixed session must be externally adopted; report: {report:?}"
    );

    let listed = mgr.list().await;
    let adopted = listed
        .iter()
        .find(|r| r.tmux_name == "tm-trusty-tools-01")
        .expect("adopted record present");
    assert_eq!(adopted.state, ManagedSessionState::Active);
}

/// Minimal `ManagedTmuxDriver` test double whose `get_pane_cwd` is
/// controllable, mirroring `lifecycle.rs`'s local `StubTmux` pattern rather
/// than extending the shared `tests::FakeTmuxDriver` (already near its
/// 1500-SLOC test-file cap).
///
/// Why (#2158): the adopted-session cwd-resolution fix needs a driver whose
/// `get_pane_cwd` returns a controllable value; every other trait method is
/// unused by these two tests and panics if called, so a wiring mistake fails
/// loudly instead of silently passing.
/// What: `list_sessions` returns `alive`; `get_pane_cwd` returns `pane_cwd`
/// for every session name (both fields set at construction).
/// Test: used by `reconcile_resolves_adopted_session_cwd_from_pane` and
/// `reconcile_flags_unresolvable_adopted_session_as_unmanaged` below.
struct PaneCwdTmux {
    alive: Vec<String>,
    pane_cwd: Option<PathBuf>,
}

impl ManagedTmuxDriver for PaneCwdTmux {
    fn create_session(
        &self,
        _name: &str,
        _workdir: &str,
    ) -> Result<(), super::manager::ManagedError> {
        unimplemented!("not exercised by PaneCwdTmux tests")
    }
    fn kill_session(&self, _name: &str) -> Result<(), super::manager::ManagedError> {
        unimplemented!("not exercised by PaneCwdTmux tests")
    }
    fn send_line(&self, _name: &str, _text: &str) -> Result<(), super::manager::ManagedError> {
        unimplemented!("not exercised by PaneCwdTmux tests")
    }
    fn capture(&self, _name: &str, _lines: usize) -> Result<String, super::manager::ManagedError> {
        unimplemented!("not exercised by PaneCwdTmux tests")
    }
    fn list_sessions(&self) -> Result<Vec<String>, super::manager::ManagedError> {
        Ok(self.alive.clone())
    }
    fn get_pane_cwd(&self, _name: &str) -> Option<PathBuf> {
        self.pane_cwd.clone()
    }
}

/// Why (#2158): an adopted session whose pane cwd resolves to a real,
/// existing directory must carry that directory as BOTH `cwd` and
/// `workspace_path` — never the permanent `/unknown` stub — so it can be
/// validated/auto-repaired like any other managed workspace.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn reconcile_resolves_adopted_session_cwd_from_pane() {
    let dir = TempDir::new().unwrap();
    let workspace = TempDir::new().unwrap();
    // #3965: `#[serial]` + `$HOME` override — see `HomeGuard` above.
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec!["tm-resolvable-01".into()],
        pane_cwd: Some(workspace.path().to_path_buf()),
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();
    mgr.reconcile_on_boot(false).await.expect("reconcile");

    let listed = mgr.list().await;
    let adopted = listed
        .iter()
        .find(|r| r.tmux_name == "tm-resolvable-01")
        .expect("adopted record present");
    assert_eq!(adopted.cwd, workspace.path());
    assert_eq!(adopted.workspace_path.as_deref(), Some(workspace.path()));
    assert_eq!(adopted.task, "adopted session");
}

/// A `ManagedTmuxDriver` whose `get_pane_cwd` fails the first `flaky_for`
/// calls and succeeds afterwards, counting every call.
///
/// Why (#6118 review): every other fixture here fixes `pane_cwd` for its
/// lifetime, so the case that actually matters — a probe that fails once and
/// then works — had no coverage at all. That is the case where declining kills
/// a live pane: `TmuxDriver::pane_current_path` reports spawn failure, a
/// non-zero exit and empty output all as `None`, and a declined pane is
/// orphan-GC input.
/// What: `list_sessions` returns `alive`; `get_pane_cwd` returns `None` for the
/// first `flaky_for` calls and `Some(pane_cwd)` after, incrementing `calls`
/// every time. `pane_cwd: None` makes it permanently unresolvable, which is how
/// the retry BOUND is asserted.
/// Test: `flaky_cwd_probe_still_adopts_within_one_reconcile`,
/// `unresolvable_cwd_probe_is_retried_a_bounded_number_of_times`.
struct FlakyPaneCwdTmux {
    alive: Vec<String>,
    pane_cwd: Option<PathBuf>,
    flaky_for: usize,
    calls: std::sync::atomic::AtomicUsize,
    /// What `get_pane_id` reports — `flaky_for: 0` plus a distinct value here
    /// makes this a plain fixture standing in for a DIFFERENT physical pane
    /// under a reused tmux name.
    pane_id: Option<String>,
}

impl ManagedTmuxDriver for FlakyPaneCwdTmux {
    fn create_session(
        &self,
        _name: &str,
        _workdir: &str,
    ) -> Result<(), super::manager::ManagedError> {
        unimplemented!("not exercised by FlakyPaneCwdTmux tests")
    }
    fn kill_session(&self, _name: &str) -> Result<(), super::manager::ManagedError> {
        unimplemented!("not exercised by FlakyPaneCwdTmux tests")
    }
    fn send_line(&self, _name: &str, _text: &str) -> Result<(), super::manager::ManagedError> {
        unimplemented!("not exercised by FlakyPaneCwdTmux tests")
    }
    fn capture(&self, _name: &str, _lines: usize) -> Result<String, super::manager::ManagedError> {
        unimplemented!("not exercised by FlakyPaneCwdTmux tests")
    }
    fn list_sessions(&self) -> Result<Vec<String>, super::manager::ManagedError> {
        Ok(self.alive.clone())
    }
    fn get_pane_cwd(&self, _name: &str) -> Option<PathBuf> {
        let n = self.calls.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
        if n < self.flaky_for {
            return None;
        }
        self.pane_cwd.clone()
    }
    fn get_pane_id(&self, _name: &str) -> Option<String> {
        self.pane_id.clone()
    }
}

/// #6118 review, CRITICAL: one transient probe failure must not cost a live
/// pane.
///
/// Why: declining hands the pane to the orphan-GC, which kills an idle-shell
/// pane with no live child after two 60-second sweeps — and `reconcile_on_boot`
/// runs once per daemon process, so a single flaky `get_pane_cwd` would be that
/// pane's only hearing until the next daemon restart. The retry in
/// `resolve_adoptable_cwd` has to close that inside one reconcile pass.
/// What: a probe that fails once then succeeds; asserts ONE `reconcile_on_boot`
/// adopts the pane normally — real cwd, real workspace, nothing declined.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn flaky_cwd_probe_still_adopts_within_one_reconcile() {
    let dir = TempDir::new().unwrap();
    let workspace = TempDir::new().unwrap();
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(FlakyPaneCwdTmux {
        alive: vec!["tm-flaky-01".into()],
        pane_cwd: Some(workspace.path().to_path_buf()),
        flaky_for: 1,
        calls: std::sync::atomic::AtomicUsize::new(0),
        pane_id: None,
    });

    let mgr = SessionManager::new(dir.path(), fake.clone()).await.unwrap();
    let report = mgr.reconcile_on_boot(false).await.expect("reconcile");

    assert!(
        report.adoption_declined.is_empty(),
        "a probe that recovers on retry must not be declined; report: {report:?}"
    );
    let listed = mgr.list().await;
    assert_eq!(
        listed.len(),
        1,
        "the pane must be adopted within one reconcile pass: {listed:?}"
    );
    assert_eq!(listed[0].tmux_name, "tm-flaky-01");
    assert_eq!(listed[0].cwd, workspace.path());
    assert_eq!(listed[0].workspace_path.as_deref(), Some(workspace.path()));
    assert!(
        fake.calls.load(std::sync::atomic::Ordering::SeqCst) >= 2,
        "the first probe must have been retried"
    );
}

/// The retry is bounded — a genuinely unresolvable pane is declined, not
/// probed forever.
///
/// Why: the retry exists to survive a flake, not to hang boot on a pane that
/// will never resolve. Boot holds the store write lock while it runs.
/// What: a probe that never succeeds; asserts the pane is declined and that
/// `get_pane_cwd` was called exactly three times (`CWD_PROBE_BACKOFF.len() + 1`).
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn unresolvable_cwd_probe_is_retried_a_bounded_number_of_times() {
    let dir = TempDir::new().unwrap();
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(FlakyPaneCwdTmux {
        alive: vec!["tm-never-01".into()],
        pane_cwd: None,
        flaky_for: usize::MAX,
        calls: std::sync::atomic::AtomicUsize::new(0),
        pane_id: None,
    });

    let mgr = SessionManager::new(dir.path(), fake.clone()).await.unwrap();
    let report = mgr.reconcile_on_boot(false).await.expect("reconcile");

    assert_eq!(report.adoption_declined, vec!["tm-never-01".to_string()]);
    assert_eq!(mgr.list().await.len(), 0);
    assert_eq!(
        fake.calls.load(std::sync::atomic::Ordering::SeqCst),
        3,
        "the probe must be attempted exactly 3 times, then give up"
    );
}

/// #6414 REGRESSION: a pane whose recorded path is GONE is declined on the
/// first probe, not after the full backoff.
///
/// Why: `resolve_adoptable_cwd` folded "tmux did not answer" and "tmux named a
/// directory that no longer exists" into one retry. Only the first is a flake.
/// tmux keeps reporting the path it recorded, so probes two and three read the
/// same bytes and reach the same verdict — and on a host with 276 panes left
/// over from reaped agent worktrees, that identical verdict cost 55 s of sleep
/// inside `reconcile_on_boot`, which every `DaemonState::session_manager()`
/// caller awaits (#6391 raised the SessionEnd sweep's budget to 300 s to
/// contain it).
///
/// What: one live pane whose `get_pane_cwd` always answers with a path that
/// does not exist. Asserts the probe ran EXACTLY once — against the pre-fix
/// body it runs 3 times and this fails — and that the verdict is byte-for-byte
/// the one the retry produced: declined, no record, nothing adopted. The count
/// is the assertion because it is the cause; wall-clock is not asserted.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn a_stale_pane_path_is_declined_on_the_first_probe() {
    let dir = TempDir::new().unwrap();
    let _home = set_home(dir.path());
    // A path under the temp dir that was never created — the shape a reaped
    // agent worktree leaves behind in a still-live pane.
    let reaped = dir.path().join("reaped-worktree");
    assert!(!reaped.exists(), "the fixture path must not exist");

    let fake = std::sync::Arc::new(FlakyPaneCwdTmux {
        alive: vec!["tm-stale-01".into()],
        pane_cwd: Some(reaped),
        flaky_for: 0,
        calls: std::sync::atomic::AtomicUsize::new(0),
        pane_id: None,
    });

    let mgr = SessionManager::new(dir.path(), fake.clone()).await.unwrap();
    let report = mgr.reconcile_on_boot(false).await.expect("reconcile");

    assert_eq!(
        fake.calls.load(std::sync::atomic::Ordering::SeqCst),
        1,
        "a path tmux keeps reporting cannot become a directory by being read again"
    );
    // The verdict is unchanged — the point of the fix is that it costs less,
    // not that it decides differently.
    assert_eq!(report.adoption_declined, vec!["tm-stale-01".to_string()]);
    assert!(report.external_adopted.is_empty());
    assert_eq!(mgr.list().await.len(), 0);
}

/// #6118: a live pane whose cwd will not resolve is NOT adopted.
///
/// Why: #2158 adopted it as an `Active` record with a `/unknown` cwd and an
/// `unmanaged` note in `task`, and that record could never be retired. The
/// `tm ls` auto-prune keeps any record whose tmux name is live, and the
/// orphan-GC keeps any pane a registry names — so the act of adopting the pane
/// is what made the pane unreapable and the record permanent. 55 of the 103
/// records in the reporting store were these. Declining hands the pane back to
/// the orphan-GC, which already knows how to reap an idle one safely.
/// What: one live pane, `get_pane_cwd` returning `None`; asserts no record was
/// written, the name is reported in `adoption_declined`, and it is absent from
/// `external_adopted`.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn reconcile_declines_to_adopt_a_pane_whose_cwd_cannot_be_resolved() {
    let dir = TempDir::new().unwrap();
    // #3965: `#[serial]` + `$HOME` override — see `HomeGuard` above. A declined
    // pane never reaches `validate_and_repair`, but pin `$HOME` anyway so a
    // future refactor cannot silently reopen the real-`$HOME` write.
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec!["tm-unresolvable-01".into()],
        pane_cwd: None,
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();
    let report = mgr.reconcile_on_boot(false).await.expect("reconcile");

    assert_eq!(
        mgr.list().await.len(),
        0,
        "a pane with no resolvable cwd must leave no record behind"
    );
    assert!(
        report
            .adoption_declined
            .contains(&"tm-unresolvable-01".to_string()),
        "the declined pane must be named in the report; report: {report:?}"
    );
    assert!(
        report.external_adopted.is_empty(),
        "nothing was adopted; report: {report:?}"
    );
}

/// #6118 + #6117 together: reconciling the same unresolvable pane over and over
/// never accumulates records.
///
/// Why: this is the shape the reporting store was in — a pane re-encountered on
/// every daemon boot, each pass free to write another row for it. The count
/// after N passes must be the count after one.
/// What: three reconcile passes over one unresolvable pane; asserts the store
/// is still empty and every pass declined it.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn repeated_reconcile_of_one_unresolvable_pane_stays_at_zero_records() {
    let dir = TempDir::new().unwrap();
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec!["tm-ghosty-01".into()],
        pane_cwd: None,
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();
    for pass in 1..=3 {
        let report = mgr.reconcile_on_boot(false).await.expect("reconcile");
        assert_eq!(
            report.adoption_declined,
            vec!["tm-ghosty-01".to_string()],
            "pass {pass} must decline the pane; report: {report:?}"
        );
        assert_eq!(
            mgr.list().await.len(),
            0,
            "pass {pass} must leave the store empty"
        );
    }
}

/// #6118 reclaim path: a declined pane is one the orphan-GC can reap.
///
/// Why: declining adoption is only a fix if something else can then retire the
/// pane. The orphan-GC's criterion is "managed prefix, absent from BOTH
/// registries, idle shell, no live child" — and adoption is what used to put
/// the pane in the managed registry. This asserts the whole chain: after a
/// reconcile pass that declined it, the pane's name is absent from
/// `known_tmux_names` (what the GC's protected set is built from), and
/// `classify_session` returns `ReapCandidate` for an idle `sh` pane.
/// What: reconcile with an unresolvable pane, feed the resulting
/// `known_tmux_names` into `TrackedNames::managed`, classify an idle pane.
/// Test: this function IS the test.
#[cfg(feature = "daemon")]
#[tokio::test]
#[serial_test::serial]
async fn a_declined_pane_is_reapable_by_the_orphan_gc() {
    use crate::daemon::orphan_gc::{
        AlwaysIdleProbe, GcDecision, PaneInfo, TrackedNames, classify_session,
    };

    let dir = TempDir::new().unwrap();
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec!["tm-leaked-01".into()],
        pane_cwd: None,
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();
    mgr.reconcile_on_boot(false).await.expect("reconcile");

    let managed = mgr.known_tmux_names().await.expect("known names");
    assert!(
        !managed.contains("tm-leaked-01"),
        "a declined pane must not be in the orphan-GC's protected set: {managed:?}"
    );

    let decision = classify_session(
        &PaneInfo {
            session_name: "tm-leaked-01".into(),
            pane_current_command: "sh".into(),
            pane_pid: None,
            pane_id: None,
            pane_current_path: None,
        },
        &TrackedNames {
            managed,
            ..Default::default()
        },
        &AlwaysIdleProbe,
        // #6118: this pane is already reapable on idleness alone, so the cwd
        // gate must not be what carries the assertion.
        &crate::daemon::orphan_gc::FsCwdProbe,
    );
    assert_eq!(
        decision,
        GcDecision::ReapCandidate,
        "an idle leaked pane the daemon declined to adopt must be reapable"
    );
}

/// #3396 regression: a LIVE tmux session unknown to the store by NAME must
/// NOT be externally-adopted as a second identity when its resolved pane cwd
/// is the SAME literal workspace an EXISTING, non-`Decommissioned` record
/// already tracks.
///
/// Why: this is the duplicate-record defect's creation path — a tmux session
/// renamed (or replaced) out from under its original managed record, then
/// rediscovered by `reconcile_on_boot`'s external-adopt loop under its new
/// live name, minted a completely separate `SessionRecord` for the exact same
/// worktree because the loop only ever checked `tmux_name` membership, never
/// the resolved workspace path against records the store already tracks —
/// the same class of bug `decide_native_registration` (#3599) fixed for the
/// native-process discovery path. The fix must skip adoption instead of
/// minting a duplicate.
/// What: seeds a `Stopped` record for `workspace` under tmux_name
/// `tm-known-01` (NOT live), then runs reconcile with a live tmux session
/// `tm-crossed-01` (a different name, unknown to the store) whose pane cwd
/// resolves to the SAME `workspace` directory. Asserts: no second record was
/// minted (`mgr.list()` still has exactly one entry), and `tm-crossed-01`
/// never appears in `report.external_adopted`.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn reconcile_skips_external_adopt_when_workspace_already_tracked() {
    let dir = TempDir::new().unwrap();
    let workspace = TempDir::new().unwrap();
    // #3965: `#[serial]` + `$HOME` override — see `HomeGuard` above. This
    // case's crossed-workspace `continue` also short-circuits before
    // `validate_and_repair` runs today, but pin `$HOME` anyway for the same
    // future-proofing reason as the sibling test above.
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec!["tm-crossed-01".into()],
        pane_cwd: Some(workspace.path().to_path_buf()),
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();
    let existing = super::record::SessionRecord {
        id: super::record::ManagedSessionId::new(),
        tmux_name: "tm-known-01".into(),
        cwd: workspace.path().to_path_buf(),
        task: "existing task".into(),
        state: ManagedSessionState::Stopped,
        created_at: chrono::Utc::now(),
        last_activity_at: None,
        workspace_path: Some(workspace.path().to_path_buf()),
        repo_url: None,
        branch: None,
        pending_decision: None,
        proposed_default: None,
        correlation: Default::default(),
        runtime: Default::default(),
        ephemeral: false,
        workspace_owned: false,
        source_id: None,
        claude_session_id: None,
        scrollback_path: None,
        last_cwd: None,
        deliverable_id: None,
        pane_id: None,
        tmux_server: None,
        injection_status: Default::default(),
        worktree_owner: None,
        terminal_at: None,
        stop_cause: None,
        kind: Default::default(),
    };
    let existing_id = existing.id;
    mgr.store.write().await.upsert(existing).await.unwrap();

    let report = mgr.reconcile_on_boot(false).await.expect("reconcile");

    assert!(
        !report
            .external_adopted
            .contains(&"tm-crossed-01".to_string()),
        "a live session resolving to an already-tracked workspace must never be \
         externally adopted; report: {report:?}"
    );

    let listed = mgr.list().await;
    assert_eq!(
        listed.len(),
        1,
        "no second record must be minted for the same workspace; records: {listed:?}"
    );
    assert_eq!(
        listed[0].id, existing_id,
        "the original record must be the only one"
    );
    assert!(
        !listed.iter().any(|r| r.tmux_name == "tm-crossed-01"),
        "no record must carry the crossed tmux_name"
    );
}

// ── #6117: one adopted record per tmux pane, however often adoption runs ────

/// The adopted id derives from the tmux name, so it is the same every time.
///
/// Why: this is the whole mechanism behind #6117. Two adopters that never saw
/// each other's write must still land on one store key.
/// Test: this function IS the test.
#[test]
fn adopted_id_is_stable_for_one_tmux_name() {
    let a = super::record::ManagedSessionId::for_adopted_tmux_name("tm-stable-01");
    let b = super::record::ManagedSessionId::for_adopted_tmux_name("tm-stable-01");
    assert_eq!(a, b, "the same tmux name must derive the same id");
}

/// Two different panes still get two different ids.
///
/// Why: a name-derived id would be worthless if it collapsed distinct panes.
/// Test: this function IS the test.
#[test]
fn adopted_id_differs_per_tmux_name() {
    let a = super::record::ManagedSessionId::for_adopted_tmux_name("tm-one-01");
    let b = super::record::ManagedSessionId::for_adopted_tmux_name("tm-two-01");
    assert_ne!(a, b, "distinct tmux names must derive distinct ids");
}

/// #6117 regression: an adopter that never saw the first adopter's record
/// targets the SAME store key.
///
/// Why: `reconcile_on_boot` builds its known-names set once, before the adopt
/// loop, and a concurrent daemon holds its own copy. Both then see the pane as
/// unknown, and the store is keyed by id — so a random id per adoption meant
/// both writes survived. The reporting store carried 11 such pairs, several
/// written 30-60 ms apart. A single-threaded test cannot stage that
/// interleaving through the public API, so it asserts the property that makes
/// the interleaving harmless: whichever adopter writes, and in whatever order,
/// the record identity for one tmux name is the same one. Pre-fix the second
/// adoption returns a fresh random id here, which is the assertion that fails.
/// What: adopts `tm-raced-01`, removes the record so the next pass is as blind
/// as a concurrent daemon's snapshot, adopts again, and compares ids.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn adopting_the_same_pane_twice_writes_one_record() {
    let dir = TempDir::new().unwrap();
    let workspace = TempDir::new().unwrap();
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec!["tm-raced-01".into()],
        pane_cwd: Some(workspace.path().to_path_buf()),
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();
    mgr.reconcile_on_boot(false).await.expect("first reconcile");
    let first = mgr.list().await;
    assert_eq!(first.len(), 1, "first adoption wrote one record");

    // Blind the second pass exactly as a concurrent adopter's stale snapshot
    // would: it does not know this pane is already tracked.
    mgr.store
        .write()
        .await
        .remove(&first[0].id)
        .await
        .expect("drop the record the second adopter never saw");

    mgr.reconcile_on_boot(false)
        .await
        .expect("second reconcile");

    let after = mgr.list().await;
    assert_eq!(after.len(), 1, "one pane, one record: {after:?}");
    assert_eq!(
        after[0].id, first[0].id,
        "re-adopting one tmux name must land on the same store key, so two \
         concurrent adopters overwrite each other instead of both surviving"
    );
}

/// #6117 review: a reused tmux name derives a reused id, so the record written
/// under it must carry nothing from the pane that held the name before.
///
/// Why: a name-derived id is only safe if the id is not a handle onto state
/// that outlives the record. Adoption can reach a previously-used id only after
/// the earlier record LEFT the store — a terminal tombstone keeps its name in
/// the known-name set and blocks re-adoption outright, so the reachable case is
/// removal (retention, `tm sessions prune`, a manual delete). `decommission`
/// clears no PID-registry entry and no correlation, so this pins what a
/// re-adopted record actually sees.
/// What: adopts `tm-recycled-01`, loads it with per-id residue (correlation,
/// deliverable, claude session, scrollback, activity), registers a PID under
/// its derived id, removes the record, then re-adopts the SAME name backed by a
/// different pane and workspace. Asserts the id is reused, every residual field
/// is clear, the record tracks the NEW pane, and that adoption neither reads nor
/// writes the PID registry — `SessionRecord` carries no PID field, so a stale
/// entry cannot reach it.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn a_reused_adopted_id_carries_no_residual_state() {
    let dir = TempDir::new().unwrap();
    let first_ws = TempDir::new().unwrap();
    let second_ws = TempDir::new().unwrap();
    let _home = set_home(dir.path());

    let first_pane = std::sync::Arc::new(FlakyPaneCwdTmux {
        alive: vec!["tm-recycled-01".into()],
        pane_cwd: Some(first_ws.path().to_path_buf()),
        flaky_for: 0,
        calls: std::sync::atomic::AtomicUsize::new(0),
        pane_id: Some("%11".into()),
    });
    let mgr = SessionManager::new(dir.path(), first_pane).await.unwrap();
    mgr.reconcile_on_boot(false).await.expect("first reconcile");

    let listed = mgr.list().await;
    assert_eq!(listed.len(), 1);
    let reused_id = listed[0].id;
    assert_eq!(
        reused_id,
        super::record::ManagedSessionId::for_adopted_tmux_name("tm-recycled-01")
    );

    // Load the record with every per-id field a later adoption could inherit.
    {
        let mut store = mgr.store.write().await;
        let mut rec = store.get(&reused_id).await.expect("get adopted");
        rec.deliverable_id = Some(crate::deliverable::record::DeliverableId::new());
        rec.claude_session_id = Some("claude-abc".into());
        rec.scrollback_path = Some(dir.path().join("scrollback.log"));
        rec.last_activity_at = Some(chrono::Utc::now());
        rec.correlation.branch = Some("feature/old".into());
        store.upsert(rec).await.expect("seed residue");
    }

    // A PID recorded under the derived id, the residue `decommission` never
    // clears. It must stay inert, not become the new record's.
    let pids = crate::core::pid_registry::PidRegistry::new(dir.path().join("pids"));
    pids.register(&reused_id.to_string(), 4242)
        .expect("register pid");

    // Removal is the only path that frees the name for re-adoption.
    mgr.store
        .write()
        .await
        .remove(&reused_id)
        .await
        .expect("remove record");

    // A DIFFERENT physical pane now answers to the same tmux name.
    let second_pane = std::sync::Arc::new(FlakyPaneCwdTmux {
        alive: vec!["tm-recycled-01".into()],
        pane_cwd: Some(second_ws.path().to_path_buf()),
        flaky_for: 0,
        calls: std::sync::atomic::AtomicUsize::new(0),
        pane_id: Some("%22".into()),
    });
    let mgr2 = SessionManager::new(dir.path(), second_pane).await.unwrap();
    mgr2.reconcile_on_boot(false)
        .await
        .expect("second reconcile");

    let after = mgr2.list().await;
    assert_eq!(after.len(), 1, "one record for one pane: {after:?}");
    let fresh = &after[0];
    assert_eq!(fresh.id, reused_id, "the derived id is reused by design");
    assert_eq!(
        fresh.pane_id.as_deref(),
        Some("%22"),
        "the record must track the NEW pane, not the one that held the name"
    );
    assert_eq!(fresh.workspace_path.as_deref(), Some(second_ws.path()));
    assert_eq!(
        fresh.deliverable_id, None,
        "deliverable link must not carry over"
    );
    assert_eq!(
        fresh.claude_session_id, None,
        "claude session must not carry over"
    );
    assert_eq!(
        fresh.scrollback_path, None,
        "scrollback must not carry over"
    );
    assert_eq!(fresh.last_activity_at, None, "activity must not carry over");
    assert_eq!(
        fresh.correlation,
        Default::default(),
        "correlation must not carry over: {:?}",
        fresh.correlation
    );

    // The stale PID entry is untouched by adoption — neither consumed nor
    // cleared. `SessionRecord` has no PID field, so it cannot reach the record;
    // reaping it belongs to the PID sweep, not here.
    let entries = pids.entries().expect("read pid registry");
    assert_eq!(entries.len(), 1, "adoption must not write PID entries");
    assert_eq!(entries[0].session_id, reused_id.to_string());
    assert_eq!(entries[0].pid, 4242);
}

/// Requirement 3 of the fix: nothing changes for a resolvable pane.
///
/// Why: the #6118 decline and the #6117 id change both sit in the adopt loop,
/// so the ordinary path needs a guard that says it still behaves as before —
/// one record, `Active`, real cwd and workspace, and stable across passes.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn repeated_reconcile_of_one_resolvable_pane_keeps_one_record() {
    let dir = TempDir::new().unwrap();
    let workspace = TempDir::new().unwrap();
    let _home = set_home(dir.path());
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec!["tm-steady-01".into()],
        pane_cwd: Some(workspace.path().to_path_buf()),
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();
    for _ in 0..3 {
        mgr.reconcile_on_boot(false).await.expect("reconcile");
    }

    let listed = mgr.list().await;
    assert_eq!(listed.len(), 1, "three passes, one record: {listed:?}");
    assert_eq!(listed[0].tmux_name, "tm-steady-01");
    assert_eq!(listed[0].state, ManagedSessionState::Active);
    assert_eq!(listed[0].cwd, workspace.path());
    assert_eq!(listed[0].workspace_path.as_deref(), Some(workspace.path()));
    assert_eq!(listed[0].task, "adopted session");
}

// ── #3692: create-path final safety net + suffixed-length cap ───────────────

/// A pre-reserved name gone STALE (another session claimed it between
/// reservation and create) is auto-suffixed by `create_with_resolved_name`'s
/// final pre-tmux-create dedupe — never creating a second session under the
/// taken name (#3692 review HIGH-2).
///
/// Why: `create_with_reserved_name` trusts a name reserved BEFORE clone/
/// worktree provisioning ran; that window is the create path's documented
/// TOCTOU. Pre-fix, this scenario produced two live sessions sharing one
/// name — the literal #3692 defect, via the create path.
/// What: registers a live tmux session + Active record under `tm-stale-01`,
/// then calls `create_with_reserved_name` with that same (now stale) reserved
/// name and asserts the created session/record landed on `tm-stale-02`.
/// Test: this function IS the test.
#[tokio::test]
async fn create_with_reserved_name_suffixes_stale_reservation() {
    let dir = TempDir::new().unwrap();
    let fake = FakeTmuxDriver::new();
    let mgr = SessionManager::new(dir.path(), fake.clone()).await.unwrap();

    // The reservation went stale: someone else now LIVES at tm-stale-01.
    let first = mgr
        .create(
            "squatter".into(),
            Some(PathBuf::from("/tmp/wt1")),
            Some("stale".into()),
            None,
            None,
            None,
        )
        .await
        .expect("first create");
    assert_eq!(first.tmux_name, "tm-stale-01");

    let second = mgr
        .create_with_reserved_name(
            super::record::ManagedSessionId::new(),
            "tm-stale-01".into(),
            "stale reservation".into(),
            Some(PathBuf::from("/tmp/wt2")),
            None,
            None,
            None,
            Default::default(),
            false,
            false,
        )
        .await
        .expect("a stale reservation must auto-suffix, never collide");

    assert_eq!(
        second.tmux_name, "tm-stale-02",
        "the stale reserved name must be suffixed to the next free ordinal"
    );
    assert!(
        fake.session_exists("tm-stale-02"),
        "the tmux session must be created under the SUFFIXED name"
    );
    // The squatter is untouched.
    assert_eq!(
        mgr.get(&first.id).await.expect("get first").tmux_name,
        "tm-stale-01"
    );
}

/// `dedupe_name_against` never returns a name over the 64-char cap
/// `validate_session_name` enforces on the bare candidate (#3692 review LOW):
/// a suffix appended to a near-cap name must truncate-and-retry, not silently
/// overflow.
///
/// Test: this function IS the test.
#[tokio::test]
async fn dedupe_name_against_caps_suffixed_length_at_64() {
    let long = "x".repeat(64); // exactly at the validate_session_name cap
    let taken: std::collections::HashSet<String> = [long.clone()].into();

    let result = SessionManager::dedupe_name_against(&long, &taken);

    assert!(
        result.chars().count() <= 64,
        "suffixed result must stay within the 64-char cap, got {} chars: {result}",
        result.chars().count()
    );
    assert_ne!(result, long, "the taken candidate must still be suffixed");
}

/// #9238: every suffix tm mints is two digits. A taken unnumbered name gets
/// `-02`, then `-03`, the serial allocator's `-NN` form, never `-2`; a taken
/// numbered name still increments at its own width.
///
/// Test: this function IS the test.
#[test]
fn dedupe_suffixes_an_unnumbered_name_with_two_digits() {
    let taken = |names: &[&str]| -> std::collections::HashSet<String> {
        names.iter().map(|n| n.to_string()).collect()
    };
    let dedupe = SessionManager::dedupe_name_against;
    assert_eq!(dedupe("tm-localizer", &taken(&[])), "tm-localizer");
    assert_eq!(
        dedupe("tm-localizer", &taken(&["tm-localizer"])),
        "tm-localizer-02"
    );
    assert_eq!(
        dedupe("tm-localizer", &taken(&["tm-localizer", "tm-localizer-02"])),
        "tm-localizer-03"
    );
    assert_eq!(dedupe("tm-i8n-01", &taken(&["tm-i8n-01"])), "tm-i8n-02");
    // A legacy single-digit name keeps its own width (#9238: still readable).
    assert_eq!(dedupe("tm-old-2", &taken(&["tm-old-2"])), "tm-old-3");
}

/// #6116: a live session in the test-owned namespace is never adopted, even
/// though its pane resolves a working directory.
///
/// Why: a test that spawns a real tmux session leaks it when its process dies
/// hard — SIGKILL, a `cargo test` timeout, an aborted run — none of which run
/// `Drop`. Three such sessions leaked on 2026-08-24, this loop adopted each
/// one, and the operator's picker grew three `(active)` ghosts. The refusal
/// reads the NAME, so it holds whether or not any test-side cleanup ran.
/// What: one live `tm-xtest-…` pane with a resolvable cwd — the shape #6118
/// would otherwise adopt — asserting no record is written, the name lands in
/// `reserved_test_refused`, and neither `external_adopted` nor
/// `adoption_declined` claims it. Before this fix the pane was adopted.
/// Test: this function IS the test.
#[tokio::test]
#[serial_test::serial]
async fn reconcile_refuses_to_adopt_a_reserved_test_session() {
    let dir = TempDir::new().unwrap();
    let workspace = TempDir::new().unwrap();
    // #3965: `#[serial]` + `$HOME` override — see `HomeGuard` above. A refused
    // pane never reaches `validate_and_repair`; pin `$HOME` anyway so a future
    // refactor cannot silently reopen the real-`$HOME` write.
    let _home = set_home(dir.path());
    let leaked = format!(
        "{}deadrt4242-01",
        trusty_common::session_naming::RESERVED_TEST_PREFIX
    );
    let fake = std::sync::Arc::new(PaneCwdTmux {
        alive: vec![leaked.clone()],
        pane_cwd: Some(workspace.path().to_path_buf()),
    });

    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();
    let report = mgr.reconcile_on_boot(false).await.expect("reconcile");

    assert_eq!(
        mgr.list().await.len(),
        0,
        "a leaked test session must leave no record for the picker to show"
    );
    assert!(
        report.reserved_test_refused.contains(&leaked),
        "the refused session must be named in the report; report: {report:?}"
    );
    assert!(
        report.external_adopted.is_empty() && report.adoption_declined.is_empty(),
        "refusal is by name, not a cwd-resolution decline; report: {report:?}"
    );
}

/// #6116: an adopted reserved-namespace record whose tmux session is gone is
/// tombstoned, while an ordinary record and a CREATED session in the same
/// namespace both still become `Stopped`.
///
/// Why: such a record was adopted by a daemon build predating the refusal
/// above — the store outlives that upgrade — and `Stopped` would leave a
/// picker row nothing can ever resume, which is what forced the owner into
/// `session_delete force`. The two paired records are the over-reach guards:
/// resumability is taken away from ADOPTED test sessions only, not from every
/// record whose name happens to be in the namespace.
/// What: three Active records, no live tmux; asserts `Deleted` plus a stamped
/// `terminal_at` for the adopted one, `Stopped` for the other two, and that
/// each id lands in exactly one report list. Before this fix all three were
/// `Stopped`.
/// Test: this function IS the test.
#[tokio::test]
async fn reconcile_tombstones_an_adopted_reserved_record_whose_tmux_is_gone() {
    let dir = crate::test_support::hermetic_temp_dir();
    let fake = FakeTmuxDriver::new();
    let mgr = SessionManager::new(dir.path(), fake).await.unwrap();

    let leaked_name = reserved_name("deadrt4242-01");
    let leaked = super::tests::make_active_test_record(
        &leaked_name,
        super::record::ADOPTED_TASK,
        "/tmp/leak-ws",
    );
    let ordinary = super::tests::make_active_test_record("tm-trusty-tools-01", "real", "/tmp/ws");
    // A project legitimately named `xtest-…`: same namespace, created not
    // adopted, so nothing here may touch it.
    let created =
        super::tests::make_active_test_record(&reserved_name("foo-01"), "real work", "/tmp/ws2");
    {
        let mut store = mgr.store.write().await;
        store.upsert(leaked.clone()).await.unwrap();
        store.upsert(ordinary.clone()).await.unwrap();
        store.upsert(created.clone()).await.unwrap();
    }

    // #7087: the sweep drops the record out of the set `mpm.residency.active`
    // serves, so seed a cache entry the sweep must evict and capture the
    // generation the sweep must move. The gone arm the other two records take
    // does not bump, so only the sweep can satisfy the assertion below.
    let leak_root = std::path::PathBuf::from("/tmp/leak-ws");
    mgr.residency_cache_store(leaked.id, leak_root.clone(), None, Vec::new())
        .await;
    let generation_before = mgr.residency_generation();

    let report = mgr.reconcile_on_boot(false).await.expect("reconcile");

    assert!(
        mgr.residency_generation() > generation_before,
        "the sweep leaves the active-project set, so it must bump the \
         residency generation: before={generation_before} after={}",
        mgr.residency_generation()
    );
    assert_eq!(
        mgr.residency_cache_lookup(&leaked.id, &leak_root).await,
        None,
        "a swept record is terminal — its derivation cache entry must go with it"
    );

    let after = mgr.get(&leaked.id).await.unwrap();
    assert_eq!(
        after.state,
        ManagedSessionState::Deleted,
        "a leaked test record with no tmux session must be tombstoned, not left resumable"
    );
    assert!(
        after.terminal_at.is_some(),
        "the retention clock must start when the record goes terminal"
    );
    assert!(
        report.reserved_test_swept.contains(&leaked.id.to_string())
            && !report.stopped.contains(&leaked.id.to_string()),
        "the swept record belongs in exactly one list; report: {report:?}"
    );

    for (record, why) in [
        (&ordinary, "an ordinary gone session stays Stopped"),
        (&created, "a CREATED session in the namespace stays Stopped"),
    ] {
        assert_eq!(
            mgr.get(&record.id).await.unwrap().state,
            ManagedSessionState::Stopped,
            "{why}"
        );
        assert!(report.stopped.contains(&record.id.to_string()));
        assert!(!report.reserved_test_swept.contains(&record.id.to_string()));
    }
}

/// #6116 (code-critic HIGH): a leaked test adoption whose pane is LIVE exits
/// the loop instead of feeding it.
///
/// Why: the guard used to sit only on the gone arm, so a live pane was
/// re-adopted `Active` — which restored its orphan-GC immunity, let the reaper
/// stamp it `Unexpected` once the pane died, let the supervisor RECREATE the
/// tmux session, and handed the next boot the same pane to re-adopt. The
/// daemon log shows that cycle three times in one day.
/// What: one live pane with an adopted reserved record, reconciled with
/// `auto_resume` ON — the loop's fuel. Asserts the record ends terminal and
/// un-auto-resumable, is absent from `adopted`, and that no session was
/// created or killed: the pane is left to the orphan-GC, which is the only
/// thing allowed to end it. Before this fix the record ended `Active` and the
/// name appeared in `report.adopted`.
/// Test: this function IS the test.
#[tokio::test]
async fn a_live_leaked_test_pane_is_never_readopted_or_recreated() {
    let dir = crate::test_support::hermetic_temp_dir();
    let fake = FakeTmuxDriver::new();
    let leaked_name = reserved_name("deadrt4242-01");
    fake.seeded_names.lock().unwrap().push(leaked_name.clone());
    let mgr = SessionManager::new(dir.path(), fake.clone()).await.unwrap();

    let leaked = super::tests::make_active_test_record(
        &leaked_name,
        super::record::ADOPTED_TASK,
        "/tmp/leak-ws",
    );
    {
        let mut store = mgr.store.write().await;
        store.upsert(leaked.clone()).await.unwrap();
    }
    let creates_before = fake.create_cwd_calls.lock().unwrap().len();

    let report = mgr.reconcile_on_boot(true).await.expect("reconcile");

    let after = mgr.get(&leaked.id).await.unwrap();
    assert_eq!(
        after.state,
        ManagedSessionState::Deleted,
        "a live leaked pane must not keep its record Active — that is what sustained the loop"
    );
    assert!(
        !after.is_auto_resumable(),
        "no automatic path may relaunch a leaked test session"
    );
    assert!(
        !report.adopted.contains(&leaked_name),
        "the live pane must not be re-adopted; report: {report:?}"
    );
    assert_eq!(
        fake.create_cwd_calls.lock().unwrap().len(),
        creates_before,
        "nothing may recreate the pane"
    );
    assert!(
        fake.kill_calls.lock().unwrap().is_empty(),
        "reconcile drops the RECORD; killing the pane is the orphan-GC's decision, \
         and it spares a pane that is not an idle shell"
    );
}

/// A name in the reserved test namespace, built from the constant the daemon
/// reads back (#6116).
fn reserved_name(tag: &str) -> String {
    format!(
        "{}{tag}",
        trusty_common::session_naming::RESERVED_TEST_PREFIX
    )
}