vta-service 0.14.36

//! Generic update + key rotation for webvh DIDs.
//!
//! Two operations sit on top of [`didwebvh_rs::update::update_did`]:
//!
//! - [`update_did_webvh`] — apply new state (optional new document,
//!   plus witness / watcher / TTL / pre-rotation toggle). When a new
//!   document is supplied the VTA forces a parallel rotation of the
//!   webvh authorization keys + pre-rotation commitments.
//! - [`rotate_did_webvh_keys`] — convenience that fetches the current
//!   document, mints fresh BIP-32 keys for every verificationMethod
//!   (preserving role/type, bumping fragment IDs to fresh unique
//!   values), and feeds the rebuilt document through `update_did_webvh`.
//!
//! See `docs/02-vta/did-webvh-update.md` for the operator-
//! facing flow + wire format.
//!
//! Internal layout:
//! - `options` — request/result types, `DerivedWebvhKey`, the
//!   witness-resolve timeout constant.
//! - `errors` — `UpdateDidWebvhError` + `From<…> for AppError`.
//! - `validate` — pure validators for caller-supplied document,
//!   watchers, witnesses.
//! - `keys` — BIP-32 derivation, install, hashing, active-update-key
//!   and pre-rotation signing-key lookup, secret re-derivation.
//! - `legacy` — `key:*` keyspace fallbacks for pre-`webvh_keys`
//!   convention DIDs.
//! - `state` — `did.jsonl` ↔ `DIDWebVHState` round-trip + SCID lookup.
//! - `orchestrator` — `update_did_webvh` (the end-to-end flow,
//!   including P6's optimistic-concurrency precondition + pre-rotation
//!   aware signing-key selection).
//! - `rotate` — `rotate_did_webvh_keys` (composes `update_did_webvh`
//!   under a `RecordSnapshot` CAS guard).

mod errors;
mod keys;
mod legacy;
mod options;
mod orchestrator;
mod plan;
mod rotate;
mod state;
mod validate;

pub use errors::UpdateDidWebvhError;
pub use options::{RotateDidWebvhKeysOptions, UpdateDidWebvhOptions, UpdateDidWebvhResult};
pub use orchestrator::{
    AgentNameVerb, agent_name_op, check_agent_name, list_agent_names, plan_did_webvh_update,
    update_did_webvh,
};
pub use plan::UpdatePlan;
pub use rotate::rotate_did_webvh_keys;
pub use state::resolve_webvh_did;

/// Cross-module accessor for `state_from_jsonl`. `passkey_vms` uses
/// it to read the current DID document before appending a passkey
/// VM; the chain-validation invariant stays inside this module.
pub fn state_from_jsonl_pub(
    did_log: &str,
) -> Result<didwebvh_rs::DIDWebVHState, UpdateDidWebvhError> {
    state::state_from_jsonl(did_log)
}

#[cfg(test)]
mod tests {
    use super::keys::{derive_webvh_keys, install_derived_webvh_keys, load_active_update_key};
    use super::options::DerivedWebvhKey;
    use super::validate::{validate_document_for_update, validate_watchers, validate_witnesses};
    use super::*;
    use crate::error::AppError;
    use crate::keys::seed_store::SeedStore;
    use crate::operations::did_webvh::webvh_keys::{self, WebvhKeyHandle, WebvhKeyRole};
    use crate::store::KeyspaceHandle;
    use affinidi_tdk::secrets_resolver::secrets::Secret;
    use axum::http::StatusCode;
    use axum::response::IntoResponse;
    use chrono::Utc;

    /// `into_response` reads back as the right HTTP status — we exercise
    /// the wire mapping rather than just the enum branch to catch any
    /// future drift in `AppError::IntoResponse`.
    fn status_of(err: UpdateDidWebvhError) -> StatusCode {
        let app: AppError = err.into();
        app.into_response().status()
    }

    #[test]
    fn not_found_maps_to_404() {
        assert_eq!(
            status_of(UpdateDidWebvhError::NotFound("x".into())),
            StatusCode::NOT_FOUND
        );
    }

    #[test]
    fn forbidden_also_maps_to_404_to_avoid_cross_context_leak() {
        assert_eq!(
            status_of(UpdateDidWebvhError::Forbidden("x".into())),
            StatusCode::NOT_FOUND
        );
    }

    #[test]
    fn conflict_maps_to_409() {
        assert_eq!(
            status_of(UpdateDidWebvhError::Conflict("x".into())),
            StatusCode::CONFLICT
        );
    }

    #[test]
    fn invalid_document_maps_to_400() {
        assert_eq!(
            status_of(UpdateDidWebvhError::InvalidDocument("x".into())),
            StatusCode::BAD_REQUEST
        );
    }

    #[test]
    fn invalid_witness_maps_to_400() {
        assert_eq!(
            status_of(UpdateDidWebvhError::InvalidWitness("x".into())),
            StatusCode::BAD_REQUEST
        );
    }

    #[test]
    fn invalid_watcher_maps_to_400() {
        assert_eq!(
            status_of(UpdateDidWebvhError::InvalidWatcher("x".into())),
            StatusCode::BAD_REQUEST
        );
    }

    #[test]
    fn library_maps_to_500() {
        assert_eq!(
            status_of(UpdateDidWebvhError::Library("x".into())),
            StatusCode::INTERNAL_SERVER_ERROR
        );
    }

    #[test]
    fn publish_maps_to_500() {
        assert_eq!(
            status_of(UpdateDidWebvhError::Publish("x".into())),
            StatusCode::INTERNAL_SERVER_ERROR
        );
    }

    #[test]
    fn persistence_maps_to_500() {
        assert_eq!(
            status_of(UpdateDidWebvhError::Persistence("x".into())),
            StatusCode::INTERNAL_SERVER_ERROR
        );
    }

    fn valid_doc(did: &str) -> serde_json::Value {
        serde_json::json!({
            "@context": ["https://www.w3.org/ns/did/v1"],
            "id": did,
            "verificationMethod": [{
                "id": format!("{did}#key-0"),
                "type": "Multikey",
                "controller": did,
                "publicKeyMultibase": "z6MkSomePub"
            }]
        })
    }

    #[test]
    fn validate_document_accepts_well_formed() {
        let did = "did:webvh:abc:vta.example.com:primary";
        validate_document_for_update(valid_doc(did), did).expect("valid doc");
    }

    #[test]
    fn validate_document_rejects_id_mismatch() {
        let existing = "did:webvh:abc:vta.example.com:primary";
        let foreign = "did:webvh:other:vta.example.com:primary";
        let err = validate_document_for_update(valid_doc(foreign), existing).unwrap_err();
        assert!(
            matches!(err, UpdateDidWebvhError::InvalidDocument(ref msg) if msg.contains("does not match"))
        );
    }

    #[test]
    fn validate_document_rejects_missing_context() {
        let did = "did:webvh:abc";
        let mut doc = valid_doc(did);
        doc.as_object_mut().unwrap().remove("@context");
        let err = validate_document_for_update(doc, did).unwrap_err();
        assert!(matches!(err, UpdateDidWebvhError::InvalidDocument(_)));
    }

    #[test]
    fn validate_document_rejects_missing_vm_field() {
        let did = "did:webvh:abc";
        let mut doc = valid_doc(did);
        doc["verificationMethod"][0]
            .as_object_mut()
            .unwrap()
            .remove("publicKeyMultibase");
        let err = validate_document_for_update(doc, did).unwrap_err();
        assert!(
            matches!(err, UpdateDidWebvhError::InvalidDocument(ref msg) if msg.contains("publicKeyMultibase"))
        );
    }

    #[test]
    fn validate_document_rejects_non_object() {
        let err = validate_document_for_update(serde_json::json!([1, 2, 3]), "did:x").unwrap_err();
        assert!(matches!(err, UpdateDidWebvhError::InvalidDocument(_)));
    }

    use affinidi_did_resolver_cache_sdk::{DIDCacheClient, config::DIDCacheConfigBuilder};
    use didwebvh_rs::multibase_type::Multibase;
    use didwebvh_rs::witness::{Witness, Witnesses};

    async fn resolver() -> DIDCacheClient {
        DIDCacheClient::new(DIDCacheConfigBuilder::default().build())
            .await
            .expect("did resolver init")
    }

    /// Build a real `did:key` from a deterministic Ed25519 keypair so
    /// the resolver actually decodes the embedded pubkey. did:key is
    /// self-resolving — no network — but the bytes have to be valid.
    fn test_did_key() -> String {
        use ed25519_dalek::SigningKey;
        let sk = SigningKey::from_bytes(&[7u8; 32]);
        let pub_bytes = sk.verifying_key().to_bytes();
        affinidi_crypto::did_key::ed25519_pub_to_did_key(&pub_bytes)
    }

    #[test]
    fn validate_watchers_accepts_empty() {
        validate_watchers(&[]).expect("disable instruction is fine");
    }

    #[test]
    fn validate_watchers_accepts_https() {
        validate_watchers(&["https://watcher.example.com/log".into()]).unwrap();
    }

    #[test]
    fn validate_watchers_rejects_ftp() {
        let err = validate_watchers(&["ftp://watcher.example.com".into()]).unwrap_err();
        assert!(matches!(err, UpdateDidWebvhError::InvalidWatcher(_)));
    }

    #[test]
    fn validate_watchers_rejects_fragment() {
        let err = validate_watchers(&["https://watcher.example.com/x#anchor".into()]).unwrap_err();
        assert!(
            matches!(err, UpdateDidWebvhError::InvalidWatcher(ref m) if m.contains("fragment"))
        );
    }

    #[test]
    fn validate_watchers_rejects_query() {
        let err = validate_watchers(&["https://watcher.example.com/x?key=v".into()]).unwrap_err();
        assert!(matches!(err, UpdateDidWebvhError::InvalidWatcher(ref m) if m.contains("query")));
    }

    #[test]
    fn validate_watchers_rejects_malformed() {
        let err = validate_watchers(&["not a url".into()]).unwrap_err();
        assert!(matches!(err, UpdateDidWebvhError::InvalidWatcher(_)));
    }

    use std::pin::Pin;
    use tokio::sync::Mutex;
    use vta_sdk::keys::{KeyOrigin, KeyRecord, KeyStatus, KeyType};
    use vti_common::config::StoreConfig;
    use vti_common::store::Store;

    /// In-memory SeedStore for tests. Mirrors the pattern used in
    /// `operations::keys::tests::MockSeedStore`.
    struct MockSeedStore(Mutex<Option<Vec<u8>>>);

    impl SeedStore for MockSeedStore {
        fn get(
            &self,
        ) -> Pin<
            Box<
                dyn std::future::Future<Output = Result<Option<Vec<u8>>, crate::error::AppError>>
                    + Send
                    + '_,
            >,
        > {
            Box::pin(async { Ok(self.0.lock().await.clone()) })
        }
        fn set(
            &self,
            seed: &[u8],
        ) -> Pin<
            Box<dyn std::future::Future<Output = Result<(), crate::error::AppError>> + Send + '_>,
        > {
            let seed = seed.to_vec();
            Box::pin(async move {
                *self.0.lock().await = Some(seed);
                Ok(())
            })
        }
    }

    async fn test_keys_ks() -> KeyspaceHandle {
        let dir = tempfile::tempdir().expect("tempdir");
        let cfg = StoreConfig {
            data_dir: dir.path().to_path_buf(),
        };
        std::mem::forget(dir);
        let store = Store::open(&cfg).expect("open store");
        store.keyspace(crate::keyspaces::KEYS).expect("keyspace")
    }

    fn test_pub_multibase() -> String {
        // Same trick as in validate_witnesses tests: a deterministic
        // Ed25519 keypair gives us a known-good multibase pubkey we
        // can hash and round-trip.
        use ed25519_dalek::SigningKey;
        let sk = SigningKey::from_bytes(&[7u8; 32]);
        let pub_bytes = sk.verifying_key().to_bytes();
        let did_key = affinidi_crypto::did_key::ed25519_pub_to_did_key(&pub_bytes);
        // did:key:z6Mk... → strip prefix to get the multibase pubkey.
        did_key.trim_start_matches("did:key:").to_string()
    }

    #[tokio::test]
    async fn load_active_update_key_finds_via_webvh_keys_fast_path() {
        let ks = test_keys_ks().await;
        let scid = "Q123";
        let pub_mb = test_pub_multibase();
        let hash = Secret::base58_hash_string(&pub_mb).unwrap();

        webvh_keys::install(
            &ks,
            &WebvhKeyHandle {
                scid: scid.into(),
                version_id: "1-zV".into(),
                hash: hash.clone(),
                public_key: pub_mb.clone(),
                derivation_path: "m/26'/0'/0'/0".into(),
                seed_id: Some(1),
                role: WebvhKeyRole::UpdateKey,
                label: "test".into(),
                created_at: Utc::now(),
            },
        )
        .await
        .unwrap();

        let seed_store = MockSeedStore(Mutex::new(None));
        let handle = load_active_update_key(
            &ks,
            &seed_store,
            "m/26'/0'/0'",
            scid,
            &[Multibase::from(pub_mb.clone())],
        )
        .await
        .expect("found via webvh_keys");
        assert_eq!(handle.hash, hash);
        assert_eq!(handle.version_id, "1-zV");
    }

    #[tokio::test]
    async fn load_active_update_key_falls_back_to_legacy_keyspace() {
        let ks = test_keys_ks().await;
        let scid = "Q123";
        let pub_mb = test_pub_multibase();

        // Legacy KeyRecord exists in `key:*` but nothing in webvh_keys.
        let key_id = format!("did:webvh:{scid}#key-0");
        let record = KeyRecord {
            key_id: key_id.clone(),
            derivation_path: "m/26'/0'/0'/0".into(),
            key_type: KeyType::Ed25519,
            status: KeyStatus::Active,
            public_key: pub_mb.clone(),
            label: Some("legacy signing key".into()),
            context_id: Some("primary".into()),
            seed_id: Some(1),
            origin: KeyOrigin::Derived,
            created_at: Utc::now(),
            updated_at: Utc::now(),
        };
        ks.insert(format!("key:{key_id}"), &record).await.unwrap();

        let seed_store = MockSeedStore(Mutex::new(None));
        let handle = load_active_update_key(
            &ks,
            &seed_store,
            "m/26'/0'/0'",
            scid,
            &[Multibase::from(pub_mb.clone())],
        )
        .await
        .expect("found via legacy fallback");
        assert_eq!(handle.public_key, pub_mb);
        assert_eq!(handle.derivation_path, "m/26'/0'/0'/0");
        assert_eq!(handle.version_id, "legacy");
    }

    #[tokio::test]
    async fn load_active_update_key_errors_when_no_match() {
        let ks = test_keys_ks().await;
        let pub_mb = test_pub_multibase();
        // A real seed is present, so the recovery fallback runs and re-derives
        // keys — but none match this foreign pubkey, so it returns None and we
        // fall through to the terminal "no active update key" error.
        let seed_store = MockSeedStore(Mutex::new(Some(vec![0x42u8; 32])));
        let err = load_active_update_key(
            &ks,
            &seed_store,
            "m/26'/0'/0'",
            "Q123",
            &[Multibase::from(pub_mb)],
        )
        .await
        .unwrap_err();
        assert!(
            matches!(err, UpdateDidWebvhError::Library(ref m) if m.contains("no active update key"))
        );
    }

    #[tokio::test]
    async fn load_active_update_key_errors_on_empty_update_keys_list() {
        let ks = test_keys_ks().await;
        let seed_store = MockSeedStore(Mutex::new(None));
        let err = load_active_update_key(&ks, &seed_store, "m/26'/0'/0'", "Q", &[])
            .await
            .unwrap_err();
        assert!(matches!(err, UpdateDidWebvhError::Library(ref m) if m.contains("no update_keys")));
    }

    #[tokio::test]
    async fn derive_webvh_keys_returns_empty_for_zero_count() {
        let ks = test_keys_ks().await;
        let seed_store = MockSeedStore(Mutex::new(Some(vec![0x42u8; 32])));
        let result = derive_webvh_keys(&ks, &seed_store, "m/26'/0'/0'", 0)
            .await
            .expect("zero count is fine");
        assert!(result.is_empty());
    }

    #[tokio::test]
    async fn derive_then_install_round_trips_with_real_version_id() {
        let ks = test_keys_ks().await;
        let seed_store = MockSeedStore(Mutex::new(Some(vec![0x42u8; 32])));
        crate::keys::seeds::save_seed_record(
            &ks,
            &crate::keys::seeds::SeedRecord {
                id: 0,
                seed_hex: None,
                seed_enc: None,
                created_at: Utc::now(),
                retired_at: None,
            },
        )
        .await
        .unwrap();
        crate::keys::seeds::set_active_seed_id(&ks, 0)
            .await
            .unwrap();

        // Phase 1: derive (no keyspace writes for handles).
        let derived: Vec<DerivedWebvhKey> = derive_webvh_keys(&ks, &seed_store, "m/26'/0'/0'", 3)
            .await
            .expect("derive 3 keys");
        assert_eq!(derived.len(), 3);

        // Hashes are unique within the batch.
        let mut hashes: Vec<_> = derived.iter().map(|d| d.hash.clone()).collect();
        hashes.sort();
        hashes.dedup();
        assert_eq!(hashes.len(), 3, "derived keys must have distinct hashes");

        // Phase 2: install with the real version-id (only known after
        // update_did returns).
        install_derived_webvh_keys(
            &ks,
            "Q123",
            "2-zVer",
            WebvhKeyRole::PreRotation,
            &derived,
            "pre-rotation",
        )
        .await
        .expect("install");

        // Each derived key is now reachable by hash.
        for d in &derived {
            let found =
                webvh_keys::load_handle(&ks, "Q123", "2-zVer", WebvhKeyRole::PreRotation, &d.hash)
                    .await
                    .unwrap()
                    .expect("handle present");
            assert_eq!(found.public_key, d.public_key);
        }
    }

    #[tokio::test]
    async fn validate_witnesses_accepts_empty_disable_instruction() {
        let r = resolver().await;
        validate_witnesses(&Witnesses::Empty {}, &r)
            .await
            .expect("Empty {} is the disable instruction");
    }

    #[tokio::test]
    async fn validate_witnesses_accepts_resolvable_did_key() {
        let r = resolver().await;
        let did = test_did_key();
        let mb = Multibase::from(did.trim_start_matches("did:key:").to_string());
        let cfg = Witnesses::Value {
            threshold: 1,
            witnesses: vec![Witness { id: mb }],
        };
        validate_witnesses(&cfg, &r)
            .await
            .expect("did:key resolves");
    }

    #[tokio::test]
    async fn validate_witnesses_rejects_threshold_without_witnesses() {
        let r = resolver().await;
        let cfg = Witnesses::Value {
            threshold: 1,
            witnesses: vec![],
        };
        let err = validate_witnesses(&cfg, &r).await.unwrap_err();
        assert!(
            matches!(err, UpdateDidWebvhError::InvalidWitness(ref msg) if msg.contains("no witnesses"))
        );
    }

    #[tokio::test]
    async fn validate_witnesses_rejects_threshold_above_count() {
        let r = resolver().await;
        let did = test_did_key();
        let mb = Multibase::from(did.trim_start_matches("did:key:").to_string());
        let cfg = Witnesses::Value {
            threshold: 5,
            witnesses: vec![Witness { id: mb }],
        };
        let err = validate_witnesses(&cfg, &r).await.unwrap_err();
        assert!(
            matches!(err, UpdateDidWebvhError::InvalidWitness(ref msg) if msg.contains("threshold"))
        );
    }

    #[test]
    fn validate_document_allows_externally_minted_public_key() {
        // Per spec Q4: caller can put a public key in the doc that the
        // VTA didn't mint. Validator only checks shape.
        let did = "did:webvh:abc";
        let doc = serde_json::json!({
            "@context": ["https://www.w3.org/ns/did/v1"],
            "id": did,
            "verificationMethod": [{
                "id": format!("{did}#external-key"),
                "type": "Multikey",
                "controller": did,
                "publicKeyMultibase": "z6MkExternal"
            }]
        });
        validate_document_for_update(doc, did).expect("external keys allowed");
    }
}

#[cfg(test)]
mod pre_rotation_e2e_tests {
    //! End-to-end regression tests for the create→update flow, with
    //! particular focus on pre-rotation. These drive
    //! [`super::super::create_did_webvh`] and [`super::update_did_webvh`]
    //! through real fjall keyspaces and assert the resulting webvh log
    //! validates as a chain.
    //!
    //! These tests catch the class of bug where the signing-key
    //! selection in `update_did_webvh` ignores
    //! `previous.next_key_hashes`. Before the fix, the
    //! `update_with_pre_rotation_count_one` test failed with the
    //! didwebvh-rs `ParametersError: Signing key ID … does not match
    //! any next key hashes …` — the same error operators saw running
    //! `pnm services rest disable` against a pre-rotation-enabled VTA.
    //!
    //! Coverage:
    //! - `pre_rotation_count = 0`: standard non-pre-rotation update.
    //! - `pre_rotation_count = 1`: single-shot reveal (regression case).
    //! - `pre_rotation_count = 1`, two consecutive updates: exercises
    //!   the post-update install of the revealed key as an UpdateKey
    //!   handle so the second update can find a signing key by hash.
    //! - `pre_rotation_count = 2`: multiple committed candidates.
    //! - `rotate_did_webvh_keys` against a pre-rotation DID: the
    //!   convenience wrapper delegates to update_did_webvh, so it
    //!   benefits from the same fix.
    //!
    //! All tests use the serverless URL path (no webvh-host fixture).

    use std::sync::Arc;
    use std::time::Duration;

    use affinidi_did_resolver_cache_sdk::{DIDCacheClient, config::DIDCacheConfigBuilder};
    use chrono::Utc;
    use serde_json::json;
    use tokio::time::sleep;

    /// webvh requires `currentVersionTime > previousVersionTime`
    /// (strict, second precision). A `create_did` immediately
    /// followed by `update_did` in the same wall-clock second falls
    /// foul of this. Tests sleep just past the second boundary
    /// between log-entry-producing calls.
    const VERSION_TIME_GAP: Duration = Duration::from_millis(1100);

    use super::state::state_from_jsonl;
    use super::{
        RotateDidWebvhKeysOptions, UpdateDidWebvhOptions, plan_did_webvh_update,
        rotate_did_webvh_keys, update_did_webvh,
    };
    use crate::auth::AuthClaims;
    use crate::config::AppConfig;
    use crate::didcomm_bridge::DIDCommBridge;
    use crate::keys::seed_store::PlaintextSeedStore;
    use crate::operations::did_webvh::{
        CreateDidWebvhDeps, CreateDidWebvhParams, create_did_webvh,
    };
    use crate::test_support::{TestStore, open_test_store, test_app_config};

    fn admin_auth() -> AuthClaims {
        AuthClaims::unsafe_local_cli_super_admin("test")
    }

    async fn build_resolver() -> DIDCacheClient {
        DIDCacheClient::new(DIDCacheConfigBuilder::default().build())
            .await
            .expect("did resolver")
    }

    fn dummy_bridge() -> Arc<DIDCommBridge> {
        Arc::new(DIDCommBridge::placeholder())
    }

    /// Build a [`WebvhDeps`](crate::operations::did_webvh::WebvhDeps) from the
    /// loose test fixtures so the `update_did_webvh` calls below stay compact.
    fn webvh_deps<'a>(
        ts: &'a TestStore,
        seed_store: &'a dyn crate::keys::seed_store::SeedStore,
        resolver: &'a DIDCacheClient,
        bridge: &'a Arc<DIDCommBridge>,
        locks: &'a crate::operations::did_webvh::WebvhAuthLocks,
    ) -> crate::operations::did_webvh::WebvhDeps<'a> {
        crate::operations::did_webvh::WebvhDeps {
            keys_ks: &ts.keys_ks,
            imported_ks: &ts.imported_ks,
            contexts_ks: &ts.contexts_ks,
            webvh_ks: &ts.webvh_ks,
            audit_ks: &ts.audit_ks,
            seed_store,
            did_resolver: resolver,
            didcomm_bridge: bridge,
            auth_locks: locks,
        }
    }

    fn ts_app_config(ts: &TestStore) -> AppConfig {
        test_app_config(ts.data_dir.clone())
    }

    /// Stage a fresh VTA-shaped fixture: a tempdir-backed store, an
    /// active seed, and a context. Returns everything callers need to
    /// drive `create_did_webvh` then `update_did_webvh`.
    async fn setup(context_id: &str) -> (TestStore, PlaintextSeedStore) {
        let ts = open_test_store().await;
        let seed_store = PlaintextSeedStore::new(&ts.data_dir);
        crate::keys::seed_store::SeedStore::set(&seed_store, &[0xAAu8; 64])
            .await
            .expect("write seed");
        crate::keys::seeds::save_seed_record(
            &ts.keys_ks,
            &crate::keys::seeds::SeedRecord {
                id: 0,
                seed_hex: None,
                seed_enc: None,
                created_at: Utc::now(),
                retired_at: None,
            },
        )
        .await
        .expect("save seed record");
        crate::keys::seeds::set_active_seed_id(&ts.keys_ks, 0)
            .await
            .expect("set active seed");
        crate::contexts::create_context(&ts.contexts_ks, context_id, "e2e ctx")
            .await
            .expect("create context");
        (ts, seed_store)
    }

    /// Helper: drive `create_did_webvh` for a serverless DID with the
    /// given pre-rotation count, and return the resulting (did, scid).
    #[allow(clippy::too_many_arguments)]
    async fn create_did(
        ts: &TestStore,
        seed_store: &PlaintextSeedStore,
        cfg: &AppConfig,
        auth: &AuthClaims,
        resolver: &DIDCacheClient,
        bridge: &Arc<DIDCommBridge>,
        context_id: &str,
        pre_rotation_count: u32,
    ) -> (String, String) {
        // Serverless create helper — no server publish, so a fresh local
        // auth-lock registry suffices.
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = CreateDidWebvhDeps {
            keys_ks: &ts.keys_ks,
            imported_ks: &ts.imported_ks,
            contexts_ks: &ts.contexts_ks,
            webvh_ks: &ts.webvh_ks,
            did_templates_ks: &ts.did_templates_ks,
            audit_ks: &ts.audit_ks,
            seed_store,
            config: cfg,
            did_resolver: resolver,
            didcomm_bridge: bridge,
            auth_locks: &auth_locks,
        };
        let result = create_did_webvh(
            &deps,
            auth,
            CreateDidWebvhParams {
                context_id: context_id.into(),
                server_id: None,
                url: Some("https://example.com/.well-known/did/did.jsonl".into()),
                path_mode: vta_sdk::protocols::did_management::create::WebvhPathMode::default(),
                domain: None,
                label: Some("e2e".into()),
                portable: true,
                add_mediator_service: false,
                additional_services: None,
                pre_rotation_count,
                did_document: None,
                did_log: None,
                set_primary: true,
                signing_key_id: None,
                ka_key_id: None,
                template: None,
                template_context: None,
                template_vars: Default::default(),
                is_vta_identity: false,
            },
            "test",
        )
        .await
        .expect("create_did_webvh");
        (result.did, result.scid)
    }

    /// Build a well-formed DID document patch that swaps the only
    /// verificationMethod's pubkey. Anything that satisfies
    /// `validate_document_for_update` is fine — we don't care about the
    /// exact shape, only that the chain validates afterward.
    fn doc_patch(did: &str, suffix: &str) -> serde_json::Value {
        json!({
            "@context": ["https://www.w3.org/ns/did/v1"],
            "id": did,
            "verificationMethod": [{
                "id": format!("{did}#patched-{suffix}"),
                "type": "Multikey",
                "controller": did,
                "publicKeyMultibase": format!("z6MkPatched{suffix}"),
            }]
        })
    }

    /// Validate the full chain end-to-end. Re-running
    /// `state_from_jsonl` on the persisted log calls
    /// `DIDWebVHState::validate` + `assert_complete`, so any
    /// chain-internal inconsistency surfaces here.
    async fn assert_chain_validates(ts: &TestStore, did: &str) {
        let log = crate::webvh_store::get_did_log(&ts.webvh_ks, did)
            .await
            .expect("get_did_log")
            .expect("log present");
        state_from_jsonl(&log).expect("chain validates");
    }

    /// Sanity: pre_rotation_count = 0 (no pre-rotation) — the path
    /// the existing integration tests already covered. Asserts the
    /// non-pre-rotation flow continues to work after the refactor.
    #[tokio::test]
    async fn update_without_pre_rotation_succeeds() {
        let (ts, seed_store) = setup("ctx-nopre").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-nopre",
            0,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let result = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v2")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("update");

        assert!(result.new_version_id.starts_with("2-"));
        assert_chain_validates(&ts, &did).await;
    }

    /// After a did-log mutation, resolver cache must be refreshed to the newest
    /// document (not left at the pre-update value from startup/create).
    #[tokio::test]
    async fn update_refreshes_resolver_with_latest_document() {
        let (ts, seed_store) = setup("ctx-refresh").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-refresh",
            0,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v2")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("update");

        let resolved = resolver
            .resolve(&did)
            .await
            .expect("resolve did from refreshed cache");
        assert!(resolved.cache_hit, "updated DID should resolve from cache");

        let log = crate::webvh_store::get_did_log(&ts.webvh_ks, &did)
            .await
            .expect("get did log")
            .expect("did log present");
        let expected_value = crate::operations::protocol::document::current_document_from_log(&log)
            .expect("extract current DID document");
        let expected_doc =
            serde_json::from_value(expected_value).expect("deserialize expected DID document");

        assert_eq!(
            resolved.doc, expected_doc,
            "resolver cache should reflect latest persisted did.jsonl document"
        );
    }

    /// Regression test for the bug operators hit running
    /// `pnm services rest disable` against a pre-rotation-enabled
    /// VTA. With pre_rotation_count = 1 (the interactive setup
    /// default), a doc-patch update used to fail with
    /// `ParametersError: Signing key ID … does not match any next
    /// key hashes …` from didwebvh-rs because the update path signed
    /// with `last.update_keys[0]` instead of the pre-rotation
    /// candidate committed in `last.next_key_hashes`.
    #[tokio::test]
    async fn update_with_pre_rotation_count_one_succeeds() {
        let (ts, seed_store) = setup("ctx-pre1").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-pre1",
            1,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let result = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v2")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("update under pre-rotation must succeed");

        assert!(result.new_version_id.starts_with("2-"));
        // Pre-rotation reveal: the new active update_key is the
        // revealed pre-rotation candidate, count = 1.
        assert_eq!(result.update_keys_count, 1);
        // pre-rotation continues — fresh candidate committed.
        assert_eq!(result.pre_rotation_key_count, 1);
        assert_chain_validates(&ts, &did).await;
    }

    /// Two consecutive doc-patch updates with pre_rotation_count = 1.
    /// This exercises the post-update install of the revealed key as
    /// an `UpdateKey` handle — without that step, the second update
    /// would fail to resolve a signing key after the first update's
    /// pre-rotation handle is moved to the `superseded:` prefix.
    #[tokio::test]
    async fn two_consecutive_updates_with_pre_rotation_succeed() {
        let (ts, seed_store) = setup("ctx-pre1b").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-pre1b",
            1,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v2")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("update 1");
        sleep(VERSION_TIME_GAP).await;

        let result2 = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v3")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("update 2");

        assert!(result2.new_version_id.starts_with("3-"));
        assert_chain_validates(&ts, &did).await;
    }

    /// pre_rotation_count = 2 — the previous entry commits two
    /// candidates; the next update reveals one of them. Asserts
    /// `load_pre_rotation_signing_key` correctly picks a matching
    /// candidate when more than one is committed.
    #[tokio::test]
    async fn update_with_pre_rotation_count_two_succeeds() {
        let (ts, seed_store) = setup("ctx-pre2").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-pre2",
            2,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v2")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("update 1");
        sleep(VERSION_TIME_GAP).await;

        update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v3")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("update 2");

        assert_chain_validates(&ts, &did).await;
    }

    /// Disabling pre-rotation mid-chain: signing key still must come
    /// from the previous entry's `next_key_hashes`, but the new
    /// entry's `next_key_hashes` is empty (turning off the feature).
    /// Subsequent updates fall back to the standard `update_keys`
    /// path — covered implicitly by the next assertion.
    #[tokio::test]
    async fn disabling_pre_rotation_then_updating_succeeds() {
        let (ts, seed_store) = setup("ctx-pre-off").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-pre-off",
            1,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        // Update 1: turn off pre-rotation.
        let r1 = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v2")),
                pre_rotation_count: Some(0),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("disable pre-rotation");
        assert_eq!(r1.pre_rotation_key_count, 0);
        sleep(VERSION_TIME_GAP).await;

        // Update 2: ordinary non-pre-rotation update.
        let r2 = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v3")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("subsequent update");
        assert!(r2.new_version_id.starts_with("3-"));
        assert_chain_validates(&ts, &did).await;
    }

    /// `rotate_did_webvh_keys` is a thin wrapper that mints fresh
    /// VM keys and delegates to `update_did_webvh`. Confirm it works
    /// against a pre-rotation-enabled DID.
    #[tokio::test]
    async fn rotate_keys_with_pre_rotation_succeeds() {
        let (ts, seed_store) = setup("ctx-rotate").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-rotate",
            1,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let result = rotate_did_webvh_keys(
            &deps,
            &auth,
            &scid,
            RotateDidWebvhKeysOptions::default(),
            None,
            "test",
        )
        .await
        .expect("rotate-keys under pre-rotation");

        assert!(result.new_version_id.starts_with("2-"));
        assert_chain_validates(&ts, &did).await;
    }

    /// Pre-fix-genesis → post-fix-update scenario.
    ///
    /// Operators who created their VTA with the original (broken)
    /// build have pre-rotation keys saved only at the legacy
    /// `key:{did}#pre-rotation-N` records — no `webvh_keys` handles.
    /// After upgrading to the fixed build, the first update has to
    /// fall back to `legacy_lookup_pre_rotation_by_hash` to find a
    /// signing key.
    ///
    /// This test simulates that state by deleting the
    /// `webvh_keys` handles installed at genesis, then running the
    /// update. If the legacy fallback is broken, the update fails
    /// with the same `ParametersError: Signing key ID … does not
    /// match any next key hashes` error operators see.
    #[tokio::test]
    async fn update_with_legacy_only_pre_rotation_genesis_succeeds() {
        let (ts, seed_store) = setup("ctx-legacy").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-legacy",
            1,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        // Wipe the webvh_keys keyspace entries so only the legacy
        // `key:{did}#…` records remain. This puts the store into the
        // shape it had on a pre-fix VTA.
        let prefix = format!("webvh:{scid}:");
        let raws = ts
            .keys_ks
            .prefix_keys(prefix.into_bytes())
            .await
            .expect("scan webvh_keys");
        assert!(
            !raws.is_empty(),
            "fixture invariant: genesis must install at least one webvh_keys handle"
        );
        for raw in raws {
            ts.keys_ks
                .remove(raw)
                .await
                .expect("strip webvh_keys handles to simulate pre-fix genesis");
        }

        // Sanity: legacy `key:` records still in place.
        let legacy = ts
            .keys_ks
            .prefix_keys(b"key:".to_vec())
            .await
            .expect("scan legacy keys");
        assert!(
            legacy.iter().any(|raw| std::str::from_utf8(raw)
                .map(|s| s.contains("#pre-rotation-"))
                .unwrap_or(false)),
            "fixture invariant: legacy pre-rotation record must exist"
        );

        // The update should succeed via the legacy fallback in
        // `load_pre_rotation_signing_key`.
        let result = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "v2")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("legacy-fallback update under pre-rotation");

        assert!(result.new_version_id.starts_with("2-"));
        assert_eq!(result.update_keys_count, 1);
        assert_eq!(result.pre_rotation_key_count, 1);
        assert_chain_validates(&ts, &did).await;
    }

    /// Optimistic-concurrency precondition.
    ///
    /// Scenario: operator A reads the DID at versionId `1-…`, operator B
    /// (or a bot) updates the DID, then A tries to save its edits with
    /// the stale `expected_version_id`. The save must fail with
    /// `Conflict` rather than silently building a chain on top of B's
    /// changes — otherwise A's document body overwrites B's edits even
    /// though the chain stays structurally valid.
    #[tokio::test]
    async fn update_with_stale_expected_version_id_conflicts() {
        let (ts, seed_store) = setup("ctx-stale").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-stale",
            0,
        )
        .await;

        // Capture the genesis versionId (`1-…`) before anyone updates.
        let log = crate::webvh_store::get_did_log(&ts.webvh_ks, &did)
            .await
            .expect("get_did_log")
            .expect("log present");
        let genesis_version_id = log
            .lines()
            .next()
            .and_then(|l| serde_json::from_str::<serde_json::Value>(l).ok())
            .and_then(|v| {
                v.get("versionId")
                    .and_then(serde_json::Value::as_str)
                    .map(str::to_string)
            })
            .expect("genesis versionId");

        // Concurrent update by "operator B" — bumps the chain to `2-…`.
        sleep(VERSION_TIME_GAP).await;
        update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "by-b")),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("operator B's update succeeds");

        // Operator A tries to save with the stale `1-…` precondition.
        sleep(VERSION_TIME_GAP).await;
        let err = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "by-a")),
                expected_version_id: Some(genesis_version_id.clone()),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect_err("stale expected_version_id must conflict");

        match err {
            crate::operations::did_webvh::UpdateDidWebvhError::Conflict(msg) => {
                assert!(
                    msg.contains(&genesis_version_id),
                    "error should name the stale version: got {msg}"
                );
                assert!(
                    msg.contains("Re-fetch"),
                    "error should hint at the recovery action: got {msg}"
                );
            }
            other => panic!("expected Conflict, got {other:?}"),
        }

        // The chain on disk should still be exactly what B wrote — A's
        // attempted update did not touch storage.
        let log_after = crate::webvh_store::get_did_log(&ts.webvh_ks, &did)
            .await
            .expect("get_did_log")
            .expect("log present");
        assert_eq!(
            log_after.lines().count(),
            2,
            "A's update must not have appended a third entry"
        );
    }

    /// Race the orchestrator against a `server_id` flip that occurs
    /// between the orchestrator's step-1 record load and its step-11
    /// CAS check. Before the `RecordSnapshot` wiring, only
    /// `log_entry_count` was checked at step 11 — `server_id`
    /// changes slipped past, and step 12 then wrote the stale
    /// `server_id` back, destroying the concurrent
    /// `register_did_with_server`'s effect.
    ///
    /// The simulated race is deterministic: we mutate the on-disk
    /// record AFTER the orchestrator's step-1 load by mutating it
    /// before re-entry. With the new snapshot machinery, the second
    /// call must reject.
    #[tokio::test]
    async fn update_detects_concurrent_server_id_flip() {
        let (ts, seed_store) = setup("ctx-svrid").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-svrid",
            0,
        )
        .await;

        // Directly flip server_id on the on-disk record — simulates
        // a `register_did_with_server` call that landed AFTER the
        // orchestrator's step 1 but BEFORE its step 11.
        //
        // We invoke update_did_webvh from a clean entry, but the
        // orchestrator's CAS catches the divergence between the
        // capture snapshot (server_id = "serverless") and the
        // current record (server_id = "webvh-prod-imaginary").
        //
        // To make the race deterministic with a single-threaded test
        // we exploit the orchestrator's flow: capture happens at
        // step 1, CAS at step 11. We mutate the disk record between
        // them by:
        //   1. Loading record, capturing the snapshot value.
        //   2. Calling store_did with server_id flipped.
        //   3. Invoking update_did_webvh — which captures the *new*
        //      server_id at step 1 (so snapshot == on-disk).
        //   4. No race detection — expected.
        //
        // To force a race we'd need a true concurrency setup. Easier
        // approach: rely on the unit tests in `concurrency::tests`
        // (which cover `ServerIdChanged` exhaustively) and assert
        // here only that *if* an update is followed by a mutation
        // of server_id while another update is mid-flight, the
        // detection wires correctly via the conflict error message
        // path. We test the error-message contract: when the
        // orchestrator emits Conflict from RaceDetected, the
        // message contains the race-reason text.
        //
        // Concretely, run an update with a stale snapshot manually:
        let mut record = crate::webvh_store::get_did(&ts.webvh_ks, &did)
            .await
            .expect("get_did")
            .expect("record present");
        let snapshot = crate::operations::did_webvh::RecordSnapshot::capture(&record);

        // Mutate on disk to simulate the racing op.
        record.server_id = "webvh-prod-imaginary".into();
        record.updated_at = chrono::Utc::now();
        crate::webvh_store::store_did(&ts.webvh_ks, &record)
            .await
            .expect("store_did");

        let current = crate::webvh_store::get_did(&ts.webvh_ks, &did)
            .await
            .expect("get_did")
            .expect("record present");

        // The CAS predicate the orchestrator now uses at step 11.
        // The snapshot checks multiple version-vector fields and
        // returns on the FIRST mismatch — log_entry_count, then
        // updated_at, then server_id. Either updated_at OR
        // server_id can be the tripping field (real concurrent
        // mutations will typically touch both, since `store_did`
        // bumps `updated_at`). What we assert is the *contract*:
        // any version-vector divergence is detected, and the
        // message names the field that diverged so operators can
        // diagnose the race.
        let race = snapshot
            .assert_unchanged(&current)
            .expect_err("snapshot must detect concurrent mutation");
        let msg = race.to_string();
        assert!(
            msg.contains("modified concurrently"),
            "race message must signal concurrent modification: {msg}"
        );
        // The trip is on either updated_at or server_id (in that
        // order). Pin both as acceptable so the test doesn't get
        // brittle if the assertion order in
        // `RecordSnapshot::assert_unchanged` ever changes — what
        // matters is that the race is caught and the field is named.
        assert!(
            msg.contains("updated_at") || msg.contains("server_id"),
            "race reason must name the diverged field: {msg}"
        );

        // Sanity: scid still resolves to the same on-disk record
        // (we modified it but kept its key intact).
        let by_scid = super::state::find_record_by_scid(&ts.webvh_ks, &scid)
            .await
            .expect("find_record_by_scid")
            .expect("present");
        assert_eq!(by_scid.did, did);
    }

    /// Concurrency test for `rotate_did_webvh_keys`. The internal
    /// `next_fragment_id` bump used to be a read-modify-write with no
    /// version check, so two parallel rotates each derived the same
    /// `[next_fragment_id, next_fragment_id + N)` range and only one
    /// store_did won — the loser's freshly-issued keys collided with
    /// the winner's published `#key-N` references. The new
    /// `RecordSnapshot::assert_unchanged` guard refuses the loser
    /// with `Conflict` so the operator re-runs the rotate cleanly.
    ///
    /// This test simulates the race deterministically: rotate once
    /// successfully (committing the bump), then mutate the on-disk
    /// record's `updated_at` to mimic a different concurrent op
    /// having moved the record between snapshot and final write,
    /// then attempt a second rotate and assert Conflict.
    #[tokio::test]
    async fn rotate_keys_with_stale_record_snapshot_conflicts() {
        let (ts, seed_store) = setup("ctx-rotate-cas").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-rotate-cas",
            0,
        )
        .await;

        // Mutate the record's updated_at on disk to simulate a
        // concurrent op having modified it between
        // `RecordSnapshot::capture` (early in rotate) and the final
        // `store_did` (the next_fragment_id bump). The rotate's
        // captured snapshot is from the start of its call; this
        // modification mid-flight is what the snapshot guard exists
        // to catch.
        //
        // We can't trigger this from within a single
        // `rotate_did_webvh_keys` call without spawning a parallel
        // task, so instead we mutate directly. The operation under
        // test re-loads + checks the snapshot at the bump point;
        // any change to updated_at between its read and that re-load
        // is a race per the helper's contract.
        sleep(VERSION_TIME_GAP).await;
        let mut record = crate::webvh_store::get_did(&ts.webvh_ks, &did)
            .await
            .unwrap()
            .unwrap();
        // Hijack the record by spawning a task that mutates updated_at
        // *during* the rotate call. We sequence with sleep so the rotate
        // sees the original record on capture, then the mutation lands
        // before the rotate's CAS re-load.
        //
        // Simpler form: do the mutation synchronously *before* calling
        // rotate, but keep the captured snapshot fresh. The rotate's
        // capture sees the post-mutation updated_at, then nothing
        // further changes — no race detected. So we actually need the
        // race to happen between capture and CAS.
        //
        // Workaround: directly invoke the snapshot helper to
        // demonstrate the guard works; the integration-level race
        // exercise lives in tests/e2e (where two real rotate tasks
        // can run concurrently). This unit-level test pins the
        // helper-call wiring.
        let snapshot = crate::operations::did_webvh::RecordSnapshot::capture(&record);
        record.updated_at = chrono::Utc::now() + chrono::Duration::seconds(1);
        crate::webvh_store::store_did(&ts.webvh_ks, &record)
            .await
            .unwrap();

        let current = crate::webvh_store::get_did(&ts.webvh_ks, &did)
            .await
            .unwrap()
            .unwrap();
        snapshot
            .assert_unchanged(&current)
            .expect_err("snapshot must reject the post-mutation record");

        // And full rotate-keys still works on a fresh state — the
        // guard didn't accidentally fail-closed in the happy case.
        let result = rotate_did_webvh_keys(
            &deps,
            &auth,
            &scid,
            RotateDidWebvhKeysOptions {
                pre_rotation_count: None,
                label: None,
            },
            None,
            "test",
        )
        .await
        .expect("happy-path rotate succeeds after the race assertion");
        assert!(result.new_version_id.starts_with("2-"));
    }

    /// Same precondition machinery, but the supplied versionId matches
    /// the current latest — should pass through cleanly. Pins the
    /// happy-path so we don't accidentally make the precondition reject
    /// every update.
    #[tokio::test]
    async fn update_with_current_expected_version_id_succeeds() {
        let (ts, seed_store) = setup("ctx-current").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-current",
            0,
        )
        .await;
        let log = crate::webvh_store::get_did_log(&ts.webvh_ks, &did)
            .await
            .expect("get_did_log")
            .expect("log present");
        let current_version_id = log
            .lines()
            .last()
            .and_then(|l| serde_json::from_str::<serde_json::Value>(l).ok())
            .and_then(|v| {
                v.get("versionId")
                    .and_then(serde_json::Value::as_str)
                    .map(str::to_string)
            })
            .expect("current versionId");

        sleep(VERSION_TIME_GAP).await;
        let result = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "current")),
                expected_version_id: Some(current_version_id),
                ..Default::default()
            },
            None,
            "test",
        )
        .await
        .expect("update with matching expected_version_id should succeed");
        assert!(result.new_version_id.starts_with("2-"));
        assert_chain_validates(&ts, &did).await;
    }

    /// Regression test for the same-second `versionTime` collision
    /// (PR #600, `backdated_version_time`).
    ///
    /// The VTA creates its `did:webvh` at `vta setup` and updates it
    /// moments later — e.g. `services didcomm enable` patching in the
    /// DIDComm mediator service. `did:webvh` serialises `versionTime`
    /// at *second* granularity and requires each entry to be strictly
    /// later than the previous, so two entries minted in the same
    /// wall-clock second serialise identically and make the DID
    /// unresolvable ("versionTime must be greater than previous") —
    /// surfacing only when a client fetches `did.jsonl`. The
    /// user-visible symptom was that `services didcomm enable` reported
    /// success and wrote `config.toml`, yet the resolved DID document
    /// still advertised REST-only at version 1.
    ///
    /// Every other test in this module dodges the collision by sleeping
    /// past the second boundary ([`VERSION_TIME_GAP`]); operators
    /// running `setup` then `enable` back-to-back had no such luxury.
    /// This test deliberately drives create → didcomm-enable **with no
    /// sleep in between** and asserts the chain still validates and
    /// advertises DIDCommMessaging at version 2 — i.e.
    /// `backdated_version_time` keeps the log strictly increasing
    /// regardless of how fast the entries are minted.
    #[tokio::test]
    async fn create_then_didcomm_enable_back_to_back_resolves() {
        use crate::operations::protocol::document::{
            current_didcomm_service, current_document_from_log, with_didcomm_service,
        };

        let (ts, seed_store) = setup("ctx-vtime").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        // Genesis entry — mirrors `vta setup`'s `create_webvh` (no
        // pre-rotation, the plain serverless case from the bug report).
        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-vtime",
            0,
        )
        .await;

        // NO `sleep(VERSION_TIME_GAP)` here — reproducing the operator's
        // back-to-back `setup` → `services didcomm enable`. Read the
        // genesis document and patch in the DIDComm mediator service
        // exactly as `enable_didcomm` does, via the shared patcher.
        let genesis_log = crate::webvh_store::get_did_log(&ts.webvh_ks, &did)
            .await
            .expect("get_did_log")
            .expect("genesis log present");
        let genesis_doc = current_document_from_log(&genesis_log).expect("read genesis doc");
        let mediator_did = "did:web:mediator.example.com";
        let patched =
            with_didcomm_service(genesis_doc, mediator_did).expect("patch didcomm service");

        let result = update_did_webvh(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(patched),
                ..Default::default()
            },
            Some(did.as_str()),
            "test",
        )
        .await
        .expect("didcomm-enable update immediately after create must succeed");
        assert!(
            result.new_version_id.starts_with("2-"),
            "expected version 2, got {}",
            result.new_version_id
        );

        // The load-bearing assertion: re-parsing the persisted log runs
        // didwebvh-rs' chain validation, including the strict
        // `versionTime` monotonicity check that collided pre-#600.
        assert_chain_validates(&ts, &did).await;

        // And the resolved document actually advertises DIDCommMessaging
        // — the whole point of `services didcomm enable`.
        let final_log = crate::webvh_store::get_did_log(&ts.webvh_ks, &did)
            .await
            .expect("get_did_log")
            .expect("log present");
        let final_doc = current_document_from_log(&final_log).expect("read final doc");
        let svc = current_didcomm_service(&final_doc)
            .expect("DIDCommMessaging service advertised after enable");
        assert_eq!(svc.mediator_did, mediator_did);
    }

    // ── plan/apply: what the plan reports must be what the execution does ────
    //
    // If a plan predicts one key and the real run installs another, a human
    // approved a rotation that never happened — and every signature over that
    // approval still verifies, so nothing downstream can tell. That is not
    // hypothetical: `derive_webvh_keys` allocates from a BIP-32 path counter, so
    // a plan that derived keys the way the real run does would consume an index,
    // and the real run would then allocate the *next* one and install a
    // different key than the one shown. Hence `peek_webvh_keys`, and hence these
    // tests.

    /// A plan must not move any state it reads — no burned derivation path, no
    /// appended log entry — and must therefore be repeatable.
    #[tokio::test]
    async fn planning_is_read_only_and_repeatable() {
        let (ts, seed_store) = setup("ctx-plan-ro").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-plan-ro",
            0,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let base_path = crate::contexts::get_context(&ts.contexts_ks, "ctx-plan-ro")
            .await
            .expect("get_context")
            .expect("context")
            .base_path;
        let opts = || UpdateDidWebvhOptions {
            document: Some(doc_patch(&did, "planned")),
            ..Default::default()
        };

        let counter_before = crate::keys::paths::peek_path_counter(&ts.keys_ks, &base_path)
            .await
            .expect("peek");
        let log_before = crate::webvh_store::get_did_log(&ts.webvh_ks, &did)
            .await
            .expect("log");

        let first = plan_did_webvh_update(&deps, &auth, &scid, opts())
            .await
            .expect("plan");

        assert_eq!(
            counter_before,
            crate::keys::paths::peek_path_counter(&ts.keys_ks, &base_path)
                .await
                .expect("peek"),
            "planning must not consume a derivation path"
        );
        assert_eq!(
            log_before,
            crate::webvh_store::get_did_log(&ts.webvh_ks, &did)
                .await
                .expect("log"),
            "planning must not append a log entry"
        );

        let second = plan_did_webvh_update(&deps, &auth, &scid, opts())
            .await
            .expect("re-plan");
        assert_eq!(
            first.new_update_keys, second.new_update_keys,
            "re-planning the same update must predict the same keys, not slide \
             down the counter"
        );
    }

    /// The race, closed at the allocation itself.
    ///
    /// `derive_webvh_keys_block` allocates a contiguous block in one atomic step,
    /// and refuses if the counter it is pinned to has moved. This is the guard the
    /// gate's re-plan cannot provide: it holds even inside a single execution, in
    /// the window the old two-call allocation left open between deriving the auth
    /// key and the pre-rotation keys.
    #[tokio::test]
    async fn a_moved_counter_refuses_to_derive_the_wrong_keys() {
        use super::keys::derive_webvh_keys_block;

        let (ts, seed_store) = setup("ctx-race").await;
        let base_path = crate::contexts::get_context(&ts.contexts_ks, "ctx-race")
            .await
            .expect("get_context")
            .expect("context")
            .base_path;

        // A caller peeks the counter, intending to derive a block starting there.
        let pinned = crate::keys::paths::peek_path_counter(&ts.keys_ks, &base_path)
            .await
            .unwrap();

        // A concurrent update in the same context allocates first — the exact race
        // a human-in-the-loop approval window makes real.
        crate::keys::paths::allocate_path(&ts.keys_ks, &base_path)
            .await
            .unwrap();

        // The first caller now tries to derive against its stale pin. It must
        // refuse: deriving would install a key nobody predicted.
        let result =
            derive_webvh_keys_block(&ts.keys_ks, &seed_store, &base_path, 2, Some(pinned)).await;
        match result {
            Err(e) => assert!(
                format!("{e}").contains("moved"),
                "expected a counter-moved conflict, got: {e}"
            ),
            Ok(_) => panic!("a moved counter must refuse, not derive the wrong keys"),
        }

        // The refusal consumed nothing — re-pinning to the current value works.
        let now = crate::keys::paths::peek_path_counter(&ts.keys_ks, &base_path)
            .await
            .unwrap();
        assert_eq!(
            now,
            pinned + 1,
            "only the concurrent allocation advanced it"
        );
        derive_webvh_keys_block(&ts.keys_ks, &seed_store, &base_path, 2, Some(now))
            .await
            .expect("re-pinned derivation succeeds");
    }

    #[tokio::test]
    async fn plan_predicts_the_update_key_that_execution_installs() {
        let (ts, seed_store) = setup("ctx-plan-keys").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-plan-keys",
            0,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let opts = || UpdateDidWebvhOptions {
            document: Some(doc_patch(&did, "v2")),
            ..Default::default()
        };

        let plan = plan_did_webvh_update(&deps, &auth, &scid, opts())
            .await
            .expect("plan");
        assert!(
            plan.rotates_update_keys(),
            "a document change rotates the update key — the effect the payload \
             never mentions and the plan exists to surface"
        );

        update_did_webvh(&deps, &auth, &scid, opts(), None, "test")
            .await
            .expect("execute");

        let (installed_keys, _) = committed_params(&ts, &did).await;
        assert_eq!(
            plan.new_update_keys, installed_keys,
            "the update key the plan showed the approver MUST be the key the \
             execution installed — otherwise the approval authorized a rotation \
             that never happened"
        );
    }

    /// Same property, under pre-rotation — where the freshly-derived keys land
    /// in `next_key_hashes` rather than `update_keys` (the new update key is the
    /// one *revealed* from the previous entry's commitment). This is the case
    /// that actually exercises a multi-key peek against a multi-key allocation:
    /// a planner reading the counter without care would predict the wrong
    /// commitments here and nothing else in the system would notice.
    #[tokio::test]
    async fn plan_predicts_the_pre_rotation_commitments_execution_publishes() {
        let (ts, seed_store) = setup("ctx-plan-pre").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-plan-pre",
            2,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let opts = || UpdateDidWebvhOptions {
            document: Some(doc_patch(&did, "pre")),
            ..Default::default()
        };

        let plan = plan_did_webvh_update(&deps, &auth, &scid, opts())
            .await
            .expect("plan");
        assert_eq!(
            plan.new_next_key_hashes.len(),
            2,
            "expected two fresh pre-rotation commitments"
        );

        update_did_webvh(&deps, &auth, &scid, opts(), None, "test")
            .await
            .expect("execute");

        let (installed_keys, installed_hashes) = committed_params(&ts, &did).await;
        assert_eq!(
            plan.new_next_key_hashes, installed_hashes,
            "the pre-rotation commitments the plan predicted MUST be the ones the \
             execution published — they authorize the next rotation, so a wrong \
             prediction means the approver saw a different future than the one \
             that now exists"
        );
        assert_eq!(
            plan.new_update_keys, installed_keys,
            "and the revealed update key must match too"
        );
    }

    /// The plan's effects must name the key rotation, not just the document edit.
    /// A surface rendering only the payload diff would show the verification
    /// method and hide the fact that the DID's controlling key is changing.
    #[tokio::test]
    async fn effects_surface_the_rotation_hidden_in_the_payload() {
        let (ts, seed_store) = setup("ctx-plan-fx").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-plan-fx",
            2,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let plan = plan_did_webvh_update(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "fx")),
                ..Default::default()
            },
        )
        .await
        .expect("plan");

        let effects = plan.to_effects();
        let kinds: Vec<&str> = effects.iter().map(|e| e.kind.as_str()).collect();
        assert!(
            kinds.contains(&"documentChange"),
            "expected the document edit: {kinds:?}"
        );
        assert!(
            kinds.contains(&"keyRotation"),
            "the rotation is invisible in the payload — the plan must surface it: {kinds:?}"
        );
        assert!(
            kinds.contains(&"preRotationRefresh"),
            "expected the pre-rotation commitments: {kinds:?}"
        );

        let rotation = effects
            .iter()
            .find(|e| e.kind == "keyRotation")
            .expect("rotation effect");
        assert_eq!(
            rotation.before,
            Some(serde_json::json!(plan.prior_update_keys))
        );
        assert_eq!(
            rotation.after,
            Some(serde_json::json!(plan.new_update_keys))
        );
        assert_ne!(
            rotation.before, rotation.after,
            "a rotation whose before equals its after is not a rotation"
        );

        // `summary` is the only member a consent surface is guaranteed able to
        // render, so an effect without one is an effect that can go unseen.
        for e in &effects {
            assert!(!e.summary.is_empty(), "effect `{}` has no summary", e.kind);
        }

        assert_eq!(plan.state_pin().resource, did);
        assert_eq!(plan.state_pin().version, plan.prior_version_id);
    }

    /// The classification must agree with what the handler actually does.
    ///
    /// This is "code decides, not the registry" turned into a test. The planner
    /// runs the real handler and reports a key rotation. SPEC §7.3 item 13 calls
    /// rotation of a sole controlling key *authority-shifting*, and
    /// authority-shifting is `destructive`. So if the plan says the key rotates,
    /// the compiled class must say `destructive` — otherwise the value the policy
    /// engine gates on is contradicted by the code it is gating.
    ///
    /// It matters concretely: an approver's device demands a typed digest match
    /// only for a `destructive` task. Under-classifying this one meant the
    /// flagship flow — edit a DID document — got a tap where it should have got a
    /// ceremony.
    #[tokio::test]
    async fn the_compiled_class_agrees_with_the_rotation_the_plan_reports() {
        let (ts, seed_store) = setup("ctx-class").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-class",
            0,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let plan = plan_did_webvh_update(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                document: Some(doc_patch(&did, "class")),
                ..Default::default()
            },
        )
        .await
        .expect("plan");

        assert!(
            plan.rotates_update_keys(),
            "a document change rotates the update key — if that ever stops being \
             true, the classification should be revisited, not this assert"
        );

        let class = crate::trust_tasks::class_for(vta_sdk::trust_tasks::TASK_WEBVH_DIDS_UPDATE_1_0)
            .expect("the update task is in the dispatch table");

        assert_eq!(
            class.side_effects,
            crate::policy::SideEffectLevel::Destructive,
            "the plan says this rotates the DID's controlling key, which SPEC §7.3 \
             calls authority-shifting; the compiled class must say so too, or the \
             policy engine gates on a value the code contradicts"
        );
    }

    /// An update that changes no document, on a DID with no pre-rotation,
    /// rotates no key — so the plan must not claim it does.
    #[tokio::test]
    async fn no_document_change_means_no_rotation() {
        let (ts, seed_store) = setup("ctx-plan-noop").await;
        let cfg = ts_app_config(&ts);
        let auth = admin_auth();
        let resolver = build_resolver().await;
        let bridge = dummy_bridge();
        let auth_locks = crate::operations::did_webvh::WebvhAuthLocks::new();
        let deps = webvh_deps(&ts, &seed_store, &resolver, &bridge, &auth_locks);

        let (_did, scid) = create_did(
            &ts,
            &seed_store,
            &cfg,
            &auth,
            &resolver,
            &bridge,
            "ctx-plan-noop",
            0,
        )
        .await;
        sleep(VERSION_TIME_GAP).await;

        let plan = plan_did_webvh_update(
            &deps,
            &auth,
            &scid,
            UpdateDidWebvhOptions {
                ttl: Some(600),
                ..Default::default()
            },
        )
        .await
        .expect("plan");

        assert!(
            !plan.rotates_update_keys(),
            "a metadata-only update with no pre-rotation must not rotate the update key"
        );
        assert!(
            !plan.to_effects().iter().any(|e| e.kind == "keyRotation"),
            "no rotation effect when nothing rotates"
        );
    }

    /// Read back the update keys and pre-rotation commitments actually in force
    /// after the last entry.
    ///
    /// webvh parameters are a *delta* — an entry that does not restate
    /// `update_keys` leaves the previous entry's standing. So "what is in force"
    /// is the last entry that restated them, walking backwards, not whatever the
    /// final entry happens to carry.
    async fn committed_params(ts: &TestStore, did: &str) -> (Vec<String>, Vec<String>) {
        let log = crate::webvh_store::get_did_log(&ts.webvh_ks, did)
            .await
            .expect("get_did_log")
            .expect("log present");
        let state = state_from_jsonl(&log).expect("chain validates");

        let mut keys: Vec<String> = vec![];
        let mut hashes: Vec<String> = vec![];
        for entry in state.log_entries() {
            // The entry's *own* parameters, not `validated_parameters` — the
            // latter records the delta as resolved during validation and reads
            // `None` on an entry that restated a value, which is the opposite of
            // what "in force" means here.
            let p = didwebvh_rs::log_entry::LogEntryMethods::get_parameters(&entry.log_entry);
            if let Some(arc) = p.update_keys.as_ref() {
                keys = arc.iter().map(|k| k.as_ref().to_string()).collect();
            }
            if let Some(arc) = p.next_key_hashes.as_ref() {
                hashes = arc.iter().map(|h| h.as_ref().to_string()).collect();
            }
        }
        (keys, hashes)
    }
}