felhom-controller/controller/internal/report/escrow_presence_wiring_test.go

package report

import (
	"go/ast"
	"go/parser"
	"go/token"
	"testing"
)

// TestMainWiresRecordPresence — the seam-discipline test (§9 rule 6).
//
// `RecordPresence` is a nil-able field: an unwired confirmer compiles, every test in this package
// passes, the fleet reports nothing new, and the whole of R-204 item 4 is inert. That is this
// project's most-repeated failure shape — six features built and never wired, one of them an off-site
// restage event that existed and never fired once.
//
// It walks the AST of main.go rather than grepping the file, because a commented-out field still
// contains the string (the lesson from the lifecycle-gate wiring test next door), and it parses with
// comments DROPPED so a commented assignment cannot satisfy it.
func TestMainWiresRecordPresence(t *testing.T) {
	const mainPath = "../../cmd/controller/main.go"
	fset := token.NewFileSet()
	f, err := parser.ParseFile(fset, mainPath, nil, 0) // comments dropped on purpose
	if err != nil {
		t.Fatalf("parse %s: %v — the wiring of RecordPresence is now unasserted", mainPath, err)
	}

	found := false
	sawConfirmerLiteral := false
	ast.Inspect(f, func(n ast.Node) bool {
		lit, ok := n.(*ast.CompositeLit)
		if !ok {
			return true
		}
		// Match `report.EscrowAutoConfirmer{...}` (and a bare `EscrowAutoConfirmer{...}`).
		name := ""
		switch t := lit.Type.(type) {
		case *ast.SelectorExpr:
			name = t.Sel.Name
		case *ast.Ident:
			name = t.Name
		}
		if name != "EscrowAutoConfirmer" {
			return true
		}
		sawConfirmerLiteral = true
		for _, el := range lit.Elts {
			kv, ok := el.(*ast.KeyValueExpr)
			if !ok {
				continue
			}
			if k, ok := kv.Key.(*ast.Ident); ok && k.Name == "RecordPresence" {
				found = true
			}
		}
		return true
	})

	// Distinguish "the literal moved" from "the field was dropped" — otherwise a refactor that
	// relocated the confirmer would read as a passing test over nothing (the §12 rule: an absent
	// thing is not evidence).
	if !sawConfirmerLiteral {
		t.Fatalf("no EscrowAutoConfirmer composite literal found in %s — did the wiring move? This test can no longer see it", mainPath)
	}
	if !found {
		t.Fatal("EscrowAutoConfirmer is constructed WITHOUT RecordPresence — the box will never learn the hub holds its recovery package, and R-204 item 4 ships inert")
	}
}

// confirmerFieldIsWired is the generalised form of the walk above: it reports whether
// `EscrowAutoConfirmer{...}` in main.go assigns `field`, and whether the literal was found at all.
// Comments are dropped on purpose, so a commented-out assignment cannot satisfy it.
func confirmerFieldIsWired(t *testing.T, field string) (found, sawLiteral bool) {
	t.Helper()
	const mainPath = "../../cmd/controller/main.go"
	fset := token.NewFileSet()
	f, err := parser.ParseFile(fset, mainPath, nil, 0)
	if err != nil {
		t.Fatalf("parse %s: %v — the wiring of %s is now unasserted", mainPath, err, field)
	}
	ast.Inspect(f, func(n ast.Node) bool {
		lit, ok := n.(*ast.CompositeLit)
		if !ok {
			return true
		}
		name := ""
		switch tt := lit.Type.(type) {
		case *ast.SelectorExpr:
			name = tt.Sel.Name
		case *ast.Ident:
			name = tt.Name
		}
		if name != "EscrowAutoConfirmer" {
			return true
		}
		sawLiteral = true
		for _, el := range lit.Elts {
			kv, ok := el.(*ast.KeyValueExpr)
			if !ok {
				continue
			}
			if k, ok := kv.Key.(*ast.Ident); ok && k.Name == field {
				found = true
			}
		}
		return true
	})
	return found, sawLiteral
}

// TestMainWiresRecordEscrowKeyHash — R-241's seam-discipline test, and it matters more than most.
//
// `RecordEscrowKeyHash` is nil-able exactly like `RecordPresence`. Unwired, the confirmer still
// compiles, every test in this package still passes, the auto-confirm still works — and
// `OffsiteRecoveryOffer`'s shape (c) reads an empty hash forever, silently falling back to the two
// proxies that R-241 proved insufficient. **The fix would ship inert, in precisely the shape the
// spike found: a correct answer computed and kept nowhere.**
func TestMainWiresRecordEscrowKeyHash(t *testing.T) {
	found, sawLiteral := confirmerFieldIsWired(t, "RecordEscrowKeyHash")
	if !sawLiteral {
		t.Fatal("no EscrowAutoConfirmer composite literal found in main.go — did the wiring move? This test can no longer see it")
	}
	if !found {
		t.Fatal("EscrowAutoConfirmer is constructed WITHOUT RecordEscrowKeyHash — the hub's escrowed-key hash is never persisted, so the recovery screen's shape (c) can never fire and R-241 ships inert")
	}
}