XFESystem

param(
    [Parameter(Mandatory=$true)][string]$Image,
    [Parameter(Mandatory=$true)][string]$BootResult,
    [ValidateSet('CSharpExperimental128','IndependentCSharp128')][string]$ImageProfile='CSharpExperimental128',
    [string]$PythonPath='python'
)
$ErrorActionPreference='Stop'
$testDirectory=Join-Path ([IO.Path]::GetTempPath()) ('xfe-media-plan-'+[Guid]::NewGuid().ToString('N'))
[void][IO.Directory]::CreateDirectory($testDirectory)
$writer=Join-Path $PSScriptRoot 'physical-media.ps1'
$global:XfeMediaTestDiskCalls=0
$global:XfeMediaTestMockSerial='230222336207'
$global:XfeMediaTestMockSystem=$false
$global:XfeMediaTestMockSize=[uint64]256060514304
$global:XfeMediaTestMockPartSize=[uint64]1000000
# These functions shadow Windows Storage cmdlets inside this isolated process.
# Any state-changing command is an immediate test failure.
function Get-Disk {
    param($Number,$ErrorAction)
    $global:XfeMediaTestDiskCalls++
    [pscustomobject]@{Number=$Number;UniqueId='5000000000002AEF';SerialNumber=$global:XfeMediaTestMockSerial;
        Size=$global:XfeMediaTestMockSize;LogicalSectorSize=512;BusType='USB';IsSystem=$global:XfeMediaTestMockSystem;
        IsBoot=$false;IsReadOnly=$false;IsOffline=$true;FriendlyName='mock dedicated USB'}
}
function Get-Partition {
    param($DiskNumber,$ErrorAction)
    [pscustomobject]@{PartitionNumber=1;Offset=[uint64]1048576;Size=$global:XfeMediaTestMockPartSize;
        GptType='c12a7328-f81f-11d2-ba4b-00a0c93ec93b';Type='System';IsSystem=$false;
        IsBoot=$false;DriveLetter=$null;AccessPaths=@()}
}
function Set-Disk { throw 'Tests must never mutate a disk.' }
function New-Object {
    param([string]$TypeName,[object[]]$ArgumentList)
    if($TypeName -cne 'Security.Principal.WindowsPrincipal'){throw ('Unexpected object creation in isolated media test: '+$TypeName)}
    # Reach regular-file evidence locking without requiring this mock test
    # process to be elevated. Set-Disk remains an unconditional stop and all
    # disk enumeration/partition calls are the mock functions above.
    $mockPrincipal=[pscustomobject]@{TestOnly=$true}
    $mockPrincipal | Add-Member -MemberType ScriptMethod -Name IsInRole -Value {param($role) return $true}
    return $mockPrincipal
}
function Refuse([string]$Name,[hashtable]$Extra) {
    $path=Join-Path $testDirectory ($Name+'.json')
    $rejected=$false
    try { & $writer -Image $Image -DiskNumber 99 -ImageProfile $ImageProfile -BootResult $BootResult -PythonPath $PythonPath -ResultPath $path @Extra | Out-Null }
    catch {$rejected=$true}
    if(-not $rejected){throw ('Expected rejection: '+$Name)}
    $log=Get-Content -LiteralPath $path -Raw -Encoding UTF8|ConvertFrom-Json
    if($log.Status -cne 'failed' -or $log.PhysicalDiskOpened -ne $false -or $log.FullReleaseQualified -ne $false){throw ('Failure log inaccurate: '+$Name)}
}
try {
    $planPath=Join-Path $testDirectory 'plan.json'
    $resultPath=Join-Path $testDirectory 'plan-result.json'
    & $writer -Image $Image -DiskNumber 99 -ImageProfile $ImageProfile -BootResult $BootResult -PythonPath $PythonPath -PlanPath $planPath -ResultPath $resultPath | Out-Null
    $plan=Get-Content -LiteralPath $planPath -Raw -Encoding UTF8|ConvertFrom-Json
    $log=Get-Content -LiteralPath $resultPath -Raw -Encoding UTF8|ConvertFrom-Json
    if($plan.image_profile -cne $ImageProfile -or $plan.image_bytes -ne 128MB -or $plan.confirm_token -notmatch '^[0-9a-f]{64}$' -or
        $plan.full_release_qualified -ne $false -or $plan.stability_passed -ne $false -or $plan.cuda_execution_verified -ne $false -or $plan.gpu_rasterization_verified -ne $false -or
        $log.Status -cne 'planned' -or $log.PhysicalDiskOpened -ne $false -or $log.HandlesClosed -ne $true){throw 'Experimental dry-run plan or structured log is inaccurate.'}
    # Exercise actual regular-file locks for image, manifest, boot receipt,
    # source snapshot and this profile's kernel configuration. The first disk
    # mutation is mocked to throw, before any raw drive can be opened.
    # An earlier lock/path failure must not count as passing this check.
    Refuse 'source-evidence-locks' @{Write=$true;ConfirmToken=$plan.confirm_token}
    $lockResult=Get-Content -LiteralPath (Join-Path $testDirectory 'source-evidence-locks.json') -Raw -Encoding UTF8|ConvertFrom-Json
    if($lockResult.Error -cne 'Tests must never mutate a disk.' -or $lockResult.Stage -cne 'locking-source-and-evidence' -or
       $lockResult.HandlesClosed -ne $true){throw ('Image/evidence/configuration locks did not finish before the mocked disk mutation: '+$lockResult.Error)}
    Refuse 'wrong-token' @{Write=$true;ConfirmToken=('0'*64)}
    $global:XfeMediaTestMockPartSize++
    Refuse 'changed-partitions' @{Write=$true;ConfirmToken=$plan.confirm_token}
    $global:XfeMediaTestMockPartSize--
    $global:XfeMediaTestMockSerial='wrong-device'
    Refuse 'wrong-serial' @{}
    $global:XfeMediaTestMockSerial='230222336207'
    $global:XfeMediaTestMockSystem=$true
    Refuse 'system-disk' @{}
    $global:XfeMediaTestMockSystem=$false
    $global:XfeMediaTestMockSize=262144
    Refuse 'tiny-addressing-boundary' @{}
    $global:XfeMediaTestMockSize=[uint64]256060514304
    $before=$global:XfeMediaTestDiskCalls
    $rejected=$false
    try { & $writer -Image $Image -DiskNumber 99 -ResultPath (Join-Path $testDirectory 'legacy-refusal.json') | Out-Null } catch {$rejected=$true}
    if(-not $rejected -or $global:XfeMediaTestDiskCalls -ne $before){throw 'The default legacy profile implicitly accepted the C# layout.'}
    Write-Host 'EXPERIMENTAL_MEDIA_PLAN_OK: exact image/receipt/source proof; explicit profile; identity/system/tiny-disk/token/partition refusal; structured logs. All Storage cmdlets mocked; no physical disks accessed.'
} finally {
    # Only explicitly created, resolved temporary files are removed.
    $resolved=[IO.Path]::GetFullPath($testDirectory)
    $tempRoot=[IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\')+'\'
    if(-not $resolved.StartsWith($tempRoot,[StringComparison]::OrdinalIgnoreCase)){throw 'Unexpected test directory boundary.'}
    Remove-Item -LiteralPath $resolved -Recurse -Force
}