runner_manager_platform/

service.rs

// owner: d3-service-installers

//! Registering `daemon run` with the operating system, so that a home host
//! resumes work by itself after a reboot with nobody logged in.
//!
//! Journey 5 is the whole of the requirement: *"the machine reboots with nobody
//! logged in; the boot-start service starts the agent, which reads the user
//! access token from the machine-scoped secret store"*. Everything in this file
//! exists to make that sentence true on Windows, macOS, and Linux, and to make
//! `service status` say so — or say precisely why not.
//!
//! # The shape: render, then apply
//!
//! A service manager is the one dependency a `cargo test` run cannot have. So
//! this module is split in two, and the split is the reason most of it is
//! testable on a developer's laptop whatever OS that laptop runs:
//!
//! * **Rendering** is pure. [`ServiceDefinition`] turns an [`InstallPlan`] into
//!   the exact text the platform consumes — a systemd unit, a launchd property
//!   list, a Task Scheduler XML document, or a canonical descriptor of the
//!   Windows service parameters. No `cfg`, no privileges, no I/O. A Windows
//!   developer renders and asserts the systemd unit; a Linux CI leg renders and
//!   asserts the launchd plist.
//! * **Applying** is behind [`ServiceControl`], one trait with a backend per
//!   platform and a public in-memory double ([`RecordingControls`]) that `f3`
//!   and this crate's own tests drive without touching the host.
//!
//! [`ServiceOperations`] is the layer above both, and it is where the logic
//! that is *not* platform-specific lives: refusing an install while the
//! single-instance lock is held, recording the resolved absolute binary path,
//! detecting a stale one, switching start mode without reinstalling, and
//! uninstalling without deleting a byte of configuration, secrets, or cache.
//!
//! # Two domains, not two products
//!
//! `--start-at boot` and `--start-at login` are the same daemon registered in
//! two different *domains*:
//!
//! | | boot | login |
//! |---|---|---|
//! | Windows | a service in the Service Control Manager, `LocalSystem` | a Task Scheduler task with a logon trigger, running at `LeastPrivilege` |
//! | macOS | a LaunchDaemon in `/Library/LaunchDaemons` | a LaunchAgent in `~/Library/LaunchAgents` |
//! | Linux | a system unit in `/etc/systemd/system` | a user unit in `~/.config/systemd/user` |
//!
//! The Windows row is the one that is not symmetric, and it is worth saying why
//! rather than leaving a reader to wonder. **Windows services cannot start at
//! logon.** Service trigger-start covers domain join, an IP address becoming
//! available, a device arriving, a firewall port event and a group-policy
//! change; there is no logon trigger, and there is no user-session service
//! type this product could use instead. Task Scheduler is the mechanism Windows
//! actually provides for "run this when the operator signs in", so that is what
//! `--start-at login` uses there. It is registered, inspected, and removed
//! through the same [`ServiceControl`] trait as everything else, so nothing
//! above this module has to know.
//!
//! # What the account can reach, and why it is not more
//!
//! `05-infrastructure.md` requires *"a least-privilege account that can read the
//! machine-scoped secret store and write its configured cache and runtime
//! directories"*. Those two clauses pull in opposite directions on every
//! platform, and the resolution is recorded per platform in
//! `docs/service-account.md` and checked by [`review_least_privilege`], which
//! reads the rendered definition back and reports anything it grants beyond the
//! requirement.
//!
//! The Windows resolution is the one that surprises people. `d2` protects the
//! machine-scoped store with `D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;OW)` and
//! documents that the DACL *is* the access control, because a machine-scope
//! DPAPI blob is decryptable by any process on the host. `NT AUTHORITY\
//! LocalService` and `NT AUTHORITY\NetworkService` — the two accounts a
//! "least privilege service" reflex reaches for — are named by none of those
//! three ACEs and therefore **cannot read the token at all**. Widening the DACL
//! to reach them would grant every service on the host read access to the one
//! credential this product holds, which is strictly worse than running as
//! `LocalSystem`. `secrets.rs` is not this task's file and is not widened; the
//! service runs as `LocalSystem`, and [`review_least_privilege`] records the
//! account together with the reason it is the minimum that satisfies the
//! requirement rather than pretending it is small.
//!
//! # What is deliberately not claimed
//!
//! **A reboot is not something a test suite can have.** Every assertion here is
//! about configuration a boot-time start depends on — the start type, the
//! account, the recorded absolute path, the restart policy the service manager
//! reports back — and about a store that is readable outside any login session,
//! which `d2` proves separately. That the machine actually comes back up and
//! the agent actually resumes is human gate 3 in `06-migration-rollout.md`, and
//! nothing in this file is evidence for it.

use std::collections::{BTreeMap, BTreeSet};
use std::ffi::OsString;
use std::fmt;
use std::path::{Path, PathBuf};
use std::time::Duration;

use chrono::{DateTime, Utc};
use runner_manager_domain::model::StartMode;
use runner_manager_domain::path::LocalAbsolutePath;
use serde::{Deserialize, Serialize};

use crate::lock::{HostLock, LockError, LockKind};
use crate::paths::AppPaths;
#[cfg(windows)]
use crate::runner_root_access::RootAdmission;
use crate::runner_root_access::{
    Reversal, RootAccessChange, RootAccessError, RootAccessReport, RootAccessSummary,
};

// ---------------------------------------------------------------------------
// Names
// ---------------------------------------------------------------------------

/// The product's own service name, on every platform that wants a short one.
pub const SERVICE_NAME: &str = "runner-manager";
/// Hidden CLI marker carried only by Windows boot-service registrations.
///
/// Application-data arguments are shared by every service manager and cannot
/// distinguish SCM from Task Scheduler. This marker is the durable routing
/// contract between the Windows installer and the shipping binary.
pub const WINDOWS_SCM_HOST_ARGUMENT: &str = "--windows-service-host";

/// What an operator sees in `services.msc`, `launchctl list`, or
/// `systemctl status`.
pub const DISPLAY_NAME: &str = "GitHub Actions Runner Manager";

/// One line of explanation, for the same three places.
pub const DESCRIPTION: &str =
    "Starts ephemeral GitHub Actions self-hosted runners on this machine on demand.";

/// The arguments the installed command line carries.
///
/// `05-infrastructure.md`: *"`service install` registers `daemon run` for the
/// current host"*. Spelled once, here, so the installer and `f3`'s command
/// surface cannot disagree about what was registered.
pub const DAEMON_ARGUMENTS: [&str; 2] = ["daemon", "run"];

/// The file `install` writes and `status` reads, inside `config/`.
///
/// `config/` and not `state/`: `05-infrastructure.md` gives `config/` to
/// *"non-secret TOML"*, and this is exactly that — a record of what was
/// registered, holding no credential. It is also the one file `uninstall`
/// removes, which is what keeps "uninstall deletes no configuration" honest:
/// the record is not configuration, it is the registration's own footprint.
pub const RECORD_FILE: &str = "service.toml";

/// The file the daemon touches after every successful GitHub call, inside
/// `state/`.
///
/// See [`record_github_contact`] for the contract; `service status` reads it
/// and Journey 5 step 4 requires it.
pub const CONTACT_FILE: &str = "github-contact.toml";

/// Present while GitHub is rejecting the daemon's credential, inside `state/`.
///
/// See [`record_github_credential_rejected`] for the contract.
pub const CREDENTIAL_REJECTION_FILE: &str = "github-credential-rejected.toml";

/// Present while the daemon cannot read its own stored credential, inside
/// `state/`.
///
/// See [`record_credential_unreadable`] for the contract.
pub const CREDENTIAL_UNREADABLE_FILE: &str = "credential-unreadable.toml";

/// The `service status` subject a [`CREDENTIAL_UNREADABLE_FILE`] is reported
/// under, which the TUI matches to offer the same command.
pub const CREDENTIAL_UNREADABLE_SUBJECT: &str = "stored credential";

/// The `service status` subject blocked runner launches are reported under.
pub const LAUNCHES_BLOCKED_SUBJECT: &str = "runner launches";

/// The [`StatusProblem::subject`] of a daemon that has stopped making progress.
pub const DAEMON_STALLED_SUBJECT: &str = "daemon progress";

/// The [`StatusProblem::subject`] of a daemon that refuses to start runners
/// because a required host check fails from its own session.
pub const HOST_UNFIT_SUBJECT: &str = "host fitness";

/// The agent's last runner-root refusal, for `service status` to report.
///
/// See [`record_runner_root_refusal`] for the contract.
pub const ROOT_REFUSAL_FILE: &str = "runner-root-refusal.toml";

/// The rotating diagnostic log the **daemon** writes, inside `logs/`.
///
/// The appender adds its own date suffix, so this is the stem rather than a
/// file that exists. `service status` reports the directory and the stem,
/// because that is what an operator needs in order to find today's file and
/// yesterday's.
///
/// It is [`crate::logging::SERVICE_LOG_STEM`] and not the operator's, because a
/// boot-mode daemon runs under a different account and writes a different file.
/// [`crate::logging::LogRole`] says why the two were separated.
pub const LOG_FILE_STEM: &str = crate::logging::SERVICE_LOG_STEM;

// ---------------------------------------------------------------------------
// Identity
// ---------------------------------------------------------------------------

/// What the operating system calls this registration.
///
/// A type rather than three constants, for one reason that is not tidiness: the
/// privileged installer tests register a **real** service on a **real** machine,
/// and they must not be able to collide with — or remove — an operator's
/// installation. [`ServiceIdentity::fixture`] produces a name that is
/// unmistakably a test artefact, and every backend takes its name from here, so
/// there is no path by which a test reaches the product's own registration.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ServiceIdentity {
    name: String,
    display_name: String,
    description: String,
}

impl ServiceIdentity {
    /// The registration an operator installs.
    #[must_use]
    pub fn product() -> Self {
        Self {
            name: SERVICE_NAME.to_string(),
            display_name: DISPLAY_NAME.to_string(),
            description: DESCRIPTION.to_string(),
        }
    }

    /// A disposable registration for a privileged test, named so that it cannot
    /// be mistaken for — or collide with — [`ServiceIdentity::product`].
    ///
    /// `tag` distinguishes concurrent runs; it is reduced to ASCII alphanumerics
    /// and `-` so that it is a legal service name, launchd label, systemd unit
    /// name, and Task Scheduler task name at once.
    #[must_use]
    pub fn fixture(tag: &str) -> Self {
        let tag: String = tag
            .chars()
            .map(|c| {
                if c.is_ascii_alphanumeric() {
                    c.to_ascii_lowercase()
                } else {
                    '-'
                }
            })
            .collect();
        let name = format!("{SERVICE_NAME}-selftest-{tag}");
        Self {
            display_name: format!("{DISPLAY_NAME} (self-test fixture {tag})"),
            description: "Disposable fixture created by runner-manager's own installer tests. \
                          Safe to remove."
                .to_string(),
            name,
        }
    }

    /// Whether this identity is a disposable test fixture.
    ///
    /// The privileged tests assert this before they delete anything, which is
    /// the mechanical half of *"never touch a service you did not create"*.
    #[must_use]
    pub fn is_fixture(&self) -> bool {
        self.name.starts_with(&format!("{SERVICE_NAME}-selftest-"))
    }

    /// The Windows service name, the systemd unit stem, and the Task Scheduler
    /// task name.
    #[must_use]
    pub fn name(&self) -> &str {
        &self.name
    }

    /// The human-readable name.
    #[must_use]
    pub fn display_name(&self) -> &str {
        &self.display_name
    }

    /// One line of explanation.
    #[must_use]
    pub fn description(&self) -> &str {
        &self.description
    }

    /// The launchd label — reverse-domain, as launchd expects.
    ///
    /// Built from the same three product segments [`crate::paths`] resolves the
    /// application-data directories with, so a label and a directory cannot
    /// drift apart.
    #[must_use]
    pub fn launchd_label(&self) -> String {
        format!(
            "{}.{}.{}",
            crate::paths::QUALIFIER,
            crate::paths::ORGANIZATION,
            self.name
        )
    }

    /// The systemd unit file name.
    #[must_use]
    pub fn systemd_unit(&self) -> String {
        format!("{}.service", self.name)
    }

    /// The service manager's own command that restarts this registration.
    ///
    /// The product has no `service stop` or `service start`, and
    /// `service install` is no restart either: it refuses while the running
    /// daemon holds the agent lock. So a remedy that restarts the daemon names
    /// the service manager's command. A forced restart does not wait for jobs;
    /// it is for a daemon that has stopped making progress anyway.
    #[must_use]
    pub fn restart_command(&self, mode: StartMode) -> String {
        let name = &self.name;
        if cfg!(windows) {
            match mode {
                StartMode::Boot => {
                    format!("Restart-Service -Name {name}")
                }
                StartMode::Login => format!("schtasks /End /TN {name}; schtasks /Run /TN {name}"),
            }
        } else if cfg!(target_os = "macos") {
            let label = self.launchd_label();
            match mode {
                StartMode::Boot => format!("sudo launchctl kickstart -k system/{label}"),
                StartMode::Login => format!("launchctl kickstart -k gui/$(id -u)/{label}"),
            }
        } else {
            let unit = self.systemd_unit();
            match mode {
                StartMode::Boot => format!("sudo systemctl restart {unit}"),
                StartMode::Login => format!("systemctl --user restart {unit}"),
            }
        }
    }
}

impl fmt::Display for ServiceIdentity {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(&self.name)
    }
}

// ---------------------------------------------------------------------------
// Restart policy
// ---------------------------------------------------------------------------

/// The restart-on-failure policy, and the bound on how fast it may retry.
///
/// `05-infrastructure.md` item 3: *"set a restart-on-failure policy with bounded
/// delay"*. Both halves matter and they are different requirements. A service
/// that does not come back after a crash defeats Journey 5; a service that comes
/// back instantly, forever, turns one bad configuration into a fork bomb against
/// GitHub's rate limit. So the delay has a floor as well as a ceiling, and the
/// floor is what `does not restart-loop faster than that bound` is measured
/// against.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct RestartPolicy {
    delay: Duration,
    reset_after: Duration,
}

impl RestartPolicy {
    /// The shortest delay this will accept.
    ///
    /// One second is not a tuning preference. Below it, launchd's own throttle
    /// and systemd's start-limit logic both take over and the configured number
    /// stops being the number in force, so a policy under this floor would be a
    /// value `service status` reported and the platform ignored.
    pub const MIN_DELAY: Duration = Duration::from_secs(1);

    /// The longest delay this will accept. Past five minutes an operator
    /// watching a restart would reasonably conclude the service is simply gone.
    pub const MAX_DELAY: Duration = Duration::from_secs(300);

    /// What `service install` uses when nothing is said.
    pub const DEFAULT_DELAY: Duration = Duration::from_secs(15);

    /// How long the service must stay up before its failure count is forgotten.
    pub const DEFAULT_RESET_AFTER: Duration = Duration::from_secs(600);

    /// # Errors
    ///
    /// [`ServiceError::RestartDelay`] when `delay` is outside
    /// [`RestartPolicy::MIN_DELAY`]..=[`RestartPolicy::MAX_DELAY`], or when
    /// `reset_after` is not longer than `delay` — a reset window shorter than
    /// the delay can never elapse between two restarts, so the failure count
    /// would reset on every attempt and no start-limit could ever trip.
    pub fn new(delay: Duration, reset_after: Duration) -> Result<Self, ServiceError> {
        if delay < Self::MIN_DELAY || delay > Self::MAX_DELAY {
            return Err(ServiceError::RestartDelay {
                requested_secs: delay.as_secs(),
                min_secs: Self::MIN_DELAY.as_secs(),
                max_secs: Self::MAX_DELAY.as_secs(),
            });
        }
        if reset_after <= delay {
            return Err(ServiceError::RestartResetWindow {
                reset_secs: reset_after.as_secs(),
                delay_secs: delay.as_secs(),
            });
        }
        Ok(Self { delay, reset_after })
    }

    /// How long the service manager waits before restarting a failed service.
    #[must_use]
    pub const fn delay(&self) -> Duration {
        self.delay
    }

    /// How long the service must run before its failure count resets.
    #[must_use]
    pub const fn reset_after(&self) -> Duration {
        self.reset_after
    }

    /// The delay a given manager can actually express.
    ///
    /// Three of the four take seconds and enforce exactly what they are given.
    /// **Windows Task Scheduler does not**: `RestartOnFailure/Interval` is
    /// expressed in whole minutes with a one-minute floor, and it *rejects* the
    /// registration outright rather than rounding — `PT15S` comes back as
    /// "The task XML contains a value which is incorrectly formatted or out of
    /// range", which is how this was found.
    ///
    /// So the interval is rounded **up**, never down, and never below one
    /// minute. The direction is the point: the requirement is that the service
    /// *"does not restart-loop faster than that bound"*, and a delay longer
    /// than the configured one still satisfies it, while a shorter one would
    /// not. `service status` reports the difference as a note so that an
    /// operator reading `15s` in the record and `60s` from the manager is told
    /// why rather than left to wonder.
    #[must_use]
    pub const fn effective_delay(&self, kind: DefinitionKind) -> Duration {
        match kind {
            DefinitionKind::WindowsScheduledTask => {
                let seconds = self.delay.as_secs();
                let minutes = seconds.div_ceil(60);
                Duration::from_secs(if minutes == 0 { 60 } else { minutes * 60 })
            }
            _ => self.delay,
        }
    }
}

impl Default for RestartPolicy {
    fn default() -> Self {
        Self {
            delay: Self::DEFAULT_DELAY,
            reset_after: Self::DEFAULT_RESET_AFTER,
        }
    }
}

impl fmt::Display for RestartPolicy {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(
            f,
            "restart after {}s, failure count resets after {}s",
            self.delay.as_secs(),
            self.reset_after.as_secs()
        )
    }
}

// ---------------------------------------------------------------------------
// The account
// ---------------------------------------------------------------------------

/// The account a registration runs under.
///
/// Not an operator choice. It is a function of the start mode and the platform,
/// because the start mode decides which secret store the daemon must read and
/// the store's own access control decides which accounts can read it. See
/// `docs/service-account.md`, and [`review_least_privilege`] for the check.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ServiceAccount {
    /// `NT AUTHORITY\SYSTEM`. The only stock Windows account named by the
    /// machine-scoped store's DACL.
    LocalSystem,
    /// `root`. What a LaunchDaemon and a systemd system unit run as, and what
    /// the macOS System Keychain's root-only master key requires.
    Root,
    /// The operator's own account, for a login-mode registration.
    InvokingUser,
}

impl ServiceAccount {
    /// The account a given kind of definition obliges.
    ///
    /// Keyed on the definition rather than on `cfg!(windows)`, and the
    /// difference is not academic: a Windows developer rendering the launchd
    /// property list would otherwise write `UserName = NT AUTHORITY\SYSTEM`
    /// into it, which is not an account macOS has. A definition's account is a
    /// property of the definition, and the whole point of rendering being pure
    /// is that any host can render any platform's and get the right answer.
    #[must_use]
    pub const fn for_definition(kind: DefinitionKind, mode: StartMode) -> Self {
        match (kind, mode) {
            (DefinitionKind::WindowsService, _) => Self::LocalSystem,
            (DefinitionKind::WindowsScheduledTask, _) | (_, StartMode::Login) => Self::InvokingUser,
            (_, StartMode::Boot) => Self::Root,
        }
    }

    /// The account the given start mode obliges on the platform this binary was
    /// built for.
    #[must_use]
    pub const fn for_start_mode(mode: StartMode) -> Self {
        Self::for_definition(host_definition_kind(mode), mode)
    }

    /// How the platform spells it.
    #[must_use]
    pub const fn as_str(&self) -> &'static str {
        match self {
            Self::LocalSystem => "NT AUTHORITY\\SYSTEM",
            Self::Root => "root",
            Self::InvokingUser => "the invoking user",
        }
    }

    /// Why this is the *minimum* account that can do the job, not merely the
    /// convenient one.
    ///
    /// Printed by `service status` and by [`review_least_privilege`], because a
    /// privileged account with no stated reason is indistinguishable from a
    /// privileged account nobody thought about.
    #[must_use]
    pub const fn justification(&self) -> &'static str {
        match self {
            Self::LocalSystem => {
                "the machine-scoped store's DACL names SY, BA and OW only; LocalService and \
                 NetworkService cannot read it, and widening the DACL to reach them would grant \
                 every service on this host read access to the one credential this product holds"
            }
            Self::Root => {
                "a boot-time registration runs outside every login session: on macOS the System \
                 Keychain is unlocked by /var/db/SystemKey, which is root-only, and on Linux the \
                 machine-scoped store is a 0600 file under /var/lib that only root can open \
                 before a session exists"
            }
            Self::InvokingUser => {
                "a login-mode registration reads the user-scoped store, which is deliberately \
                 readable by exactly one account and needs no elevation at all"
            }
        }
    }

    /// Whether registering under this account needs administrative rights.
    #[must_use]
    pub const fn needs_elevation(&self) -> bool {
        matches!(self, Self::LocalSystem | Self::Root)
    }
}

impl fmt::Display for ServiceAccount {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(self.as_str())
    }
}

// ---------------------------------------------------------------------------
// Errors
// ---------------------------------------------------------------------------

/// Something went wrong installing, inspecting, or removing the registration.
///
/// Every variant is formatted straight into an operator-facing message, so each
/// one says what to do next rather than only what failed. No variant carries a
/// secret: this module never reads the token, only the *location* `d2` publishes
/// for exactly this purpose.
#[derive(Debug, thiserror::Error)]
pub enum ServiceError {
    /// The single-instance lock is held, so a second agent must not be
    /// registered.
    ///
    /// `05-infrastructure.md` item 1. The message is `d1`'s, verbatim, because
    /// `d1` already worked out what to tell an operator who lost that race.
    #[error("cannot install the service while an agent is already running on this host: {source}")]
    LockHeld {
        /// What `d1` said, including who holds it.
        #[source]
        source: Box<LockError>,
    },

    /// The lock could not be inspected at all, which is not the same as it being
    /// free.
    #[error(
        "cannot tell whether an agent is already running on this host, so the service was not \
         installed: {source}. Fix the reported problem with the state directory and try again."
    )]
    LockUnreadable {
        /// The underlying failure.
        #[source]
        source: Box<LockError>,
    },

    /// The runner root this registration would run jobs under could not be
    /// created, inspected, or given the access the registration's account needs.
    ///
    /// Reported *before* anything is registered. A registration whose workspaces
    /// would land in a directory ordinary local users can write is a
    /// registration that should not exist, and `04-security-recovery.md` asks
    /// for exactly that refusal rather than a warning.
    #[error(
        "this registration would run jobs under the default runner root, and that root could \
         not be prepared, so nothing was registered: {source}"
    )]
    RunnerRoot {
        /// What [`crate::runner_root_access`] reported, including the remedy.
        #[source]
        source: Box<RootAccessError>,
    },

    /// The path of the running binary could not be resolved.
    #[error(
        "cannot resolve the absolute path of this executable, so there is nothing to register: \
         {detail}. Run the installer from the installed binary rather than through a shell \
         function or a wrapper that replaces argv[0]."
    )]
    BinaryPath {
        /// What the platform reported.
        detail: String,
    },

    /// The binary named for the registration is not there.
    #[error(
        "{} is not a file, so registering it would create a service that cannot start. Install \
         the product first, then run `service install` from the installed binary.",
        path.display()
    )]
    BinaryMissing {
        /// The path that was to be registered.
        path: PathBuf,
    },

    /// The requested restart delay is outside the bound.
    #[error(
        "a restart delay of {requested_secs}s is outside the supported range \
         {min_secs}s-{max_secs}s. Below the floor the platform's own throttle overrides the \
         value, so `service status` would report a delay that is not the one in force."
    )]
    RestartDelay {
        /// What was asked for.
        requested_secs: u64,
        /// The floor.
        min_secs: u64,
        /// The ceiling.
        max_secs: u64,
    },

    /// The failure-count reset window is not longer than the restart delay.
    #[error(
        "a failure-count reset window of {reset_secs}s is not longer than the {delay_secs}s \
         restart delay, so the count would reset between every pair of restarts and no \
         start limit could ever apply."
    )]
    RestartResetWindow {
        /// What was asked for.
        reset_secs: u64,
        /// The delay it has to exceed.
        delay_secs: u64,
    },

    /// A registration is already there, in the **other** start mode.
    ///
    /// Only the other one. A registration in the mode being asked for is
    /// replaced rather than refused — see [`Operations::install`], and the
    /// outage that taught us why.
    #[error(
        "{name} is already registered to start at {existing}, and this asks for {requested}. \
         Changing the start mode moves the registration between two different service \
         managers, so it is not something an install does by itself: run `service uninstall` \
         first, or change the start mode in the terminal UI (`runner-manager tui`), which \
         switches it in place and keeps the registration running throughout."
    )]
    AlreadyInstalled {
        /// Which registration.
        name: String,
        /// The mode it currently carries.
        existing: StartMode,
        /// The mode this install asked for.
        requested: StartMode,
    },

    /// No registration is there.
    #[error("{name} is not registered on this host, so there is nothing to {operation}.")]
    NotInstalled {
        /// Which registration.
        name: String,
        /// What was being attempted.
        operation: &'static str,
    },

    /// The record `install` wrote could not be read or written.
    #[error("cannot {operation} the service record {}: {detail}", path.display())]
    Record {
        /// Read, write, or remove.
        operation: &'static str,
        /// The record file.
        path: PathBuf,
        /// The underlying failure.
        detail: String,
    },

    /// The record is there but is not one this version wrote.
    #[error(
        "the service record {} was not written by this product, or was written by a version \
         this one cannot read: {detail}. Run `service uninstall` and `service install` again; \
         neither touches configuration, secrets, or the cache.",
        path.display()
    )]
    RecordUnreadable {
        /// The record file.
        path: PathBuf,
        /// What was wrong with it.
        detail: String,
    },

    /// The record is there and **this account** may not read it.
    ///
    /// Its own variant rather than a [`ServiceError::Record`] with a
    /// `Permission denied` in the detail, because it is the one record failure
    /// that is not a fault in the record: `service status` reports it and
    /// carries on, where every other read failure ends the command. See
    /// [`Operations::status`].
    ///
    /// A version before this one wrote the record at `0600` through a temporary
    /// file, so a boot-mode `sudo service install` left it owned by `root` and
    /// unreadable by the operator whose profile it is in. `service status` then
    /// failed on their own host, with a remedy naming the command that had just
    /// failed.
    #[error(
        "the service record {} is there and this account may not read it: {detail}. It was \
         written by whichever account installed the service -- on a boot-mode host, `sudo \
         service install`. Running `service install` again rewrites it readable; until then \
         only what the service manager itself reports is available.",
        path.display()
    )]
    RecordNotPermitted {
        /// The record file.
        path: PathBuf,
        /// What the operating system said.
        detail: String,
    },

    /// The application-data directories could not be resolved or created.
    #[error("cannot prepare this host's application-data directories: {source}")]
    Paths {
        /// The underlying failure.
        #[source]
        source: Box<crate::paths::PathsError>,
    },

    /// The platform's service manager refused, or could not be reached.
    #[error("cannot {operation} {name} through {manager}: {detail}")]
    Control {
        /// What was being attempted.
        operation: &'static str,
        /// Which registration.
        name: String,
        /// Which service manager.
        manager: &'static str,
        /// What it said.
        detail: String,
    },

    /// An operation failed and its compensating action failed too.
    #[error(
        "cannot {operation} {name}: {cause}. The attempted rollback also failed: {rollback}. \
         Inspect `service status` before retrying."
    )]
    Rollback {
        /// The transaction that could not be completed.
        operation: &'static str,
        /// Which registration was involved.
        name: String,
        /// The original failure.
        cause: String,
        /// The failure while restoring the previous state.
        rollback: String,
    },

    /// The machine's registration is another installation's (see
    /// [`ForeignService`]), and changing it from this account would act on it
    /// with this account's directories.
    #[error(
        "this machine's {name} service was installed from {installed_by}, not from this \
         account's data root, so this account does not {operation} it: doing so would \
         re-register or remove that installation's service with this account's directories. \
         Do it {act_as}. If that account no longer exists, remove the registration with the \
         service manager itself first."
    )]
    ForeignInstallation {
        /// Which registration.
        name: String,
        /// What was refused.
        operation: &'static str,
        /// [`ForeignService::installed_by`].
        installed_by: String,
        /// [`ForeignService::act_as`].
        act_as: String,
    },

    /// `host forget-local` found this account's configuration in use, and
    /// moved nothing.
    #[error("this account's local configuration is in use, so nothing was archived: {detail}.")]
    LocalConfigurationInUse {
        /// What uses it.
        detail: String,
    },

    /// The operation needs administrative rights it does not have.
    #[error("{operation} {name} needs administrative rights: {detail}. {remedy}")]
    NeedsElevation {
        /// What was being attempted.
        operation: &'static str,
        /// Which registration.
        name: String,
        /// What the platform said.
        detail: String,
        /// How to get them, in this platform's own terms.
        remedy: &'static str,
    },
}

// ---------------------------------------------------------------------------
// Directories
// ---------------------------------------------------------------------------

/// The four directories the registration was installed against.
///
/// Recorded rather than re-derived, because `05-infrastructure.md` item 2 speaks
/// of the *configured* cache and runtime directories: the account the service
/// runs under and the account that ran `service install` do not always resolve
/// the same platform-standard locations, and a claim about what the service can
/// write is only checkable against a specific set of paths.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ServiceDirectories {
    /// Non-secret TOML and the SQLite database.
    pub config: PathBuf,
    /// The agent lock, the attempt journal, and the runner package cache.
    pub state: PathBuf,
    /// Per-attempt disposable runner workspaces.
    pub runtime: PathBuf,
    /// Rotating redacted diagnostics.
    pub logs: PathBuf,
}

impl ServiceDirectories {
    /// Snapshots the four directories a resolved [`AppPaths`] names.
    #[must_use]
    pub fn of(paths: &AppPaths) -> Self {
        Self {
            config: paths.config_dir().to_path_buf(),
            state: paths.state_dir().to_path_buf(),
            runtime: paths.runtime_dir().to_path_buf(),
            logs: paths.logs_dir().to_path_buf(),
        }
    }

    /// The four, in the order `05-infrastructure.md` lists them.
    #[must_use]
    pub fn all(&self) -> [&Path; 4] {
        [
            self.config.as_path(),
            self.state.as_path(),
            self.runtime.as_path(),
            self.logs.as_path(),
        ]
    }

    /// The rotating diagnostic log's stem, which is what `service status`
    /// reports and what `05-infrastructure.md` item 4 requires be preserved.
    #[must_use]
    pub fn log_file(&self) -> PathBuf {
        self.logs.join(LOG_FILE_STEM)
    }

    /// The four as the hidden `daemon run` options a registration passes them
    /// in, [`SERVICE_DIRECTORY_OPTIONS`] order.
    #[must_use]
    pub fn arguments(&self) -> [OsString; 8] {
        let [config, state, runtime, logs] = SERVICE_DIRECTORY_OPTIONS.map(OsString::from);
        [
            config,
            self.config.clone().into_os_string(),
            state,
            self.state.clone().into_os_string(),
            runtime,
            self.runtime.clone().into_os_string(),
            logs,
            self.logs.clone().into_os_string(),
        ]
    }

    /// Reads the four back out of a registration's command line.
    ///
    /// `None` unless all four options are there: a registration made before
    /// they existed starts the daemon against whatever its account's
    /// platform-standard directories are, and which those are cannot be told
    /// from here.
    #[must_use]
    pub fn from_command_line(command_line: &str) -> Option<Self> {
        let arguments = split_command_line(command_line);
        let value = |option: &str| {
            let at = arguments.iter().position(|argument| argument == option)?;
            arguments.get(at + 1).map(PathBuf::from)
        };
        let [config, state, runtime, logs] = SERVICE_DIRECTORY_OPTIONS;
        Some(Self {
            config: value(config)?,
            state: value(state)?,
            runtime: value(runtime)?,
            logs: value(logs)?,
        })
    }

    /// The deepest directory all four sit under: what an operator would call
    /// the installation's data root. The configuration directory when they
    /// share nothing, and [`crate::paths::SYSTEM_DATA_ROOT`] for the system
    /// tree, whose logs are under `/var/log` rather than beside the rest.
    #[must_use]
    pub fn root(&self) -> PathBuf {
        if *self == Self::of(&AppPaths::system()) {
            return PathBuf::from(crate::paths::SYSTEM_DATA_ROOT);
        }
        let mut shared: Vec<std::path::Component<'_>> = self.config.components().collect();
        for other in [&self.state, &self.runtime, &self.logs] {
            let common = shared
                .iter()
                .zip(other.components())
                .take_while(|(left, right)| **left == *right)
                .count();
            shared.truncate(common);
        }
        if shared.is_empty() {
            self.config.clone()
        } else {
            shared.iter().collect()
        }
    }

    /// The four as an [`AppPaths`], to read the records a daemon running
    /// against them writes.
    #[must_use]
    pub fn paths(&self) -> AppPaths {
        AppPaths::from_directories(&self.config, &self.state, &self.runtime, &self.logs)
    }
}

/// The hidden `daemon run` options that carry the installing account's four
/// application-data directories across to the service's account, in
/// [`ServiceDirectories`] order. Written by `service install`, and read back
/// by [`ServiceDirectories::from_command_line`] to tell whose data root a
/// registration runs against.
pub const SERVICE_DIRECTORY_OPTIONS: [&str; 4] = [
    "--service-config-dir",
    "--service-state-dir",
    "--service-runtime-dir",
    "--service-logs-dir",
];

// ---------------------------------------------------------------------------
// The install plan
// ---------------------------------------------------------------------------

/// What `service install` was asked for, before anything has been resolved.
///
/// Separate from [`InstallPlan`] because a request is the operator's words and
/// a plan is what the host actually supports: the plan carries a *resolved
/// absolute* binary path, the account the start mode obliges, and the four
/// directories the registration is installed against, none of which the caller
/// supplies.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct InstallRequest {
    start_mode: StartMode,
    binary: Option<PathBuf>,
    source_binary: Option<PathBuf>,
    arguments: Vec<OsString>,
    restart: RestartPolicy,
    on_demand: bool,
    protected: Vec<PathBuf>,
}

impl InstallRequest {
    /// Register the binary that is running this call.
    #[must_use]
    pub fn new(start_mode: StartMode) -> Self {
        Self {
            start_mode,
            binary: None,
            source_binary: None,
            arguments: DAEMON_ARGUMENTS.iter().map(OsString::from).collect(),
            restart: RestartPolicy::default(),
            on_demand: false,
            protected: Vec::new(),
        }
    }

    /// Host paths the service, its runners and their jobs may not reach at
    /// all. See [`ProtectedPaths`].
    #[must_use]
    pub fn protecting(mut self, paths: Vec<PathBuf>) -> Self {
        self.protected = paths;
        self
    }

    /// Registers the service but does not ask the manager to start it by
    /// itself.
    ///
    /// Production never uses this: a boot-mode registration that does not start
    /// at boot is the failure `service status` reports. **The privileged
    /// installer tests use it for every fixture they create**, so that a
    /// registration which somehow escaped its cleanup guard cannot start with
    /// the owner's machine on the next reboot. A leaked service is bad; a
    /// leaked service that runs is worse, and the difference costs one flag.
    #[must_use]
    pub const fn started_on_demand(mut self) -> Self {
        self.on_demand = true;
        self
    }

    /// Register a named binary instead of the running one.
    ///
    /// The privileged installer tests use this to register a fixture service
    /// host. Production does not: `05-infrastructure.md` item 6 is specifically
    /// about the path of *the running binary*, and letting an operator name a
    /// different one would defeat the stale-path detection it asks for.
    #[must_use]
    pub fn for_binary(mut self, binary: impl Into<PathBuf>) -> Self {
        self.binary = Some(binary.into());
        self
    }

    /// Where the registered binary was copied from.
    ///
    /// # Why a registration has a source at all
    ///
    /// A service registered directly against a package manager's own file can
    /// never be upgraded on Windows, because the running service holds that
    /// file open and `npm i -g` cannot replace it. What it does instead is
    /// worse than failing: it rewrites the package metadata, reports success,
    /// and leaves the old executable in place — so the operator is told the new
    /// version is installed while the old one keeps running. That was observed,
    /// twice in a row, before this existed.
    ///
    /// So the service runs a copy the product owns, and this records where that
    /// copy came from. The source is what a package manager updates, what
    /// [`inspect_binary`] watches for item 6's stale-path case, and what the
    /// daemon compares its own version against to know an upgrade is waiting.
    #[must_use]
    pub fn copied_from(mut self, source: impl Into<PathBuf>) -> Self {
        self.source_binary = Some(source.into());
        self
    }

    /// Replace the registered arguments. Defaults to [`DAEMON_ARGUMENTS`].
    #[must_use]
    pub fn with_arguments<I, S>(mut self, arguments: I) -> Self
    where
        I: IntoIterator<Item = S>,
        S: Into<OsString>,
    {
        self.arguments = arguments.into_iter().map(Into::into).collect();
        self
    }

    /// Replace the restart-on-failure policy. Defaults to
    /// [`RestartPolicy::default`].
    #[must_use]
    pub const fn with_restart(mut self, restart: RestartPolicy) -> Self {
        self.restart = restart;
        self
    }

    /// The start mode asked for.
    #[must_use]
    pub const fn start_mode(&self) -> StartMode {
        self.start_mode
    }
}

/// Everything a backend needs, resolved and validated.
///
/// Constructing one is where `05-infrastructure.md` item 6 is actually
/// satisfied: the binary path is made absolute and is confirmed to be a file
/// *before* anything is registered, so a registration that would fail at boot
/// is refused at install time instead.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct InstallPlan {
    identity: ServiceIdentity,
    start_mode: StartMode,
    binary: PathBuf,
    source_binary: Option<PathBuf>,
    arguments: Vec<OsString>,
    account: ServiceAccount,
    restart: RestartPolicy,
    directories: ServiceDirectories,
    secret_guard: Option<PathBuf>,
    on_demand: bool,
    protected: Vec<PathBuf>,
}

impl InstallPlan {
    /// Resolves a request against this host.
    ///
    /// # Errors
    ///
    /// [`ServiceError::BinaryPath`] when the running executable cannot be
    /// located, and [`ServiceError::BinaryMissing`] when the path that would be
    /// registered is not a file.
    pub fn resolve(
        identity: ServiceIdentity,
        request: &InstallRequest,
        directories: ServiceDirectories,
    ) -> Result<Self, ServiceError> {
        let binary = match &request.binary {
            Some(named) => absolute(named)?,
            None => running_executable()?,
        };
        if !binary.is_file() {
            return Err(ServiceError::BinaryMissing { path: binary });
        }
        // `d2` publishes the guard file the store lives in so the systemd
        // sandbox can admit only its parent for atomic token rotation. A store
        // that cannot be resolved is not fatal here; it merely cannot receive
        // that narrow writable-path exception.
        let secret_guard = crate::secrets::PlatformSecretStore::for_start_mode(request.start_mode)
            .ok()
            .map(|store| store.guard());
        Ok(Self {
            identity,
            start_mode: request.start_mode,
            binary,
            source_binary: request.source_binary.clone(),
            arguments: request.arguments.clone(),
            account: ServiceAccount::for_start_mode(request.start_mode),
            restart: request.restart,
            directories,
            secret_guard,
            on_demand: request.on_demand,
            protected: request.protected.clone(),
        })
    }

    /// Builds a plan from values a caller already holds, without touching the
    /// filesystem.
    ///
    /// This is what makes the renderers testable on a host that has none of the
    /// paths involved: a Windows developer can render the systemd unit for
    /// `/opt/runner-manager/bin/runner-manager` and assert every line of it.
    #[must_use]
    pub fn unchecked(
        identity: ServiceIdentity,
        start_mode: StartMode,
        binary: impl Into<PathBuf>,
        directories: ServiceDirectories,
    ) -> Self {
        Self {
            identity,
            start_mode,
            binary: binary.into(),
            source_binary: None,
            arguments: DAEMON_ARGUMENTS.iter().map(OsString::from).collect(),
            account: ServiceAccount::for_start_mode(start_mode),
            restart: RestartPolicy::default(),
            directories,
            secret_guard: None,
            on_demand: false,
            protected: Vec::new(),
        }
    }

    /// The same plan with `paths` made inaccessible. See [`ProtectedPaths`].
    #[must_use]
    pub fn with_protected_paths(mut self, paths: Vec<PathBuf>) -> Self {
        self.protected = paths;
        self
    }

    /// The host paths the service and its jobs may not reach.
    #[must_use]
    pub fn protected_paths(&self) -> &[PathBuf] {
        &self.protected
    }

    /// Registers without arming the manager's automatic start. See
    /// [`InstallRequest::started_on_demand`].
    #[must_use]
    pub const fn started_on_demand(mut self) -> Self {
        self.on_demand = true;
        self
    }

    /// Whether the manager was asked not to start this by itself.
    #[must_use]
    pub const fn is_on_demand(&self) -> bool {
        self.on_demand
    }

    /// Names the file the secret store lives in, so systemd can permit atomic
    /// replacement of it under `ProtectSystem=strict`.
    ///
    /// [`InstallPlan::resolve`] fills this from `d2`; a test names it directly
    /// so that a Windows or macOS CI leg can assert the Linux unit's writable
    /// path for a store that platform does not have.
    #[must_use]
    pub fn with_secret_guard(mut self, guard: impl Into<PathBuf>) -> Self {
        self.secret_guard = Some(guard.into());
        self
    }

    /// The file the machine-scoped secret store lives in, when one resolved.
    #[must_use]
    pub fn secret_guard(&self) -> Option<&Path> {
        self.secret_guard.as_deref()
    }

    /// Overrides the restart policy on an already-built plan.
    #[must_use]
    pub const fn with_restart(mut self, restart: RestartPolicy) -> Self {
        self.restart = restart;
        self
    }

    /// Overrides the registered arguments on an already-built plan.
    #[must_use]
    pub fn with_arguments<I, S>(mut self, arguments: I) -> Self
    where
        I: IntoIterator<Item = S>,
        S: Into<OsString>,
    {
        self.arguments = arguments.into_iter().map(Into::into).collect();
        self
    }

    /// What the operating system calls this registration.
    #[must_use]
    pub const fn identity(&self) -> &ServiceIdentity {
        &self.identity
    }

    /// Boot or login.
    #[must_use]
    pub const fn start_mode(&self) -> StartMode {
        self.start_mode
    }

    /// The resolved absolute path of the binary to register.
    #[must_use]
    pub fn binary(&self) -> &Path {
        &self.binary
    }

    /// Where [`Self::binary`] was copied from, when it is a copy.
    ///
    /// `None` is the legacy layout: the registration names the file a package
    /// manager owns, and cannot be upgraded while it runs. See
    /// [`InstallRequest::copied_from`].
    #[must_use]
    pub fn source_binary(&self) -> Option<&Path> {
        self.source_binary.as_deref()
    }

    /// The arguments it is registered with.
    #[must_use]
    pub fn arguments(&self) -> &[OsString] {
        &self.arguments
    }

    /// The account it runs under.
    #[must_use]
    pub const fn account(&self) -> &ServiceAccount {
        &self.account
    }

    /// The restart-on-failure policy.
    #[must_use]
    pub const fn restart(&self) -> RestartPolicy {
        self.restart
    }

    /// The four directories it was installed against.
    #[must_use]
    pub const fn directories(&self) -> &ServiceDirectories {
        &self.directories
    }

    /// The command line as one string, quoted the way each platform expects.
    #[must_use]
    pub fn command_line(&self) -> String {
        let mut out = quote_argument(&self.binary.to_string_lossy());
        for argument in &self.arguments {
            out.push(' ');
            out.push_str(&quote_argument(&argument.to_string_lossy()));
        }
        out
    }
}

/// Undoes a runner-root change, and says what could not be undone.
///
/// `None` when the rollback was complete — either because there was nothing to
/// undo, or because the directory this operation created was removed again and
/// the descriptor it replaced was written back. `Some` is the "report any
/// non-reversible existing directory state explicitly" half of the requirement,
/// and the caller folds it into the failure it was already reporting.
fn retained_runner_root(change: &RootAccessChange) -> Option<String> {
    let reversal = change.revert();
    matches!(reversal, Reversal::Retained { .. }).then(|| reversal.to_string())
}

/// The error a failed step returns once both of its rollbacks have been
/// attempted.
///
/// `retained` is [`retained_runner_root`]'s answer and `rollback` is what
/// undoing the *registration* reported — whatever it reports on success, which
/// a failure has no use for. Both arrive already evaluated, because each may be
/// attempted exactly once and the order is the caller's to choose.
///
/// A complete rollback leaves `cause` exactly as it was: the operator's problem
/// is what failed, not the tidying up afterwards. An incomplete one is promoted
/// to [`ServiceError::Rollback`], which is the variant that exists to say "this
/// failed *and* something is left behind" — and it names everything that did.
fn rolled_back<T>(
    retained: Option<String>,
    rollback: Result<T, ServiceError>,
    operation: &'static str,
    identity: &ServiceIdentity,
    cause: ServiceError,
) -> ServiceError {
    let left_behind = match (rollback.err(), retained) {
        (Some(rollback), Some(retained)) => Some(format!("{rollback}; {retained}")),
        (Some(rollback), None) => Some(rollback.to_string()),
        (None, retained) => retained,
    };
    match left_behind {
        Some(rollback) => ServiceError::Rollback {
            operation,
            name: identity.name().to_string(),
            cause: cause.to_string(),
            rollback,
        },
        None => cause,
    }
}

/// [`rolled_back`] for a failure with nothing registered yet, where the runner
/// root is the only thing there is to undo.
fn undo_runner_root(
    change: &RootAccessChange,
    operation: &'static str,
    identity: &ServiceIdentity,
    cause: ServiceError,
) -> ServiceError {
    rolled_back(
        retained_runner_root(change),
        Ok(()),
        operation,
        identity,
        cause,
    )
}

/// Makes a path absolute without resolving symlinks.
///
/// Symbolic links are deliberately left alone. A Homebrew installation puts a
/// stable link at `/opt/homebrew/bin/runner-manager` and moves the file it
/// points at on every upgrade; recording the link's target would make an
/// ordinary `brew upgrade` look exactly like the npm failure this module exists
/// to detect, and recording the link records the thing the operator installed.
///
/// Linux is the one platform where this is not fully in the caller's hands:
/// `std::env::current_exe` reads `/proc/self/exe`, which the kernel has already
/// resolved. There the recorded path is the real file rather than the shim —
/// which is still correct for the npm case, because a real file under a Node
/// prefix disappears with the prefix.
fn absolute(path: &Path) -> Result<PathBuf, ServiceError> {
    std::path::absolute(path).map_err(|error| ServiceError::BinaryPath {
        detail: format!("{} could not be made absolute: {error}", path.display()),
    })
}

/// The absolute path of the executable running this call.
fn running_executable() -> Result<PathBuf, ServiceError> {
    let raw = std::env::current_exe().map_err(|error| ServiceError::BinaryPath {
        detail: error.to_string(),
    })?;
    absolute(&raw)
}

/// Quotes one command-line argument when it needs it.
///
/// The rule is Windows', because Windows is the platform where a command line is
/// a single string the callee re-splits, and because `windows-service` applies
/// exactly this rule when it builds `lpBinaryPathName`. The Unix backends embed
/// arguments in a plist array and in a systemd `ExecStart=`, both of which
/// accept the same quoting, so one rule serves all three rather than three
/// nearly-identical ones.
pub(crate) fn quote_argument(argument: &str) -> String {
    if !argument.is_empty() && !argument.contains([' ', '"', '\t', '\n']) {
        return argument.to_string();
    }
    let mut out = String::with_capacity(argument.len() + 2);
    out.push('"');
    let mut backslashes = 0usize;
    for c in argument.chars() {
        match c {
            '\\' => {
                backslashes += 1;
                out.push('\\');
            }
            '"' => {
                // Every backslash immediately before a quote must be doubled,
                // and the quote itself escaped.
                for _ in 0..=backslashes {
                    out.push('\\');
                }
                out.push('"');
                backslashes = 0;
            }
            other => {
                backslashes = 0;
                out.push(other);
            }
        }
    }
    // Trailing backslashes would otherwise escape the closing quote.
    for _ in 0..backslashes {
        out.push('\\');
    }
    out.push('"');
    out
}

/// Reads the executable back out of a command line quoted by
/// [`quote_argument`].
///
/// `service status` needs this because the Windows Service Control Manager
/// stores the binary and its arguments as one string and hands the whole thing
/// back from `QueryServiceConfigW`. Comparing a record against a registration
/// means splitting that string the same way Windows itself does.
///
/// Returns `None` for an empty or whitespace-only command line, which is the
/// only input with no first argument to find.
#[must_use]
pub fn executable_from_command_line(command_line: &str) -> Option<PathBuf> {
    split_command_line(command_line)
        .into_iter()
        .next()
        .filter(|executable| !executable.is_empty())
        .map(PathBuf::from)
}

/// Splits a command line quoted by [`quote_argument`] back into its
/// arguments, by the rule Windows itself applies: whitespace separates
/// arguments outside quotes, `2n` backslashes before a quote are `n`
/// backslashes and a quote that opens or closes, `2n+1` are `n` backslashes
/// and a literal quote, and every other backslash is literal.
#[must_use]
pub fn split_command_line(command_line: &str) -> Vec<String> {
    let mut arguments = Vec::new();
    let mut current = String::new();
    let mut started = false;
    let mut quoted = false;
    let mut backslashes = 0usize;
    for c in command_line.chars() {
        match c {
            '\\' => {
                backslashes += 1;
                started = true;
            }
            '"' => {
                current.extend(std::iter::repeat_n('\\', backslashes / 2));
                if backslashes.is_multiple_of(2) {
                    quoted = !quoted;
                } else {
                    current.push('"');
                }
                backslashes = 0;
                started = true;
            }
            ' ' | '\t' if !quoted => {
                current.extend(std::iter::repeat_n('\\', backslashes));
                backslashes = 0;
                if started {
                    arguments.push(std::mem::take(&mut current));
                    started = false;
                }
            }
            other => {
                current.extend(std::iter::repeat_n('\\', backslashes));
                backslashes = 0;
                current.push(other);
                started = true;
            }
        }
    }
    current.extend(std::iter::repeat_n('\\', backslashes));
    if started {
        arguments.push(current);
    }
    arguments
}

// ---------------------------------------------------------------------------
// Rendered definitions
// ---------------------------------------------------------------------------

/// Which of the four things a platform reads.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum DefinitionKind {
    /// The parameters `CreateServiceW` is called with, rendered as a canonical
    /// descriptor so that they can be reviewed and asserted like the other
    /// three. The Service Control Manager has no file.
    WindowsService,
    /// A Task Scheduler XML document, for `--start-at login` on Windows.
    WindowsScheduledTask,
    /// A launchd property list — a LaunchDaemon at boot, a LaunchAgent at login.
    LaunchdPlist,
    /// A systemd unit — a system unit at boot, a user unit at login.
    SystemdUnit,
}

impl DefinitionKind {
    /// What to call the thing that reads it, in an operator-facing message.
    #[must_use]
    pub const fn manager(self) -> &'static str {
        match self {
            Self::WindowsService => "the Windows Service Control Manager",
            Self::WindowsScheduledTask => "Windows Task Scheduler",
            Self::LaunchdPlist => "launchd",
            Self::SystemdUnit => "systemd",
        }
    }
}

impl fmt::Display for DefinitionKind {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(self.manager())
    }
}

/// One platform's definition of the registration, as text.
///
/// Producing this is pure: no `cfg`, no privileges, no filesystem. That is what
/// lets every leg of the CI matrix assert every platform's definition, instead
/// of each leg asserting only its own and the other two being reviewed by
/// reading.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ServiceDefinition {
    kind: DefinitionKind,
    text: String,
    install_path: Option<PathBuf>,
}

impl ServiceDefinition {
    /// Which platform this is for.
    #[must_use]
    pub const fn kind(&self) -> DefinitionKind {
        self.kind
    }

    /// The definition itself.
    #[must_use]
    pub fn text(&self) -> &str {
        &self.text
    }

    /// Where the platform expects the file, when the platform reads a file.
    ///
    /// `None` for [`DefinitionKind::WindowsService`], whose "definition" is a
    /// set of arguments to `CreateServiceW`, and for a Task Scheduler document,
    /// which is handed to `schtasks` from a temporary file and is not stored
    /// where it was written.
    #[must_use]
    pub fn install_path(&self) -> Option<&Path> {
        self.install_path.as_deref()
    }

    /// The definition this host's own service manager would be given.
    ///
    /// The value-level twin of [`host_definition_kind`]. Rendering needs no
    /// privileges and no service manager, so anything that wants to *see* what
    /// an install would register — `f3`'s `service install --dry-run`, a
    /// support bundle, [`RecordingControls`] — can have it without registering
    /// anything.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Control`] when a Windows logon-triggered registration is
    /// asked for and the session reports no account to register it for.
    pub fn for_host(plan: &InstallPlan) -> Result<Self, ServiceError> {
        Ok(match host_definition_kind(plan.start_mode()) {
            DefinitionKind::WindowsService => Self::windows_service(plan),
            DefinitionKind::WindowsScheduledTask => {
                Self::windows_scheduled_task(plan, &TaskPrincipal::current()?)
            }
            DefinitionKind::LaunchdPlist => Self::launchd(plan, host_home().as_deref()),
            DefinitionKind::SystemdUnit => Self::systemd(plan, host_home().as_deref()),
        })
    }

    /// The Windows service parameters, as a canonical descriptor.
    #[must_use]
    pub fn windows_service(plan: &InstallPlan) -> Self {
        Self {
            kind: DefinitionKind::WindowsService,
            text: windows_service_descriptor(plan),
            install_path: None,
        }
    }

    /// A Task Scheduler document for `--start-at login`.
    #[must_use]
    pub fn windows_scheduled_task(plan: &InstallPlan, principal: &TaskPrincipal) -> Self {
        Self {
            kind: DefinitionKind::WindowsScheduledTask,
            text: windows_scheduled_task_xml(plan, principal),
            install_path: None,
        }
    }

    /// A launchd property list.
    ///
    /// `home` is only consulted for `--start-at login`, where the file belongs
    /// in the operator's own `~/Library/LaunchAgents`.
    #[must_use]
    pub fn launchd(plan: &InstallPlan, home: Option<&Path>) -> Self {
        let file = format!("{}.plist", plan.identity().launchd_label());
        let install_path = match plan.start_mode() {
            StartMode::Boot => Some(PathBuf::from(LAUNCH_DAEMONS_DIR).join(file)),
            StartMode::Login => home.map(|home| home.join(LAUNCH_AGENTS_SUBDIR).join(file)),
        };
        Self {
            kind: DefinitionKind::LaunchdPlist,
            text: launchd_plist(plan),
            install_path,
        }
    }

    /// Wraps text this module did not render.
    ///
    /// Two callers need it and both matter. A test builds a deliberately
    /// widened definition and watches [`review_least_privilege`] reject it —
    /// without which the review would be a function nobody had ever seen fail.
    /// And `service status` can review the definition **actually on disk**,
    /// which on Linux and macOS an operator is free to edit after installation.
    #[must_use]
    pub fn from_text(kind: DefinitionKind, text: impl Into<String>) -> Self {
        Self {
            kind,
            text: text.into(),
            install_path: None,
        }
    }

    /// A systemd unit.
    ///
    /// `home` is only consulted for `--start-at login`, where the unit belongs
    /// in the operator's own `~/.config/systemd/user`.
    #[must_use]
    pub fn systemd(plan: &InstallPlan, home: Option<&Path>) -> Self {
        let file = plan.identity().systemd_unit();
        let install_path = match plan.start_mode() {
            StartMode::Boot => Some(PathBuf::from(SYSTEMD_SYSTEM_DIR).join(file)),
            StartMode::Login => home.map(|home| home.join(SYSTEMD_USER_SUBDIR).join(file)),
        };
        Self {
            kind: DefinitionKind::SystemdUnit,
            text: systemd_unit(plan),
            install_path,
        }
    }
}

/// Where a LaunchDaemon lives.
pub const LAUNCH_DAEMONS_DIR: &str = "/Library/LaunchDaemons";
/// Where a LaunchAgent lives, under the operator's home directory.
pub const LAUNCH_AGENTS_SUBDIR: &str = "Library/LaunchAgents";
/// Where a systemd system unit lives.
pub const SYSTEMD_SYSTEM_DIR: &str = "/etc/systemd/system";
/// Where a systemd user unit lives, under the operator's home directory.
pub const SYSTEMD_USER_SUBDIR: &str = ".config/systemd/user";

/// The product's own page, cited by every definition so an operator who finds
/// one on a host can find out what put it there.
const DOCUMENTATION: &str = "https://github.com/IvanMurzak/GitHub-Runner-Scaler-UI";

/// How many consecutive failures the platform tolerates before it stops
/// retrying.
///
/// The companion to [`RestartPolicy::reset_after`]: the delay bounds how *fast*
/// a restart may come, and this bounds how *many* come before the host gives
/// up and leaves the failure visible instead of hiding it behind an endless
/// retry.
pub const START_LIMIT_BURST: u32 = 5;

// -- systemd -----------------------------------------------------------------

/// Renders the systemd unit for this plan.
///
/// # Why the sandbox is this tight, and what it costs
///
/// `05-infrastructure.md` item 2 ends *"and write its configured cache and
/// runtime directories — and no more"*. `ProtectSystem=strict` plus an explicit
/// `ReadWritePaths` is what "and no more" means on Linux: everything outside the
/// recorded application-data directories and the credential store directory
/// is read-only to this unit. The latter must be writable because refresh-token
/// rotation atomically replaces the credential file.
///
/// **The runner inherits it.** The agent spawns the GitHub Actions runner as a
/// child, so a workflow running on this host also runs inside this sandbox: it
/// cannot write outside those directories and its private `/tmp`, and
/// `NoNewPrivileges=yes` means it cannot `sudo`. `07-security.md` assumes a
/// hostile workflow may run here, so that is the intended direction — but it is
/// a real behavioural limit and `docs/service-account.md` states it where an
/// operator will find it.
#[must_use]
pub fn systemd_unit(plan: &InstallPlan) -> String {
    let identity = plan.identity();
    let restart = plan.restart();
    let directories = plan.directories();

    let mut out = String::new();
    out.push_str("[Unit]\n");
    out.push_str(&format!("Description={}\n", identity.display_name()));
    out.push_str(&format!("Documentation={DOCUMENTATION}\n"));
    out.push_str("After=network-online.target\n");
    out.push_str("Wants=network-online.target\n");
    // In `[Unit]` rather than `[Service]`: systemd moved these in v229 and only
    // accepts them here without a deprecation warning.
    out.push_str(&format!(
        "StartLimitIntervalSec={}\n",
        restart.reset_after().as_secs()
    ));
    out.push_str(&format!("StartLimitBurst={START_LIMIT_BURST}\n"));

    out.push_str("\n[Service]\n");
    out.push_str("Type=simple\n");
    // A runner is a child of the daemon. In particular, systemd must not
    // signal it merely because a cooperative daemon handover replaces the
    // manager process; startup recovery supervises any survivor instead.
    out.push_str("KillMode=process\n");
    out.push_str(&format!("ExecStart={}\n", plan.command_line()));
    out.push_str(&format!(
        "WorkingDirectory={}\n",
        directories.state.display()
    ));
    out.push_str(&format!("SyslogIdentifier={identity}\n"));
    out.push_str("Restart=on-failure\n");
    out.push_str(&format!("RestartSec={}\n", restart.delay().as_secs()));

    out.push_str("\n# Least privilege. See docs/service-account.md.\n");
    for directive in systemd_hardening(plan.start_mode()) {
        out.push_str(directive);
        out.push('\n');
    }
    let quoted = |paths: &[String]| {
        paths
            .iter()
            .map(|path| quote_argument(path))
            .collect::<Vec<_>>()
            .join(" ")
    };
    out.push_str(&format!(
        "ReadWritePaths={}\n",
        quoted(&permitted_paths(DefinitionKind::SystemdUnit, plan))
    ));
    if !plan.protected_paths().is_empty() {
        out.push_str(&format!(
            "InaccessiblePaths={}\n",
            inaccessible_entries(plan).join(" ")
        ));
    }

    out.push_str("\n[Install]\n");
    out.push_str(match plan.start_mode() {
        StartMode::Boot => "WantedBy=multi-user.target\n",
        StartMode::Login => "WantedBy=default.target\n",
    });
    out
}

/// The hardening directives every unit carries, in the order they are rendered.
///
/// One list, used by [`systemd_hardening`], so that [`review_least_privilege`]
/// is written against the same directives the renderer emits: a directive
/// dropped from the unit is one the review then reports as missing, rather
/// than one that silently stops being checked.
///
/// The capability bounding set listed here is a login unit's: empty. A boot
/// unit's is [`BOOT_CAPABILITIES`]; see [`systemd_hardening`].
///
/// # Why not `RestrictSUIDSGID=yes`
///
/// Its seccomp filter cannot inspect `openat2`'s flags, so it answers every
/// `openat2` with `ENOSYS`, expecting a fallback to `openat`. GNU tar 1.35
/// extracts through `openat2(..., RESOLVE_BENEATH)` and has none, so every
/// extraction in a job failed with "Cannot open: Function not implemented" --
/// and the runner unpacks every action it downloads with `tar`. Measured on
/// Ubuntu 26.04 with systemd 259. What the directive guarded against is
/// covered without it: `NoNewPrivileges=yes` makes a set-user-ID bit inert for
/// everything this unit starts, and the only places it can write are `root`'s
/// own `0700` directories and its private `/tmp`, which no other account can
/// reach to execute a file left there.
const SYSTEMD_HARDENING: [&str; 12] = [
    "NoNewPrivileges=yes",
    "CapabilityBoundingSet=",
    "AmbientCapabilities=",
    "PrivateTmp=yes",
    "PrivateDevices=yes",
    "ProtectSystem=strict",
    "ProtectKernelTunables=yes",
    "ProtectKernelModules=yes",
    "ProtectControlGroups=yes",
    "RestrictNamespaces=yes",
    "RestrictRealtime=yes",
    "RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX",
];

/// The capabilities a boot unit's daemon keeps, all for one purpose: running
/// its runners as accounts of a [`crate::runner_account::RunnerPool`] rather than as
/// itself.
///
/// - `CAP_SETUID`, `CAP_SETGID`: to start a runner as that account.
/// - `CAP_KILL`: to signal the runner's processes, which are no longer its own.
/// - `CAP_CHOWN`: to hand the runner its attempt directory and caches.
/// - `CAP_DAC_OVERRIDE`, `CAP_FOWNER`: to clean up what the runner left, and
///   to prune caches, though the runner's account owns those files.
///
/// None reaches a job. Moving from `root` to another uid clears the permitted
/// and effective sets, the ambient set is empty, and `NoNewPrivileges=yes`
/// stops a set-user-ID or file-capability binary from granting any back.
pub const BOOT_CAPABILITIES: &str = boot_capabilities!();

/// The one spelling of [`BOOT_CAPABILITIES`], so that the directive the unit
/// carries and the list the review checks it against cannot drift apart.
macro_rules! boot_capabilities {
    () => {
        "CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_KILL CAP_SETGID CAP_SETUID"
    };
}
use boot_capabilities;

/// The hardening directives a unit started in `mode` carries.
///
/// A boot unit keeps [`BOOT_CAPABILITIES`] for its daemon, and hides every
/// home directory behind an empty `tmpfs`: its
/// data lives outside them, and a workflow running as `root` has no business
/// reading the files there that DAC leaves world-readable. `tmpfs` rather than
/// `yes`, because tools such as `git` treat an *unreadable* `$HOME/.gitconfig`
/// as fatal and an absent one as nothing.
fn systemd_hardening(mode: StartMode) -> Vec<&'static str> {
    let mut directives = SYSTEMD_HARDENING.to_vec();
    if mode == StartMode::Boot {
        if let Some(directive) = directives
            .iter_mut()
            .find(|directive| **directive == "CapabilityBoundingSet=")
        {
            *directive = concat!("CapabilityBoundingSet=", boot_capabilities!());
        }
        directives.push("ProtectHome=tmpfs");
    }
    directives
}

/// `InaccessiblePaths=` entries for `plan`'s protected paths, each prefixed
/// with `-` so that a path that does not exist yet is not an error.
fn inaccessible_entries(plan: &InstallPlan) -> Vec<String> {
    plan.protected_paths()
        .iter()
        .map(|path| quote_argument(&format!("-{}", path.to_string_lossy())))
        .collect()
}

/// Host paths no runner or job may reach, which the operator names with
/// `host protect-path`.
///
/// On Linux the systemd unit lists them in `InaccessiblePaths=`, so inside the
/// unit the kernel replaces each with a node of mode `000`: no runner or job,
/// in any pool account, reaches it, whatever its own permissions. Measured on
/// Ubuntu 26.04: `rm-runner-1` reads such a file on the host and gets
/// `Permission denied` inside the unit. The
/// list is read when the service is registered, so a change takes effect when
/// it is registered again. Windows and macOS have no equivalent the installer
/// can set, so there it is refused rather than written and silently ignored.
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ProtectedPaths {
    #[serde(default)]
    pub paths: Vec<PathBuf>,
}

impl ProtectedPaths {
    /// The file in the configuration directory.
    pub const FILE: &'static str = "protected-paths.json";

    /// Whether this platform can enforce protected paths.
    #[must_use]
    pub const fn supported() -> bool {
        cfg!(all(unix, not(target_os = "macos")))
    }

    /// The list in `config_dir`, empty when there is none.
    ///
    /// # Errors
    ///
    /// When the file cannot be read or does not parse.
    pub fn load(config_dir: &Path) -> std::io::Result<Self> {
        crate::settings_file::load(&config_dir.join(Self::FILE))
    }

    /// Writes the list into `config_dir`.
    ///
    /// # Errors
    ///
    /// When the file cannot be written.
    pub fn save(&self, config_dir: &Path) -> std::io::Result<()> {
        crate::settings_file::save(&config_dir.join(Self::FILE), self)
    }

    /// Why `path` cannot be protected, or `None` when it can.
    ///
    /// The paths every job needs to run at all, and the service's own
    /// directories, are refused: hiding them would stop every runner rather
    /// than keep jobs out of something.
    #[must_use]
    pub fn refusal(path: &Path, own: &[PathBuf]) -> Option<String> {
        const SYSTEM: [&str; 16] = [
            "/", "/bin", "/boot", "/dev", "/etc", "/lib", "/lib32", "/lib64", "/opt", "/proc",
            "/run", "/sbin", "/sys", "/tmp", "/usr", "/var",
        ];
        if !path.is_absolute()
            || path
                .components()
                .any(|component| matches!(component, std::path::Component::ParentDir))
        {
            return Some(format!(
                "{} is not an absolute path without `..`",
                path.display()
            ));
        }
        if SYSTEM.iter().any(|system| path == Path::new(system)) {
            return Some(format!(
                "{} is one every job needs to run; protect a directory inside it instead",
                path.display()
            ));
        }
        if let Some(needed) = own
            .iter()
            .find(|needed| needed.starts_with(path) || path.starts_with(needed))
        {
            return Some(format!(
                "{} holds or lies inside {}, which the service itself uses",
                path.display(),
                needed.display()
            ));
        }
        None
    }
}

/// The trees `ProtectHome=` hides, which a boot unit's directories must
/// therefore lie outside.
#[cfg(any(test, all(unix, not(target_os = "macos"))))]
const SYSTEMD_HOME_ROOTS: [&str; 3] = ["/home", "/root", "/run/user"];

/// Renames a non-empty directory at `path` to `<name>.before-move-<stamp>`
/// beside it, leaving nothing at `path`.
#[cfg(any(all(test, unix), target_os = "linux"))]
fn set_aside(path: &Path, stamp: &str) -> std::io::Result<()> {
    let occupied = match std::fs::read_dir(path) {
        Ok(mut entries) => entries.next().is_some(),
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => false,
        Err(error) => return Err(error),
    };
    if occupied {
        let name = path.file_name().map_or_else(
            || std::borrow::Cow::Borrowed("directory"),
            |name| name.to_string_lossy(),
        );
        std::fs::rename(
            path,
            path.with_file_name(format!("{name}.before-move-{stamp}")),
        )?;
    }
    Ok(())
}

/// Copies the tree at `from` into `to`, except a top-level entry named `skip`.
/// Directories are created `0700`, files keep their mode, and symbolic links
/// are copied as links rather than followed.
#[cfg(any(all(test, unix), target_os = "linux"))]
fn copy_tree(from: &Path, to: &Path, skip: Option<&str>) -> std::io::Result<()> {
    use std::os::unix::fs::DirBuilderExt as _;

    std::fs::DirBuilder::new()
        .recursive(true)
        .mode(0o700)
        .create(to)?;
    for entry in std::fs::read_dir(from)? {
        let entry = entry?;
        if skip.is_some_and(|skip| entry.file_name() == skip) {
            continue;
        }
        let source = entry.path();
        let target = to.join(entry.file_name());
        let kind = entry.file_type()?;
        if kind.is_symlink() {
            std::os::unix::fs::symlink(std::fs::read_link(&source)?, &target)?;
        } else if kind.is_dir() {
            copy_tree(&source, &target, None)?;
        } else {
            std::fs::copy(&source, &target)?;
        }
    }
    Ok(())
}

/// Why a boot unit could not use `path`, owned by `owner`, or `None` when it
/// can.
///
/// A boot unit runs as `root` with no capability at all, so a directory
/// another account owns is one it cannot open, and one under a home tree is
/// one its `ProtectHome=` hides.
#[cfg(any(test, all(unix, not(target_os = "macos"))))]
fn boot_directory_refusal(path: &Path, owner: Option<u32>) -> Option<String> {
    if let Some(root) = SYSTEMD_HOME_ROOTS
        .iter()
        .find(|root| path.starts_with(root))
    {
        return Some(format!(
            "{} is under {root}, which a boot service cannot see",
            path.display()
        ));
    }
    match owner {
        Some(0) => None,
        Some(uid) => Some(format!(
            "{} belongs to uid {uid}, and a boot service runs as root with no capability \
             to open another account's directory",
            path.display()
        )),
        None => Some(format!("{} cannot be inspected", path.display())),
    }
}

// -- launchd -----------------------------------------------------------------

/// The `ProcessType` every rendered plist carries.
///
/// # Why not `Background`
///
/// launchd applies a job's `ProcessType` to the whole process tree it starts,
/// not only to the daemon. Under `Background` every runner the daemon launched
/// ran at base priority 4, on efficiency cores with throttled I/O, so each job
/// took 4 to 20 times as long as on a classic runner.
///
/// A child cannot leave it. This is the process type launchd chose at spawn
/// (`spawn type = background (5)` in `launchctl print`), not the
/// `PRIO_DARWIN_BG` flag `setpriority` controls: measured on macOS 27, a child
/// of a `Background` agent reads `getpriority(PRIO_DARWIN_PROCESS) == 0`, and
/// `setpriority(PRIO_DARWIN_PROCESS, 0, 0)` returns success and leaves it at
/// 4, before `exec` and after it alike. 0.4.31 tried exactly that.
///
/// The measured alternatives, as the base priority of a runner the agent
/// starts: `Background` 4, `Adaptive` 4, `Standard` (the default when the key
/// is absent) 20, `Interactive` 31 (the same as a classic runner, and the value
/// GitHub's own runner service template uses). The daemon itself mostly waits,
/// so it costs nothing to run it at that priority too.
pub const LAUNCHD_PROCESS_TYPE: &str = "Interactive";

/// Renders the launchd property list for this plan.
///
/// `KeepAlive` is a dictionary rather than `<true/>` on purpose: the
/// requirement is *restart on failure*, and a bare `KeepAlive` also restarts a
/// job that exited cleanly, which would turn a deliberate `service stop` into a
/// fight with launchd.
#[must_use]
pub fn launchd_plist(plan: &InstallPlan) -> String {
    let identity = plan.identity();
    let directories = plan.directories();
    let mut out = String::new();
    out.push_str("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
    out.push_str(
        "<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \
         \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n",
    );
    out.push_str("<plist version=\"1.0\">\n<dict>\n");
    out.push_str(&plist_string("Label", &identity.launchd_label()));

    out.push_str("  <key>ProgramArguments</key>\n  <array>\n");
    out.push_str(&format!(
        "    <string>{}</string>\n",
        xml_escape(&plan.binary().to_string_lossy())
    ));
    for argument in plan.arguments() {
        out.push_str(&format!(
            "    <string>{}</string>\n",
            xml_escape(&argument.to_string_lossy())
        ));
    }
    out.push_str("  </array>\n");

    out.push_str("  <key>RunAtLoad</key>\n  <true/>\n");
    out.push_str("  <key>KeepAlive</key>\n  <dict>\n");
    out.push_str("    <key>SuccessfulExit</key>\n    <false/>\n");
    out.push_str("  </dict>\n");
    out.push_str(&format!(
        "  <key>ThrottleInterval</key>\n  <integer>{}</integer>\n",
        plan.restart().delay().as_secs()
    ));
    out.push_str(&plist_string("ProcessType", LAUNCHD_PROCESS_TYPE));
    out.push_str(&plist_string(
        "WorkingDirectory",
        &directories.state.to_string_lossy(),
    ));
    out.push_str(&plist_string(
        "StandardOutPath",
        &directories
            .logs
            .join("runner-manager.launchd.out.log")
            .to_string_lossy(),
    ));
    out.push_str(&plist_string(
        "StandardErrorPath",
        &directories
            .logs
            .join("runner-manager.launchd.err.log")
            .to_string_lossy(),
    ));

    match plan.start_mode() {
        StartMode::Boot => {
            // A LaunchDaemon runs as root unless told otherwise, and here it
            // must: the System Keychain's master key is root-only.
            out.push_str(&plist_string(
                "UserName",
                ServiceAccount::for_definition(DefinitionKind::LaunchdPlist, StartMode::Boot)
                    .as_str(),
            ));
            // A daemon has no user session and must not be given one.
            out.push_str("  <key>SessionCreate</key>\n  <false/>\n");
        }
        StartMode::Login => {
            // A LaunchAgent already runs as the operator. Naming a `UserName`
            // here would be asking launchd for an account switch a login-mode
            // registration has no reason to want.
        }
    }

    out.push_str("</dict>\n</plist>\n");
    out
}

/// One `<key>`/`<string>` pair, indented as the rest of the plist is.
fn plist_string(key: &str, value: &str) -> String {
    format!(
        "  <key>{}</key>\n  <string>{}</string>\n",
        xml_escape(key),
        xml_escape(value)
    )
}

// -- Windows Task Scheduler --------------------------------------------------

/// The account a Task Scheduler task runs as.
///
/// Task Scheduler, unlike the other three managers, needs the principal spelled
/// out in the document. Isolating the one impure step keeps
/// [`windows_scheduled_task_xml`] a pure function that every CI leg can assert.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct TaskPrincipal {
    user_id: String,
}

impl TaskPrincipal {
    /// The account running this call, as `DOMAIN\user`.
    ///
    /// # Errors
    ///
    /// [`ServiceError::BinaryPath`] is not the right shape here, so this
    /// reports [`ServiceError::Control`] naming what the environment failed to
    /// say.
    pub fn current() -> Result<Self, ServiceError> {
        let user = std::env::var("USERNAME")
            .ok()
            .filter(|value| !value.trim().is_empty());
        let Some(user) = user else {
            return Err(ServiceError::Control {
                operation: "identify the account for",
                name: SERVICE_NAME.to_string(),
                manager: "Windows Task Scheduler",
                detail: "this session reports no %USERNAME%, so there is no principal to \
                         register a logon-triggered task for"
                    .to_string(),
            });
        };
        let domain = std::env::var("USERDOMAIN")
            .ok()
            .filter(|value| !value.trim().is_empty());
        Ok(Self {
            user_id: match domain {
                Some(domain) => format!("{domain}\\{user}"),
                None => user,
            },
        })
    }

    /// A named principal, for tests and for a caller that already knows.
    #[must_use]
    pub fn named(user_id: impl Into<String>) -> Self {
        Self {
            user_id: user_id.into(),
        }
    }

    /// `DOMAIN\user`.
    #[must_use]
    pub fn user_id(&self) -> &str {
        &self.user_id
    }
}

/// Renders the Task Scheduler document for a `--start-at login` registration.
///
/// `RunLevel` is `LeastPrivilege`, which is the whole of Windows' answer to
/// item 2 in this domain: the task runs with the operator's ordinary filtered
/// token and never with an elevated one, whatever the operator's group
/// membership.
#[must_use]
pub fn windows_scheduled_task_xml(plan: &InstallPlan, principal: &TaskPrincipal) -> String {
    let identity = plan.identity();
    let user = xml_escape(principal.user_id());
    let arguments = plan
        .arguments()
        .iter()
        .map(|argument| quote_argument(&argument.to_string_lossy()))
        .collect::<Vec<_>>()
        .join(" ");
    let mut out = String::new();
    out.push_str("<?xml version=\"1.0\" encoding=\"UTF-16\"?>\n");
    out.push_str(
        "<Task version=\"1.4\" \
         xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\n",
    );
    out.push_str("  <RegistrationInfo>\n");
    out.push_str(&format!(
        "    <Description>{}</Description>\n",
        xml_escape(identity.description())
    ));
    out.push_str(&format!(
        "    <URI>\\{}</URI>\n",
        xml_escape(identity.name())
    ));
    out.push_str("  </RegistrationInfo>\n");

    out.push_str("  <Triggers>\n    <LogonTrigger>\n");
    out.push_str("      <Enabled>true</Enabled>\n");
    out.push_str(&format!("      <UserId>{user}</UserId>\n"));
    out.push_str("    </LogonTrigger>\n  </Triggers>\n");

    out.push_str("  <Principals>\n    <Principal id=\"Author\">\n");
    out.push_str(&format!("      <UserId>{user}</UserId>\n"));
    out.push_str("      <LogonType>InteractiveToken</LogonType>\n");
    out.push_str("      <RunLevel>LeastPrivilege</RunLevel>\n");
    out.push_str("    </Principal>\n  </Principals>\n");

    out.push_str("  <Settings>\n");
    // One agent per host is `d1`'s lock; saying so here means Task Scheduler
    // refuses the second start rather than starting a process that then loses
    // the race and exits.
    out.push_str("    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\n");
    out.push_str("    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\n");
    out.push_str("    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\n");
    out.push_str("    <AllowHardTerminate>true</AllowHardTerminate>\n");
    out.push_str("    <StartWhenAvailable>true</StartWhenAvailable>\n");
    out.push_str("    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\n");
    out.push_str("    <IdleSettings>\n");
    out.push_str("      <StopOnIdleEnd>false</StopOnIdleEnd>\n");
    out.push_str("      <RestartOnIdle>false</RestartOnIdle>\n");
    out.push_str("    </IdleSettings>\n");
    out.push_str("    <AllowStartOnDemand>true</AllowStartOnDemand>\n");
    out.push_str("    <Enabled>true</Enabled>\n");
    out.push_str("    <Hidden>false</Hidden>\n");
    out.push_str("    <RunOnlyIfIdle>false</RunOnlyIfIdle>\n");
    out.push_str("    <WakeToRun>false</WakeToRun>\n");
    // A daemon has no natural end, so any limit here would be a scheduled kill.
    out.push_str("    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\n");
    out.push_str("    <Priority>7</Priority>\n");
    out.push_str("    <RestartOnFailure>\n");
    out.push_str(&format!(
        "      <Interval>{}</Interval>\n",
        iso8601_minutes(
            plan.restart()
                .effective_delay(DefinitionKind::WindowsScheduledTask)
        )
    ));
    out.push_str(&format!("      <Count>{START_LIMIT_BURST}</Count>\n"));
    out.push_str("    </RestartOnFailure>\n");
    out.push_str("  </Settings>\n");

    out.push_str("  <Actions Context=\"Author\">\n    <Exec>\n");
    out.push_str(&format!(
        "      <Command>{}</Command>\n",
        xml_escape(&plan.binary().to_string_lossy())
    ));
    if !arguments.is_empty() {
        out.push_str(&format!(
            "      <Arguments>{}</Arguments>\n",
            xml_escape(&arguments)
        ));
    }
    out.push_str(&format!(
        "      <WorkingDirectory>{}</WorkingDirectory>\n",
        xml_escape(&plan.directories().state.to_string_lossy())
    ));
    out.push_str("    </Exec>\n  </Actions>\n");
    out.push_str("</Task>\n");
    out
}

/// `PT<n>M`, which is the only shape Task Scheduler accepts for a restart
/// interval. See [`RestartPolicy::effective_delay`].
fn iso8601_minutes(duration: Duration) -> String {
    format!("PT{}M", duration.as_secs() / 60)
}

/// Escapes the five XML entities. Applied to every value that reaches a plist
/// or a task document, because a Windows account name may legitimately contain
/// `&` and a path may contain `<`.
///
/// `pub(crate)` rather than private because [`crate::wsl::task`] renders a
/// second kind of Task Scheduler document and must escape it the same way; two
/// escapers in one crate is exactly how one of them ends up subtly different.
pub(crate) fn xml_escape(value: &str) -> String {
    let mut out = String::with_capacity(value.len());
    for c in value.chars() {
        match c {
            '&' => out.push_str("&amp;"),
            '<' => out.push_str("&lt;"),
            '>' => out.push_str("&gt;"),
            '"' => out.push_str("&quot;"),
            '\'' => out.push_str("&apos;"),
            other => out.push(other),
        }
    }
    out
}

/// The inverse of [`xml_escape`], for reading a definition back off disk.
///
/// `&amp;` is replaced last, which is the whole subtlety: replacing it first
/// would turn a literal `&amp;amp;` into `&` in two passes instead of `&amp;`
/// in one.
fn xml_unescape(value: &str) -> String {
    value
        .replace("&lt;", "<")
        .replace("&gt;", ">")
        .replace("&quot;", "\"")
        .replace("&apos;", "'")
        .replace("&amp;", "&")
}

// -- Windows Service Control Manager -----------------------------------------

/// How `CreateServiceW` should be called, in a form that can be reviewed,
/// asserted, and printed on any platform.
///
/// The Windows backend builds its `ServiceInfo` from **this** value rather than
/// from the plan, so the descriptor a Linux CI leg asserts and the parameters a
/// Windows host registers cannot drift apart.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct WindowsServiceSpec {
    /// The service name.
    pub name: String,
    /// What `services.msc` shows.
    pub display_name: String,
    /// The one-line description.
    pub description: String,
    /// `true` for `SERVICE_AUTO_START`, `false` for `SERVICE_DEMAND_START`.
    pub automatic_start: bool,
    /// The account, or `None` for `LocalSystem`, which is what
    /// `CreateServiceW` takes a null `lpServiceStartName` to mean.
    pub account: Option<String>,
    /// The full launch command, quoted.
    pub command_line: String,
    /// The restart-on-failure policy.
    pub restart: RestartPolicy,
}

/// Derives the Windows service parameters from a plan.
#[must_use]
pub fn windows_service_spec(plan: &InstallPlan) -> WindowsServiceSpec {
    WindowsServiceSpec {
        name: plan.identity().name().to_string(),
        display_name: plan.identity().display_name().to_string(),
        description: plan.identity().description().to_string(),
        // Only a boot-mode registration is a service at all; a login-mode one
        // is a scheduled task. So an automatic start is the only kind here, and
        // the field exists because the privileged tests register an on-demand
        // fixture rather than one that starts with the test machine.
        automatic_start: plan.start_mode() == StartMode::Boot && !plan.is_on_demand(),
        account: match ServiceAccount::for_definition(
            DefinitionKind::WindowsService,
            plan.start_mode(),
        ) {
            // `None` means LocalSystem to `CreateServiceW`, and naming it
            // explicitly would be one more string to spell right.
            ServiceAccount::LocalSystem => None,
            other => Some(other.as_str().to_string()),
        },
        command_line: plan.command_line(),
        restart: plan.restart(),
    }
}

/// Renders the descriptor [`review_least_privilege`] reads and `service status`
/// can print.
#[must_use]
fn windows_service_descriptor(plan: &InstallPlan) -> String {
    let spec = windows_service_spec(plan);
    let mut out = String::new();
    out.push_str("[windows-service]\n");
    out.push_str(&format!("Name={}\n", spec.name));
    out.push_str(&format!("DisplayName={}\n", spec.display_name));
    out.push_str(&format!("Description={}\n", spec.description));
    // OWN_PROCESS and never INTERACTIVE_PROCESS: an interactive service would
    // put a process this product controls on the operator's desktop, which is
    // both deprecated by Windows and more than the requirement asks for.
    out.push_str("ServiceType=OWN_PROCESS\n");
    out.push_str(&format!(
        "StartType={}\n",
        if spec.automatic_start {
            "AutoStart"
        } else {
            "OnDemand"
        }
    ));
    out.push_str("ErrorControl=Normal\n");
    out.push_str(&format!(
        "Account={}\n",
        spec.account
            .as_deref()
            .unwrap_or(ServiceAccount::LocalSystem.as_str())
    ));
    out.push_str(&format!("CommandLine={}\n", spec.command_line));
    out.push_str(&format!(
        "FailureActionRestartDelaySecs={}\n",
        spec.restart.delay().as_secs()
    ));
    out.push_str(&format!(
        "FailureActionsResetPeriodSecs={}\n",
        spec.restart.reset_after().as_secs()
    ));
    // Without this flag the Service Control Manager applies failure actions
    // only to a crash, and a daemon that exits non-zero after failing to reach
    // GitHub is not a crash.
    out.push_str("FailureActionsOnNonCrashFailures=true\n");
    out.push_str(&format!(
        "ReadWritePaths={}\n",
        plan.directories()
            .all()
            .iter()
            .map(|path| quote_argument(&path.to_string_lossy()))
            .collect::<Vec<_>>()
            .join(" ")
    ));
    out
}

// ---------------------------------------------------------------------------
// The least-privilege review
// ---------------------------------------------------------------------------

/// Whether a finding is about too much authority or too little.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum FindingKind {
    /// The definition grants more than `05-infrastructure.md` item 2 asks for.
    /// This is what makes a review fail.
    Excess,
    /// The definition does not grant something the daemon needs, or does not
    /// state something the review cannot verify without.
    Shortfall,
}

impl fmt::Display for FindingKind {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(match self {
            Self::Excess => "excess",
            Self::Shortfall => "shortfall",
        })
    }
}

/// One thing the review has to say about a definition.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct PrivilegeFinding {
    /// Excess or shortfall.
    pub kind: FindingKind,
    /// The directive, key, or element it is about.
    pub subject: String,
    /// What is wrong with it, in terms an operator can act on.
    pub detail: String,
}

impl fmt::Display for PrivilegeFinding {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "{}: {} -- {}", self.kind, self.subject, self.detail)
    }
}

/// What a definition actually grants, measured against the requirement.
///
/// `05-infrastructure.md` item 2 and `07-security.md`'s release gate
/// (*"Service account permissions are documented and verified least
/// privilege"*) are the same requirement stated twice, and this is the
/// verification half. The documentation half is `docs/service-account.md`.
///
/// The review reads the **rendered text**, not the plan it came from. That is
/// deliberate and it is the only version of this check worth having: a review
/// that re-derived its expectations from the same values the renderer used
/// would agree with the renderer by construction and could never fail. Reading
/// the text means a hand-edited unit on a real host is reviewed as it is, and
/// means a test can widen a definition and watch this say so.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct PrivilegeReview {
    kind: DefinitionKind,
    account: ServiceAccount,
    controls: Vec<String>,
    findings: Vec<PrivilegeFinding>,
}

impl PrivilegeReview {
    /// Whether the definition grants nothing beyond the requirement.
    #[must_use]
    pub fn is_least_privilege(&self) -> bool {
        !self
            .findings
            .iter()
            .any(|finding| finding.kind == FindingKind::Excess)
    }

    /// Everything the review found, excesses and shortfalls together.
    #[must_use]
    pub fn findings(&self) -> &[PrivilegeFinding] {
        &self.findings
    }

    /// Only the excesses — the findings that make [`Self::is_least_privilege`]
    /// false.
    #[must_use]
    pub fn excesses(&self) -> Vec<&PrivilegeFinding> {
        self.findings
            .iter()
            .filter(|finding| finding.kind == FindingKind::Excess)
            .collect()
    }

    /// The controls the definition was confirmed to carry.
    ///
    /// Present so that a passing review says *what it checked* rather than only
    /// that it passed. A check that reports nothing when it succeeds is
    /// indistinguishable from a check that did not run.
    #[must_use]
    pub fn controls(&self) -> &[String] {
        &self.controls
    }

    /// The account the registration runs under, and why it is the minimum.
    #[must_use]
    pub const fn account(&self) -> &ServiceAccount {
        &self.account
    }

    /// Which platform's definition was reviewed.
    #[must_use]
    pub const fn kind(&self) -> DefinitionKind {
        self.kind
    }
}

impl fmt::Display for PrivilegeReview {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        writeln!(
            f,
            "{} runs as {} ({})",
            self.kind,
            self.account,
            self.account.justification()
        )?;
        for control in &self.controls {
            writeln!(f, "  confirmed  {control}")?;
        }
        for finding in &self.findings {
            writeln!(f, "  {finding}")?;
        }
        if self.is_least_privilege() {
            write!(f, "  verdict    least privilege")
        } else {
            write!(
                f,
                "  verdict    NOT least privilege: {} excess(es)",
                self.excesses().len()
            )
        }
    }
}

/// Reads a definition back and reports what it grants.
///
/// `plan` supplies only the two things the text cannot: the four directories
/// the registration is *allowed* to write, and the start mode, which decides
/// which account is the minimum.
#[must_use]
pub fn review_least_privilege(
    definition: &ServiceDefinition,
    plan: &InstallPlan,
) -> PrivilegeReview {
    let mut controls = Vec::new();
    let mut findings = Vec::new();
    match definition.kind() {
        DefinitionKind::SystemdUnit => {
            review_systemd(definition.text(), plan, &mut controls, &mut findings);
        }
        DefinitionKind::LaunchdPlist => {
            review_launchd(definition.text(), plan, &mut controls, &mut findings);
        }
        DefinitionKind::WindowsScheduledTask => {
            review_scheduled_task(definition.text(), &mut controls, &mut findings);
        }
        DefinitionKind::WindowsService => {
            review_windows_service(definition.text(), plan, &mut controls, &mut findings);
        }
    }
    PrivilegeReview {
        kind: definition.kind(),
        // The definition's account, not the plan's: a Linux CI leg reviewing the
        // Windows descriptor must report `LocalSystem`, which is the account
        // that descriptor registers, and not `root`, which is the account this
        // leg's own host would use.
        account: ServiceAccount::for_definition(definition.kind(), plan.start_mode()),
        controls,
        findings,
    }
}

/// Every writable path a definition may name, as the strings it names them by.
fn permitted_paths(kind: DefinitionKind, plan: &InstallPlan) -> Vec<String> {
    let mut permitted = plan
        .directories()
        .all()
        .iter()
        .map(|path| path.to_string_lossy().into_owned())
        .collect::<Vec<_>>();
    if kind == DefinitionKind::SystemdUnit
        && let Some(secret_directory) = plan.secret_guard().and_then(Path::parent)
    {
        permitted.push(secret_directory.to_string_lossy().into_owned());
    }
    permitted
}

/// Whether two path spellings name the same place on **this host's**
/// filesystem. Case-insensitive on Windows, exact elsewhere.
///
/// For a rendered definition use [`same_path_for`] instead: which comparison is
/// right there follows the platform the definition is *for*, and every leg of
/// the CI matrix reviews all four.
fn same_path_text(left: &str, right: &str) -> bool {
    if cfg!(windows) {
        left.eq_ignore_ascii_case(right)
    } else {
        left == right
    }
}

/// Whether two path spellings name the same place on the platform a given
/// definition targets.
fn same_path_for(kind: DefinitionKind, left: &str, right: &str) -> bool {
    match kind {
        DefinitionKind::WindowsService | DefinitionKind::WindowsScheduledTask => {
            left.eq_ignore_ascii_case(right)
        }
        DefinitionKind::LaunchdPlist | DefinitionKind::SystemdUnit => left == right,
    }
}

/// Checks a `ReadWritePaths`-style list against the permitted directories.
fn review_writable_paths(
    kind: DefinitionKind,
    subject: &str,
    listed: &[String],
    plan: &InstallPlan,
    controls: &mut Vec<String>,
    findings: &mut Vec<PrivilegeFinding>,
) {
    let permitted = permitted_paths(kind, plan);
    for entry in listed {
        if !permitted
            .iter()
            .any(|allowed| same_path_for(kind, allowed, entry))
        {
            findings.push(PrivilegeFinding {
                kind: FindingKind::Excess,
                subject: subject.to_string(),
                detail: format!(
                    "{entry} is writable but is not one of this registration's required paths"
                ),
            });
        }
    }
    for allowed in &permitted {
        if !listed
            .iter()
            .any(|entry| same_path_for(kind, allowed, entry))
        {
            findings.push(PrivilegeFinding {
                kind: FindingKind::Shortfall,
                subject: subject.to_string(),
                detail: format!(
                    "{allowed} is one of this registration's directories but is not writable, \
                     so the daemon cannot use it"
                ),
            });
        }
    }
    if listed.len() == permitted.len() && findings.iter().all(|f| f.subject != subject) {
        controls.push(format!(
            "{subject} names exactly the required application-data and credential paths"
        ));
    }
}

/// Compares a unit's capability bounding set with the one it should keep, as
/// sets: a capability it lacks is a shortfall, one it adds is an excess.
fn review_capabilities(
    expected: &str,
    wanted: &str,
    actual: &str,
    controls: &mut Vec<String>,
    findings: &mut Vec<PrivilegeFinding>,
) {
    let subject = "CapabilityBoundingSet";
    // `~` inverts the list, keeping every capability *except* those named.
    if actual.trim_start().starts_with('~') {
        findings.push(PrivilegeFinding {
            kind: FindingKind::Excess,
            subject: subject.to_string(),
            detail: format!("is `{actual}`, which keeps every capability it does not name"),
        });
        return;
    }
    let wanted: BTreeSet<&str> = wanted.split_whitespace().collect();
    let actual: BTreeSet<&str> = actual.split_whitespace().collect();
    let extra = actual.difference(&wanted).copied().collect::<Vec<_>>();
    let missing = wanted.difference(&actual).copied().collect::<Vec<_>>();
    if !extra.is_empty() {
        findings.push(PrivilegeFinding {
            kind: FindingKind::Excess,
            subject: subject.to_string(),
            detail: format!(
                "keeps {}, which the requirement does not ask for",
                extra.join(" ")
            ),
        });
    }
    if !missing.is_empty() {
        findings.push(PrivilegeFinding {
            kind: FindingKind::Shortfall,
            subject: subject.to_string(),
            detail: format!("drops {}, which the daemon needs", missing.join(" ")),
        });
    }
    if extra.is_empty() && missing.is_empty() {
        controls.push(expected.to_string());
    }
}

/// The one inbound-surface rule, applied to whichever platform names it.
///
/// `07-security.md` handling rule 2: *"The product exposes no inbound HTTP,
/// socket, or RPC surface anywhere, in any command."* A definition that asks the
/// service manager to open a socket or publish a Mach service on the daemon's
/// behalf would create exactly that surface without a line of product code
/// changing, which is why it is checked here and not only in review.
fn review_inbound_surface(
    text: &str,
    markers: &[(&str, &str)],
    controls: &mut Vec<String>,
    findings: &mut Vec<PrivilegeFinding>,
) {
    let mut clean = true;
    for (marker, detail) in markers {
        if text.contains(marker) {
            clean = false;
            findings.push(PrivilegeFinding {
                kind: FindingKind::Excess,
                subject: (*marker).to_string(),
                detail: (*detail).to_string(),
            });
        }
    }
    if clean {
        controls.push(
            "no socket, listener, or Mach service is published on the daemon's behalf".to_string(),
        );
    }
}

fn review_systemd(
    text: &str,
    plan: &InstallPlan,
    controls: &mut Vec<String>,
    findings: &mut Vec<PrivilegeFinding>,
) {
    let directives = ini_directives(text, "Service");
    for expected in systemd_hardening(plan.start_mode()) {
        let (key, value) = expected
            .split_once('=')
            .expect("every hardening directive is written as key=value");
        match directives.get(key) {
            Some(actual) if key == "CapabilityBoundingSet" => {
                review_capabilities(expected, value, actual, controls, findings);
            }
            Some(actual) if actual == value => controls.push((*expected).to_string()),
            Some(actual) => findings.push(PrivilegeFinding {
                kind: FindingKind::Excess,
                subject: key.to_string(),
                detail: format!(
                    "is `{actual}`, not `{value}`, so the unit keeps authority the \
                                 requirement does not ask for"
                ),
            }),
            None => findings.push(PrivilegeFinding {
                kind: FindingKind::Excess,
                subject: key.to_string(),
                detail: format!(
                    "is absent, so the unit inherits systemd's default rather than `{value}`"
                ),
            }),
        }
    }

    match directives.get("ReadWritePaths") {
        Some(value) => {
            let listed = split_quoted(value);
            review_writable_paths(
                DefinitionKind::SystemdUnit,
                "ReadWritePaths",
                &listed,
                plan,
                controls,
                findings,
            );
        }
        None => findings.push(PrivilegeFinding {
            kind: FindingKind::Shortfall,
            subject: "ReadWritePaths".to_string(),
            detail: "is absent, so `ProtectSystem=strict` leaves the daemon nowhere to write"
                .to_string(),
        }),
    }

    // Each path the operator protected must stay inaccessible: a unit that no
    // longer lists one has let every job back into it.
    if !plan.protected_paths().is_empty() {
        let listed = directives
            .get("InaccessiblePaths")
            .map(|value| split_quoted(value))
            .unwrap_or_default();
        let missing = plan
            .protected_paths()
            .iter()
            .filter(|path| {
                let entry = format!("-{}", path.to_string_lossy());
                !listed.contains(&entry)
            })
            .map(|path| path.display().to_string())
            .collect::<Vec<_>>();
        if missing.is_empty() {
            controls.push("InaccessiblePaths keeps every protected path from every job".into());
        } else {
            findings.push(PrivilegeFinding {
                kind: FindingKind::Excess,
                subject: "InaccessiblePaths".to_string(),
                detail: format!("no longer hides {}", missing.join(", ")),
            });
        }
    }

    // `User=` on a system unit is an escalation only in the other direction, so
    // what is checked is the pair systemd actually treats as privileged.
    if directives.contains_key("PrivateUsers")
        && directives.get("PrivateUsers") == Some(&"no".to_string())
    {
        findings.push(PrivilegeFinding {
            kind: FindingKind::Excess,
            subject: "PrivateUsers".to_string(),
            detail: "is explicitly disabled, which is broader than leaving it at systemd's default"
                .to_string(),
        });
    }

    review_inbound_surface(
        text,
        &[
            (
                "ListenStream=",
                "asks systemd to open a listening socket for this service, which \
                 07-security.md rule 2 forbids the product to have",
            ),
            (
                "ListenDatagram=",
                "asks systemd to open a listening socket for this service, which \
                 07-security.md rule 2 forbids the product to have",
            ),
        ],
        controls,
        findings,
    );
}

fn review_launchd(
    text: &str,
    plan: &InstallPlan,
    controls: &mut Vec<String>,
    findings: &mut Vec<PrivilegeFinding>,
) {
    // A scheduling class is not an authority, so no value here is an excess.
    // Anything but `Interactive` is a shortfall: launchd applies it to every
    // runner the daemon starts. See `LAUNCHD_PROCESS_TYPE`.
    match plist_string_value(text, "ProcessType") {
        Some(value) if value == LAUNCHD_PROCESS_TYPE => {
            controls.push(format!("ProcessType={LAUNCHD_PROCESS_TYPE}"));
        }
        found => findings.push(PrivilegeFinding {
            kind: FindingKind::Shortfall,
            subject: "ProcessType".to_string(),
            detail: format!(
                "is {}, and launchd applies it to every runner the daemon starts, so their jobs \
                 run below normal priority. The daemon rewrites it to `{LAUNCHD_PROCESS_TYPE}` \
                 when it next starts with no runner; `service status` says how to restart it",
                found.map_or_else(
                    || "absent (launchd's `Standard`)".to_string(),
                    |value| format!("`{value}`")
                )
            ),
        }),
    }

    match plan.start_mode() {
        StartMode::Boot => {
            if plist_bool_value(text, "SessionCreate") == Some(true) {
                findings.push(PrivilegeFinding {
                    kind: FindingKind::Excess,
                    subject: "SessionCreate".to_string(),
                    detail: "asks launchd to create a security session for a job that runs \
                             outside every login session and has no use for one"
                        .to_string(),
                });
            } else {
                controls.push("SessionCreate is not requested".to_string());
            }
            match plist_string_value(text, "UserName").as_deref() {
                Some("root") => {
                    controls.push("UserName=root, stated rather than inherited".to_string())
                }
                Some(other) => findings.push(PrivilegeFinding {
                    kind: FindingKind::Shortfall,
                    subject: "UserName".to_string(),
                    detail: format!(
                        "is `{other}`, which cannot unlock the System Keychain: \
                         /var/db/SystemKey is root-only, so the daemon would start and then \
                         find no credential"
                    ),
                }),
                None => findings.push(PrivilegeFinding {
                    kind: FindingKind::Shortfall,
                    subject: "UserName".to_string(),
                    detail: "is absent, so the account is launchd's implicit default and this \
                             review cannot confirm it"
                        .to_string(),
                }),
            }
        }
        StartMode::Login => {
            if let Some(named) = plist_string_value(text, "UserName") {
                findings.push(PrivilegeFinding {
                    kind: FindingKind::Excess,
                    subject: "UserName".to_string(),
                    detail: format!(
                        "names `{named}` in a LaunchAgent, which already runs as the operator; \
                         naming an account here asks launchd for a switch a login-mode \
                         registration has no reason to want"
                    ),
                });
            } else {
                controls
                    .push("no UserName: the agent runs as the operator and no other".to_string());
            }
        }
    }

    review_inbound_surface(
        text,
        &[
            (
                "<key>Sockets</key>",
                "asks launchd to open a socket for this job, which 07-security.md rule 2 \
                 forbids the product to have",
            ),
            (
                "<key>MachServices</key>",
                "publishes a Mach service, which is the RPC surface 07-security.md rule 2 \
                 forbids the product to have",
            ),
        ],
        controls,
        findings,
    );
}

fn review_scheduled_task(
    text: &str,
    controls: &mut Vec<String>,
    findings: &mut Vec<PrivilegeFinding>,
) {
    match xml_value(text, "RunLevel").as_deref() {
        Some("LeastPrivilege") => controls.push("RunLevel=LeastPrivilege".to_string()),
        Some(other) => findings.push(PrivilegeFinding {
            kind: FindingKind::Excess,
            subject: "RunLevel".to_string(),
            detail: format!(
                "is `{other}`, so the task runs with an elevated token whenever the operator is \
                 an administrator"
            ),
        }),
        None => findings.push(PrivilegeFinding {
            kind: FindingKind::Excess,
            subject: "RunLevel".to_string(),
            detail: "is absent, so Task Scheduler decides the token rather than the definition"
                .to_string(),
        }),
    }

    match xml_value(text, "LogonType").as_deref() {
        Some("InteractiveToken") => controls.push("LogonType=InteractiveToken".to_string()),
        Some(other) => findings.push(PrivilegeFinding {
            kind: FindingKind::Excess,
            subject: "LogonType".to_string(),
            detail: format!(
                "is `{other}`, which asks Windows to store or synthesise a credential for this \
                 task; an interactive token needs neither"
            ),
        }),
        None => findings.push(PrivilegeFinding {
            kind: FindingKind::Shortfall,
            subject: "LogonType".to_string(),
            detail: "is absent, so this review cannot confirm that no credential is stored"
                .to_string(),
        }),
    }
}

fn review_windows_service(
    text: &str,
    plan: &InstallPlan,
    controls: &mut Vec<String>,
    findings: &mut Vec<PrivilegeFinding>,
) {
    let directives = ini_directives(text, "windows-service");

    match directives.get("ServiceType").map(String::as_str) {
        Some("OWN_PROCESS") => controls.push("ServiceType=OWN_PROCESS".to_string()),
        Some(other) => findings.push(PrivilegeFinding {
            kind: FindingKind::Excess,
            subject: "ServiceType".to_string(),
            detail: format!(
                "is `{other}`; an interactive or shared-process service reaches further than a \
                 daemon that only talks to GitHub over HTTPS"
            ),
        }),
        None => findings.push(PrivilegeFinding {
            kind: FindingKind::Shortfall,
            subject: "ServiceType".to_string(),
            detail: "is absent, so this review cannot confirm the service is not interactive"
                .to_string(),
        }),
    }

    // The account is not a free choice on Windows: `d2`'s DACL decides it. What
    // the review can check is that the definition names the one account that
    // DACL admits, and no broader one.
    match directives.get("Account").map(String::as_str) {
        Some(account) if account == ServiceAccount::LocalSystem.as_str() => {
            controls.push(format!(
                "Account={account}: the only stock account the machine-scoped store's DACL \
                 (SY, BA, OW) admits"
            ));
        }
        Some(other) => findings.push(PrivilegeFinding {
            kind: FindingKind::Shortfall,
            subject: "Account".to_string(),
            detail: format!(
                "is `{other}`, which the machine-scoped store's DACL does not name, so the \
                 daemon would start and then find no credential. Widening that DACL is not this \
                 registration's to do: an ACE reaching `{other}` would also reach every other \
                 service running under it"
            ),
        }),
        None => findings.push(PrivilegeFinding {
            kind: FindingKind::Shortfall,
            subject: "Account".to_string(),
            detail: "is absent, so this review cannot confirm which account was registered"
                .to_string(),
        }),
    }

    match directives.get("ReadWritePaths") {
        Some(value) => {
            let listed = split_quoted(value);
            review_writable_paths(
                DefinitionKind::WindowsService,
                "ReadWritePaths",
                &listed,
                plan,
                controls,
                findings,
            );
        }
        None => findings.push(PrivilegeFinding {
            kind: FindingKind::Shortfall,
            subject: "ReadWritePaths".to_string(),
            detail: "is absent, so the directories the service was installed against are not \
                     recorded"
                .to_string(),
        }),
    }
}

// -- parsing helpers ---------------------------------------------------------

/// Reads `key=value` lines out of one `[section]` of an INI-shaped document.
///
/// systemd's unit format and this module's Windows descriptor are both this
/// shape. A repeated key takes its last value, which is systemd's own rule for
/// every directive here.
fn ini_directives(text: &str, section: &str) -> BTreeMap<String, String> {
    let mut out = BTreeMap::new();
    let mut inside = false;
    for line in text.lines() {
        let line = line.trim();
        if line.starts_with('[') && line.ends_with(']') {
            inside = &line[1..line.len() - 1] == section;
            continue;
        }
        if !inside || line.is_empty() || line.starts_with('#') || line.starts_with(';') {
            continue;
        }
        if let Some((key, value)) = line.split_once('=') {
            out.insert(key.trim().to_string(), value.trim().to_string());
        }
    }
    out
}

/// The command line in a systemd `ExecStart=`, without the prefixes systemd
/// reads off its front (`-`, `@`, `:`, `+`, `!`, `!!`).
///
/// A drop-in may carry any of them, and left in place they become part of the
/// executable's path. With `@` the second word is the `argv[0]` handed to the
/// process rather than an argument, so it goes as well.
#[cfg(any(test, all(unix, not(target_os = "macos"))))]
fn systemd_exec_command_line(value: &str) -> String {
    let value = value.trim();
    let command = value.trim_start_matches(['-', '@', ':', '+', '!']);
    if !value[..value.len() - command.len()].contains('@') {
        return command.to_string();
    }
    let mut words = split_command_line(command);
    if words.len() > 1 {
        words.remove(1);
    }
    words
        .iter()
        .map(|word| quote_argument(word))
        .collect::<Vec<_>>()
        .join(" ")
}

/// Parses a systemd time span such as `15`, `15s`, `500ms`, `1min 30s` or
/// `2h`. A bare number is seconds. `None` for `infinity`, an empty value, or
/// anything systemd would not accept either.
#[cfg(any(test, all(unix, not(target_os = "macos"))))]
fn systemd_timespan(value: &str) -> Option<Duration> {
    let mut rest = value.trim();
    if rest.is_empty() || rest == "infinity" {
        return None;
    }
    let mut seconds = 0f64;
    while !rest.is_empty() {
        let digits = rest
            .find(|c: char| !(c.is_ascii_digit() || c == '.'))
            .unwrap_or(rest.len());
        if digits == 0 {
            return None;
        }
        let number: f64 = rest[..digits].parse().ok()?;
        rest = rest[digits..].trim_start();
        let letters = rest
            .find(|c: char| !c.is_alphabetic())
            .unwrap_or(rest.len());
        let scale = match &rest[..letters] {
            "" | "s" | "sec" | "second" | "seconds" => 1.0,
            "us" | "usec" | "\u{3bc}s" | "\u{b5}s" => 1e-6,
            "ms" | "msec" => 1e-3,
            "m" | "min" | "minute" | "minutes" => 60.0,
            "h" | "hr" | "hour" | "hours" => 3_600.0,
            "d" | "day" | "days" => 86_400.0,
            "w" | "week" | "weeks" => 604_800.0,
            "M" | "month" | "months" => 2_629_800.0,
            "y" | "year" | "years" => 31_557_600.0,
            _ => return None,
        };
        seconds += number * scale;
        rest = rest[letters..].trim_start();
    }
    Duration::try_from_secs_f64(seconds).ok()
}

/// Splits a whitespace-separated list that may contain arguments quoted by
/// [`quote_argument`].
fn split_quoted(value: &str) -> Vec<String> {
    let mut out = Vec::new();
    let mut rest = value.trim();
    while !rest.is_empty() {
        if rest.starts_with('"') {
            // `executable_from_command_line` already implements Windows' quoting
            // rules; reuse it rather than write a second, subtly different one.
            if let Some(parsed) = executable_from_command_line(rest) {
                out.push(parsed.to_string_lossy().into_owned());
            }
            // Advance past the closing quote.
            let mut depth = 0usize;
            let mut end = rest.len();
            for (index, c) in rest.char_indices() {
                match c {
                    '\\' => depth += 1,
                    '"' => {
                        if depth.is_multiple_of(2) && index > 0 {
                            end = index + 1;
                            break;
                        }
                        depth = 0;
                    }
                    _ => depth = 0,
                }
            }
            rest = rest[end..].trim_start();
        } else {
            let end = rest.find(char::is_whitespace).unwrap_or(rest.len());
            out.push(rest[..end].to_string());
            rest = rest[end..].trim_start();
        }
    }
    out
}

/// The text between the **first** `<tag>` and its `</tag>`, unescaped, for the
/// small, known documents this module renders. Not a general XML parser and
/// does not pretend to be one.
///
/// "First" matters for a document that repeats a tag: a Task Scheduler task has
/// an `<Enabled>` in its trigger *and* one in its settings, so a caller after
/// the second one passes the slice that starts at `<Settings>`.
///
/// `pub(crate)` rather than private because [`crate::wsl::task`] reads back a
/// second kind of Task Scheduler document; one reader for both is the same
/// argument [`xml_escape`] makes for one escaper.
pub(crate) fn xml_value(text: &str, tag: &str) -> Option<String> {
    let open = format!("<{tag}>");
    let close = format!("</{tag}>");
    let start = text.find(&open)? + open.len();
    let end = text[start..].find(&close)? + start;
    Some(xml_unescape(text[start..end].trim()))
}

/// Whether Task Scheduler will launch a login task automatically.
///
/// Its `/Query /XML` output normalises away values that equal the schema
/// default. In particular, an enabled task commonly has no `<Enabled>` node at
/// all, so only an explicit `false` means disabled.
#[cfg(any(windows, test))]
fn windows_login_task_starts_automatically(document: &str) -> bool {
    document.contains("<LogonTrigger>")
        && xml_value(document, "Enabled").as_deref() != Some("false")
}

/// The `<string>` that follows `<key>key</key>` in a property list.
fn plist_value_after_key<'a>(text: &'a str, key: &str) -> Option<&'a str> {
    let marker = format!("<key>{key}</key>");
    let start = text.find(&marker)? + marker.len();
    Some(text[start..].trim_start())
}

pub fn plist_string_value(text: &str, key: &str) -> Option<String> {
    let rest = plist_value_after_key(text, key)?;
    if !rest.starts_with("<string>") {
        return None;
    }
    xml_value(rest, "string")
}

fn plist_bool_value(text: &str, key: &str) -> Option<bool> {
    let rest = plist_value_after_key(text, key)?;
    if rest.starts_with("<true/>") {
        Some(true)
    } else if rest.starts_with("<false/>") {
        Some(false)
    } else {
        None
    }
}

// ---------------------------------------------------------------------------
// The install record
// ---------------------------------------------------------------------------

/// The version of [`InstallRecord`] on disk.
///
/// Bumped when a record written by an older version can no longer be read.
/// `service status` reports an unreadable record as a problem with a remedy
/// rather than failing, because the remedy — uninstall and install again —
/// touches no configuration, no secret and no cache.
pub const RECORD_SCHEMA_VERSION: u32 = 1;

/// What `service install` wrote down, and what `service status` reads back.
///
/// This is the *record* half of `05-infrastructure.md` item 6. The service
/// manager also knows the binary path, and the two are compared: a registration
/// whose command line no longer matches the record is a registration something
/// else has edited, and saying so is more useful than picking one of them to
/// believe.
///
/// It holds no credential. The nearest thing is the *location* of the secret
/// store, which `d2` publishes for `host show` to print, and even that is
/// derived rather than stored.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct InstallRecord {
    /// [`RECORD_SCHEMA_VERSION`] at the time of writing.
    pub schema_version: u32,
    /// What the operating system calls the registration.
    pub service_name: String,
    /// Which service manager holds it.
    pub manager: String,
    /// Boot or login.
    pub start_mode: StartMode,
    /// The account it runs under.
    pub account: ServiceAccount,
    /// **The resolved absolute path of the binary at install time.** Item 6.
    pub binary: PathBuf,
    /// Where [`Self::binary`] was copied from, when it is a copy.
    ///
    /// `#[serde(default)]` rather than a schema bump: a record written before
    /// this existed is still readable, and reads as `None`. That is not a
    /// silent downgrade — `None` means the registration names a package
    /// manager's own file, which is the layout that cannot be upgraded while
    /// the service runs, and `service status` says so by name.
    #[serde(default)]
    pub source_binary: Option<PathBuf>,
    /// The arguments it was registered with.
    pub arguments: Vec<String>,
    /// The restart-on-failure delay.
    pub restart_delay_secs: u64,
    /// How long it must run before the failure count resets.
    pub restart_reset_secs: u64,
    /// The rotating diagnostic log's stem. Item 4.
    pub log_file: PathBuf,
    /// Whether the manager was asked not to start this by itself. Always
    /// `false` for a registration an operator made; see
    /// [`InstallRequest::started_on_demand`].
    ///
    /// `#[serde(default)]` so that a record missing the field is rejected by
    /// the schema check below, with its remedy, rather than by a parse error
    /// that names a field an operator has never heard of.
    #[serde(default)]
    pub starts_on_demand: bool,
    /// Where the platform's definition file was written, when there is one.
    pub definition_path: Option<PathBuf>,
    /// The host paths the registration made inaccessible. See
    /// [`ProtectedPaths`]; empty in a record written before they existed.
    #[serde(default)]
    pub protected_paths: Vec<PathBuf>,
    /// When the registration was made.
    pub installed_at: DateTime<Utc>,
    /// Which build of the product made it.
    pub installed_by_version: String,
    // A TOML table has to follow every scalar at its level, so this field is
    // last by necessity rather than by taste.
    /// The four directories the registration was installed against. Item 2's
    /// *"configured cache and runtime directories"*.
    pub directories: ServiceDirectories,
}

impl InstallRecord {
    /// Where the record lives, given this host's directories.
    #[must_use]
    pub fn path(paths: &AppPaths) -> PathBuf {
        paths.config_dir().join(RECORD_FILE)
    }

    /// Builds the record for a plan that has just been applied.
    #[must_use]
    pub fn of(plan: &InstallPlan, definition: &ServiceDefinition, at: DateTime<Utc>) -> Self {
        Self {
            schema_version: RECORD_SCHEMA_VERSION,
            service_name: plan.identity().name().to_string(),
            manager: definition.kind().manager().to_string(),
            start_mode: plan.start_mode(),
            account: plan.account().clone(),
            binary: plan.binary().to_path_buf(),
            arguments: plan
                .arguments()
                .iter()
                .map(|argument| argument.to_string_lossy().into_owned())
                .collect(),
            restart_delay_secs: plan.restart().delay().as_secs(),
            restart_reset_secs: plan.restart().reset_after().as_secs(),
            starts_on_demand: plan.is_on_demand(),
            source_binary: plan.source_binary().map(Path::to_path_buf),
            log_file: plan.directories().log_file(),
            definition_path: definition.install_path().map(Path::to_path_buf),
            protected_paths: plan.protected_paths().to_vec(),
            installed_at: at,
            installed_by_version: env!("CARGO_PKG_VERSION").to_string(),
            directories: plan.directories().clone(),
        }
    }

    /// The plan this record describes, as this build would register it.
    ///
    /// The directories, binary, arguments and restart policy are the recorded
    /// ones; everything else -- hardening, the secret store's guard -- is what
    /// this build renders. That difference is the point: it is how a
    /// registration written by an older build is compared against, and
    /// repaired to, the current definition.
    #[must_use]
    pub fn plan(&self, identity: ServiceIdentity) -> InstallPlan {
        let plan = InstallPlan::unchecked(
            identity,
            self.start_mode,
            self.binary.clone(),
            self.directories.clone(),
        )
        .with_arguments(self.arguments.clone())
        .with_restart(self.restart())
        .with_protected_paths(self.protected_paths.clone());
        let plan = if self.starts_on_demand {
            plan.started_on_demand()
        } else {
            plan
        };
        match crate::secrets::PlatformSecretStore::for_start_mode(self.start_mode) {
            Ok(store) => plan.with_secret_guard(store.guard()),
            Err(_) => plan,
        }
    }

    /// The restart policy this record describes, or [`RestartPolicy::default`]
    /// when the recorded numbers are outside the supported range — which can
    /// only happen to a record something else has edited.
    #[must_use]
    pub fn restart(&self) -> RestartPolicy {
        RestartPolicy::new(
            Duration::from_secs(self.restart_delay_secs),
            Duration::from_secs(self.restart_reset_secs),
        )
        .unwrap_or_default()
    }

    /// Reads the record, or reports that there is none.
    ///
    /// `Ok(None)` means no registration was made by this product on this host.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Record`] when the file exists and cannot be read,
    /// [`ServiceError::RecordNotPermitted`] when it exists and this account may
    /// not read it, and [`ServiceError::RecordUnreadable`] when it is not a
    /// record this version understands.
    pub fn read(paths: &AppPaths) -> Result<Option<Self>, ServiceError> {
        let path = Self::path(paths);
        let text = match std::fs::read_to_string(&path) {
            Ok(text) => text,
            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
            // Told apart from every other read failure because `status` carries
            // on through this one alone. See `ServiceError::RecordNotPermitted`.
            Err(error) if error.kind() == std::io::ErrorKind::PermissionDenied => {
                return Err(ServiceError::RecordNotPermitted {
                    path,
                    detail: error.to_string(),
                });
            }
            Err(error) => {
                return Err(ServiceError::Record {
                    operation: "read",
                    path,
                    detail: error.to_string(),
                });
            }
        };
        let record: Self =
            toml::from_str(&text).map_err(|error| ServiceError::RecordUnreadable {
                path: path.clone(),
                detail: error.to_string(),
            })?;
        if record.schema_version != RECORD_SCHEMA_VERSION {
            return Err(ServiceError::RecordUnreadable {
                path,
                detail: format!(
                    "it declares schema version {} and this build reads version {}",
                    record.schema_version, RECORD_SCHEMA_VERSION
                ),
            });
        }
        Ok(Some(record))
    }

    /// Writes the record, replacing whatever was there.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Record`].
    pub fn write(&self, paths: &AppPaths) -> Result<(), ServiceError> {
        use std::io::Write as _;

        let path = Self::path(paths);
        let text = toml::to_string_pretty(self).map_err(|error| ServiceError::Record {
            operation: "encode",
            path: path.clone(),
            detail: error.to_string(),
        })?;
        if let Some(parent) = path.parent() {
            std::fs::create_dir_all(parent).map_err(|error| ServiceError::Record {
                operation: "write",
                path: path.clone(),
                detail: error.to_string(),
            })?;
        }
        let parent = path.parent().ok_or_else(|| ServiceError::Record {
            operation: "write",
            path: path.clone(),
            detail: "the record path has no parent directory".to_string(),
        })?;
        let mut temporary =
            tempfile::NamedTempFile::new_in(parent).map_err(|error| ServiceError::Record {
                operation: "write",
                path: path.clone(),
                detail: error.to_string(),
            })?;
        temporary
            .write_all(text.as_bytes())
            .and_then(|()| temporary.as_file().sync_all())
            .map_err(|error| ServiceError::Record {
                operation: "write",
                path: path.clone(),
                detail: error.to_string(),
            })?;
        // ------------------------------------------------------------------
        // THE RECORD IS READABLE BY THE ACCOUNT WHOSE DIRECTORY IT IS IN.
        // ------------------------------------------------------------------
        // `NamedTempFile` creates at `0600`, which is right for a temporary
        // file and wrong for this one. A boot-mode `service install` runs under
        // `sudo`, so `0600` made the record `root`-owned and unreadable by the
        // operator — and `service status`, which asks no privilege of anybody,
        // failed on their own host with `Permission denied` and a remedy that
        // named the command that had just failed.
        //
        // `0644` does not widen anything: `RECORD_FILE`'s own documentation is
        // that this is *"non-secret TOML"* holding no credential, and
        // `AppPaths::create_all` puts it in a `0700` directory, so no other
        // local account can reach it whatever its own mode says. It is the same
        // arrangement the rotating diagnostics already have.
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt as _;

            temporary
                .as_file()
                .set_permissions(std::fs::Permissions::from_mode(0o644))
                .map_err(|error| ServiceError::Record {
                    operation: "write",
                    path: path.clone(),
                    detail: error.to_string(),
                })?;
        }
        temporary
            .persist(&path)
            .map(|_| ())
            .map_err(|error| ServiceError::Record {
                operation: "write",
                path,
                detail: error.error.to_string(),
            })
    }

    /// Removes the record. Returns whether there was one.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Record`].
    pub fn remove(paths: &AppPaths) -> Result<bool, ServiceError> {
        let path = Self::path(paths);
        match std::fs::remove_file(&path) {
            Ok(()) => Ok(true),
            Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(false),
            Err(error) => Err(ServiceError::Record {
                operation: "remove",
                path,
                detail: error.to_string(),
            }),
        }
    }
}

// ---------------------------------------------------------------------------
// The last successful GitHub contact
// ---------------------------------------------------------------------------

/// The heartbeat file's own schema version.
const CONTACT_SCHEMA_VERSION: u32 = 1;

#[derive(Debug, Clone, Serialize, Deserialize)]
struct ContactRecord {
    schema_version: u32,
    last_success: DateTime<Utc>,
}

/// Records that GitHub was reached successfully, for `service status` to
/// report.
///
/// # The contract, for `f3` and for the agent
///
/// Journey 5 step 4 requires `service status` to report *"the last successful
/// GitHub contact"*, and `service status` runs in the operator's terminal while
/// the daemon runs in a service. They share no memory, so the fact has to be on
/// disk, and this is the file. **The daemon calls this after each successful
/// GitHub call; nothing else writes it.**
///
/// It is a single timestamp and deliberately not a log: an operator asking this
/// question wants to know whether the agent is alive and reaching GitHub *now*,
/// and a value that is minutes old answers it. Writing it is a whole-file
/// replace through a temporary in the same directory, so a status command can
/// never read a half-written timestamp.
///
/// # Errors
///
/// [`ServiceError::Record`] when `state/` cannot be written.
pub fn record_github_contact(paths: &AppPaths, at: DateTime<Utc>) -> Result<(), ServiceError> {
    write_state_record(
        &contact_path(paths),
        &ContactRecord {
            schema_version: CONTACT_SCHEMA_VERSION,
            last_success: at,
        },
    )
}

/// Reads the last successful GitHub contact, or reports that none was recorded.
///
/// `Ok(None)` is the honest answer on a host whose agent has never run, and it
/// is what `service status` prints rather than a zero timestamp.
///
/// # Errors
///
/// [`ServiceError::Record`] when the file exists and cannot be read or parsed.
/// A malformed heartbeat is reported rather than treated as absence: absence
/// means *"the agent has never reached GitHub"*, and reporting a parse failure
/// as that would be a wrong answer to the question Journey 5 asks.
pub fn last_github_contact(paths: &AppPaths) -> Result<Option<DateTime<Utc>>, ServiceError> {
    Ok(read_state_record::<ContactRecord>(&contact_path(paths))?.map(|record| record.last_success))
}

/// Where the heartbeat lives.
#[must_use]
pub fn contact_path(paths: &AppPaths) -> PathBuf {
    paths.state_dir().join(CONTACT_FILE)
}

/// Writes a small TOML record under `state/`, through a temporary in the same
/// directory and a rename, so a status command never reads half of one.
pub(crate) fn write_state_record(path: &Path, record: &impl Serialize) -> Result<(), ServiceError> {
    let failed = |detail: String| ServiceError::Record {
        operation: "write",
        path: path.to_path_buf(),
        detail,
    };
    let text = toml::to_string_pretty(record).map_err(|error| failed(error.to_string()))?;
    let directory = path.parent().unwrap_or_else(|| Path::new("."));
    std::fs::create_dir_all(directory).map_err(|error| failed(error.to_string()))?;
    let temporary = path.with_extension("toml.new");
    std::fs::write(&temporary, text).map_err(|error| failed(error.to_string()))?;
    std::fs::rename(&temporary, path).map_err(|error| failed(error.to_string()))
}

/// Reads a record [`write_state_record`] wrote. `Ok(None)` when there is none;
/// one that exists and does not parse is an error, never absence.
pub(crate) fn read_state_record<T: serde::de::DeserializeOwned>(
    path: &Path,
) -> Result<Option<T>, ServiceError> {
    let failed = |detail: String| ServiceError::Record {
        operation: "read",
        path: path.to_path_buf(),
        detail,
    };
    let text = match std::fs::read_to_string(path) {
        Ok(text) => text,
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
        Err(error) => return Err(failed(error.to_string())),
    };
    toml::from_str(&text)
        .map(Some)
        .map_err(|error| failed(error.to_string()))
}

/// Removes a record; one that is not there is already removed.
pub(crate) fn remove_state_record(path: &Path) -> Result<(), ServiceError> {
    match std::fs::remove_file(path) {
        Ok(()) => Ok(()),
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
        Err(error) => Err(ServiceError::Record {
            operation: "remove",
            path: path.to_path_buf(),
            detail: error.to_string(),
        }),
    }
}

// ---------------------------------------------------------------------------
// The credential GitHub rejected
// ---------------------------------------------------------------------------

#[derive(Debug, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct CredentialRejectionRecord {
    schema_version: u32,
    rejected_since: DateTime<Utc>,
}

/// Records that GitHub rejected the daemon's credential, keeping the first
/// moment of an ongoing rejection.
///
/// # Why a file of its own
///
/// A rejected credential used to be visible only in the daemon's log: the
/// contact heartbeat simply stopped moving, `service status` still printed
/// `healthy`, and the TUI -- which authenticates with its own, perhaps freshly
/// renewed, copy -- showed nothing at all while the service started no runner
/// for hours. Separate from [`CONTACT_FILE`] so that an older build reading
/// that file is not handed a field it refuses.
///
/// # Errors
///
/// [`ServiceError::Record`] when `state/` cannot be written.
pub fn record_github_credential_rejected(
    paths: &AppPaths,
    at: DateTime<Utc>,
) -> Result<(), ServiceError> {
    if github_credential_rejected_since(paths)
        .ok()
        .flatten()
        .is_some()
    {
        return Ok(());
    }
    write_state_record(
        &credential_rejection_path(paths),
        &CredentialRejectionRecord {
            schema_version: CONTACT_SCHEMA_VERSION,
            rejected_since: at,
        },
    )
}

/// Clears a recorded rejection once GitHub accepts the credential again.
///
/// # Errors
///
/// [`ServiceError::Record`] when the record exists and cannot be removed.
pub fn clear_github_credential_rejection(paths: &AppPaths) -> Result<(), ServiceError> {
    remove_state_record(&credential_rejection_path(paths))
}

/// Since when GitHub has been rejecting the daemon's credential, if it is.
///
/// # Errors
///
/// [`ServiceError::Record`] when the file exists and cannot be read or parsed.
pub fn github_credential_rejected_since(
    paths: &AppPaths,
) -> Result<Option<DateTime<Utc>>, ServiceError> {
    Ok(
        read_state_record::<CredentialRejectionRecord>(&credential_rejection_path(paths))?
            .map(|record| record.rejected_since),
    )
}

/// Where the rejection record lives.
#[must_use]
pub fn credential_rejection_path(paths: &AppPaths) -> PathBuf {
    paths.state_dir().join(CREDENTIAL_REJECTION_FILE)
}

#[derive(Debug, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct CredentialUnreadableRecord {
    schema_version: u32,
    unreadable_since: DateTime<Utc>,
}

/// Records that the daemon could not read its stored credential, keeping the
/// first moment of an ongoing failure.
///
/// # Why a file of its own
///
/// A daemon that cannot read its credential exits, and the service manager
/// starts it again a few seconds later, for ever. `service status` reads the
/// registration, which is fine, and the heartbeat, which merely stops moving --
/// so it said `healthy` while a macOS host that had just been upgraded was
/// locked out of its own keychain item and started no runner. The reason was
/// only in the daemon's log. The daemon is the one process whose view of the
/// store matters, and it shares no memory with `service status`, so it says
/// so on disk; [`clear_credential_unreadable`] removes it as soon as a read
/// succeeds.
///
/// # Errors
///
/// [`ServiceError::Record`] when `state/` cannot be written.
pub fn record_credential_unreadable(
    paths: &AppPaths,
    at: DateTime<Utc>,
) -> Result<(), ServiceError> {
    if credential_unreadable_since(paths).ok().flatten().is_some() {
        return Ok(());
    }
    write_state_record(
        &credential_unreadable_path(paths),
        &CredentialUnreadableRecord {
            schema_version: CONTACT_SCHEMA_VERSION,
            unreadable_since: at,
        },
    )
}

/// Clears a recorded failure once the daemon reads its credential again.
///
/// # Errors
///
/// [`ServiceError::Record`] when the record exists and cannot be removed.
pub fn clear_credential_unreadable(paths: &AppPaths) -> Result<(), ServiceError> {
    remove_state_record(&credential_unreadable_path(paths))
}

/// Since when the daemon has been unable to read its stored credential, if it
/// has.
///
/// # Errors
///
/// [`ServiceError::Record`] when the file exists and cannot be read or parsed.
pub fn credential_unreadable_since(
    paths: &AppPaths,
) -> Result<Option<DateTime<Utc>>, ServiceError> {
    Ok(
        read_state_record::<CredentialUnreadableRecord>(&credential_unreadable_path(paths))?
            .map(|record| record.unreadable_since),
    )
}

/// Where the unreadable-credential record lives.
#[must_use]
pub fn credential_unreadable_path(paths: &AppPaths) -> PathBuf {
    paths.state_dir().join(CREDENTIAL_UNREADABLE_FILE)
}

/// How to sign this host in again for `mode`: the exact command, in
/// backticks, and where to run it when that matters.
///
/// A machine-scoped store needs privilege: `sudo` on Unix, an elevated
/// terminal on Windows. A login-mode store on macOS is the login keychain,
/// which is unlocked for the desktop session only, so an SSH session cannot
/// write it.
#[must_use]
pub fn sign_in_instruction(mode: StartMode) -> String {
    let (command, place) = match mode {
        StartMode::Boot if cfg!(unix) => (sudo_command("auth login --start-at boot"), ""),
        StartMode::Boot => (
            "runner-manager auth login --start-at boot".to_owned(),
            " from an elevated terminal",
        ),
        StartMode::Login => (
            "runner-manager auth login --start-at login".to_owned(),
            MACOS_LOGIN_PLACE,
        ),
    };
    format!("`{command}`{place}")
}

/// `sudo`, then this program, then `arguments`: a command an operator can
/// paste.
///
/// `sudo` searches only its own `secure_path`, which an npm or nvm
/// installation is not on, and the npm command is a Node shim that root's
/// `PATH` could not run either. So the command names this executable -- the
/// native binary, even behind that shim -- unless it already lives on
/// `secure_path`, where the bare name reads better and works.
#[must_use]
pub fn sudo_command(arguments: &str) -> String {
    // A test binary is not the product; its own path would only make every
    // remedy a test compares depend on where the build directory is.
    let executable = if cfg!(test) {
        None
    } else {
        std::env::current_exe().ok()
    };
    format!("sudo {} {arguments}", sudo_program(executable.as_deref()))
}

/// How a `sudo` command names `executable`. See [`sudo_command`].
fn sudo_program(executable: Option<&Path>) -> String {
    /// Ubuntu's and Debian's `secure_path`, which other distributions'
    /// defaults are a subset of.
    const SECURE_PATH: [&str; 7] = [
        "/usr/local/sbin",
        "/usr/local/bin",
        "/usr/sbin",
        "/usr/bin",
        "/sbin",
        "/bin",
        "/snap/bin",
    ];
    let Some(executable) = executable else {
        return "runner-manager".to_owned();
    };
    if executable
        .parent()
        .is_some_and(|directory| SECURE_PATH.iter().any(|path| directory == Path::new(path)))
    {
        return "runner-manager".to_owned();
    }
    let text = executable.to_string_lossy();
    if text
        .chars()
        .all(|c| c.is_ascii_alphanumeric() || "/._-+@".contains(c))
    {
        text.into_owned()
    } else {
        format!("'{}'", text.replace('\'', "'\\''"))
    }
}

/// Where a login-mode sign-in has to happen on macOS, as a phrase to follow
/// the command; nothing elsewhere.
pub const MACOS_LOGIN_PLACE: &str = if cfg!(target_os = "macos") {
    " in a Terminal in this Mac's desktop session (an SSH session cannot unlock the login \
     keychain)"
} else {
    ""
};

// ---------------------------------------------------------------------------
// A definition written by an older build
// ---------------------------------------------------------------------------

/// An installed service definition that differs from what this build renders
/// for the same recorded installation.
///
/// # Why this exists
///
/// An upgrade replaces the binary a registration runs and nothing else. A
/// systemd unit written by 0.4.7 still carried `LoadCredential=`, which hands
/// the daemon a copy of the credential frozen at service start, and lacked
/// write access to the credential store. Every release after the fix kept
/// running under that unit: the daemon could neither renew the token nor see
/// one renewed by anybody else, and stopped starting runners the moment the
/// frozen access token expired.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct DefinitionDrift {
    /// The definition file on disk.
    pub path: PathBuf,
    /// The build that wrote it, as its install record says.
    pub installed_by_version: String,
    /// What this build renders in its place.
    pub rendered: String,
    /// The start mode it was installed for.
    pub start_mode: StartMode,
    /// Which manager reads the definition.
    pub manager: DefinitionKind,
}

/// Compares the installed definition against this build's rendering.
///
/// A systemd unit is compared byte for byte. A launchd plist is compared on
/// `ProcessType` alone (see [`launchd_definition_drift`]). `None` for every
/// other manager, for a definition that cannot be read, and for one that
/// already matches. The file is read through `controls`, so a double never
/// compares against a real host's definition.
fn definition_drift(
    controls: &dyn ControlFactory,
    identity: &ServiceIdentity,
    record: &InstallRecord,
) -> Option<DefinitionDrift> {
    let compare = match host_definition_kind(record.start_mode) {
        DefinitionKind::SystemdUnit => systemd_definition_drift,
        DefinitionKind::LaunchdPlist => launchd_definition_drift,
        DefinitionKind::WindowsService | DefinitionKind::WindowsScheduledTask => return None,
    };
    let path = record.definition_path.clone()?;
    let installed = controls.installed_definition(&path)?;
    compare(identity, record, path, &installed)
}

/// A plist whose `ProcessType` is not [`LAUNCHD_PROCESS_TYPE`], with the plist
/// this build renders in its place.
///
/// Only that one key, unlike the systemd comparison. The daemon repairs this
/// drift by itself (`daemon.rs`, `converge_launchd_definition`), so a
/// whole-file comparison would make it rewrite and reload over every edit an
/// operator made to the plist. A plist that does carry the wrong value is
/// replaced whole, as `service install` would replace it.
fn launchd_definition_drift(
    identity: &ServiceIdentity,
    record: &InstallRecord,
    path: PathBuf,
    installed: &str,
) -> Option<DefinitionDrift> {
    (plist_string_value(installed, "ProcessType").as_deref() != Some(LAUNCHD_PROCESS_TYPE)).then(
        || DefinitionDrift {
            path,
            installed_by_version: record.installed_by_version.clone(),
            rendered: launchd_plist(&record.plan(identity.clone())),
            start_mode: record.start_mode,
            manager: DefinitionKind::LaunchdPlist,
        },
    )
}

fn systemd_definition_drift(
    identity: &ServiceIdentity,
    record: &InstallRecord,
    path: PathBuf,
    installed: &str,
) -> Option<DefinitionDrift> {
    let rendered = systemd_unit(&record.plan(identity.clone()));
    (installed != rendered).then(|| DefinitionDrift {
        path,
        installed_by_version: record.installed_by_version.clone(),
        rendered,
        start_mode: record.start_mode,
        manager: DefinitionKind::SystemdUnit,
    })
}

// ---------------------------------------------------------------------------
// The last runner-root refusal
// ---------------------------------------------------------------------------

const ROOT_REFUSAL_SCHEMA_VERSION: u32 = 1;

#[derive(Debug, Clone, Serialize, Deserialize)]
struct RootRefusalFile {
    schema_version: u32,
    /// Keyed by policy, because the fact is per-policy and not per-host.
    #[serde(default)]
    refusals: BTreeMap<String, RootRefusalEntry>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
struct RootRefusalEntry {
    at: DateTime<Utc>,
    kind: String,
    root: String,
    detail: String,
}

/// One policy's last runner-root refusal, as `service status` reports it.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RunnerRootRefusal {
    /// The policy that placed no runner.
    pub policy: String,
    /// When it was last refused.
    pub at: DateTime<Utc>,
    /// The closed-vocabulary cause, as `RunnerRootError::kind` names it.
    pub kind: String,
    /// The root it was refused.
    pub root: String,
    /// The refusal in full, including the remediation. Not redacted: this file
    /// is read by a command in the operator's terminal, not by the log sink.
    pub detail: String,
}

/// Records that one policy could not use its runner root.
///
/// # The contract, and why a file
///
/// A launch the runner root refuses fails before any attempt row exists, so the
/// journal cannot carry it and no screen can show it. The daemon's own log
/// cannot either: it redacts every field it does not allow-list and scrubs
/// anything path-shaped out of the ones it does, which is most of a
/// `RunnerRootError`. So the sentence an operator needs — the directory and the
/// remediation, verbatim — has nowhere to go, and the failure reads
/// `runner_start_failed reason=other` once per poll for as long as it lasts.
/// That is not hypothetical: it cost three hours.
///
/// **Keyed by policy, and that is load-bearing.** A host runs several policies
/// and they do not share a fate: `allocate_persistent_slot` tolerates an
/// unresolvable host default, so a repository with its own persistent root
/// places runners happily while an ephemeral policy on a withheld volume places
/// none. A single host-wide slot would have the working policy clear the broken
/// one's record on the same reconcile pass, and `service status` would report a
/// healthy host that had started zero runners for an entire target.
///
/// **The daemon writes this when a root refuses a launch and clears the policy's
/// entry when one succeeds; nothing else writes it.** It keeps the last refusal
/// per policy rather than a history, for the reason [`record_github_contact`] is
/// a single timestamp: the operator is asking whether runners can be placed
/// *now*.
///
/// Written whole through a temporary in the same directory, so a status command
/// cannot read half a record.
///
/// # Errors
///
/// [`ServiceError::Record`] when `state/` cannot be read or written.
pub fn record_runner_root_refusal(
    paths: &AppPaths,
    policy: &str,
    at: DateTime<Utc>,
    kind: &str,
    root: &str,
    detail: &str,
) -> Result<(), ServiceError> {
    let mut file = read_refusal_file(paths)?.unwrap_or(RootRefusalFile {
        schema_version: ROOT_REFUSAL_SCHEMA_VERSION,
        refusals: BTreeMap::new(),
    });
    file.schema_version = ROOT_REFUSAL_SCHEMA_VERSION;
    file.refusals.insert(
        policy.to_owned(),
        RootRefusalEntry {
            at,
            kind: kind.to_owned(),
            root: root.to_owned(),
            detail: detail.to_owned(),
        },
    );
    write_refusal_file(paths, &file)
}

/// Clears one policy's entry, because that policy placed a runner.
///
/// Removes the file once the last entry goes, so a host that is working leaves
/// nothing behind for a later `service status` to report. A policy with no entry
/// is not an error: this is called on every successful placement, and almost
/// every one of those follows another success.
///
/// # Errors
///
/// [`ServiceError::Record`] when `state/` cannot be read or written.
pub fn clear_runner_root_refusal(paths: &AppPaths, policy: &str) -> Result<(), ServiceError> {
    let Some(mut file) = read_refusal_file(paths)? else {
        return Ok(());
    };
    if file.refusals.remove(policy).is_none() {
        return Ok(());
    }
    if file.refusals.is_empty() {
        let path = root_refusal_path(paths);
        return match std::fs::remove_file(&path) {
            Ok(()) => Ok(()),
            Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
            Err(error) => Err(ServiceError::Record {
                operation: "remove",
                path,
                detail: error.to_string(),
            }),
        };
    }
    write_refusal_file(paths, &file)
}

/// Every policy whose runner root refused it and has not since succeeded.
///
/// Ordered by policy, so two runs of `service status` on an unchanged host
/// print the same thing in the same order.
///
/// # Errors
///
/// [`ServiceError::Record`] when the file exists and cannot be read or parsed.
/// Reported rather than treated as absence, for the reason
/// [`last_github_contact`] gives: absence means "every policy is placing
/// runners", and answering a parse failure with that would be a wrong answer.
pub fn runner_root_refusals(paths: &AppPaths) -> Result<Vec<RunnerRootRefusal>, ServiceError> {
    Ok(read_refusal_file(paths)?
        .map(|file| {
            file.refusals
                .into_iter()
                .map(|(policy, entry)| RunnerRootRefusal {
                    policy,
                    at: entry.at,
                    kind: entry.kind,
                    root: entry.root,
                    detail: entry.detail,
                })
                .collect()
        })
        .unwrap_or_default())
}

fn read_refusal_file(paths: &AppPaths) -> Result<Option<RootRefusalFile>, ServiceError> {
    read_state_record(&root_refusal_path(paths))
}

fn write_refusal_file(paths: &AppPaths, file: &RootRefusalFile) -> Result<(), ServiceError> {
    write_state_record(&root_refusal_path(paths), file)
}

/// Where the refusals live.
#[must_use]
pub fn root_refusal_path(paths: &AppPaths) -> PathBuf {
    paths.state_dir().join(ROOT_REFUSAL_FILE)
}

// ---------------------------------------------------------------------------
// The recorded binary path
// ---------------------------------------------------------------------------

/// What became of the absolute path `install` recorded.
///
/// `05-infrastructure.md` item 6 in one type. Three of the four variants are
/// errors, and `service status` reports them as errors rather than as health —
/// which is the whole point, because the npm case produces a service that looks
/// installed, is registered, and cannot start.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum BinaryPath {
    /// The recorded path is a file, and the service manager still starts it.
    Current {
        /// The path.
        path: PathBuf,
    },
    /// **Nothing is at the recorded path.**
    ///
    /// This is the npm upgrade: `npm i -g @ivan-murzak/runner-manager` puts the binary under
    /// the active Node installation's global prefix, and switching Node versions
    /// with `nvm`, `fnm`, or `volta` moves that prefix. The service is still
    /// registered, still set to start at boot, and starts nothing.
    Missing {
        /// The path the record names.
        recorded: PathBuf,
    },
    /// Something is at the recorded path, but it is not a file the service
    /// manager could start.
    NotExecutable {
        /// The path the record names.
        recorded: PathBuf,
        /// What is there instead.
        detail: String,
    },
    /// The record and the service manager name different binaries.
    Diverged {
        /// What the record says.
        recorded: PathBuf,
        /// What the service manager is registered to start.
        registered: PathBuf,
    },
}

impl BinaryPath {
    /// Whether this is a state `service status` must report as an error.
    #[must_use]
    pub const fn is_error(&self) -> bool {
        !matches!(self, Self::Current { .. })
    }

    /// The path the record names, whatever state it is in.
    #[must_use]
    pub fn recorded(&self) -> &Path {
        match self {
            Self::Current { path } => path,
            Self::Missing { recorded }
            | Self::NotExecutable { recorded, .. }
            | Self::Diverged { recorded, .. } => recorded,
        }
    }
}

impl fmt::Display for BinaryPath {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::Current { path } => write!(f, "{}", path.display()),
            Self::Missing { recorded } => write!(
                f,
                "{} -- STALE: nothing is at the recorded path, so the service cannot start. A \
                 package manager that moved the binary is the usual cause; an `npm i -g` \
                 installation moves with the active Node version. Run `service install` again \
                 from the binary that is now installed.",
                recorded.display()
            ),
            Self::NotExecutable { recorded, detail } => write!(
                f,
                "{} -- STALE: {detail}, so the service cannot start. Run `service install` again \
                 from the installed binary.",
                recorded.display()
            ),
            Self::Diverged {
                recorded,
                registered,
            } => write!(
                f,
                "{} -- STALE: the service manager is registered to start {} instead. Something \
                 has edited the registration since it was installed. Run `service uninstall` and \
                 `service install`; neither touches configuration, secrets, or the cache.",
                recorded.display(),
                registered.display()
            ),
        }
    }
}

/// Decides what became of a recorded path.
///
/// `registered` is what the service manager says it will start, when the
/// platform can be asked. Order matters and is deliberate: **absence is checked
/// first**, because a missing binary is the failure item 6 exists for and an
/// operator hearing "the registration disagrees with the record" about a file
/// that is not there would be sent to the wrong problem.
#[must_use]
pub fn inspect_binary(recorded: &Path, registered: Option<&Path>) -> BinaryPath {
    match std::fs::metadata(recorded) {
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
            return BinaryPath::Missing {
                recorded: recorded.to_path_buf(),
            };
        }
        Err(error) => {
            return BinaryPath::NotExecutable {
                recorded: recorded.to_path_buf(),
                detail: format!("it cannot be inspected ({error})"),
            };
        }
        Ok(metadata) if !metadata.is_file() => {
            return BinaryPath::NotExecutable {
                recorded: recorded.to_path_buf(),
                detail: "what is there is not a file".to_string(),
            };
        }
        Ok(_) => {}
    }
    if let Some(registered) = registered
        && !same_path_text(&recorded.to_string_lossy(), &registered.to_string_lossy())
    {
        return BinaryPath::Diverged {
            recorded: recorded.to_path_buf(),
            registered: registered.to_path_buf(),
        };
    }
    BinaryPath::Current {
        path: recorded.to_path_buf(),
    }
}

// ---------------------------------------------------------------------------
// The control seam
// ---------------------------------------------------------------------------

/// What a service manager says about a registration it holds.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Registration {
    /// Which manager holds it, which is also what decides the start mode:
    /// a Windows service is a boot registration and a Task Scheduler task is a
    /// login one; a LaunchDaemon and a system unit are boot, a LaunchAgent and
    /// a user unit are login.
    pub manager: DefinitionKind,
    /// The start mode the *domain* it was found in implies.
    pub start_mode: StartMode,
    /// The full command line, as the manager stores it.
    pub command_line: String,
    /// The account it runs under, spelled as [`ServiceAccount`] spells it, when
    /// the manager names a real account.
    ///
    /// `None` where the manager reports only a placeholder: a login
    /// registration that runs as whoever signs in, or a Task Scheduler `UserId`
    /// that is a raw SID. Status then reports the install record's account.
    pub account: Option<String>,
    /// Whether it is running now.
    pub running: bool,
    /// Whether it will start by itself.
    ///
    /// Distinct from [`Registration::start_mode`]: a Windows service can be
    /// registered in the boot domain and still be set to `demand` start, which
    /// is a service that exists, looks installed, and does not come back after
    /// a reboot.
    pub starts_automatically: bool,
    /// The restart-on-failure delay the manager reports, when it reports one.
    ///
    /// The *delay* rather than the whole [`RestartPolicy`], because that is the
    /// half every one of the four managers can be asked for. The failure-count
    /// reset window has no representation at all in Task Scheduler or launchd,
    /// so a `RestartPolicy` read back from them would carry one number the
    /// manager reported and one this module invented — and a comparison against
    /// an invented number is a comparison that cannot fail.
    pub restart_delay: Option<Duration>,
}

impl Registration {
    /// The executable the manager will start, parsed out of the command line.
    #[must_use]
    pub fn binary(&self) -> Option<PathBuf> {
        executable_from_command_line(&self.command_line)
    }
}

/// One platform's service manager, for one start-mode domain.
///
/// Every method takes the identity rather than storing it, so one control can
/// answer about the product's registration and about a test fixture's without
/// either being able to reach the other by accident.
pub trait ServiceControl: fmt::Debug {
    /// Which manager this is.
    fn manager(&self) -> DefinitionKind;

    /// Registers the plan, returning the definition that was applied.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Control`] or [`ServiceError::NeedsElevation`].
    fn install(&self, plan: &InstallPlan) -> Result<ServiceDefinition, ServiceError>;

    /// Deregisters. Returns whether there was a registration to remove.
    ///
    /// **Removes the registration and nothing else.** No implementation of this
    /// method may delete a directory, a database, a secret, or a cache;
    /// `05-infrastructure.md` item 5 is a property of every backend, not a
    /// check somewhere above them.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Control`] or [`ServiceError::NeedsElevation`].
    fn uninstall(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError>;

    /// What the manager knows about this registration, if anything.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Control`].
    fn query(&self, identity: &ServiceIdentity) -> Result<Option<Registration>, ServiceError>;

    /// Starts it now, without waiting for the next boot or logon.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Control`], [`ServiceError::NeedsElevation`], or
    /// [`ServiceError::NotInstalled`].
    fn start(&self, identity: &ServiceIdentity) -> Result<(), ServiceError>;

    /// Stops it. Returns whether it was running.
    ///
    /// # Errors
    ///
    /// As [`ServiceControl::start`].
    fn stop(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError>;
}

/// Chooses the control for a start mode.
///
/// The indirection is what makes [`ServiceOperations`] testable: production
/// hands it [`HostControls`], every test in this file hands it
/// [`RecordingControls`], and neither knows the difference.
pub trait ControlFactory: fmt::Debug + Send + Sync {
    /// The control for one start-mode domain.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Control`] when this host has no manager for that domain.
    fn control(&self, mode: StartMode) -> Result<Box<dyn ServiceControl>, ServiceError>;

    /// The text of an installed definition file, for drift detection. `None`
    /// when there is none to read. The default reads nothing, so a double
    /// never reports the real host's unit as its own.
    fn installed_definition(&self, _path: &Path) -> Option<String> {
        None
    }

    /// Whether this Mac signs somebody in after a restart, and whether
    /// FileVault holds it at the unlock screen. `None` where the platform has
    /// no such probe; the default probes nothing, for the same reason as
    /// [`Self::installed_definition`].
    fn unattended_login(&self) -> Option<crate::unattended_login::UnattendedLogin> {
        None
    }
}

/// The real service managers of the host this binary was built for.
#[derive(Debug, Clone, Copy, Default)]
pub struct HostControls;

// ---------------------------------------------------------------------------
// The operations
// ---------------------------------------------------------------------------

/// What `install` did.
#[derive(Debug, Clone)]
pub struct Installed {
    /// The plan that was applied, including the resolved absolute binary path.
    pub plan: InstallPlan,
    /// The definition the platform was given.
    pub definition: ServiceDefinition,
    /// The record that was written.
    pub record: InstallRecord,
    /// What the definition grants, measured against the requirement.
    pub review: PrivilegeReview,
    /// What was done to the runner root the registration will run jobs under.
    ///
    /// Named trustees rather than SIDs, so printing it adds no identity to the
    /// output. See [`crate::runner_root_access`].
    pub runner_root: RootAccessSummary,
    /// Whether this replaced a registration that was already there, rather than
    /// making a new one.
    ///
    /// Reported rather than glossed over: "Service installed" on a host that
    /// had one already reads as though nothing had been taken away and put
    /// back, and what was taken away and put back is the thing an operator
    /// watching a running agent wants to know about.
    pub replaced_existing: bool,
}

/// What `uninstall` did — and, as importantly, what it did not.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Uninstalled {
    /// Whether a registration was removed.
    pub removed_registration: bool,
    /// Whether the install record was removed.
    pub removed_record: bool,
    /// Whether a definition file was removed, and which.
    pub removed_definition: Option<PathBuf>,
    /// The directories that were **left exactly as they were**.
    ///
    /// `05-infrastructure.md` item 5 stated as a value rather than as a
    /// promise: `service uninstall` prints this list, so an operator can see
    /// that the configuration, the SQLite database, the stored token and the
    /// runner package cache are all still there.
    pub preserved: Vec<PathBuf>,
}

impl fmt::Display for Uninstalled {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        if self.removed_registration {
            writeln!(f, "The service registration was removed.")?;
        } else {
            writeln!(f, "There was no service registration to remove.")?;
        }
        writeln!(f, "Nothing else was deleted. These are untouched:")?;
        for path in &self.preserved {
            writeln!(f, "  {}", path.display())?;
        }
        write!(
            f,
            "The stored GitHub token is untouched too; `auth logout` is what purges it."
        )
    }
}

/// What `set_start_mode` did.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct StartModeChange {
    /// What it was.
    pub from: StartMode,
    /// What it is now.
    pub to: StartMode,
    /// `false` when the registration was already in the requested mode.
    pub changed: bool,
    /// The secret store the new mode obliges, so a caller can tell an operator
    /// whether the token has to move too.
    pub store_scope: crate::secrets::SecretScope,
    /// What the mode change did to the runner root's access control.
    ///
    /// A mode change moves the account the daemon runs as, and the runner root
    /// admits that account by name — so the two move together or the new
    /// registration cannot write its own workspaces.
    pub runner_root: RootAccessSummary,
}

impl fmt::Display for StartModeChange {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        if !self.changed {
            return write!(f, "The service already starts at {}.", self.to);
        }
        write!(
            f,
            "The service now starts at {} instead of {}. It reads the {}-scoped secret store; \
             if the token was stored under the other scope, run `auth login` again. {}",
            self.to, self.from, self.store_scope, self.runner_root
        )
    }
}

/// Install, uninstall, inspect, and switch start mode.
///
/// This is the whole of the library contract `f3` builds `service install`,
/// `service uninstall` and `service status` on. Nothing here prints; every
/// operation returns a value with a [`fmt::Display`] a command can write, so the
/// same facts are available to the TUI and to a JSON document without being
/// re-derived from text.
#[derive(Debug, Clone)]
pub struct ServiceOperations {
    paths: AppPaths,
    identity: ServiceIdentity,
    controls: std::sync::Arc<dyn ControlFactory>,
    runner_root: Option<LocalAbsolutePath>,
}

impl ServiceOperations {
    /// Operates on this host's real service managers.
    #[must_use]
    pub fn on_this_host(paths: AppPaths) -> Self {
        Self::with_controls(
            paths,
            ServiceIdentity::product(),
            std::sync::Arc::new(HostControls),
        )
    }

    /// Operates on the controls a caller supplies.
    ///
    /// Both other arguments are explicit for the same reason: the privileged
    /// installer tests register a real service under a
    /// [`ServiceIdentity::fixture`] name, against a disposable
    /// [`AppPaths::rooted_at`] tree, and must not be able to touch an operator's
    /// installation even by mistake.
    #[must_use]
    pub fn with_controls(
        paths: AppPaths,
        identity: ServiceIdentity,
        controls: std::sync::Arc<dyn ControlFactory>,
    ) -> Self {
        Self {
            paths,
            identity,
            controls,
            runner_root: None,
        }
    }

    /// Points runner-root preparation at a directory the caller owns, for the
    /// **current account**.
    ///
    /// **Only a [`ServiceIdentity::fixture`] registration is allowed to move
    /// it, and the guard is here rather than at the call site.** A product
    /// registration ignores the override entirely and resolves
    /// [`crate::runner_root::default_runner_root`] itself, which is what keeps
    /// "custom roots are never re-ACLed" true no matter what a caller passes.
    ///
    /// It exists because the directory the product uses is
    /// `%SystemDrive%\rman`, and a smoke test that created and re-permissioned
    /// *that* would be editing the machine it runs on from outside its own
    /// fixture. So a fixture aims this at a temporary directory it created and
    /// will delete — and "and will delete" is why the override is always
    /// reconciled for the calling account rather than for the account the start
    /// mode obliges. A boot-mode root admits `SY` and `BA` only, which an
    /// ordinary filtered token is neither, so a test that supplied one could
    /// not then inspect or remove its own temporary directory.
    #[must_use]
    pub fn with_runner_root(mut self, root: LocalAbsolutePath) -> Self {
        self.runner_root = Some(root);
        self
    }

    /// The directories this operates against.
    #[must_use]
    pub const fn paths(&self) -> &AppPaths {
        &self.paths
    }

    /// The registration this operates on.
    #[must_use]
    pub const fn identity(&self) -> &ServiceIdentity {
        &self.identity
    }

    /// Registers `daemon run` with the operating system.
    ///
    /// The order is the contract, and each step is a requirement:
    ///
    /// 1. the four directories are created, because item 2 is about writing them;
    /// 2. **the single-instance lock is taken** — item 1. It is held for the
    ///    whole of the install rather than probed and released, so a daemon that
    ///    starts halfway through cannot end up racing a registration;
    /// 3. neither start-mode domain already holds a registration — item 6's
    ///    record would otherwise describe one of two;
    /// 4. the binary path is resolved and confirmed to be a file — item 6;
    /// 5. the platform registers it;
    /// 6. the record is written.
    ///
    /// # Errors
    ///
    /// [`ServiceError::LockHeld`] when an agent is already running,
    /// [`ServiceError::AlreadyInstalled`], [`ServiceError::BinaryMissing`], and
    /// whatever the platform reports.
    pub fn install(&self, request: &InstallRequest) -> Result<Installed, ServiceError> {
        self.paths
            .create_all()
            .map_err(|source| ServiceError::Paths {
                source: Box::new(source),
            })?;

        // Item 1. The guard lives until the end of this function; dropping it is
        // the release, so an early return releases it too.
        let _guard = self.refuse_while_an_agent_runs()?;
        let adopted = self.adopt_boot_installation(request.start_mode())?;
        // Replacing applies to this account's own registration only: over
        // another installation's it would re-register that service against
        // this account's directories.
        if !adopted {
            self.refuse_foreign("replace")?;
        }

        // --------------------------------------------------------------------
        // AN INSTALL OVER THE SAME START MODE REPLACES; IT DOES NOT REFUSE.
        // --------------------------------------------------------------------
        // This used to refuse any existing registration, and that was wrong in
        // a way that took a real host down.
        //
        // `service install` is *also* how an operator moves to a new version by
        // hand — `install_owned_copy` says so, and the `.old` rename it does
        // exists precisely so that reinstalling over a **running** service
        // works. So the caller replaces the copy the service runs and *then*
        // asks to register it. Refusing at that point does not undo the swap:
        // the daemon is left running a binary nobody registered, the command
        // reports failure, and on macOS the new binary is a program the stored
        // credential's keychain grant does not name. Watched on 0.1.17: the
        // copy under `state/bin` was replaced at 00:16, `service install` said
        // "already registered", and the daemon crash-looped on `-25293` from
        // then on.
        //
        // Registering the same service twice is not what an operator is asking
        // for here and is not what they get: the platform is asked to drop the
        // registration and take it again, which is a deregister followed by a
        // register because that is the only thing launchd, systemd and the SCM
        // all support — `launchctl bootstrap` refuses a label already loaded.
        //
        // The *other* mode is still refused. Moving between boot and login
        // moves the registration between two service managers and changes the
        // account and the secret store with it; `set_start_mode` does that,
        // carefully, and an install is not the place for it.
        let (replacing, previous_was_running) = match self.find_registration()? {
            Some((existing, registration)) if existing == request.start_mode() => {
                (true, registration.running)
            }
            Some((existing, _)) => {
                return Err(ServiceError::AlreadyInstalled {
                    name: self.identity.name().to_string(),
                    existing,
                    requested: request.start_mode(),
                });
            }
            None => (false, false),
        };

        let plan = InstallPlan::resolve(
            self.identity.clone(),
            request,
            ServiceDirectories::of(&self.paths),
        )?;

        // Resolved before the runner root, and used after it: every step from
        // here on has to be able to undo the directory, and a `?` between the
        // preparation and the first fallible use would leave one behind with
        // nothing to say so.
        let control = self.controls.control(plan.start_mode())?;

        // Item 8, and the one step that can refuse an otherwise valid install.
        // Before the platform is asked to register anything, because a
        // registration whose workspaces would land in a directory ordinary local
        // users can write is one that should never have existed — and because
        // undoing a directory is cheaper than undoing a service.
        let root = self.prepare_runner_root(plan.start_mode())?;

        // Read before the registration is dropped, so that a replace which then
        // fails to take can put back what was there. A record this account
        // cannot read leaves nothing to reinstate, which is reported rather
        // than pretended: see `reinstate`.
        let previous = if replacing {
            InstallRecord::read(&self.paths).ok().flatten()
        } else {
            None
        };
        if replacing && let Err(cause) = control.uninstall(&self.identity) {
            return Err(undo_runner_root(&root, "install", &self.identity, cause));
        }

        let definition = match control.install(&plan) {
            Ok(definition) => definition,
            Err(cause) => {
                // Nothing was deregistered on a first install, so there is
                // nothing to put back and `reinstate` says so with `Ok(())`.
                let restored =
                    self.reinstate(control.as_ref(), previous.as_ref(), previous_was_running);
                return Err(rolled_back(
                    retained_runner_root(&root),
                    restored,
                    "install",
                    &self.identity,
                    cause,
                ));
            }
        };
        let review = review_least_privilege(&definition, &plan);
        let record = InstallRecord::of(&plan, &definition, Utc::now());
        if let Err(cause) = record.write(&self.paths) {
            let rollback = control
                .uninstall(&self.identity)
                .map(|_| ())
                .and_then(|()| {
                    self.reinstate(control.as_ref(), previous.as_ref(), previous_was_running)
                });
            return Err(rolled_back(
                retained_runner_root(&root),
                rollback,
                "install",
                &self.identity,
                cause,
            ));
        }

        // Registration is not the postcondition of an install: a service the
        // current session still has to start by hand is only half-installed.
        // This matters most for a logon-triggered Windows task because its
        // trigger has already passed by the time an operator reinstalls it.
        // Start through the same control that registered the definition and
        // roll the whole replacement back if the manager refuses it.
        if let Err(cause) = control.start(&self.identity) {
            let remove_new = control.uninstall(&self.identity).map(|_| ());
            let restore_registration = remove_new.and_then(|()| {
                self.reinstate(control.as_ref(), previous.as_ref(), previous_was_running)
            });
            let restore_record = restore_registration.and_then(|()| match &previous {
                Some(previous) => previous.write(&self.paths),
                None => InstallRecord::remove(&self.paths).map(|_| ()),
            });
            return Err(rolled_back(
                retained_runner_root(&root),
                restore_record,
                "install and start",
                &self.identity,
                cause,
            ));
        }
        Ok(Installed {
            plan,
            definition,
            record,
            review,
            runner_root: root.summary().clone(),
            replaced_existing: replacing,
        })
    }

    /// Puts back a registration this call deregistered in order to replace it.
    ///
    /// `Ok(())` when there was nothing to put back, which is the ordinary case:
    /// a first install deregisters nothing. When there *was* a record, the plan
    /// is rebuilt from it rather than from the request, because the request is
    /// the one that just failed.
    ///
    /// Best effort by construction — the caller passes the result to
    /// [`rolled_back`], which reports a failed rollback alongside the original
    /// cause rather than replacing it.
    fn reinstate(
        &self,
        control: &dyn ServiceControl,
        previous: Option<&InstallRecord>,
        was_running: bool,
    ) -> Result<(), ServiceError> {
        let Some(record) = previous else {
            return Ok(());
        };
        control.install(&record.plan(self.identity.clone()))?;
        if was_running {
            control.start(&self.identity)?;
        }
        Ok(())
    }

    /// Deregisters, and deletes nothing else.
    ///
    /// # Errors
    ///
    /// Whatever the platform reports. A missing registration is **not** an
    /// error: `service uninstall` on a host that has none should say so and
    /// exit cleanly, because an operator running it twice has not made a
    /// mistake.
    pub fn uninstall(&self) -> Result<Uninstalled, ServiceError> {
        let record = InstallRecord::read(&self.paths).ok().flatten();
        let removed_definition = record
            .as_ref()
            .and_then(|record| record.definition_path.clone());

        let mut removed_registration = false;
        // Both domains, not only the recorded one. A record can be lost while a
        // registration survives, and leaving a registration behind because a
        // TOML file was deleted is exactly the state `uninstall` exists to end.
        //
        // Except another installation's: it is skipped, and when it is all
        // there is, the uninstall is refused and this account's record kept.
        let mut foreign = None;
        for mode in [StartMode::Boot, StartMode::Login] {
            let control = self.controls.control(mode)?;
            if let Some(directories) = control
                .query(&self.identity)
                .ok()
                .flatten()
                .and_then(|registration| self.foreign_directories(&registration))
            {
                foreign = Some(directories);
                continue;
            }
            if control.uninstall(&self.identity)? {
                removed_registration = true;
            }
        }
        if !removed_registration && let Some(directories) = foreign {
            return Err(self.foreign_refusal("uninstall", directories));
        }
        let removed_record = InstallRecord::remove(&self.paths)?;
        Ok(Uninstalled {
            removed_registration,
            removed_record,
            removed_definition: removed_definition.filter(|_| removed_registration),
            preserved: self
                .paths
                .all()
                .iter()
                .map(|(_, path)| (*path).to_path_buf())
                .collect(),
        })
    }

    /// Switches between `boot` and `login` **without re-resolving anything**.
    ///
    /// `05-infrastructure.md` item 7. Everything the new registration carries —
    /// the absolute binary path, the arguments, the restart policy, the four
    /// directories — comes from the existing record, so the operator is not
    /// asked to reinstall the product and a binary that has since moved is not
    /// silently swapped for whichever one happens to be running this command.
    ///
    /// On Windows the registration necessarily moves between two different
    /// Windows facilities, because Windows has no service that starts at logon;
    /// see this module's documentation. That is still not a reinstall: no file
    /// is downloaded, replaced, or re-resolved.
    ///
    /// The caller must persist the new mode onto this host's `Host` record so
    /// that `host show` reports it — [`StartModeChange::to`] is the value, and
    /// `f1` already emits `host.service_start_mode` from that field.
    ///
    /// # Errors
    ///
    /// [`ServiceError::NotInstalled`] when there is no record to switch, and
    /// whatever the platform reports.
    pub fn set_start_mode(&self, to: StartMode) -> Result<StartModeChange, ServiceError> {
        let Some(record) = InstallRecord::read(&self.paths)? else {
            return Err(ServiceError::NotInstalled {
                name: self.identity.name().to_string(),
                operation: "switch the start mode of",
            });
        };
        let from = record.start_mode;
        if from == to {
            // Nothing moves, so nothing about the root's access control has to.
            // Reconciling it here would turn a no-op command into one that can
            // fail on a permission it does not need.
            return Ok(StartModeChange {
                from,
                to,
                changed: false,
                store_scope: crate::secrets::SecretScope::for_start_mode(to),
                runner_root: RootAccessSummary::NotApplicable,
            });
        }

        // A real switch only: a no-op touches no service manager at all. Over
        // another installation's registration it would move that service.
        self.refuse_foreign("switch the start mode of")?;

        #[cfg(windows)]
        let arguments = {
            let mut arguments = record.arguments.clone();
            arguments.retain(|argument| argument != WINDOWS_SCM_HOST_ARGUMENT);
            if to == StartMode::Boot {
                arguments.push(WINDOWS_SCM_HOST_ARGUMENT.to_string());
            }
            arguments
        };
        #[cfg(not(windows))]
        let arguments = record.arguments.clone();
        let plan = InstallPlan::unchecked(
            self.identity.clone(),
            to,
            record.binary.clone(),
            record.directories.clone(),
        )
        .with_arguments(arguments)
        .with_restart(record.restart());
        let plan = if record.starts_on_demand {
            plan.started_on_demand()
        } else {
            plan
        };
        let plan = match crate::secrets::PlatformSecretStore::for_start_mode(to) {
            Ok(store) => plan.with_secret_guard(store.guard()),
            Err(_) => plan,
        };

        // Install the target domain before touching the live one. This makes a
        // failed target install a no-op from the operator's point of view and,
        // unlike uninstall-first ordering, never trades a working service for
        // an error message. Resolved before the runner root and used after it,
        // so that no `?` sits between preparing the directory and the first
        // step that knows how to undo it.
        let target = self.controls.control(to)?;
        // The domain being left, resolved here rather than where it is used for
        // the same reason: the only step that removes it runs after the runner
        // root has been prepared, and a `?` there would abandon the target
        // registration, the record and the directory without a word.
        let previous = self.controls.control(from)?;

        // The account changes with the mode, and so must the account the runner
        // root admits: `04-security-recovery.md` requires the selected identity
        // to be *reconciled* when service mode changes, which means adding the
        // operator's on the way to login and dropping it again on the way back.
        // Before the target install, for the same reason `install` does it
        // first — a root that cannot be made safe must not produce a working
        // registration.
        let root = self.prepare_runner_root(to)?;

        let definition = match target.install(&plan) {
            Ok(definition) => definition,
            Err(cause) => {
                return Err(undo_runner_root(
                    &root,
                    "switch start mode",
                    &self.identity,
                    cause,
                ));
            }
        };
        let next_record = InstallRecord::of(&plan, &definition, record.installed_at);
        if let Err(cause) = next_record.write(&self.paths) {
            return Err(rolled_back(
                retained_runner_root(&root),
                target.uninstall(&self.identity),
                "switch start mode",
                &self.identity,
                cause,
            ));
        }

        // Only after the target registration and its durable record exist is
        // it safe to remove the old domain. If that last step fails, remove the
        // target and put the old record back so status and reality agree.
        if let Err(cause) = previous.uninstall(&self.identity) {
            let target_rollback = target.uninstall(&self.identity);
            let record_rollback = record.write(&self.paths);
            return Err(rolled_back(
                retained_runner_root(&root),
                target_rollback.and(record_rollback),
                "switch start mode",
                &self.identity,
                cause,
            ));
        }
        Ok(StartModeChange {
            from,
            to,
            changed: true,
            store_scope: crate::secrets::SecretScope::for_start_mode(to),
            runner_root: root.summary().clone(),
        })
    }

    /// Starts the registration now.
    ///
    /// # Errors
    ///
    /// [`ServiceError::NotInstalled`], or whatever the platform reports.
    pub fn start(&self) -> Result<(), ServiceError> {
        let mode = self.own_registration_mode("start")?;
        self.controls.control(mode)?.start(&self.identity)
    }

    /// The domain holding this account's own registration, for `operation`.
    ///
    /// # Errors
    ///
    /// [`ServiceError::NotInstalled`] when there is none, and
    /// [`ServiceError::ForeignInstallation`] when the only one is another
    /// installation's.
    fn own_registration_mode(&self, operation: &'static str) -> Result<StartMode, ServiceError> {
        match self.registration_for_status()? {
            None => Err(ServiceError::NotInstalled {
                name: self.identity.name().to_string(),
                operation,
            }),
            Some((_, Some(directories))) => Err(self.foreign_refusal(operation, directories)),
            Some((registration, None)) => Ok(registration.start_mode),
        }
    }

    /// Stops the registration. Returns whether it was running.
    ///
    /// # Errors
    ///
    /// As [`ServiceOperations::start`].
    pub fn stop(&self) -> Result<bool, ServiceError> {
        let mode = self.own_registration_mode("stop")?;
        self.controls.control(mode)?.stop(&self.identity)
    }

    /// Everything Journey 5 step 4 asks `service status` to report.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Record`] when local state cannot be read, and whatever
    /// the platform reports. A *stale binary path* is deliberately **not** an
    /// error here: it is a reported state, because a status command that
    /// refused to print anything else would hide the very facts an operator
    /// needs in order to fix it.
    ///
    /// A record **this account may not read** is reported for the same reason
    /// and is the second exception. On a boot-mode host the record was written
    /// by `sudo service install`, and a version before this one wrote it `0600`
    /// — so the operator's own `service status` ended with `Permission denied`
    /// and printed nothing at all, on a host whose registration the service
    /// manager would have described perfectly well. What launchd, systemd or
    /// the SCM says is a separate fact from the record, and it is still worth
    /// having.
    ///
    /// # A registration made from another data root
    ///
    /// The service manager holds one registration per machine under one name,
    /// and every account on the machine sees it. When its command line names
    /// application-data directories that are not this account's, it is
    /// **another installation's service**, and comparing this account's
    /// install record against it would report a stale binary, a mismatched
    /// start mode and a secret store in the wrong scope, each with a remedy
    /// (`service uninstall`, `service install`, `auth login`) that, followed
    /// from this account, breaks a healthy service. So it is reported as what
    /// it is: see [`ForeignService`].
    pub fn status(&self) -> Result<ServiceStatus, ServiceError> {
        match self.registration_for_status()? {
            Some((registration, Some(directories))) => {
                Ok(self.foreign_status(registration, directories))
            }
            found => {
                let (record, record_refused) = match InstallRecord::read(&self.paths) {
                    Ok(record) => (record, None),
                    Err(refusal @ ServiceError::RecordNotPermitted { .. }) => (None, Some(refusal)),
                    Err(error) => return Err(error),
                };
                self.status_at(
                    &self.paths,
                    record,
                    record_refused.as_ref(),
                    found.map(|(registration, _)| registration),
                )
            }
        }
    }

    /// [`Self::status`] for the installation whose directories are `paths`,
    /// from the record already read there.
    fn status_at(
        &self,
        paths: &AppPaths,
        record: Option<InstallRecord>,
        record_refused: Option<&ServiceError>,
        found: Option<Registration>,
    ) -> Result<ServiceStatus, ServiceError> {
        let last_github_contact = last_github_contact(paths)?;
        let drift = record
            .as_ref()
            .and_then(|record| definition_drift(self.controls.as_ref(), &self.identity, record));
        let credential_rejected_since = github_credential_rejected_since(paths).ok().flatten();
        let credential_unreadable_since = credential_unreadable_since(paths).ok().flatten();
        let probed = self.controls.unattended_login();
        let unattended = record.as_ref().and_then(|record| {
            // The account is only read where something was probed to judge
            // it against.
            let account = probed.as_ref().map_or_else(String::new, |_| {
                found
                    .as_ref()
                    .and_then(|registration| registration.account.clone())
                    .unwrap_or_else(|| service_account_name(&record.account))
            });
            unattended_gap(record.start_mode, &account, probed.as_ref())
        });
        let now = Utc::now();
        let installed = record.is_some() || found.is_some();
        let status = ServiceStatus::compose(
            self.identity.clone(),
            record,
            record_refused,
            found,
            last_github_contact,
            paths,
        )
        .with_definition_drift(drift)
        .with_credential_rejection(credential_rejected_since)
        .with_credential_unreadable(credential_unreadable_since)
        .with_launches_blocked(crate::launch_health::launches_blocked(paths, now))
        .with_unattended_gap(unattended)
        .with_host_unfit(
            crate::host_fitness::host_unfit_in_force(paths, now).filter(|_| installed),
        );
        let restart = status.restart_command();
        Ok(status.with_stall(
            crate::daemon_heartbeat::liveness(paths, now).stall(last_github_contact, &restart),
        ))
    }

    /// The installed definition, when it is not what this build renders for
    /// the recorded installation. See [`definition_drift`].
    ///
    /// # Errors
    ///
    /// Whatever reading the install record reports.
    pub fn definition_drift(&self) -> Result<Option<DefinitionDrift>, ServiceError> {
        Ok(InstallRecord::read(&self.paths)?
            .and_then(|record| definition_drift(self.controls.as_ref(), &self.identity, &record)))
    }

    /// Writes the plist this build renders over an outdated one, then has a
    /// detached helper boot the job out and bootstrap it again from the new
    /// file.
    ///
    /// launchd reads a plist only when the job is bootstrapped. Rewriting the
    /// file changes nothing for a job that is already loaded, and a `KeepAlive`
    /// restart reuses the loaded copy. So the job has to be booted out, and
    /// that terminates the daemon that asked for it. The helper runs in a
    /// session of its own, which launchd does not kill with the job, and
    /// retries the bootstrap: launchd refuses it for a few seconds while the
    /// old job is still exiting (`5: Input/output error`, measured).
    ///
    /// Call this only from the daemon the job runs, and only while it holds no
    /// runner. It is an operation on the registration the daemon itself runs
    /// under, and it never changes the start mode.
    ///
    /// # Errors
    ///
    /// [`ServiceError::Control`] or [`ServiceError::NeedsElevation`] when the
    /// plist cannot be written or the helper cannot be started. The loaded job
    /// is untouched in both cases.
    #[cfg(target_os = "macos")]
    pub fn reload_launchd_definition(&self, drift: &DefinitionDrift) -> Result<(), ServiceError> {
        // The record names the start mode; the account this process runs as has
        // to agree, or the record describes a registration other than the one
        // running, and root would end up rewriting an operator's LaunchAgent.
        // SAFETY: `getuid` reads the calling process's real user id and cannot
        // fail.
        let root = unsafe { libc::getuid() } == 0;
        if root != (drift.start_mode == StartMode::Boot) {
            return Err(ServiceError::Control {
                operation: "rewrite",
                name: self.identity.name().to_string(),
                manager: "launchd",
                detail: format!(
                    "the install record says --start-at {}, but this daemon runs as {}; the plist \
                     is left as it is",
                    drift.start_mode,
                    if root { "root" } else { "the operator" }
                ),
            });
        }
        replace_definition(self.identity.name(), drift)?;
        // The definition is now this build's, as after the WSL unit rewrite.
        // Best effort: the record says who wrote the plist and nothing reads it
        // to decide whether to repair.
        if let Ok(Some(mut record)) = InstallRecord::read(&self.paths) {
            record.installed_by_version = env!("CARGO_PKG_VERSION").to_string();
            let _ = record.write(&self.paths);
        }
        sys::reload_detached(&self.identity, drift.start_mode, &drift.path)
    }

    /// Creates or reconciles the runner root this start mode's account needs.
    ///
    /// The account is not an argument: it is [`ServiceAccount::for_start_mode`],
    /// the same function the registration's own principal comes from, so the
    /// directory admits exactly the identity the definition registers and a mode
    /// change reconciles both together or neither.
    ///
    /// On macOS and Linux this is a no-op that returns
    /// [`RootAccessSummary::NotApplicable`]; see [`crate::runner_root_access`].
    fn prepare_runner_root(&self, mode: StartMode) -> Result<RootAccessChange, ServiceError> {
        #[cfg(not(windows))]
        {
            // `runner_root` is consumed here as well as in the Windows arm: a
            // field only one platform reads is a dead field on the other.
            let _ = (mode, &self.runner_root);
            Ok(RootAccessChange::not_applicable())
        }
        #[cfg(windows)]
        {
            let wrap = |source| ServiceError::RunnerRoot {
                source: Box::new(source),
            };
            // The test seam, and the two things allowed through it. `cfg!(test)`
            // is false in every shipped binary, so what a released build honours
            // is the fixture name alone — and a fixture name cannot be the
            // product's, which is what keeps a released `service install`
            // pointed at the platform default whatever a caller passes.
            //
            // An overridden root is always reconciled **for this account**,
            // which is the foreground admission — a real mode of the product
            // rather than a concession invented here. It has to be: a boot-mode
            // root admits `SY` and `BA` only, and a test process holding an
            // ordinary filtered token is neither, so it could not inspect the
            // temporary directory it just supplied nor delete it afterwards.
            // What that costs is that the *boot* descriptor is not proved
            // through this path; it is proved purely, by this module's
            // `the_runner_root_a_boot_registration_needs_admits_only_the_service`
            // and by `runner_root_access`'s own tests, and for real by the
            // privileged installer test, which runs elevated.
            if let Some(root) = self
                .runner_root
                .as_ref()
                .filter(|_| self.identity.is_fixture() || cfg!(test))
            {
                let admission = RootAdmission::of_this_account().map_err(wrap)?;
                return crate::runner_root_access::reconcile(&self.paths, root, &admission)
                    .map_err(wrap);
            }

            let admission = match ServiceAccount::for_start_mode(mode) {
                // A boot registration runs as LocalSystem, which the constant
                // `SY` ace already names.
                ServiceAccount::LocalSystem => RootAdmission::LocalSystem,
                // A login registration runs as this account, under a filtered
                // token in which Administrators is deny-only — so without an
                // ace of its own it would be admitted by nothing.
                ServiceAccount::InvokingUser | ServiceAccount::Root => {
                    RootAdmission::of_this_account().map_err(wrap)?
                }
            };
            crate::runner_root_access::ensure_default_root(&self.paths, &admission).map_err(wrap)
        }
    }

    /// Takes the single-instance lock, or refuses with `d1`'s own message.
    fn refuse_while_an_agent_runs(&self) -> Result<HostLock, ServiceError> {
        HostLock::try_acquire(&self.paths, LockKind::SingleInstance).map_err(
            |source| match source {
                held @ LockError::Held { .. } => ServiceError::LockHeld {
                    source: Box::new(held),
                },
                other => ServiceError::LockUnreadable {
                    source: Box::new(other),
                },
            },
        )
    }

    /// The registration, in whichever domain holds it.
    fn find_registration(&self) -> Result<Option<(StartMode, Registration)>, ServiceError> {
        for mode in [StartMode::Boot, StartMode::Login] {
            let control = self.controls.control(mode)?;
            if let Some(registration) = control.query(&self.identity)? {
                return Ok(Some((registration.start_mode, registration)));
            }
        }
        Ok(None)
    }

    /// The registration [`Self::status`] describes, with the directories it
    /// runs against when they are not this account's: this account's own
    /// registration when either domain holds one, else whichever there is.
    ///
    /// [`Self::find_registration`] stops at the boot domain, so a boot service
    /// made from another data root would hide this account's own login
    /// registration. The other domain is asked only in that case, and a
    /// failure to ask it is not this status's failure.
    fn registration_for_status(
        &self,
    ) -> Result<Option<(Registration, Option<ServiceDirectories>)>, ServiceError> {
        let Some((mode, found)) = self.find_registration()? else {
            return Ok(None);
        };
        let Some(directories) = self.foreign_directories(&found) else {
            return Ok(Some((found, None)));
        };
        let other = match mode {
            StartMode::Boot => StartMode::Login,
            StartMode::Login => StartMode::Boot,
        };
        let own = self
            .controls
            .control(other)
            .ok()
            .and_then(|control| control.query(&self.identity).ok().flatten())
            .filter(|registration| self.foreign_directories(registration).is_none());
        Ok(Some(match own {
            Some(own) => (own, None),
            None => (found, Some(directories)),
        }))
    }

    /// Moves a Linux boot service registered against another tree onto this
    /// one, which for `root` is the system tree. Returns whether it did.
    ///
    /// `service install` calls this before it opens anything in this tree, so
    /// that the copy lands in an empty one; the install itself calls it again,
    /// which then only confirms the registration is to be replaced.
    ///
    /// Before the system tree, a boot service ran against whichever tree
    /// `sudo` resolved: `/root`'s on some distributions, the operator's own on
    /// others. A boot unit with no capabilities cannot open the operator's, and
    /// `ProtectHome=` hides both, so the service is stopped, its configuration
    /// and state are copied here unless this tree already has its own, and the
    /// install then replaces the registration. The old tree is left as it was.
    ///
    /// # Errors
    ///
    /// Whatever stopping the old service or copying its tree reports.
    pub fn adopt_boot_installation(&self, mode: StartMode) -> Result<bool, ServiceError> {
        #[cfg(target_os = "linux")]
        return self.adopt_boot_installation_on_linux(mode);
        #[cfg(not(target_os = "linux"))]
        {
            let _ = mode;
            Ok(false)
        }
    }

    #[cfg(target_os = "linux")]
    fn adopt_boot_installation_on_linux(&self, mode: StartMode) -> Result<bool, ServiceError> {
        if mode != StartMode::Boot {
            return Ok(false);
        }
        self.refuse_overridden_account()?;
        if !crate::host_fitness::is_elevated() {
            return Ok(false);
        }
        let Some((StartMode::Boot, found)) = self.find_registration()? else {
            return Ok(false);
        };
        let Some(old) = self.foreign_directories(&found) else {
            return Ok(false);
        };
        self.controls
            .control(StartMode::Boot)?
            .stop(&self.identity)?;
        // No service was ever installed against this tree, so whatever is in it
        // is what an interrupted attempt or a stray command left: set aside,
        // never deleted, in favour of the data the running service used. A
        // tree with its own install record keeps it.
        if matches!(InstallRecord::read(&self.paths), Ok(None)) {
            let stamp = Utc::now().format("%Y%m%dT%H%M%SZ").to_string();
            for (from, to, skip) in [
                (&old.config, self.paths.config_dir(), None),
                // `service install` copies the binary in again.
                (&old.state, self.paths.state_dir(), Some("bin")),
            ] {
                set_aside(to, &stamp)
                    .and_then(|()| copy_tree(from, to, skip))
                    .map_err(|error| ServiceError::Control {
                        operation: "move the data of",
                        name: self.identity.name().to_string(),
                        manager: "systemd",
                        detail: format!(
                            "cannot copy {} to {}: {error}",
                            from.display(),
                            to.display()
                        ),
                    })?;
            }
        }
        Ok(true)
    }

    /// Refuses a Linux boot install over a unit an administrator's drop-in made
    /// run as another account.
    ///
    /// A drop-in outlives the unit file `service install` rewrites, so the new
    /// unit would run as that account too, and that account cannot open the
    /// system tree `root` owns. Said before anything is stopped or copied.
    #[cfg(target_os = "linux")]
    fn refuse_overridden_account(&self) -> Result<(), ServiceError> {
        let Some((StartMode::Boot, found)) = self.find_registration()? else {
            return Ok(());
        };
        match found.account.as_deref() {
            Some(account) if account != ServiceAccount::Root.as_str() => {
                Err(ServiceError::Control {
                    operation: "install",
                    name: self.identity.name().to_string(),
                    manager: "systemd",
                    detail: format!(
                        "a drop-in under {SYSTEMD_SYSTEM_DIR}/{}.d/ makes it run as {account}, and \
                         a boot service must run as root to use {}. Remove `User=` and `Group=` \
                         from that drop-in, run `sudo systemctl daemon-reload`, and install again",
                        self.identity.systemd_unit(),
                        crate::paths::SYSTEM_DATA_ROOT,
                    ),
                })
            }
            _ => Ok(()),
        }
    }

    /// Refuses `operation` when the machine's registration is another
    /// installation's. See [`ServiceError::ForeignInstallation`].
    fn refuse_foreign(&self, operation: &'static str) -> Result<(), ServiceError> {
        match self.registration_for_status()? {
            Some((_, Some(directories))) => Err(self.foreign_refusal(operation, directories)),
            _ => Ok(()),
        }
    }

    /// [`ServiceError::ForeignInstallation`] for the installation at
    /// `directories`.
    fn foreign_refusal(
        &self,
        operation: &'static str,
        directories: ServiceDirectories,
    ) -> ServiceError {
        let foreign = self.foreign_service_at(directories);
        ServiceError::ForeignInstallation {
            name: self.identity.name().to_string(),
            operation,
            installed_by: foreign.installed_by(),
            act_as: foreign.act_as(),
        }
    }

    /// The directories `registration` runs against, when they are not this
    /// account's. See [`ForeignService`].
    fn foreign_directories(&self, registration: &Registration) -> Option<ServiceDirectories> {
        ServiceDirectories::from_command_line(&registration.command_line)
            .filter(|directories| !same_directory(&directories.config, self.paths.config_dir()))
    }

    /// The machine's service and the installation it belongs to, when that is
    /// not this account's, without reading anything of that installation's
    /// beyond its path. `None` when the service is this account's, when there
    /// is none, or when the service manager cannot be asked.
    #[must_use]
    pub fn foreign_service(&self) -> Option<ForeignService> {
        let (_, directories) = self.registration_for_status().ok()??;
        Some(self.foreign_service_at(directories?))
    }

    /// The [`ForeignService`] for an installation at `directories`, before
    /// anything of its own is read.
    fn foreign_service_at(&self, directories: ServiceDirectories) -> ForeignService {
        let root = directories.root();
        let home = host_home();
        // This account's own installation under other directories, when the
        // four are exactly a layout a command of this account resolves.
        let this_account = home
            .as_deref()
            .filter(|home| contains_directory(home, &root))
            .and_then(|_| {
                if directories == ServiceDirectories::of(&AppPaths::rooted_at(&root)) {
                    Some(format!(
                        "with `--data-dir {}`",
                        quote_argument(&root.to_string_lossy())
                    ))
                } else {
                    AppPaths::discover()
                        .ok()
                        .filter(|standard| directories == ServiceDirectories::of(standard))
                        .map(|_| "without `--data-dir`".to_owned())
                }
            });
        ForeignService {
            owner: data_root_owner(&root, home.as_deref()),
            this_account,
            root,
            directories,
            local_root: ServiceDirectories::of(&self.paths).root(),
            local_record: InstallRecord::path(&self.paths),
            unused_local_record: InstallRecord::read(&self.paths).ok().flatten(),
            unreadable: None,
        }
    }

    /// [`Self::status`] for a registration made from another data root.
    ///
    /// What that installation recorded is read when this account may read it,
    /// and the status is then exactly the one its owner would see. When it may
    /// not, the status holds what the service manager says and nothing it
    /// would have to guess.
    fn foreign_status(
        &self,
        registration: Registration,
        directories: ServiceDirectories,
    ) -> ServiceStatus {
        let service_paths = directories.paths();
        let mut foreign = self.foreign_service_at(directories);
        let unreadable = match InstallRecord::read(&service_paths) {
            Ok(Some(record)) => {
                match self.status_at(
                    &service_paths,
                    Some(record),
                    None,
                    Some(registration.clone()),
                ) {
                    Ok(status) => return status.with_foreign(foreign),
                    Err(error) => error.to_string(),
                }
            }
            Ok(None) => format!(
                "there is no install record at {}",
                InstallRecord::path(&service_paths).display()
            ),
            // Not the error's own words: `RecordNotPermitted` and
            // `RecordUnreadable` both end in a `service install` remedy, which
            // from this account would re-register the machine's service
            // against the wrong directories.
            Err(
                ServiceError::RecordNotPermitted { path, detail }
                | ServiceError::RecordUnreadable { path, detail }
                | ServiceError::Record { path, detail, .. },
            ) => format!("this account cannot read {} ({detail})", path.display()),
            Err(error) => error.to_string(),
        };
        foreign.unreadable = Some(unreadable);
        ServiceStatus::foreign_unread(self.identity.clone(), registration, foreign)
    }

    /// Moves this account's own configuration aside, when no registration on
    /// this machine runs against it: `host forget-local`.
    ///
    /// Everything in the configuration directory -- the install record, the
    /// database with its host row and policies, `runner.env` and the rest -- is
    /// **renamed** into a `forgotten-<timestamp>` directory beside it, never
    /// deleted, so moving it back restores it exactly. The state, runtime and
    /// log directories are left alone even where the platform puts them inside
    /// the configuration directory (macOS does), and so is every secret store
    /// and every directory a registration names.
    ///
    /// Both domains are asked, strictly: a domain that cannot be asked might
    /// hold this account's own registration, so it refuses rather than reads
    /// as empty.
    ///
    /// # Errors
    ///
    /// [`ServiceError::LocalConfigurationInUse`] when a registration on this
    /// machine runs against these directories, when a registration from
    /// another data root names a directory overlapping them, or when an agent
    /// holds this account's single-instance lock. [`ServiceError::Record`] when
    /// the move fails; whatever had already moved is put back first, and
    /// anything that could not be put back is named.
    pub fn forget_local(&self, at: DateTime<Utc>) -> Result<ForgottenLocal, ServiceError> {
        let config = self.paths.config_dir();
        let in_use = |detail: String| ServiceError::LocalConfigurationInUse { detail };
        let mut service_root = None;
        for mode in [StartMode::Boot, StartMode::Login] {
            let registration = self
                .controls
                .control(mode)
                .and_then(|control| control.query(&self.identity))
                .map_err(|error| {
                    in_use(format!(
                        "whether a {mode} registration runs against it could not be read ({error})"
                    ))
                })?;
            let Some(registration) = registration else {
                continue;
            };
            let Some(directories) = self.foreign_directories(&registration) else {
                return Err(in_use(format!(
                    "{} holds a registration that runs against {}. `service status` describes it",
                    registration.manager,
                    config.display()
                )));
            };
            if let Some(overlap) = directories.all().into_iter().find(|directory| {
                contains_directory(directory, config) || contains_directory(config, directory)
            }) {
                return Err(in_use(format!(
                    "the machine's service runs against {}, which overlaps {}",
                    overlap.display(),
                    config.display()
                )));
            }
            service_root.get_or_insert_with(|| directories.root());
        }
        let _lock =
            HostLock::try_acquire(&self.paths, LockKind::SingleInstance).map_err(|source| {
                in_use(format!(
                    "an agent may be running against these directories: {source}"
                ))
            })?;
        let failed = |operation: &'static str, path: &Path| {
            let path = path.to_path_buf();
            move |error: std::io::Error| ServiceError::Record {
                operation,
                path,
                detail: error.to_string(),
            }
        };
        // Never the agent's own directories, wherever the platform nests them.
        let kept = [
            self.paths.state_dir(),
            self.paths.runtime_dir(),
            self.paths.logs_dir(),
        ];
        let mut entries = Vec::new();
        for entry in std::fs::read_dir(config).map_err(failed("list", config))? {
            let entry = entry.map_err(failed("list", config))?.path();
            let archived = entry
                .file_name()
                .is_some_and(|name| name.to_string_lossy().starts_with(FORGOTTEN_PREFIX));
            if !archived && !kept.iter().any(|kept| contains_directory(&entry, kept)) {
                entries.push(entry);
            }
        }
        if entries.is_empty() {
            return Ok(ForgottenLocal {
                archive: None,
                moved: entries,
                service_root,
            });
        }
        entries.sort();
        let archive = config.join(format!("{FORGOTTEN_PREFIX}{}", at.format("%Y%m%dT%H%M%SZ")));
        std::fs::create_dir(&archive).map_err(failed("create", &archive))?;
        let inside = |entry: &Path| archive.join(entry.file_name().unwrap_or_default());
        for (index, entry) in entries.iter().enumerate() {
            if let Err(error) = std::fs::rename(entry, inside(entry)) {
                let stranded: Vec<String> = entries[..index]
                    .iter()
                    .rev()
                    .filter(|done| std::fs::rename(inside(done), done).is_err())
                    .map(|done| inside(done).display().to_string())
                    .collect();
                let _ = std::fs::remove_dir(&archive);
                let mut detail = error.to_string();
                if !stranded.is_empty() {
                    detail.push_str(&format!(
                        "; these could not be put back and are still in the archive: {}",
                        stranded.join(", ")
                    ));
                }
                return Err(ServiceError::Record {
                    operation: "archive",
                    path: entry.clone(),
                    detail,
                });
            }
        }
        Ok(ForgottenLocal {
            archive: Some(archive),
            moved: entries,
            service_root,
        })
    }
}

/// The name every `host forget-local` archive starts with. A later run leaves
/// earlier archives where they are.
pub const FORGOTTEN_PREFIX: &str = "forgotten-";

/// What [`ServiceOperations::forget_local`] did.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ForgottenLocal {
    /// Where the configuration went, or `None` when there was nothing to move.
    pub archive: Option<PathBuf>,
    /// What was moved, by its old path.
    pub moved: Vec<PathBuf>,
    /// The data root of the machine's service, when one runs from another
    /// installation. Named so the operator can see it was not touched.
    pub service_root: Option<PathBuf>,
}

impl fmt::Display for ForgottenLocal {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let Some(archive) = &self.archive else {
            return write!(
                f,
                "Nothing to archive: this account's configuration directory is empty."
            );
        };
        writeln!(f, "Archived this account's unused local configuration")?;
        writeln!(f, "  archive                   {}", archive.display())?;
        for path in &self.moved {
            writeln!(f, "  moved                     {}", path.display())?;
        }
        if let Some(root) = &self.service_root {
            writeln!(
                f,
                "  service data root         {} (untouched)",
                root.display()
            )?;
        }
        write!(
            f,
            "  restore                   move everything in the archive back into its parent \
             directory"
        )
    }
}

/// Whether two directory spellings name the same place: the same text on
/// this platform's terms, or the same canonical directory.
fn same_directory(left: &Path, right: &Path) -> bool {
    let text = |path: &Path| {
        path.to_string_lossy()
            .trim_end_matches(['/', '\\'])
            .to_owned()
    };
    same_path_text(&text(left), &text(right))
        || matches!(
            (std::fs::canonicalize(left), std::fs::canonicalize(right)),
            (Ok(left), Ok(right)) if left == right
        )
}

/// Where the remedy starts in a [`StatusProblem`]'s detail: the sentence
/// openings every builder above uses for it.
const REMEDY_OPENINGS: [&str; 8] = [
    ". Run ",
    ". If nothing is waiting",
    ". Re-register",
    ". Switch the start mode",
    " Sign in again",
    ". Fix: ",
    "; to do it now",
    "; if the service manager denies",
];

/// A problem's diagnosis without its remedy. See
/// [`ServiceStatus::with_foreign`].
///
/// A detail that still names a command that changes the registration or the
/// credential after the cut -- a builder this list does not know yet -- is
/// reduced to the first clause rather than passed on, because the cost of
/// showing too little is a shorter sentence and the cost of showing too much
/// is a broken service.
fn diagnosis_only(detail: &str) -> String {
    let cut = REMEDY_OPENINGS
        .iter()
        .filter_map(|opening| detail.find(opening))
        .min()
        .unwrap_or(detail.len());
    let diagnosis = detail[..cut].trim_end_matches(['.', ' ']);
    let names_a_change = |text: &str| {
        [
            "service install",
            "service uninstall",
            "auth login",
            "launchctl",
            "systemctl",
        ]
        .iter()
        .any(|command| text.contains(command))
    };
    if !names_a_change(diagnosis) {
        return diagnosis.to_owned();
    }
    // Clause ends followed by a space, so a `.` inside a path does not cut.
    let end = [", ", "; ", ". "]
        .iter()
        .filter_map(|separator| diagnosis.find(separator))
        .min()
        .unwrap_or(diagnosis.len());
    let first = &diagnosis[..end];
    if names_a_change(first) {
        "the installation's own records report this".to_owned()
    } else {
        first.to_owned()
    }
}

/// A path's components as this platform compares them: case-insensitively
/// on Windows.
fn path_key(path: &Path) -> Vec<String> {
    path.components()
        .map(|component| {
            let text = component.as_os_str().to_string_lossy();
            if cfg!(windows) {
                text.to_lowercase()
            } else {
                text.into_owned()
            }
        })
        .collect()
}

/// Whether `inner` is `outer` or a directory under it, by the rule
/// [`same_directory`] uses: on this platform's terms, or canonically.
fn contains_directory(outer: &Path, inner: &Path) -> bool {
    path_key(inner).starts_with(&path_key(outer))
        || matches!(
            (std::fs::canonicalize(outer), std::fs::canonicalize(inner)),
            (Ok(outer), Ok(inner)) if inner.starts_with(&outer)
        )
}

/// The account whose data root `root` is, when the path says: the folder
/// under the directory that holds this account's `home`, `root` for root's
/// home on Unix, and `LocalSystem` for its profile on Windows. `None` when
/// the path names nobody, which is reported as the path alone.
#[must_use]
pub fn data_root_owner(root: &Path, home: Option<&Path>) -> Option<String> {
    let target = path_key(root);
    if cfg!(windows) {
        if target
            .windows(3)
            .any(|run| run == ["system32", "config", "systemprofile"])
        {
            return Some("LocalSystem".to_owned());
        }
    } else if [
        "/root",
        "/var/root",
        "/private/var/root",
        crate::paths::SYSTEM_DATA_ROOT,
    ]
    .iter()
    .any(|home| root.starts_with(home))
    {
        return Some("root".to_owned());
    }
    let users = path_key(home?.parent()?);
    // A home directly under the root (`/root` under `sudo`) names no directory
    // of homes: every path would then "belong" to its first component.
    if users.len() < 2 {
        return None;
    }
    if target.len() > users.len() && target[..users.len()] == users[..] {
        root.components()
            .nth(users.len())
            .map(|name| name.as_os_str().to_string_lossy().into_owned())
    } else {
        None
    }
}

/// A registration whose command line names application-data directories that
/// are not this account's: **another installation's service**.
///
/// Every account on a machine sees the one registration its service manager
/// holds under the product's name. A second account -- one that ran a
/// login-mode install once, say -- has an install record and a database of its
/// own, and comparing them against the other installation's registration used
/// to report a stale binary, a mismatched start mode and a secret store in the
/// wrong scope, with `service uninstall`, `service install` and `auth login`
/// as the remedies. Followed from that account, each of them breaks or
/// replaces a service that is healthy. So the registration is reported as the
/// other installation's, with what can be read of it, and this account's own
/// record as the unused configuration it is.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ForeignService {
    /// The directories its command line names.
    pub directories: ServiceDirectories,
    /// The data root they sit under. See [`ServiceDirectories::root`].
    pub root: PathBuf,
    /// The account that data root belongs to, when its path says.
    pub owner: Option<String>,
    /// How a command run by this account reaches the installation, when it is
    /// this account's own under other directories -- an install made with
    /// `--data-dir`, seen from a command run without it, or the other way
    /// round. `None` for another account's.
    pub this_account: Option<String>,
    /// This account's own data root, which no registration runs against.
    pub local_root: PathBuf,
    /// Where this account's own install record is, or would be.
    pub local_record: PathBuf,
    /// This account's own install record, from an earlier install.
    pub unused_local_record: Option<InstallRecord>,
    /// Why the service's own records could not be read, or `None` when they
    /// were and the status describes them.
    pub unreadable: Option<String>,
}

impl ForeignService {
    /// How to see the service's own details: as its owner, or elevated.
    #[must_use]
    pub fn where_to_look(&self) -> String {
        if let Some(reach) = &self.this_account {
            return reach.clone();
        }
        let elevated = if cfg!(windows) {
            "from an elevated terminal (Run as administrator)"
        } else {
            "with sudo"
        };
        match &self.owner {
            Some(owner) if owner != "LocalSystem" && owner != "root" => {
                format!("{elevated}, or signed in as {owner}")
            }
            _ => elevated.to_owned(),
        }
    }

    /// Where a change to the service has to be made from: the installation's
    /// own account, because every remedy a command prints acts on the
    /// directories of whoever runs it. Elevation alone reads the service's
    /// records but is still this account.
    #[must_use]
    pub fn act_as(&self) -> String {
        if let Some(reach) = &self.this_account {
            return reach.clone();
        }
        match &self.owner {
            Some(owner) if owner != "LocalSystem" && owner != "root" => {
                format!("signed in as {owner}")
            }
            _ => format!(
                "from the account whose data root {} is",
                self.root.display()
            ),
        }
    }

    /// Whether the service's own records could not be read, so only what the
    /// service manager says is known.
    #[must_use]
    pub const fn is_unread(&self) -> bool {
        self.unreadable.is_some()
    }

    /// Who installed it, for a sentence.
    #[must_use]
    pub fn installed_by(&self) -> String {
        match &self.owner {
            Some(owner) => format!("{owner}'s data root {}", self.root.display()),
            None => format!("the data root {}", self.root.display()),
        }
    }

    /// The data root and its owner, for a field: `<root> (<owner>)`.
    #[must_use]
    pub fn label(&self) -> String {
        match &self.owner {
            Some(owner) => format!("{} ({owner})", self.root.display()),
            None => self.root.display().to_string(),
        }
    }

    /// The note describing this account's own record, when there is one.
    #[must_use]
    pub fn unused_local_note(&self) -> Option<String> {
        let record = self.unused_local_record.as_ref()?;
        Some(format!(
            "unused local configuration from an earlier install: {} records a {} registration \
             made by runner-manager {} on {}, and no service on this machine runs against it. \
             `runner-manager host forget-local` moves it aside; it never touches the service's \
             own directories or any secret.",
            self.local_record.display(),
            record.start_mode,
            record.installed_by_version,
            record.installed_at.format("%Y-%m-%d"),
        ))
    }
}

// ---------------------------------------------------------------------------
// Status
// ---------------------------------------------------------------------------

/// One thing `service status` has to report as wrong.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct StatusProblem {
    /// What it is about.
    pub subject: &'static str,
    /// What is wrong, and what to do.
    pub detail: String,
}

impl fmt::Display for StatusProblem {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "{}: {}", self.subject, self.detail)
    }
}

/// Everything `service status` reports.
///
/// Journey 5 step 4 names four of these — the start mode, the resolved binary
/// path, the diagnostic log path, and the last successful GitHub contact — and
/// the release gate adds the fifth: *"`service status` reports a stale binary
/// path as an error rather than appearing healthy"*. [`Self::is_healthy`] is
/// what an exit code should be derived from, and it is false whenever
/// [`Self::problems`] is non-empty.
#[derive(Debug, Clone)]
pub struct ServiceStatus {
    identity: ServiceIdentity,
    record: Option<InstallRecord>,
    registration: Option<Registration>,
    binary: Option<BinaryPath>,
    log_file: PathBuf,
    store: Option<crate::secrets::ActiveStore>,
    last_github_contact: Option<DateTime<Utc>>,
    runner_root: Option<(PathBuf, RootAccessReport)>,
    credential_rejected_since: Option<DateTime<Utc>>,
    launches_blocked: Option<crate::launch_health::LaunchesBlocked>,
    unattended_gap: Option<UnattendedGap>,
    foreign: Option<ForeignService>,
    problems: Vec<StatusProblem>,
    notes: Vec<String>,
}

/// Why a registration does not come back by itself after an unattended
/// restart, and what an operator can do about it.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct UnattendedGap {
    /// One or more sentences, the way `service status` prints them.
    pub reason: String,
    /// What changes it. Never something this product does by itself.
    pub remedy: String,
}

/// The name of the account a registration runs as: the invoking user's own
/// for a login-mode one.
#[must_use]
pub fn service_account_name(account: &ServiceAccount) -> String {
    match account {
        // Under `sudo` the invoking user is the one sudo names, not root.
        ServiceAccount::InvokingUser => std::env::var("SUDO_USER")
            .ok()
            .filter(|user| !user.is_empty() && crate::host_fitness::is_elevated())
            .or_else(crate::unattended_login::current_account)
            .unwrap_or_else(|| "the operator".to_owned()),
        other => other.as_str().to_owned(),
    }
}

/// The account `registration` names, which an administrator can change from
/// the one the install record saved, and otherwise the record's.
fn registered_account<'a>(registration: Option<&'a Registration>, recorded: &'a str) -> &'a str {
    registration
        .and_then(|registration| registration.account.as_deref())
        .unwrap_or(recorded)
}

/// A Windows service account as `QueryServiceConfigW` names it, spelled the
/// way [`ServiceAccount`] does, so a service nobody edited reports the account
/// the record holds.
#[cfg(any(windows, test))]
fn windows_service_account(name: &str) -> String {
    if name.eq_ignore_ascii_case("LocalSystem") || name.eq_ignore_ascii_case(".\\LocalSystem") {
        ServiceAccount::LocalSystem.as_str().to_string()
    } else {
        name.to_string()
    }
}

/// A Task Scheduler `UserId`, unless it is a raw SID, which names no account
/// an operator would recognise.
#[cfg(any(windows, test))]
fn scheduled_task_account(user_id: Option<String>) -> Option<String> {
    user_id.filter(|id| !id.to_ascii_uppercase().starts_with("S-1-"))
}

/// Works out the gap for a registration in `mode` running as `account`.
///
/// `found` is `None` where nothing could be probed (every platform but macOS):
/// a login registration then keeps the general statement that it waits for a
/// sign-in. On a Mac the statement depends on automatic login and FileVault,
/// and a login registration that automatic login brings back has no gap. The
/// earlier statement was printed for every login registration, so a Mac set to
/// sign its runner account in automatically was told it would not resume.
#[must_use]
pub fn unattended_gap(
    mode: StartMode,
    account: &str,
    found: Option<&crate::unattended_login::UnattendedLogin>,
) -> Option<UnattendedGap> {
    let Some(found) = found else {
        return (mode == StartMode::Login).then(|| UnattendedGap {
            reason: "This registration starts at login, so the agent does not run until the \
                     operator signs in; this host does not resume work after an unattended \
                     reboot."
                .to_owned(),
            remedy: "For machine-on operation, move the service and credential to `--start-at \
                     boot` from an elevated terminal."
                .to_owned(),
        });
    };
    let resume = crate::unattended_login::resume(found, mode, account);
    if matches!(resume, crate::unattended_login::Resume::Unknown(_)) {
        // `host doctor` says what could not be read; a note here would claim
        // a gap nobody has seen.
        return None;
    }
    Some(UnattendedGap {
        reason: resume.explain(account)?,
        remedy: resume.remedy().unwrap_or_else(|| {
            "Run `runner-manager host doctor` on the Mac's desktop, where automatic login and \
             FileVault can be read."
                .to_owned()
        }),
    })
}

impl ServiceStatus {
    /// `record_refused` carries a [`ServiceError::RecordNotPermitted`] when
    /// there **is** a record and this account may not read it, which is not the
    /// same state as having none and must not be reported as one. See
    /// [`Operations::status`].
    fn compose(
        identity: ServiceIdentity,
        record: Option<InstallRecord>,
        record_refused: Option<&ServiceError>,
        registration: Option<Registration>,
        last_github_contact: Option<DateTime<Utc>>,
        paths: &AppPaths,
    ) -> Self {
        let mut problems = Vec::new();
        let mut notes = Vec::new();

        if let Some(refusal) = record_refused {
            // A problem rather than a note: `is_healthy` stays false, because
            // an operator who cannot read their own install record does have
            // something to fix. It is just not a reason to withhold everything
            // the service manager knows.
            problems.push(StatusProblem {
                subject: "install record",
                detail: refusal.to_string(),
            });
        }

        let log_file = record.as_ref().map_or_else(
            || ServiceDirectories::of(paths).log_file(),
            |record| record.log_file.clone(),
        );

        let binary = record.as_ref().map(|record| {
            inspect_binary(
                &record.binary,
                registration
                    .as_ref()
                    .and_then(Registration::binary)
                    .as_deref(),
            )
        });
        if let Some(state) = &binary
            && state.is_error()
        {
            problems.push(StatusProblem {
                subject: "binary",
                detail: state.to_string(),
            });
        }

        match (&record, &registration) {
            (Some(_), None) => problems.push(StatusProblem {
                subject: "registration",
                detail: "this host has a service record but no service manager knows the \
                         registration. Run `service install` again; it deletes nothing."
                    .to_string(),
            }),
            // Not reported when the record was refused rather than absent: the
            // problem above already names the real state, and "there is no
            // install record" would be a second, wrong diagnosis of the same
            // file, with a `service uninstall` in its remedy.
            (None, Some(found)) if record_refused.is_none() => problems.push(StatusProblem {
                subject: "record",
                detail: format!(
                    "{} holds a registration for this service but there is no install record, so \
                     the path it was installed from and the directories it was installed against \
                     are unknown. Run `service uninstall` and `service install`.",
                    found.manager
                ),
            }),
            (None, Some(_)) => {}
            (Some(record), Some(found)) => {
                if record.start_mode != found.start_mode {
                    problems.push(StatusProblem {
                        subject: "start mode",
                        detail: format!(
                            "the record says {} and {} holds a {} registration. Switch the start \
                             mode again to make them agree.",
                            record.start_mode, found.manager, found.start_mode
                        ),
                    });
                }
                if record.start_mode == StartMode::Boot && !found.starts_automatically {
                    problems.push(StatusProblem {
                        subject: "start mode",
                        detail: format!(
                            "{} holds the registration but will not start it by itself, so this \
                             host does not resume work after a reboot.",
                            found.manager
                        ),
                    });
                }
                if let Some(actual) = found.restart_delay {
                    let expected = record.restart().effective_delay(found.manager);
                    if actual != expected {
                        problems.push(StatusProblem {
                            subject: "restart policy",
                            detail: format!(
                                "the record says the service restarts after {}s and {} reports \
                                 {}s. Something has edited the registration since it was \
                                 installed.",
                                expected.as_secs(),
                                found.manager,
                                actual.as_secs()
                            ),
                        });
                    } else if expected != record.restart().delay() {
                        // Not a fault. Task Scheduler expresses this in whole
                        // minutes, so the delay in force is longer than the one
                        // asked for -- never shorter, which is the direction
                        // the requirement cares about.
                        notes.push(format!(
                            "{} expresses the restart delay in whole minutes, so the {}s asked \
                             for is enforced as {}s. The service therefore never restarts faster \
                             than the configured bound.",
                            found.manager,
                            record.restart().delay().as_secs(),
                            expected.as_secs()
                        ));
                    }
                }
                if found.starts_automatically && !found.running {
                    problems.push(StatusProblem {
                        subject: "runtime",
                        detail: format!(
                            "{} holds an automatic registration, but the daemon is stopped. Run \
                             `runner-manager service install --start-at {}`; if the service \
                             manager denies replacement, retry from an elevated terminal. If it \
                             stops again, inspect {}.",
                            found.manager,
                            found.start_mode,
                            log_file.display()
                        ),
                    });
                }
            }
            (None, None) => {}
        }

        // The two facts here really are independent, which is what `f1`'s
        // `status.rs` says this check needs and could not have there: the scope
        // is derived from the mode the **record** carries, and it is compared
        // against the mode the **service manager** actually holds.
        let store = record.as_ref().and_then(|record| {
            let registered_mode = registration
                .as_ref()
                .map_or(record.start_mode, |found| found.start_mode);
            crate::secrets::PlatformSecretStore::for_start_mode(record.start_mode)
                .ok()
                .map(|store| crate::secrets::ActiveStore::of(&store, registered_mode))
        });
        if let Some(store) = &store
            && !store.agrees_with_start_mode()
        {
            problems.push(StatusProblem {
                subject: "secret store",
                detail: format!(
                    "{store}. Run `auth login` again so the token is stored where the registered \
                     start mode can read it."
                ),
            });
        }

        if last_github_contact.is_none() {
            notes.push(
                "GitHub has not been reached successfully since this host's state directory was \
                 created."
                    .to_string(),
            );
        }

        // The privileged inspection output. Read-only, tolerant of an account
        // that may not read the descriptor at all, and never a `problem`: a
        // root this account cannot inspect is a true statement about this
        // account's rights, not a fault in the registration. What refuses an
        // install is the preflight in `runner_root_access`, which runs as the
        // installing account and has the authority to know.
        let runner_root = crate::runner_root::default_runner_root(paths)
            .ok()
            .map(|root| {
                let path = root.as_path().to_path_buf();
                let report = crate::runner_root_access::report(&path);
                (path, report)
            });
        // Reported, and deliberately not a `problem`. The Definition of Done
        // asks for a broad root to be "reported and fail the security
        // preflight", and the security preflight is `install`'s -- which runs
        // as the installing account and refuses outright. `service status` runs
        // as whoever typed it, is expected to be readable on a host with
        // nothing installed at all, and drives an exit code; turning a
        // directory that predates this feature into a non-zero exit for a
        // machine that has never installed the service would report a fault
        // that is not this registration's.
        if let Some((
            path,
            RootAccessReport::Present {
                broad_write: true, ..
            },
        )) = &runner_root
        {
            notes.push(format!(
                "the platform default runner root {} can be written by ordinary local users, so \
                 it is not a safe place to run jobs. `service install` refuses it rather than \
                 tightening it, because the contents of a directory anybody could write cannot \
                 be trusted: remove or empty it, or choose another root with `runner-manager \
                 host set-runtime-root --path <PATH>`.",
                path.display()
            ));
        }

        // The surface the agent has nowhere else to reach. A root that refuses
        // a launch does so before any attempt row exists, and the daemon's log
        // redacts the paths out of the sentence, so without this the operator
        // sees `runner_start_failed reason=other` once per poll and nothing
        // that names the directory or the fix.
        //
        // A **note** and not a problem, by the same rule the broad-write root
        // above obeys: `service status` runs as whoever typed it, is expected
        // to be readable on a host with nothing installed at all, and drives an
        // exit code. A problem here would fail that exit code on three hosts
        // that are not broken -- one whose root was fixed but which has had no
        // queued job since, one whose service was uninstalled without clearing
        // `state/`, and one that only ever ran the agent in the foreground --
        // and the printed remedy (`service uninstall && service install`) does
        // not touch `state/`, so following it would not clear the error either.
        // A note is read by the same operator at the same moment and traps
        // nobody in a loop.
        //
        // A read failure is reported and not swallowed, for the reason
        // `runner_root_refusals` documents: absence means "every policy is
        // placing runners", and answering a parse failure with that would be
        // the wrong answer to the question this row exists for.
        match runner_root_refusals(paths) {
            Ok(refusals) => {
                for refusal in refusals {
                    notes.push(format!(
                        "policy {} started no runner: its runner root {} refused the launch \
                         ({}), last at {}. {} This clears when that policy next places a \
                         runner.",
                        refusal.policy,
                        refusal.root,
                        refusal.kind,
                        refusal.at.to_rfc3339(),
                        refusal.detail,
                    ));
                }
            }
            Err(error) => notes.push(format!(
                "whether the agent could use its runner roots could not be read: {error}"
            )),
        }

        Self {
            identity,
            record,
            registration,
            binary,
            log_file,
            store,
            last_github_contact,
            runner_root,
            credential_rejected_since: None,
            launches_blocked: None,
            unattended_gap: None,
            foreign: None,
            problems,
            notes,
        }
    }

    /// Marks a status read from another installation's directories as that
    /// installation's. See [`ForeignService`].
    ///
    /// Its problems were written for its owner, and their remedies -- `service
    /// install`, `auth login`, re-registering a drifted definition -- act on
    /// the directories of whoever runs them. Printed to this account, which
    /// reaches here precisely by following "run it elevated", they would
    /// re-register the machine's service against this account's data root.
    /// So each keeps its diagnosis and loses its remedy, and says where the
    /// remedy has to be run instead.
    fn with_foreign(mut self, foreign: ForeignService) -> Self {
        let act_as = foreign.act_as();
        for problem in &mut self.problems {
            problem.detail = format!(
                "{}. Act on it {act_as}: a remedy run from this account acts on this account's \
                 own directories, not the service's.",
                diagnosis_only(&problem.detail)
            );
        }
        if let Some(note) = foreign.unused_local_note() {
            self.notes.push(note);
        }
        self.foreign = Some(foreign);
        self
    }

    /// A registration made from another data root whose records this account
    /// cannot read: what the service manager reports, and nothing else.
    ///
    /// The only problems are ones the service manager alone settles -- an
    /// automatic registration that is stopped, a boot registration that will
    /// not start by itself -- and their remedy is to look as the owner, never
    /// to reinstall from here.
    fn foreign_unread(
        identity: ServiceIdentity,
        registration: Registration,
        foreign: ForeignService,
    ) -> Self {
        let mut problems = Vec::new();
        let look = foreign.where_to_look();
        if registration.starts_automatically && !registration.running {
            problems.push(StatusProblem {
                subject: "runtime",
                detail: format!(
                    "{} holds an automatic registration for the service installed from {}, but \
                     it is stopped. Run `runner-manager service status` {look} to see why; do not \
                     reinstall it from this account.",
                    registration.manager,
                    foreign.installed_by(),
                ),
            });
        }
        if registration.start_mode == StartMode::Boot && !registration.starts_automatically {
            problems.push(StatusProblem {
                subject: "start mode",
                detail: format!(
                    "{} holds the boot registration installed from {} but will not start it by \
                     itself. Run `runner-manager service status` {look}.",
                    registration.manager,
                    foreign.installed_by(),
                ),
            });
        }
        let mut notes = Vec::new();
        if let Some(reason) = &foreign.unreadable {
            notes.push(format!(
                "its health is not known here: {reason}. Run `runner-manager service status` \
                 {look} to see it."
            ));
        }
        notes.extend(foreign.unused_local_note());
        Self {
            identity,
            record: None,
            log_file: foreign.directories.log_file(),
            registration: Some(registration),
            binary: None,
            store: None,
            last_github_contact: None,
            runner_root: None,
            credential_rejected_since: None,
            launches_blocked: None,
            unattended_gap: None,
            foreign: Some(foreign),
            problems,
            notes,
        }
    }

    /// The other installation this machine's service belongs to, when it is
    /// not this account's. See [`ForeignService`].
    #[must_use]
    pub const fn foreign(&self) -> Option<&ForeignService> {
        self.foreign.as_ref()
    }

    /// Whether this is another installation's service whose own records this
    /// account could not read, so only the service manager's facts are here.
    #[must_use]
    pub fn is_unread(&self) -> bool {
        self.foreign.as_ref().is_some_and(ForeignService::is_unread)
    }

    /// The one-word-or-so verdict `service status` ends with.
    #[must_use]
    pub fn verdict(&self) -> String {
        if !self.is_healthy() {
            return "NOT healthy".to_owned();
        }
        match &self.foreign {
            Some(foreign) if foreign.is_unread() => format!(
                "{}; installed from {}, so its health is read {}",
                if self.is_running() {
                    "running"
                } else {
                    "not running"
                },
                foreign.installed_by(),
                foreign.where_to_look()
            ),
            _ => "healthy".to_owned(),
        }
    }

    /// Reports a definition this build would render differently.
    #[must_use]
    pub fn with_definition_drift(mut self, drift: Option<DefinitionDrift>) -> Self {
        if let Some(drift) = drift {
            if drift.manager == DefinitionKind::LaunchdPlist {
                // A restart, not `service install`: the running daemon holds the
                // single-instance lock, which refuses an install, and a daemon
                // that starts with no runner repairs the plist itself.
                let restart = match drift.start_mode {
                    StartMode::Boot => format!(
                        "sudo launchctl kickstart -k system/{}",
                        self.identity.launchd_label()
                    ),
                    StartMode::Login => format!(
                        "launchctl kickstart -k gui/$(id -u)/{}",
                        self.identity.launchd_label()
                    ),
                };
                self.problems.push(StatusProblem {
                    subject: "definition",
                    detail: format!(
                        "{} was written by runner-manager {} with a `ProcessType` other than \
                         `{LAUNCHD_PROCESS_TYPE}`, which launchd applies to every runner the \
                         daemon starts, so their jobs run below normal priority. The daemon \
                         rewrites it and reloads itself when it starts with no runner, which it \
                         does after every upgrade; to do it now, restart the service while no \
                         job is running: `{restart}`. Configuration and credentials are kept.",
                        drift.path.display(),
                        drift.installed_by_version,
                    ),
                });
                return self;
            }
            let repair = match drift.start_mode {
                StartMode::Boot => format!(
                    "`sudo systemctl stop runner-manager && {}` (for a managed WSL host, run \
                     `runner-manager wsl install --distribution <name>` from Windows)",
                    sudo_command("service install --start-at boot")
                ),
                StartMode::Login => "`systemctl --user stop runner-manager && runner-manager \
                                     service install --start-at login`"
                    .to_owned(),
            };
            self.problems.push(StatusProblem {
                subject: "definition",
                detail: format!(
                    "{} was written by runner-manager {} and differs from what {} renders, so \
                     the daemon runs under outdated settings (for example a credential frozen \
                     at service start). Re-register it with {repair}; configuration and \
                     credentials are kept.",
                    drift.path.display(),
                    drift.installed_by_version,
                    env!("CARGO_PKG_VERSION"),
                ),
            });
        }
        self
    }

    /// Reports that GitHub is rejecting the daemon's credential.
    #[must_use]
    pub fn with_credential_rejection(mut self, since: Option<DateTime<Utc>>) -> Self {
        if let Some(since) = since {
            self.credential_rejected_since = Some(since);
            self.problems.push(StatusProblem {
                subject: "github credential",
                detail: format!(
                    "GitHub has rejected the service's credential since {}, so the service \
                     cannot see queued jobs or start runners. Run `runner-manager auth login` \
                     (for a managed WSL host, `runner-manager --host wsl:<name> auth login` \
                     from Windows).",
                    since.to_rfc3339()
                ),
            });
        }
        self
    }

    /// Since when GitHub has rejected the service's credential, if it has.
    #[must_use]
    pub const fn credential_rejected_since(&self) -> Option<DateTime<Utc>> {
        self.credential_rejected_since
    }

    /// Reports that the daemon starts no runner because its launches are
    /// blocked. See [`crate::launch_health`].
    #[must_use]
    pub fn with_launches_blocked(
        mut self,
        blocked: Option<crate::launch_health::LaunchesBlocked>,
    ) -> Self {
        if let Some(blocked) = &blocked {
            self.problems.push(StatusProblem {
                subject: LAUNCHES_BLOCKED_SUBJECT,
                detail: format!(
                    "the service has started no runner {blocked}. Fix: {}.",
                    blocked.remedy
                ),
            });
        }
        self.launches_blocked = blocked;
        self
    }

    /// Why the service starts no runner, when its launches are blocked.
    #[must_use]
    pub const fn launches_blocked(&self) -> Option<&crate::launch_health::LaunchesBlocked> {
        self.launches_blocked.as_ref()
    }

    /// Reports that the daemon cannot read its own stored credential, and the
    /// exact command that ends it. See [`record_credential_unreadable`].
    #[must_use]
    pub fn with_credential_unreadable(mut self, since: Option<DateTime<Utc>>) -> Self {
        if let Some(since) = since {
            let mode = self.start_mode().unwrap_or_default();
            self.problems.push(StatusProblem {
                subject: CREDENTIAL_UNREADABLE_SUBJECT,
                detail: format!(
                    "the service has been unable to read its stored GitHub credential since {}, \
                     so it starts no runner; the diagnostic log has the store's own answer.{} \
                     Sign in again: {}.",
                    since.to_rfc3339(),
                    if cfg!(target_os = "macos") {
                        " That is what a keychain item written by a different build looks like."
                    } else {
                        ""
                    },
                    sign_in_instruction(mode)
                ),
            });
        }
        self
    }

    /// What this host's default runner root grants, and to whom.
    ///
    /// `None` when the platform default could not even be resolved. The
    /// descriptor inside has been through
    /// [`crate::runner_root_access::redact`], so it names the well-known
    /// trustees and says "an account" for everything else — no more identity
    /// than the `account` line above it already prints.
    #[must_use]
    pub fn runner_root(&self) -> Option<(&Path, &RootAccessReport)> {
        self.runner_root
            .as_ref()
            .map(|(path, report)| (path.as_path(), report))
    }

    /// Whether a registration exists at all.
    #[must_use]
    pub const fn is_installed(&self) -> bool {
        self.registration.is_some() || self.record.is_some()
    }

    /// Whether the daemon is running now.
    #[must_use]
    pub fn is_running(&self) -> bool {
        self.registration
            .as_ref()
            .is_some_and(|registration| registration.running)
    }

    /// **False whenever anything is wrong**, including a stale binary path.
    #[must_use]
    pub fn is_healthy(&self) -> bool {
        self.problems.is_empty()
    }

    /// Everything that is wrong.
    #[must_use]
    pub fn problems(&self) -> &[StatusProblem] {
        &self.problems
    }

    /// True statements that are not faults — a login-mode registration not
    /// running unattended, or an agent that has not yet reached GitHub.
    #[must_use]
    pub fn notes(&self) -> &[String] {
        &self.notes
    }

    /// Reports that the daemon starts no runner because a required host check
    /// fails from its own session. That is the service not doing its job, so
    /// it is a problem: a host whose daemon refused every runner used to read
    /// `verdict healthy`.
    #[must_use]
    pub fn with_host_unfit(mut self, unfit: Option<crate::host_fitness::HostUnfitRecord>) -> Self {
        if let Some(unfit) = unfit {
            self.problems.push(StatusProblem {
                subject: HOST_UNFIT_SUBJECT,
                detail: format!(
                    "the service has started no runner since {}, because a required host check \
                     fails from its own session: {}",
                    unfit.since.to_rfc3339(),
                    unfit.describe()
                ),
            });
        }
        self
    }

    /// Reports a daemon that is running and has stopped making progress. See
    /// [`crate::daemon_heartbeat`]: launchd, systemd and the SCM all report
    /// such a daemon running, so this used to read `verdict healthy`.
    #[must_use]
    pub fn with_stall(mut self, stall: Option<String>) -> Self {
        if let Some(detail) = stall {
            self.problems.push(StatusProblem {
                subject: DAEMON_STALLED_SUBJECT,
                detail,
            });
        }
        self
    }

    /// Records whether this registration comes back by itself after an
    /// unattended restart, as a note. See [`unattended_gap`].
    #[must_use]
    pub fn with_unattended_gap(mut self, gap: Option<UnattendedGap>) -> Self {
        if let Some(gap) = &gap {
            self.notes.push(gap.reason.clone());
        }
        self.unattended_gap = gap;
        self
    }

    /// Why this registration does not come back by itself after an
    /// unattended restart, when it does not.
    #[must_use]
    pub const fn unattended_gap(&self) -> Option<&UnattendedGap> {
        self.unattended_gap.as_ref()
    }

    /// The service manager's command that restarts this registration, for its
    /// start mode (boot when unknown). See [`ServiceIdentity::restart_command`].
    #[must_use]
    pub fn restart_command(&self) -> String {
        self.identity
            .restart_command(self.start_mode().unwrap_or(StartMode::Boot))
    }

    /// The recorded start mode. Journey 5 step 4. For another installation's
    /// service whose record this account cannot read, the mode the service
    /// manager's domain implies.
    #[must_use]
    pub fn start_mode(&self) -> Option<StartMode> {
        self.record
            .as_ref()
            .map(|record| record.start_mode)
            .or_else(|| {
                self.registration
                    .as_ref()
                    .filter(|_| self.is_unread())
                    .map(|registration| registration.start_mode)
            })
    }

    /// The binary the service runs: the recorded one, or for another
    /// installation's service whose record this account cannot read, the one
    /// the service manager names.
    #[must_use]
    pub fn service_binary(&self) -> Option<PathBuf> {
        self.record
            .as_ref()
            .map(|record| record.binary.clone())
            .or_else(|| {
                self.registration
                    .as_ref()
                    .filter(|_| self.is_unread())
                    .and_then(Registration::binary)
            })
    }

    /// The resolved absolute binary path and what became of it. Journey 5
    /// step 4 and `05-infrastructure.md` item 6.
    #[must_use]
    pub const fn binary(&self) -> Option<&BinaryPath> {
        self.binary.as_ref()
    }

    /// The diagnostic log path. `05-infrastructure.md` item 4.
    #[must_use]
    pub fn log_file(&self) -> &Path {
        &self.log_file
    }

    /// The last successful GitHub contact. Journey 5 step 4.
    #[must_use]
    pub const fn last_github_contact(&self) -> Option<DateTime<Utc>> {
        self.last_github_contact
    }

    /// Which store the daemon reads, and whether that agrees with the
    /// registration.
    #[must_use]
    pub const fn secret_store(&self) -> Option<&crate::secrets::ActiveStore> {
        self.store.as_ref()
    }

    /// The record `install` wrote.
    #[must_use]
    pub const fn record(&self) -> Option<&InstallRecord> {
        self.record.as_ref()
    }

    /// What the service manager says.
    #[must_use]
    pub const fn registration(&self) -> Option<&Registration> {
        self.registration.as_ref()
    }
}

impl fmt::Display for ServiceStatus {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        writeln!(f, "Service: {}", self.identity)?;
        match (&self.record, &self.registration) {
            (None, None) => {
                writeln!(
                    f,
                    "  installed                 no. `service install` registers `{} {}`.",
                    SERVICE_NAME,
                    DAEMON_ARGUMENTS.join(" ")
                )?;
            }
            _ => {
                let manager = self
                    .registration
                    .as_ref()
                    .map(|registration| registration.manager.manager());
                writeln!(
                    f,
                    "  installed                 {}",
                    manager.unwrap_or("yes, but no service manager knows it")
                )?;
                writeln!(
                    f,
                    "  state                     {}",
                    if self.is_running() {
                        "running"
                    } else {
                        "not running"
                    }
                )?;
            }
        }
        if let Some(foreign) = &self.foreign {
            writeln!(
                f,
                "  installed from            {} -- another installation's, not this account's ({})",
                foreign.installed_by(),
                foreign.local_root.display()
            )?;
            // Without the record, the service manager's own facts.
            if foreign.is_unread()
                && let Some(registration) = &self.registration
            {
                writeln!(f, "  start mode                {}", registration.start_mode)?;
                if let Some(account) = &registration.account {
                    writeln!(f, "  account                   {account}")?;
                }
                if let Some(binary) = self.service_binary() {
                    writeln!(f, "  binary                    {}", binary.display())?;
                }
            }
        }
        if let Some(record) = &self.record {
            writeln!(f, "  start mode                {}", record.start_mode)?;
            let recorded = record.account.to_string();
            let account = registered_account(self.registration.as_ref(), &recorded);
            writeln!(f, "  account                   {account}")?;
            writeln!(f, "  restart on failure        {}", record.restart())?;
            writeln!(
                f,
                "  arguments                 {}",
                record.arguments.join(" ")
            )?;
        }
        if let Some(binary) = &self.binary {
            writeln!(f, "  binary                    {binary}")?;
        }
        writeln!(f, "  diagnostic log            {}", self.log_file.display())?;
        if let Some((path, report)) = &self.runner_root {
            // Named as the *default* rather than as "the runner root", because
            // it is only the effective one until an operator runs
            // `host set-runtime-root`. This crate cannot see that setting — it
            // lives in the application's store — so an unqualified label here
            // would contradict the `runner root … (host-configured)` row that
            // `status` and `host show` print from the value that is in force.
            writeln!(f, "  default runner root       {}", path.display())?;
            if *report != RootAccessReport::NotApplicable {
                writeln!(f, "  default root access       {report}")?;
            }
        }
        if let Some(store) = &self.store {
            writeln!(f, "  secret store              {store}")?;
        }
        // Not known, rather than "never", for a service whose records were not
        // read: its contact file is in a directory this account cannot open.
        if !self.is_unread() {
            writeln!(
                f,
                "  last GitHub contact       {}",
                match self.last_github_contact {
                    Some(at) => at.to_rfc3339(),
                    None => "never".to_string(),
                }
            )?;
        }
        for note in &self.notes {
            writeln!(f, "  note                      {note}")?;
        }
        for problem in &self.problems {
            writeln!(f, "  ERROR                     {problem}")?;
        }
        write!(f, "  verdict                   {}", self.verdict())
    }
}

// ---------------------------------------------------------------------------
// The in-memory double
// ---------------------------------------------------------------------------

/// A [`ControlFactory`] that registers nothing and remembers everything.
///
/// Public rather than `#[cfg(test)]` on purpose. `f3` builds three commands on
/// [`ServiceOperations`] and has to be able to test them without a service
/// manager, and a double that lived behind `#[cfg(test)]` here would be
/// invisible from another crate — which would leave `f3` either untested or
/// writing a second double that drifts from this one.
///
/// It is not a simulator. It stores what it was asked to register and reports it
/// back, which is exactly enough to exercise the logic that sits *above* a
/// service manager: the lock refusal, the record, the stale-path detection, the
/// start-mode switch, and the promise that uninstall deletes nothing else.
#[derive(Debug, Clone, Default)]
pub struct RecordingControls {
    state: std::sync::Arc<std::sync::Mutex<RecordingState>>,
}

#[derive(Debug, Default)]
struct RecordingState {
    registrations: BTreeMap<(StartMode, String), Registration>,
    definitions: BTreeMap<String, ServiceDefinition>,
    calls: Vec<String>,
    #[cfg(test)]
    install_failures: BTreeMap<StartMode, String>,
    #[cfg(test)]
    after_install: BTreeMap<StartMode, TestInstallSideEffect>,
}

#[cfg(test)]
#[derive(Debug, Clone)]
enum TestInstallSideEffect {
    HideDirectory { directory: PathBuf, hidden: PathBuf },
}

impl RecordingControls {
    /// A factory holding no registrations.
    #[must_use]
    pub fn new() -> Self {
        Self::default()
    }

    /// Every call made through this factory, in order, as
    /// `"<operation> <name> (<mode>)"`.
    #[must_use]
    pub fn calls(&self) -> Vec<String> {
        self.state.lock().expect("not poisoned").calls.clone()
    }

    /// Every registration currently held, with the domain it is in.
    #[must_use]
    pub fn registrations(&self) -> Vec<(StartMode, String, Registration)> {
        self.state
            .lock()
            .expect("not poisoned")
            .registrations
            .iter()
            .map(|((mode, name), registration)| (*mode, name.clone(), registration.clone()))
            .collect()
    }

    /// The definition applied for a registration, if it is held.
    #[must_use]
    pub fn definition(&self, name: &str) -> Option<ServiceDefinition> {
        self.state
            .lock()
            .expect("not poisoned")
            .definitions
            .get(name)
            .cloned()
    }

    /// Edits a held registration, as something outside this product would.
    ///
    /// This is how the divergence and start-type problems are made reachable
    /// from a test: `sc config`, `launchctl` and `systemctl` can all change a
    /// registration after installation, and a status command that could not be
    /// shown detecting that would be a status command nobody had tested against
    /// the case it exists for.
    ///
    /// Does nothing when no registration of that name is held.
    pub fn edit(&self, name: &str, edit: impl FnOnce(&mut Registration)) {
        let mut state = self.state.lock().expect("not poisoned");
        if let Some((_, registration)) = state
            .registrations
            .iter_mut()
            .find(|((_, held), _)| held == name)
        {
            edit(registration);
        }
    }

    #[cfg(test)]
    fn fail_next_install(&self, mode: StartMode, detail: &str) {
        self.state
            .lock()
            .expect("not poisoned")
            .install_failures
            .insert(mode, detail.to_string());
    }

    #[cfg(test)]
    fn hide_directory_after_install(&self, mode: StartMode, directory: PathBuf, hidden: PathBuf) {
        self.state
            .lock()
            .expect("not poisoned")
            .after_install
            .insert(
                mode,
                TestInstallSideEffect::HideDirectory { directory, hidden },
            );
    }
}

impl ControlFactory for RecordingControls {
    fn control(&self, mode: StartMode) -> Result<Box<dyn ServiceControl>, ServiceError> {
        Ok(Box::new(RecordingControl {
            mode,
            state: std::sync::Arc::clone(&self.state),
        }))
    }
}

#[derive(Debug)]
struct RecordingControl {
    mode: StartMode,
    state: std::sync::Arc<std::sync::Mutex<RecordingState>>,
}

impl RecordingControl {
    fn note(&self, operation: &str, name: &str) {
        self.state
            .lock()
            .expect("not poisoned")
            .calls
            .push(format!("{operation} {name} ({})", self.mode));
    }
}

impl ServiceControl for RecordingControl {
    fn manager(&self) -> DefinitionKind {
        // The double reports the kind this host's real backend would, so a test
        // that asserts on the manager name asserts something true of the
        // platform it is running on.
        host_definition_kind(self.mode)
    }

    fn install(&self, plan: &InstallPlan) -> Result<ServiceDefinition, ServiceError> {
        self.note("install", plan.identity().name());
        #[cfg(test)]
        if let Some(detail) = self
            .state
            .lock()
            .expect("not poisoned")
            .install_failures
            .remove(&self.mode)
        {
            return Err(ServiceError::Control {
                operation: "install",
                name: plan.identity().name().to_string(),
                manager: "recording control",
                detail,
            });
        }
        // The real definition, not a stub. Rendering is pure, so the double can
        // afford it -- and a stub would make `Installed::review` report that the
        // definition confirms nothing, which is exactly the shape of false
        // assurance a test double must never hand back.
        let definition = ServiceDefinition::for_host(plan)?;
        let mut state = self.state.lock().expect("not poisoned");
        state.registrations.insert(
            (self.mode, plan.identity().name().to_string()),
            Registration {
                manager: host_definition_kind(self.mode),
                start_mode: self.mode,
                command_line: plan.command_line(),
                account: (*plan.account() != ServiceAccount::InvokingUser)
                    .then(|| plan.account().as_str().to_string()),
                running: false,
                starts_automatically: true,
                restart_delay: Some(plan.restart().delay()),
            },
        );
        state
            .definitions
            .insert(plan.identity().name().to_string(), definition.clone());
        #[cfg(test)]
        let side_effect = state.after_install.remove(&self.mode);
        drop(state);
        #[cfg(test)]
        if let Some(TestInstallSideEffect::HideDirectory { directory, hidden }) = side_effect {
            std::fs::rename(&directory, &hidden).expect("test fault can hide the record directory");
            std::fs::write(&directory, b"blocks recreation")
                .expect("test fault can block record directory recreation");
        }
        Ok(definition)
    }

    fn uninstall(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
        self.note("uninstall", identity.name());
        let mut state = self.state.lock().expect("not poisoned");
        state.definitions.remove(identity.name());
        Ok(state
            .registrations
            .remove(&(self.mode, identity.name().to_string()))
            .is_some())
    }

    fn query(&self, identity: &ServiceIdentity) -> Result<Option<Registration>, ServiceError> {
        self.note("query", identity.name());
        Ok(self
            .state
            .lock()
            .expect("not poisoned")
            .registrations
            .get(&(self.mode, identity.name().to_string()))
            .cloned())
    }

    fn start(&self, identity: &ServiceIdentity) -> Result<(), ServiceError> {
        self.note("start", identity.name());
        let mut state = self.state.lock().expect("not poisoned");
        match state
            .registrations
            .get_mut(&(self.mode, identity.name().to_string()))
        {
            Some(registration) => {
                registration.running = true;
                Ok(())
            }
            None => Err(ServiceError::NotInstalled {
                name: identity.name().to_string(),
                operation: "start",
            }),
        }
    }

    fn stop(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
        self.note("stop", identity.name());
        let mut state = self.state.lock().expect("not poisoned");
        match state
            .registrations
            .get_mut(&(self.mode, identity.name().to_string()))
        {
            Some(registration) => Ok(std::mem::replace(&mut registration.running, false)),
            None => Err(ServiceError::NotInstalled {
                name: identity.name().to_string(),
                operation: "stop",
            }),
        }
    }
}

impl ControlFactory for HostControls {
    fn control(&self, mode: StartMode) -> Result<Box<dyn ServiceControl>, ServiceError> {
        sys::control(mode)
    }

    fn installed_definition(&self, path: &Path) -> Option<String> {
        std::fs::read_to_string(path).ok()
    }

    fn unattended_login(&self) -> Option<crate::unattended_login::UnattendedLogin> {
        crate::unattended_login::probe()
    }
}

/// The operator's home directory, when the platform reports one.
///
/// Only login-mode registrations need it — a LaunchAgent and a systemd user
/// unit both live under it — and it is resolved lazily so that a boot-mode
/// operation on an account with no profile is not refused for wanting something
/// it never uses.
#[must_use]
pub fn host_home() -> Option<PathBuf> {
    directories::BaseDirs::new().map(|dirs| dirs.home_dir().to_path_buf())
}

/// The Unix backends' name for the same thing.
#[cfg(unix)]
fn home_directory() -> Option<PathBuf> {
    host_home()
}

/// Runs a command and returns its exit status with both streams as text.
///
/// The three Unix backends and the Windows Task Scheduler backend all drive a
/// stock command-line tool, and all four want the same three things back. The
/// tools are chosen for machine-readable, locale-independent output wherever one
/// exists — `systemctl is-active`, `launchctl print`, `schtasks /XML` — because
/// parsing a localised human-facing table is how a status command starts lying
/// on somebody else's machine.
fn run(program: &str, arguments: &[&std::ffi::OsStr]) -> std::io::Result<(bool, String, String)> {
    let output = std::process::Command::new(program)
        .args(arguments)
        .output()?;
    Ok((
        output.status.success(),
        String::from_utf8_lossy(&output.stdout).into_owned(),
        String::from_utf8_lossy(&output.stderr).into_owned(),
    ))
}

/// Which manager holds a given start-mode domain on the platform this binary
/// was built for.
#[must_use]
pub const fn host_definition_kind(mode: StartMode) -> DefinitionKind {
    if cfg!(windows) {
        match mode {
            StartMode::Boot => DefinitionKind::WindowsService,
            StartMode::Login => DefinitionKind::WindowsScheduledTask,
        }
    } else if cfg!(target_os = "macos") {
        DefinitionKind::LaunchdPlist
    } else {
        DefinitionKind::SystemdUnit
    }
}

/// Enables a launchd label after it has been bootstrapped.
///
/// `launchctl bootstrap` deliberately preserves a label's disabled bit. An
/// `enable` failure therefore means the new registration cannot satisfy its
/// start policy. Compensate by booting it out and removing the plist so a
/// failed install cannot look installed to `service status`.
#[cfg(any(target_os = "macos", test))]
fn enable_launchd_registration(
    mut launchctl: impl FnMut(&[&std::ffi::OsStr]) -> (bool, String),
    domain: &str,
    service_target: &str,
    plist: &Path,
    name: &str,
    elevation_remedy: &'static str,
) -> Result<(), ServiceError> {
    let (enabled, cause) = launchctl(&[
        std::ffi::OsStr::new("enable"),
        std::ffi::OsStr::new(service_target),
    ]);
    if enabled {
        return Ok(());
    }

    let (booted_out, bootout_detail) = launchctl(&[
        std::ffi::OsStr::new("bootout"),
        std::ffi::OsStr::new(service_target),
    ]);
    let removed = std::fs::remove_file(plist);
    if !booted_out || removed.is_err() {
        return Err(ServiceError::Rollback {
            operation: "enable launchd registration",
            name: name.to_string(),
            cause,
            rollback: format!(
                "launchctl bootout {domain}: {}; remove {}: {}",
                if booted_out {
                    "succeeded".to_string()
                } else {
                    bootout_detail
                },
                plist.display(),
                removed
                    .err()
                    .map_or_else(|| "succeeded".to_string(), |error| error.to_string())
            ),
        });
    }

    if cause.to_ascii_lowercase().contains("permission denied") {
        Err(ServiceError::NeedsElevation {
            operation: "enable",
            name: name.to_string(),
            detail: cause,
            remedy: elevation_remedy,
        })
    } else {
        Err(ServiceError::Control {
            operation: "enable",
            name: name.to_string(),
            manager: "launchd",
            detail: cause,
        })
    }
}

// ---------------------------------------------------------------------------
// Windows
// ---------------------------------------------------------------------------

/// A stop request delivered by the Windows Service Control Manager.
///
/// The application owns the drain policy; this platform boundary only turns
/// `SERVICE_CONTROL_STOP`/`SHUTDOWN` into an awaitable notification.
#[derive(Debug, Clone)]
pub struct ServiceShutdown(tokio::sync::watch::Receiver<bool>);

impl ServiceShutdown {
    /// Waits until SCM asks the service to stop or shut down.
    pub async fn wait(mut self) {
        if !*self.0.borrow() {
            let _ = self.0.changed().await;
        }
    }
}

/// Runs the production process as a real Windows service host.
///
/// `StartServiceCtrlDispatcher` must run in the service process's main thread,
/// so the callback is handed through a process-global slot to the entrypoint
/// invoked by SCM. The slot is single-use by design: one process hosts exactly
/// one own-process service.
#[cfg(windows)]
pub fn run_windows_service_host<F>(run: F) -> Result<u8, ServiceError>
where
    F: FnOnce(ServiceShutdown) -> u8 + Send + 'static,
{
    windows_host::run(Box::new(run))
}

#[cfg(windows)]
mod windows_host {
    use std::ffi::OsString;
    use std::sync::{Arc, Mutex, OnceLock, mpsc};
    use std::time::Duration;

    use windows_service::service::{
        ServiceControl, ServiceControlAccept, ServiceExitCode, ServiceState, ServiceStatus,
        ServiceType,
    };
    use windows_service::service_control_handler::{
        self, ServiceControlHandlerResult, ServiceStatusHandle,
    };

    use super::{SERVICE_NAME, ServiceError, ServiceShutdown};

    type Runner = Box<dyn FnOnce(ServiceShutdown) -> u8 + Send>;

    struct Invocation {
        run: Runner,
        result: mpsc::SyncSender<Result<u8, String>>,
    }

    static INVOCATION: OnceLock<Mutex<Option<Invocation>>> = OnceLock::new();

    windows_service::define_windows_service!(ffi_service_main, service_main);

    pub(super) fn run(run: Runner) -> Result<u8, ServiceError> {
        let (result_tx, result_rx) = mpsc::sync_channel(1);
        let slot = INVOCATION.get_or_init(|| Mutex::new(None));
        let mut invocation = slot
            .lock()
            .map_err(|_| host_error("prepare", "the service-host slot is poisoned"))?;
        if invocation.is_some() {
            return Err(host_error(
                "prepare",
                "the service-host slot was already used",
            ));
        }
        *invocation = Some(Invocation {
            run,
            result: result_tx,
        });
        drop(invocation);

        windows_service::service_dispatcher::start("", ffi_service_main)
            .map_err(|error| host_error("connect", &error.to_string()))?;
        result_rx
            .recv()
            .map_err(|error| host_error("finish", &error.to_string()))?
            .map_err(|detail| host_error("run", &detail))
    }

    fn service_main(_arguments: Vec<OsString>) {
        let Some(invocation) = INVOCATION.get().and_then(|slot| slot.lock().ok()?.take()) else {
            return;
        };
        let result = run_service(invocation.run);
        let _ = invocation.result.send(result);
    }

    fn run_service(run: Runner) -> Result<u8, String> {
        let (stop_tx, stop_rx) = tokio::sync::watch::channel(false);
        let status: Arc<Mutex<Option<ServiceStatusHandle>>> = Arc::new(Mutex::new(None));
        let handler_status = Arc::clone(&status);
        let handler = move |control| match control {
            ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
            ServiceControl::Stop | ServiceControl::Shutdown => {
                if let Some(handle) = handler_status.lock().ok().and_then(|guard| *guard) {
                    let _ = handle.set_service_status(service_status(
                        ServiceState::StopPending,
                        ServiceControlAccept::empty(),
                        1,
                        Duration::from_secs(300),
                        0,
                    ));
                }
                let _ = stop_tx.send(true);
                ServiceControlHandlerResult::NoError
            }
            _ => ServiceControlHandlerResult::NotImplemented,
        };
        let handle = service_control_handler::register("", handler)
            .map_err(|error| format!("cannot register the service control handler: {error}"))?;
        *status
            .lock()
            .map_err(|_| "the service status handle is poisoned".to_string())? = Some(handle);
        handle
            .set_service_status(service_status(
                ServiceState::Running,
                ServiceControlAccept::STOP | ServiceControlAccept::SHUTDOWN,
                0,
                Duration::default(),
                0,
            ))
            .map_err(|error| format!("cannot report SERVICE_RUNNING: {error}"))?;

        let exit = run(ServiceShutdown(stop_rx));
        handle
            .set_service_status(service_status(
                ServiceState::Stopped,
                ServiceControlAccept::empty(),
                0,
                Duration::default(),
                u32::from(exit),
            ))
            .map_err(|error| format!("cannot report SERVICE_STOPPED: {error}"))?;
        Ok(exit)
    }

    fn service_status(
        state: ServiceState,
        accepted: ServiceControlAccept,
        checkpoint: u32,
        wait_hint: Duration,
        exit: u32,
    ) -> ServiceStatus {
        ServiceStatus {
            service_type: ServiceType::OWN_PROCESS,
            current_state: state,
            controls_accepted: accepted,
            exit_code: if exit == 0 {
                ServiceExitCode::Win32(0)
            } else {
                ServiceExitCode::ServiceSpecific(exit)
            },
            checkpoint,
            wait_hint,
            process_id: None,
        }
    }

    fn host_error(operation: &'static str, detail: &str) -> ServiceError {
        ServiceError::Control {
            operation,
            name: SERVICE_NAME.to_string(),
            manager: "the Windows Service Control Manager",
            detail: detail.to_string(),
        }
    }
}

#[cfg(windows)]
mod sys {
    //! Two managers, because Windows has two answers.
    //!
    //! `--start-at boot` is a service in the Service Control Manager, which is
    //! the only Windows facility that starts something before anybody logs in.
    //! `--start-at login` is a Task Scheduler task with a logon trigger, which
    //! is the only Windows facility that starts something when somebody does.
    //! There is no single mechanism that does both: service trigger-start has no
    //! logon trigger, and a scheduled task cannot run before a session exists.

    use std::ffi::{OsStr, OsString};
    use std::time::{Duration, Instant};

    use runner_manager_domain::model::StartMode;
    use windows_service::service::{
        ServiceAccess, ServiceAction, ServiceActionType, ServiceErrorControl,
        ServiceFailureActions, ServiceFailureResetPeriod, ServiceInfo, ServiceStartType,
        ServiceState, ServiceType,
    };
    use windows_service::service_manager::{ServiceManager, ServiceManagerAccess};

    use super::{
        DefinitionKind, InstallPlan, Registration, ServiceControl, ServiceDefinition, ServiceError,
        ServiceIdentity, TaskPrincipal, run, windows_service_spec, xml_value,
    };

    /// `ERROR_SERVICE_DOES_NOT_EXIST`. Not an error here: it is the answer to
    /// "is this registered".
    const SERVICE_DOES_NOT_EXIST: i32 = 1060;
    /// `ERROR_SERVICE_MARKED_FOR_DELETE`. `DeleteService` is asynchronous: the
    /// registration remains in this state until every open service handle is
    /// closed, and callers must not mistake that short window for a leak.
    const SERVICE_MARKED_FOR_DELETE: i32 = 1072;
    /// `ERROR_ACCESS_DENIED`.
    const ACCESS_DENIED: i32 = 5;
    const DELETE_TIMEOUT: Duration = Duration::from_secs(30);
    const DELETE_POLL_INTERVAL: Duration = Duration::from_millis(200);

    const ELEVATION_REMEDY: &str = "Run the command from an elevated prompt: right-click Windows Terminal or PowerShell and \
         choose \"Run as administrator\".";

    pub(super) fn control(mode: StartMode) -> Result<Box<dyn ServiceControl>, ServiceError> {
        Ok(match mode {
            StartMode::Boot => Box::new(ScmControl),
            StartMode::Login => Box::new(TaskControl),
        })
    }

    // -- the Service Control Manager -----------------------------------------

    #[derive(Debug)]
    struct ScmControl;

    /// Turns a `windows-service` failure into this module's error, keeping the
    /// "needs elevation" case separate: an operator told "access is denied" and
    /// an operator told "run this elevated" are not equally well served.
    fn scm_error(
        operation: &'static str,
        name: &str,
        error: &windows_service::Error,
    ) -> ServiceError {
        let raw = match error {
            windows_service::Error::Winapi(io) => io.raw_os_error(),
            _ => None,
        };
        let detail = match error {
            windows_service::Error::Winapi(io) => io.to_string(),
            other => other.to_string(),
        };
        if raw == Some(ACCESS_DENIED) {
            return ServiceError::NeedsElevation {
                operation,
                name: name.to_string(),
                detail,
                remedy: ELEVATION_REMEDY,
            };
        }
        ServiceError::Control {
            operation,
            name: name.to_string(),
            manager: "the Windows Service Control Manager",
            detail,
        }
    }

    fn open_manager(
        access: ServiceManagerAccess,
        operation: &'static str,
        name: &str,
    ) -> Result<ServiceManager, ServiceError> {
        ServiceManager::local_computer(None::<&OsStr>, access)
            .map_err(|error| scm_error(operation, name, &error))
    }

    impl ServiceControl for ScmControl {
        fn manager(&self) -> DefinitionKind {
            DefinitionKind::WindowsService
        }

        fn install(&self, plan: &InstallPlan) -> Result<ServiceDefinition, ServiceError> {
            let spec = windows_service_spec(plan);
            let manager = open_manager(
                ServiceManagerAccess::CONNECT | ServiceManagerAccess::CREATE_SERVICE,
                "install",
                &spec.name,
            )?;
            let info = ServiceInfo {
                name: OsString::from(&spec.name),
                display_name: OsString::from(&spec.display_name),
                // Never INTERACTIVE_PROCESS: see `windows_service_descriptor`.
                service_type: ServiceType::OWN_PROCESS,
                start_type: if spec.automatic_start {
                    ServiceStartType::AutoStart
                } else {
                    ServiceStartType::OnDemand
                },
                error_control: ServiceErrorControl::Normal,
                executable_path: plan.binary().to_path_buf(),
                launch_arguments: plan.arguments().to_vec(),
                dependencies: Vec::new(),
                // `None` is LocalSystem, which is the account `d2`'s DACL admits.
                account_name: spec.account.as_ref().map(OsString::from),
                // No password is ever taken, asked for, or stored. An account
                // that needed one would be an account this installer refuses.
                account_password: None,
            };
            let service = manager
                .create_service(
                    &info,
                    ServiceAccess::CHANGE_CONFIG
                        | ServiceAccess::QUERY_CONFIG
                        | ServiceAccess::QUERY_STATUS
                        | ServiceAccess::START
                        | ServiceAccess::STOP
                        | ServiceAccess::DELETE,
                )
                .map_err(|error| scm_error("install", &spec.name, &error))?;
            service
                .set_description(&spec.description)
                .map_err(|error| scm_error("describe", &spec.name, &error))?;
            service
                .update_failure_actions(ServiceFailureActions {
                    reset_period: ServiceFailureResetPeriod::After(spec.restart.reset_after()),
                    reboot_msg: None,
                    command: None,
                    // Three identical restart actions rather than one: the
                    // Service Control Manager applies the first action to the
                    // first failure, the second to the second, and the last to
                    // every failure after that. One action would leave the
                    // second and later failures unhandled, which is a service
                    // that comes back once and then stays down.
                    actions: Some(vec![
                        ServiceAction {
                            action_type: ServiceActionType::Restart,
                            delay: spec.restart.delay(),
                        };
                        3
                    ]),
                })
                .map_err(|error| scm_error("set the restart policy of", &spec.name, &error))?;
            // Without this the failure actions apply only to a crash, and a
            // daemon that exits non-zero is not a crash.
            service
                .set_failure_actions_on_non_crash_failures(true)
                .map_err(|error| scm_error("set the restart policy of", &spec.name, &error))?;
            Ok(ServiceDefinition::windows_service(plan))
        }

        fn uninstall(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
            let manager =
                open_manager(ServiceManagerAccess::CONNECT, "uninstall", identity.name())?;
            let service = match manager.open_service(
                identity.name(),
                ServiceAccess::QUERY_STATUS | ServiceAccess::STOP | ServiceAccess::DELETE,
            ) {
                Ok(service) => Some(service),
                Err(error) if is_missing(&error) => return Ok(false),
                // A previous caller has already asked SCM to delete this
                // registration. That is the desired state, not an uninstall
                // failure. Wait for SCM to release the name so a following
                // `service install` can use it immediately.
                Err(error) if is_marked_for_delete(&error) => None,
                Err(error) => return Err(scm_error("uninstall", identity.name(), &error)),
            };
            if let Some(service) = service {
                // A running service can be deleted, but it lingers until it stops.
                // Stopping first is what makes `uninstall` followed by `install`
                // work in one sitting, which is what the start-mode switch needs.
                if let Ok(status) = service.query_status()
                    && status.current_state != ServiceState::Stopped
                {
                    let _ = service.stop();
                }
                match service.delete() {
                    Ok(()) => {}
                    // DeleteService is idempotent from the operator's point of
                    // view. Another process can mark the service between our
                    // OpenService and DeleteService calls.
                    Err(error) if is_marked_for_delete(&error) => {}
                    Err(error) => {
                        return Err(scm_error("uninstall", identity.name(), &error));
                    }
                }
                drop(service);
            }

            // `DeleteService` marks a registration for deletion and returns;
            // SCM removes it only after the last service handle closes. Drop
            // ours before polling, then wait for the observable postcondition
            // promised by `uninstall`: an immediate status check must not see
            // a registration that is merely on its way out. This also keeps a
            // stop/uninstall/install sequence deterministic on busy hosts.
            let absent = wait_until_scm_absent(DELETE_TIMEOUT, DELETE_POLL_INTERVAL, || {
                match manager.open_service(identity.name(), ServiceAccess::QUERY_STATUS) {
                    Ok(service) => {
                        drop(service);
                        Ok(false)
                    }
                    Err(error) if is_missing(&error) => Ok(true),
                    Err(error) if is_marked_for_delete(&error) => Ok(false),
                    Err(error) => Err(scm_error("verify uninstall of", identity.name(), &error)),
                }
            })?;
            if !absent {
                return Err(ServiceError::Control {
                    operation: "verify uninstall of",
                    name: identity.name().to_string(),
                    manager: "the Windows Service Control Manager",
                    detail: format!(
                        "the registration was still visible {} seconds after DeleteService; \
                         retry `service uninstall` from an elevated prompt",
                        DELETE_TIMEOUT.as_secs()
                    ),
                });
            }
            Ok(true)
        }

        fn query(&self, identity: &ServiceIdentity) -> Result<Option<Registration>, ServiceError> {
            let manager = open_manager(ServiceManagerAccess::CONNECT, "inspect", identity.name())?;
            let service = match manager.open_service(
                identity.name(),
                ServiceAccess::QUERY_CONFIG | ServiceAccess::QUERY_STATUS,
            ) {
                Ok(service) => service,
                Err(error) if is_missing(&error) => return Ok(None),
                Err(error) => return Err(scm_error("inspect", identity.name(), &error)),
            };
            let config = service
                .query_config()
                .map_err(|error| scm_error("inspect", identity.name(), &error))?;
            let status = service
                .query_status()
                .map_err(|error| scm_error("inspect", identity.name(), &error))?;
            let restart_delay = service.get_failure_actions().ok().and_then(|actions| {
                actions
                    .actions
                    .and_then(|actions| actions.into_iter().next())
                    .filter(|action| action.action_type == ServiceActionType::Restart)
                    .map(|action| action.delay)
            });
            Ok(Some(Registration {
                manager: DefinitionKind::WindowsService,
                start_mode: StartMode::Boot,
                // `lpBinaryPathName` holds the executable *and* its arguments
                // as one string, which is why this module carries its own
                // parser rather than trusting `executable_path`'s name.
                command_line: config.executable_path.to_string_lossy().into_owned(),
                account: config
                    .account_name
                    .map(|account| super::windows_service_account(&account.to_string_lossy())),
                running: status.current_state == ServiceState::Running,
                starts_automatically: config.start_type == ServiceStartType::AutoStart,
                restart_delay,
            }))
        }

        fn start(&self, identity: &ServiceIdentity) -> Result<(), ServiceError> {
            let manager = open_manager(ServiceManagerAccess::CONNECT, "start", identity.name())?;
            let service = manager
                .open_service(identity.name(), ServiceAccess::START)
                .map_err(|error| scm_error("start", identity.name(), &error))?;
            service
                .start::<&OsStr>(&[])
                .map_err(|error| scm_error("start", identity.name(), &error))
        }

        fn stop(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
            let manager = open_manager(ServiceManagerAccess::CONNECT, "stop", identity.name())?;
            let service = manager
                .open_service(
                    identity.name(),
                    ServiceAccess::STOP | ServiceAccess::QUERY_STATUS,
                )
                .map_err(|error| scm_error("stop", identity.name(), &error))?;
            let status = service
                .query_status()
                .map_err(|error| scm_error("stop", identity.name(), &error))?;
            if status.current_state == ServiceState::Stopped {
                return Ok(false);
            }
            service
                .stop()
                .map_err(|error| scm_error("stop", identity.name(), &error))?;
            Ok(true)
        }
    }

    fn is_missing(error: &windows_service::Error) -> bool {
        matches!(error, windows_service::Error::Winapi(io)
            if io.raw_os_error() == Some(SERVICE_DOES_NOT_EXIST))
    }

    pub(super) fn is_marked_for_delete(error: &windows_service::Error) -> bool {
        matches!(error, windows_service::Error::Winapi(io)
            if io.raw_os_error() == Some(SERVICE_MARKED_FOR_DELETE))
    }

    pub(super) fn wait_until_scm_absent(
        timeout: Duration,
        poll_interval: Duration,
        mut probe_absent: impl FnMut() -> Result<bool, ServiceError>,
    ) -> Result<bool, ServiceError> {
        let deadline = Instant::now() + timeout;
        loop {
            if probe_absent()? {
                return Ok(true);
            }
            if Instant::now() >= deadline {
                return Ok(false);
            }
            std::thread::sleep(poll_interval);
        }
    }

    // -- Task Scheduler ------------------------------------------------------

    #[derive(Debug)]
    struct TaskControl;

    fn task_error(operation: &'static str, name: &str, detail: String) -> ServiceError {
        if detail.to_ascii_lowercase().contains("access is denied") {
            return ServiceError::NeedsElevation {
                operation,
                name: name.to_string(),
                detail,
                remedy: ELEVATION_REMEDY,
            };
        }
        ServiceError::Control {
            operation,
            name: name.to_string(),
            manager: "Windows Task Scheduler",
            detail,
        }
    }

    fn schtasks(
        operation: &'static str,
        name: &str,
        arguments: &[&OsStr],
    ) -> Result<(bool, String), ServiceError> {
        match run("schtasks.exe", arguments) {
            Ok((ok, stdout, stderr)) => Ok((ok, if ok { stdout } else { stderr })),
            Err(error) => Err(task_error(operation, name, error.to_string())),
        }
    }

    /// Task Scheduler reads `/XML` files as UTF-16, so the document is written
    /// as UTF-16 little-endian with a byte-order mark rather than as UTF-8.
    fn write_utf16(path: &std::path::Path, text: &str) -> std::io::Result<()> {
        let mut bytes = vec![0xFF, 0xFE];
        for unit in text.encode_utf16() {
            bytes.extend_from_slice(&unit.to_le_bytes());
        }
        std::fs::write(path, bytes)
    }

    impl ServiceControl for TaskControl {
        fn manager(&self) -> DefinitionKind {
            DefinitionKind::WindowsScheduledTask
        }

        fn install(&self, plan: &InstallPlan) -> Result<ServiceDefinition, ServiceError> {
            let name = plan.identity().name().to_string();
            let principal = TaskPrincipal::current()?;
            let definition = ServiceDefinition::windows_scheduled_task(plan, &principal);
            let directory = tempfile::tempdir()
                .map_err(|error| task_error("install", &name, error.to_string()))?;
            let document = directory.path().join("task.xml");
            write_utf16(&document, definition.text())
                .map_err(|error| task_error("install", &name, error.to_string()))?;
            let (ok, message) = schtasks(
                "install",
                &name,
                &[
                    OsStr::new("/Create"),
                    OsStr::new("/TN"),
                    OsStr::new(&name),
                    OsStr::new("/XML"),
                    document.as_os_str(),
                ],
            )?;
            if !ok {
                return Err(task_error("install", &name, message));
            }
            Ok(definition)
        }

        fn uninstall(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
            if self.query(identity)?.is_none() {
                return Ok(false);
            }
            let name = identity.name().to_string();
            let (ok, message) = schtasks(
                "uninstall",
                &name,
                &[
                    OsStr::new("/Delete"),
                    OsStr::new("/TN"),
                    OsStr::new(&name),
                    OsStr::new("/F"),
                ],
            )?;
            if !ok {
                return Err(task_error("uninstall", &name, message));
            }
            Ok(true)
        }

        fn query(&self, identity: &ServiceIdentity) -> Result<Option<Registration>, ServiceError> {
            let name = identity.name().to_string();
            let (ok, document) = schtasks(
                "inspect",
                &name,
                &[
                    OsStr::new("/Query"),
                    OsStr::new("/TN"),
                    OsStr::new(&name),
                    OsStr::new("/XML"),
                    OsStr::new("ONE"),
                ],
            )?;
            if !ok {
                // `schtasks` reports a missing task and a broken Task Scheduler
                // the same way, with a non-zero exit; there is no distinct code.
                // Treating it as absence is the safe reading: the caller either
                // installs, which will then fail loudly, or reports "not
                // installed", which is what an operator with no task sees.
                return Ok(None);
            }
            let command = xml_value(&document, "Command").unwrap_or_default();
            let arguments = xml_value(&document, "Arguments").unwrap_or_default();
            let command_line = if arguments.is_empty() {
                super::quote_argument(&command)
            } else {
                format!("{} {arguments}", super::quote_argument(&command))
            };
            Ok(Some(Registration {
                manager: DefinitionKind::WindowsScheduledTask,
                start_mode: StartMode::Login,
                command_line,
                account: super::scheduled_task_account(xml_value(&document, "UserId")),
                running: task_is_running(&name),
                starts_automatically: super::windows_login_task_starts_automatically(&document),
                restart_delay: xml_value(&document, "Interval")
                    .as_deref()
                    .and_then(parse_iso8601),
            }))
        }

        fn start(&self, identity: &ServiceIdentity) -> Result<(), ServiceError> {
            let name = identity.name().to_string();
            let (ok, message) = schtasks(
                "start",
                &name,
                &[OsStr::new("/Run"), OsStr::new("/TN"), OsStr::new(&name)],
            )?;
            if ok {
                Ok(())
            } else {
                Err(task_error("start", &name, message))
            }
        }

        fn stop(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
            let running = self
                .query(identity)?
                .is_some_and(|registration| registration.running);
            if !running {
                return Ok(false);
            }
            let name = identity.name().to_string();
            let (ok, message) = schtasks(
                "stop",
                &name,
                &[OsStr::new("/End"), OsStr::new("/TN"), OsStr::new(&name)],
            )?;
            if ok {
                Ok(true)
            } else {
                Err(task_error("stop", &name, message))
            }
        }
    }

    /// Whether Task Scheduler reports the task as running.
    ///
    /// **This is the one value in this module read from localised output.**
    /// `schtasks /Query /FO CSV` prints a `Status` column in the machine's
    /// display language, and Task Scheduler exposes no locale-independent
    /// equivalent short of COM. On a non-English Windows this therefore reports
    /// `false` for a task that is in fact running.
    ///
    /// That is stated rather than hidden because of what does *not* depend on
    /// it: Journey 5's liveness question is answered by the last successful
    /// GitHub contact, which is a timestamp this product writes itself and no
    /// locale can move. Nothing in the Definition of Done rests on this
    /// boolean.
    fn task_is_running(name: &str) -> bool {
        let Ok((true, stdout, _)) = run(
            "schtasks.exe",
            &[
                OsStr::new("/Query"),
                OsStr::new("/TN"),
                OsStr::new(name),
                OsStr::new("/FO"),
                OsStr::new("CSV"),
                OsStr::new("/NH"),
            ],
        ) else {
            return false;
        };
        stdout
            .lines()
            .filter_map(|line| line.rsplit(',').next())
            .any(|status| {
                status
                    .trim()
                    .trim_matches('"')
                    .eq_ignore_ascii_case("running")
            })
    }

    /// Parses the `PT<n>M` shape this module writes, and the `PT<n>S` shape
    /// Task Scheduler would accept if it took seconds. Anything richer -- days,
    /// hours, a combination -- is `None` rather than a guess.
    fn parse_iso8601(value: &str) -> Option<Duration> {
        let rest = value.strip_prefix("PT")?;
        if let Some(minutes) = rest.strip_suffix('M') {
            return minutes
                .parse::<u64>()
                .ok()
                .map(|minutes| Duration::from_secs(minutes * 60));
        }
        rest.strip_suffix('S')?
            .parse::<u64>()
            .ok()
            .map(Duration::from_secs)
    }
}

// ---------------------------------------------------------------------------
// Unix: shared plumbing
// ---------------------------------------------------------------------------

/// Writes a definition file, creating its directory, and says when the refusal
/// was a permissions one.
///
/// Both Unix backends write a file into a directory only `root` can write —
/// `/Library/LaunchDaemons` and `/etc/systemd/system` — and an operator who ran
/// `service install` without `sudo` deserves to be told that rather than handed
/// an `EACCES`.
#[cfg(unix)]
fn write_definition(
    operation: &'static str,
    name: &str,
    path: &Path,
    text: &str,
    remedy: &'static str,
) -> Result<(), ServiceError> {
    if let Some(parent) = path.parent()
        && let Err(error) = std::fs::create_dir_all(parent)
        && error.kind() != std::io::ErrorKind::AlreadyExists
    {
        return Err(definition_error(operation, name, error, remedy, parent));
    }
    std::fs::write(path, text)
        .map_err(|error| definition_error(operation, name, error, remedy, path))
}

/// Replaces an installed definition with [`DefinitionDrift::rendered`].
///
/// Through a temporary file in the same directory and a rename, so a failure
/// at any point leaves the old definition in place rather than a truncated
/// one. The mode is set to `0644` before the rename, as `service install`
/// leaves it: launchd refuses a plist that others can write.
#[cfg(all(unix, any(target_os = "macos", test)))]
fn replace_definition(name: &str, drift: &DefinitionDrift) -> Result<(), ServiceError> {
    use std::io::Write as _;

    let path = drift.path.as_path();
    let directory = path.parent().unwrap_or_else(|| Path::new("/"));
    let failed = |error: std::io::Error, at: &Path| {
        definition_error("rewrite", name, error, SUDO_REMEDY, at)
    };
    let mut staged =
        tempfile::NamedTempFile::new_in(directory).map_err(|error| failed(error, directory))?;
    staged
        .write_all(drift.rendered.as_bytes())
        .and_then(|()| staged.as_file().sync_all())
        .map_err(|error| failed(error, staged.path()))?;
    std::fs::set_permissions(
        staged.path(),
        <std::fs::Permissions as std::os::unix::fs::PermissionsExt>::from_mode(0o644),
    )
    .map_err(|error| failed(error, path))?;
    staged
        .persist(path)
        .map(drop)
        .map_err(|error| failed(error.error, path))
}

#[cfg(unix)]
fn definition_error(
    operation: &'static str,
    name: &str,
    error: std::io::Error,
    remedy: &'static str,
    path: &Path,
) -> ServiceError {
    let detail = format!("{}: {error}", path.display());
    if error.kind() == std::io::ErrorKind::PermissionDenied {
        ServiceError::NeedsElevation {
            operation,
            name: name.to_string(),
            detail,
            remedy,
        }
    } else {
        ServiceError::Control {
            operation,
            name: name.to_string(),
            manager: "the local service manager",
            detail,
        }
    }
}

/// `sudo` is the remedy on both Unixes, and the message says which command.
#[cfg(unix)]
const SUDO_REMEDY: &str = "A boot-start registration is machine-wide, so it needs root: run the same command with \
     `sudo`. `service install --start-at login` needs no elevation at all, at the cost of the \
     agent not running until you sign in.";

// ---------------------------------------------------------------------------
// macOS
// ---------------------------------------------------------------------------

#[cfg(target_os = "macos")]
mod sys {
    //! One manager, two domains. `--start-at boot` is a LaunchDaemon in
    //! `/Library/LaunchDaemons`, loaded into launchd's `system` domain;
    //! `--start-at login` is a LaunchAgent in the operator's own
    //! `~/Library/LaunchAgents`, loaded into `gui/<uid>`.
    //!
    //! `launchctl print` is the only inspection command here whose output is
    //! parsed, and it is English-only on every macOS release — launchd has no
    //! localisation for it. The registration's *existence* is decided by the
    //! plist file rather than by that output, so a launchd that changed its
    //! wording would cost this module the running/not-running line and nothing
    //! else.

    use std::ffi::OsStr;
    use std::path::PathBuf;
    use std::time::Duration;

    use runner_manager_domain::model::StartMode;

    use super::{
        DefinitionKind, InstallPlan, LAUNCH_AGENTS_SUBDIR, LAUNCH_DAEMONS_DIR, Registration,
        SUDO_REMEDY, ServiceControl, ServiceDefinition, ServiceError, ServiceIdentity,
        enable_launchd_registration, home_directory, plist_string_value, quote_argument, run,
        write_definition, xml_value,
    };

    pub(super) fn control(mode: StartMode) -> Result<Box<dyn ServiceControl>, ServiceError> {
        Ok(Box::new(LaunchdControl { mode }))
    }

    #[derive(Debug)]
    struct LaunchdControl {
        mode: StartMode,
    }

    impl LaunchdControl {
        /// launchd's domain target for this start mode.
        fn domain(&self) -> String {
            match self.mode {
                StartMode::Boot => "system".to_string(),
                // SAFETY: `getuid` reads the calling process's real user id and
                // cannot fail; it takes no arguments and touches no memory.
                StartMode::Login => format!("gui/{}", unsafe { libc::getuid() }),
            }
        }

        fn service_target(&self, identity: &ServiceIdentity) -> String {
            format!("{}/{}", self.domain(), identity.launchd_label())
        }

        /// Where this domain's plist lives, when the domain has a home to put
        /// it in.
        fn plist_path(&self, identity: &ServiceIdentity) -> Option<PathBuf> {
            let file = format!("{}.plist", identity.launchd_label());
            match self.mode {
                StartMode::Boot => Some(PathBuf::from(LAUNCH_DAEMONS_DIR).join(file)),
                StartMode::Login => {
                    home_directory().map(|home| home.join(LAUNCH_AGENTS_SUBDIR).join(file))
                }
            }
        }

        fn failed(&self, operation: &'static str, name: &str, detail: String) -> ServiceError {
            ServiceError::Control {
                operation,
                name: name.to_string(),
                manager: "launchd",
                detail,
            }
        }

        fn launchctl(&self, arguments: &[&OsStr]) -> (bool, String) {
            match run("launchctl", arguments) {
                Ok((ok, stdout, stderr)) => (ok, if ok { stdout } else { stderr }),
                Err(error) => (false, error.to_string()),
            }
        }
    }

    impl ServiceControl for LaunchdControl {
        fn manager(&self) -> DefinitionKind {
            DefinitionKind::LaunchdPlist
        }

        fn install(&self, plan: &InstallPlan) -> Result<ServiceDefinition, ServiceError> {
            let name = plan.identity().name().to_string();
            let definition = ServiceDefinition::launchd(plan, home_directory().as_deref());
            let Some(path) = definition.install_path().map(std::path::Path::to_path_buf) else {
                return Err(self.failed(
                    "install",
                    &name,
                    "this account has no home directory, so there is nowhere to put a \
                     LaunchAgent. Use --start-at boot, which installs a LaunchDaemon under \
                     /Library/LaunchDaemons."
                        .to_string(),
                ));
            };
            write_definition("install", &name, &path, definition.text(), SUDO_REMEDY)?;
            let target = self.domain();
            let (ok, message) = self.launchctl(&[
                OsStr::new("bootstrap"),
                OsStr::new(&target),
                path.as_os_str(),
            ]);
            if !ok {
                // Leave nothing behind: a plist launchd refused is a file that
                // would make the next `service status` claim a registration
                // that does not exist.
                let _ = std::fs::remove_file(&path);
                if message.to_ascii_lowercase().contains("permission denied") {
                    return Err(ServiceError::NeedsElevation {
                        operation: "install",
                        name,
                        detail: message,
                        remedy: SUDO_REMEDY,
                    });
                }
                return Err(self.failed("install", &name, message));
            }
            // A previously disabled label stays disabled through a bootstrap,
            // which is a service that is installed and will never start.
            let service_target = self.service_target(plan.identity());
            enable_launchd_registration(
                |arguments| self.launchctl(arguments),
                &target,
                &service_target,
                &path,
                &name,
                SUDO_REMEDY,
            )?;
            Ok(definition)
        }

        fn uninstall(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
            let Some(path) = self.plist_path(identity) else {
                return Ok(false);
            };
            if !path.exists() {
                return Ok(false);
            }
            let target = self.service_target(identity);
            let (ok, message) = self.launchctl(&[OsStr::new("bootout"), OsStr::new(&target)]);
            if !ok
                && !message.to_ascii_lowercase().contains("no such process")
                && !message.contains("113")
            {
                if message.to_ascii_lowercase().contains("permission denied") {
                    return Err(ServiceError::NeedsElevation {
                        operation: "uninstall",
                        name: identity.name().to_string(),
                        detail: message,
                        remedy: SUDO_REMEDY,
                    });
                }
                return Err(self.failed("uninstall", identity.name(), message));
            }
            // Only the definition. `05-infrastructure.md` item 5: nothing else
            // on this host is touched here or anywhere below it.
            std::fs::remove_file(&path).map_err(|error| {
                super::definition_error(
                    "uninstall",
                    identity.name(),
                    error,
                    SUDO_REMEDY,
                    path.as_path(),
                )
            })?;
            Ok(true)
        }

        fn query(&self, identity: &ServiceIdentity) -> Result<Option<Registration>, ServiceError> {
            let Some(path) = self.plist_path(identity) else {
                return Ok(None);
            };
            let Ok(document) = std::fs::read_to_string(&path) else {
                return Ok(None);
            };
            let target = self.service_target(identity);
            let (loaded, printed) = self.launchctl(&[OsStr::new("print"), OsStr::new(&target)]);
            Ok(Some(Registration {
                manager: DefinitionKind::LaunchdPlist,
                start_mode: self.mode,
                command_line: program_arguments(&document),
                // A LaunchDaemon without `UserName` runs as root; a LaunchAgent
                // runs as whoever signs in, which names no one in particular.
                account: plist_string_value(&document, "UserName").or_else(|| {
                    (self.mode == StartMode::Boot)
                        .then(|| super::ServiceAccount::Root.as_str().to_string())
                }),
                running: loaded && printed.contains("state = running"),
                starts_automatically: document.contains("<key>RunAtLoad</key>")
                    && super::plist_bool_value(&document, "RunAtLoad") == Some(true),
                restart_delay: xml_value(
                    super::plist_value_after_key(&document, "ThrottleInterval").unwrap_or(""),
                    "integer",
                )
                .and_then(|value| value.parse::<u64>().ok())
                .map(Duration::from_secs),
            }))
        }

        fn start(&self, identity: &ServiceIdentity) -> Result<(), ServiceError> {
            let target = self.service_target(identity);
            let (ok, message) = self.launchctl(&[
                OsStr::new("kickstart"),
                OsStr::new("-k"),
                OsStr::new(&target),
            ]);
            if ok {
                Ok(())
            } else {
                Err(self.failed("start", identity.name(), message))
            }
        }

        fn stop(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
            let running = self
                .query(identity)?
                .is_some_and(|registration| registration.running);
            if !running {
                return Ok(false);
            }
            let target = self.service_target(identity);
            let (ok, message) = self.launchctl(&[
                OsStr::new("kill"),
                OsStr::new("SIGTERM"),
                OsStr::new(&target),
            ]);
            if ok {
                Ok(true)
            } else {
                Err(self.failed("stop", identity.name(), message))
            }
        }
    }

    /// Boots the job out and bootstraps it again from `plist`, from a shell
    /// that outlives this process.
    ///
    /// `setsid` puts the shell in a session and process group of its own. On a
    /// bootout launchd sends SIGTERM to the job's whole process group, the
    /// process that asked for the bootout included, and spares a child in
    /// another session (measured on macOS 27). Without `setsid` the helper
    /// survived that only by luck: one run in four left the job unloaded. The
    /// work runs in a background subshell, so the outer shell exits at once and
    /// is reaped here rather than left behind. `bootout` blocks until the daemon
    /// has exited; the bootstrap is retried for a minute because launchd
    /// refuses it while the old job is still being torn down. When the job is
    /// still loaded after a failed bootout, every bootstrap fails and the
    /// running daemon carries on as it was.
    pub(super) fn reload_detached(
        identity: &ServiceIdentity,
        mode: StartMode,
        plist: &std::path::Path,
    ) -> Result<(), ServiceError> {
        use std::os::unix::process::CommandExt;

        const SCRIPT: &str = r#"(
  sleep 1
  /bin/launchctl bootout "$1"
  tries=0
  until /bin/launchctl bootstrap "$2" "$3"; do
    tries=$((tries + 1))
    if [ "$tries" -ge 60 ]; then
      echo "runner-manager: launchd did not load $3 again; run: $4" >&2
      exit 1
    fi
    sleep 1
  done
) </dev/null &"#;

        let control = LaunchdControl { mode };
        // Once the job is booted out nothing holds the single-instance lock,
        // so a reinstall in the same start mode is the remedy.
        let reinstall = match mode {
            StartMode::Boot => "sudo runner-manager service install --start-at boot",
            StartMode::Login => "runner-manager service install --start-at login",
        };
        let mut command = std::process::Command::new("/bin/sh");
        command
            .args(["-c", SCRIPT, "runner-manager-reload"])
            .arg(control.service_target(identity))
            .arg(control.domain())
            .arg(plist)
            .arg(reinstall)
            .stdin(std::process::Stdio::null());
        // SAFETY: one async-signal-safe system call between `fork` and `exec`,
        // touching no memory, allocator or lock.
        unsafe {
            command.pre_exec(|| {
                if libc::setsid() == -1 {
                    return Err(std::io::Error::last_os_error());
                }
                Ok(())
            });
        }
        let status = command.status().map_err(|error| {
            control.failed("reload", identity.name(), format!("/bin/sh: {error}"))
        })?;
        if status.success() {
            Ok(())
        } else {
            Err(control.failed(
                "reload",
                identity.name(),
                format!("the reload helper exited with {status}"),
            ))
        }
    }

    /// Rebuilds the command line from a plist's `ProgramArguments` array.
    fn program_arguments(document: &str) -> String {
        let Some(rest) = super::plist_value_after_key(document, "ProgramArguments") else {
            return String::new();
        };
        let Some(end) = rest.find("</array>") else {
            return String::new();
        };
        let mut out = Vec::new();
        let mut cursor = &rest[..end];
        while let Some(open) = cursor.find("<string>") {
            let after = &cursor[open + "<string>".len()..];
            let Some(close) = after.find("</string>") else {
                break;
            };
            out.push(quote_argument(&super::xml_unescape(&after[..close])));
            cursor = &after[close..];
        }
        out.join(" ")
    }
}

// ---------------------------------------------------------------------------
// Linux and the other Unixes
// ---------------------------------------------------------------------------

#[cfg(all(unix, not(target_os = "macos")))]
mod sys {
    //! One manager, two domains. `--start-at boot` is a system unit in
    //! `/etc/systemd/system`, wanted by `multi-user.target`; `--start-at login`
    //! is a user unit in `~/.config/systemd/user`, wanted by `default.target`.
    //!
    //! Every inspection here goes through `systemctl cat` and `systemctl show`,
    //! whose output is machine-readable `key=value` text rather than a
    //! sentence, so nothing in this module depends on the machine's display
    //! language.

    use std::ffi::OsStr;
    use std::path::PathBuf;

    use runner_manager_domain::model::StartMode;

    use super::{
        DefinitionKind, InstallPlan, Registration, SUDO_REMEDY, SYSTEMD_SYSTEM_DIR,
        SYSTEMD_USER_SUBDIR, ServiceControl, ServiceDefinition, ServiceError, ServiceIdentity,
        home_directory, ini_directives, run, systemd_exec_command_line, systemd_timespan,
        write_definition,
    };

    pub(super) fn control(mode: StartMode) -> Result<Box<dyn ServiceControl>, ServiceError> {
        Ok(Box::new(SystemdControl { mode }))
    }

    #[derive(Debug)]
    struct SystemdControl {
        mode: StartMode,
    }

    impl SystemdControl {
        fn unit_path(&self, identity: &ServiceIdentity) -> Option<PathBuf> {
            let file = identity.systemd_unit();
            match self.mode {
                StartMode::Boot => Some(PathBuf::from(SYSTEMD_SYSTEM_DIR).join(file)),
                StartMode::Login => {
                    home_directory().map(|home| home.join(SYSTEMD_USER_SUBDIR).join(file))
                }
            }
        }

        /// `systemctl`, with `--user` for the login domain.
        fn systemctl(&self, arguments: &[&str]) -> (bool, String) {
            let mut all: Vec<&OsStr> = Vec::with_capacity(arguments.len() + 1);
            if self.mode == StartMode::Login {
                all.push(OsStr::new("--user"));
            }
            all.extend(arguments.iter().map(OsStr::new));
            match run("systemctl", &all) {
                Ok((ok, stdout, stderr)) => (
                    ok,
                    if stdout.trim().is_empty() {
                        stderr
                    } else {
                        stdout
                    },
                ),
                Err(error) => (false, error.to_string()),
            }
        }

        fn failed(&self, operation: &'static str, name: &str, detail: String) -> ServiceError {
            ServiceError::Control {
                operation,
                name: name.to_string(),
                manager: "systemd",
                detail,
            }
        }
    }

    impl ServiceControl for SystemdControl {
        fn manager(&self) -> DefinitionKind {
            DefinitionKind::SystemdUnit
        }

        fn install(&self, plan: &InstallPlan) -> Result<ServiceDefinition, ServiceError> {
            use std::os::unix::fs::MetadataExt as _;

            let name = plan.identity().name().to_string();
            if self.mode == StartMode::Boot {
                // The credential store's directory as well as the four: the
                // service rewrites the credential there when GitHub rotates it.
                let refusals = super::permitted_paths(DefinitionKind::SystemdUnit, plan)
                    .iter()
                    .filter_map(|path| {
                        let path = std::path::Path::new(path);
                        let owner = std::fs::metadata(path).ok().map(|metadata| metadata.uid());
                        super::boot_directory_refusal(path, owner)
                    })
                    .collect::<Vec<_>>();
                if !refusals.is_empty() {
                    return Err(self.failed(
                        "install",
                        &name,
                        format!(
                            "{}. Run `{}` without --data-dir, which uses {} and {}; a \
                             directory there that root does not own is handed back with \
                             `sudo chown -R root:root <directory>`",
                            refusals.join("; "),
                            super::sudo_command("service install --start-at boot"),
                            crate::paths::SYSTEM_DATA_ROOT,
                            crate::paths::SYSTEM_LOGS_DIR,
                        ),
                    ));
                }
            }
            // The accounts the daemon starts its runners as, one per concurrent
            // runner. Created here, from the elevated install, since the
            // service itself can create no account.
            if self.mode == StartMode::Boot
                && let Err(detail) = crate::runner_account::RunnerPool::ensure()
            {
                return Err(self.failed("install", &name, detail));
            }
            let definition = ServiceDefinition::systemd(plan, home_directory().as_deref());
            let Some(path) = definition.install_path().map(std::path::Path::to_path_buf) else {
                return Err(self.failed(
                    "install",
                    &name,
                    "this account has no home directory, so there is nowhere to put a systemd \
                     user unit. Use --start-at boot, which installs a system unit under \
                     /etc/systemd/system."
                        .to_string(),
                ));
            };
            write_definition("install", &name, &path, definition.text(), SUDO_REMEDY)?;
            let unit = plan.identity().systemd_unit();
            let (reloaded, message) = self.systemctl(&["daemon-reload"]);
            if !reloaded {
                let _ = std::fs::remove_file(&path);
                return Err(self.failed("install", &name, message));
            }
            let (enabled, message) = self.systemctl(&["enable", &unit]);
            if !enabled {
                let _ = std::fs::remove_file(&path);
                let _ = self.systemctl(&["daemon-reload"]);
                return Err(self.failed("install", &name, message));
            }
            Ok(definition)
        }

        fn uninstall(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
            let Some(path) = self.unit_path(identity) else {
                return Ok(false);
            };
            if !path.exists() {
                return Ok(false);
            }
            let unit = identity.systemd_unit();
            // `--now` stops it as well as disabling it. A failure here is not
            // fatal: the unit file is about to go, and refusing to remove it
            // because `systemctl` disliked something would leave the host with
            // a unit nothing manages.
            let _ = self.systemctl(&["disable", "--now", &unit]);
            std::fs::remove_file(&path).map_err(|error| {
                super::definition_error(
                    "uninstall",
                    identity.name(),
                    error,
                    SUDO_REMEDY,
                    path.as_path(),
                )
            })?;
            let _ = self.systemctl(&["daemon-reload"]);
            Ok(true)
        }

        fn query(&self, identity: &ServiceIdentity) -> Result<Option<Registration>, ServiceError> {
            let Some(path) = self.unit_path(identity) else {
                return Ok(None);
            };
            if !path.exists() {
                return Ok(None);
            }
            let unit = identity.systemd_unit();
            // `cat` includes administrator drop-ins in systemd's order. Reading
            // only our base file hides User/ExecStart/RestartSec overrides, so
            // the file is read only when `systemctl` cannot answer.
            let effective = match self.systemctl(&["cat", &unit]) {
                (true, text) => text,
                _ => match std::fs::read_to_string(&path) {
                    Ok(document) => document,
                    Err(_) => return Ok(None),
                },
            };
            let directives = ini_directives(&effective, "Service");
            // One `show` answers what `is-active` and `is-enabled` each did.
            let (_, shown) = self.systemctl(&[
                "show",
                "--property=ActiveState",
                "--property=UnitFileState",
                &unit,
            ]);
            let state = |key: &str| {
                shown
                    .lines()
                    .find_map(|line| line.strip_prefix(key)?.strip_prefix('='))
                    .map(str::trim)
            };
            Ok(Some(Registration {
                manager: DefinitionKind::SystemdUnit,
                start_mode: self.mode,
                command_line: directives
                    .get("ExecStart")
                    .map(|value| systemd_exec_command_line(value))
                    .unwrap_or_default(),
                // A system unit without `User=` runs as root; a user unit runs
                // as whoever owns the session, which names no one in particular.
                account: directives
                    .get("User")
                    .filter(|user| !user.is_empty())
                    .cloned()
                    .or_else(|| {
                        (self.mode == StartMode::Boot)
                            .then(|| super::ServiceAccount::Root.as_str().to_string())
                    }),
                running: state("ActiveState") == Some("active"),
                starts_automatically: state("UnitFileState") == Some("enabled"),
                restart_delay: directives
                    .get("RestartSec")
                    .and_then(|value| systemd_timespan(value)),
            }))
        }

        fn start(&self, identity: &ServiceIdentity) -> Result<(), ServiceError> {
            let unit = identity.systemd_unit();
            let (ok, message) = self.systemctl(&["start", &unit]);
            if ok {
                Ok(())
            } else {
                Err(self.failed("start", identity.name(), message))
            }
        }

        fn stop(&self, identity: &ServiceIdentity) -> Result<bool, ServiceError> {
            let running = self
                .query(identity)?
                .is_some_and(|registration| registration.running);
            if !running {
                return Ok(false);
            }
            let unit = identity.systemd_unit();
            let (ok, message) = self.systemctl(&["stop", &unit]);
            if ok {
                Ok(true)
            } else {
                Err(self.failed("stop", identity.name(), message))
            }
        }
    }
}

/// What the macOS tests that load real launch agents share.
#[cfg(all(test, target_os = "macos"))]
pub(crate) mod launchd_fixture {
    use std::path::{Path, PathBuf};

    /// Opts a macOS host into the tests that load launch agents into the
    /// caller's GUI session. CI's macOS leg sets it, and
    /// `privileged_tests_are_wired_into_ci.rs` asserts that it still does.
    const ACCEPTANCE: &str = "RUNNER_MANAGER_LAUNCHD_ACCEPTANCE";

    /// Whether this run may load launch agents. Says so when it may not, since
    /// the test then passes having measured nothing.
    pub(crate) fn enabled() -> bool {
        let enabled = std::env::var_os(ACCEPTANCE).is_some_and(|value| value == "1");
        if !enabled {
            eprintln!("skipped: set {ACCEPTANCE}=1 to load test launch agents");
        }
        enabled
    }

    /// A copy of the running test binary in `directory`, for a launchd job to
    /// run as its program.
    ///
    /// A copy, because a launchd job whose program lives on an external volume
    /// waits on a privacy approval nobody gives before `main` runs (measured
    /// with a target directory under `/Volumes`), and the temporary directory
    /// is on the boot volume.
    pub(crate) fn job_binary(directory: &Path) -> PathBuf {
        let binary = directory.join("launch-agent-job");
        std::fs::copy(std::env::current_exe().expect("test binary"), &binary)
            .expect("test binary copied");
        binary
    }

    /// A launch agent loaded into the caller's GUI domain, booted out on drop.
    pub(crate) struct LoadedAgent(String);

    impl LoadedAgent {
        /// Bootstraps `plist`, whose `Label` is `label`, and fails the test when
        /// launchd refuses it.
        pub(crate) fn bootstrap(label: &str, plist: &Path) -> Self {
            // SAFETY: `getuid` reads the calling process's real user id and
            // cannot fail.
            let domain = format!("gui/{}", unsafe { libc::getuid() });
            // Armed before the bootstrap, so a half-loaded job is removed too.
            let loaded = Self(format!("{domain}/{label}"));
            let bootstrap = std::process::Command::new("launchctl")
                .arg("bootstrap")
                .arg(&domain)
                .arg(plist)
                .output()
                .expect("launchctl runs");
            assert!(
                bootstrap.status.success(),
                "launchctl bootstrap {domain} refused {label}, so nothing was measured: {}",
                String::from_utf8_lossy(&bootstrap.stderr)
            );
            loaded
        }

        /// `gui/<uid>/<label>`.
        pub(crate) fn target(&self) -> &str {
            &self.0
        }
    }

    impl Drop for LoadedAgent {
        fn drop(&mut self) {
            let _ = std::process::Command::new("launchctl")
                .args(["bootout", &self.0])
                .output();
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    use std::collections::BTreeMap;

    #[test]
    fn task_scheduler_omitting_default_enabled_still_means_automatic() {
        assert!(windows_login_task_starts_automatically(
            "<Task><Triggers><LogonTrigger></LogonTrigger></Triggers></Task>"
        ));
        assert!(windows_login_task_starts_automatically(
            "<Task><LogonTrigger><Enabled>true</Enabled></LogonTrigger></Task>"
        ));
        assert!(!windows_login_task_starts_automatically(
            "<Task><LogonTrigger><Enabled>false</Enabled></LogonTrigger></Task>"
        ));
        assert!(!windows_login_task_starts_automatically(
            "<Task><BootTrigger></BootTrigger></Task>"
        ));
    }

    // -----------------------------------------------------------------------
    // Fixtures
    // -----------------------------------------------------------------------

    /// A plan against paths that exist on no platform, so that every renderer
    /// can be asserted on every leg of the CI matrix.
    fn linux_plan(mode: StartMode) -> InstallPlan {
        InstallPlan::unchecked(
            ServiceIdentity::product(),
            mode,
            "/opt/runner-manager/bin/runner-manager",
            ServiceDirectories {
                config: PathBuf::from("/var/lib/runner-manager/config"),
                state: PathBuf::from("/var/lib/runner-manager/state"),
                runtime: PathBuf::from("/var/lib/runner-manager/runtime"),
                logs: PathBuf::from("/var/log/runner-manager"),
            },
        )
        .with_secret_guard("/var/lib/runner-manager/secrets/user-access-token")
    }

    fn windows_plan(mode: StartMode) -> InstallPlan {
        InstallPlan::unchecked(
            ServiceIdentity::product(),
            mode,
            "C:\\Program Files\\runner-manager\\runner-manager.exe",
            ServiceDirectories {
                config: PathBuf::from("C:\\Users\\op\\AppData\\Local\\rm\\config"),
                state: PathBuf::from("C:\\Users\\op\\AppData\\Local\\rm\\state"),
                runtime: PathBuf::from("C:\\Users\\op\\AppData\\Local\\rm\\runtime"),
                logs: PathBuf::from("C:\\Users\\op\\AppData\\Local\\rm\\logs"),
            },
        )
    }

    /// Replaces one fragment of a rendered definition, and **fails the test if
    /// the fragment was not there**.
    ///
    /// Without the assertion a renderer change would quietly turn every
    /// "widened definition is rejected" test below into a test that reviews the
    /// unmodified definition and passes for the wrong reason. This is the
    /// single guard that keeps that class of vacuity out of this file.
    fn edited(text: &str, from: &str, to: &str) -> String {
        assert!(
            text.contains(from),
            "the rendered definition does not contain `{from}`, so this test would assert \
             nothing about a widened one"
        );
        text.replace(from, to)
    }

    /// Every file under `root`, keyed by its path relative to `root`.
    fn snapshot(roots: &[&Path]) -> BTreeMap<PathBuf, Vec<u8>> {
        fn walk(directory: &Path, out: &mut BTreeMap<PathBuf, Vec<u8>>) {
            let Ok(entries) = std::fs::read_dir(directory) else {
                return;
            };
            for entry in entries.flatten() {
                let path = entry.path();
                if path.is_dir() {
                    walk(&path, out);
                } else if let Ok(bytes) = std::fs::read(&path) {
                    out.insert(path, bytes);
                }
            }
        }
        let mut out = BTreeMap::new();
        for root in roots {
            walk(root, &mut out);
        }
        out
    }

    struct Host {
        _root: tempfile::TempDir,
        paths: AppPaths,
        binary: PathBuf,
        /// A runner root inside this host's own temporary tree.
        ///
        /// Without it every `install` in this module would create and
        /// re-permission the **real** `%SystemDrive%\rman` on the machine
        /// running the tests, and would fail outright on any machine where that
        /// directory already exists with the access control `C:\` gives it.
        /// A sibling of the four application-data directories rather than a
        /// child of one, so `b1`'s overlap check has nothing to object to.
        runner_root: LocalAbsolutePath,
        controls: RecordingControls,
    }

    impl Host {
        fn new() -> Self {
            let root = tempfile::tempdir().expect("a temporary directory");
            let paths = AppPaths::rooted_at(root.path());
            paths.create_all().expect("the four directories");
            let binary = root.path().join(if cfg!(windows) {
                "runner-manager.exe"
            } else {
                "runner-manager"
            });
            std::fs::write(&binary, b"not a real binary").expect("a stand-in binary");
            let runner_root = LocalAbsolutePath::new(
                root.path()
                    .join("runner-root")
                    .to_str()
                    .expect("a unicode temporary path"),
            )
            .expect("a local absolute path");
            Self {
                _root: root,
                paths,
                binary,
                runner_root,
                controls: RecordingControls::new(),
            }
        }

        fn operations(&self) -> ServiceOperations {
            ServiceOperations::with_controls(
                self.paths.clone(),
                ServiceIdentity::product(),
                std::sync::Arc::new(self.controls.clone()),
            )
            .with_runner_root(self.runner_root.clone())
        }

        fn request(&self, mode: StartMode) -> InstallRequest {
            InstallRequest::new(mode).for_binary(&self.binary)
        }
    }

    #[cfg(windows)]
    #[test]
    fn windows_uninstall_waits_through_the_marked_for_deletion_window() {
        let probes = std::cell::Cell::new(0);
        let absent =
            super::sys::wait_until_scm_absent(Duration::from_secs(1), Duration::ZERO, || {
                let next = probes.get() + 1;
                probes.set(next);
                Ok(next == 3)
            })
            .expect("the simulated SCM probe succeeds");

        assert!(absent);
        assert_eq!(
            probes.get(),
            3,
            "uninstall must recheck after transient presence instead of treating it as a leak"
        );
    }

    #[cfg(windows)]
    #[test]
    fn windows_recognises_an_already_pending_service_deletion() {
        let error = windows_service::Error::Winapi(std::io::Error::from_raw_os_error(1072));

        assert!(super::sys::is_marked_for_delete(&error));
    }

    #[test]
    fn launchd_enable_failure_is_returned_and_removes_the_bootstrapped_registration() {
        let root = tempfile::tempdir().expect("a temporary directory");
        let plist = root.path().join("fixture.plist");
        std::fs::write(&plist, b"fixture").expect("a plist fixture");
        let calls = std::cell::RefCell::new(Vec::new());

        let error = enable_launchd_registration(
            |arguments| {
                let call = arguments
                    .iter()
                    .map(|argument| argument.to_string_lossy().into_owned())
                    .collect::<Vec<_>>();
                let operation = call[0].clone();
                calls.borrow_mut().push(call);
                if operation == "enable" {
                    (false, "label remains disabled".to_string())
                } else {
                    (true, String::new())
                }
            },
            "system",
            "system/com.openai.runner-manager-selftest",
            &plist,
            "runner-manager-selftest",
            "rerun with administrative rights",
        )
        .expect_err("enable failure must fail the install");

        assert!(
            matches!(
                error,
                ServiceError::Control {
                    operation: "enable",
                    ..
                }
            ),
            "{error}"
        );
        assert_eq!(calls.borrow().len(), 2);
        assert_eq!(calls.borrow()[0][0], "enable");
        assert_eq!(calls.borrow()[1][0], "bootout");
        assert!(!plist.exists(), "rollback must remove the plist");
    }

    // -----------------------------------------------------------------------
    // Quoting, and reading a command line back
    // -----------------------------------------------------------------------

    #[test]
    fn a_path_with_spaces_survives_a_round_trip_through_a_command_line() {
        let plan = windows_plan(StartMode::Boot);
        let command_line = plan.command_line();
        assert!(
            command_line.starts_with('"'),
            "a path with a space must be quoted, got {command_line}"
        );
        assert_eq!(
            executable_from_command_line(&command_line).as_deref(),
            Some(plan.binary())
        );
    }

    #[test]
    fn a_path_without_spaces_is_not_quoted_and_still_reads_back() {
        let plan = linux_plan(StartMode::Boot);
        let command_line = plan.command_line();
        assert!(!command_line.starts_with('"'), "got {command_line}");
        assert_eq!(
            executable_from_command_line(&command_line).as_deref(),
            Some(plan.binary())
        );
    }

    #[test]
    fn a_quoted_path_containing_a_quote_reads_back_verbatim() {
        // Not a path anybody has, but it is the input that separates a real
        // implementation of Windows' quoting rules from a `split_whitespace`.
        let awkward = r#"C:\odd "name"\rm.exe"#;
        let quoted = quote_argument(awkward);
        assert_eq!(
            executable_from_command_line(&format!("{quoted} daemon run"))
                .as_deref()
                .map(Path::to_string_lossy)
                .as_deref(),
            Some(awkward)
        );
    }

    #[test]
    fn an_empty_command_line_has_no_executable() {
        assert_eq!(executable_from_command_line("   "), None);
        assert_eq!(executable_from_command_line(""), None);
    }

    #[test]
    fn xml_escaping_round_trips_the_characters_a_path_or_an_account_may_hold() {
        let awkward = r#"DOMAIN\R&D <team> "ops""#;
        assert_eq!(
            xml_escape(awkward),
            "DOMAIN\\R&amp;D &lt;team&gt; &quot;ops&quot;"
        );
        assert_eq!(xml_unescape(&xml_escape(awkward)), awkward);
    }

    // -----------------------------------------------------------------------
    // The restart policy is bounded at both ends
    // -----------------------------------------------------------------------

    #[test]
    fn a_restart_delay_under_the_floor_is_refused() {
        let error = RestartPolicy::new(Duration::from_millis(500), Duration::from_secs(60))
            .expect_err("half a second is under the one-second floor");
        assert!(
            matches!(error, ServiceError::RestartDelay { .. }),
            "{error}"
        );
    }

    #[test]
    fn a_restart_delay_over_the_ceiling_is_refused() {
        let error = RestartPolicy::new(Duration::from_secs(3600), Duration::from_secs(7200))
            .expect_err("an hour is over the five-minute ceiling");
        assert!(
            matches!(error, ServiceError::RestartDelay { .. }),
            "{error}"
        );
    }

    #[test]
    fn a_reset_window_no_longer_than_the_delay_is_refused() {
        let error = RestartPolicy::new(Duration::from_secs(15), Duration::from_secs(15))
            .expect_err("a window equal to the delay can never elapse between restarts");
        assert!(
            matches!(error, ServiceError::RestartResetWindow { .. }),
            "{error}"
        );
    }

    #[test]
    fn a_delay_inside_the_bound_is_accepted() {
        let policy = RestartPolicy::new(Duration::from_secs(20), Duration::from_secs(300))
            .expect("twenty seconds is inside the bound");
        assert_eq!(policy.delay(), Duration::from_secs(20));
        assert_eq!(policy.reset_after(), Duration::from_secs(300));
    }

    // -----------------------------------------------------------------------
    // Identity
    // -----------------------------------------------------------------------

    #[test]
    fn a_fixture_identity_can_never_be_the_product_identity() {
        let fixture = ServiceIdentity::fixture("abc123");
        assert!(fixture.is_fixture());
        assert!(!ServiceIdentity::product().is_fixture());
        assert_ne!(fixture.name(), ServiceIdentity::product().name());
        assert_ne!(
            fixture.launchd_label(),
            ServiceIdentity::product().launchd_label()
        );
        assert_ne!(
            fixture.systemd_unit(),
            ServiceIdentity::product().systemd_unit()
        );
    }

    #[test]
    fn a_fixture_tag_is_reduced_to_characters_every_manager_accepts() {
        let fixture = ServiceIdentity::fixture("A b/c:\\d");
        assert!(
            fixture
                .name()
                .chars()
                .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-'),
            "got {}",
            fixture.name()
        );
    }

    // -----------------------------------------------------------------------
    // The systemd unit
    // -----------------------------------------------------------------------

    #[test]
    fn the_boot_unit_restarts_on_failure_after_the_bounded_delay() {
        let unit = systemd_unit(&linux_plan(StartMode::Boot));
        assert!(unit.contains("KillMode=process\n"), "{unit}");
        assert!(unit.contains("Restart=on-failure\n"), "{unit}");
        assert!(unit.contains("RestartSec=15\n"), "{unit}");
        assert!(unit.contains("StartLimitIntervalSec=600\n"), "{unit}");
        assert!(unit.contains("StartLimitBurst=5\n"), "{unit}");
        assert!(unit.contains("WantedBy=multi-user.target\n"), "{unit}");
    }

    #[test]
    fn the_boot_unit_reads_the_live_store_instead_of_a_frozen_systemd_copy() {
        let unit = systemd_unit(&linux_plan(StartMode::Boot));
        assert!(
            !unit.contains("LoadCredential="),
            "a startup snapshot would shadow every rotated credential until restart:\n{unit}"
        );
    }

    #[test]
    fn a_login_unit_carries_no_machine_credential_and_wants_the_session_target() {
        let unit = systemd_unit(&linux_plan(StartMode::Login));
        assert!(
            !unit.contains("LoadCredential="),
            "a user unit must not name a root-owned credential file, got:\n{unit}"
        );
        assert!(unit.contains("WantedBy=default.target\n"), "{unit}");
    }

    #[test]
    fn the_unit_can_atomically_replace_the_credential_and_write_only_required_directories() {
        let plan = linux_plan(StartMode::Boot);
        let unit = systemd_unit(&plan);
        let directives = ini_directives(&unit, "Service");
        let listed = split_quoted(
            directives
                .get("ReadWritePaths")
                .expect("the unit names its writable paths"),
        );
        assert_eq!(listed.len(), 5, "{listed:?}");
        for path in plan.directories().all() {
            assert!(
                listed.iter().any(|entry| entry == &path.to_string_lossy()),
                "{} is missing from {listed:?}",
                path.display()
            );
        }
        assert!(
            listed
                .iter()
                .any(|entry| entry == "/var/lib/runner-manager/secrets"),
            "atomic credential replacement needs its parent directory in {listed:?}"
        );
    }

    #[test]
    fn the_unit_records_the_absolute_binary_path() {
        let plan = linux_plan(StartMode::Boot);
        let unit = systemd_unit(&plan);
        assert!(
            unit.contains("ExecStart=/opt/runner-manager/bin/runner-manager daemon run\n"),
            "{unit}"
        );
    }

    // -----------------------------------------------------------------------
    // The launchd property list
    // -----------------------------------------------------------------------

    #[test]
    fn the_daemon_restarts_only_after_an_unsuccessful_exit() {
        let plist = launchd_plist(&linux_plan(StartMode::Boot));
        // A bare `KeepAlive` would also restart a job the operator stopped
        // deliberately, which turns `service stop` into a fight with launchd.
        assert!(
            plist.contains(
                "<key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n"
            ),
            "{plist}"
        );
        assert!(
            plist.contains("<key>ThrottleInterval</key>\n  <integer>15</integer>"),
            "{plist}"
        );
    }

    #[test]
    fn a_launch_daemon_names_root_and_a_launch_agent_names_nobody() {
        let daemon = launchd_plist(&linux_plan(StartMode::Boot));
        assert_eq!(
            plist_string_value(&daemon, "UserName").as_deref(),
            Some("root")
        );
        assert_eq!(plist_bool_value(&daemon, "SessionCreate"), Some(false));

        let agent = launchd_plist(&linux_plan(StartMode::Login));
        assert_eq!(
            plist_string_value(&agent, "UserName"),
            None,
            "a LaunchAgent already runs as the operator:\n{agent}"
        );
    }

    #[test]
    fn the_plist_runs_the_daemon_and_its_runners_as_an_interactive_job() {
        for mode in [StartMode::Boot, StartMode::Login] {
            let plan = linux_plan(mode);
            let plist = launchd_plist(&plan);
            assert_eq!(
                plist_string_value(&plist, "ProcessType").as_deref(),
                Some("Interactive"),
                "launchd applies ProcessType to every runner the daemon starts:\n{plist}"
            );
            let review = review_least_privilege(
                &ServiceDefinition::from_text(DefinitionKind::LaunchdPlist, plist),
                &plan,
            );
            assert!(
                review
                    .controls()
                    .iter()
                    .any(|control| control == "ProcessType=Interactive"),
                "{review}"
            );
            assert!(
                !review
                    .findings()
                    .iter()
                    .any(|finding| finding.subject == "ProcessType"),
                "{review}"
            );
        }
    }

    /// The value 0.4.31 and earlier installed, and launchd's default, both
    /// throttle every runner. That is a shortfall the update repairs, not an
    /// excess: a scheduling class grants no authority.
    #[test]
    fn a_plist_that_throttles_its_runners_is_a_shortfall() {
        let plan = linux_plan(StartMode::Login);
        let rendered = launchd_plist(&plan);
        let interactive = "<key>ProcessType</key>\n  <string>Interactive</string>\n";
        for (label, throttled) in [
            (
                "Background",
                edited(
                    &rendered,
                    interactive,
                    "<key>ProcessType</key>\n  <string>Background</string>\n",
                ),
            ),
            ("absent", edited(&rendered, interactive, "")),
        ] {
            let review = review_least_privilege(
                &ServiceDefinition::from_text(DefinitionKind::LaunchdPlist, throttled),
                &plan,
            );
            assert!(review.is_least_privilege(), "{label}: {review}");
            assert!(
                review.findings().iter().any(|finding| {
                    finding.kind == FindingKind::Shortfall
                        && finding.subject == "ProcessType"
                        && finding.detail.contains(label)
                }),
                "{label}: {review}"
            );
        }
    }

    #[test]
    fn a_plist_with_an_old_process_type_is_drift_and_an_operator_edit_is_not() {
        let host = Host::new();
        let identity = ServiceIdentity::product();
        let plan = InstallPlan::resolve(
            identity.clone(),
            &host.request(StartMode::Login),
            ServiceDirectories::of(&host.paths),
        )
        .expect("a resolvable plan");
        let installed = launchd_plist(&plan);
        let definition =
            ServiceDefinition::from_text(DefinitionKind::LaunchdPlist, installed.clone());
        let mut record = InstallRecord::of(&plan, &definition, Utc::now());
        record.installed_by_version = "0.4.31".into();
        let path = PathBuf::from("/Users/op/Library/LaunchAgents/runner-manager.plist");

        assert_eq!(
            launchd_definition_drift(&identity, &record, path.clone(), &installed),
            None
        );
        let edited_by_operator = edited(
            &installed,
            "</dict>\n</plist>\n",
            "  <key>Nice</key>\n  <integer>0</integer>\n</dict>\n</plist>\n",
        );
        assert_eq!(
            launchd_definition_drift(&identity, &record, path.clone(), &edited_by_operator),
            None,
            "the daemon repairs this drift itself, so it must not key on edits it did not cause"
        );

        let written_by_0_4_31 = edited(
            &installed,
            "<string>Interactive</string>",
            "<string>Background</string>",
        );
        let drift = launchd_definition_drift(&identity, &record, path, &written_by_0_4_31)
            .expect("a Background plist is drift");
        assert_eq!(drift.manager, DefinitionKind::LaunchdPlist);
        assert_eq!(drift.start_mode, StartMode::Login);
        assert_eq!(
            drift.rendered, installed,
            "the repair must write exactly what `service install` writes"
        );

        let status = ServiceStatus::compose(identity, None, None, None, None, &host.paths)
            .with_definition_drift(Some(drift));
        let problem = status
            .problems()
            .iter()
            .find(|problem| problem.subject == "definition")
            .expect("the drift is reported");
        // The remedy is a restart: a running daemon holds the lock that refuses
        // `service install`.
        assert!(
            problem.detail.contains("0.4.31")
                && problem.detail.contains(
                    "launchctl kickstart -k gui/$(id -u)/io.github.IvanMurzak.runner-manager`"
                )
                && !problem.detail.contains("service install")
                && !problem.detail.contains("systemctl")
                && !problem.detail.contains("sudo"),
            "{}",
            problem.detail
        );
    }

    #[cfg(unix)]
    #[test]
    fn a_replaced_definition_is_the_rendering_and_readable_by_launchd() {
        use std::os::unix::fs::PermissionsExt as _;

        let root = tempfile::tempdir().expect("a temporary directory");
        let path = root
            .path()
            .join("io.github.IvanMurzak.runner-manager.plist");
        std::fs::write(&path, "<string>Background</string>").expect("old plist");
        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
        let drift = DefinitionDrift {
            path: path.clone(),
            installed_by_version: "0.4.31".into(),
            rendered: launchd_plist(&linux_plan(StartMode::Login)),
            start_mode: StartMode::Login,
            manager: DefinitionKind::LaunchdPlist,
        };

        replace_definition("runner-manager", &drift).expect("replaced");

        assert_eq!(std::fs::read_to_string(&path).unwrap(), drift.rendered);
        assert_eq!(
            std::fs::metadata(&path).unwrap().permissions().mode() & 0o777,
            0o644
        );
        assert_eq!(
            std::fs::read_dir(root.path()).unwrap().count(),
            1,
            "no staging file is left beside the plist"
        );
    }

    /// The job of [`a_job_reloads_itself_from_its_rewritten_plist`], run by
    /// launchd and by nothing else.
    ///
    /// It does what the daemon does when it starts: when its own plist (kept
    /// in its working directory) does not carry [`LAUNCHD_PROCESS_TYPE`], it
    /// rewrites the plist and asks for the reload from inside the job that the
    /// reload boots out. Either way it then stays up, to be booted out by the
    /// helper or, once reloaded, by the test.
    #[cfg(target_os = "macos")]
    #[test]
    #[ignore = "run only by launchd, as the job of the detached-reload test"]
    fn detached_reload_job() {
        let label = std::env::var("XPC_SERVICE_NAME").unwrap_or_default();
        let tag = label
            .split_once("-selftest-")
            .map(|(_, tag)| tag.to_string())
            .unwrap_or_else(|| panic!("run only by launchd for the reload test, not {label:?}"));
        let identity = ServiceIdentity::fixture(&tag);
        assert_eq!(identity.launchd_label(), label);
        let path = std::env::current_dir()
            .expect("working directory")
            .join(format!("{label}.plist"));
        let installed = std::fs::read_to_string(&path).expect("own plist");
        if plist_string_value(&installed, "ProcessType").as_deref() != Some(LAUNCHD_PROCESS_TYPE) {
            let drift = DefinitionDrift {
                path: path.clone(),
                installed_by_version: "0.4.31".into(),
                rendered: installed.replace(
                    "<string>Background</string>",
                    &format!("<string>{LAUNCHD_PROCESS_TYPE}</string>"),
                ),
                start_mode: StartMode::Login,
                manager: DefinitionKind::LaunchdPlist,
            };
            replace_definition(identity.name(), &drift).expect("plist replaced");
            super::sys::reload_detached(&identity, StartMode::Login, &path)
                .expect("helper started");
        }
        std::thread::sleep(Duration::from_secs(120));
    }

    /// A job that rewrites its own plist and asks for the reload comes back
    /// under the rewritten plist.
    ///
    /// The request comes from inside the job, as the daemon's does, so the
    /// helper has to outlive the bootout of the very job that started it.
    /// launchd sends SIGTERM to the job's whole process group, so a helper that
    /// stayed in it would sometimes die before its bootstrap and leave the job
    /// unloaded. Measured with `setsid` removed, that failed one run in four
    /// here: this test catches it, though not on every run.
    #[cfg(target_os = "macos")]
    #[test]
    fn a_job_reloads_itself_from_its_rewritten_plist() {
        if !super::launchd_fixture::enabled() {
            return;
        }
        let root = tempfile::tempdir().expect("a temporary directory");
        let identity = ServiceIdentity::fixture(&format!("reload-{}", std::process::id()));
        let label = identity.launchd_label();
        let path = root.path().join(format!("{label}.plist"));
        let binary = super::launchd_fixture::job_binary(root.path());
        let mut plist = String::from("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
        plist.push_str("<plist version=\"1.0\">\n<dict>\n");
        plist.push_str(&plist_string("Label", &label));
        plist.push_str("  <key>ProgramArguments</key>\n  <array>\n");
        for argument in [
            binary.to_string_lossy().as_ref(),
            "--ignored",
            "--exact",
            "service::tests::detached_reload_job",
            "--test-threads=1",
        ] {
            plist.push_str(&format!("    <string>{}</string>\n", xml_escape(argument)));
        }
        plist.push_str("  </array>\n  <key>RunAtLoad</key>\n  <true/>\n");
        plist.push_str(&plist_string(
            "WorkingDirectory",
            &root.path().to_string_lossy(),
        ));
        plist.push_str(&plist_string("ProcessType", "Background"));
        plist.push_str("</dict>\n</plist>\n");
        std::fs::write(&path, plist).expect("plist written");

        let loaded = super::launchd_fixture::LoadedAgent::bootstrap(&label, &path);
        let spawn_type = || {
            let printed = std::process::Command::new("launchctl")
                .args(["print", loaded.target()])
                .output()
                .expect("launchctl runs");
            String::from_utf8_lossy(&printed.stdout)
                .lines()
                .find_map(|line| {
                    line.trim()
                        .strip_prefix("spawn type = ")
                        .map(str::to_string)
                })
        };
        assert_eq!(spawn_type().as_deref(), Some("background (5)"));

        let deadline = std::time::Instant::now() + Duration::from_secs(90);
        while spawn_type().as_deref() != Some("interactive (4)") {
            assert!(
                std::time::Instant::now() < deadline,
                "the job did not come back under its rewritten plist; launchd reports {:?}",
                spawn_type()
            );
            std::thread::sleep(Duration::from_millis(250));
        }
        let rewritten = std::fs::read_to_string(&path).expect("plist readable");
        assert_eq!(
            plist_string_value(&rewritten, "ProcessType").as_deref(),
            Some(LAUNCHD_PROCESS_TYPE)
        );
    }

    #[test]
    fn the_plist_records_the_absolute_binary_path_and_the_daemon_arguments() {
        let plist = launchd_plist(&linux_plan(StartMode::Boot));
        assert!(
            plist.contains("<string>/opt/runner-manager/bin/runner-manager</string>"),
            "{plist}"
        );
        assert!(plist.contains("<string>daemon</string>"), "{plist}");
        assert!(plist.contains("<string>run</string>"), "{plist}");
    }

    #[test]
    fn the_launchd_label_is_the_product_identity_in_reverse_domain_form() {
        assert_eq!(
            ServiceIdentity::product().launchd_label(),
            "io.github.IvanMurzak.runner-manager"
        );
    }

    // -----------------------------------------------------------------------
    // The Task Scheduler document
    // -----------------------------------------------------------------------

    #[test]
    fn the_task_runs_at_least_privilege_on_a_logon_trigger() {
        let xml = windows_scheduled_task_xml(
            &windows_plan(StartMode::Login),
            &TaskPrincipal::named("HOST\\operator"),
        );
        assert!(xml.contains("<LogonTrigger>"), "{xml}");
        assert!(xml.contains("<RunLevel>LeastPrivilege</RunLevel>"), "{xml}");
        assert!(
            xml.contains("<LogonType>InteractiveToken</LogonType>"),
            "{xml}"
        );
        assert!(xml.contains("<UserId>HOST\\operator</UserId>"), "{xml}");
        assert!(
            xml.contains("<Interval>PT1M</Interval>"),
            "Task Scheduler takes whole minutes only, and rejects the registration outright \
             for anything finer:\n{xml}"
        );
    }

    #[test]
    fn task_schedulers_minute_granularity_only_ever_rounds_the_delay_up() {
        // Measured against the real Task Scheduler, which answers `PT15S` with
        // "The task XML contains a value which is incorrectly formatted or out
        // of range". Rounding *up* is what keeps "does not restart-loop faster
        // than that bound" true on this manager.
        for (asked, enforced) in [(1u64, 60u64), (15, 60), (60, 60), (61, 120), (300, 300)] {
            let policy =
                RestartPolicy::new(Duration::from_secs(asked), Duration::from_secs(asked + 600))
                    .expect("inside the supported range");
            assert_eq!(
                policy
                    .effective_delay(DefinitionKind::WindowsScheduledTask)
                    .as_secs(),
                enforced,
                "a {asked}s delay must be enforced as {enforced}s"
            );
            assert!(
                policy.effective_delay(DefinitionKind::WindowsScheduledTask) >= policy.delay(),
                "rounding must never shorten the bound"
            );
        }
    }

    #[test]
    fn every_other_manager_enforces_the_delay_exactly_as_configured() {
        let policy = RestartPolicy::default();
        for kind in [
            DefinitionKind::WindowsService,
            DefinitionKind::LaunchdPlist,
            DefinitionKind::SystemdUnit,
        ] {
            assert_eq!(
                policy.effective_delay(kind),
                policy.delay(),
                "{kind:?} takes seconds and enforces exactly what it is given"
            );
        }
    }

    #[test]
    fn a_task_whose_manager_reports_the_rounded_delay_is_not_a_fault() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Login))
            .expect("an install at login");
        // What a real Task Scheduler reports back for a 15-second policy.
        host.controls.edit("runner-manager", |registration| {
            registration.manager = DefinitionKind::WindowsScheduledTask;
            registration.restart_delay = Some(Duration::from_secs(60));
        });

        let status = operations.status().expect("a status");
        assert!(
            status.is_healthy(),
            "minute granularity is the manager's, not a mis-registration: {status}"
        );
        assert!(
            status
                .notes()
                .iter()
                .any(|note| note.contains("whole minutes")),
            "but the operator must be told why 15 became 60: {status}"
        );

        // The discriminator: a delay that is neither the configured one nor its
        // rounding is still a fault.
        host.controls.edit("runner-manager", |registration| {
            registration.restart_delay = Some(Duration::from_secs(1));
        });
        assert!(
            !operations.status().expect("a status").is_healthy(),
            "a one-second delay is not what any manager was asked for"
        );
    }

    #[test]
    fn the_task_records_the_absolute_binary_path_and_the_daemon_arguments() {
        let plan = windows_plan(StartMode::Login);
        let xml = windows_scheduled_task_xml(&plan, &TaskPrincipal::named("HOST\\operator"));
        assert_eq!(
            xml_value(&xml, "Command").as_deref(),
            Some("C:\\Program Files\\runner-manager\\runner-manager.exe"),
            "{xml}"
        );
        assert_eq!(xml_value(&xml, "Arguments").as_deref(), Some("daemon run"));
    }

    #[test]
    fn an_account_name_holding_xml_punctuation_is_escaped() {
        let xml = windows_scheduled_task_xml(
            &windows_plan(StartMode::Login),
            &TaskPrincipal::named("R&D\\ops"),
        );
        assert!(xml.contains("<UserId>R&amp;D\\ops</UserId>"), "{xml}");
        assert_eq!(xml_value(&xml, "UserId").as_deref(), Some("R&D\\ops"));
    }

    // -----------------------------------------------------------------------
    // The Windows service descriptor
    // -----------------------------------------------------------------------

    #[test]
    fn the_service_starts_automatically_under_the_account_the_store_admits() {
        let text = windows_service_descriptor(&windows_plan(StartMode::Boot));
        let directives = ini_directives(&text, "windows-service");
        assert_eq!(
            directives.get("StartType").map(String::as_str),
            Some("AutoStart")
        );
        assert_eq!(
            directives.get("Account").map(String::as_str),
            Some("NT AUTHORITY\\SYSTEM")
        );
        assert_eq!(
            directives.get("ServiceType").map(String::as_str),
            Some("OWN_PROCESS")
        );
        assert_eq!(
            directives
                .get("FailureActionRestartDelaySecs")
                .map(String::as_str),
            Some("15")
        );
        assert_eq!(
            directives
                .get("FailureActionsOnNonCrashFailures")
                .map(String::as_str),
            Some("true"),
            "without this flag a non-zero exit is not a failure the manager restarts"
        );
    }

    #[test]
    fn the_service_spec_leaves_the_account_unnamed_so_the_api_means_local_system() {
        let spec = windows_service_spec(&windows_plan(StartMode::Boot));
        assert_eq!(spec.account, None);
        assert!(spec.automatic_start);
        assert!(
            spec.command_line.contains("daemon run"),
            "{}",
            spec.command_line
        );
    }

    // -----------------------------------------------------------------------
    // Where each definition is installed
    // -----------------------------------------------------------------------

    #[test]
    fn each_definition_goes_where_its_platform_expects_it() {
        let home = PathBuf::from("/home/op");
        assert_eq!(
            ServiceDefinition::launchd(&linux_plan(StartMode::Boot), Some(&home)).install_path(),
            Some(Path::new(
                "/Library/LaunchDaemons/io.github.IvanMurzak.runner-manager.plist"
            ))
        );
        assert_eq!(
            ServiceDefinition::launchd(&linux_plan(StartMode::Login), Some(&home)).install_path(),
            Some(Path::new(
                "/home/op/Library/LaunchAgents/io.github.IvanMurzak.runner-manager.plist"
            ))
        );
        assert_eq!(
            ServiceDefinition::systemd(&linux_plan(StartMode::Boot), Some(&home)).install_path(),
            Some(Path::new("/etc/systemd/system/runner-manager.service"))
        );
        assert_eq!(
            ServiceDefinition::systemd(&linux_plan(StartMode::Login), Some(&home)).install_path(),
            Some(Path::new(
                "/home/op/.config/systemd/user/runner-manager.service"
            ))
        );
        assert_eq!(
            ServiceDefinition::windows_service(&windows_plan(StartMode::Boot)).install_path(),
            None,
            "the Service Control Manager has no file"
        );
    }

    #[test]
    fn a_login_definition_without_a_home_directory_has_nowhere_to_go() {
        assert_eq!(
            ServiceDefinition::systemd(&linux_plan(StartMode::Login), None).install_path(),
            None
        );
        assert_eq!(
            ServiceDefinition::launchd(&linux_plan(StartMode::Login), None).install_path(),
            None
        );
    }

    // -----------------------------------------------------------------------
    // The least-privilege review: the passing case, then every failing one
    // -----------------------------------------------------------------------

    #[test]
    fn the_rendered_definitions_are_all_least_privilege() {
        let linux = linux_plan(StartMode::Boot);
        let windows = windows_plan(StartMode::Boot);
        for (definition, plan) in [
            (ServiceDefinition::systemd(&linux, None), &linux),
            (ServiceDefinition::launchd(&linux, None), &linux),
            (ServiceDefinition::windows_service(&windows), &windows),
        ] {
            let review = review_least_privilege(&definition, plan);
            assert!(
                review.is_least_privilege(),
                "{:?} should be least privilege, got:\n{review}",
                definition.kind()
            );
            assert!(
                !review.controls().is_empty(),
                "a review that confirms nothing proves nothing: {:?}",
                definition.kind()
            );
        }
    }

    #[test]
    fn the_rendered_task_is_least_privilege_and_says_what_it_checked() {
        let plan = windows_plan(StartMode::Login);
        let definition =
            ServiceDefinition::windows_scheduled_task(&plan, &TaskPrincipal::named("HOST\\op"));
        let review = review_least_privilege(&definition, &plan);
        assert!(review.is_least_privilege(), "{review}");
        assert!(
            review
                .controls()
                .iter()
                .any(|control| control.contains("LeastPrivilege")),
            "{review}"
        );
    }

    #[test]
    fn a_unit_that_makes_one_more_directory_writable_is_not_least_privilege() {
        let plan = linux_plan(StartMode::Boot);
        let rendered = systemd_unit(&plan);
        let widened = edited(
            &rendered,
            "ReadWritePaths=/var/lib/runner-manager/config",
            "ReadWritePaths=/etc /var/lib/runner-manager/config",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::SystemdUnit, widened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
        assert!(
            review
                .excesses()
                .iter()
                .any(|finding| finding.detail.contains("/etc")),
            "the review must name the directory it objects to: {review}"
        );
    }

    #[test]
    fn a_unit_that_drops_a_hardening_directive_is_not_least_privilege() {
        let plan = linux_plan(StartMode::Boot);
        let rendered = systemd_unit(&plan);
        let weakened = edited(&rendered, "NoNewPrivileges=yes\n", "");
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::SystemdUnit, weakened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
        assert!(
            review
                .excesses()
                .iter()
                .any(|finding| finding.subject == "NoNewPrivileges"),
            "{review}"
        );
    }

    /// Whether reviewing `unit` against `plan` reports `kind` for `subject`.
    fn reports(unit: &str, plan: &InstallPlan, subject: &str, kind: FindingKind) -> bool {
        review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::SystemdUnit, unit.to_string()),
            plan,
        )
        .findings()
        .iter()
        .any(|finding| finding.subject == subject && finding.kind == kind)
    }

    #[test]
    fn protected_paths_are_inaccessible_and_the_review_keeps_them_so() {
        let plan = linux_plan(StartMode::Boot).with_protected_paths(vec![
            PathBuf::from("/srv/keys"),
            PathBuf::from("/data/my backups"),
        ]);
        let unit = systemd_unit(&plan);
        let directives = ini_directives(&unit, "Service");
        assert_eq!(
            split_quoted(&directives["InaccessiblePaths"]),
            ["-/srv/keys", "-/data/my backups"]
        );
        assert!(!reports(
            &unit,
            &plan,
            "InaccessiblePaths",
            FindingKind::Excess
        ));
        let dropped = unit.replace(
            &format!("InaccessiblePaths={}\n", directives["InaccessiblePaths"]),
            "",
        );
        assert!(reports(
            &dropped,
            &plan,
            "InaccessiblePaths",
            FindingKind::Excess
        ));
        assert!(
            !ini_directives(&systemd_unit(&linux_plan(StartMode::Boot)), "Service")
                .contains_key("InaccessiblePaths")
        );
    }

    // Unix paths: protected paths are a systemd mechanism.
    #[cfg(unix)]
    #[test]
    fn a_path_every_job_or_the_service_needs_cannot_be_protected() {
        let own = [PathBuf::from("/var/lib/runner-manager/config")];
        for refused in [
            "/",
            "/usr",
            "/etc",
            "/tmp",
            "relative",
            "/srv/../etc",
            "/var/lib",
            "/var/lib/runner-manager/config/x",
        ] {
            assert!(
                ProtectedPaths::refusal(Path::new(refused), &own).is_some(),
                "{refused}"
            );
        }
        for accepted in ["/srv/keys", "/home/ivan/.ssh", "/var/lib/postgresql"] {
            assert_eq!(
                ProtectedPaths::refusal(Path::new(accepted), &own),
                None,
                "{accepted}"
            );
        }
        let directory = tempfile::tempdir().unwrap();
        assert_eq!(
            ProtectedPaths::load(directory.path()).unwrap(),
            ProtectedPaths::default()
        );
        let list = ProtectedPaths {
            paths: vec![PathBuf::from("/srv/keys")],
        };
        list.save(directory.path()).unwrap();
        assert_eq!(ProtectedPaths::load(directory.path()).unwrap(), list);
    }

    #[test]
    fn no_unit_breaks_tar_by_answering_openat2_with_enosys() {
        for mode in [StartMode::Boot, StartMode::Login] {
            let unit = systemd_unit(&linux_plan(mode));
            assert!(
                !unit.contains("RestrictSUIDSGID"),
                "RestrictSUIDSGID fails every tar extraction in a job: {unit}"
            );
        }
    }

    #[test]
    fn only_a_boot_daemon_keeps_capabilities_and_boot_units_hide_home_trees() {
        let boot = systemd_unit(&linux_plan(StartMode::Boot));
        let directives = ini_directives(&boot, "Service");
        assert_eq!(directives["CapabilityBoundingSet"], BOOT_CAPABILITIES);
        assert_eq!(directives["AmbientCapabilities"], "");
        assert_eq!(directives["NoNewPrivileges"], "yes");
        assert_eq!(directives["ProtectHome"], "tmpfs");
        assert!(!directives.contains_key("BindPaths"));

        let login = systemd_unit(&linux_plan(StartMode::Login));
        let directives = ini_directives(&login, "Service");
        assert_eq!(directives["CapabilityBoundingSet"], "");
        assert!(!directives.contains_key("ProtectHome"));

        let unprotected = boot.replace("ProtectHome=tmpfs\n", "");
        assert!(reports(
            &unprotected,
            &linux_plan(StartMode::Boot),
            "ProtectHome",
            FindingKind::Excess
        ));
        let boot_set = format!("CapabilityBoundingSet={BOOT_CAPABILITIES}\n");
        let inverted = boot.replace(&boot_set, "CapabilityBoundingSet=~CAP_SYS_ADMIN\n");
        assert!(reports(
            &inverted,
            &linux_plan(StartMode::Boot),
            "CapabilityBoundingSet",
            FindingKind::Excess
        ));
        let widened = boot.replace(
            &boot_set,
            &format!("CapabilityBoundingSet={BOOT_CAPABILITIES} CAP_SYS_ADMIN\n"),
        );
        assert!(reports(
            &widened,
            &linux_plan(StartMode::Boot),
            "CapabilityBoundingSet",
            FindingKind::Excess
        ));
        let narrowed = boot.replace(&boot_set, "CapabilityBoundingSet=CAP_SETUID\n");
        assert!(reports(
            &narrowed,
            &linux_plan(StartMode::Boot),
            "CapabilityBoundingSet",
            FindingKind::Shortfall
        ));
    }

    #[test]
    fn status_reports_the_registered_account_and_falls_back_to_the_record() {
        let recorded = ServiceAccount::for_start_mode(StartMode::Boot).to_string();
        for (registered, shown) in [(Some("ivan"), "ivan"), (None, recorded.as_str())] {
            let host = Host::new();
            let operations = host.operations();
            operations.install(&host.request(StartMode::Boot)).unwrap();
            host.controls.edit("runner-manager", |registration| {
                registration.account = registered.map(str::to_string);
            });
            let status = operations.status().unwrap().to_string();
            assert!(
                status.contains(&format!("account                   {shown}\n")),
                "{status}"
            );
        }
    }

    #[cfg(target_os = "linux")]
    #[test]
    fn a_boot_install_refuses_a_unit_a_drop_in_runs_as_another_account() {
        let host = Host::new();
        let operations = host.operations();
        operations.install(&host.request(StartMode::Boot)).unwrap();
        host.controls.edit("runner-manager", |registration| {
            registration.account = Some("ivan".to_string());
        });
        let refused = operations
            .install(&host.request(StartMode::Boot))
            .expect_err("a unit running as ivan cannot use root's tree");
        let message = refused.to_string();
        assert!(message.contains("run as ivan"), "{message}");
        assert!(message.contains("Remove `User=`"), "{message}");
    }

    #[test]
    fn manager_account_spellings_match_the_record() {
        assert_eq!(
            windows_service_account("LocalSystem"),
            ServiceAccount::LocalSystem.as_str()
        );
        assert_eq!(windows_service_account(".\\svc-runner"), ".\\svc-runner");
        assert_eq!(
            scheduled_task_account(Some("S-1-5-21-1-2-3-1001".into())),
            None
        );
        assert_eq!(
            scheduled_task_account(Some("HOST\\op".into())),
            Some("HOST\\op".to_string())
        );
    }

    #[test]
    fn exec_start_prefixes_are_not_part_of_the_binary() {
        for (value, expected) in [
            ("/opt/rm daemon run", "/opt/rm daemon run"),
            ("-/opt/rm daemon run", "/opt/rm daemon run"),
            ("+!/opt/rm daemon run", "/opt/rm daemon run"),
            ("!!/opt/rm daemon run", "/opt/rm daemon run"),
            ("@/opt/rm runner-manager daemon run", "/opt/rm daemon run"),
            ("-@\"/opt/my rm\" rm daemon", "\"/opt/my rm\" daemon"),
        ] {
            assert_eq!(systemd_exec_command_line(value), expected, "{value}");
        }
        assert_eq!(
            executable_from_command_line(&systemd_exec_command_line("-/opt/rm daemon")),
            Some(PathBuf::from("/opt/rm"))
        );
    }

    #[test]
    fn restart_sec_accepts_systemd_time_spans() {
        for (value, expected) in [
            ("15", Duration::from_secs(15)),
            ("15s", Duration::from_secs(15)),
            ("1min", Duration::from_secs(60)),
            ("1min 30s", Duration::from_secs(90)),
            ("1min30s", Duration::from_secs(90)),
            ("2h", Duration::from_secs(7_200)),
            ("500ms", Duration::from_millis(500)),
            ("1.5s", Duration::from_millis(1_500)),
        ] {
            assert_eq!(systemd_timespan(value), Some(expected), "{value}");
        }
        for value in ["", "infinity", "soon", "5 parsecs", "s"] {
            assert_eq!(systemd_timespan(value), None, "{value}");
        }
    }

    #[cfg(unix)]
    #[test]
    fn the_system_tree_is_reported_as_roots_installation_under_var_lib() {
        let system = ServiceDirectories::of(&AppPaths::system());
        assert_eq!(system.root(), Path::new("/var/lib/runner-manager"));
        assert_eq!(
            data_root_owner(&system.root(), Some(Path::new("/home/op"))).as_deref(),
            Some("root")
        );
    }

    #[test]
    fn a_boot_service_refuses_directories_it_could_not_open() {
        let var = Path::new("/var/lib/runner-manager/state");
        assert_eq!(boot_directory_refusal(var, Some(0)), None);
        let refused = boot_directory_refusal(var, Some(1000)).expect("another owner");
        assert!(refused.contains("uid 1000"), "{refused}");
        assert!(boot_directory_refusal(var, None).is_some());
        for hidden in ["/home/op/.config/runner-manager", "/root/.local/state/rm"] {
            let refused =
                boot_directory_refusal(Path::new(hidden), Some(0)).expect("a hidden tree");
            assert!(refused.contains("cannot see"), "{refused}");
        }
    }

    #[cfg(unix)]
    #[test]
    fn a_moved_tree_keeps_files_modes_and_links_but_not_the_skipped_entry() {
        use std::os::unix::fs::PermissionsExt as _;

        let from = tempfile::tempdir().unwrap();
        let to = tempfile::tempdir().unwrap();
        let target = to.path().join("state");
        std::fs::create_dir_all(from.path().join("journal/2026")).unwrap();
        std::fs::write(from.path().join("journal/2026/attempt"), b"entry").unwrap();
        std::fs::write(from.path().join("secret"), b"x").unwrap();
        std::fs::set_permissions(
            from.path().join("secret"),
            std::fs::Permissions::from_mode(0o600),
        )
        .unwrap();
        std::os::unix::fs::symlink("journal", from.path().join("latest")).unwrap();
        std::fs::create_dir(from.path().join("bin")).unwrap();

        copy_tree(from.path(), &target, Some("bin")).unwrap();

        assert_eq!(
            std::fs::read(target.join("journal/2026/attempt")).unwrap(),
            b"entry"
        );
        let mode = |path: &Path| std::fs::metadata(path).unwrap().permissions().mode() & 0o777;
        assert_eq!(mode(&target.join("secret")), 0o600);
        assert_eq!(mode(&target.join("journal")), 0o700);
        assert_eq!(
            std::fs::read_link(target.join("latest")).unwrap(),
            Path::new("journal")
        );
        assert!(!target.join("bin").exists());

        // An occupied target is set aside whole, not merged into or deleted.
        std::fs::write(target.join("stale.sqlite3-wal"), b"stale").unwrap();
        set_aside(&target, "20261110T000000Z").unwrap();
        assert!(!target.exists());
        let aside = to.path().join("state.before-move-20261110T000000Z");
        assert_eq!(
            std::fs::read(aside.join("stale.sqlite3-wal")).unwrap(),
            b"stale"
        );
        copy_tree(from.path(), &target, Some("bin")).unwrap();
        assert!(!target.join("stale.sqlite3-wal").exists());
        set_aside(&to.path().join("absent"), "x").unwrap();
    }

    #[test]
    fn systemd_drop_ins_replace_base_service_directives() {
        let base = systemd_unit(&linux_plan(StartMode::Boot));
        let combined = format!(
            "# /etc/systemd/system/runner-manager.service\n{base}\n\
             # /etc/systemd/system/runner-manager.service.d/account.conf\n\
             [Service]\nUser=ivan\nRestartSec=30\nExecStart=\n\
             ExecStart=/opt/runner-manager daemon run\n"
        );
        let directives = ini_directives(&combined, "Service");
        assert_eq!(directives["User"], "ivan");
        assert_eq!(directives["RestartSec"], "30");
        assert_eq!(directives["ExecStart"], "/opt/runner-manager daemon run");
        assert_eq!(directives["ProtectSystem"], "strict");
    }

    #[test]
    fn a_unit_that_keeps_capabilities_is_not_least_privilege() {
        let plan = linux_plan(StartMode::Login);
        let rendered = systemd_unit(&plan);
        let widened = edited(
            &rendered,
            "CapabilityBoundingSet=\n",
            "CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN\n",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::SystemdUnit, widened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
        assert!(
            review
                .excesses()
                .iter()
                .any(|finding| finding.subject == "CapabilityBoundingSet"),
            "{review}"
        );
    }

    #[test]
    fn a_unit_that_opens_a_listening_socket_is_not_least_privilege() {
        let plan = linux_plan(StartMode::Boot);
        let rendered = systemd_unit(&plan);
        let widened = edited(
            &rendered,
            "[Install]",
            "ListenStream=127.0.0.1:9000\n\n[Install]",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::SystemdUnit, widened),
            &plan,
        );
        assert!(
            !review.is_least_privilege(),
            "07-security.md rule 2 forbids any inbound surface: {review}"
        );
    }

    #[test]
    fn a_unit_that_makes_a_directory_unwritable_is_a_shortfall_not_an_excess() {
        let plan = linux_plan(StartMode::Boot);
        let rendered = systemd_unit(&plan);
        let narrowed = edited(&rendered, " /var/lib/runner-manager/runtime", "");
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::SystemdUnit, narrowed),
            &plan,
        );
        assert!(
            review.is_least_privilege(),
            "too little authority is not an excess: {review}"
        );
        assert!(
            review
                .findings()
                .iter()
                .any(|finding| finding.kind == FindingKind::Shortfall
                    && finding.detail.contains("runtime")),
            "{review}"
        );
    }

    #[test]
    fn a_launch_agent_that_names_an_account_is_not_least_privilege() {
        let plan = linux_plan(StartMode::Login);
        let rendered = launchd_plist(&plan);
        let widened = edited(
            &rendered,
            "<key>ProcessType</key>",
            "<key>UserName</key>\n  <string>root</string>\n  <key>ProcessType</key>",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::LaunchdPlist, widened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
        assert!(
            review
                .excesses()
                .iter()
                .any(|finding| finding.subject == "UserName"),
            "{review}"
        );
    }

    #[test]
    fn a_launch_daemon_that_asks_for_a_session_is_not_least_privilege() {
        let plan = linux_plan(StartMode::Boot);
        let rendered = launchd_plist(&plan);
        let widened = edited(
            &rendered,
            "<key>SessionCreate</key>\n  <false/>",
            "<key>SessionCreate</key>\n  <true/>",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::LaunchdPlist, widened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
        assert!(
            review
                .excesses()
                .iter()
                .any(|finding| finding.subject == "SessionCreate"),
            "{review}"
        );
    }

    #[test]
    fn a_launchd_job_that_publishes_a_mach_service_is_not_least_privilege() {
        let plan = linux_plan(StartMode::Boot);
        let rendered = launchd_plist(&plan);
        let widened = edited(
            &rendered,
            "<key>ProcessType</key>",
            "<key>MachServices</key>\n  <dict/>\n  <key>ProcessType</key>",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::LaunchdPlist, widened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
    }

    #[test]
    fn a_task_asking_for_the_highest_available_token_is_not_least_privilege() {
        let plan = windows_plan(StartMode::Login);
        let rendered = windows_scheduled_task_xml(&plan, &TaskPrincipal::named("HOST\\op"));
        let widened = edited(
            &rendered,
            "<RunLevel>LeastPrivilege</RunLevel>",
            "<RunLevel>HighestAvailable</RunLevel>",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::WindowsScheduledTask, widened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
        assert!(
            review
                .excesses()
                .iter()
                .any(|finding| finding.subject == "RunLevel"),
            "{review}"
        );
    }

    #[test]
    fn a_task_that_would_store_a_password_is_not_least_privilege() {
        let plan = windows_plan(StartMode::Login);
        let rendered = windows_scheduled_task_xml(&plan, &TaskPrincipal::named("HOST\\op"));
        let widened = edited(
            &rendered,
            "<LogonType>InteractiveToken</LogonType>",
            "<LogonType>Password</LogonType>",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::WindowsScheduledTask, widened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
    }

    #[test]
    fn an_interactive_windows_service_is_not_least_privilege() {
        let plan = windows_plan(StartMode::Boot);
        let rendered = windows_service_descriptor(&plan);
        let widened = edited(
            &rendered,
            "ServiceType=OWN_PROCESS",
            "ServiceType=OWN_PROCESS|INTERACTIVE_PROCESS",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::WindowsService, widened),
            &plan,
        );
        assert!(!review.is_least_privilege(), "{review}");
        assert!(
            review
                .excesses()
                .iter()
                .any(|finding| finding.subject == "ServiceType"),
            "{review}"
        );
    }

    #[test]
    fn a_windows_service_under_an_account_the_store_dacl_does_not_name_is_reported() {
        let plan = windows_plan(StartMode::Boot);
        let rendered = windows_service_descriptor(&plan);
        let changed = edited(
            &rendered,
            "Account=NT AUTHORITY\\SYSTEM",
            "Account=NT AUTHORITY\\LocalService",
        );
        let review = review_least_privilege(
            &ServiceDefinition::from_text(DefinitionKind::WindowsService, changed),
            &plan,
        );
        // LocalService is *less* privileged, so this is not an excess. It is
        // still wrong, because `d2`'s DACL names SY, BA and OW and nothing else:
        // the daemon would start and find no credential. Reporting it as a
        // shortfall rather than as an excess is the difference between a check
        // that understands the requirement and one that counts adjectives.
        assert!(review.is_least_privilege(), "{review}");
        assert!(
            review.findings().iter().any(|finding| {
                finding.kind == FindingKind::Shortfall && finding.subject == "Account"
            }),
            "{review}"
        );
    }

    // -----------------------------------------------------------------------
    // The recorded absolute path, and what became of it
    // -----------------------------------------------------------------------

    #[test]
    fn a_recorded_path_that_is_still_there_is_current() {
        let host = Host::new();
        let state = inspect_binary(&host.binary, Some(&host.binary));
        assert!(!state.is_error(), "{state}");
        assert!(matches!(state, BinaryPath::Current { .. }), "{state}");
    }

    #[test]
    fn the_npm_upgrade_case_reports_a_stale_path_as_an_error() {
        let host = Host::new();
        // An `npm i -g` binary lives under the active Node installation's
        // global prefix. Switching Node versions moves the prefix, and the
        // recorded path stops existing while the registration survives.
        let recorded = host.binary.clone();
        let healthy = inspect_binary(&recorded, Some(&recorded));
        assert!(
            !healthy.is_error(),
            "the discriminator: before the binary moves, this must be healthy"
        );

        std::fs::remove_file(&recorded).expect("the binary moves out from under the record");

        let state = inspect_binary(&recorded, Some(&recorded));
        assert!(state.is_error(), "{state}");
        assert!(matches!(state, BinaryPath::Missing { .. }), "{state}");
        assert!(
            state.to_string().contains("npm"),
            "the message must name the cause an operator will not otherwise connect: {state}"
        );
    }

    #[test]
    fn a_directory_at_the_recorded_path_is_not_something_the_manager_can_start() {
        let root = tempfile::tempdir().expect("a temporary directory");
        let state = inspect_binary(root.path(), None);
        assert!(state.is_error(), "{state}");
        assert!(matches!(state, BinaryPath::NotExecutable { .. }), "{state}");
    }

    #[test]
    fn a_registration_naming_a_different_binary_is_a_divergence() {
        let host = Host::new();
        let other = host.binary.with_file_name("something-else");
        let state = inspect_binary(&host.binary, Some(&other));
        assert!(state.is_error(), "{state}");
        assert!(matches!(state, BinaryPath::Diverged { .. }), "{state}");
    }

    #[test]
    fn absence_is_reported_before_divergence() {
        let host = Host::new();
        let recorded = host.binary.clone();
        std::fs::remove_file(&recorded).expect("removable");
        let other = recorded.with_file_name("something-else");
        // Both faults are true at once. The operator needs to hear about the
        // missing file, not about a disagreement between two paths of which one
        // does not exist.
        assert!(matches!(
            inspect_binary(&recorded, Some(&other)),
            BinaryPath::Missing { .. }
        ));
    }

    // -----------------------------------------------------------------------
    // The record
    // -----------------------------------------------------------------------

    #[test]
    fn the_record_round_trips_through_toml() {
        let host = Host::new();
        let plan = InstallPlan::resolve(
            ServiceIdentity::product(),
            &host.request(StartMode::Boot),
            ServiceDirectories::of(&host.paths),
        )
        .expect("a resolvable plan");
        let definition = ServiceDefinition::from_text(DefinitionKind::SystemdUnit, "[Service]\n");
        let record = InstallRecord::of(&plan, &definition, Utc::now());
        record.write(&host.paths).expect("a writable record");
        let read = InstallRecord::read(&host.paths)
            .expect("a readable record")
            .expect("a record is there");
        assert_eq!(read, record);
        assert_eq!(read.binary, host.binary);
        assert!(read.binary.is_absolute());
    }

    #[test]
    fn a_unit_written_by_an_older_build_is_reported_and_a_current_one_is_not() {
        let host = Host::new();
        let identity = ServiceIdentity::product();
        let plan = InstallPlan::resolve(
            identity.clone(),
            &host.request(StartMode::Boot),
            ServiceDirectories::of(&host.paths),
        )
        .expect("a resolvable plan");
        let installed = systemd_unit(&plan);
        let definition =
            ServiceDefinition::from_text(DefinitionKind::SystemdUnit, installed.clone());
        let mut record = InstallRecord::of(&plan, &definition, Utc::now());
        let path = PathBuf::from("/etc/systemd/system/runner-manager.service");

        assert_eq!(
            systemd_definition_drift(&identity, &record, path.clone(), &installed),
            None,
            "the record must rebuild exactly the unit `service install` wrote"
        );

        record.installed_by_version = "0.4.7".into();
        let frozen = installed.replace(
            "[Service]\n",
            "[Service]\nLoadCredential=runner-manager.user-access-token:/var/lib/runner-manager/secrets/user-access-token\n",
        );
        let drift = systemd_definition_drift(&identity, &record, path, &frozen)
            .expect("an outdated unit is drift");
        assert_eq!(drift.installed_by_version, "0.4.7");
        assert_eq!(drift.rendered, installed);

        let status = ServiceStatus::compose(identity, None, None, None, None, &host.paths)
            .with_definition_drift(Some(drift));
        assert!(!status.is_healthy());
        assert!(
            status
                .problems()
                .iter()
                .any(|problem| problem.subject == "definition" && problem.detail.contains("0.4.7")),
            "{status}"
        );
    }

    #[test]
    fn a_rejected_credential_keeps_its_first_moment_and_makes_the_service_unhealthy() {
        let host = Host::new();
        assert_eq!(github_credential_rejected_since(&host.paths).unwrap(), None);
        let first = Utc::now() - chrono::Duration::hours(9);
        record_github_credential_rejected(&host.paths, first).unwrap();
        record_github_credential_rejected(&host.paths, Utc::now()).unwrap();
        let since = github_credential_rejected_since(&host.paths).unwrap();
        assert_eq!(since, Some(first));

        let status = ServiceStatus::compose(
            ServiceIdentity::product(),
            None,
            None,
            None,
            None,
            &host.paths,
        )
        .with_credential_rejection(since);
        assert!(!status.is_healthy());
        assert_eq!(status.credential_rejected_since(), Some(first));
        assert!(status.to_string().contains("auth login"), "{status}");

        clear_github_credential_rejection(&host.paths).unwrap();
        clear_github_credential_rejection(&host.paths).unwrap();
        assert_eq!(github_credential_rejected_since(&host.paths).unwrap(), None);
    }

    /// A guest that started nothing for 13 days while this said `healthy`.
    #[test]
    fn blocked_launches_make_the_service_unhealthy_with_their_remedy() {
        use crate::launch_health::{
            BlockCause, Viewpoint, clear_launches_blocked, launches_blocked,
            record_launches_blocked,
        };

        let host = Host::new();
        let compose = || {
            ServiceStatus::compose(
                ServiceIdentity::product(),
                None,
                None,
                None,
                None,
                &host.paths,
            )
            .with_launches_blocked(launches_blocked(&host.paths, Utc::now()))
        };
        assert!(
            !compose()
                .problems()
                .iter()
                .any(|problem| problem.subject == LAUNCHES_BLOCKED_SUBJECT)
        );
        let blocked = BlockCause::FenceHeld {
            directory: PathBuf::from("launch-fence"),
            owner: None,
        }
        .blocked_since(Utc::now(), Viewpoint::Guest);
        record_launches_blocked(&host.paths, &blocked, Utc::now()).unwrap();

        let status = compose();
        assert!(!status.is_healthy());
        assert_eq!(status.launches_blocked(), Some(&blocked));
        let problem = status
            .problems()
            .iter()
            .find(|problem| problem.subject == LAUNCHES_BLOCKED_SUBJECT)
            .expect("reported under its own subject");
        assert!(problem.detail.contains("systemctl restart"), "{status}");

        clear_launches_blocked(&host.paths).unwrap();
        assert_eq!(compose().launches_blocked(), None);
    }

    /// The daemon's own "I cannot read my credential", which used to exist
    /// only in its log while `service status` said `healthy`.
    #[test]
    fn an_unreadable_credential_keeps_its_first_moment_and_names_the_exact_command() {
        let host = Host::new();
        assert_eq!(credential_unreadable_since(&host.paths).unwrap(), None);
        let first = Utc::now() - chrono::Duration::minutes(40);
        record_credential_unreadable(&host.paths, first).unwrap();
        record_credential_unreadable(&host.paths, Utc::now()).unwrap();
        let since = credential_unreadable_since(&host.paths).unwrap();
        assert_eq!(since, Some(first), "a restart loop must not move the start");

        let status = ServiceStatus::compose(
            ServiceIdentity::product(),
            None,
            None,
            None,
            None,
            &host.paths,
        )
        .with_credential_unreadable(since);
        assert!(!status.is_healthy());
        let problem = status
            .problems()
            .iter()
            .find(|problem| problem.subject == CREDENTIAL_UNREADABLE_SUBJECT)
            .expect("reported under its own subject");
        // No record, so the default start mode, whose exact command is named.
        assert!(
            problem
                .detail
                .contains(&sign_in_instruction(StartMode::default())),
            "{status}"
        );

        clear_credential_unreadable(&host.paths).unwrap();
        clear_credential_unreadable(&host.paths).unwrap();
        assert_eq!(credential_unreadable_since(&host.paths).unwrap(), None);
        let healthy = ServiceStatus::compose(
            ServiceIdentity::product(),
            None,
            None,
            None,
            None,
            &host.paths,
        )
        .with_credential_unreadable(None);
        assert!(
            !healthy
                .problems()
                .iter()
                .any(|problem| problem.subject == CREDENTIAL_UNREADABLE_SUBJECT),
            "{healthy}"
        );
    }

    #[test]
    fn a_sudo_command_names_a_binary_sudo_would_not_find() {
        assert_eq!(sudo_program(None), "runner-manager");
        assert_eq!(
            sudo_program(Some(Path::new("/usr/local/bin/runner-manager"))),
            "runner-manager"
        );
        assert_eq!(
            sudo_program(Some(Path::new(
                "/home/op/.nvm/versions/node/v26.13.0/lib/node_modules/@ivan-murzak/\
                 runner-manager-linux-x64/bin/runner-manager"
            ))),
            "/home/op/.nvm/versions/node/v26.13.0/lib/node_modules/@ivan-murzak/\
             runner-manager-linux-x64/bin/runner-manager"
        );
        assert_eq!(
            sudo_program(Some(Path::new("/home/o'p/my bin/runner-manager"))),
            "'/home/o'\\''p/my bin/runner-manager'"
        );
        assert_eq!(
            sudo_command("service status"),
            "sudo runner-manager service status"
        );
    }

    #[test]
    fn the_sign_in_instruction_names_the_start_mode_it_writes() {
        assert!(sign_in_instruction(StartMode::Login).contains("auth login --start-at login`"));
        assert!(sign_in_instruction(StartMode::Boot).contains("auth login --start-at boot`"));
        assert_eq!(
            sign_in_instruction(StartMode::Boot).starts_with("`sudo "),
            cfg!(unix),
            "a machine-scoped store needs root on Unix"
        );
        assert_eq!(
            sign_in_instruction(StartMode::Login).contains("SSH"),
            cfg!(target_os = "macos"),
            "only the macOS login keychain is out of an SSH session's reach"
        );
    }

    /// The record is readable by the account whose directory it is in.
    ///
    /// A boot-mode `service install` runs under `sudo`, and `NamedTempFile`
    /// creates at `0600`, so the record landed `root`-owned and unreadable by
    /// the operator — `service status` then failed on their own host with
    /// `Permission denied`. Ownership cannot be reproduced in an unprivileged
    /// test, but the mode that made ownership fatal can, and it is the half
    /// this code controls.
    #[cfg(unix)]
    #[test]
    fn the_record_is_not_written_readable_only_by_whoever_installed_it() {
        use std::os::unix::fs::PermissionsExt as _;

        let host = Host::new();
        let plan = InstallPlan::resolve(
            ServiceIdentity::product(),
            &host.request(StartMode::Boot),
            ServiceDirectories::of(&host.paths),
        )
        .expect("a resolvable plan");
        let definition = ServiceDefinition::from_text(DefinitionKind::SystemdUnit, "[Service]\n");
        InstallRecord::of(&plan, &definition, Utc::now())
            .write(&host.paths)
            .expect("a writable record");

        let mode = std::fs::metadata(InstallRecord::path(&host.paths))
            .expect("the record is there")
            .permissions()
            .mode()
            & 0o777;
        assert_eq!(
            mode, 0o644,
            "the record is mode {mode:04o}; at 0600 an operator cannot read a record `sudo \
             service install` wrote, and `service status` fails on their own host. It holds no \
             credential and sits in a 0700 directory, so 0644 discloses nothing"
        );
    }

    /// A record written before the service ran a copy of its own must still
    /// load. It reads as `None`, which is the truth about it: that registration
    /// names the package manager's file and cannot be upgraded under itself.
    #[test]
    fn a_record_without_a_source_binary_still_reads_and_says_it_has_none() {
        let host = Host::new();
        let path = InstallRecord::path(&host.paths);
        std::fs::write(
            &path,
            format!(
                "schema_version = {RECORD_SCHEMA_VERSION}
service_name = \"runner-manager\"
                 manager = \"systemd\"
start_mode = \"boot\"
account = \"root\"
                 binary = \"/x\"
arguments = []
restart_delay_secs = 15
                 restart_reset_secs = 600
log_file = \"/x\"
                 installed_at = \"2026-01-01T00:00:00Z\"
installed_by_version = \"0.1.0\"
                 [directories]
config = \"/a\"
state = \"/b\"
runtime = \"/c\"
logs = \"/d\"
"
            ),
        )
        .expect("a writable record");
        let read = InstallRecord::read(&host.paths)
            .expect("a record missing an optional field is still readable")
            .expect("a record is there");
        assert_eq!(
            read.source_binary, None,
            "the legacy layout has no source, and must not invent one"
        );
    }

    /// The field that makes an upgrade possible survives the write.
    #[test]
    fn a_registration_remembers_the_file_it_was_copied_from() {
        let host = Host::new();
        let source = host.binary.with_file_name("npm-installed-runner-manager");
        std::fs::copy(&host.binary, &source).expect("a second file to stand in for the package");
        let plan = InstallPlan::resolve(
            ServiceIdentity::product(),
            &host.request(StartMode::Boot).copied_from(&source),
            ServiceDirectories::of(&host.paths),
        )
        .expect("a resolvable plan");
        let definition = ServiceDefinition::from_text(
            DefinitionKind::SystemdUnit,
            "[Service]
",
        );
        let record = InstallRecord::of(&plan, &definition, Utc::now());
        record.write(&host.paths).expect("a writable record");

        let read = InstallRecord::read(&host.paths)
            .expect("a readable record")
            .expect("a record is there");
        assert_eq!(read.source_binary.as_deref(), Some(source.as_path()));
        assert_ne!(
            read.source_binary.as_deref(),
            Some(read.binary.as_path()),
            "the whole point is that the two are different files: one the service holds open,              one the package manager is free to replace"
        );
    }

    #[test]
    fn a_record_from_a_schema_this_build_cannot_read_is_refused_with_a_remedy() {
        let host = Host::new();
        let path = InstallRecord::path(&host.paths);
        std::fs::write(
            &path,
            format!(
                "schema_version = {}\nservice_name = \"runner-manager\"\nmanager = \"systemd\"\n\
                 start_mode = \"boot\"\naccount = \"root\"\nbinary = \"/x\"\narguments = []\n\
                 restart_delay_secs = 15\nrestart_reset_secs = 600\nlog_file = \"/x\"\n\
                 installed_at = \"2026-01-01T00:00:00Z\"\ninstalled_by_version = \"0.1.0\"\n\
                 [directories]\nconfig = \"/a\"\nstate = \"/b\"\nruntime = \"/c\"\nlogs = \"/d\"\n",
                RECORD_SCHEMA_VERSION + 1
            ),
        )
        .expect("a writable record");
        let error = InstallRecord::read(&host.paths).expect_err("a future schema is refused");
        assert!(
            matches!(error, ServiceError::RecordUnreadable { .. }),
            "{error}"
        );
        assert!(
            error.to_string().contains("service uninstall"),
            "the message must say how to recover: {error}"
        );
    }

    #[test]
    fn no_record_is_not_an_error() {
        let host = Host::new();
        assert_eq!(InstallRecord::read(&host.paths).expect("no record"), None);
        assert!(!InstallRecord::remove(&host.paths).expect("nothing to remove"));
    }

    // -----------------------------------------------------------------------
    // The last successful GitHub contact
    // -----------------------------------------------------------------------

    #[test]
    fn no_heartbeat_reads_as_never_rather_than_as_the_epoch() {
        let host = Host::new();
        assert_eq!(last_github_contact(&host.paths).expect("readable"), None);
    }

    #[test]
    fn the_heartbeat_round_trips_to_the_second() {
        let host = Host::new();
        let at = DateTime::parse_from_rfc3339("2026-08-22T10:11:12Z")
            .expect("a valid timestamp")
            .with_timezone(&Utc);
        record_github_contact(&host.paths, at).expect("a writable heartbeat");
        assert_eq!(
            last_github_contact(&host.paths).expect("readable"),
            Some(at)
        );
    }

    #[test]
    fn a_malformed_heartbeat_is_an_error_and_not_silently_never() {
        let host = Host::new();
        std::fs::write(contact_path(&host.paths), b"this is not toml \x00").expect("writable");
        let error = last_github_contact(&host.paths)
            .expect_err("a heartbeat that cannot be parsed is not the same as no heartbeat");
        assert!(matches!(error, ServiceError::Record { .. }), "{error}");
    }

    /// The surface the three-hour outage did not have.
    ///
    /// A root that refuses a launch does so before any attempt row exists, and
    /// the daemon's log scrubs the paths out of the sentence, so this file is
    /// the only place the directory and the remediation can reach the operator.
    #[test]
    fn a_runner_root_refusal_round_trips_for_service_status() {
        let host = Host::new();
        let at = DateTime::from_timestamp(1_760_000_000, 0).expect("a valid instant");

        assert!(
            runner_root_refusals(&host.paths)
                .expect("readable")
                .is_empty(),
            "no record means every policy is placing runners"
        );

        record_runner_root_refusal(
            &host.paths,
            "policy-a",
            at,
            "denied_by_privacy_policy",
            "/Volumes/NVME/runners",
            "the runner root /Volumes/NVME/runners cannot be used: ... Grant Full Disk Access",
        )
        .expect("a writable record");

        let refusals = runner_root_refusals(&host.paths).expect("readable");
        assert_eq!(refusals.len(), 1);
        assert_eq!(refusals[0].policy, "policy-a");
        assert_eq!(refusals[0].at, at);
        assert_eq!(refusals[0].kind, "denied_by_privacy_policy");
        assert_eq!(refusals[0].root, "/Volumes/NVME/runners");
        assert!(
            refusals[0].detail.contains("/Volumes/NVME/runners")
                && refusals[0].detail.contains("Full Disk Access"),
            "the path and the remediation are the whole point of this file: {refusals:?}"
        );
    }

    /// The regression that would put the outage straight back.
    ///
    /// A host runs several policies and they do not share a fate. When the
    /// record was one host-wide slot, the policy that placed a runner deleted
    /// the record of the policy that could not — on the same reconcile pass —
    /// and `service status` reported a healthy host that had started zero
    /// runners for an entire target.
    #[test]
    fn one_policy_placing_a_runner_does_not_clear_another_policys_refusal() {
        let host = Host::new();
        let at = DateTime::from_timestamp(1_760_000_000, 0).expect("a valid instant");
        record_runner_root_refusal(
            &host.paths,
            "broken",
            at,
            "denied_by_privacy_policy",
            "/Volumes/NVME/runners",
            "detail",
        )
        .expect("a writable record");
        record_runner_root_refusal(
            &host.paths,
            "also-broken",
            at,
            "not_writable",
            "/srv/other",
            "detail",
        )
        .expect("a writable record");

        // The policy with its own working root succeeds and clears only itself.
        clear_runner_root_refusal(&host.paths, "healthy")
            .expect("clearing an absent policy is fine");
        clear_runner_root_refusal(&host.paths, "also-broken").expect("that policy recovered");

        let refusals = runner_root_refusals(&host.paths).expect("readable");
        assert_eq!(
            refusals
                .iter()
                .map(|r| r.policy.as_str())
                .collect::<Vec<_>>(),
            vec!["broken"],
            "the policy that is still refused must keep its record"
        );
    }

    /// Clearing is what keeps a fixed host from reporting a stale fault, and the
    /// file goes when the last entry does.
    #[test]
    fn clearing_the_last_refusal_removes_the_file_and_is_idempotent() {
        let host = Host::new();
        record_runner_root_refusal(
            &host.paths,
            "p",
            Utc::now(),
            "not_writable",
            "/srv/x",
            "detail",
        )
        .expect("a writable record");

        clear_runner_root_refusal(&host.paths, "p").expect("the record is removed");
        assert!(
            !root_refusal_path(&host.paths).exists(),
            "a host with nothing refused leaves nothing behind"
        );
        clear_runner_root_refusal(&host.paths, "p").expect("removing what is gone is not an error");
    }

    /// Same rule as the heartbeat: absence means "every policy is placing
    /// runners", so a record that cannot be parsed must not be reported as one.
    #[test]
    fn a_malformed_refusal_is_an_error_and_not_silently_none() {
        let host = Host::new();
        std::fs::write(root_refusal_path(&host.paths), b"not toml \x00").expect("writable");
        let error = runner_root_refusals(&host.paths)
            .expect_err("an unparseable record is not the same as no record");
        assert!(matches!(error, ServiceError::Record { .. }), "{error}");
    }

    /// The half of this feature that turns the file into a diagnosis, and the
    /// half that had no test: `service status` must actually read it.
    ///
    /// A **note** and not a problem, deliberately. `service status` runs as
    /// whoever typed it, must stay readable on a host with nothing installed,
    /// and drives an exit code -- and nothing an operator can type clears this
    /// record, so a problem would fail that exit code on a host whose root was
    /// fixed but which has had no queued job since, with a printed remedy
    /// (`service uninstall && service install`) that does not touch `state/`.
    #[test]
    fn service_status_reports_a_refusal_as_a_note_and_stays_healthy() {
        let host = Host::new();
        record_runner_root_refusal(
            &host.paths,
            "policy-a",
            DateTime::from_timestamp(1_760_000_000, 0).expect("a valid instant"),
            "denied_by_privacy_policy",
            "/Volumes/NVME/runners",
            "Grant Full Disk Access to the program that runs the service",
        )
        .expect("a writable record");

        let status = host.operations().status().expect("a readable status");
        let notes = status.notes().join("\n");

        assert!(
            notes.contains("/Volumes/NVME/runners") && notes.contains("Full Disk Access"),
            "the directory and the remediation the log had to scrub must appear here: {notes}"
        );
        assert!(
            notes.contains("policy-a"),
            "the operator has to know which target placed no runner: {notes}"
        );
        assert!(
            !status
                .problems()
                .iter()
                .any(|problem| problem.subject == "runner root"),
            "a record nothing an operator types can clear must not drive the exit code"
        );
    }

    // -----------------------------------------------------------------------
    // -----------------------------------------------------------------------
    // Install
    // -----------------------------------------------------------------------

    #[test]
    fn install_records_the_absolute_binary_path_and_the_four_directories() {
        let host = Host::new();
        let installed = host
            .operations()
            .install(&host.request(StartMode::Boot))
            .expect("an install against the recording controls");

        assert_eq!(installed.record.binary, host.binary);
        assert!(installed.record.binary.is_absolute());
        assert_eq!(installed.record.start_mode, StartMode::Boot);
        assert_eq!(installed.record.arguments, vec!["daemon", "run"]);
        assert_eq!(
            installed.record.directories,
            ServiceDirectories::of(&host.paths)
        );
        assert_eq!(
            installed.record.log_file,
            host.paths.logs_dir().join(LOG_FILE_STEM)
        );
        assert_eq!(installed.record.restart_delay_secs, 15);

        let registrations = host.controls.registrations();
        assert_eq!(registrations.len(), 1);
        assert_eq!(registrations[0].0, StartMode::Boot);
        assert_eq!(registrations[0].1, "runner-manager");
    }

    #[test]
    fn install_is_refused_while_the_single_instance_lock_is_held() {
        let host = Host::new();
        // The discriminator: with the lock free, the same call succeeds.
        {
            let operations = host.operations();
            operations
                .install(&host.request(StartMode::Boot))
                .expect("an install with the lock free");
            operations.uninstall().expect("a clean slate");
        }

        let _held = HostLock::try_acquire(&host.paths, LockKind::SingleInstance)
            .expect("this process takes the lock first");

        let error = host
            .operations()
            .install(&host.request(StartMode::Boot))
            .expect_err("a second agent must not be registered while one is running");
        assert!(matches!(error, ServiceError::LockHeld { .. }), "{error}");
        assert!(
            error.to_string().contains("already running"),
            "the message must be actionable: {error}"
        );
        assert!(
            host.controls.registrations().is_empty(),
            "a refused install must register nothing"
        );
        assert_eq!(
            InstallRecord::read(&host.paths).expect("readable"),
            None,
            "a refused install must write no record"
        );
    }

    /// Installing over the same start mode replaces the registration.
    ///
    /// It used to be refused, and the refusal is what broke a real host: the
    /// caller has already swapped the binary the service runs by the time this
    /// is reached — that is the documented way to upgrade by hand — so refusing
    /// left a daemon running an unregistered binary and, on macOS, one the
    /// stored credential's keychain grant did not name.
    #[test]
    fn installing_over_the_same_start_mode_replaces_the_registration() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("the first install");

        let again = operations
            .install(&host.request(StartMode::Boot))
            .expect("an install over the same mode replaces rather than refusing");

        assert!(
            again.replaced_existing,
            "the operator is told this replaced something rather than made it"
        );
        assert_eq!(
            host.controls.registrations().len(),
            1,
            "replacing must not leave two registrations behind"
        );
        assert_eq!(
            InstallRecord::read(&host.paths)
                .expect("readable")
                .expect("a record")
                .start_mode,
            StartMode::Boot
        );
    }

    /// The *other* mode is still refused, because changing it moves the
    /// registration between two service managers and changes the account and
    /// the secret store with it. `set_start_mode` is what does that.
    #[test]
    fn installing_over_the_other_start_mode_is_refused() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("the first install");

        let error = operations
            .install(&host.request(StartMode::Login))
            .expect_err("a mode change is not an install");
        assert!(
            matches!(
                error,
                ServiceError::AlreadyInstalled {
                    existing: StartMode::Boot,
                    requested: StartMode::Login,
                    ..
                }
            ),
            "{error}"
        );
        assert!(
            !error
                .to_string()
                .contains("switch the start mode in place,"),
            "the old remedy named a capability no command offers; the terminal UI is where \
             the start mode moves: {error}"
        );
        assert_eq!(host.controls.registrations().len(), 1);
    }

    #[test]
    fn install_rolls_back_the_registration_when_record_persistence_fails() {
        let host = Host::new();
        let record_path = InstallRecord::path(&host.paths);
        std::fs::create_dir(&record_path).expect("a directory blocks the record file");

        let error = host
            .operations()
            .install(&host.request(StartMode::Boot))
            .expect_err("record persistence must fail");

        assert!(matches!(error, ServiceError::Record { .. }), "{error}");
        assert!(
            host.controls.registrations().is_empty(),
            "a failed install must not leave a live unrecorded registration"
        );
        assert!(
            host.controls
                .calls()
                .iter()
                .any(|call| call == "uninstall runner-manager (boot)"),
            "the registration must be explicitly rolled back: {:?}",
            host.controls.calls()
        );
        assert!(
            !host.runner_root.as_path().exists(),
            "the rollback must take the runner root this install created with it; a directory \
             prepared for a registration that does not exist is litter, and on Windows it is \
             litter with a security descriptor"
        );
    }

    // -----------------------------------------------------------------------
    // The runner root (b2)
    // -----------------------------------------------------------------------

    #[test]
    fn the_runner_root_a_boot_registration_needs_admits_only_the_service() {
        use crate::runner_root_access::{RootAdmission, default_root_sddl, grants_broad_write};

        // The mapping `prepare_runner_root` reads, asserted against the same
        // function the registration's own principal comes from — which is the
        // point of deriving it there rather than restating it.
        assert_eq!(
            ServiceAccount::for_definition(DefinitionKind::WindowsService, StartMode::Boot),
            ServiceAccount::LocalSystem
        );
        assert_eq!(
            ServiceAccount::for_definition(DefinitionKind::WindowsScheduledTask, StartMode::Login),
            ServiceAccount::InvokingUser
        );

        let boot = default_root_sddl(&RootAdmission::LocalSystem);
        assert!(!grants_broad_write(&boot), "{boot}");
        assert!(
            !boot.contains("S-1-5-21"),
            "a boot registration runs as LocalSystem, so its root names no operator: {boot}"
        );

        // A login task runs under a *filtered* token — `RunLevel` is
        // `LeastPrivilege`, see `windows_scheduled_task_xml` — in which
        // Administrators is deny-only. Without an ace of its own the account
        // the task runs as would be admitted by nothing at all.
        let login = default_root_sddl(&RootAdmission::Account("S-1-5-21-1-2-3-1001".to_owned()));
        assert!(login.contains("S-1-5-21-1-2-3-1001"), "{login}");
        assert!(!grants_broad_write(&login), "{login}");
    }

    #[test]
    fn an_install_reports_the_runner_root_it_prepared() {
        let host = Host::new();
        let installed = host
            .operations()
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        let rendered = installed.runner_root.to_string();
        assert!(
            !rendered.contains("S-1-5-21"),
            "the report must add no identity to the output: {rendered}"
        );
        if cfg!(windows) {
            assert_eq!(
                installed.runner_root.path(),
                Some(host.runner_root.as_path())
            );
            assert!(
                host.runner_root.as_path().is_dir(),
                "the directory jobs would run in has to exist once the service is registered"
            );
        } else {
            assert_eq!(
                installed.runner_root,
                crate::runner_root_access::RootAccessSummary::NotApplicable,
                "macOS and Linux keep the runtime directory they have always used"
            );
        }
    }

    #[test]
    fn switching_start_mode_reconciles_the_runner_root_for_the_new_account() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install at boot");

        let change = operations
            .set_start_mode(StartMode::Login)
            .expect("a switch to login");

        assert!(change.changed);
        if cfg!(windows) {
            assert_eq!(change.runner_root.path(), Some(host.runner_root.as_path()));
            assert!(
                host.runner_root.as_path().is_dir(),
                "the switch must not remove the directory it reconciled"
            );
        }
        // The operator is told, because the account that may write there has
        // moved with the mode.
        assert!(
            change.to_string().contains("runner root"),
            "{}",
            change.to_string()
        );
    }

    #[test]
    fn switching_to_the_mode_already_in_force_touches_no_runner_root() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install at boot");

        let change = operations
            .set_start_mode(StartMode::Boot)
            .expect("a switch to the mode already in force");

        assert!(!change.changed);
        assert_eq!(
            change.runner_root,
            crate::runner_root_access::RootAccessSummary::NotApplicable,
            "nothing moves, so nothing about the root's access control has to; reconciling here \
             would turn a no-op command into one that can fail on a permission it does not need"
        );
    }

    #[cfg(windows)]
    #[test]
    fn a_registration_the_manager_refuses_leaves_no_runner_root_behind() {
        let host = Host::new();
        host.controls
            .fail_next_install(StartMode::Boot, "injected registration failure");

        let error = host
            .operations()
            .install(&host.request(StartMode::Boot))
            .expect_err("the manager refuses the registration");

        assert!(matches!(error, ServiceError::Control { .. }), "{error}");
        assert!(
            !host.runner_root.as_path().exists(),
            "the directory was created for a registration that does not exist"
        );
    }

    #[cfg(windows)]
    #[test]
    fn an_existing_broad_runner_root_refuses_the_install_before_anything_is_registered() {
        let host = Host::new();
        // What a directory created below `C:\` with inheritance left on looks
        // like, built deliberately because a per-account `%TEMP%` never
        // produces one by accident.
        crate::runner_root_access::create_with_descriptor_for_tests(
            host.runner_root.as_path(),
            "D:P(A;OICI;FA;;;SY)(A;OICI;FA;;;WD)",
        )
        .expect("a deliberately open runner root");
        let before = crate::runner_root_access::report(host.runner_root.as_path());

        let error = host
            .operations()
            .install(&host.request(StartMode::Boot))
            .expect_err("an open runner root is refused");

        assert!(matches!(error, ServiceError::RunnerRoot { .. }), "{error}");
        assert!(
            error.to_string().contains("nothing was registered"),
            "{error}"
        );
        assert!(
            host.controls.registrations().is_empty(),
            "the refusal has to come before the platform is asked to register anything: {:?}",
            host.controls.calls()
        );
        assert_eq!(
            crate::runner_root_access::report(host.runner_root.as_path()),
            before,
            "an open directory is refused rather than tightened: its contents cannot be trusted, \
             so adopting it would be worse than declining it"
        );
    }

    #[cfg(windows)]
    #[test]
    fn uninstall_leaves_the_runner_root_exactly_where_it_is() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        assert!(host.runner_root.as_path().is_dir());

        operations.uninstall().expect("an uninstall");

        assert!(
            host.runner_root.as_path().is_dir(),
            "`05-infrastructure.md` item 5: uninstall deregisters and deletes nothing else. A \
             runner root may hold an operator's retained workspaces."
        );
    }

    #[test]
    fn install_reviews_what_it_registered() {
        let host = Host::new();
        let installed = host
            .operations()
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        assert!(
            installed.review.is_least_privilege(),
            "{}",
            installed.review
        );
        assert!(
            !installed.review.controls().is_empty(),
            "a review that confirms nothing proves nothing: {}",
            installed.review
        );
        assert_eq!(
            installed.review.kind(),
            host_definition_kind(StartMode::Boot),
            "the review must be of the definition this host's manager was given"
        );
        assert!(
            !installed.review.account().justification().is_empty(),
            "a privileged account with no stated reason is an unreviewed one"
        );
    }

    // -----------------------------------------------------------------------
    // Uninstall deletes nothing else
    // -----------------------------------------------------------------------

    #[test]
    fn uninstall_leaves_configuration_sqlite_secrets_and_cache_exactly_as_they_were() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");

        // The files `05-infrastructure.md` says must survive. Written *after*
        // the install so that the snapshot below is of a host in the state an
        // operator's would be in.
        let config = host.paths.config_dir();
        std::fs::write(config.join("runner-manager.db"), b"sqlite fixture").expect("writable");
        std::fs::write(config.join("config.toml"), b"host_capacity = 2").expect("writable");
        std::fs::create_dir_all(host.paths.state_dir().join("packages/2.330.0")).expect("writable");
        std::fs::write(
            host.paths
                .state_dir()
                .join("packages/2.330.0/runner.tar.gz"),
            b"cached package",
        )
        .expect("writable");
        std::fs::create_dir_all(host.paths.state_dir().join("secrets")).expect("writable");
        std::fs::write(
            host.paths.state_dir().join("secrets/user-access-token"),
            b"a stand-in for the stored credential",
        )
        .expect("writable");
        std::fs::write(
            host.paths.logs_dir().join("runner-manager.log.2026-08-22"),
            b"diagnostics",
        )
        .expect("writable");

        let roots: Vec<PathBuf> = host
            .paths
            .all()
            .iter()
            .map(|(_, path)| (*path).to_path_buf())
            .collect();
        let roots: Vec<&Path> = roots.iter().map(PathBuf::as_path).collect();
        let before = snapshot(&roots);

        // Non-vacuity: a comparison of two empty maps would pass whatever
        // `uninstall` did.
        assert!(
            before.len() >= 6,
            "the fixture must actually contain the files this test is about, got {before:#?}"
        );
        let record_path = InstallRecord::path(&host.paths);
        assert!(
            before.contains_key(&record_path),
            "the install record must be present before uninstall"
        );

        let uninstalled = operations.uninstall().expect("an uninstall");
        assert!(uninstalled.removed_registration);
        assert!(uninstalled.removed_record);

        let after = snapshot(&roots);

        // Exactly one thing changed, and it is the registration's own record.
        let mut expected = before.clone();
        expected.remove(&record_path);
        assert_eq!(
            after, expected,
            "uninstall must remove its own record and nothing else"
        );
        assert!(
            !record_path.exists(),
            "the record itself must go, or `uninstall` did nothing at all"
        );
        assert!(
            uninstalled
                .preserved
                .iter()
                .all(|path| roots.contains(&path.as_path())),
            "the preserved list must name the four directories: {uninstalled}"
        );
    }

    #[test]
    fn uninstall_on_a_host_with_no_registration_is_not_a_failure() {
        let host = Host::new();
        let uninstalled = host.operations().uninstall().expect("a no-op uninstall");
        assert!(!uninstalled.removed_registration);
        assert!(!uninstalled.removed_record);
    }

    #[test]
    fn uninstall_removes_a_registration_even_when_the_record_is_gone() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        std::fs::remove_file(InstallRecord::path(&host.paths)).expect("the record is lost");

        let uninstalled = operations.uninstall().expect("an uninstall");
        assert!(
            uninstalled.removed_registration,
            "a lost record must not strand a registration"
        );
        assert!(host.controls.registrations().is_empty());
    }

    // -----------------------------------------------------------------------
    // Switching start mode
    // -----------------------------------------------------------------------

    #[test]
    fn switching_start_mode_reuses_the_recorded_path_and_re_resolves_nothing() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install at boot");

        // The discriminator. If the switch re-resolved the binary the way
        // `install` does, it would either fail here or silently record the test
        // binary instead. Removing the file makes the difference visible.
        std::fs::remove_file(&host.binary).expect("the installed binary goes away");

        let change = operations
            .set_start_mode(StartMode::Login)
            .expect("a switch that does not reinstall the product");
        assert!(change.changed);
        assert_eq!(change.from, StartMode::Boot);
        assert_eq!(change.to, StartMode::Login);
        assert_eq!(change.store_scope, crate::secrets::SecretScope::User);

        let record = InstallRecord::read(&host.paths)
            .expect("readable")
            .expect("a record");
        assert_eq!(record.start_mode, StartMode::Login);
        assert_eq!(
            record.binary, host.binary,
            "the recorded path must survive the switch untouched"
        );

        let registrations = host.controls.registrations();
        assert_eq!(registrations.len(), 1, "{registrations:?}");
        assert_eq!(registrations[0].0, StartMode::Login);
        assert!(
            registrations[0]
                .2
                .command_line
                .contains(&host.binary.to_string_lossy().into_owned()),
            "{:?}",
            registrations[0].2
        );
    }

    #[test]
    fn switching_start_mode_keeps_the_live_registration_when_target_install_fails() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install at boot");
        let record_before = std::fs::read(InstallRecord::path(&host.paths)).expect("the record");
        host.controls
            .fail_next_install(StartMode::Login, "injected target failure");

        let error = operations
            .set_start_mode(StartMode::Login)
            .expect_err("the target manager refuses the install");

        assert!(matches!(error, ServiceError::Control { .. }), "{error}");
        assert_eq!(
            std::fs::read(InstallRecord::path(&host.paths)).expect("the old record survives"),
            record_before
        );
        let registrations = host.controls.registrations();
        assert_eq!(registrations.len(), 1, "{registrations:?}");
        assert_eq!(registrations[0].0, StartMode::Boot);
    }

    #[test]
    fn switching_start_mode_rolls_back_target_when_record_persistence_fails() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install at boot");
        let record_before = std::fs::read(InstallRecord::path(&host.paths)).expect("the record");
        let config = host.paths.config_dir().to_path_buf();
        let hidden = config.with_file_name("config-hidden-by-fault");
        host.controls.hide_directory_after_install(
            StartMode::Login,
            config.clone(),
            hidden.clone(),
        );

        let error = operations
            .set_start_mode(StartMode::Login)
            .expect_err("the injected filesystem fault prevents persistence");

        std::fs::remove_file(&config).expect("remove the injected blocker");
        std::fs::rename(&hidden, &config).expect("restore the record directory");
        assert!(matches!(error, ServiceError::Record { .. }), "{error}");
        assert_eq!(
            std::fs::read(InstallRecord::path(&host.paths)).expect("the old record survives"),
            record_before
        );
        let registrations = host.controls.registrations();
        assert_eq!(registrations.len(), 1, "{registrations:?}");
        assert_eq!(registrations[0].0, StartMode::Boot);
        assert!(
            host.controls
                .calls()
                .iter()
                .any(|call| call == "uninstall runner-manager (login)"),
            "the target must be rolled back: {:?}",
            host.controls.calls()
        );
    }

    #[test]
    fn switching_to_the_mode_already_in_force_registers_nothing_again() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        let before = host.controls.calls().len();

        let change = operations
            .set_start_mode(StartMode::Boot)
            .expect("a no-op switch");
        assert!(!change.changed);
        assert_eq!(
            host.controls.calls().len(),
            before,
            "a no-op switch must not touch the service manager"
        );
    }

    #[test]
    fn switching_start_mode_on_a_host_with_no_registration_is_refused() {
        let host = Host::new();
        let error = host
            .operations()
            .set_start_mode(StartMode::Login)
            .expect_err("there is nothing to switch");
        assert!(
            matches!(error, ServiceError::NotInstalled { .. }),
            "{error}"
        );
    }

    // -----------------------------------------------------------------------
    // Status
    // -----------------------------------------------------------------------

    #[test]
    fn status_reports_the_four_facts_journey_five_asks_for() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        let at = DateTime::parse_from_rfc3339("2026-08-22T09:00:00Z")
            .expect("a valid timestamp")
            .with_timezone(&Utc);
        record_github_contact(&host.paths, at).expect("a heartbeat");

        let status = operations.status().expect("a status");
        assert_eq!(status.start_mode(), Some(StartMode::Boot));
        assert_eq!(
            status.binary().map(BinaryPath::recorded),
            Some(host.binary.as_path())
        );
        assert_eq!(status.log_file(), host.paths.logs_dir().join(LOG_FILE_STEM));
        assert_eq!(status.last_github_contact(), Some(at));
        assert!(status.is_installed());
        assert!(status.is_healthy(), "{status}");

        let printed = status.to_string();
        for fragment in [
            "start mode",
            "diagnostic log",
            "last GitHub contact",
            "binary",
        ] {
            assert!(printed.contains(fragment), "{printed}");
        }
    }

    /// A record this account may not read is reported, and `status` keeps
    /// going.
    ///
    /// It used to end the command with `Permission denied`, which is exactly
    /// what an operator met on a boot-mode host: `sudo service install` wrote
    /// the record `0600` and `root`-owned, and `service status` — a command
    /// that asks no privilege of anybody — then printed nothing at all about a
    /// registration the service manager could describe perfectly well.
    ///
    /// Ownership cannot be reproduced without privileges; the mode that made it
    /// fatal can.
    #[cfg(unix)]
    #[test]
    fn status_reports_a_record_it_may_not_read_and_still_reports_the_registration() {
        use std::os::unix::fs::PermissionsExt as _;

        // `root` is not subject to the mode bits and would read the record
        // regardless, leaving the assertions below testing nothing.
        // SAFETY: `geteuid` takes no argument and cannot fail.
        if unsafe { libc::geteuid() } == 0 {
            return;
        }

        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        assert!(
            operations.status().expect("a status").is_healthy(),
            "the discriminator: healthy before the record is made unreadable"
        );

        let record = InstallRecord::path(&host.paths);
        std::fs::set_permissions(&record, std::fs::Permissions::from_mode(0o000))
            .expect("the mode is applied");

        let status = operations
            .status()
            .expect("a record this account may not read is reported, not thrown");
        assert!(status.is_installed(), "{status}");
        assert!(!status.is_healthy(), "{status}");

        let printed = status.to_string();
        assert!(
            printed.contains("this account may not read it"),
            "the operator is told which of the two states this is: {printed}"
        );
        assert!(
            !printed.contains("there is no install record"),
            "a record that is there and unreadable is not a record that is missing, and the \
             missing one's remedy starts with `service uninstall`: {printed}"
        );

        // Left readable so the fixture's own cleanup is not the thing that
        // fails on a host where TempDir removal walks the tree.
        std::fs::set_permissions(&record, std::fs::Permissions::from_mode(0o644))
            .expect("the mode is restored");
    }

    #[test]
    fn status_reports_a_stale_binary_as_an_error_rather_than_appearing_healthy() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");

        // The discriminator: healthy first, so a `is_healthy` that always
        // returned false could not pass this test.
        assert!(
            operations.status().expect("a status").is_healthy(),
            "the freshly installed host must be healthy"
        );

        std::fs::remove_file(&host.binary).expect("the binary moves out from under the record");

        let status = operations.status().expect("a status");
        assert!(!status.is_healthy(), "{status}");
        assert!(
            status
                .problems()
                .iter()
                .any(|problem| problem.subject == "binary"),
            "{status}"
        );
        assert!(status.to_string().contains("STALE"), "{status}");
    }

    #[test]
    fn status_reports_a_registration_that_would_not_start_at_boot() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        assert!(operations.status().expect("a status").is_healthy());

        host.controls.edit("runner-manager", |registration| {
            registration.starts_automatically = false;
        });

        let status = operations.status().expect("a status");
        assert!(!status.is_healthy(), "{status}");
        assert!(
            status
                .problems()
                .iter()
                .any(|problem| problem.detail.contains("after a reboot")),
            "{status}"
        );
    }

    #[test]
    fn install_starts_the_registration_and_a_later_stop_is_unhealthy() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Login))
            .expect("install and immediate start");

        assert!(
            operations.status().expect("running status").is_running(),
            "install must not wait for the next login trigger"
        );
        operations.stop().expect("stop the registration");
        let status = operations.status().expect("stopped status");
        assert!(!status.is_healthy(), "{status}");
        assert!(
            status
                .problems()
                .iter()
                .any(|problem| problem.subject == "runtime"),
            "{status}"
        );
        let rendered = status.to_string();
        assert!(
            rendered.contains("runner-manager service install --start-at login"),
            "{rendered}"
        );
        assert!(
            !rendered.contains("runner-manager service start"),
            "{rendered}"
        );
    }

    #[test]
    fn status_reports_a_restart_policy_something_else_edited() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        assert!(operations.status().expect("a status").is_healthy());

        host.controls.edit("runner-manager", |registration| {
            registration.restart_delay = Some(Duration::from_secs(1));
        });

        let status = operations.status().expect("a status");
        assert!(!status.is_healthy(), "{status}");
        assert!(
            status
                .problems()
                .iter()
                .any(|problem| problem.subject == "restart policy"),
            "{status}"
        );
    }

    #[test]
    fn status_reports_a_registration_naming_a_binary_the_record_does_not() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        let other = host.binary.with_file_name("someone-elses.exe");
        std::fs::write(&other, b"x").expect("writable");

        host.controls.edit("runner-manager", |registration| {
            registration.command_line = quote_argument(&other.to_string_lossy());
        });

        let status = operations.status().expect("a status");
        assert!(!status.is_healthy(), "{status}");
        assert!(
            matches!(status.binary(), Some(BinaryPath::Diverged { .. })),
            "{status}"
        );
    }

    #[test]
    fn status_reports_a_record_no_service_manager_knows_about() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Boot))
            .expect("an install");
        // Something removed the registration behind this product's back.
        for mode in [StartMode::Boot, StartMode::Login] {
            host.controls
                .control(mode)
                .expect("a control")
                .uninstall(&ServiceIdentity::product())
                .expect("removed");
        }

        let status = operations.status().expect("a status");
        assert!(!status.is_healthy(), "{status}");
        assert!(
            status
                .problems()
                .iter()
                .any(|problem| problem.subject == "registration"),
            "{status}"
        );
    }

    #[test]
    fn status_on_a_host_with_nothing_installed_is_neither_healthy_nor_broken() {
        let host = Host::new();
        let status = host.operations().status().expect("a status");
        assert!(!status.is_installed());
        assert!(
            status.is_healthy(),
            "a host that never installed the service has no fault to report: {status}"
        );
        assert!(status.to_string().contains("installed"), "{status}");
    }

    #[test]
    fn status_says_a_login_registration_does_not_resume_after_an_unattended_reboot() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Login))
            .expect("an install at login");
        let status = operations.status().expect("a status");
        assert!(
            status
                .notes()
                .iter()
                .any(|note| note.contains("does not run until the operator signs in")),
            "05-infrastructure.md requires `service status` to say so: {status}"
        );
    }

    /// A Mac that signs its runner account in automatically does resume, and
    /// `service status` used to tell it otherwise.
    #[test]
    fn a_mac_with_automatic_login_as_the_service_account_resumes_after_a_reboot() {
        use crate::unattended_login::{AutoLogin, UnattendedLogin};
        let automatic = UnattendedLogin {
            auto_login: AutoLogin::As("ivan".into()),
            filevault_on: Some(false),
        };
        assert_eq!(
            unattended_gap(StartMode::Login, "ivan", Some(&automatic)),
            None
        );

        let off = UnattendedLogin {
            auto_login: AutoLogin::Off,
            filevault_on: Some(false),
        };
        let gap = unattended_gap(StartMode::Login, "ivan", Some(&off)).expect("a gap");
        assert!(gap.reason.contains("automatic login is off"), "{gap:?}");
        assert!(gap.reason.contains("Automatically log in as"), "{gap:?}");

        let locked = UnattendedLogin {
            auto_login: AutoLogin::As("ivan".into()),
            filevault_on: Some(true),
        };
        let gap = unattended_gap(StartMode::Boot, "root", Some(&locked)).expect("a gap");
        assert!(gap.reason.contains("FileVault is on"), "{gap:?}");

        // An unanswered probe is no gap: `host doctor` says what it could not
        // read.
        let unread = UnattendedLogin {
            auto_login: AutoLogin::As("ivan".into()),
            filevault_on: None,
        };
        assert_eq!(
            unattended_gap(StartMode::Login, "ivan", Some(&unread)),
            None
        );

        // Where nothing can be probed, a login registration still says so.
        let gap = unattended_gap(StartMode::Login, "ivan", None).expect("a gap");
        assert!(
            gap.reason
                .contains("does not run until the operator signs in")
        );
        assert_eq!(unattended_gap(StartMode::Boot, "root", None), None);
    }

    /// A daemon blocked in a file system call is still "running" to the
    /// service manager; its heartbeat is what says it is stuck.
    #[test]
    fn a_daemon_that_stopped_beating_makes_the_service_unhealthy() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Login))
            .expect("an install at login");
        let stalled_problem = |operations: &ServiceOperations| {
            operations
                .status()
                .expect("a status")
                .problems()
                .iter()
                .find(|problem| problem.subject == DAEMON_STALLED_SUBJECT)
                .map(|problem| problem.detail.clone())
        };
        crate::daemon_heartbeat::beat(&operations.paths, Utc::now()).unwrap();
        assert_eq!(stalled_problem(&operations), None, "beating");

        crate::daemon_heartbeat::beat(
            &operations.paths,
            Utc::now() - chrono::Duration::minutes(20),
        )
        .unwrap();
        let detail = stalled_problem(&operations).expect("a stall is a problem");
        assert!(detail.contains("has made no progress since"), "{detail}");
        // The restart is the service manager's command for this login-mode
        // registration: the product has no `service stop` or `service start`.
        let restart = ServiceIdentity::product().restart_command(StartMode::Login);
        assert!(detail.contains(&restart), "{detail}");
        assert!(!detail.contains("runner-manager service stop"), "{detail}");
        assert!(!detail.contains("runner-manager service start"), "{detail}");
    }

    /// Each platform's restart is its service manager's own command for the
    /// registration's start mode, never a `runner-manager service` subcommand
    /// that does not exist.
    #[test]
    fn the_restart_command_is_the_service_managers_own() {
        let identity = ServiceIdentity::product();
        let boot = identity.restart_command(StartMode::Boot);
        let login = identity.restart_command(StartMode::Login);
        for command in [&boot, &login] {
            assert!(!command.contains("runner-manager service"), "{command}");
            assert!(command.contains(identity.name()), "{command}");
        }
        assert_ne!(boot, login);
        if cfg!(windows) {
            assert!(
                boot.starts_with("Restart-Service -Name runner-manager"),
                "{boot}"
            );
            assert!(
                login.contains("schtasks /Run /TN runner-manager"),
                "{login}"
            );
        } else if cfg!(target_os = "macos") {
            assert!(
                boot.starts_with("sudo launchctl kickstart -k system/"),
                "{boot}"
            );
            assert!(login.starts_with("launchctl kickstart -k gui/"), "{login}");
        } else {
            assert_eq!(boot, "sudo systemctl restart runner-manager.service");
            assert_eq!(login, "systemctl --user restart runner-manager.service");
        }
    }

    /// A daemon refusing every runner is not a healthy service.
    #[test]
    fn a_daemon_that_finds_the_host_unfit_makes_the_service_unhealthy() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Login))
            .expect("an install at login");
        let paths = operations.paths.clone();
        crate::host_fitness::record_host_unfit(
            &paths,
            &[crate::host_fitness::UnfitFinding {
                id: "host.runner_root_responsive".into(),
                detail: "macOS has not let the service list /Volumes/NVME/runners".into(),
                remedy: Some("click Allow".into()),
            }],
            Utc::now(),
        )
        .unwrap();
        let status = operations.status().expect("a status");
        assert!(!status.is_healthy(), "{status}");
        let problem = status
            .problems()
            .iter()
            .find(|problem| problem.subject == HOST_UNFIT_SUBJECT)
            .expect("the refusal is a problem");
        assert!(
            problem.detail.contains("/Volumes/NVME/runners"),
            "{problem:?}"
        );
        assert!(problem.detail.contains("Fix: click Allow"), "{problem:?}");

        // A record nobody has re-stamped for a while is a stopped daemon's,
        // not a refusal in force.
        crate::host_fitness::clear_host_unfit(&paths).unwrap();
        crate::host_fitness::record_host_unfit(
            &paths,
            &[],
            Utc::now() - chrono::Duration::hours(2),
        )
        .unwrap();
        let status = operations.status().expect("a status");
        assert!(
            !status
                .problems()
                .iter()
                .any(|problem| problem.subject == HOST_UNFIT_SUBJECT),
            "{status}"
        );
    }

    // -----------------------------------------------------------------------
    // Start and stop
    // -----------------------------------------------------------------------

    #[test]
    fn start_and_stop_reach_the_domain_that_holds_the_registration() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&host.request(StartMode::Login))
            .expect("an install at login");
        operations.start().expect("a start");
        assert!(operations.status().expect("a status").is_running());
        assert!(operations.stop().expect("a stop"));
        assert!(!operations.status().expect("a status").is_running());
    }

    #[test]
    fn starting_a_host_with_no_registration_is_refused() {
        let host = Host::new();
        let error = host.operations().start().expect_err("nothing to start");
        assert!(
            matches!(error, ServiceError::NotInstalled { .. }),
            "{error}"
        );
    }

    // -----------------------------------------------------------------------
    // The seam with `d2`
    // -----------------------------------------------------------------------

    /// Requirement 2 is *"an account that can **read the secret store**"*, and
    /// on Windows what an account may read is decided by a DACL in a file this
    /// task does not own. Asserting the account name alone would be asserting
    /// this module against itself; this reads `d2`'s protection back off a real
    /// store and checks that it admits the account this installer registers.
    ///
    /// No privileges are needed. `d2` documents that a rooted machine-scoped
    /// store *"is protected and encrypted exactly as the standard one is"* —
    /// the Windows backend picks its DACL from the scope, not from the site —
    /// so a store in a temporary directory carries the access control the real
    /// one does.
    #[cfg(windows)]
    #[test]
    fn the_account_this_installer_registers_is_one_the_stores_own_dacl_admits() {
        use crate::secrets::{PlatformSecretStore, SecretScope, SecretStore as _};

        let root = tempfile::tempdir().expect("a temporary directory");
        let store = PlatformSecretStore::rooted_at(SecretScope::Machine, root.path())
            .expect("a rooted machine-scoped store");
        store
            .store(&secrecy::SecretString::from("a stand-in for the token"))
            .expect("the store accepts a value");
        let protection = store.protection().expect("the DACL can be read back");

        assert!(
            protection.description().contains(";;;SY)"),
            "the machine-scoped store must admit LocalSystem, or a boot-start service cannot \
             read the token. `d2` writes this DACL and it is not this task's to widen. Got: {}",
            protection.description()
        );
        assert_eq!(
            ServiceAccount::for_definition(DefinitionKind::WindowsService, StartMode::Boot),
            ServiceAccount::LocalSystem,
            "and that is the account this installer registers, which is why SY is what matters"
        );
        assert!(
            !protection.readable_by_other_local_users(),
            "the same DACL must still exclude ordinary local users: {}",
            protection.description()
        );

        // The other half of the analysis in `docs/service-account.md`, and the
        // reason LocalService and NetworkService are not used: the DACL names
        // three trustees and neither of them is among them.
        for rejected in [";;;LS)", ";;;NS)"] {
            assert!(
                !protection.description().contains(rejected),
                "if the store ever admitted {rejected}, the least-privilege analysis in \
                 docs/service-account.md would need redoing: {}",
                protection.description()
            );
        }
    }

    // -- another installation's service ---------------------------------------

    /// A request that records `host`'s own four directories on the command
    /// line, the way `service install` registers one.
    fn request_with_directories(host: &Host, mode: StartMode) -> InstallRequest {
        let mut arguments: Vec<OsString> = DAEMON_ARGUMENTS.iter().map(OsString::from).collect();
        arguments.extend(ServiceDirectories::of(&host.paths).arguments());
        host.request(mode).with_arguments(arguments)
    }

    /// The operations a second account on the same machine gets: its own
    /// directories, and the machine's one service manager.
    fn second_account(account: &Host, machine: &Host) -> ServiceOperations {
        ServiceOperations::with_controls(
            account.paths.clone(),
            ServiceIdentity::product(),
            std::sync::Arc::new(machine.controls.clone()),
        )
        .with_runner_root(account.runner_root.clone())
    }

    /// The owner's boot service, and a second account holding the record of
    /// an earlier login install of its own -- the layout an owner reported on
    /// a Windows host with two local accounts.
    fn a_machine_with_a_stale_second_account() -> (Host, Host) {
        let owner = Host::new();
        owner
            .operations()
            .install(&request_with_directories(&owner, StartMode::Boot))
            .expect("the owner's boot install");
        let earlier = Host::new();
        earlier
            .operations()
            .install(&request_with_directories(&earlier, StartMode::Login))
            .expect("the second account's earlier login install");
        assert!(
            InstallRecord::read(&earlier.paths).unwrap().is_some(),
            "the earlier install left its record behind"
        );
        (owner, earlier)
    }

    /// The advice that, followed from the second account, breaks or replaces
    /// the owner's healthy service.
    const DESTRUCTIVE_ADVICE: [&str; 4] = [
        "service uninstall",
        "service install`",
        "service install --",
        "auth login",
    ];

    #[test]
    fn a_service_installed_from_another_data_root_is_reported_as_that_installations() {
        let (owner, earlier) = a_machine_with_a_stale_second_account();

        let status = second_account(&earlier, &owner).status().expect("a status");

        let foreign = status.foreign().expect("the service is the owner's");
        assert_eq!(foreign.directories, ServiceDirectories::of(&owner.paths));
        assert_eq!(foreign.root, ServiceDirectories::of(&owner.paths).root());
        assert!(foreign.unreadable.is_none(), "{status}");
        assert!(
            status.is_healthy(),
            "the owner's service is healthy, and a stale record elsewhere is not its fault: \
             {status}"
        );
        for subject in [
            "binary",
            "start mode",
            "secret store",
            "record",
            "registration",
        ] {
            assert!(
                !status
                    .problems()
                    .iter()
                    .any(|problem| problem.subject == subject),
                "{subject} compared the second account's record against the owner's \
                 registration: {status}"
            );
        }
        let rendered = status.to_string();
        for advice in DESTRUCTIVE_ADVICE {
            assert!(!rendered.contains(advice), "{advice}: {rendered}");
        }
        assert!(rendered.contains("another installation's"), "{rendered}");
        assert!(
            status
                .notes()
                .iter()
                .any(|note| note.contains("unused local configuration")
                    && note.contains("host forget-local")),
            "{status}"
        );
        // What the owner recorded, not what the second account did.
        assert_eq!(status.start_mode(), Some(StartMode::Boot));
    }

    #[test]
    fn a_foreign_service_whose_records_cannot_be_read_reports_only_what_the_manager_says() {
        let (owner, earlier) = a_machine_with_a_stale_second_account();
        // Stands in for a profile this account may not open: there is nothing
        // to read where the registration points.
        InstallRecord::remove(&owner.paths).expect("the owner's record removed");

        let operations = second_account(&earlier, &owner);
        let status = operations.status().expect("a status");
        let foreign = status.foreign().expect("the service is the owner's");
        assert!(foreign.unreadable.is_some(), "{status}");
        assert!(
            status.is_healthy(),
            "running, and nothing it could judge: {status}"
        );
        let rendered = status.to_string();
        for advice in DESTRUCTIVE_ADVICE {
            assert!(!rendered.contains(advice), "{advice}: {rendered}");
        }
        assert!(rendered.contains("running; installed from"), "{rendered}");
        assert!(!rendered.contains("last GitHub contact"), "{rendered}");

        // Stopped, it is a problem -- with a place to look, not a reinstall.
        owner.operations().stop().expect("stopped");
        let stopped = operations.status().expect("a status");
        assert!(!stopped.is_healthy(), "{stopped}");
        let rendered = stopped.to_string();
        for advice in DESTRUCTIVE_ADVICE {
            assert!(!rendered.contains(advice), "{advice}: {rendered}");
        }
    }

    #[test]
    fn this_accounts_own_registration_still_reports_every_mismatch() {
        let host = Host::new();
        let operations = host.operations();
        operations
            .install(&request_with_directories(&host, StartMode::Boot))
            .expect("an install");
        let other = host.binary.with_file_name("someone-elses");
        std::fs::write(&other, b"x").expect("writable");
        // Something edited the registration, keeping its directories.
        host.controls.edit("runner-manager", |registration| {
            let mut arguments = split_command_line(&registration.command_line);
            arguments[0] = other.to_string_lossy().into_owned();
            registration.command_line = arguments
                .iter()
                .map(|argument| quote_argument(argument))
                .collect::<Vec<_>>()
                .join(" ");
            registration.start_mode = StartMode::Login;
        });

        let status = operations.status().expect("a status");
        assert!(status.foreign().is_none(), "{status}");
        assert!(
            matches!(status.binary(), Some(BinaryPath::Diverged { .. })),
            "{status}"
        );
        assert!(
            status
                .problems()
                .iter()
                .any(|problem| problem.subject == "start mode"),
            "{status}"
        );
        assert!(status.to_string().contains("service uninstall"), "{status}");
    }

    #[test]
    fn directories_read_back_from_a_command_line_with_spaces() {
        let root = Path::new("/Users/someone/Library/Application Support/runner manager");
        let directories = ServiceDirectories {
            config: root.join("config"),
            state: root.join("data").join("state"),
            runtime: root.join("data").join("runtime"),
            logs: root.join("data").join("logs"),
        };
        let mut command_line = quote_argument("/usr/local/bin/runner-manager");
        for argument in ["daemon", "run"]
            .map(OsString::from)
            .into_iter()
            .chain(directories.arguments())
        {
            command_line.push(' ');
            command_line.push_str(&quote_argument(&argument.to_string_lossy()));
        }
        assert_eq!(
            ServiceDirectories::from_command_line(&command_line),
            Some(directories.clone())
        );
        assert_eq!(directories.root(), root);
        assert_eq!(
            ServiceDirectories::from_command_line("runner-manager daemon run"),
            None,
            "a registration that names no directories cannot be judged foreign"
        );
    }

    #[test]
    fn the_owner_of_a_data_root_is_read_from_its_path() {
        let users = Path::new(if cfg!(windows) { r"C:\Users" } else { "/home" });
        let home = users.join("ivand");
        assert_eq!(
            data_root_owner(&users.join("yuriv").join("data"), Some(&home)).as_deref(),
            Some("yuriv")
        );
        assert_eq!(
            data_root_owner(
                Path::new(if cfg!(windows) { r"D:\rm" } else { "/opt/rm" }),
                Some(&home)
            ),
            None
        );
        if cfg!(windows) {
            assert_eq!(
                data_root_owner(
                    Path::new(r"C:\Windows\System32\config\systemprofile\AppData"),
                    Some(&home)
                )
                .as_deref(),
                Some("LocalSystem")
            );
        } else {
            assert_eq!(
                data_root_owner(Path::new("/root/.config/runner-manager"), Some(&home)).as_deref(),
                Some("root")
            );
        }
    }

    #[test]
    fn forget_local_archives_the_unused_record_and_never_touches_the_service_root() {
        let (owner, earlier) = a_machine_with_a_stale_second_account();
        let owner_before = snapshot(&[owner._root.path()]);
        let config = earlier.paths.config_dir().to_path_buf();
        let record = std::fs::read(InstallRecord::path(&earlier.paths)).unwrap();

        let forgotten = second_account(&earlier, &owner)
            .forget_local(Utc::now())
            .expect("archived");

        assert_eq!(
            snapshot(&[owner._root.path()]),
            owner_before,
            "the owner's directories must not change by one byte"
        );
        let archive = forgotten.archive.expect("something was archived");
        assert!(archive.starts_with(&config), "{}", archive.display());
        assert_eq!(
            std::fs::read(archive.join(RECORD_FILE)).unwrap(),
            record,
            "moved, not rewritten or deleted"
        );
        assert!(InstallRecord::read(&earlier.paths).unwrap().is_none());
        assert_eq!(
            forgotten.service_root,
            Some(ServiceDirectories::of(&owner.paths).root())
        );
        // Afterwards the second account's status has no unused record to note.
        let status = second_account(&earlier, &owner).status().expect("status");
        assert!(
            !status
                .notes()
                .iter()
                .any(|note| note.contains("unused local configuration")),
            "{status}"
        );
    }

    #[test]
    fn forget_local_refuses_a_configuration_a_service_runs_against() {
        let (owner, earlier) = a_machine_with_a_stale_second_account();
        let before = snapshot(&[owner._root.path()]);
        let refused = owner.operations().forget_local(Utc::now());
        assert!(
            matches!(refused, Err(ServiceError::LocalConfigurationInUse { .. })),
            "{refused:?}"
        );
        assert_eq!(snapshot(&[owner._root.path()]), before);

        // Nor while an agent holds the second account's own lock.
        let _agent = HostLock::try_acquire(&earlier.paths, LockKind::SingleInstance)
            .expect("the agent's lock");
        let refused = second_account(&earlier, &owner).forget_local(Utc::now());
        assert!(
            matches!(refused, Err(ServiceError::LocalConfigurationInUse { .. })),
            "{refused:?}"
        );
        assert!(InstallRecord::read(&earlier.paths).unwrap().is_some());
    }

    #[test]
    fn a_readable_foreign_service_keeps_its_diagnoses_and_loses_its_remedies() {
        let (owner, earlier) = a_machine_with_a_stale_second_account();
        // The owner's service has every problem whose remedy acts on the
        // directories of whoever runs it.
        owner.operations().stop().expect("stopped");
        record_github_credential_rejected(&owner.paths, Utc::now()).expect("rejected");
        record_credential_unreadable(&owner.paths, Utc::now()).expect("unreadable");

        let status = second_account(&earlier, &owner).status().expect("a status");
        assert!(status.foreign().is_some_and(|foreign| !foreign.is_unread()));
        let subjects: Vec<_> = status.problems().iter().map(|p| p.subject).collect();
        for subject in [
            "runtime",
            "github credential",
            CREDENTIAL_UNREADABLE_SUBJECT,
        ] {
            assert!(subjects.contains(&subject), "{subject}: {status}");
        }
        let rendered = status.to_string();
        for advice in DESTRUCTIVE_ADVICE {
            assert!(!rendered.contains(advice), "{advice}: {rendered}");
        }
        for problem in status.problems() {
            assert!(problem.detail.contains("Act on it"), "{problem}");
        }
    }

    #[test]
    fn no_command_of_this_account_changes_another_installations_service() {
        let (owner, earlier) = a_machine_with_a_stale_second_account();
        let operations = second_account(&earlier, &owner);
        let foreign = |result: Result<(), ServiceError>| {
            assert!(
                matches!(result, Err(ServiceError::ForeignInstallation { .. })),
                "{result:?}"
            );
        };
        foreign(
            operations
                .install(&request_with_directories(&earlier, StartMode::Boot))
                .map(drop),
        );
        foreign(operations.uninstall().map(drop));
        foreign(operations.set_start_mode(StartMode::Boot).map(drop));
        foreign(operations.start());
        foreign(operations.stop().map(drop));

        let registration = owner
            .controls
            .control(StartMode::Boot)
            .unwrap()
            .query(&ServiceIdentity::product())
            .unwrap()
            .expect("the owner's registration is still there");
        assert_eq!(
            ServiceDirectories::from_command_line(&registration.command_line),
            Some(ServiceDirectories::of(&owner.paths)),
            "and still runs against the owner's directories"
        );
        assert!(registration.running, "and was never stopped");
        assert!(
            InstallRecord::read(&earlier.paths).unwrap().is_some(),
            "the refused uninstall kept this account's record"
        );
    }

    #[test]
    fn forget_local_leaves_agent_directories_nested_in_the_configuration_alone() {
        // macOS puts state, runtime and logs inside the configuration
        // directory: `config_local_dir` and `data_local_dir` are one folder.
        let root = tempfile::tempdir().unwrap();
        let config = root.path().join("Application Support");
        let paths = AppPaths::from_directories(
            &config,
            config.join("state"),
            config.join("runtime"),
            config.join("logs"),
        );
        paths.create_all().unwrap();
        std::fs::write(config.join(RECORD_FILE), b"an earlier install").unwrap();
        std::fs::write(paths.logs_dir().join("runner-manager.log"), b"log").unwrap();
        let operations = ServiceOperations::with_controls(
            paths.clone(),
            ServiceIdentity::product(),
            std::sync::Arc::new(RecordingControls::new()),
        );

        let forgotten = operations.forget_local(Utc::now()).expect("archived");

        assert_eq!(forgotten.moved, vec![config.join(RECORD_FILE)]);
        for kept in [paths.state_dir(), paths.runtime_dir(), paths.logs_dir()] {
            assert!(kept.is_dir(), "{} was moved", kept.display());
        }
        assert!(paths.logs_dir().join("runner-manager.log").is_file());
    }

    #[test]
    fn a_remedy_is_cut_from_every_detail_a_builder_writes() {
        for (detail, diagnosis) in [
            (
                "x holds an automatic registration, but the daemon is stopped. Run `runner-manager \
                 service install --start-at boot`; if the service manager denies replacement",
                "x holds an automatic registration, but the daemon is stopped",
            ),
            (
                "store -- MISMATCH. Run `auth login` again so the token is stored",
                "store -- MISMATCH",
            ),
            (
                "unit differs, so the daemon runs under outdated settings. Re-register it with \
                 `sudo runner-manager service install --start-at boot`",
                "unit differs, so the daemon runs under outdated settings",
            ),
            (
                "it starts no runner; the log has it. Sign in again: `runner-manager auth login`",
                "it starts no runner; the log has it",
            ),
            (
                "C:\\a\\runner-manager.exe -- STALE: moved. Run `service uninstall` and `service \
                 install`",
                "C:\\a\\runner-manager.exe -- STALE: moved",
            ),
            (
                "a new builder: run `runner-manager service install` here, or not",
                "the installation's own records report this",
            ),
        ] {
            assert_eq!(diagnosis_only(detail), diagnosis, "{detail}");
        }
    }
}