pharos_native/runtime/social_connections/

browser.rs

//! Native desktop website authorization with persistent profiles and encrypted owner session checkpoints.
use super::*;
use pharos_runtime_integrations::browser::{Browser, BrowserError};
use pharos_runtime_social::browser as sessions;
use std::sync::{Arc, Mutex, OnceLock};

struct PendingBrowser {
    scope: ConnectionScope,
    provider: SocialProvider,
    session: String,
    browser: Browser,
    target: String,
    previous: Option<ConnectionRecord>,
    created: std::time::Instant,
}
type PendingMap = std::collections::BTreeMap<String, Arc<Mutex<PendingBrowser>>>;
/// Keeps private browser handles out of metadata, exports and HTTP responses.
fn registry() -> &'static Mutex<PendingMap> {
    static REGISTRY: OnceLock<Mutex<PendingMap>> = OnceLock::new();
    REGISTRY.get_or_init(|| Mutex::new(PendingMap::new()))
}
/// Serializes owner UI transitions without holding the global registry lock during browser IO.
fn operation_lock(
    scope: &ConnectionScope,
    provider: SocialProvider,
) -> Result<Arc<Mutex<()>>, SocialError> {
    static LOCKS: OnceLock<Mutex<std::collections::BTreeMap<String, Arc<Mutex<()>>>>> =
        OnceLock::new();
    let mut locks = LOCKS
        .get_or_init(|| Mutex::new(std::collections::BTreeMap::new()))
        .lock()
        .map_err(|_| SocialError::Busy)?;
    locks.retain(|_, value| Arc::strong_count(value) > 1);
    if locks.len() >= 256 {
        return Err(SocialError::Busy);
    }
    Ok(locks
        .entry(reference(scope, provider))
        .or_insert_with(|| Arc::new(Mutex::new(())))
        .clone())
}
/// Derives a stable persistent profile identity without trusting form-supplied paths or owner identifiers.
fn reference(scope: &ConnectionScope, provider: SocialProvider) -> String {
    dynamic::hex_digest(&Sha256::digest(
        format!(
            "{}\0{}\0{}\0{}",
            scope.application(),
            scope.namespace(),
            scope.owner(),
            provider.key()
        )
        .as_bytes(),
    ))
}
/// Reads browser enablement only from the trusted serving configuration, never an imported app source.
fn executable(app: &AppRuntime) -> Result<PathBuf, SocialError> {
    let conf = if app.is_editor_preview {
        OPERATOR_CONFIG
            .read()
            .map_err(|_| SocialError::Configuration)?
            .clone()
    } else {
        app.runtime_conf_path.clone()
    }
    .ok_or(SocialError::Configuration)?;
    let conf = Path::new(&conf);
    if config::dynamic_config_lookup_raw(conf, "SOCIAL_BROWSER_MODE").as_deref() != Some("local") {
        return Err(SocialError::UnsupportedProvider);
    }
    let path = config::dynamic_config_lookup_raw(conf, "SOCIAL_BROWSER_EXECUTABLE")
        .filter(|value| !value.is_empty())
        .map(PathBuf::from)
        .or_else(|| {
            [
                "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
                "/usr/bin/chromium",
                "/usr/bin/google-chrome",
            ]
            .iter()
            .map(PathBuf::from)
            .find(|path| path.is_file())
        })
        .ok_or(SocialError::Configuration)?;
    if !path.is_absolute() || !path.is_file() {
        return Err(SocialError::Configuration);
    }
    Ok(path)
}
/// Resolves an external persistent browser area; installed app replacement cannot remove login state.
fn profile(
    app: &AppRuntime,
    scope: &ConnectionScope,
    provider: SocialProvider,
) -> Result<PathBuf, SocialError> {
    let root = app
        .state_path
        .as_deref()
        .and_then(|path| Path::new(path).parent())
        .ok_or(SocialError::Configuration)?;
    for installed in [app.app_root.as_deref(), app.artifact_dir.as_deref()]
        .into_iter()
        .flatten()
    {
        if root.starts_with(installed) {
            return Err(SocialError::Configuration);
        }
    }
    let root = root.join("browser-sessions");
    stdfs::create_dir_all(&root).map_err(|_| SocialError::Transport)?;
    use std::os::unix::fs::PermissionsExt;
    if stdfs::symlink_metadata(&root)
        .map_err(|_| SocialError::Transport)?
        .file_type()
        .is_symlink()
    {
        return Err(SocialError::Forbidden);
    }
    stdfs::set_permissions(&root, stdfs::Permissions::from_mode(0o700))
        .map_err(|_| SocialError::Transport)?;
    Ok(root.join(reference(scope, provider)))
}
/// Maps only fixed browser diagnostics; no protocol responses, cookies or profile paths enter user errors.
fn error(error: BrowserError) -> SocialError {
    match error {
        BrowserError::Blocked => SocialError::Forbidden,
        BrowserError::Capacity => SocialError::Capacity,
        BrowserError::Closed | BrowserError::Unavailable => SocialError::Transport,
        BrowserError::InvalidResponse => SocialError::InvalidResponse,
    }
}
/// Finds only this authenticated owner's active sign-in, additionally bound to its initiating local session.
fn pending(
    scope: &ConnectionScope,
    provider: SocialProvider,
    session: &str,
) -> Result<Option<Arc<Mutex<PendingBrowser>>>, SocialError> {
    let handle = registry()
        .lock()
        .map_err(|_| SocialError::Busy)?
        .get(&reference(scope, provider))
        .cloned();
    if let Some(handle) = &handle {
        let value = handle.lock().map_err(|_| SocialError::Busy)?;
        if value.scope != *scope || value.provider != provider || value.session != session {
            return Err(SocialError::Busy);
        }
    }
    Ok(handle)
}
/// Stops expired or user-closed windows while retaining their profile and saved authentication state.
pub(super) fn maintenance() {
    let handles = match registry().lock() {
        Ok(map) => map
            .iter()
            .map(|(key, value)| (key.clone(), value.clone()))
            .collect::<Vec<_>>(),
        Err(_) => return,
    };
    for (key, handle) in handles {
        let expired = handle.try_lock().is_ok_and(|mut value| {
            value.created.elapsed() > Duration::from_secs(1200) || !value.browser.is_open()
        });
        if expired {
            let removed = registry().lock().ok().and_then(|mut map| map.remove(&key));
            drop(removed);
        }
    }
}
/// Closes only framework-owned browser processes on orderly shutdown; persistent profiles are preserved.
pub(super) fn shutdown() {
    let handles = registry()
        .lock()
        .map(|mut values| std::mem::take(&mut *values))
        .unwrap_or_default();
    drop(handles);
}
/// Handles the browser mode behind the same local authentication, capability, origin and CSRF gates as API mode.
#[allow(clippy::too_many_arguments)]
pub(super) fn handle(
    app: &AppRuntime,
    request: &http::HttpRequest,
    declaration: &Value,
    provider: SocialProvider,
    operation: &str,
    scope: &ConnectionScope,
    store: &database::LogicalAppStore,
    session: &str,
    capability: &str,
) -> Result<Vec<u8>, SocialError> {
    // Status reads durable metadata and must not wait behind a network-bound collection.
    let operation_lock = (operation != "status")
        .then(|| operation_lock(scope, provider))
        .transpose()?;
    let _operation_guard = operation_lock
        .as_ref()
        .map(|lock| lock.lock().map_err(|_| SocialError::Busy))
        .transpose()?;
    maintenance();
    let destination = return_destination(declaration)?;
    let available = executable(app).is_ok();
    let vault = vault(app)?;
    let guards = authority_guards(app, store, scope.owner(), capability, Some(session))?;
    let repository = ConnectionRepository {
        adapter: store.adapter.as_ref(),
        config: &store.config,
        schema: &store.schema,
        vault: &vault,
        guards: &guards,
    };
    let row = repository.browser(scope, provider)?;
    if operation == "status" {
        let pending = pending(scope, provider, session)?;
        if request.target.contains("format=json") || request.target.contains("format%3Djson") {
            let page_ready = if let Some(handle) = &pending {
                let mut value = handle.lock().map_err(|_| SocialError::Busy)?;
                let target = value.target.clone();
                value.browser.page_ready(&target).unwrap_or(false)
            } else {
                false
            };
            return Ok(http_json_response(200,"OK",&json!({"provider":provider.key(),"mode":"browser","page_ready":page_ready,"configured":available,"connection_scope":"owner","namespace":scope.namespace(),"authorization_pending":pending.is_some(),"connection":row}).to_string(),&request.method));
        }
        return status_response(
            app,
            request,
            declaration,
            None,
            provider,
            scope,
            row,
            session,
            None,
            Some(BrowserStatus {
                available,
                pending: pending.is_some(),
            }),
        );
    }
    match operation {
        "connect" => {
            if super::super::runtime_shutdown_requested() {
                return Err(SocialError::Busy);
            }
            if pending(scope, provider, session)?.is_some() {
                return Err(SocialError::Busy);
            }
            let executable = executable(app)?;
            let profile = profile(app, scope, provider)?;
            let mut sign_in_hosts =
                if provider == SocialProvider::X || provider.needs_account_page() {
                    pharos_runtime_integrations::browser::GOOGLE_SIGN_IN_HOSTS.to_vec()
                } else {
                    Vec::new()
                };
            if provider.needs_account_page() {
                sign_in_hosts
                    .extend_from_slice(pharos_runtime_integrations::browser::ACCOUNT_SIGN_IN_HOSTS);
            }
            let mut browser = Browser::launch_with_sign_in_hosts(
                &executable,
                &profile,
                sessions::domains(provider),
                true,
                &sign_in_hosts,
            )
            .map_err(error)?;
            if let Some(row) = row.as_ref().filter(|row| !row.credential_ref.is_empty()) {
                let cookies = checkpoint_for_retained_profile(&repository, scope, provider, row)?;
                match restore_retained_session(
                    &mut browser,
                    provider,
                    &row.account_id,
                    cookies.as_deref().map(String::as_str).unwrap_or_default(),
                ) {
                    Ok(()) | Err(SocialError::AuthorizationRequired) => {}
                    Err(problem) => return Err(problem),
                }
            }
            let target = browser.open(sessions::home(provider)).map_err(error)?;
            let handle = Arc::new(Mutex::new(PendingBrowser {
                scope: scope.clone(),
                provider,
                session: session.into(),
                browser,
                target,
                previous: row,
                created: std::time::Instant::now(),
            }));
            let mut map = registry().lock().map_err(|_| SocialError::Busy)?;
            if map.len() >= 4 || map.contains_key(&reference(scope, provider)) {
                return Err(SocialError::Busy);
            }
            map.insert(reference(scope, provider), handle);
        }
        "finish" => {
            let Some(handle) = pending(scope, provider, session)? else {
                return status_response(
                    app,
                    request,
                    declaration,
                    None,
                    provider,
                    scope,
                    row,
                    session,
                    None,
                    Some(BrowserStatus {
                        available,
                        pending: false,
                    }),
                );
            };
            let mut value = handle.lock().map_err(|_| SocialError::Busy)?;
            let target = value.target.clone();
            let ready = match value.browser.authentication_ready(&target) {
                Ok(ready) => ready,
                Err(problem) => {
                    eprintln!(
                        "browser connection navigation check unavailable: {}",
                        error(problem).code()
                    );
                    false
                }
            };
            if !ready {
                return status_response(
                    app,
                    request,
                    declaration,
                    None,
                    provider,
                    scope,
                    row,
                    session,
                    None,
                    Some(BrowserStatus {
                        available,
                        pending: true,
                    }),
                );
            }
            let cookies = match value.browser.cookies() {
                Ok(cookies) => cookies,
                Err(problem) => {
                    eprintln!(
                        "browser connection cookie checkpoint unavailable: {}",
                        error(problem).code()
                    );
                    consent_ui::record(scope, provider, session, Some(consent_ui::Outcome::Failed));
                    return status_response(
                        app,
                        request,
                        declaration,
                        None,
                        provider,
                        scope,
                        row,
                        session,
                        None,
                        Some(BrowserStatus {
                            available,
                            pending: true,
                        }),
                    );
                }
            };
            let identity = if provider.needs_account_page() {
                value
                    .browser
                    .account_identity(&target, provider.key())
                    .map_err(error)?
                    .map(|identity| {
                        dynamic::hex_digest(&Sha256::digest(
                            format!("{}\0{identity}", provider.key()).as_bytes(),
                        ))
                    })
            } else {
                sessions::account(provider, &cookies).ok()
            };
            if identity.as_deref().is_none_or(|identity| {
                sessions::account_with_identity(provider, &cookies, Some(identity)).is_err()
            }) {
                return status_response(
                    app,
                    request,
                    declaration,
                    None,
                    provider,
                    scope,
                    row,
                    session,
                    None,
                    Some(BrowserStatus {
                        available,
                        pending: true,
                    }),
                );
            }
            let identity = identity.ok_or(SocialError::AuthorizationRequired)?;
            require_session(store, session, scope.owner())?;
            let saved = match repository.save_browser_identity(
                scope,
                provider,
                value.previous.as_ref(),
                &cookies,
                &identity,
            ) {
                Ok(row) => row,
                Err(error) => {
                    eprintln!("browser connection checkpoint failed: {}", error.code());
                    consent_ui::record(scope, provider, session, Some(consent_ui::Outcome::Failed));
                    return status_response(
                        app,
                        request,
                        declaration,
                        None,
                        provider,
                        scope,
                        row,
                        session,
                        None,
                        Some(BrowserStatus {
                            available,
                            pending: true,
                        }),
                    );
                }
            };
            consent_ui::record(scope, provider, session, None);
            value.browser.close();
            drop(value);
            let removed = registry()
                .lock()
                .map_err(|_| SocialError::Busy)?
                .remove(&reference(scope, provider));
            drop(removed);
            use pharos_runtime_database::operations::{Mutation, Predicate};
            let mut completion_guards = guards.clone();
            completion_guards.push(Mutation::RequireCount {
                entity: "social_connection".into(),
                filter: Predicate::All(vec![
                    Predicate::Equal("application".into(), json!(scope.application())),
                    Predicate::Equal("namespace".into(), json!(scope.namespace())),
                    Predicate::Equal("owner".into(), json!(scope.owner())),
                    Predicate::Equal("provider".into(), json!(saved.provider)),
                    Predicate::Equal("revision".into(), json!(saved.revision)),
                    Predicate::Equal("status".into(), json!("connected")),
                ]),
                minimum: 1,
                maximum: Some(1),
            });
            if super::super::event_discovery::social_connection_available(
                app,
                provider,
                &completion_guards,
            )
            .is_err()
            {
                eprintln!("event sources could not be rescheduled after browser connection");
            }
            return status_response(
                app,
                request,
                declaration,
                None,
                provider,
                scope,
                Some(saved),
                session,
                None,
                Some(BrowserStatus {
                    available,
                    pending: false,
                }),
            );
        }
        "cancel" => {
            let _ = pending(scope, provider, session)?;
            let removed = registry()
                .lock()
                .map_err(|_| SocialError::Busy)?
                .remove(&reference(scope, provider));
            drop(removed);
        }
        "disconnect" => {
            let _ = pending(scope, provider, session)?;
            let revoked = row
                .as_ref()
                .filter(|row| row.status != "disconnected" || !row.credential_ref.is_empty())
                .map(|row| repository.disconnect(row))
                .transpose()?;
            let removed = registry()
                .lock()
                .map_err(|_| SocialError::Busy)?
                .remove(&reference(scope, provider));
            drop(removed);
            let profile = profile(app, scope, provider)?;
            if profile.exists() {
                if stdfs::symlink_metadata(&profile)
                    .map_err(|_| SocialError::Transport)?
                    .file_type()
                    .is_symlink()
                {
                    return Err(SocialError::Forbidden);
                }
                stdfs::remove_dir_all(profile).map_err(|_| SocialError::Transport)?;
            }
            if let Some(row) = revoked {
                repository.finish_disconnect(&row)?;
            }
        }
        _ => return Err(SocialError::Forbidden),
    }
    Ok(http_route_redirect_for_request(
        request,
        &app_scope_path(app, destination),
    ))
}

/// Resolves an explicitly requested unique connected owner without borrowing another namespace or guessing among grants.
fn selected_owner(app: &AppRuntime, provider: SocialProvider) -> Result<Option<i64>, SocialError> {
    use pharos_runtime_database::operations::{Predicate, Query};
    let declaration = dynamic::dynamic_contract_doc(app, "social_connections_contract")
        .ok_or(SocialError::Configuration)?;
    if declaration.get("collection_owner").and_then(Value::as_str) != Some("connected") {
        return Ok(None);
    }
    let scope = scope(app, 1)?;
    let store = app_database_operations(app).ok_or(SocialError::Configuration)?;
    let rows = store
        .adapter
        .query(
            &store.config,
            &store.schema,
            &Query {
                entity: "social_connection".into(),
                fields: vec!["owner".into()],
                filter: Some(Predicate::All(vec![
                    Predicate::Equal("application".into(), json!(scope.application())),
                    Predicate::Equal("namespace".into(), json!(scope.namespace())),
                    Predicate::Equal("provider".into(), json!(sessions::key(provider))),
                    Predicate::Equal("status".into(), json!("connected")),
                ])),
                order: vec![],
                limit: 2,
                offset: 0,
            },
        )
        .map_err(|_| SocialError::Transport)?;
    if rows.len() != 1 {
        return Err(SocialError::AuthorizationRequired);
    }
    Ok(Some(
        rows[0]
            .get("owner")
            .and_then(Value::as_i64)
            .filter(|owner| *owner > 0)
            .ok_or(SocialError::Configuration)?,
    ))
}
/// Allows recovery from a missing checkpoint only through the same scope-bound profile and recorded provider account.
fn checkpoint_for_retained_profile(
    repository: &ConnectionRepository<'_>,
    scope: &ConnectionScope,
    provider: SocialProvider,
    row: &ConnectionRecord,
) -> Result<Option<zeroize::Zeroizing<String>>, SocialError> {
    match repository.browser_reconnect_cookies(scope, provider, row) {
        Ok(cookies) => Ok(Some(cookies)),
        Err(SocialError::AuthorizationRequired)
            if row.application == scope.application()
                && row.namespace == scope.namespace()
                && row.owner == scope.owner()
                && row.provider == sessions::key(provider)
                && !row.account_id.is_empty()
                && matches!(
                    row.status.as_str(),
                    "connected" | "reauthorization_required" | "disconnected"
                ) =>
        {
            Ok(None)
        }
        Err(problem) => Err(problem),
    }
}

/// Keeps newer provider cookies from the retained profile instead of replaying an older vault checkpoint.
fn restore_retained_session(
    browser: &mut Browser,
    provider: SocialProvider,
    account_id: &str,
    checkpoint: &str,
) -> Result<(), SocialError> {
    let retained = browser.cookies().map_err(error)?;
    // Account-page providers are verified again before promotion; cookie presence alone never saves a connection.
    match sessions::account_with_identity(provider, &retained, Some(account_id)) {
        Ok(account) if account == account_id => Ok(()),
        Ok(_) => Err(SocialError::Forbidden),
        Err(_) if checkpoint.is_empty() => Err(SocialError::AuthorizationRequired),
        Err(_) => browser.restore(checkpoint).map_err(error),
    }
}

/// Checks the provider home separately so an unavailable artist resource cannot expire the owner's whole connection.
fn provider_home_ready(
    browser: &mut Browser,
    provider: SocialProvider,
) -> Result<bool, SocialError> {
    let target = browser.open(sessions::home(provider)).map_err(error)?;
    let started = std::time::Instant::now();
    loop {
        if started.elapsed() >= Duration::from_secs(2)
            && browser.page_ready(&target).map_err(error)?
            && browser.authentication_ready(&target).map_err(error)?
        {
            return Ok(true);
        }
        if started.elapsed() >= Duration::from_secs(5) {
            return Ok(false);
        }
        std::thread::sleep(Duration::from_millis(250));
    }
}

/// Persists a still-valid provider session after a resource failure, or requests owner sign-in only when home is also blocked.
fn settle_blocked_resource(
    browser: &mut Browser,
    repository: &ConnectionRepository<'_>,
    scope: &ConnectionScope,
    provider: SocialProvider,
    leased: &ConnectionRecord,
) -> Result<(), SocialError> {
    if provider_home_ready(browser, provider)? {
        let retained = browser.cookies().map_err(error)?;
        if sessions::account(provider, &retained).ok().as_deref()
            == Some(leased.account_id.as_str())
        {
            repository.save_browser(scope, provider, Some(leased), &retained)?;
            return Ok(());
        }
    }
    repository.browser_needs_login(leased)
}

/// Collects one bounded rendered page under durable owner/connection authority and retains private evidence.
pub(super) fn observations(
    app: &AppRuntime,
    profile_url: &str,
) -> Result<ObservationBatch, SocialError> {
    use pharos_runtime_database::operations::{Mutation, Predicate, Transaction, WriteValue};
    let parsed = Url::parse(profile_url).map_err(|_| SocialError::InvalidResponse)?;
    let provider = SocialProvider::from_url(&parsed).ok_or(SocialError::UnsupportedProvider)?;
    let selected = selected_owner(app, provider).inspect_err(|problem| {
        eprintln!(
            "social collection owner unavailable: provider={} code={}",
            provider.key(),
            problem.code()
        );
    })?;
    let (scope, store) = collection_authority(app, selected).inspect_err(|problem| {
        eprintln!(
            "social collection authority unavailable: provider={} code={}",
            provider.key(),
            problem.code()
        );
    })?;
    let operation_lock = operation_lock(&scope, provider)?;
    let _operation_guard = operation_lock.lock().map_err(|_| SocialError::Busy)?;
    if registry()
        .lock()
        .map_err(|_| SocialError::Busy)?
        .contains_key(&reference(&scope, provider))
    {
        return Err(SocialError::Busy);
    }
    let declaration = dynamic::dynamic_contract_doc(app, "social_connections_contract")
        .ok_or(SocialError::Configuration)?;
    let capability = declaration
        .get("owner_capability")
        .and_then(Value::as_str)
        .ok_or(SocialError::Configuration)?;
    let guards = authority_guards(app, &store, scope.owner(), capability, None)?;
    let vault = vault(app)?;
    let repository = ConnectionRepository {
        adapter: store.adapter.as_ref(),
        config: &store.config,
        schema: &store.schema,
        vault: &vault,
        guards: &guards,
    };
    let row = repository
        .browser(&scope, provider)?
        .ok_or(SocialError::AuthorizationRequired)?;
    let now = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .map_err(|_| SocialError::Configuration)?
        .as_secs() as i64;
    let cookies = checkpoint_for_retained_profile(&repository, &scope, provider, &row)?;
    let leased = repository.lease_refresh(&row, now)?;
    let mut checkpoint_saved = false;
    let result = (|| {
        let mut browser = Browser::launch(
            &executable(app)?,
            &profile(app, &scope, provider)?,
            sessions::domains(provider),
            false,
        )
        .map_err(error)?;
        if let Err(problem) = restore_retained_session(
            &mut browser,
            provider,
            &row.account_id,
            cookies.as_deref().map(String::as_str).unwrap_or_default(),
        ) {
            if problem == SocialError::AuthorizationRequired {
                repository.browser_needs_login(&leased)?;
            }
            return Err(problem);
        }
        let restored = browser.cookies().map_err(error)?;
        if sessions::account(provider, &restored).ok().as_deref() != Some(row.account_id.as_str()) {
            repository.browser_needs_login(&leased)?;
            return Err(SocialError::AuthorizationRequired);
        }
        let target = browser.open(profile_url).map_err(error)?;
        let collection_started = std::time::Instant::now();
        let mut poster_budget = 2;
        let mut date_budget = 8;
        let snapshot = collection_snapshot(
            app,
            &mut browser,
            &target,
            profile_url,
            profile_url,
            &mut poster_budget,
            &mut date_budget,
        );
        let mut snapshot = match snapshot {
            Ok(snapshot) => snapshot,
            Err(SocialError::AuthorizationRequired) => {
                eprintln!(
                    "social artist resource redirected: provider={}",
                    provider.key()
                );
                settle_blocked_resource(&mut browser, &repository, &scope, provider, &leased)?;
                return Err(SocialError::AuthorizationRequired);
            }
            Err(error) => return Err(error),
        };
        let resources = snapshot
            .get("post_resources")
            .and_then(Value::as_array)
            .cloned()
            .unwrap_or_default();
        let mut resource_count = 0;
        let mut detail_dates = Vec::new();
        let mut detail_diagnostics = Vec::new();
        for resource in resources.iter().filter_map(Value::as_str).take(4) {
            if collection_started.elapsed() >= Duration::from_secs(20) {
                break;
            }
            resource_count += 1;
            let post_target = match browser.open(resource) {
                Ok(target) => target,
                Err(problem) => {
                    eprintln!(
                        "browser optional detail unavailable: {}",
                        error(problem).code()
                    );
                    continue;
                }
            };
            let page = match collection_snapshot(
                app,
                &mut browser,
                &post_target,
                resource,
                profile_url,
                &mut poster_budget,
                &mut date_budget,
            ) {
                Ok(page) => page,
                Err(problem) => {
                    eprintln!("browser optional detail unavailable: {}", problem.code());
                    continue;
                }
            };
            let diagnostics = page.get("diagnostics").unwrap_or(&Value::Null);
            detail_diagnostics.push(json!({"headings":diagnostics.get("heading_count"),"messages":diagnostics.get("message_nodes"),"attributed":diagnostics.get("attributed"),"profile_links":diagnostics.get("profile_links"),"main_links":diagnostics.get("main_link_count"),"privacy":diagnostics.get("instagram_privacy")}));
            detail_dates.extend(
                page.pointer("/diagnostics/posting_dates")
                    .and_then(Value::as_array)
                    .into_iter()
                    .flatten()
                    .take(4)
                    .cloned(),
            );
            for key in ["posts", "links", "structured"] {
                let additions = page
                    .get(key)
                    .and_then(Value::as_array)
                    .cloned()
                    .unwrap_or_default();
                if let Some(values) = snapshot.get_mut(key).and_then(Value::as_array_mut) {
                    for value in additions.into_iter().take(20) {
                        if values.len() < 60 && !values.contains(&value) {
                            values.push(value);
                        }
                    }
                }
            }
        }
        snapshot["diagnostics"]["detail_pages"] = json!(resource_count);
        snapshot["diagnostics"]["detail_posting_dates"] = json!(detail_dates);
        snapshot["diagnostics"]["detail_views"] = json!(detail_diagnostics);
        snapshot["text"] = json!(
            snapshot
                .get("posts")
                .and_then(Value::as_array)
                .map(|posts| posts
                    .iter()
                    .filter_map(|post| post.get("text").and_then(Value::as_str))
                    .take(20)
                    .collect::<Vec<_>>()
                    .join("\n"))
                .unwrap_or_default()
        );
        let current = snapshot
            .get("url")
            .and_then(Value::as_str)
            .ok_or(SocialError::InvalidResponse)?;
        let refreshed = browser.cookies().map_err(error)?;
        if sessions::account(provider, &refreshed).ok().as_deref() != Some(row.account_id.as_str())
        {
            repository.browser_needs_login(&leased)?;
            return Err(SocialError::AuthorizationRequired);
        }
        if !browser.allowed_url(current)
            || snapshot.get("login").and_then(Value::as_bool) == Some(true)
        {
            eprintln!(
                "social artist resource login barrier: provider={}",
                provider.key()
            );
            settle_blocked_resource(&mut browser, &repository, &scope, provider, &leased)?;
            return Err(SocialError::AuthorizationRequired);
        }
        let row = repository.save_browser(&scope, provider, Some(&leased), &refreshed)?;
        checkpoint_saved = true;
        let mut evidence = snapshot
            .get("structured")
            .and_then(Value::as_array)
            .map(|values| values.iter().take(10).cloned().collect::<Vec<_>>())
            .unwrap_or_default();
        // Event links retain their source context even when the provider supplies no structured event declaration.
        for post in snapshot
            .get("posts")
            .and_then(Value::as_array)
            .into_iter()
            .flatten()
            .take(10)
        {
            let text = post.get("text").and_then(Value::as_str).unwrap_or("");
            let text = &text[..text.floor_char_boundary(3500)];
            if evidence.len() < 40
                && (!text.trim().is_empty()
                    || post
                        .get("image_text")
                        .and_then(Value::as_str)
                        .is_some_and(|text| !text.trim().is_empty()))
            {
                evidence.push(json!({"url":post.get("permalink").and_then(Value::as_str).unwrap_or(profile_url),"description":text,"source_profile":profile_url,"evidence_kind":"rendered_post","audience":post.get("audience"),"datePublished":post.get("published_at"),"publication_labels":post.get("publication_labels"),"image_text":post.get("image_text"),"image_status":post.get("image_status"),"author_url":post.get("author_url")}));
            }
            for link in post
                .get("links")
                .and_then(Value::as_array)
                .into_iter()
                .flatten()
                .filter_map(Value::as_str)
                .take(20)
            {
                if facebook_event_url(link).is_some() && evidence.len() < 40 {
                    evidence.push(json!({"evidence_kind":"rendered_post","url":link,"description":text,"source_profile":profile_url,"datePublished":post.get("published_at"),"publication_labels":post.get("publication_labels"),"image_text":post.get("image_text")}));
                    break;
                }
            }
        }
        let event_links = snapshot
            .get("links")
            .and_then(Value::as_array)
            .into_iter()
            .flatten()
            .filter_map(|link| link.get("url").and_then(Value::as_str))
            .filter_map(facebook_event_url)
            .collect::<std::collections::BTreeSet<_>>();
        for link in event_links
            .iter()
            .take(2usize.saturating_sub(resource_count))
        {
            let target = match browser.open(link) {
                Ok(target) => target,
                Err(problem) => {
                    eprintln!(
                        "browser optional detail unavailable: {}",
                        error(problem).code()
                    );
                    continue;
                }
            };
            let page = match collection_snapshot(
                app,
                &mut browser,
                &target,
                link,
                profile_url,
                &mut poster_budget,
                &mut date_budget,
            ) {
                Ok(page) => page,
                Err(problem) => {
                    eprintln!("browser optional detail unavailable: {}", problem.code());
                    continue;
                }
            };
            if page.get("login").and_then(Value::as_bool) == Some(true) {
                continue;
            }
            for value in page
                .get("structured")
                .and_then(Value::as_array)
                .into_iter()
                .flatten()
                .take(3)
            {
                if evidence.len() < 40 {
                    evidence.push(value.clone());
                }
            }
        }
        browser.close();
        let mut links = std::collections::BTreeSet::new();
        for item in snapshot
            .get("links")
            .and_then(Value::as_array)
            .into_iter()
            .flatten()
            .take(1000)
        {
            let Some(value) = item.get("url").and_then(Value::as_str) else {
                continue;
            };
            let Ok(mut url) = Url::parse(value) else {
                continue;
            };
            if matches!(
                url.host_str(),
                Some("l.facebook.com" | "lm.facebook.com" | "l.instagram.com")
            ) && let Some(value) = url
                .query_pairs()
                .find(|(key, _)| key == "u")
                .map(|(_, value)| value.into_owned())
                && let Ok(decoded) = Url::parse(&value)
            {
                url = decoded;
            }
            if url.scheme() == "https"
                && url.username().is_empty()
                && url.password().is_none()
                && url.as_str().len() <= 2048
            {
                if evidence.len() < 40 && SocialProvider::from_url(&url).is_none() {
                    let context = item.get("context").and_then(Value::as_str).unwrap_or("");
                    let context = &context[..context.floor_char_boundary(3500)];
                    evidence.push(json!({"evidence_kind":"rendered_link","url":url.as_str(),"description":context,"source_profile":profile_url,"datePublished":item.get("published_at"),"publication_labels":item.get("publication_labels"),"author_url":item.get("author_url")}));
                }
                links.insert(url.to_string());
            }
        }
        let mut guards = guards.clone();
        guards.push(Mutation::RequireCount {
            entity: "social_connection".into(),
            filter: Predicate::All(vec![
                Predicate::Equal("application".into(), json!(scope.application())),
                Predicate::Equal("namespace".into(), json!(scope.namespace())),
                Predicate::Equal("owner".into(), json!(scope.owner())),
                Predicate::Equal("provider".into(), json!(sessions::key(provider))),
                Predicate::Equal("revision".into(), json!(row.revision)),
                Predicate::Equal("status".into(), json!("connected")),
            ]),
            minimum: 1,
            maximum: Some(1),
        });
        let text = snapshot.get("text").and_then(Value::as_str).unwrap_or("");
        let text = format!(
            "Attributed browser posts v3; public evidence required before publication.\n{}\nCapture diagnostics: {}",
            &text[..text.floor_char_boundary(16000)],
            snapshot.get("diagnostics").cloned().unwrap_or(Value::Null)
        );
        let target = pharos_runtime_database::operations::operation_fingerprint(&profile_url)
            .map_err(|_| SocialError::InvalidResponse)?;
        let post = pharos_runtime_database::operations::operation_fingerprint(&(
            profile_url,
            &text,
            &links,
        ))
        .map_err(|_| SocialError::InvalidResponse)?;
        let observation = json!({"application":scope.application(),"namespace":scope.namespace(),"owner":scope.owner(),"provider":sessions::key(provider),"target":target,"post_id":post,"published_at":"","permalink":profile_url,"text":text,"links":serde_json::to_string(&links).map_err(|_|SocialError::InvalidResponse)?});
        let values = observation
            .as_object()
            .ok_or(SocialError::InvalidResponse)?
            .iter()
            .map(|(key, value)| (key.clone(), WriteValue::Literal(value.clone())))
            .collect();
        let mut steps = guards.clone();
        steps.extend(legacy_observation_redactions(&store, &scope, provider)?);
        steps.push(Mutation::InsertIfAbsent {
            entity: "social_observation".into(),
            unique_key: vec![
                "application".into(),
                "namespace".into(),
                "owner".into(),
                "provider".into(),
                "target".into(),
                "post_id".into(),
            ],
            values,
        });
        store
            .adapter
            .transact(
                &store.config,
                &store.schema,
                &Transaction {
                    steps,
                    idempotency_key: None,
                },
            )
            .map_err(|_| SocialError::Busy)?;
        let posts = snapshot.get("posts").and_then(Value::as_array);
        let unverified_posts = match posts {
            Some(posts) if !posts.is_empty() => posts
                .iter()
                .filter(|post| {
                    !super::super::event_discovery::social_evidence::posting_date_known(post)
                })
                .count(),
            _ => snapshot
                .pointer("/diagnostics/message_nodes")
                .and_then(Value::as_u64)
                .unwrap_or(0) as usize,
        };
        let verified_posts = posts
            .map(|posts| {
                posts
                    .iter()
                    .filter(|post| {
                        super::super::event_discovery::social_evidence::posting_date_known(post)
                    })
                    .count()
            })
            .unwrap_or(0);
        Ok(ObservationBatch {
            links: links.into_iter().collect(),
            evidence,
            unverified_posts,
            verified_posts,
            guards,
        })
    })();
    if result.is_err() && !checkpoint_saved {
        match repository.release_browser_lease(&leased) {
            Ok(()) | Err(SocialError::Busy | SocialError::Forbidden) => {}
            Err(problem) => eprintln!(
                "browser collection lease cleanup failed: {}",
                problem.code()
            ),
        }
    }
    result
}

/// Redacts legacy whole-document browser content through scoped compare-and-swap operations, preserving observation identities.
fn legacy_observation_redactions(
    store: &super::super::database::LogicalAppStore,
    scope: &ConnectionScope,
    provider: SocialProvider,
) -> Result<Vec<pharos_runtime_database::operations::Mutation>, SocialError> {
    use pharos_runtime_database::operations::{Mutation, Predicate, Query, WriteValue};
    let prefixes = [
        "Partial browser view; public evidence required before publication.",
        "Scoped browser content v2; public evidence required before publication.",
    ];
    let scope_filter = vec![
        Predicate::Equal("application".into(), json!(scope.application())),
        Predicate::Equal("namespace".into(), json!(scope.namespace())),
        Predicate::Equal("owner".into(), json!(scope.owner())),
        Predicate::Equal("provider".into(), json!(sessions::key(provider))),
    ];
    let mut filter = scope_filter.clone();
    filter.push(Predicate::Any(
        prefixes
            .iter()
            .map(|prefix| Predicate::Contains("text".into(), (*prefix).into()))
            .collect(),
    ));
    let rows = store
        .adapter
        .query(
            &store.config,
            &store.schema,
            &Query {
                entity: "social_observation".into(),
                fields: vec![
                    "target".into(),
                    "post_id".into(),
                    "text".into(),
                    "links".into(),
                ],
                filter: Some(Predicate::All(filter)),
                order: vec![],
                limit: 100,
                offset: 0,
            },
        )
        .map_err(|_| SocialError::Transport)?;
    let mut steps = Vec::new();
    for row in rows {
        if !row
            .get("text")
            .and_then(Value::as_str)
            .is_some_and(|text| prefixes.iter().any(|prefix| text.starts_with(prefix)))
        {
            continue;
        }
        let mut filter = scope_filter.clone();
        for field in ["target", "post_id", "text", "links"] {
            let value = row
                .get(field)
                .filter(|value| value.is_string())
                .ok_or(SocialError::InvalidResponse)?;
            filter.push(Predicate::Equal(field.into(), value.clone()));
        }
        steps.push(Mutation::Update {
            entity: "social_observation".into(),
            filter: Predicate::All(filter),
            values: std::collections::BTreeMap::from([
                (
                    "text".into(),
                    WriteValue::Literal(json!(
                        "[redacted: legacy browser snapshot lacked verified post attribution]"
                    )),
                ),
                ("links".into(), WriteValue::Literal(json!("[]"))),
            ]),
            expected_rows: Some(1),
        });
    }
    Ok(steps)
}

/// Accepts only concrete Facebook event IDs observed inside the authorized profile view.
fn facebook_event_url(value: &str) -> Option<String> {
    let mut url = Url::parse(value).ok()?;
    if url.scheme() != "https"
        || url.port_or_known_default() != Some(443)
        || !matches!(
            url.host_str(),
            Some("facebook.com" | "www.facebook.com" | "m.facebook.com")
        )
        || !url.username().is_empty()
        || url.password().is_some()
    {
        return None;
    }
    let segments = url
        .path_segments()?
        .filter(|segment| !segment.is_empty())
        .collect::<Vec<_>>();
    if segments.len() != 2
        || segments[0] != "events"
        || segments[1].is_empty()
        || !segments[1].bytes().all(|byte| byte.is_ascii_digit())
    {
        return None;
    }
    url.set_query(None);
    url.set_fragment(None);
    Some(url.to_string())
}

/// Identifies the same Instagram post across root and artist-prefixed permalink forms, preserving shortcode case.
fn instagram_post_key(url: &Url) -> Option<(&str, &str)> {
    let path = url.path().trim_end_matches('/');
    let count = path.split('/').filter(|part| !part.is_empty()).count();
    if !(2..=3).contains(&count) {
        return None;
    }
    let (prefix, id) = path.rsplit_once('/')?;
    let kind = prefix.rsplit('/').next()?;
    (matches!(kind, "p" | "reel")
        && !id.is_empty()
        && id.len() <= 128
        && id
            .bytes()
            .all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, b'_' | b'-')))
    .then_some((kind, id))
}

/// A provider redirect to the owner home feed cannot become evidence for the requested artist.
fn same_profile_location(expected: &str, current: &str) -> bool {
    let (Ok(expected), Ok(current)) = (Url::parse(expected), Url::parse(current)) else {
        return false;
    };
    let host = |url: &Url| {
        url.host_str()
            .unwrap_or("")
            .trim_start_matches("www.")
            .trim_start_matches("m.")
            .trim_start_matches("mbasic.")
            .to_ascii_lowercase()
    };
    expected.scheme() == "https"
        && current.scheme() == "https"
        && host(&expected) == host(&current)
        && (expected.path().trim_end_matches('/') == current.path().trim_end_matches('/')
            || host(&expected) == "instagram.com"
                && instagram_post_key(&expected).is_some()
                && instagram_post_key(&expected) == instagram_post_key(&current))
        && ["id", "story_fbid", "fbid"].iter().all(|key| {
            expected
                .query_pairs()
                .find(|(name, _)| name == key)
                .map(|(_, value)| value)
                == current
                    .query_pairs()
                    .find(|(name, _)| name == key)
                    .map(|(_, value)| value)
        })
}

/// OCRs at most two visible, attributed post images within a strict helper deadline; failures remain explicit evidence.
fn extract_posters(
    app: &AppRuntime,
    browser: &mut Browser,
    target: &str,
    snapshot: &mut Value,
    budget: &mut usize,
) {
    use base64::Engine;
    use std::io::Write;
    use std::os::unix::fs::OpenOptionsExt;
    let Some(posts) = snapshot.get_mut("posts").and_then(Value::as_array_mut) else {
        return;
    };
    for post in posts {
        if post.get("image_status").is_some() {
            continue;
        }
        let now = super::super::runtime_timestamp_seconds(&super::super::current_timestamp_utc())
            .unwrap_or(u64::MAX);
        if !super::super::event_discovery::social_evidence::dated_announcement(post, now) {
            post["image_status"] = json!("posting_date_unverified_or_stale");
            continue;
        }
        let images = post
            .get("images")
            .and_then(Value::as_array)
            .cloned()
            .unwrap_or_default();
        if images.is_empty() {
            continue;
        }
        post["image_status"] = json!("not_read");
        for image in images
            .into_iter()
            .filter(|image| image.get("visible").and_then(Value::as_bool) == Some(true))
            .take(1)
        {
            if *budget == 0 {
                post["image_status"] = json!("budget_exceeded");
                break;
            }
            *budget -= 1;
            let result = (|| -> Result<String, SocialError> {
                let encoded = browser
                    .capture_poster(target, &image["clip"])
                    .map_err(error)?;
                let bytes = base64::engine::general_purpose::STANDARD
                    .decode(encoded)
                    .map_err(|_| SocialError::InvalidResponse)?;
                if bytes.len() > 2 * 1024 * 1024 {
                    return Err(SocialError::Capacity);
                }
                let root = app
                    .state_path
                    .as_deref()
                    .and_then(|path| Path::new(path).parent())
                    .ok_or(SocialError::Configuration)?;
                let name = SystemTime::now()
                    .duration_since(UNIX_EPOCH)
                    .map_err(|_| SocialError::Configuration)?
                    .as_nanos();
                let path = root.join(format!("social-poster-{name}.png"));
                let mut file = stdfs::OpenOptions::new()
                    .create_new(true)
                    .write(true)
                    .mode(0o600)
                    .open(&path)
                    .map_err(|_| SocialError::Transport)?;
                let extraction = (|| {
                    file.write_all(&bytes).map_err(|_| SocialError::Transport)?;
                    drop(file);
                    let conf = if app.is_editor_preview {
                        OPERATOR_CONFIG
                            .read()
                            .map_err(|_| SocialError::Configuration)?
                            .clone()
                    } else {
                        app.runtime_conf_path.clone()
                    }
                    .ok_or(SocialError::Configuration)?;
                    super::super::agent_media::extract_poster_with_platform_helper(
                        &path,
                        root,
                        Path::new(&conf),
                    )
                    .map_err(|_| SocialError::InvalidResponse)
                })();
                stdfs::remove_file(&path).map_err(|_| SocialError::Transport)?;
                extraction
            })();
            match result {
                Ok(text) => {
                    post["image_text"] = json!(text);
                    post["image_status"] = json!("read");
                }
                Err(_) => post["image_status"] = json!("unavailable"),
            }
        }
    }
}

/// Resolves bounded header-only publication tooltips without reading comment dates or guessing from post prose.
fn resolve_publications(
    browser: &mut Browser,
    session: &str,
    snapshot: &mut Value,
    budget: &mut usize,
) {
    let targets = snapshot
        .get("date_targets")
        .and_then(Value::as_array)
        .cloned()
        .unwrap_or_default();
    for target in targets.iter().take(4) {
        if *budget == 0 {
            break;
        }
        *budget -= 1;
        let Ok(labels) = browser.publication_labels(session, target) else {
            continue;
        };
        if labels.as_array().is_none_or(Vec::is_empty) {
            continue;
        }
        if let Some(posts) = snapshot.get_mut("posts").and_then(Value::as_array_mut) {
            for (index, post) in posts.iter_mut().enumerate() {
                if target.get("post_index").and_then(Value::as_u64) == Some(index as u64)
                    && post.get("permalink") == target.get("permalink")
                {
                    post["publication_labels"] = labels.clone();
                }
            }
        }
    }
    if let Some(posts) = snapshot.get("posts").and_then(Value::as_array) {
        let dates=posts.iter().take(20).map(|post|json!({"published_at":post.get("published_at"),"publication_labels":post.get("publication_labels"),"audience":post.get("audience")})).collect::<Vec<_>>();
        snapshot["diagnostics"]["posting_dates"] = json!(dates);
    }
}

/// Gives hydrated provider posts time to appear and merges three bounded rendered views without claiming a complete feed.
fn collection_snapshot(
    app: &AppRuntime,
    browser: &mut Browser,
    target: &str,
    expected: &str,
    source_profile: &str,
    poster_budget: &mut usize,
    date_budget: &mut usize,
) -> Result<Value, SocialError> {
    let started = std::time::Instant::now();
    let mut snapshot = loop {
        let value = match browser.snapshot_for_profile(target, Some(source_profile)) {
            Ok(value) => value,
            Err(BrowserError::InvalidResponse) if started.elapsed() < Duration::from_secs(15) => {
                std::thread::sleep(Duration::from_millis(500));
                continue;
            }
            Err(problem) => return Err(error(problem)),
        };
        if value
            .get("navigation_error")
            .and_then(Value::as_str)
            .is_some()
        {
            return Err(SocialError::Transport);
        }
        if started.elapsed() >= Duration::from_secs(3)
            && value.get("ready").and_then(Value::as_bool) == Some(true)
        {
            if !value
                .get("url")
                .and_then(Value::as_str)
                .is_some_and(|current| same_profile_location(expected, current))
            {
                let path = value
                    .get("url")
                    .and_then(Value::as_str)
                    .and_then(|url| Url::parse(url).ok())
                    .map(|url| url.path().to_owned())
                    .unwrap_or_default();
                eprintln!(
                    "social resource navigation rejected: path={} login={}",
                    path,
                    value.get("login").and_then(Value::as_bool).unwrap_or(false)
                );
                return Err(SocialError::AuthorizationRequired);
            }
            break value;
        }
        if started.elapsed() >= Duration::from_secs(15) {
            eprintln!(
                "social browser content not ready: diagnostics={}",
                value.get("diagnostics").unwrap_or(&Value::Null)
            );
            return Err(SocialError::Transport);
        }
        std::thread::sleep(Duration::from_millis(500));
    };
    resolve_publications(browser, target, &mut snapshot, date_budget);
    extract_posters(app, browser, target, &mut snapshot, poster_budget);
    if expected != source_profile {
        return Ok(snapshot);
    }
    for _ in 0..2 {
        if snapshot.get("login").and_then(Value::as_bool) == Some(true) {
            break;
        }
        browser.scroll_collection_view(target).map_err(error)?;
        std::thread::sleep(Duration::from_secs(2));
        let mut next = browser
            .snapshot_for_profile(target, Some(source_profile))
            .map_err(error)?;
        if !next
            .get("url")
            .and_then(Value::as_str)
            .is_some_and(|current| same_profile_location(expected, current))
        {
            return Err(SocialError::AuthorizationRequired);
        }
        if let Some(posts) = next.get_mut("posts").and_then(Value::as_array_mut) {
            for post in posts {
                if let Some(previous) =
                    snapshot
                        .get("posts")
                        .and_then(Value::as_array)
                        .and_then(|posts| {
                            posts.iter().find(|previous| {
                                previous["text"] == post["text"]
                                    && previous["published_at"] == post["published_at"]
                                    && previous["author_url"] == post["author_url"]
                            })
                        })
                {
                    *post = previous.clone();
                }
            }
        }
        resolve_publications(browser, target, &mut next, date_budget);
        extract_posters(app, browser, target, &mut next, poster_budget);
        for (key, limit) in [
            ("links", 1000),
            ("structured", 30),
            ("posts", 40),
            ("post_resources", 4),
        ] {
            let additions = next
                .get(key)
                .and_then(Value::as_array)
                .cloned()
                .unwrap_or_default();
            if let Some(values) = snapshot.get_mut(key).and_then(Value::as_array_mut) {
                for value in additions {
                    if values.len() >= limit {
                        break;
                    }
                    if !values.contains(&value) {
                        values.push(value);
                    }
                }
            }
        }
    }
    Ok(snapshot)
}

#[cfg(test)]
mod tests {
    use super::*;
    /// Legacy content redaction is owner/provider/namespace scoped, preserves new snapshots and is idempotent in the generic store.
    #[test]
    #[cfg(feature = "sqlite")]
    fn legacy_snapshots_are_redacted_without_crossing_scope() {
        use pharos_runtime_database::{
            contract::{AppDataContract, migration_checksum},
            operations::{
                AppSchema, Migration, Mutation, Predicate, Query, SchemaChange, Transaction,
                WriteValue,
            },
        };
        let (_directory, app) = super::super::tests::application();
        let app_id = "generic_consumer";
        let schema = AppSchema {
            app_id: app_id.into(),
            entities: pharos_runtime_social::schema::entities(),
        };
        let changes = schema
            .entities
            .iter()
            .cloned()
            .map(SchemaChange::CreateEntity)
            .collect::<Vec<_>>();
        let contract = AppDataContract {
            schema,
            migrations: vec![Migration {
                app_id: app_id.into(),
                id: "create_social".into(),
                checksum: migration_checksum(app_id, "create_social", &changes).unwrap(),
                changes,
            }],
            legacy_adoption: None,
        };
        let config = pharos_runtime_database::DbBackendConfig {
            backend: "sqlite".into(),
            sqlite_path: Some(
                Path::new(app.app_root.as_ref().unwrap())
                    .parent()
                    .unwrap()
                    .join("observations.sqlite3"),
            ),
            ..Default::default()
        };
        let adapter = pharos_runtime_database_adapters::resolve(&config).unwrap();
        adapter.ensure_database(&config, &contract.schema).unwrap();
        adapter.apply_contract(&config, &contract).unwrap();
        let store = super::super::super::database::LogicalAppStore {
            config,
            schema: contract.schema,
            adapter,
        };
        let legacy = "Partial browser view; public evidence required before publication. private-account-panel";
        let mut inserts = Vec::new();
        for (post, owner, namespace, provider, text) in [
            ("old", 7, "deployment", "browser_facebook", legacy),
            (
                "region-only",
                7,
                "deployment",
                "browser_facebook",
                "Scoped browser content v2; public evidence required before publication. private-account-panel",
            ),
            ("other-owner", 8, "deployment", "browser_facebook", legacy),
            ("other-namespace", 7, "another", "browser_facebook", legacy),
            ("api", 7, "deployment", "facebook", legacy),
            (
                "new",
                7,
                "deployment",
                "browser_facebook",
                "Attributed browser posts v3; Public event",
            ),
        ] {
            let row = json!({"application":app_id,"namespace":namespace,"owner":owner,"provider":provider,"target":"profile","post_id":post,"published_at":"","permalink":"https://facebook.com/artist","text":text,"links":"[]"});
            inserts.push(Mutation::Insert {
                entity: "social_observation".into(),
                values: row
                    .as_object()
                    .unwrap()
                    .iter()
                    .map(|(key, value)| (key.clone(), WriteValue::Literal(value.clone())))
                    .collect(),
            });
        }
        store
            .adapter
            .transact(
                &store.config,
                &store.schema,
                &Transaction {
                    steps: inserts,
                    idempotency_key: None,
                },
            )
            .unwrap();
        let scope = ConnectionScope::new(app_id, "deployment", 7).unwrap();
        let steps =
            legacy_observation_redactions(&store, &scope, SocialProvider::Facebook).unwrap();
        assert_eq!(steps.len(), 2);
        store
            .adapter
            .transact(
                &store.config,
                &store.schema,
                &Transaction {
                    steps,
                    idempotency_key: None,
                },
            )
            .unwrap();
        let rows = store
            .adapter
            .query(
                &store.config,
                &store.schema,
                &Query {
                    entity: "social_observation".into(),
                    fields: vec!["post_id".into(), "text".into()],
                    filter: Some(Predicate::Contains(
                        "text".into(),
                        "private-account-panel".into(),
                    )),
                    order: vec![],
                    limit: 10,
                    offset: 0,
                },
            )
            .unwrap();
        assert_eq!(rows.len(), 3);
        assert!(rows.iter().all(|row| row["post_id"] != "old"));
        assert!(
            legacy_observation_redactions(&store, &scope, SocialProvider::Facebook)
                .unwrap()
                .is_empty()
        );
    }

    /// Exercises real poster OCR with the serving installation configuration and explicit local test input.
    #[test]
    #[ignore = "requires PHAROS_TEST_POSTER_INPUT, PHAROS_TEST_RUNTIME_CONFIG and installed OCR helper/models"]
    fn poster_dates_use_configured_platform_helper() {
        let input = PathBuf::from(std::env::var("PHAROS_TEST_POSTER_INPUT").unwrap());
        let conf = PathBuf::from(std::env::var("PHAROS_TEST_RUNTIME_CONFIG").unwrap());
        let text = super::super::super::agent_media::extract_poster_with_platform_helper(
            &input,
            input.parent().unwrap(),
            &conf,
        )
        .unwrap();
        assert!(text.contains("OCTOBER 30 2026"));
        let candidate = json!({"evidence_kind":"rendered_post","author_url":"https://facebook.com/artist","source_profile":"https://facebook.com/artist","datePublished":"2026-10-22T10:00:00Z","description":"Festival details on poster","image_text":text});
        assert!(
            super::super::super::event_discovery::social_evidence::eligible(
                &candidate,
                super::super::super::runtime_timestamp_seconds("2026-10-23T12:00:00Z").unwrap()
            )
        );
    }

    /// Artist redirects cannot silently collect the connected owner's home stream.
    #[test]
    fn profile_redirects_do_not_change_evidence_identity() {
        assert!(same_profile_location(
            "https://www.instagram.com/p/AbC123/",
            "https://www.instagram.com/madmaxxmusic/p/AbC123/"
        ));
        assert!(!same_profile_location(
            "https://www.instagram.com/p/AbC123/",
            "https://www.instagram.com/madmaxxmusic/p/Other123/"
        ));
        assert!(!same_profile_location(
            "https://www.instagram.com/p/AbC123/",
            "https://www.instagram.com/"
        ));
        assert!(!same_profile_location(
            "https://www.instagram.com/madmaxxmusic/",
            "https://www.instagram.com/p/AbC123/"
        ));

        assert!(same_profile_location(
            "https://www.facebook.com/artist/",
            "https://m.facebook.com/artist"
        ));
        assert!(same_profile_location(
            "https://facebook.com/story.php?id=1&story_fbid=123",
            "https://www.facebook.com/story.php?id=1&story_fbid=123"
        ));
        assert!(!same_profile_location(
            "https://facebook.com/story.php?id=1&story_fbid=123",
            "https://facebook.com/story.php?id=1&story_fbid=456"
        ));
        assert!(!same_profile_location(
            "https://facebook.com/artist",
            "https://facebook.com/"
        ));
        assert!(!same_profile_location(
            "https://facebook.com/artist",
            "https://facebook.com/owner"
        ));
        assert!(!same_profile_location(
            "https://facebook.com/profile.php?id=1",
            "https://facebook.com/profile.php?id=2"
        ));
        assert!(!same_profile_location(
            "https://facebook.com/artist",
            "https://facebook.com.evil/artist"
        ));
    }

    /// Observed event navigation cannot expand to other profiles, arbitrary redirects or private destinations.
    #[test]
    fn observed_facebook_events_are_bounded() {
        assert_eq!(
            facebook_event_url("https://www.facebook.com/events/123/?ref=profile").as_deref(),
            Some("https://www.facebook.com/events/123/")
        );
        for value in [
            "https://www.facebook.com/other-profile",
            "https://www.facebook.com/events/123/edit/",
            "https://www.facebook.com/events/not-an-id/",
            "https://facebook.com.evil.test/events/123/",
            "https://user:secret@www.facebook.com/events/123/",
            "http://www.facebook.com/events/123/",
        ] {
            assert!(facebook_event_url(value).is_none());
        }
    }
    /// Stable profile roots retain keys across reopening and cannot cross owner, app, deployment or provider.
    #[test]
    fn profiles_persist_and_remain_scope_bound() {
        let (_directory, app) = super::super::tests::application();
        let scope = ConnectionScope::new("generic_consumer", "deployment", 7).unwrap();
        let first = profile(&app, &scope, SocialProvider::Facebook).unwrap();
        stdfs::create_dir_all(&first).unwrap();
        stdfs::write(first.join("retention-marker"), "controlled-test-marker").unwrap();
        assert_eq!(
            profile(&app, &scope, SocialProvider::Facebook).unwrap(),
            first
        );
        assert!(first.join("retention-marker").is_file());
        for other in [
            ConnectionScope::new("generic_consumer", "deployment", 8).unwrap(),
            ConnectionScope::new("generic_consumer", "other", 7).unwrap(),
            ConnectionScope::new("another_app", "deployment", 7).unwrap(),
        ] {
            assert_ne!(
                profile(&app, &other, SocialProvider::Facebook).unwrap(),
                first
            );
        }
        assert_ne!(profile(&app, &scope, SocialProvider::X).unwrap(), first);
        assert_eq!(executable(&app), Err(SocialError::UnsupportedProvider));
    }
    /// Reconnection keeps rotated persistent cookies and refuses to cross into another retained account.
    #[test]
    #[ignore = "requires explicitly selected installed Chromium"]
    fn reconnect_preserves_newer_profile_cookies() {
        let (_directory, app) = super::super::tests::application();
        let executable = std::env::var("PHAROS_BROWSER_TEST_EXECUTABLE").unwrap();
        let profile = Path::new(app.app_root.as_ref().unwrap()).join("test-browser-profile");
        let mut browser = Browser::launch(
            Path::new(&executable),
            &profile,
            sessions::domains(SocialProvider::Facebook),
            false,
        )
        .unwrap();
        assert_eq!(
            restore_retained_session(&mut browser, SocialProvider::Facebook, "123", ""),
            Err(SocialError::AuthorizationRequired)
        );
        let older = r#"[{"name":"c_user","value":"123","domain":".facebook.com","path":"/","secure":true},{"name":"xs","value":"older-test-session","domain":".facebook.com","path":"/","secure":true}]"#;
        restore_retained_session(&mut browser, SocialProvider::Facebook, "123", older).unwrap();
        let newer = older.replace("older-test-session", "rotated-test-session");
        browser.restore(&newer).unwrap();
        restore_retained_session(&mut browser, SocialProvider::Facebook, "123", older).unwrap();
        assert!(browser.cookies().unwrap().contains("rotated-test-session"));
        restore_retained_session(&mut browser, SocialProvider::Facebook, "123", "").unwrap();
        assert_eq!(
            restore_retained_session(&mut browser, SocialProvider::Facebook, "456", older),
            Err(SocialError::Forbidden)
        );
        assert!(browser.cookies().unwrap().contains("rotated-test-session"));
        drop(browser);
    }
}