path: root/internal/journal/read_test.go

// SPDX-License-Identifier: GPL-3.0-or-later

package journal

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

func TestRunsListsNewestFirst(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	t0 := time.Date(2026, 9, 11, 9, 0, 0, 0, time.UTC)
	t1 := t0.Add(time.Hour)
	for _, r := range []struct {
		id   string
		at   time.Time
		dirs []string
	}{{"A", t0, []string{"dl"}}, {"B", t1, []string{"dl", "docs"}}} {
		w.Append(Entry{Time: r.at, Run: r.id, Action: "run-start", Status: "ok"})
		for _, d := range r.dirs {
			w.Append(Entry{Time: r.at, Run: r.id, Dir: d, File: "x.pdf", Step: 1,
				Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"})
		}
		w.Append(Entry{Time: r.at, Run: r.id, Action: "run-end", Status: "ok"})
	}
	w.Close()

	runs, err := Runs(path, 0)
	if err != nil {
		t.Fatal(err)
	}
	if len(runs) != 2 || runs[0].ID != "B" || runs[1].ID != "A" {
		t.Fatalf("runs = %+v; want B then A", runs)
	}
	if len(runs[0].Dirs) != 2 || runs[0].Dirs[0] != "dl" || runs[0].Dirs[1] != "docs" {
		t.Errorf("run B dirs = %v, want [dl docs] in first-seen order", runs[0].Dirs)
	}
	if runs[0].Counts["move"] != 2 {
		t.Errorf("run B move count = %d, want 2", runs[0].Counts["move"])
	}
	if !runs[0].Start.Equal(t1) {
		t.Errorf("run B start = %v, want %v", runs[0].Start, t1)
	}
	if runs, err = Runs(path, 1); err != nil || len(runs) != 1 || runs[0].ID != "B" {
		t.Errorf("Runs(path, 1) = %+v, %v", runs, err)
	}
}

// TestTruncatedLastLineIsSkipped: a crash mid-write must not make the log
// unreadable - everything before the broken line still parses.
func TestTruncatedLastLineIsSkipped(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	w.Append(Entry{Time: time.Now(), Run: "A", Action: "run-start", Status: "ok"})
	w.Close()
	f, _ := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0o644)
	f.WriteString("2026-09-11T10:02:03+02:00\tA\tdl\thalf-written")
	f.Close()

	runs, err := Runs(path, 0)
	if err != nil {
		t.Fatalf("a truncated final line made the whole log unreadable: %v", err)
	}
	if len(runs) != 1 || runs[0].ID != "A" {
		t.Errorf("runs = %+v; want the complete run A", runs)
	}
}

// TestRunsMarksAnUndoneRun: an undo run's run-start Detail names the run it
// reverses, in the exact format "undo of <run id>". Runs must mark that
// earlier run Undone, and must not mark the undo run itself.
func TestRunsMarksAnUndoneRun(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	t0 := time.Date(2026, 9, 11, 9, 0, 0, 0, time.UTC)
	t1 := t0.Add(time.Hour)
	w.Append(Entry{Time: t0, Run: "A", Action: "run-start", Status: "ok"})
	w.Append(Entry{Time: t0, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"})
	w.Append(Entry{Time: t0, Run: "A", Action: "run-end", Status: "ok"})
	w.Append(Entry{Time: t1, Run: "B", Action: "run-start", Status: "ok", Detail: "undo of A"})
	w.Append(Entry{Time: t1, Run: "B", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "undo-move", Status: "ok", Src: "/b/x.pdf", Dst: "/a/x.pdf"})
	w.Append(Entry{Time: t1, Run: "B", Action: "run-end", Status: "ok"})
	w.Close()

	runs, err := Runs(path, 0)
	if err != nil {
		t.Fatal(err)
	}
	byID := map[string]Run{}
	for _, r := range runs {
		byID[r.ID] = r
	}
	if !byID["A"].Undone {
		t.Errorf("run A = %+v, want Undone", byID["A"])
	}
	if byID["B"].Undone {
		t.Errorf("run B (the undo run itself) = %+v, want not Undone", byID["B"])
	}
}

// TestRunsDoesNotMarkUndoneWhenEveryFileWasDeclined: an undo run's
// run-start Detail alone is not enough for Runs to mark the original run
// Undone, even when the undo run went on to decline every file (spec §9's
// "declined files are logged even though nothing happens to them",
// extended to undo) and reversed nothing at all - otherwise `krino log`
// would tell the user a run had been undone when the file was still
// filed. Run B here carries the same run-start Detail as
// TestRunsMarksAnUndoneRun's, but every one of its file-scoped entries is
// "declined", never "ok" - the shape ApplyUndo logs when the front end's
// own review declines everything - so run A must come back exactly as
// untouched.
func TestRunsDoesNotMarkUndoneWhenEveryFileWasDeclined(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	t0 := time.Date(2026, 9, 11, 9, 0, 0, 0, time.UTC)
	t1 := t0.Add(time.Hour)
	w.Append(Entry{Time: t0, Run: "A", Action: "run-start", Status: "ok"})
	w.Append(Entry{Time: t0, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"})
	w.Append(Entry{Time: t0, Run: "A", Action: "run-end", Status: "ok"})
	w.Append(Entry{Time: t1, Run: "B", Action: "run-start", Status: "ok", Detail: "undo of A"})
	w.Append(Entry{Time: t1, Run: "B", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "undo-move", Status: "declined", Src: "/b/x.pdf", Dst: "/a/x.pdf"})
	w.Append(Entry{Time: t1, Run: "B", Action: "run-end", Status: "ok"})
	w.Close()

	runs, err := Runs(path, 0)
	if err != nil {
		t.Fatal(err)
	}
	byID := map[string]Run{}
	for _, r := range runs {
		byID[r.ID] = r
	}
	if byID["A"].Undone {
		t.Errorf("run A = %+v, want NOT Undone - the undo run declined every file and reversed nothing", byID["A"])
	}
	if byID["B"].Undone {
		t.Errorf("run B (the undo run itself) = %+v, want not Undone", byID["B"])
	}
}

// TestRunsDoesNotMarkUndoneWhenOnlyOkEntryIsMkdir: "at least one ok
// undo-* entry" alone is too loose a check, by the same shape as the bug
// it fixes above. A file's own chain stops after a failed file-affecting
// reversal, but a failed or refused undo-mkdir deliberately does not stop
// anything (internal/engine's isFileAffecting draws exactly this line,
// and undoFile's stop-on-failure check shares it) - so an undo-mkdir
// belonging to one file can still succeed even though every
// file-affecting reversal in the whole run failed. Here x.pdf's own
// undo-move fails, y.pdf's own undo-move also fails, and z.pdf's
// undo-mkdir - tidying up a directory that turned out empty, not
// restoring anything - is the run's only "ok" entry. Marking the original
// run Undone from that alone would be the same bug again, by a narrower
// route.
func TestRunsDoesNotMarkUndoneWhenOnlyOkEntryIsMkdir(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	t0 := time.Date(2026, 9, 11, 9, 0, 0, 0, time.UTC)
	t1 := t0.Add(time.Hour)
	w.Append(Entry{Time: t0, Run: "A", Action: "run-start", Status: "ok"})
	w.Append(Entry{Time: t0, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"})
	w.Append(Entry{Time: t0, Run: "A", Dir: "dl", File: "y.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/y.pdf", Dst: "/b/y.pdf"})
	w.Append(Entry{Time: t0, Run: "A", Action: "run-end", Status: "ok"})
	w.Append(Entry{Time: t1, Run: "B", Action: "run-start", Status: "ok", Detail: "undo of A"})
	w.Append(Entry{Time: t1, Run: "B", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "undo-move", Status: "failed", Src: "/b/x.pdf", Dst: "/a/x.pdf"})
	w.Append(Entry{Time: t1, Run: "B", Dir: "dl", File: "y.pdf", Step: 1,
		Action: "undo-move", Status: "failed", Src: "/b/y.pdf", Dst: "/a/y.pdf"})
	// z.pdf's own file-affecting reversal is unrelated to x.pdf/y.pdf's
	// failures; only its cleanup mkdir is shown here, since that mkdir is
	// the one entry this test is about - the run's only "ok" line.
	w.Append(Entry{Time: t1, Run: "B", Dir: "dl", File: "z.pdf", Step: 2,
		Action: "undo-mkdir", Status: "ok", Src: "/a/Work"})
	w.Append(Entry{Time: t1, Run: "B", Action: "run-end", Status: "ok"})
	w.Close()

	runs, err := Runs(path, 0)
	if err != nil {
		t.Fatal(err)
	}
	byID := map[string]Run{}
	for _, r := range runs {
		byID[r.ID] = r
	}
	if byID["A"].Undone {
		t.Errorf("run A = %+v, want NOT Undone - the run's only ok entry is an undo-mkdir (tidiness, not a restoration), and every file-affecting reversal failed", byID["A"])
	}
}

// TestEntriesCrashedRunReturnsNilError: a run-start present, run-end
// absent, and otherwise clean is exactly the crashed-run shape Entries'
// own doc comment says it must accept - "to end of file when there is no
// run-end (a crashed run, which is precisely when corruption is likely)".
// Pinning it as its own test, rather than leaving it implicit in tests
// about something else, is deliberate.
func TestEntriesCrashedRunReturnsNilError(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 12, 8, 0, 0, 0, time.UTC)
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"}); err != nil {
		t.Fatal(err)
	}
	// No run-end: the process crashed right here.
	if err := w.Close(); err != nil {
		t.Fatal(err)
	}

	got, err := Entries(path, "A")
	if err != nil {
		t.Fatalf("a crashed but otherwise clean run returned an error: %v", err)
	}
	if len(got) != 2 || got[0].Action != "run-start" || got[1].Action != "move" {
		t.Errorf("entries = %+v, want [run-start, move]", got)
	}
}

// TestEntriesIntactRunReturnsNilError: a complete, clean run - run-start,
// a step, run-end, nothing corrupt - must read back with a nil error.
// Every other test in this file needs this to be true along the way, but
// none of them state it as their own point; this one does.
func TestEntriesIntactRunReturnsNilError(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 12, 8, 0, 0, 0, time.UTC)
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Close(); err != nil {
		t.Fatal(err)
	}

	got, err := Entries(path, "A")
	if err != nil {
		t.Fatalf("a fully intact run returned an error: %v", err)
	}
	if len(got) != 3 || got[0].Action != "run-start" || got[1].Action != "move" || got[2].Action != "run-end" {
		t.Errorf("entries = %+v, want [run-start, move, run-end]", got)
	}
}

// TestEntriesBothFailureModesReportsBadLineFirst: a run that both has an
// unparsable line inside its window AND lacks a readable run-start must
// surface as the unparsable-line error, not the missing-run-start one -
// Entries checks badLine before sawRunStart. The run-start line here is
// destroyed unattributably (as in TestEntriesFailsClosedOnMissingRunStart),
// and a second, still-attributable line is separately corrupted so badLine
// is set via the runFieldOf fallback rather than the window check.
func TestEntriesBothFailureModesReportsBadLineFirst(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 12, 8, 0, 0, 0, time.UTC)
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Close(); err != nil {
		t.Fatal(err)
	}

	raw, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	lines := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
	if len(lines) != 3 {
		t.Fatalf("fixture has %d lines, want 3", len(lines))
	}
	// Line 1 (run-start): destroyed unattributably - no tabs at all, so
	// runFieldOf cannot even recover its Run column.
	lines[0] = "totally-mangled-no-tabs-here"
	// Line 2 (move): corrupt its Step column only - it keeps its tabs and
	// its Run column ("A") stays readable via runFieldOf's fallback.
	fields := strings.Split(lines[1], "\t")
	fields[4] = "not-a-number"
	lines[1] = strings.Join(fields, "\t")
	if err := os.WriteFile(path, []byte(strings.Join(lines, "\n")+"\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	// A damaged line whose file is readable refuses only that file (a
	// "damaged" entry); the run as a whole still fails closed here, on its
	// missing run-start.
	got, err := Entries(path, "A")
	if err == nil {
		t.Fatal("Entries returned no error with a missing run-start")
	}
	if !strings.Contains(err.Error(), "no readable run-start") {
		t.Errorf("error = %q, want it to name the missing run-start", err)
	}
	if len(got) != 2 || got[0].Action != "damaged" || got[0].File != "x.pdf" || got[1].Action != "run-end" {
		t.Errorf("entries = %+v, want x.pdf damaged, then run-end", got)
	}
}

// TestEntriesAdjacentRunStartsOneCorrupted pins what journal.Entries does
// for two runs whose run-start lines are adjacent, one of them corrupted -
// it asserts the observed behaviour, not an invented "correct" result.
// The log here is exactly:
//
//	1  run-start A          (good)
//	2  run-start B          (corrupted: no tabs, unattributable)
//	3  move      A          (good)
//	4  run-end   A          (good)
//	5  move      B          (good)
//	6  run-end   B          (good)
//
// Observed behaviour, traced by hand against Entries and confirmed by this
// test: Entries(path, "A") fails closed with the unparsable-line error,
// because line 2 falls inside A's own window (opened by line 1, not yet
// closed by a run-end) even though the corrupted line was actually B's
// run-start, not A's - this is exactly the "residual risk... a false
// refusal, not a false success" the function's own doc comment already
// names. Entries(path, "B"), in contrast, never sees line 2 as inside its
// window (B's window has not opened - its own run-start is the corrupted
// line), so it reaches the end of the file with no badLine, and instead
// fails on B's missing run-start.
//
// This is a known inconsistency, left as is rather than fixed: the SAME
// corrupted line produces two different error shapes depending only on
// which run asks, which is a surprising inconsistency in the message a
// caller sees, even though both directions correctly fail closed.
func TestEntriesAdjacentRunStartsOneCorrupted(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 12, 8, 0, 0, 0, time.UTC)
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "B", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "B", Dir: "dl", File: "y.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/y.pdf", Dst: "/b/y.pdf"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "B", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Close(); err != nil {
		t.Fatal(err)
	}

	raw, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	lines := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
	if len(lines) != 6 {
		t.Fatalf("fixture has %d lines, want 6", len(lines))
	}
	// Line 2, B's run-start, adjacent to A's on line 1: destroyed
	// unattributably.
	lines[1] = "totally-mangled-no-tabs-here"
	if err := os.WriteFile(path, []byte(strings.Join(lines, "\n")+"\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	gotA, errA := Entries(path, "A")
	if errA == nil {
		t.Fatal("Entries(A) returned no error; pinned behaviour expects one (the corrupted adjacent line falls inside A's window)")
	}
	if !strings.Contains(errA.Error(), "unparsable line 2") {
		t.Errorf("Entries(A) error = %q, want it to name the unparsable line 2", errA)
	}
	if len(gotA) != 3 || gotA[0].Action != "run-start" || gotA[1].Action != "move" || gotA[2].Action != "run-end" {
		t.Errorf("Entries(A) = %+v, want A's own [run-start, move, run-end]", gotA)
	}

	gotB, errB := Entries(path, "B")
	if errB == nil {
		t.Fatal("Entries(B) returned no error; pinned behaviour expects one (B's own run-start is the corrupted line)")
	}
	if !strings.Contains(errB.Error(), "no readable run-start") {
		t.Errorf("Entries(B) error = %q, want it to name the missing run-start", errB)
	}
	if len(gotB) != 2 || gotB[0].Action != "move" || gotB[1].Action != "run-end" {
		t.Errorf("Entries(B) = %+v, want B's surviving [move, run-end]", gotB)
	}
}

// TestEntriesReportsAMangledLine: a corrupt line that is not the log's
// final line must not be silently dropped by Entries the way Runs drops it
// - PlanUndo needs to know a step went missing. A line whose directory and
// file columns are readable is returned as a "damaged" entry for that
// file, so only that file is refused and the rest of the run can still be
// undone.
func TestEntriesReportsAMangledLine(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 11, 10, 2, 3, 0, time.UTC)
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Close(); err != nil {
		t.Fatal(err)
	}

	// Mangle line 2 (the move step) in place: corrupt its Step column so it
	// fails to parse, without touching the line or column count of the
	// file otherwise - the point is a bad line in the middle, not at EOF.
	raw, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	lines := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
	if len(lines) != 3 {
		t.Fatalf("fixture has %d lines, want 3", len(lines))
	}
	fields := strings.Split(lines[1], "\t")
	fields[4] = "not-a-number" // the step column
	lines[1] = strings.Join(fields, "\t")
	if err := os.WriteFile(path, []byte(strings.Join(lines, "\n")+"\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	got, err := Entries(path, "A")
	if err != nil {
		t.Fatalf("Entries = %v; a damaged line with a readable file must not refuse the run", err)
	}
	if len(got) != 3 || got[1].Action != "damaged" || got[1].Dir != "dl" || got[1].File != "x.pdf" || !strings.Contains(got[1].Detail, "line 2") {
		t.Fatalf("entries = %+v; want run-start, x.pdf damaged (line 2), run-end", got)
	}
}

// TestEntriesIgnoresAnotherRunsDamagedLine: a damaged line whose run
// column names another run - two directories' runs can interleave in one
// log - does not refuse this run, even inside its window.
func TestEntriesIgnoresAnotherRunsDamagedLine(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 11, 10, 2, 3, 0, time.UTC)
	for _, e := range []Entry{
		{Time: at, Run: "A", Action: "run-start", Status: "ok"},
		{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1, Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"},
		{Time: at, Run: "A", Action: "run-end", Status: "ok"},
	} {
		if err := w.Append(e); err != nil {
			t.Fatal(err)
		}
	}
	w.Close()
	raw, _ := os.ReadFile(path)
	lines := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
	cut := "2026-09-11T10:02:04Z\tB\tscans\ty.pdf\t1\tmo"
	lines = append(lines[:2], append([]string{cut}, lines[2:]...)...)
	if err := os.WriteFile(path, []byte(strings.Join(lines, "\n")+"\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	got, err := Entries(path, "A")
	if err != nil || len(got) != 3 {
		t.Errorf("Entries(A) = %+v, %v; want A's three entries and no error", got, err)
	}
}

// TestEntriesFailsClosedOnUnattributableCorruptionInsideWindow: when a
// line's own Run column is destroyed, Entries cannot attribute it by
// content - but if it falls inside runID's own window (between its
// run-start and run-end), that possibility alone must be enough to refuse
// rather than silently return an incomplete chain (spec §10).
func TestEntriesFailsClosedOnUnattributableCorruptionInsideWindow(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 11, 10, 2, 3, 0, time.UTC)
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Close(); err != nil {
		t.Fatal(err)
	}

	// Insert a line with no tabs at all - its Run column is unrecoverable -
	// between the move step and run-end, i.e. inside A's window.
	raw, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	lines := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
	if len(lines) != 3 {
		t.Fatalf("fixture has %d lines, want 3", len(lines))
	}
	inserted := make([]string, 0, len(lines)+1)
	inserted = append(inserted, lines[:2]...)
	inserted = append(inserted, "totally-mangled-no-tabs-here")
	inserted = append(inserted, lines[2:]...)
	if err := os.WriteFile(path, []byte(strings.Join(inserted, "\n")+"\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	got, err := Entries(path, "A")
	if err == nil {
		t.Fatal("Entries did not fail closed on unattributable corruption inside the run's window")
	}
	if !strings.Contains(err.Error(), "line 3") {
		t.Errorf("error %q does not name line 3", err)
	}
	if len(got) != 3 {
		t.Fatalf("got %d entries, want the 3 surviving (run-start, move, run-end): %+v", len(got), got)
	}
}

// TestEntriesIgnoresUnattributableCorruptionOutsideWindow: the same
// corruption shape, placed after A's run-end inside a later run B's own
// window, must not poison A - the window scoping keeps it out.
func TestEntriesIgnoresUnattributableCorruptionOutsideWindow(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 11, 10, 2, 3, 0, time.UTC)
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "B", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "B", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Close(); err != nil {
		t.Fatal(err)
	}

	// Insert the same unattributable corruption, now inside B's window
	// (between B's run-start and run-end), not A's.
	raw, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	lines := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
	if len(lines) != 5 {
		t.Fatalf("fixture has %d lines, want 5", len(lines))
	}
	inserted := make([]string, 0, len(lines)+1)
	inserted = append(inserted, lines[:4]...)
	inserted = append(inserted, "totally-mangled-no-tabs-here")
	inserted = append(inserted, lines[4:]...)
	if err := os.WriteFile(path, []byte(strings.Join(inserted, "\n")+"\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	got, err := Entries(path, "A")
	if err != nil {
		t.Fatalf("corruption outside A's window poisoned A: %v", err)
	}
	if len(got) != 3 {
		t.Fatalf("got %d entries, want A's 3: %+v", len(got), got)
	}
}

// TestEntriesFailsClosedOnMissingRunStart: run-start is not an optional
// marker - every run Apply writes begins with one, so its absence, once
// other entries for the run did parse, means either corruption or a log
// truncated at the front. Either way the chain cannot be trusted, even
// though the window logic alone sees nothing wrong (it never opens without
// a parsed run-start, so it never flags anything inside the gap).
func TestEntriesFailsClosedOnMissingRunStart(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 11, 10, 2, 3, 0, time.UTC)
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-start", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Dir: "dl", File: "x.pdf", Step: 1,
		Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Append(Entry{Time: at, Run: "A", Action: "run-end", Status: "ok"}); err != nil {
		t.Fatal(err)
	}
	if err := w.Close(); err != nil {
		t.Fatal(err)
	}

	// Replace A's run-start line (line 1) with a line with no tabs at all -
	// unrecoverable, like the round-1 fixtures.
	raw, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	lines := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
	if len(lines) != 3 {
		t.Fatalf("fixture has %d lines, want 3", len(lines))
	}
	lines[0] = "totally-mangled-no-tabs-here"
	if err := os.WriteFile(path, []byte(strings.Join(lines, "\n")+"\n"), 0o644); err != nil {
		t.Fatal(err)
	}

	got, err := Entries(path, "A")
	if err == nil {
		t.Fatal("Entries did not fail closed on a missing run-start")
	}
	if !strings.Contains(err.Error(), "run-start") {
		t.Errorf("error %q does not name the missing run-start", err)
	}
	if len(got) != 2 {
		t.Fatalf("got %d entries, want the 2 surviving (move, run-end): %+v", len(got), got)
	}
	if got[0].Action != "move" || got[1].Action != "run-end" {
		t.Errorf("entries = %+v", got)
	}
}

// TestReversedStepsCountsEveryUndoOfARun: the steps earlier undo runs of a
// run already reversed - only "ok" undo entries of runs that undo it - so
// a later undo of the same run can offer just what is left. Runs also
// names the run an undo run reversed.
func TestReversedStepsCountsEveryUndoOfARun(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, err := Open(path)
	if err != nil {
		t.Fatal(err)
	}
	at := time.Date(2026, 9, 11, 9, 0, 0, 0, time.UTC)
	for _, e := range []Entry{
		{Time: at, Run: "R", Action: "run-start", Status: "ok"},
		{Time: at, Run: "R", Dir: "dl", File: "a.pdf", Step: 1, Action: "move", Status: "ok", Src: "/dl/a.pdf", Dst: "/w/a.pdf"},
		{Time: at, Run: "R", Action: "run-end", Status: "ok"},
		{Time: at.Add(time.Minute), Run: "U1", Action: "run-start", Status: "ok", Detail: UndoOf("R")},
		{Time: at.Add(time.Minute), Run: "U1", Dir: "dl", File: "a.pdf", Step: 1, Action: "undo-move", Status: "ok", Src: "/w/a.pdf", Dst: "/dl/a.pdf"},
		{Time: at.Add(time.Minute), Run: "U1", Dir: "dl", File: "b.pdf", Step: 1, Action: "undo-rename", Status: "failed", Src: "/dl/r-b.pdf", Dst: "/dl/b.pdf"},
		{Time: at.Add(time.Minute), Run: "U1", Action: "run-end", Status: "ok"},
		{Time: at.Add(2 * time.Minute), Run: "U2", Action: "run-start", Status: "ok", Detail: UndoOf("OTHER")},
		{Time: at.Add(2 * time.Minute), Run: "U2", Dir: "dl", File: "a.pdf", Step: 1, Action: "undo-move", Status: "ok", Src: "/w/a.pdf", Dst: "/dl/a.pdf"},
		{Time: at.Add(2 * time.Minute), Run: "U2", Action: "run-end", Status: "ok"},
	} {
		if err := w.Append(e); err != nil {
			t.Fatal(err)
		}
	}
	w.Close()
	got, err := ReversedSteps(path, "R")
	if err != nil {
		t.Fatal(err)
	}
	want := map[ReversedKey]int{{Dir: "dl", File: "a.pdf", Action: "undo-move", Src: "/w/a.pdf"}: 1}
	if len(got) != len(want) || got[ReversedKey{Dir: "dl", File: "a.pdf", Action: "undo-move", Src: "/w/a.pdf"}] != 1 {
		t.Errorf("ReversedSteps = %v, want %v", got, want)
	}
	runs, err := Runs(path, 0)
	if err != nil {
		t.Fatal(err)
	}
	for _, r := range runs {
		want := map[string]string{"R": "", "U1": "R", "U2": "OTHER"}[r.ID]
		if r.UndoOf != want {
			t.Errorf("run %s: UndoOf = %q, want %q", r.ID, r.UndoOf, want)
		}
	}
}

// TestEntriesRefusesALineCutInsideItsRunColumn: a crash that cuts the last
// line inside its run column leaves a prefix of some run's ID - it cannot
// be called another run's line, so inside this run's window it refuses
// the run.
func TestEntriesRefusesALineCutInsideItsRunColumn(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	at := time.Date(2026, 9, 11, 10, 2, 3, 0, time.UTC)
	run := "20260911T100203-ab12"
	for _, e := range []Entry{
		{Time: at, Run: run, Action: "run-start", Status: "ok"},
		{Time: at, Run: run, Dir: "dl", File: "x.pdf", Step: 1, Action: "copy", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"},
	} {
		if err := w.Append(e); err != nil {
			t.Fatal(err)
		}
	}
	w.Close()
	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0)
	if err != nil {
		t.Fatal(err)
	}
	f.WriteString("2026-09-11T10:02:04Z\t20260911T10")
	f.Close()
	if got, err := Entries(path, run); err == nil {
		t.Errorf("Entries = %+v, no error; a line cut inside its run column must refuse the run", got)
	}
}

// TestRunsMarksAPartlyUndoneRun: a run whose undo reversed some of its
// reversible steps but not all is partly undone; once a later undo
// reverses the rest, it is undone in full. A permanent delete counts
// toward neither.
func TestRunsMarksAPartlyUndoneRun(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	t0 := time.Date(2026, 9, 11, 9, 0, 0, 0, time.UTC)
	for _, e := range []Entry{
		{Time: t0, Run: "A", Action: "run-start", Status: "ok"},
		{Time: t0, Run: "A", Dir: "dl", File: "x.pdf", Step: 1, Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"},
		{Time: t0, Run: "A", Dir: "dl", File: "y.pdf", Step: 1, Action: "rename", Status: "ok", Src: "/a/y.pdf", Dst: "/a/z.pdf"},
		{Time: t0, Run: "A", Dir: "dl", File: "old.pdf", Step: 1, Action: "delete", Status: "ok", Src: "/a/old.pdf"},
		{Time: t0, Run: "A", Action: "run-end", Status: "ok"},
		{Time: t0.Add(time.Hour), Run: "B", Action: "run-start", Status: "ok", Detail: "undo of A"},
		{Time: t0.Add(time.Hour), Run: "B", Dir: "dl", File: "x.pdf", Step: 1, Action: "undo-move", Status: "ok", Src: "/b/x.pdf", Dst: "/a/x.pdf"},
		{Time: t0.Add(time.Hour), Run: "B", Dir: "dl", File: "y.pdf", Step: 1, Action: "undo-rename", Status: "declined", Src: "/a/z.pdf", Dst: "/a/y.pdf"},
		{Time: t0.Add(time.Hour), Run: "B", Action: "run-end", Status: "ok"},
	} {
		w.Append(e)
	}
	runA := func() Run {
		t.Helper()
		runs, err := Runs(path, 0)
		if err != nil {
			t.Fatal(err)
		}
		for _, r := range runs {
			if r.ID == "A" {
				return r
			}
		}
		t.Fatal("no run A")
		return Run{}
	}
	if a := runA(); !a.Undone || !a.PartlyUndone {
		t.Errorf("after one of two reversals: %+v, want undone, partly", a)
	}
	t2 := t0.Add(2 * time.Hour)
	w.Append(Entry{Time: t2, Run: "C", Action: "run-start", Status: "ok", Detail: "undo of A"})
	w.Append(Entry{Time: t2, Run: "C", Dir: "dl", File: "y.pdf", Step: 1, Action: "undo-rename", Status: "ok", Src: "/a/z.pdf", Dst: "/a/y.pdf"})
	w.Append(Entry{Time: t2, Run: "C", Action: "run-end", Status: "ok"})
	w.Close()
	if a := runA(); !a.Undone || a.PartlyUndone {
		t.Errorf("after both reversals: %+v, want undone in full", a)
	}
}

// TestRunsIgnoresAPermanentlyDeletedFilesSteps: a file whose chain ended
// in a permanent delete can never be undone, so its earlier steps do not
// keep the run partly undone forever.
func TestRunsIgnoresAPermanentlyDeletedFilesSteps(t *testing.T) {
	path := filepath.Join(t.TempDir(), "krino.log")
	w, _ := Open(path)
	t0 := time.Date(2026, 9, 11, 9, 0, 0, 0, time.UTC)
	for _, e := range []Entry{
		{Time: t0, Run: "A", Action: "run-start", Status: "ok"},
		{Time: t0, Run: "A", Dir: "dl", File: "x.pdf", Step: 1, Action: "move", Status: "ok", Src: "/a/x.pdf", Dst: "/b/x.pdf"},
		{Time: t0, Run: "A", Dir: "dl", File: "y.pdf", Step: 1, Action: "rename", Status: "ok", Src: "/a/y.pdf", Dst: "/a/z.pdf"},
		{Time: t0, Run: "A", Dir: "dl", File: "y.pdf", Step: 2, Action: "delete", Status: "ok", Src: "/a/z.pdf"},
		{Time: t0, Run: "A", Action: "run-end", Status: "ok"},
		{Time: t0.Add(time.Hour), Run: "B", Action: "run-start", Status: "ok", Detail: "undo of A"},
		{Time: t0.Add(time.Hour), Run: "B", Dir: "dl", File: "x.pdf", Step: 1, Action: "undo-move", Status: "ok", Src: "/b/x.pdf", Dst: "/a/x.pdf"},
		{Time: t0.Add(time.Hour), Run: "B", Action: "run-end", Status: "ok"},
	} {
		w.Append(e)
	}
	w.Close()
	runs, err := Runs(path, 0)
	if err != nil {
		t.Fatal(err)
	}
	for _, r := range runs {
		if r.ID == "A" && (!r.Undone || r.PartlyUndone) {
			t.Errorf("run A = %+v; want undone in full: y.pdf could never be reversed", r)
		}
	}
}