#!/usr/bin/env bash
set -eo pipefail

# Pins consequence suppression: while a root cause is being repaired, the
# healers for its downstream effects stand down.
#
# A dead WAN takes the proxy, DNS and the health check with it. Each has its own
# subscriber, and each used to conclude independently that a restart was in
# order — three repairs for one fault, none of which could work until the uplink
# came back. safe_proxy_restart()'s rate limit throttled the pile-up after the
# fact; nothing expressed that they were consequences.
#
# The failure mode this guards against is quiet: without suppression the router
# still heals, it just thrashes while doing it. Only a log read would show it.

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TACHYON_LIB="$ROOT_DIR/tachyon/files/usr/lib"
WATCHDOG_UC="$TACHYON_LIB/service/watchdog.uc"
CONTROLLER_UC="$TACHYON_LIB/service/event_controller.uc"

fail() {
  printf 'FAIL: %s\n' "$1" >&2
  exit 1
}

# ── causality is expressed once ───────────────────────────────────────────────
# The bus already ranked healers by cause. Those ranks are named so the
# subscription priority and the suppression check cannot drift apart — a drift
# would either suppress nothing or let a cause suppress itself.
for c in 'PRIORITY_WAN     = 10' 'PRIORITY_SINGBOX = 20' \
         'PRIORITY_PROXY   = 40' 'PRIORITY_DNS     = 50'; do
  grep -q "const $c;" "$WATCHDOG_UC" || fail "the causal rank '$c' is gone"
done

# The registrations must use the constants, not literals, or naming them buys
# nothing.
for reg in 'heal_wan_and_gateway", priority: PRIORITY_WAN' \
           'heal_singbox_stopped", priority: PRIORITY_SINGBOX' \
           'heal_proxy_connectivity", priority: PRIORITY_PROXY' \
           'heal_dns_stall", priority: PRIORITY_DNS'; do
  grep -q "$reg" "$WATCHDOG_UC" \
    || fail "a subscription re-hardcodes its priority instead of using the named rank: $reg"
done

# ── the root cause is claimed and released ────────────────────────────────────
# The general active_root_causes registry was replaced by two named deadline
# vars — WAN and sing-box are the only two causes ever claimed; proxy and DNS
# healers only need to know if either is active.
grep -q 'let wan_repair_until' "$WATCHDOG_UC" \
  || fail "wan_repair_until is gone; nothing marks a WAN repair as a root cause"
grep -q 'let singbox_repair_until' "$WATCHDOG_UC" \
  || fail "singbox_repair_until is gone; nothing marks a sing-box restart as a root cause"
grep -q 'function suppressed_by_root_cause(healer)' "$WATCHDOG_UC" \
  || fail "suppressed_by_root_cause() is gone; consequences no longer stand down"

# WAN deadline is set before ifdown, not after: ifdown is itself what makes the
# proxy and DNS probes fail, and those facts arrive while ifup is still running.
claim_line="$(grep -n 'wan_repair_until = time()' "$WATCHDOG_UC" | cut -d: -f1)"
ifdown_line="$(grep -n '/sbin/ifdown wan' "$WATCHDOG_UC" | cut -d: -f1)"
[ -n "$claim_line" ] || fail "heal_wan_and_gateway does not set wan_repair_until before ifdown"
[ -n "$ifdown_line" ] || fail "heal_wan_and_gateway no longer restarts the wan interface"
[ "$claim_line" -lt "$ifdown_line" ] \
  || fail "the WAN deadline is set after ifdown; the resulting proxy/DNS failures would not be suppressed"

grep -q 'singbox_repair_until = time()' "$WATCHDOG_UC" \
  || fail "heal_singbox_stopped does not set singbox_repair_until"

# ── every claim has a release path ────────────────────────────────────────────
# A deadline released only at expiry suppresses real faults for the full window.
# Both causes have a recovery fact that zeroes the deadline immediately.
grep -q 'wan_repair_until = 0;' "$WATCHDOG_UC" \
  || fail "the WAN deadline is never cleared on recovery"
grep -q 'singbox_repair_until = 0;' "$WATCHDOG_UC" \
  || fail "the sing-box deadline is never cleared on recovery"

# WAN_UP is new: probe_wan only ever published failure, so a recovered uplink
# was invisible.
grep -q 'WAN_UP:                 "wan.up",' "$CONTROLLER_UC" \
  || fail "EV.WAN_UP is missing from the event vocabulary"
grep -q 'bus.emit(EV.WAN_UP' "$CONTROLLER_UC" \
  || fail "probe_wan no longer publishes WAN_UP; the deadline could only lapse by expiry"
grep -qE 'subscribe\(EV\.WAN_UP, note_wan_recovered,' "$WATCHDOG_UC" \
  || fail "nothing subscribes to WAN_UP"

# ── the consequences actually check ───────────────────────────────────────────
for healer in heal_dns_stall heal_proxy_connectivity heal_proxy_health heal_dns_continuous; do
  grep -q "suppressed_by_root_cause(\"$healer\")" "$WATCHDOG_UC" \
    || fail "$healer does not stand down for an active root cause; it would repair a consequence"
done

# ── a skip is logged, never silent ────────────────────────────────────────────
# "the watchdog did nothing" and "the watchdog deliberately stood down" look
# identical in a log that omits this.
grep -qE 'standing down, WAN repair|standing down, sing-box restart' "$WATCHDOG_UC" \
  || fail "a suppressed repair is now silent; the log cannot distinguish it from inaction"

# ── the suppression state machine behaves ─────────────────────────────────────
# watchdog.uc is a CLI module with no exports, so the block is lifted out of the
# source verbatim — extracted, not copied, so a change to the logic changes the
# test's subject too.
SUPPRESS_UC="$(mktemp "${TMPDIR:-/tmp}/tachyon_suppress_XXXXXX")"
trap 'rm -f "$SUPPRESS_UC"' EXIT

# log_message, as_string, sprintf are module-level in watchdog.uc, outside the
# block. They go in first so closures capture them correctly.
cat > "$SUPPRESS_UC" <<'PRELUDE'
let logged = [];
function log_message(msg, level) { push(logged, msg); }
function as_string(v) { return "" + v; }
function sprintf(...args) { return join("", args); }
PRELUDE

sed -n '/^const SUPPRESSION_DEADLINE/,/^\/\/ ─── Escalation ladder/p' "$WATCHDOG_UC" >> "$SUPPRESS_UC"
grep -q 'function suppressed_by_root_cause' "$SUPPRESS_UC" \
  || fail "could not extract the suppression block from watchdog.uc"

cat >> "$SUPPRESS_UC" <<'DRIVER'

let out = [];
// Nothing is being repaired: every healer runs.
push(out, "idle_proxy=" + (suppressed_by_root_cause("proxy") ? "skip" : "run"));

// WAN is being repaired. The proxy and DNS healers are downstream of it.
wan_repair_until = time() + SUPPRESSION_DEADLINE;
push(out, "wan_proxy=" + (suppressed_by_root_cause("proxy") ? "skip" : "run"));
push(out, "wan_dns=" + (suppressed_by_root_cause("dns") ? "skip" : "run"));
// WAN does not suppress itself (it IS the root cause).
// Both vars are in scope; singbox_repair_until is still 0, so only WAN fires.
push(out, "logged=" + (length(logged) > 0 ? "yes" : "no"));

// The uplink comes back: suppression lifts immediately, not at the deadline.
wan_repair_until = 0;
push(out, "released_proxy=" + (suppressed_by_root_cause("proxy") ? "skip" : "run"));

// A sing-box restart suppresses proxy/DNS, but not a WAN fault which must still
// be repaired.
singbox_repair_until = time() + SUPPRESSION_DEADLINE;
push(out, "singbox_blocks_proxy=" + (suppressed_by_root_cause("proxy") ? "skip" : "run"));
singbox_repair_until = 0;

// An expired deadline no longer suppresses.
wan_repair_until = time() - 1;
push(out, "expired_proxy=" + (suppressed_by_root_cause("proxy") ? "skip" : "run"));

print(join(" ", out) + "\n");
DRIVER

actual="$(ucode "$SUPPRESS_UC")"
expected="idle_proxy=run wan_proxy=skip wan_dns=skip logged=yes released_proxy=run singbox_blocks_proxy=skip expired_proxy=run"
[ "$actual" = "$expected" ] \
  || fail "root-cause suppression misbehaves
  expected: $expected
  actual:   $actual"

printf 'heal suppression checks passed\n'