const { execFile } = require("node:child_process");
const { createHash } = require("node:crypto");
const { chmod, mkdtemp, mkdir, rm, symlink, writeFile, readFile } = require("node:fs/promises");
const os = require("node:os");
const path = require("node:path");
const { pathToFileURL } = require("node:url");
const { promisify } = require("node:util");

const execFileAsync = promisify(execFile);
const ROOT_DIR = path.resolve(__dirname, "../../../..");
const PREFLIGHT = path.join(ROOT_DIR, "deploy/trialrun/preflight-remote.sh");
const AGGREGATE_PREFLIGHT = path.join(ROOT_DIR, "deploy/trialrun/check-existing-deployment.sh");
const REFRESH_HELPER = path.join(ROOT_DIR, "scripts/refresh-deployment-contract.sh");
const REFRESH_INSTALLER = path.join(ROOT_DIR, "deploy/trialrun/install-deployment-contract-refresh.sh");
const PRODUCTION_PREFLIGHT = path.join(ROOT_DIR, "deploy/trialrun/production-preflight.mjs");
const PRODUCTION_PREFLIGHT_REMOTE = path.join(ROOT_DIR, "deploy/trialrun/production-preflight-remote.sh");
const PRODUCTION_IDENTITY_BOOTSTRAP = path.join(ROOT_DIR, "deploy/trialrun/production-identity-bootstrap.mjs");
const PRODUCTION_IDENTITY_BOOTSTRAP_REMOTE = path.join(ROOT_DIR, "deploy/trialrun/production-identity-bootstrap-remote.sh");

describe("deployment safety contract", () => {
  let fixtureRoot;
  let remoteDir;
  let envFile;
  let postgresDir;
  let storageDir;

  beforeEach(async () => {
    fixtureRoot = await mkdtemp(path.join(os.tmpdir(), "hyb-oa-deploy-safety-"));
    remoteDir = path.join(fixtureRoot, "app");
    envFile = path.join(remoteDir, "deploy/trialrun/.env");
    postgresDir = path.join(fixtureRoot, "postgres");
    storageDir = path.join(fixtureRoot, "storage");
    await mkdir(path.join(remoteDir, "server"), { recursive: true });
    await mkdir(path.join(remoteDir, "deploy/trialrun"), { recursive: true });
    await mkdir(postgresDir, { recursive: true });
    await mkdir(storageDir, { recursive: true });
    await writeFile(path.join(remoteDir, "server/package.json"), "{}\n");
    await writeFile(path.join(remoteDir, "deploy/trialrun/docker-compose.yml"), "services: {}\n");
    await writeFile(envFile, "APP_ORIGIN=https://example.invalid\n", { mode: 0o600 });
    await writeFile(path.join(postgresDir, "PG_VERSION"), "16\n");
  });

  afterEach(async () => {
    await rm(fixtureRoot, { recursive: true, force: true });
  });

  function preflight(overrides = {}) {
    return execFileAsync("bash", [PREFLIGHT], {
      env: {
        ...process.env,
        REMOTE_DIR: remoteDir,
        REMOTE_ENV_FILE: envFile,
        COMPOSE_FILE: "deploy/trialrun/docker-compose.yml",
        POSTGRES_DATA_DIR: postgresDir,
        STORAGE_HOST_DIR: storageDir,
        DEPLOY_DATA_MODE: "existing",
        SYNC_ENV: "0",
        ...overrides,
      },
    });
  }

  it("accepts a complete existing deployment contract", async () => {
    await expect(preflight()).resolves.toMatchObject({ stdout: expect.stringContaining("[remote-preflight][PASS]") });
  });

  it("rejects a config directory masquerading as the repository root", async () => {
    await expect(preflight({ REMOTE_DIR: path.join(remoteDir, "deploy/trialrun") })).rejects.toMatchObject({ code: 1 });
  });

  it("rejects a missing or symbolic remote env before synchronization", async () => {
    await rm(envFile);
    await expect(preflight()).rejects.toMatchObject({ code: 1 });
    await symlink(path.join(remoteDir, "missing.env"), envFile);
    await expect(preflight()).rejects.toMatchObject({ code: 1 });
  });

  it("rejects invalid existing data directories", async () => {
    await rm(path.join(postgresDir, "PG_VERSION"));
    await expect(preflight()).rejects.toMatchObject({ code: 1 });
  });

  it("runs remote preflight before rsync and reads existing contracts from systemd", async () => {
    const deploy = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "deploy/trialrun/deploy.sh"), "utf8");
    const wrapper = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "deploy/trialrun/deploy-existing.sh"), "utf8");
    expect(deploy.indexOf("REMOTE_PREFLIGHT_SCRIPT")).toBeGreaterThanOrEqual(0);
    expect(deploy.indexOf('>>> 3. 同步前只读校验远端部署合同')).toBeLessThan(deploy.indexOf("rsync -az --delete"));
    expect(deploy.indexOf('>>> 3. 同步前只读校验远端部署合同')).toBeLessThan(deploy.indexOf("mkdir -p '${REMOTE_DIR}'"));
    expect(wrapper).toContain("check-existing-deployment.sh");
    expect(wrapper.indexOf("check-existing-deployment.sh")).toBeLessThan(wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"'));
    expect(wrapper).not.toContain("docker inspect");
    expect(wrapper).not.toContain("working_dir");
    expect(wrapper).toContain("DEPLOY_DATA_MODE=existing");
    expect(wrapper).toContain("SYNC_ENV=0");
    expect(wrapper).toContain("DEPLOY_DEFER_FINAL_SUCCESS=1");
    expect(wrapper).toContain("DEPLOY_STATUS_OUTPUT_MODE=quiet");
    expect(deploy).toContain("DEPLOY_STATUS_OUTPUT_MODE");
    expect(deploy).toContain("DEPLOY_STATUS_OUTPUT_MODE='${DEPLOY_STATUS_OUTPUT_MODE}'");
    expect(wrapper).toContain("生产部署验证不接受未进入上游的提交");
    expect(wrapper).toContain("部署后 migration status 与目标只读复核");
    expect(wrapper).toContain('EXPECTED_PENDING_MIGRATIONS=""');
    expect(wrapper.indexOf('EXPECTED_PENDING_MIGRATIONS=""')).toBeGreaterThan(
      wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"'),
    );
    expect(wrapper.indexOf('ssh "$DEPLOY_REFRESH_SERVER" refresh')).toBeGreaterThan(wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"'));
    expect(wrapper).toContain("DEPLOYED_BUT_CONTRACT_REFRESH_FAILED");
  });

  it("requires production target identity and pending migration allowlist before deploy.sh", async () => {
    const wrapper = await readFile(path.join(ROOT_DIR, "deploy/trialrun/deploy-existing.sh"), "utf8");
    const preflight = await readFile(PRODUCTION_PREFLIGHT, "utf8");
    const remote = await readFile(PRODUCTION_PREFLIGHT_REMOTE, "utf8");
    const bootstrap = await readFile(PRODUCTION_IDENTITY_BOOTSTRAP, "utf8");

    expect(wrapper).toContain("EXPECTED_PRODUCTION_ORIGIN");
    expect(wrapper).toContain("EXPECTED_PRODUCTION_DB_NAME_SHA256");
    expect(wrapper).toContain("EXPECTED_PENDING_MIGRATIONS");
    expect(wrapper).toContain("EXPECTED_DEPLOY_SERVER");
    expect(wrapper).toContain("EXPECTED_REMOTE_DIR");
    expect(wrapper).toContain("EXPECTED_COMPOSE_PROJECT_NAME");
    expect(wrapper).toContain("PRODUCTION_READ_ONLY_PREFLIGHT");
    expect(wrapper.indexOf('node "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT"')).toBeLessThan(
      wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"'),
    );
    expect(wrapper.indexOf('if [[ "${PRODUCTION_READ_ONLY_PREFLIGHT:-0}" == "1" ]]')).toBeLessThan(
      wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"'),
    );
    expect(preflight).toContain("CANDIDATE_MIGRATIONS_CSV");
    expect(preflight).toContain("PRISMA_STATUS_OUTPUT_MISSING");
    expect(preflight).toContain("PRISMA_STATUS_OUTPUT_UNREADABLE");
    expect(preflight).toContain("CANDIDATE_COMMIT_MISSING");
    expect(preflight).not.toContain("rev-parse");
    expect(preflight).toContain("redacted datasource line");
    expect(preflight).toContain("PRODUCTION_PREFLIGHT_REPORT_NOT_FRESH");
    expect(preflight.lastIndexOf("printStableRemoteSummary(stdout)")).toBeLessThan(
      preflight.lastIndexOf("assertRemotePreflightResult({"),
    );
    expect(preflight.indexOf("reportRef=${reportRef(reportDir)}")).toBeLessThan(
      preflight.lastIndexOf("assertRemotePreflightResult({"),
    );
    expect(remote).toContain("PRISMA_STATUS_BEGIN");
    expect(remote).toContain("PROD_MIGRATION_STATUS_UNKNOWN_PENDING");
    expect(remote).toContain("logged_failure");
    expect(remote).toContain("PROD_DATABASE_URL_HOST_NON_PRODUCTION_IDENTITY");
    expect(remote).toContain("PROD_TARGET_BUILD_SHA_MISMATCH");
    expect(remote).toContain('FROM "_prisma_migrations"');
    expect(remote).toContain("rollbackWindow=OPEN");
    expect(remote).not.toMatch(/\b(prisma migrate reset|prisma db push|prisma migrate resolve)\b/);
    expect(remote.indexOf("PRISMA_STATUS_BEGIN")).toBeLessThan(remote.indexOf("_prisma_migrations"));
    expect(bootstrap.indexOf("assertContractForOriginVerification")).toBeLessThan(
      bootstrap.indexOf("verifyOriginIdentity(identity, contract, expectedOrigin);"),
    );
    expect(bootstrap.indexOf("verifyOriginIdentity(identity, contract, expectedOrigin);")).toBeLessThan(
      bootstrap.indexOf("const expectedRemoteDir = contract.REMOTE_DIR"),
    );
    expect(bootstrap.indexOf("const expectedRemoteDir = contract.REMOTE_DIR")).toBeLessThan(
      bootstrap.indexOf("const databaseIdentityHash = bootstrapDatabaseIdentityHash"),
    );
    expect(bootstrap.indexOf('if (identityOnly === "1")')).toBeLessThan(
      bootstrap.indexOf("const databaseIdentityHash = bootstrapDatabaseIdentityHash"),
    );
    expect(bootstrap.indexOf("const databaseIdentityHash = bootstrapDatabaseIdentityHash")).toBeLessThan(
      bootstrap.indexOf("spawnSync(\"bash\", [DEPLOY_EXISTING_SCRIPT]"),
    );
  });

  it("rejects loopback/staging production identities without invoking SSH", async () => {
    const target = await import(pathToFileURL(PRODUCTION_PREFLIGHT).href);
    expect(() => target.validateProductionOrigin("https://127.0.0.1")).toThrowError(
      expect.objectContaining({ code: "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY" }),
    );
    expect(() => target.validateProductionOrigin("https://staging.example.com")).toThrowError(
      expect.objectContaining({ code: "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY" }),
    );
    expect(() => target.validateProductionOrigin("https://0.0.0.0")).toThrowError(
      expect.objectContaining({ code: "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY" }),
    );
    expect(() => target.validateProductionOrigin("https://[::ffff:127.0.0.1]")).toThrowError(
      expect.objectContaining({ code: "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY" }),
    );
    expect(() => target.validateProductionDbName("hyb_oa_regression")).toThrowError(
      expect.objectContaining({ code: "PROD_TARGET_DB_NON_PRODUCTION_IDENTITY" }),
    );
    expect(() => target.validateExactProductionIdentity({
      deployServer: "deploy.production.invalid",
      remoteDir: "/srv/hyb-oa-trialrun",
      composeProjectName: "hyb-oa-trialrun",
      expectedDeployServer: "deploy.production.invalid",
      expectedRemoteDir: "/srv/hyb-oa-trialrun",
      expectedComposeProjectName: "hyb-oa-trialrun",
    })).not.toThrow();
    expect(() => target.validateExactProductionIdentity({
      deployServer: "deploy.production.invalid",
      remoteDir: "/srv/hyb-oa-trialrun",
      composeProjectName: "hyb-oa-trialrun",
      expectedDeployServer: "deploy.production.invalid",
      expectedRemoteDir: "/srv/different",
      expectedComposeProjectName: "hyb-oa-trialrun",
    })).toThrowError(expect.objectContaining({ code: "REMOTE_DIR_MISMATCH" }));
    expect(() => target.validateExactProductionIdentity({
      deployServer: "deploy.production.invalid",
      remoteDir: "/srv/hyb-oa-trialrun",
      composeProjectName: "hyb-oa-trialrun",
      expectedDeployServer: "different.production.invalid",
      expectedRemoteDir: "/srv/hyb-oa-trialrun",
      expectedComposeProjectName: "hyb-oa-trialrun",
    })).toThrowError(expect.objectContaining({ code: "DEPLOY_SERVER_MISMATCH" }));
    expect(() => target.validateExactProductionIdentity({
      deployServer: "deploy.production.invalid",
      remoteDir: "/srv/hyb-oa-trialrun",
      composeProjectName: "hyb-oa-trialrun",
      expectedDeployServer: "deploy.production.invalid",
      expectedRemoteDir: "/srv/hyb-oa-trialrun",
      expectedComposeProjectName: "different",
    })).toThrowError(expect.objectContaining({ code: "COMPOSE_PROJECT_NAME_MISMATCH" }));
    expect(() => target.validateExactProductionIdentity({
      deployServer: "deploy.production.invalid",
      remoteDir: "/srv/hyb-oa-trialrun",
      composeProjectName: "hyb-oa-trialrun",
      expectedDeployServer: "deploy.production.invalid",
      expectedRemoteDir: "/srv/hyb-oa-trialrun",
    })).toThrowError(expect.objectContaining({ code: "EXPECTED_COMPOSE_PROJECT_NAME_MISSING" }));
    expect(() => target.validateExactProductionIdentity({
      deployServer: "deploy.staging.invalid",
      remoteDir: "/srv/hyb-oa-trialrun",
      composeProjectName: "hyb-oa-trialrun",
      expectedDeployServer: "deploy.staging.invalid",
      expectedRemoteDir: "/srv/hyb-oa-trialrun",
      expectedComposeProjectName: "hyb-oa-trialrun",
    })).toThrowError(expect.objectContaining({ code: "DEPLOY_SERVER_NON_PRODUCTION_IDENTITY" }));
    expect(() => target.validatePrismaStatusText("")).toThrowError(
      expect.objectContaining({ code: "PRISMA_STATUS_OUTPUT_UNREADABLE" }),
    );
    expect(() => target.validatePrismaStatusText("unexpected output")).toThrowError(
      expect.objectContaining({ code: "PRISMA_STATUS_OUTPUT_UNREADABLE" }),
    );
  });

  it.each([
    {
      name: "prefers a remote safety code when the marker is missing",
      status: 1,
      stdout: "",
      stderr: "[production-preflight][PAUSED] code=PROD_DATABASE_IDENTITY_MISMATCH",
      rawStatus: null,
      expectedCode: "PROD_DATABASE_IDENTITY_MISMATCH",
    },
    {
      name: "prefers a remote safety code when the marker exists",
      status: 1,
      stdout: "[production-preflight][PAUSED] code=PROD_MIGRATION_STATUS_FAILED",
      stderr: "",
      rawStatus: "Database schema is up to date!",
      expectedCode: "PROD_MIGRATION_STATUS_FAILED",
    },
    {
      name: "fails closed when a remote failure has no parseable code",
      status: 1,
      stdout: "remote command failed",
      stderr: "ssh exited unexpectedly",
      rawStatus: null,
      expectedCode: "PRODUCTION_PREFLIGHT_REMOTE_FAILED",
    },
    {
      name: "requires the Prisma marker after a successful remote exit",
      status: 0,
      stdout: "[production-preflight][PASS] target_identity",
      stderr: "",
      rawStatus: null,
      expectedCode: "PRISMA_STATUS_OUTPUT_MISSING",
    },
  ])("$name", async ({ status, stdout, stderr, rawStatus, expectedCode }) => {
    const target = await import(pathToFileURL(PRODUCTION_PREFLIGHT).href);
    expect(() => target.assertRemotePreflightResult({ status, stdout, stderr, rawStatus })).toThrowError(
      expect.objectContaining({ code: expectedCode }),
    );
  });

  it("captures a redacted pre-status evidence copy from a controlled SSH fixture", async () => {
    const fakeBin = path.join(fixtureRoot, "bin");
    const reportDir = path.join(fixtureRoot, "report");
    const sshCapture = path.join(fixtureRoot, "ssh-command.txt");
    await mkdir(fakeBin, { recursive: true });
    await mkdir(reportDir, { recursive: true });
    await writeFile(path.join(reportDir, "prisma-migrate-status.txt"), "stale PASS\n");
    const fakeSsh = path.join(fakeBin, "ssh");
    await writeFile(
      fakeSsh,
      [
        "#!/usr/bin/env node",
        "require('node:fs').writeFileSync(process.env.FAKE_SSH_CAPTURE, process.argv.slice(2).join(' '));",
        "process.stdout.write('[production-preflight][PASS] target_identity\\n');",
        "process.stdout.write('[production-preflight][PRISMA_STATUS_BEGIN]\\n');",
        "process.stdout.write('Datasource \\\"db\\\": PostgreSQL database \\\"hyb_oa\\\" at \\\"db.internal:5432\\\"\\n');",
        "process.stdout.write('Database schema is up to date!\\n');",
        "process.stdout.write('[production-preflight][PRISMA_STATUS_END] exit=0\\n');",
        "process.stdout.write('[production-preflight][PASS] migration_reconciliation pending=none\\n');",
        "process.stdout.write('[production-preflight][PASS] rollbackWindow=OPEN terminatedRows=0\\n');",
      ].join("\n"),
      { mode: 0o700 },
    );
    await chmod(fakeSsh, 0o700);

    const candidateCommit = require("node:child_process")
      .execFileSync("git", ["rev-parse", "HEAD"], { cwd: ROOT_DIR, encoding: "utf8" })
      .trim();
    const result = await execFileAsync("node", [PRODUCTION_PREFLIGHT], {
      cwd: ROOT_DIR,
      env: {
        ...process.env,
        PATH: `${fakeBin}${path.delimiter}${process.env.PATH}`,
        DEPLOY_SERVER: "deploy.production.invalid",
        REMOTE_DIR: remoteDir,
        REMOTE_ENV_FILE: envFile,
        COMPOSE_FILE: "deploy/trialrun/docker-compose.yml",
        COMPOSE_PROJECT_NAME: "hyb-oa-trialrun",
        POSTGRES_DATA_DIR: postgresDir,
        STORAGE_HOST_DIR: storageDir,
        EXPECTED_PRODUCTION_ORIGIN: "https://oa.hyinda.com",
        EXPECTED_PRODUCTION_DB_NAME_SHA256: createHash("sha256").update("hyb_oa", "utf8").digest("hex"),
        EXPECTED_PENDING_MIGRATIONS: "",
        EXPECTED_DEPLOY_SERVER: "deploy.production.invalid",
        EXPECTED_REMOTE_DIR: remoteDir,
        EXPECTED_COMPOSE_PROJECT_NAME: "hyb-oa-trialrun",
        CANDIDATE_COMMIT: candidateCommit,
        PRODUCTION_PREFLIGHT_REPORT_DIR: reportDir,
        FAKE_SSH_CAPTURE: sshCapture,
      },
    });
    const statusEvidence = await readFile(path.join(reportDir, "prisma-migrate-status.txt"), "utf8");
    const sshCommand = await readFile(sshCapture, "utf8");
    expect(result.stdout).toContain("[production-preflight][PASS]");
    expect(statusEvidence).toContain("Database schema is up to date!");
    expect(statusEvidence).toContain("[redacted datasource line]");
    expect(statusEvidence).not.toContain("hyb_oa");
    expect(statusEvidence).not.toContain("db.internal:5432");
    expect(result.stdout).not.toContain("oa.hyinda.com");
    expect(result.stdout).not.toContain("hyb_oa");
    expect(sshCommand).not.toContain("oa.hyinda.com");
    expect(sshCommand).not.toContain("hyb_oa");
    expect(sshCommand).toContain("EXPECTED_PRODUCTION_ORIGIN_SHA256");
    expect(sshCommand).toContain("EXPECTED_PRODUCTION_DB_NAME_SHA256");
    expect(sshCommand).toContain(`BUILD_SHA='${candidateCommit}'`);
    expect(sshCommand).toContain(`VITE_BUILD_SHA='${candidateCommit.slice(0, 12)}'`);
  });

  it("bootstraps only an exact historical identity and a unique refresh probe", async () => {
    const bootstrap = await import(pathToFileURL(PRODUCTION_IDENTITY_BOOTSTRAP).href);
    const historicalTarget = [
      'DEPLOY_SERVER="${DEPLOY_SERVER:-deploy.production.invalid}"',
      'REMOTE_DIR="${REMOTE_DIR:-/srv/hyb-oa-trialrun}"',
    ].join("\n");
    const historicalProject = [
      'REMOTE_DIR="${REMOTE_DIR:-/srv/hyb-oa-trialrun}"',
      'COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-hyb-oa-trialrun}"',
    ].join("\n");
    expect(bootstrap.parseHistoricalDeploymentIdentity(historicalTarget, historicalProject)).toEqual({
      deployServer: "deploy.production.invalid",
      composeProjectName: "hyb-oa-trialrun",
    });
    expect(bootstrap.selectUniqueRefreshTarget([
      { target: "ordinary", status: 1, stdout: "" },
      { target: "refresh", status: 0, stdout: "[deployment-contract-refresh][PASS] probe\n" },
    ])).toBe("refresh");
    expect(() => bootstrap.selectUniqueRefreshTarget([])).toThrowError(
      expect.objectContaining({ code: "REFRESH_IDENTITY_NOT_FOUND" }),
    );
    expect(() => bootstrap.selectUniqueRefreshTarget([
      { target: "refresh-a", status: 0, stdout: "[deployment-contract-refresh][PASS] probe" },
      { target: "refresh-b", status: 0, stdout: "[deployment-contract-refresh][PASS] probe" },
    ])).toThrowError(expect.objectContaining({ code: "REFRESH_IDENTITY_NOT_UNIQUE" }));

    const contract = bootstrap.parseDeploymentContract([
      "REMOTE_DIR=/srv/hyb-oa-trialrun",
      "REMOTE_ENV_FILE=/srv/hyb-oa-trialrun/deploy/trialrun/.env",
      "COMPOSE_FILE=deploy/trialrun/docker-compose.yml",
      "COMPOSE_PROJECT_NAME=hyb-oa-trialrun",
      "POSTGRES_DATA_DIR=/srv/data/postgres",
      "STORAGE_HOST_DIR=/srv/data/storage",
    ].join(" "));
    expect(() => bootstrap.assertContractForOriginVerification(
      bootstrap.parseHistoricalDeploymentIdentity(historicalTarget, historicalProject),
      contract,
    )).not.toThrow();
    const relocatedContract = {
      ...contract,
      REMOTE_DIR: "/srv/current-production",
      REMOTE_ENV_FILE: "/srv/current-production/deploy/trialrun/.env",
    };
    expect(() => bootstrap.assertContractForOriginVerification(
      bootstrap.parseHistoricalDeploymentIdentity(historicalTarget, historicalProject),
      relocatedContract,
    )).not.toThrow();
    expect(() => bootstrap.assertContractForOriginVerification(
      bootstrap.parseHistoricalDeploymentIdentity(historicalTarget, historicalProject),
      { ...contract, COMPOSE_PROJECT_NAME: "different" },
    )).toThrowError(expect.objectContaining({ code: "SYSTEMD_COMPOSE_PROJECT_MISMATCH" }));
    expect(() => bootstrap.assertContractForOriginVerification(
      bootstrap.parseHistoricalDeploymentIdentity(historicalTarget, historicalProject),
      { ...contract, REMOTE_ENV_FILE: "/srv/different/.env" },
    )).toThrowError(expect.objectContaining({ code: "SYSTEMD_REMOTE_ENV_FILE_MISMATCH" }));

    const bootstrapSource = await readFile(PRODUCTION_IDENTITY_BOOTSTRAP, "utf8");
    const remoteSource = await readFile(PRODUCTION_IDENTITY_BOOTSTRAP_REMOTE, "utf8");
    expect(bootstrapSource).not.toContain("console.log(databaseIdentityHash)");
    expect(bootstrapSource).not.toContain("console.log(identity)");
    expect(remoteSource).toContain("DB_SHA256");
    expect(remoteSource).not.toContain("DB_BASE64");
    expect(remoteSource).not.toContain("prisma migrate status");
    expect(remoteSource.indexOf('IDENTITY_BOOTSTRAP_MODE" == "origin"')).toBeLessThan(
      remoteSource.indexOf("actual_db_name="),
    );
  });

  it("verifies both origin samples before reading the remote database name", async () => {
    const fakeBin = path.join(fixtureRoot, "origin-bin");
    await mkdir(fakeBin, { recursive: true });
    await writeFile(path.join(fakeBin, "docker"), [
      "#!/usr/bin/env bash",
      "set -euo pipefail",
      "joined=\"$*\"",
      "if [[ \"$1\" == compose && \"${2:-}\" == version ]]; then exit 0; fi",
      "if [[ \"$1\" == ps ]]; then printf 'server1\\n'; exit 0; fi",
      "if [[ \"$1\" == inspect ]]; then printf 'APP_ORIGIN=https://example.invalid\\n'; exit 0; fi",
      "printf 'unexpected fake docker call: %s\\n' \"$joined\" >&2",
      "exit 97",
      "",
    ].join("\n"), { mode: 0o700 });
    await chmod(path.join(fakeBin, "docker"), 0o700);
    const hash = createHash("sha256").update("https://example.invalid", "utf8").digest("hex");
    const runBootstrapRemote = (mode) => execFileAsync("bash", [PRODUCTION_IDENTITY_BOOTSTRAP_REMOTE], {
      cwd: remoteDir,
      env: {
        ...process.env,
        PATH: `${fakeBin}${path.delimiter}${process.env.PATH}`,
        IDENTITY_BOOTSTRAP_MODE: mode,
        REMOTE_DIR: remoteDir,
        REMOTE_ENV_FILE: envFile,
        COMPOSE_FILE: "deploy/trialrun/docker-compose.yml",
        COMPOSE_PROJECT_NAME: "hyb-oa-trialrun",
        EXPECTED_PRODUCTION_ORIGIN_SHA256: hash,
      },
    });
    await expect(runBootstrapRemote("origin")).resolves.toMatchObject({
      stdout: "[production-identity-bootstrap][PASS] origin_identity\n",
    });
    await expect(runBootstrapRemote("database")).rejects.toMatchObject({
      stderr: expect.stringContaining("PROD_TARGET_DB_NAME_MISSING"),
    });
  });

  it("runs the remote gate against synthetic status and migration history", async () => {
    const fakeBin = path.join(fixtureRoot, "remote-bin");
    await mkdir(fakeBin, { recursive: true });
    await writeFile(path.join(remoteDir, "deploy/trialrun/.env"), [
      "APP_ORIGIN=https://oa.example.com",
      "POSTGRES_DB=production_db",
      "POSTGRES_USER=synthetic_user",
      "NODE_ENV=production",
      "COOKIE_SECURE=true",
      "",
    ].join("\n"), { mode: 0o600 });
    await writeFile(path.join(fakeBin, "docker"), [
      "#!/usr/bin/env bash",
      "set -euo pipefail",
      "joined=\"$*\"",
      "mode=\"${FAKE_REMOTE_MODE:-happy}\"",
      "if [[ \"$1\" == compose && \"${2:-}\" == version ]]; then exit 0; fi",
      "if [[ \"$1\" == ps ]]; then",
      "  if [[ \"$joined\" == *service=server* ]]; then printf 'server1\\n'; else printf 'db1\\n'; fi",
      "  exit 0",
      "fi",
      "if [[ \"$1\" == inspect ]]; then printf 'NODE_ENV=production\\nCOOKIE_SECURE=true\\nAPP_ORIGIN=https://oa.example.com\\n'; exit 0; fi",
      "if [[ \"$joined\" == *' config'* ]]; then exit 0; fi",
      "if [[ \"$joined\" == *' exec '* && \"$joined\" == *' sh -lc '* ]]; then",
      "  case \"$mode\" in",
      "    pending) printf 'Following migration have not yet been applied:\\n20260807193001_followup_migration\\n'; exit 1 ;;",
      "    unknown) printf 'Following migration have not yet been applied:\\n20260807193002_unknown_migration\\n'; exit 1 ;;",
      "    *) printf 'Database schema is up to date!\\n'; exit 0 ;;",
      "  esac",
      "fi",
      "if [[ \"$joined\" == *' exec '* && \"$joined\" == *' node -e '* ]]; then",
      "  printf 'db.internal\\nproduction_db\\n'; exit 0",
      "fi",
      "if [[ \"$joined\" == *'SELECT current_database()'* ]]; then printf 'production_db\\n'; exit 0; fi",
      "if [[ \"$joined\" == *'_prisma_migrations'* ]]; then",
      "  case \"$mode\" in",
      "    pending) printf '20260807193000_contract_registry_termination_workspace|applied\\n';;",
      "    logs) printf '20260807193000_contract_registry_termination_workspace|logged_failure\\n';;",
      "    *) printf '20260807193000_contract_registry_termination_workspace|applied\\n20260807193001_followup_migration|applied\\n';;",
      "  esac",
      "  exit 0",
      "fi",
      "if [[ \"$joined\" == *'contract_registry'* ]]; then printf '0\\n'; exit 0; fi",
      "printf 'unexpected fake docker call: %s\\n' \"$joined\" >&2",
      "exit 97",
      "",
    ].join("\n"), { mode: 0o700 });
    await chmod(path.join(fakeBin, "docker"), 0o700);

    const hash = (value) => createHash("sha256").update(value, "utf8").digest("hex");
    const buildSha = "a".repeat(40);
    const runRemote = (mode, expectedPending = "", buildOverrides = {}) => execFileAsync("bash", [PRODUCTION_PREFLIGHT_REMOTE], {
      cwd: remoteDir,
      env: {
        ...process.env,
        PATH: `${fakeBin}${path.delimiter}${process.env.PATH}`,
        FAKE_REMOTE_MODE: mode,
        REMOTE_DIR: remoteDir,
        REMOTE_ENV_FILE: envFile,
        COMPOSE_FILE: "deploy/trialrun/docker-compose.yml",
        COMPOSE_PROJECT_NAME: "hyb-oa-trialrun",
        POSTGRES_DATA_DIR: postgresDir,
        STORAGE_HOST_DIR: storageDir,
        EXPECTED_PRODUCTION_ORIGIN_SHA256: hash("https://oa.example.com"),
        EXPECTED_PRODUCTION_DB_NAME_SHA256: hash("production_db"),
        BUILD_SHA: buildSha,
        VITE_BUILD_SHA: buildSha.slice(0, 12),
        CANDIDATE_MIGRATIONS_CSV: "20260807193000_contract_registry_termination_workspace,20260807193001_followup_migration",
        EXPECTED_PENDING_MIGRATIONS_CSV: expectedPending,
        ...buildOverrides,
      },
    });
    const result = await runRemote("happy");
    expect(result.stdout).toContain("target_identity");
    expect(result.stdout).toContain("migration_reconciliation pending=none");
    expect(result.stdout).toContain("rollbackWindow=OPEN");
    const pendingResult = await runRemote("pending", "20260807193001_followup_migration");
    expect(pendingResult.stdout).toContain("migration_reconciliation pending=20260807193001_followup_migration");
    await expect(runRemote("unknown")).rejects.toMatchObject({
      stderr: expect.stringContaining("PROD_MIGRATION_STATUS_UNKNOWN_PENDING"),
    });
    await expect(runRemote("logs")).rejects.toMatchObject({
      stderr: expect.stringContaining("PROD_MIGRATION_FAILED_OR_ROLLED_BACK"),
    });
    await expect(runRemote("happy", "", { BUILD_SHA: "a".repeat(39) })).rejects.toMatchObject({
      stderr: expect.stringContaining("PROD_TARGET_BUILD_SHA_INVALID"),
    });
    await expect(runRemote("happy", "", { VITE_BUILD_SHA: "a".repeat(7) })).rejects.toMatchObject({
      stderr: expect.stringContaining("PROD_TARGET_VITE_BUILD_SHA_INVALID"),
    });
    await expect(runRemote("happy", "", { VITE_BUILD_SHA: "b".repeat(12) })).rejects.toMatchObject({
      stderr: expect.stringContaining("PROD_TARGET_BUILD_SHA_MISMATCH"),
    });
  });

  it("aggregates preflight checks and keeps the root helper self-contained", async () => {
    const aggregate = await require("node:fs/promises").readFile(AGGREGATE_PREFLIGHT, "utf8");
    const helper = await require("node:fs/promises").readFile(REFRESH_HELPER, "utf8");
    const installer = await require("node:fs/promises").readFile(REFRESH_INSTALLER, "utf8");
    expect(aggregate).toContain("set -uo pipefail");
    expect(aggregate).not.toMatch(/^set\s+-[A-Za-z]*e[A-Za-z]*(?:\s|$)/m);
    expect(aggregate).toContain("CHECK_NAMES=(");
    expect(aggregate).toContain("root_ssh_identity");
    expect(aggregate).toContain("refresh_program");
    expect(helper).toContain("SSH_ORIGINAL_COMMAND");
    expect(helper).toContain("20-active-build.conf");
    expect(helper).toContain("refresh_program_integrity_invalid");
    expect(helper).not.toContain("eval ");
    expect(helper).not.toContain("bash -c");
    expect(helper).not.toContain("REMOTE_DIR/");
    expect(installer).toContain("dedicated key already has unmanaged or unrestricted root authorization");
    expect(installer).toContain("no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty,no-user-rc");
    expect(installer).toContain("managed forced-command marker is malformed");
  });

  it("keeps immutable build args after stable dependency layers", async () => {
    const dockerfile = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "deploy/trialrun/Dockerfile"), "utf8");
    expect(dockerfile.indexOf("RUN apk add --no-cache bash curl")).toBeLessThan(dockerfile.indexOf("ARG VITE_BUILD_SHA"));
    expect(dockerfile.indexOf("RUN cd client && npm ci")).toBeLessThan(dockerfile.indexOf("ARG VITE_BUILD_SHA"));
    expect(dockerfile.indexOf("RUN cd server && npm ci")).toBeLessThan(dockerfile.indexOf("ARG BUILD_SHA"));
  });

  it("keeps deployment smoke output free of raw account and external identifiers", async () => {
    const seed = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "server/src/scripts/seed-trialrun.js"), "utf8");
    const external = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "server/src/scripts/smoke-external-deps.js"), "utf8");
    const runtime = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "server/src/scripts/smoke-trialrun-runtime.js"), "utf8");
    expect(seed).not.toContain("${adminEmail}");
    expect(seed).not.toContain("${adminPhone}");
    expect(seed).not.toContain("${result.password}");
    expect(seed).not.toContain("generateOneTimePassword");
    expect(external).not.toContain("corpId=${config.wecomCorpId}");
    expect(external).not.toContain("redirectUri=${config.wecomRedirectUri}");
    expect(external).not.toContain("from=${config.emailFrom}");
    expect(runtime).not.toContain("${adminEmployee.employee_no}");
  });

  it("keeps the formal payment batch baseline enabled and restores QA caller state", async () => {
    const envExample = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "deploy/trialrun/.env.example"), "utf8");
    const runtime = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "server/src/scripts/smoke-trialrun-runtime.js"), "utf8");
    const shortWindow = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "scripts/qa/run-p2-fin-live-window.sh"), "utf8");
    const enableWindow = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "scripts/qa/run-fin-prod-enable-window.sh"), "utf8");
    const liveSpec = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "client/tests/e2e/manual/p2-fin-live-payment-batch.spec.ts"), "utf8");

    expect(envExample).toMatch(/^PAYMENT_BATCH_ENABLED=true$/m);
    expect(runtime).toContain("PAYMENT_BATCH_ENABLED: 'true'");
    expect(runtime).toContain("FEATURE_FLAG_KEYS.paymentBatch");
    expect(shortWindow).toContain("restore-caller-flag-snapshot");
    expect(shortWindow).toContain("P2_FIN_LIVE_ALREADY_ON='$ALREADY_ON_MODE'");
    expect(enableWindow).toContain("restore-caller-flag-snapshot");
    expect(liveSpec).toContain("restoreFlagSnapshot");
    expect(liveSpec).not.toContain("forcePaymentBatchOff");
    expect(shortWindow).not.toContain("force_payment_batch_flag_off");
    expect(enableWindow).not.toContain("force_payment_batch_flag_off");
  });
});