path: root/tests/check.py

#!/usr/bin/env python3
"""Pure's end-to-end checks: pure-serve, the HTTP host, running modules that
aup builds (the sibling checkout, --aup-root). The core's and the store's own
tests are core/test-module.c and store/test-tree-store.c.

1. Documents: pure-serve running the document editor written in aup
   (aup's examples/editor.aup) answers random requests exactly as the earlier
   document server running editor.pure, with one and with three connection
   threads, on persistent and pipelined connections too.
2. Lending: a read lends the stored extents and still carries its version
   while the document changes; lent answers count against the payload budget;
   a text view is lent while its answer waits and let go when it is read or
   its connection closes, the store keeping one mapping again.
3. Durability: concurrent edits share commits, and every acknowledged edit
   survives kill -9, with one and with three threads; so do the app's
   acknowledged posts (keyed lists, JSON bodies with groups).
4. JSON: request bodies are read in place, fields by path, and malformed or
   mistyped ones are refused with the field named.
5. Timers run on the owner and their beats are saved like events.
6. Links: sends are saved with their event and delivered in order and in
   batches to another app, which applies each once, across kill -9 of either
   side; webhooks receive them over HTTPS only from a trusted receiver; an
   API's answers become the app's events (--reply). Linked without a
   connection (pure://, UDP, docs/design/011), the same holds across kill -9
   of either side or both with no handshake, also with the link's packets
   delayed, lost and reordered (netem, in a namespace of its own).
7. Sealed sends: sealed to the receiver's key, they pass a relay unread and
   unchanged (a changed byte is refused, a replay applies nothing), and a
   node that keeps its deliveries sealed refuses unsealed ones.
"""
import argparse
import json
import random
import subprocess
import sys
import tempfile
from pathlib import Path

HERE = Path(__file__).resolve().parent
ROOT = HERE.parent
# The app that exercises documents: the editor written in aup, from aup's examples.
EDITOR = ROOT.parent / 'aup' / 'examples' / 'editor.aup'


def run(*args, stdin=None, check=True):
    return subprocess.run([str(a) for a in args], input=stdin, capture_output=True, text=True,
                          check=check, timeout=60)


def compile_module(aup, source_path, out):
    run(aup, 'build', source_path, '-o', out)
    return out.read_bytes()


class HttpHost:
    """A Pure HTTP host on a fresh port; stops with its statistics."""

    def __init__(self, args, env=None):
        import select
        self.process = subprocess.Popen([str(a) for a in args] + ['--port', '0'], stdout=subprocess.PIPE,
                                        stderr=subprocess.PIPE, env=env)
        ready, _, _ = select.select([self.process.stdout], [], [], 10)
        assert ready, 'HTTP host did not start'
        line = self.process.stdout.readline()
        assert line, self.process.communicate(timeout=5)
        self.info = json.loads(line)  # its port, name, public key
        self.port = self.info['port']

    def request(self, method, key, body=b'', expected=None):
        import http.client
        headers = {'Content-Length': str(len(body))}
        if expected is not None:
            headers['If-None-Match' if expected == 0 else 'If-Match'] = '*' if expected == 0 else f'"{expected}"'
        connection = http.client.HTTPConnection('127.0.0.1', self.port, timeout=30)
        try:
            connection.request(method, f'/objects/{key}', body, headers)
            response = connection.getresponse()
            return response.status, response.getheader('ETag'), response.getheader('X-Pure-Error'), response.read()
        finally:
            connection.close()

    def stop(self):
        self.process.terminate()
        _, error = self.process.communicate(timeout=30)
        assert self.process.returncode == 0, error[-1000:]
        return [json.loads(line) for line in error.decode().splitlines() if line.startswith('{')]


def server_parity(aup, pure, work, seeds, operations=150, threads=1):
    """The document server running editor.aup answers every request exactly
    as the server running editor.pure: status, revision, error and body."""
    import struct
    module = work / 'editor-server.pmod'
    compile_module(aup, EDITOR, module)
    compared = 0
    for seed in seeds:
        rng = random.Random(seed + 13000)
        old = HttpHost([pure / 'prototypes/connections/build/tree/pure-connections', '--program', pure / 'prototypes/connections/examples/editor.pure',
                        '--store', work / f'http-old-{seed}-{threads}'])
        new = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / f'http-new-{seed}-{threads}',
                        '--threads', str(threads)])
        try:
            revision, size = {}, {}
            for _ in range(operations):
                key = rng.choice(['a', 'b', 'long-key_1'])
                current, length = revision.get(key, 0), size.get(key, 0)
                if rng.random() < 0.35:
                    request = ('GET', key, b'', None)
                else:
                    pick = rng.random()
                    base = current if pick < 0.75 else max(current - 1, 0) if pick < 0.9 else current + 3
                    if rng.random() < 0.05:
                        body = bytes(rng.randrange(256) for _ in range(rng.randint(0, 7)))  # too short
                    else:
                        insert = bytes(rng.randrange(256) for _ in range(rng.choice([0, 1, 7, 300, 5000])))
                        body = struct.pack('<II', rng.randint(0, length + 2), rng.choice([0, 1, 3, length])) + insert
                    request = ('PUT', key, body, base)
                theirs, ours = old.request(*request), new.request(*request)
                assert ours == theirs, (seed, request[:2], request[3], ours[:3], theirs[:3])
                if theirs[0] == 200 and theirs[1]:
                    revision[key] = int(theirs[1].strip('"'))
                    if request[0] == 'GET':
                        size[key] = len(theirs[3])
                    else:
                        size[key] = len(old.request('GET', key)[3])
                        assert new.request('GET', key) == old.request('GET', key)
                compared += 1
        finally:
            old.stop()
            new.stop()
    return compared


def server_pipelining(aup, pure, work):
    """One connection, many requests: a keep-alive client and a pipelined
    burst (all requests in one write, one split across writes) get the same
    answers, in order, as separate connections would."""
    import http.client
    import socket
    import struct
    module = work / 'editor-pipeline.pmod'
    compile_module(aup, EDITOR, module)
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'pipeline'])
    try:
        connection = http.client.HTTPConnection('127.0.0.1', host.port, timeout=30)
        answers = []
        for body, headers in [(struct.pack('<II', 0, 0) + b'hello', {'If-None-Match': '*'}),
                              (struct.pack('<II', 5, 0) + b'!', {'If-Match': '"1"'}),
                              (struct.pack('<II', 0, 0) + b'x', {'If-Match': '"1"'})]:
            connection.request('PUT', '/objects/p', body, headers)
            response = connection.getresponse()
            answers.append((response.status, response.getheader('ETag'), response.read()))
        connection.request('GET', '/objects/p')
        response = connection.getresponse()
        answers.append((response.status, response.getheader('ETag'), response.read()))
        connection.close()
        assert answers == [(200, '"1"', b'hello'), (200, '"2"', b'!'), (412, '"2"', b''), (200, '"2"', b'hello!')], answers

        def request(method, key, body=b'', condition=''):
            return (f'{method} /objects/{key} HTTP/1.1\r\nHost: x\r\nContent-Length: {len(body)}\r\n{condition}\r\n'
                    .encode() + body)
        pipeline = (request('GET', 'p') + request('PUT', 'q', struct.pack('<II', 0, 0) + b'q1', 'If-None-Match: *\r\n') +
                    request('GET', 'q') + request('GET', 'missing') +
                    request('PUT', 'q', struct.pack('<II', 2, 0) + b'!', 'If-Match: "1"\r\n') + request('GET', 'q'))
        expected = [(200, b'hello!'), (200, b'q1'), (200, b'q1'), (404, b''), (200, b'!'), (200, b'q1!')]
        for split in (len(pipeline), 7, 61):  # one write, and small writes that cut heads and bodies
            with socket.create_connection(('127.0.0.1', host.port), timeout=30) as sock:
                for at in range(0, len(pipeline), split):
                    sock.sendall(pipeline[at:at + split])
                reader = sock.makefile('rb')
                for status, body in expected:
                    code = int(reader.readline().split()[1])
                    length = 0
                    for line in iter(reader.readline, b'\r\n'):
                        name, _, value = line.decode().partition(':')
                        if name.lower() == 'content-length':
                            length = int(value)
                    assert (code, reader.read(length)) == (status, body), (split, code, status, body)
            # The next round starts from the same documents.
            host.request('PUT', 'q', struct.pack('<II', 0, 3) + b'q1', int(host.request('GET', 'q')[1].strip('"')))
            expected = [(200, b'hello!'), (412, b''), (200, b'q1'), (404, b''), (412, b''), (200, b'q1')]
            pipeline = (request('GET', 'p') + request('PUT', 'q', struct.pack('<II', 0, 0) + b'q1', 'If-None-Match: *\r\n') +
                        request('GET', 'q') + request('GET', 'missing') +
                        request('PUT', 'q', struct.pack('<II', 2, 0) + b'!', 'If-Match: "1"\r\n') + request('GET', 'q'))
    finally:
        stats = host.stop()
    assert stats[0]['active'] == 0 and stats[0]['retained_payload_bytes'] == 0, stats
    return len(answers) + 3 * len(expected)


def server_lent_reads(aup, pure, work):
    """A read lends the stored document's extents instead of copying them: a
    1 MiB answer sent slowly still carries the version read while the
    document is replaced five times meanwhile."""
    import socket
    import struct
    module = work / 'editor-lent.pmod'
    compile_module(aup, EDITOR, module)
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'lent'])
    big = bytes(range(256)) * 4096
    try:
        assert host.request('PUT', 'big', struct.pack('<II', 0, 0) + big, 0)[0] == 200
        with socket.create_connection(('127.0.0.1', host.port), timeout=30) as sock:
            sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 4096)
            sock.sendall(b'GET /objects/big HTTP/1.1\r\nHost: x\r\nContent-Length: 0\r\n\r\n')
            data = sock.recv(100)
            for revision in range(1, 6):
                edit = struct.pack('<II', 0, len(big) if revision == 1 else 1) + b'Z'
                assert host.request('PUT', 'big', edit, revision)[0] == 200
            while b'\r\n\r\n' not in data or len(data) < data.index(b'\r\n\r\n') + 4 + len(big):
                chunk = sock.recv(65536)
                assert chunk, len(data)
                data += chunk
        assert data[data.index(b'\r\n\r\n') + 4:] == big
        assert host.request('GET', 'big') == (200, '"6"', 'none', b'Z')
    finally:
        stats = host.stop()
    assert stats[0]['active'] == 0 and stats[0]['retained_payload_bytes'] == 0, stats
    return len(big)


def server_lent_budget(aup, pure, work):
    """Lent extents count against the payload budget while an answer waits
    on its socket. Two readers pipeline 1 MiB reads without reading: the
    kernel takes what it can and each reader leaves one answer waiting. A
    third request finds no room (503 payload_budget) until a reader goes."""
    import socket
    import struct
    import time
    module = work / 'editor-budget.pmod'
    compile_module(aup, EDITOR, module)
    big = bytes(range(256)) * 4096
    budget = 2 * len(big) + len(big) // 2
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'lent-budget',
                     '--budget', budget])
    readers = []
    try:
        assert host.request('PUT', 'big', struct.pack('<II', 0, 0) + big, 0)[0] == 200
        for _ in range(2):
            sock = socket.create_connection(('127.0.0.1', host.port), timeout=30)
            sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 4096)
            sock.sendall(b'GET /objects/big HTTP/1.1\r\nHost: x\r\nContent-Length: 0\r\n\r\n' * 32)
            readers.append(sock)
        time.sleep(0.3)
        refused = host.request('GET', 'big')
        assert refused[0] == 503 and refused[2] == 'payload_budget', refused[:3]
        readers.pop().close()
        for _ in range(100):
            answered = host.request('GET', 'big')
            if answered[0] == 200:
                break
            time.sleep(0.05)
        assert answered[0] == 200 and answered[3] == big, answered[:3]
    finally:
        for sock in readers:
            sock.close()
        stats = host.stop()
    assert stats[0]['active'] == 0 and stats[0]['retained_payload_bytes'] == 0, stats
    return budget


NOTE_SOURCE = """state note: text
input write = message {
  text: text
}
on write { note = write.text }
view page = note
view size = note.bytes
"""


def server_lent_views(aup, pure, work, threads=1):
    """A view that shows a text state as it is lends the state's stored
    extents. Answers pipelined on one connection and left waiting hold the
    store mapping they were read from while the note is replaced: each comes
    out whole in one version. When a reader goes without reading, the
    mappings its answers held are unmapped and nothing stays charged. With
    several threads the owner lends and a connection thread gives back."""
    import socket
    import time
    module, source = work / 'note.pmod', work / 'note.aup'
    source.write_text(NOTE_SOURCE)
    compile_module(aup, source, module)
    store = work / f'lent-views-{threads}'
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', store, '--threads', threads])

    def write(text):
        body = json.dumps({'text': text}).encode()
        import http.client
        connection = http.client.HTTPConnection('127.0.0.1', host.port, timeout=30)
        connection.request('POST', '/inputs/write', body, {'Content-Type': 'application/json'})
        assert connection.getresponse().status == 200
        connection.close()

    def mappings():
        # A compaction replaces the file: a mapping of the old one shows as "(deleted)".
        path = str((store / 'pure.tree').resolve())
        return sum(1 for line in open(f'/proc/{host.process.pid}/maps') if path in line)

    def settle(to):
        for _ in range(100):  # an answer's ticket is released on its thread
            if mappings() <= to: return mappings()
            time.sleep(0.02)
        return mappings()

    def pipeline(count):
        # Far more than the kernel's buffers take (a few MiB): an answer waits, lent.
        sock = socket.create_connection(('127.0.0.1', host.port), timeout=30)
        sock.sendall(b'GET /views/page HTTP/1.1\r\nHost: x\r\n\r\n' * count)
        time.sleep(0.3)
        return sock

    size = 1 << 20
    try:
        write('x' * size)
        assert http(host.port, 'GET', '/views/size')[3] == str(size).encode()
        alone = mappings()
        # Whole versions, however the note changes while answers wait.
        sock = pipeline(32)
        for round_ in range(5):
            write(chr(ord('A') + round_) * size)
        held = mappings()
        data = b''
        while data.count(b'HTTP/1.1 200') < 32 or len(data) < 32 * size:
            chunk = sock.recv(1 << 20)
            assert chunk, len(data)
            data += chunk
        sock.close()
        answers = [part.split(b'\r\n\r\n', 1) for part in data.split(b'HTTP/1.1 200 OK\r\n')[1:]]
        bodies = [body[:size] for _, body in answers]
        assert all(b'text/plain' in head for head, _ in answers) and bodies[0] == b'x' * size, [b[:1] for b in bodies]
        assert all(len(set(body)) == 1 and len(body) == size for body in bodies), [len(b) for b in bodies]
        after_reading = settle(alone)
        # A reader that goes without reading gives back what its answers held.
        sock = pipeline(32)
        for round_ in range(3):
            write(chr(ord('a') + round_) * size)
        held_again = mappings()
        sock.close()
        after_leaving = settle(alone)
        assert held > alone and held_again > alone and after_reading <= alone and after_leaving <= alone, \
            (alone, held, after_reading, held_again, after_leaving)
        assert http(host.port, 'GET', '/views/page')[3] == b'c' * size
    finally:
        stats = host.stop()
    assert stats[0]['active'] == 0 and stats[0]['retained_payload_bytes'] == 0, stats
    return {'alone': alone, 'while_lent': max(held, held_again), 'after': after_leaving}


def server_bursts(aup, pure, work, clients=8, edits=30, shards=1):
    """Concurrent edits share commits, and every acknowledged edit survives a
    kill -9 of the server."""
    import http.client
    import signal
    import struct
    import threading
    import time
    module = work / 'editor-bursts.pmod'
    compile_module(aup, EDITOR, module)

    def load(host, rounds, acknowledged):
        def client(number):
            key, base = f'c{number}', acknowledged[number][1]
            for _ in range(rounds):
                try:
                    status, tag, _, _ = host.request('PUT', key, struct.pack('<II', 0, 0) + b'x', base)
                except (OSError, http.client.HTTPException):  # the server died mid-answer: not acknowledged
                    return
                if status != 200:
                    return
                base = int(tag.strip('"'))
                acknowledged[number] = (acknowledged[number][0] + 1, base)
        threads = [threading.Thread(target=client, args=(n,)) for n in range(clients)]
        start = time.perf_counter()
        for thread in threads:
            thread.start()
        return threads, start

    timings = {}
    for name, args in [('program', [pure / 'prototypes/connections/build/tree/pure-connections', '--program', pure / 'prototypes/connections/examples/editor.pure']),
                       ('module', [pure / 'build/pure-serve', '--module', module, '--threads', str(shards)])]:
        host = HttpHost(args + ['--store', work / f'bursts-{name}-{shards}'])
        acknowledged = [(0, 0)] * clients
        threads, start = load(host, edits, acknowledged)
        for thread in threads:
            thread.join()
        timings[name] = time.perf_counter() - start
        assert all(count == edits for count, _ in acknowledged), acknowledged
        stats = host.stop()
        if name == 'module':
            bursts = stats[0]['bursts']
            assert stats[0]['burst_events'] == clients * edits and (clients == 1 or bursts < clients * edits), stats
    # Kill the module server while clients edit; what it acknowledged is stored.
    store = work / f'bursts-module-{shards}'
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', store, '--threads', str(shards)])
    acknowledged = [(edits, edits)] * clients
    threads, _ = load(host, 1000, acknowledged)
    time.sleep(0.5)
    host.process.send_signal(signal.SIGKILL)
    host.process.wait()
    for thread in threads:
        thread.join()
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', store, '--threads', str(shards)])
    try:
        for number, (count, base) in enumerate(acknowledged):
            status, tag, _, body = host.request('GET', f'c{number}')
            stored = int(tag.strip('"'))
            assert status == 200 and stored in (base, base + 1) and len(body) == stored, (number, count, base, tag)
    finally:
        host.stop()
    return {'writes': clients * edits, 'bursts': bursts, 'program_seconds': round(timings['program'], 3),
            'module_seconds': round(timings['module'], 3),
            'acknowledged_before_kill': sum(count for count, _ in acknowledged) - clients * edits}


SERVED_SOURCE = """record Entry {
  name: text
  points = 0
}
state board: list of Entry by name
state at: index of board
input score = message {
  points: u32
  name: bytes
}
input join = text
input drop = key Delete
on score {
  if !board.has(text(score.name)) { board.add(Entry { name: text(score.name) }) }
  board[text(score.name)].points = board[text(score.name)].points + score.points
  at = board[text(score.name)]
  reply score.name
}
on join {
  board.add(Entry { name: join })
  at = board[join]
}
on drop.down { board.remove(at) }
view total = sum(e.points for e in board)
view current = at.name
view leaders = each e in board {
  name = e.name
  points = e.points
}
"""


def post(port, path, body):
    """A JSON body posted on its own connection: status, X-Pure-Error."""
    import http.client
    connection = http.client.HTTPConnection('127.0.0.1', port, timeout=30)
    try:
        data = json.dumps(body).encode()
        connection.request('POST', path, data, {'Content-Length': str(len(data)), 'Content-Type': 'application/json'})
        response = connection.getresponse()
        response.read()
        return response.status, response.getheader('X-Pure-Error')
    finally:
        connection.close()


def http(port, method, path, body=b''):
    """One request on its own connection: status, X-Pure-Error, content type, body."""
    import http.client
    connection = http.client.HTTPConnection('127.0.0.1', port, timeout=30)
    try:
        connection.request(method, path, body, {'Content-Length': str(len(body))} if method != 'GET' else {})
        response = connection.getresponse()
        return response.status, response.getheader('X-Pure-Error'), response.getheader('Content-Type'), response.read()
    finally:
        connection.close()


JSON_SOURCE = """record Note {
  title: text
  body: text
  points = 0
}
state notes: list of Note by title
state counted = 0
input add = message {
  title: text
  points: number
  body: text
}
input count = message {
  n: u32
}
record Shipment {
  title: text
  city: text
  note: text
  zip = 0
}
state shipped: list of Shipment
input ship = message {
  title: text
  to: {
    city: text
    zip: u32
    door: {
      note: text
    }
  }
}
on add {
  notes.add(Note { title: add.title, body: add.body, points: add.points })
  reply add.title
}
on count { counted = counted + count.n }
on ship {
  shipped.append(Shipment { title: ship.title, city: ship.to.city, note: ship.to.door.note, zip: ship.to.zip })
  reply ship.to.door.note
}
view counted_view = counted
view all = each n in notes {
  title = n.title
  body = n.body
  points = n.points
}
view shipments = each s in shipped {
  title = s.title
  city = s.city
  note = s.note
  zip = s.zip
}
"""


def server_json(aup, pure, work, rounds=300):
    """Messages of text and number fields posted as JSON objects: strings
    come out as Python's json module reads them (escapes, control bytes,
    Korean, surrogate pairs), numbers as it reads them; a missing, unknown,
    doubled or mistyped field, broken JSON and a lone surrogate answer 400."""
    module, source = work / 'json.pmod', work / 'json.aup'
    source.write_text(JSON_SOURCE)
    compile_module(aup, source, module)
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'json-store'])
    rng = random.Random(77)
    pieces = ['a', 'Z', ' ', '"', '\\', '/', '\n', '\t', '\x01', '\x1f', 'é', '가', '😀', '\u2028', 'x' * 20]
    notes = {}

    def post(path, body, json_body=True):
        import http.client
        connection = http.client.HTTPConnection('127.0.0.1', host.port, timeout=30)
        try:
            headers = {'Content-Length': str(len(body))}
            if json_body: headers['Content-Type'] = 'application/json'
            connection.request('POST', path, body, headers)
            response = connection.getresponse()
            return response.status, response.getheader('X-Pure-Error'), response.read()
        finally:
            connection.close()

    try:
        for _ in range(rounds):
            title = ''.join(rng.choice(pieces) for _ in range(rng.randint(0, 6)))
            body = ''.join(rng.choice(pieces) for _ in range(rng.randint(0, 4)))
            points = rng.choice([0, 1, -2.5, 1e3, 3.25e-2, 12345678.5])
            members = [('title', title), ('points', points), ('body', body)]
            rng.shuffle(members)
            text = json.dumps(dict(members), ensure_ascii=rng.random() < 0.5)
            text = text.replace(': ', ':' + ' ' * rng.randint(0, 2)).replace(', ', ',\n' if rng.random() < 0.3 else ', ')
            got = post('/inputs/add', text.encode())
            if title in notes:
                assert got[:2] == (409, 'exists'), (text, got)
                continue
            assert got == (200, 'none', title.encode()), (text, got)
            notes[title] = (body, points)
        rows = json.loads(http(host.port, 'GET', '/views/all')[3])['items']
        want = [{'title': t, 'body': notes[t][0], 'points': notes[t][1]} for t in sorted(notes, key=lambda t: t.encode())]
        assert rows == want, [(a, b) for a, b in zip(rows, want) if a != b][:2]
        # The query gives fixed fields; a body without JSON fills a message's one variable field only.
        assert post('/inputs/count?n=3', b'', json_body=False)[:2] == (200, 'none')
        assert post('/inputs/count', b'{"n": 4}')[:2] == (200, 'none')
        assert http(host.port, 'GET', '/views/counted_view')[3] == b'7'
        assert post('/inputs/add?points=2', b'{"title": "q-from-query", "body": ""}')[:2] == (200, 'none')
        wrong = [
            (b'{"title": "m", "points": 1}', 'missing_field'),
            (b'{"title": "m", "points": 1, "body": "", "extra": 1}', 'json_field'),
            (b'{"title": "m", "title": "n", "points": 1, "body": ""}', 'json_field'),
            (b'{"title": 1, "points": 1, "body": ""}', 'json_type'),
            (b'{"title": "m", "points": "1", "body": ""}', 'json_type'),
            (b'{"title": "m", "points": 1e999, "body": ""}', 'json_type'),
            (b'{"title": "m", "points": 01, "body": ""}', 'json'),
            (b'{"title": "m", "points": NaN, "body": ""}', 'json'),
            (b'{"title": "m", "points": 1, "body": "",}', 'json'),
            (b'{"title": "\\ud800", "points": 1, "body": ""}', 'json'),
            (b'{"title": "\xff", "points": 1, "body": ""}', 'json'),
            (b'{"title": "m", "points": 1, "body": ""} x', 'json'),
            (b'[1]', 'json'),
            (b'{"title": "m\n", "points": 1, "body": ""}', 'json'),  # a raw newline in a string
        ]
        for body, error in wrong:
            assert post('/inputs/add', body)[:2] == (400, error), (body, post('/inputs/add', body))
        assert post('/inputs/add?points=2', b'{"title": "m", "points": 1, "body": ""}')[:2] == (400, 'json_field')
        assert post('/inputs/add', b'plain', json_body=False)[:2] == (400, 'json')  # two text fields need JSON
        assert post('/inputs/count', b'{"n": -1}')[:2] == (400, 'json_type')
        assert post('/inputs/count', b'{"n": 4294967296}')[:2] == (400, 'json_type')
        # Groups: objects inside the body, members in any order, strings
        # read where they are (escaped ones unescaped over themselves).
        shipments = []
        for _ in range(rounds // 3):
            title, city, note = (''.join(rng.choice(pieces) for _ in range(rng.randint(0, 5))) for _ in range(3))
            zip_code = rng.randint(0, 99999)
            door = [('note', note)]
            to = [('city', city), ('zip', zip_code), ('door', dict(door))]
            rng.shuffle(to)
            members = [('title', title), ('to', dict(to))]
            rng.shuffle(members)
            text = json.dumps(dict(members), ensure_ascii=rng.random() < 0.5)
            got = post('/inputs/ship', text.encode())
            assert got == (200, 'none', note.encode()), (text, got)
            shipments.append({'title': title, 'city': city, 'note': note, 'zip': zip_code})
        # A group's fixed field from the query, by its path.
        assert post('/inputs/ship?to.zip=7', b'{"title": "q", "to": {"city": "c", "door": {"note": "n"}}}')[:2] == \
            (200, 'none')
        shipments.append({'title': 'q', 'city': 'c', 'note': 'n', 'zip': 7})
        rows = json.loads(http(host.port, 'GET', f'/views/shipments?count={len(shipments)}')[3])['items']
        assert rows == shipments, [(a, b) for a, b in zip(rows, shipments) if a != b][:2]
        grouped = '{"title": "t", "to": {"city": "c", "zip": 1, "door": {"note": "n"}}}'
        wrong_groups = [
            (grouped.replace('"zip": 1', '"zip": 1, "lat": 2'), 'json_field'),         # unknown member of a group
            (grouped.replace('"note": "n"', '"note": "n", "bell": {"x": 1}'), 'json_field'),
            (grouped.replace('"door": {"note": "n"}', '"door": "n"'), 'json_type'),    # a group as a value
            (grouped.replace('"title": "t"', '"title": {"a": "t"}'), 'json_type'),    # a field as a group
            (grouped.replace('"door": {"note": "n"}', '"door": {}'), 'missing_field'),
            (grouped.replace('"zip": 1', '"zip": 1, "zip": 2'), 'json_field'),
            (grouped.replace('"zip": 1', '"zip": [1]'), 'json_type'),
            (grouped.replace('"zip": 1', '"zip": null'), 'json_type'),
            (grouped.replace('"note": "n"', '"note": "n\\ud800"'), 'json'),
            (grouped.replace('"door": {"note": "n"}}', '"door": {"note": "n"}'), 'json'),  # unclosed
        ]
        for body, error in wrong_groups:
            assert post('/inputs/ship', body.encode())[:2] == (400, error), (body, post('/inputs/ship', body.encode()))
        assert post('/inputs/ship?to.zip=7', grouped.encode())[:2] == (400, 'json_field')  # given twice
    finally:
        host.stop()
    return rounds + len(wrong) + rounds // 3 + len(wrong_groups)


LINK_SENDER = """state n = 0
state total = 0
input buy = message {
  item: text
  count: u32
}
output ordered = message {
  item: text
  count: u32
  to: {
    city: text
  }
}
on buy {
  n = n + 1
  total = total + buy.count
  send ordered { item: buy.item, count: buy.count, to: { city: "Seoul" } }
}
view sent = n
view sent_total = total
"""

LINK_RECEIVER = """state stock = 0
state orders = 0
input order = message {
  item: text
  count: u32
  to: {
    city: text
  }
}
on order {
  require order.count < 100
  stock = stock + order.count
  orders = orders + 1
}
view total = stock
view count = orders
"""


def server_links(aup, pure, work):
    """Two served apps, one's output wired to the other's input over HTTP
    (--send). While four clients buy from the sender, the receiver and then
    the sender are killed (-9) and started again on their stores. In the end
    the receiver has applied every order the sender saved exactly once (its
    total and count equal the sender's), a refused order (count 150) was
    delivered once and did not hold back the order after it, and every
    acknowledged order is among the saved ones."""
    import select
    import signal
    import socket
    import threading
    import time
    sender_module, receiver_module = work / 'link-sender.pmod', work / 'link-receiver.pmod'
    for module, text in ((sender_module, LINK_SENDER), (receiver_module, LINK_RECEIVER)):
        source = module.with_suffix('.aup')
        source.write_text(text)
        compile_module(aup, source, module)

    def free_port():
        with socket.socket() as probe:
            probe.bind(('127.0.0.1', 0))
            return probe.getsockname()[1]

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        assert ready and process.stdout.readline(), 'host did not start'
        return process

    def post(port, path, body):
        import http.client
        connection = http.client.HTTPConnection('127.0.0.1', port, timeout=10)
        try:
            data = json.dumps(body).encode()
            connection.request('POST', path, data, {'Content-Length': str(len(data)), 'Content-Type': 'application/json'})
            response = connection.getresponse()
            response.read()
            return response.status
        finally:
            connection.close()

    def number(port, view):
        return int(http(port, 'GET', f'/views/{view}')[3])

    port_a, port_b = free_port(), free_port()
    receiver = [pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'link-b', '--threads', '2']
    sender = [pure / 'build/pure-serve', '--module', sender_module, '--store', work / 'link-a',
              '--send', f'ordered=http://127.0.0.1:{port_b}/inputs/order']
    hosts = {'b': start(receiver, port_b), 'a': start(sender, port_a)}
    acknowledged = [0] * 4
    stop = threading.Event()

    def client(which):
        rng = random.Random(which + 7700)
        while not stop.is_set():
            count = rng.randint(1, 20)
            try:
                status = post(port_a, '/inputs/buy', {'item': f'c{which}', 'count': count})
            except OSError:
                time.sleep(0.02)
                continue
            if status == 200:
                acknowledged[which] += count
            else:
                time.sleep(0.02)

    clients = [threading.Thread(target=client, args=(n,)) for n in range(len(acknowledged))]
    for thread in clients:
        thread.start()
    try:
        for name, args, port in (('b', receiver, port_b), ('a', sender, port_a)):
            time.sleep(0.6)
            hosts[name].send_signal(signal.SIGKILL)
            hosts[name].wait()
            time.sleep(0.3)
            hosts[name] = start(args, port)
        time.sleep(0.6)
    finally:
        stop.set()
        for thread in clients:
            thread.join()
    try:
        assert post(port_a, '/inputs/buy', {'item': 'big', 'count': 150}) == 200
        assert post(port_a, '/inputs/buy', {'item': 'after', 'count': 7}) == 200
        deadline = time.time() + 30
        while True:
            sent, sent_total = number(port_a, 'sent'), number(port_a, 'sent_total')
            count, total = number(port_b, 'count'), number(port_b, 'total')
            if (count, total) == (sent - 1, sent_total - 150) or time.time() > deadline:
                break
            time.sleep(0.1)
        assert (count, total) == (sent - 1, sent_total - 150), (count, total, sent, sent_total)
        assert sent_total >= sum(acknowledged) + 157 and sum(acknowledged) > 0, (sent_total, acknowledged)
    finally:
        stats = {}
        for name, process in hosts.items():
            process.terminate()
            _, error = process.communicate(timeout=30)
            assert process.returncode == 0, error[-1000:]
            stats[name] = [json.loads(line) for line in error.decode().splitlines() if line.startswith('{"active"')][-1]
    return {'orders': sent, 'acknowledged_total': sum(acknowledged), 'delivered_after_restart': stats['a']['delivered'],
            'attempts_after_restart': stats['a']['delivery_attempts']}


def server_links_udp(aup, pure, work, netem=None):
    """The same two apps linked without a connection (--send
    OUTPUT=pure://host:port/INPUT to the receiver's --link-port, sealed with
    the two nodes' keys, docs/design/011-pure-transport.md). While four
    clients buy from the sender, the receiver, then the sender, then both
    are killed (-9) and started again on their stores: neither side makes a
    handshake, and in the end the receiver has applied every order the
    sender saved exactly once, the refused order (count 150) did not hold
    back the one after it, and every acknowledged order is among the saved
    ones. With netem (in a network namespace of its own), the loopback
    delays, loses and reorders packets meanwhile. The receiver takes its
    senders from a file (--senders, the sender among a thousand others) and
    lets a sender's keys and streams go after 400 ms of quiet
    (--link-idle-ms): the order after a longer pause arrives all the same.
    Started again, it makes no X25519: the secret is remembered beside its
    key (KEY.links)."""
    import select
    import signal
    import socket
    import threading
    import time
    sender_module, receiver_module = work / 'udp-sender.pmod', work / 'udp-receiver.pmod'
    for module, text in ((sender_module, LINK_SENDER), (receiver_module, LINK_RECEIVER)):
        source = module.with_suffix('.aup')
        source.write_text(text)
        compile_module(aup, source, module)

    def free_port(kind=socket.SOCK_STREAM):
        with socket.socket(socket.AF_INET, kind) as probe:
            probe.bind(('127.0.0.1', 0))
            return probe.getsockname()[1]

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        line = process.stdout.readline() if ready else b''
        assert line, f'host did not start: {process.stderr.read(2000) if process.poll() is not None else ""}'
        return process, json.loads(line)

    def post(port, path, body):
        import http.client
        connection = http.client.HTTPConnection('127.0.0.1', port, timeout=10)
        try:
            data = json.dumps(body).encode()
            connection.request('POST', path, data, {'Content-Length': str(len(data)), 'Content-Type': 'application/json'})
            response = connection.getresponse()
            response.read()
            return response.status
        finally:
            connection.close()

    def number(port, view):
        return int(http(port, 'GET', f'/views/{view}')[3])

    tag = 'udp-lossy' if netem else 'udp'
    keys = {}
    for name in ('sender', 'receiver'):  # each node's key, made by the node itself
        process, info = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / f'{tag}-key',
                               '--key', work / f'{tag}-{name}.key'], 0)
        keys[name] = info['public_key']
        process.terminate()
        process.communicate(timeout=30)
    port_a, port_b, link_port = free_port(), free_port(), free_port(socket.SOCK_DGRAM)
    others = random.Random(4242)
    senders = [f'other{n} {others.getrandbits(256):064x}' for n in range(1000)]
    senders.insert(500, f'udp-sender.ordered {keys["sender"]}')
    (work / f'{tag}-senders').write_text('\n'.join(senders) + '\n')
    receiver = [pure / 'build/pure-serve', '--module', receiver_module, '--store', work / f'{tag}-b', '--threads', '2',
                '--key', work / f'{tag}-receiver.key', '--link-port', link_port,
                '--senders', work / f'{tag}-senders', '--link-idle-ms', '400']
    sender = [pure / 'build/pure-serve', '--module', sender_module, '--store', work / f'{tag}-a',
              '--key', work / f'{tag}-sender.key', '--send', f'ordered=pure://127.0.0.1:{link_port}/order',
              '--seal', f'ordered={keys["receiver"]}']
    hosts = {'b': start(receiver, port_b)[0], 'a': start(sender, port_a)[0]}
    acknowledged = [0] * 4
    stop = threading.Event()

    def client(which):
        rng = random.Random(which + 9900)
        while not stop.is_set():
            count = rng.randint(1, 20)
            try:
                status = post(port_a, '/inputs/buy', {'item': f'c{which}', 'count': count})
            except OSError:
                time.sleep(0.02)
                continue
            if status == 200:
                acknowledged[which] += count
            else:
                time.sleep(0.02)

    clients = [threading.Thread(target=client, args=(n,)) for n in range(len(acknowledged))]
    for thread in clients:
        thread.start()
    try:
        for names in (('b',), ('a',), ('a', 'b')):
            time.sleep(0.6)
            for name in names:
                hosts[name].send_signal(signal.SIGKILL)
                hosts[name].wait()
            time.sleep(0.3)
            for name in names:
                hosts[name] = start(receiver if name == 'b' else sender, port_b if name == 'b' else port_a)[0]
        time.sleep(0.6)
    finally:
        stop.set()
        for thread in clients:
            thread.join()
    try:
        assert post(port_a, '/inputs/buy', {'item': 'big', 'count': 150}) == 200
        assert post(port_a, '/inputs/buy', {'item': 'after', 'count': 7}) == 200
        deadline = time.time() + 60
        while True:
            sent, sent_total = number(port_a, 'sent'), number(port_a, 'sent_total')
            count, total = number(port_b, 'count'), number(port_b, 'total')
            if (count, total) == (sent - 1, sent_total - 150) or time.time() > deadline:
                break
            time.sleep(0.1)
        assert (count, total) == (sent - 1, sent_total - 150), (count, total, sent, sent_total)
        assert sent_total >= sum(acknowledged) + 157 and sum(acknowledged) > 0, (sent_total, acknowledged)
        time.sleep(1.2)  # the receiver lets the quiet sender go
        assert post(port_a, '/inputs/buy', {'item': 'late', 'count': 3}) == 200
        deadline = time.time() + 30
        while (number(port_b, 'count'), number(port_b, 'total')) != (sent, sent_total - 147) and time.time() < deadline:
            time.sleep(0.05)
        assert (number(port_b, 'count'), number(port_b, 'total')) == (sent, sent_total - 147)
    finally:
        stats = {}
        for name, process in hosts.items():
            process.terminate()
            _, error = process.communicate(timeout=30)
            assert process.returncode == 0, error[-1000:]
            stats[name] = [json.loads(line) for line in error.decode().splitlines() if line.startswith('{"active"')][-1]
    # The receiver, started again, remembered the sender's secret: no X25519 for it.
    assert stats['b']['listener_swept'] >= 1 and stats['b']['listener_woken'] >= 2, stats['b']
    assert stats['b']['listener_remembered'] == stats['b']['listener_woken'], stats['b']
    return {'orders': sent, 'acknowledged_total': sum(acknowledged),
            'packets_after_restart': stats['a']['link_packets'], 'resent_after_restart': stats['a']['link_resent'],
            'lost_after_restart': stats['a']['link_lost'], 'received_after_restart': stats['b']['listener_received'],
            'woken_after_restart': stats['b']['listener_woken'], 'swept_after_restart': stats['b']['listener_swept'],
            'remembered_after_restart': stats['b']['listener_remembered']}


def server_links_udp_lossy(aup, pure, work):
    """server_links_udp in a network namespace of its own (unshare -rn, no
    privileges), its loopback delaying (5 ms, 2 ms jitter), losing (3 %) and
    reordering (10 %) the link's packets (UDP; the clients' HTTP goes
    straight). None where there is no unshare or tc."""
    import shutil
    unshare = shutil.which('unshare')
    tc = shutil.which('tc') or next((path for path in ('/usr/sbin/tc', '/sbin/tc') if Path(path).exists()), None)
    ip = shutil.which('ip') or next((path for path in ('/usr/sbin/ip', '/sbin/ip', '/bin/ip') if Path(path).exists()), None)
    if not unshare or not tc or not ip or subprocess.run([unshare, '-rn', 'true'], capture_output=True).returncode:
        return None
    script = f"""
import json, subprocess, sys
from pathlib import Path
sys.path.insert(0, {str(HERE)!r})
import check
subprocess.run([{ip!r}, 'link', 'set', 'lo', 'up'], check=True)
# UDP alone through netem (the clients' HTTP stays quick): a prio qdisc, its third band netem, a filter
for rule in (['qdisc', 'add', 'dev', 'lo', 'root', 'handle', '1:', 'prio'],
             ['qdisc', 'add', 'dev', 'lo', 'parent', '1:3', 'handle', '30:', 'netem', 'delay', '5ms', '2ms',
              'loss', '3%', 'reorder', '10%'],
             ['filter', 'add', 'dev', 'lo', 'protocol', 'ip', 'parent', '1:0', 'prio', '3', 'u32', 'match', 'ip',
              'protocol', '17', '0xff', 'flowid', '1:3']):
    subprocess.run([{tc!r}] + rule, check=True)
print(json.dumps(check.server_links_udp(Path({str(aup)!r}), Path({str(pure)!r}), Path({str(work)!r}), netem=True)))
"""
    done = subprocess.run([unshare, '-rn', sys.executable, '-c', script], capture_output=True, text=True, timeout=600)
    assert done.returncode == 0, done.stderr[-3000:]
    return json.loads(done.stdout.strip().splitlines()[-1])


RANGES_SOURCE = """record Item { id = 0 }
state rows: list of Item by id
state other: list of Item by id
state at: index of other
state limit = 2
state done = 0
state below = 0
input seed = key KeyS
input go = key KeyG
input count = key KeyC
on seed.down {
  rows.add(Item { id: 0 })
  rows.add(Item { id: 1 })
  rows.add(Item { id: 2 })
  rows.add(Item { id: 3 })
  rows.add(Item { id: 4 })
  other.add(Item { id: 100 })
}
on go.down {
  for r in rows where r.id <= at.position {
    other.add(Item { id: -r.id - 1 - done })
    done = done + 1
  }
}
on count.down {
  for r in rows where r.id <= limit {
    below = below + 1
  }
}
view total = done
view counted = below
"""


def module_ranges(aup, pure, work):
    """A walk whose where reads an index into a list its body inserts into:
    each insert before the index's item moves the index on, so the walk's
    bound moves with it and all five rows pass, twice (review 004, F1). The
    module runs ranged and not from the same keys (build/module-probe), and
    the two must end the same, state for state; a walk whose bound its body
    cannot move stays ranged."""
    source, module = work / 'ranges.aup', work / 'ranges.pmod'
    source.write_text(RANGES_SOURCE)
    compile_module(aup, source, module)
    done = subprocess.run([str(pure / 'build/module-probe'), str(module), 'seed', 'go', 'count', 'go'],
                          capture_output=True, text=True, timeout=60)
    assert done.returncode == 0, done.stderr
    row = json.loads(done.stdout)
    states = row['states']
    assert states['done'] == 10 and states['at'] == 10 and states['below'] == 3, row
    assert row['ranged'] >= 1, row
    return row


def server_links_refused(aup, pure, work):
    """A link to an input the receiver's app does not have: the receiver
    says so (REFUSED), and the sender says it once on stderr, as a wire says
    a receiver does not take its sends, and tries a packet a wait instead of
    sending its records again every second."""
    import select
    import socket
    import time
    sender_module, receiver_module = work / 'refused-sender.pmod', work / 'refused-receiver.pmod'
    for module, text in ((sender_module, LINK_SENDER), (receiver_module, LINK_RECEIVER)):
        source = module.with_suffix('.aup')
        source.write_text(text)
        compile_module(aup, source, module)

    def free_port(kind=socket.SOCK_STREAM):
        with socket.socket(socket.AF_INET, kind) as probe:
            probe.bind(('127.0.0.1', 0))
            return probe.getsockname()[1]

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        line = process.stdout.readline() if ready else b''
        assert line, f'host did not start: {process.stderr.read(2000) if process.poll() is not None else ""}'
        return process, json.loads(line)

    keys = {}
    for name in ('sender', 'receiver'):
        process, info = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'refused-key',
                               '--key', work / f'refused-{name}.key'], 0)
        keys[name] = info['public_key']
        process.terminate()
        process.communicate(timeout=30)
    port_a, port_b, link_port = free_port(), free_port(), free_port(socket.SOCK_DGRAM)
    receiver = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'refused-b',
                      '--key', work / 'refused-receiver.key', '--link-port', link_port,
                      '--sender', f'refused-sender.ordered={keys["sender"]}'], port_b)[0]
    sender = start([pure / 'build/pure-serve', '--module', sender_module, '--store', work / 'refused-a',
                    '--key', work / 'refused-sender.key', '--send', f'ordered=pure://127.0.0.1:{link_port}/nosuch',
                    '--seal', f'ordered={keys["receiver"]}'], port_a)[0]
    said = []
    try:
        import http.client
        connection = http.client.HTTPConnection('127.0.0.1', port_a, timeout=10)
        body = json.dumps({'item': 'x', 'count': 1}).encode()
        connection.request('POST', '/inputs/buy', body, {'Content-Length': str(len(body)), 'Content-Type': 'application/json'})
        assert connection.getresponse().status == 200
        connection.close()
        deadline = time.time() + 10
        while not said and time.time() < deadline:
            ready, _, _ = select.select([sender.stderr], [], [], 0.1)
            if ready:
                line = sender.stderr.readline().decode()
                if line.startswith('{"link"'):
                    said.append(json.loads(line))
        assert said and said[0]['error'].startswith('the receiver refuses the stream: it has no input of that name'), said
        time.sleep(2.5)  # tried at 1 s and at 3 s: not every second, and said once
    finally:
        stats = {}
        for name, process in (('a', sender), ('b', receiver)):
            process.terminate()
            _, error = process.communicate(timeout=30)
            assert process.returncode == 0, error[-1000:]
            lines = error.decode().splitlines()
            stats[name] = [json.loads(line) for line in lines if line.startswith('{"active"')][-1]
            if name == 'a':
                said += [json.loads(line) for line in lines if line.startswith('{"link"')]
    assert len(said) == 1, said
    assert stats['a']['link_packets'] <= 8 and stats['a']['link_records'] <= 4, stats['a']
    assert stats['a']['link_refused'] >= 2 and stats['b']['listener_refused'] >= 2, (stats['a'], stats['b'])
    return {'said': said[0]['error'], 'packets': stats['a']['link_packets']}



MEMORY_RECEIVER = """record Order {
  item: text
  count = 0
}
state kept: list of Order
state got = 0
input order = message {
  item: text
  count: u32
  to: {
    city: text
  }
}
input clean = message {
  below: u32
}
on order {
  kept.append(Order { item: order.item, count: order.count })
  got = got + 1
}
on clean {
  for o in kept where o.count < clean.below {
    kept.remove(o)
  }
}
view count = got
view held = kept.count
"""


def server_memory(aup, pure, work):
    """What an app holds, bounded (--memory, docs/design/013-memory-budget.md).
    A sender whose link's receiver is down fills its outbox: its next buy is
    refused, 503 memory, and changes nothing, while its views still read;
    once the receiver is up and stores what waited, it takes buys again. The
    receiver, started again with a budget below what it keeps, refuses the
    link's deliveries (and a client's order, 503 memory) but not the clean
    that frees them; meanwhile its link hands the records over a few times a
    second, not at every turn, and once freed it takes them all, once."""
    import select
    import socket
    import time
    sender_module, receiver_module = work / 'memory-sender.pmod', work / 'memory-receiver.pmod'
    for module, text in ((sender_module, LINK_SENDER), (receiver_module, MEMORY_RECEIVER)):
        source = module.with_suffix('.aup')
        source.write_text(text)
        compile_module(aup, source, module)

    def free_port(kind=socket.SOCK_STREAM):
        with socket.socket(socket.AF_INET, kind) as probe:
            probe.bind(('127.0.0.1', 0))
            return probe.getsockname()[1]

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        line = process.stdout.readline() if ready else b''
        assert line, f'host did not start: {process.stderr.read(2000) if process.poll() is not None else ""}'
        return process, json.loads(line)

    def stop(process):
        process.terminate()
        _, error = process.communicate(timeout=30)
        assert process.returncode == 0, error[-1000:]
        return [json.loads(line) for line in error.decode().splitlines() if line.startswith('{"active"')][-1]

    def number(port, view):
        return int(http(port, 'GET', f'/views/{view}')[3])

    def until(test, seconds):  # test once more at most after the deadline: it may post
        deadline = time.time() + seconds
        while not test():
            if time.time() > deadline:
                return False
            time.sleep(0.02)
        return True

    keys = {}
    for name in ('sender', 'receiver'):
        process, info = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'memory-key',
                               '--key', work / f'memory-{name}.key'], 0)
        keys[name] = info['public_key']
        stop(process)
    port_a, port_b, link_port = free_port(), free_port(), free_port(socket.SOCK_DGRAM)
    receiving = [pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'memory-b',
                 '--key', work / 'memory-receiver.key', '--link-port', link_port,
                 '--sender', f'memory-sender.ordered={keys["sender"]}']
    sender = start([pure / 'build/pure-serve', '--module', sender_module, '--store', work / 'memory-a',
                    '--key', work / 'memory-sender.key', '--send', f'ordered=pure://127.0.0.1:{link_port}/order',
                    '--seal', f'ordered={keys["receiver"]}', '--memory', 1000], port_a)[0]
    receiver, stats, item = None, {}, 'x' * 40
    try:
        accepted, refused = 0, None
        while accepted < 200 and not refused:
            status = post(port_a, '/inputs/buy', {'item': item, 'count': 1})
            accepted += status[0] == 200
            refused = status if status[0] != 200 else None
        assert refused == (503, 'memory') and 3 <= accepted < 200, (accepted, refused)
        assert number(port_a, 'sent') == accepted
        receiver = start(receiving, port_b)[0]
        assert until(lambda: number(port_b, 'count') == accepted, 20), number(port_b, 'count')
        assert until(lambda: post(port_a, '/inputs/buy', {'item': item, 'count': 1})[0] == 200, 10)
        assert until(lambda: number(port_b, 'count') == accepted + 1, 10)
        stop(receiver)
        receiver = start(receiving + ['--memory', 300], port_b)[0]  # below what it keeps
        order = {'item': item, 'count': 1, 'to': {'city': 'Seoul'}}
        assert post(port_b, '/inputs/order', order) == (503, 'memory')
        for _ in range(3):
            assert post(port_a, '/inputs/buy', {'item': item, 'count': 1})[0] == 200
        time.sleep(2.0)
        assert number(port_b, 'count') == accepted + 1 and number(port_a, 'sent') == accepted + 4
        assert post(port_b, '/inputs/clean', {'below': 100})[0] == 200
        assert until(lambda: number(port_b, 'count') == accepted + 4, 5), number(port_b, 'count')
        assert number(port_b, 'held') == 3
    finally:
        for name, process in (('b', receiver), ('a', sender)):
            if process:
                stats[name] = stop(process)
    assert stats['a']['memory_refused'] >= 1 and stats['a']['state_bytes'] <= 1000, stats['a']
    assert 2 <= stats['b']['memory_refused'] <= 40 and stats['b']['state_bytes'] <= 300, stats['b']
    return {'sends_held': accepted, 'receiver_refused': stats['b']['memory_refused'],
            'link_resent': stats['a']['link_resent']}


WINDOW_SENDER = """state n = 0
input buy = message {
  item: text
  count: u32
}
output ordered = message {
  item: text
  count: u32
  to: {
    city: text
  }
}
output copied = message {
  item: text
  count: u32
  to: {
    city: text
  }
}
on buy {
  n = n + 1
  send ordered { item: buy.item, count: buy.count, to: { city: "Seoul" } }
  send copied { item: buy.item, count: buy.count, to: { city: "Busan" } }
}
view sent = n
"""


def server_windows(aup, pure, work):
    """Each --send holds a window of its sends (--window bytes past what its
    receiver has), not the whole outbox (docs/design/013-memory-budget.md,
    step 2). A sender's two outputs, one linked (pure://) and one over HTTP,
    both receivers down: 300 buys wait, each outlet holding some 2,000
    bytes of them. When the receivers come up, the outlets take the rest
    from the outbox as their receivers store what they hold, and each
    receiver applies all 300, once each."""
    import select
    import socket
    import time
    sender_module, receiver_module = work / 'window-sender.pmod', work / 'window-receiver.pmod'
    for module, text in ((sender_module, WINDOW_SENDER), (receiver_module, LINK_RECEIVER)):
        source = module.with_suffix('.aup')
        source.write_text(text)
        compile_module(aup, source, module)

    def free_port(kind=socket.SOCK_STREAM):
        with socket.socket(socket.AF_INET, kind) as probe:
            probe.bind(('127.0.0.1', 0))
            return probe.getsockname()[1]

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        line = process.stdout.readline() if ready else b''
        assert line, f'host did not start: {process.stderr.read(2000) if process.poll() is not None else ""}'
        return process, json.loads(line)

    def stop(process):
        process.terminate()
        _, error = process.communicate(timeout=30)
        assert process.returncode == 0, error[-1000:]
        return [json.loads(line) for line in error.decode().splitlines() if line.startswith('{"active"')][-1]

    def number(port, view):
        return int(http(port, 'GET', f'/views/{view}')[3])

    keys = {}
    for name in ('sender', 'receiver'):
        process, info = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'window-key',
                               '--key', work / f'window-{name}.key'], 0)
        keys[name] = info['public_key']
        stop(process)
    port_a, port_b, port_c, link_port = free_port(), free_port(), free_port(), free_port(socket.SOCK_DGRAM)
    sender = start([pure / 'build/pure-serve', '--module', sender_module, '--store', work / 'window-a',
                    '--key', work / 'window-sender.key', '--window', 2000,
                    '--send', f'ordered=pure://127.0.0.1:{link_port}/order', '--seal', f'ordered={keys["receiver"]}',
                    '--send', f'copied=http://127.0.0.1:{port_c}/inputs/order'], port_a)[0]
    receivers, stats, total = [], {}, 0
    try:
        for i in range(300):
            count = i % 50 + 1
            assert post(port_a, '/inputs/buy', {'item': f'i{i:03}', 'count': count})[0] == 200
            total += count
        time.sleep(0.5)
        receivers.append(start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'window-b',
                                '--key', work / 'window-receiver.key', '--link-port', link_port,
                                '--sender', f'window-sender.ordered={keys["sender"]}'], port_b)[0])
        receivers.append(start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'window-c'],
                               port_c)[0])
        deadline = time.time() + 60
        while (number(port_b, 'count') < 300 or number(port_c, 'count') < 300) and time.time() < deadline:
            time.sleep(0.05)
        for port in (port_b, port_c):
            assert number(port, 'count') == 300 and number(port, 'total') == total, (port, number(port, 'count'))
    finally:
        for name, process in zip(('b', 'c'), receivers):
            stats[name] = stop(process)
        stats['a'] = stop(sender)
    assert stats['a']['windows_full'] >= 1, stats['a']
    return {'windows_full': stats['a']['windows_full'], 'wire_deliveries': stats['a']['delivered'],
            'link_records': stats['a']['link_records']}


UPGRADED_SENDER = """state n = 0
input buy = message {
  item: text
  count: u32
}
output ordered = message {
  note: text
  item: text
  count: u32
}
on buy {
  n = n + 1
  send ordered { note: "second", item: buy.item, count: buy.count }
}
view sent = n
"""

UPGRADED_RECEIVER = """state orders = 0
state noted = 0
state stock = 0
input order = message {
  item: text
  count: u32
  note: text
}
on order {
  orders = orders + 1
  stock = stock + order.count
  if order.note == "second" { noted = noted + 1 }
}
view count = orders
view noted_count = noted
view total = stock
"""


def server_upgrade(aup, pure, work):
    """A rolling upgrade of an output's fields between two linked nodes. The
    sender, its receiver down, holds five sends of ordered {item, count,
    to.city}; started again with ordered {note, item, count} it recasts them
    by name (note empty, to.city gone) where it was refused before (review
    004's F3), and a module without the output is refused naming it. The old
    receiver lacks note, so it refuses them (it would drop the field) and
    they wait; the upgraded receiver, its fields in another order, takes all
    eight by name, once each."""
    import select
    import socket
    import time
    modules = {}
    for name, text in (('sender-1', LINK_SENDER), ('sender-2', UPGRADED_SENDER), ('receiver-1', LINK_RECEIVER),
                       ('receiver-2', UPGRADED_RECEIVER), ('sender-0', 'state n = 0\ninput tap = key KeyT\non tap.down { n = 1 }\n')):
        source = work / f'upgrade-{name}.aup'
        source.write_text(text)
        modules[name] = compile_module(aup, source, source.with_suffix('.pmod')) and source.with_suffix('.pmod')

    def free_port(kind=socket.SOCK_STREAM):
        with socket.socket(socket.AF_INET, kind) as probe:
            probe.bind(('127.0.0.1', 0))
            return probe.getsockname()[1]

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        line = process.stdout.readline() if ready else b''
        assert line, f'host did not start: {process.stderr.read(2000) if process.poll() is not None else ""}'
        return process, json.loads(line)

    def stop(process):
        process.terminate()
        _, error = process.communicate(timeout=30)
        assert process.returncode == 0, error[-1000:]
        return [json.loads(line) for line in error.decode().splitlines() if line.startswith('{"active"')][-1]

    def number(port, view):
        return int(http(port, 'GET', f'/views/{view}')[3])

    keys = {}
    for name in ('sender', 'receiver'):
        process, info = start([pure / 'build/pure-serve', '--module', modules['receiver-1'], '--store',
                               work / 'upgrade-key', '--key', work / f'upgrade-{name}.key'], 0)
        keys[name] = info['public_key']
        stop(process)
    port_a, port_b, link_port = free_port(), free_port(), free_port(socket.SOCK_DGRAM)

    def sender_args(module):
        return [pure / 'build/pure-serve', '--module', modules[module], '--store', work / 'upgrade-a', '--key',
                work / 'upgrade-sender.key', '--name', 'up', '--send', f'ordered=pure://127.0.0.1:{link_port}/order',
                '--seal', f'ordered={keys["receiver"]}']

    def receiver_args(module):
        return [pure / 'build/pure-serve', '--module', modules[module], '--store', work / 'upgrade-b', '--key',
                work / 'upgrade-receiver.key', '--link-port', link_port, '--sender', f'up.ordered={keys["sender"]}']

    running, stats, said = {}, {}, ''
    try:
        running['a'] = start(sender_args('sender-1'), port_a)[0]
        for i in range(5):
            assert post(port_a, '/inputs/buy', {'item': f'first-{i}', 'count': 1})[0] == 200
        stop(running.pop('a'))
        refused = subprocess.run([str(a) for a in sender_args('sender-0')] + ['--port', str(port_a)],
                                 capture_output=True, timeout=30)
        assert refused.returncode != 0 and b"sends wait on the output 'ordered'" in refused.stderr, refused.stderr
        running['a'] = start(sender_args('sender-2'), port_a)[0]
        for i in range(3):
            assert post(port_a, '/inputs/buy', {'item': f'second-{i}', 'count': 10})[0] == 200
        running['b'] = start(receiver_args('receiver-1'), port_b)[0]
        time.sleep(1.5)
        assert number(port_b, 'count') == 0  # the old input takes another shape: the sends wait
        stop(running.pop('b'))
        running['b'] = start(receiver_args('receiver-2'), port_b)[0]
        deadline = time.time() + 20
        while number(port_b, 'count') < 8 and time.time() < deadline:
            time.sleep(0.05)
        got = (number(port_b, 'count'), number(port_b, 'noted_count'), number(port_b, 'total'))
        assert got == (8, 3, 35), got
    finally:
        for name, process in running.items():
            stats[name] = stop(process)
    assert stats['a']['link_refused'] >= 1, stats['a']
    return {'recast_waiting': 5, 'delivered': 8, 'refused_while_old': stats['a']['link_refused']}


FIELDS_SENDER = """input buy = message {
  item: text
  count: u32
}
output swapped = message {
  count: u32
  item: text
}
output plain = message {
  item: text
  count: u32
}
output noted = message {
  item: text
  count: u32
  note: text
}
output over_http = message {
  item: text
  count: u32
}
output noted_http = message {
  item: text
  count: u32
  note: text
}
on buy {
  send swapped { count: buy.count, item: buy.item }
  send plain { item: buy.item, count: buy.count }
  send noted { item: buy.item, count: buy.count, note: "kept" }
  send over_http { item: buy.item, count: buy.count }
  send noted_http { item: buy.item, count: buy.count, note: "kept" }
}
"""


def fields_receiver(narrow_notes):
    """Inputs for FIELDS_SENDER's outputs; narrow ones lack note unless narrow_notes."""
    note = '  note: text\n' if narrow_notes else ''
    kept = lambda name: f'  if {name}.note == "kept" {{ {name}_kept = {name}_kept + 1 }}\n' if narrow_notes else ''
    return (f"""state swapped_n = 0
state swapped_total = 0
state wider_n = 0
state wider_blank = 0
state narrow_n = 0
state narrow_kept = 0
state wider_http_n = 0
state wider_http_blank = 0
state narrow_http_n = 0
state narrow_http_kept = 0
input swapped_in = message {{
  item: text
  count: u32
}}
input wider = message {{
  note: text
  item: text
  count: u32
}}
input narrow = message {{
  item: text
  count: u32
{note}}}
input wider_http = message {{
  item: text
  count: u32
  note: text
}}
input narrow_http = message {{
  item: text
  count: u32
{note}}}
on swapped_in {{
  swapped_n = swapped_n + 1
  swapped_total = swapped_total + swapped_in.count
}}
on wider {{
  wider_n = wider_n + 1
  if wider.note == "" {{ wider_blank = wider_blank + 1 }}
}}
on narrow {{
  narrow_n = narrow_n + 1
{kept('narrow')}}}
on wider_http {{
  wider_http_n = wider_http_n + 1
  if wider_http.note == "" {{ wider_http_blank = wider_http_blank + 1 }}
}}
on narrow_http {{
  narrow_http_n = narrow_http_n + 1
{kept('narrow_http')}}}
view counts = "{{swapped_n}} {{swapped_total}} {{wider_n}} {{wider_blank}} {{narrow_n}} {{narrow_kept}} {{wider_http_n}} {{wider_http_blank}} {{narrow_http_n}} {{narrow_http_kept}}"
""")


def server_fields(aup, pure, work):
    """Deliveries take their fields by name (docs/design/014-fields-by-name.md).
    A sender's five outputs, three linked and two over HTTP, to one receiver:
    fields in another order are taken; an input with a field more takes
    messages without it (empty); an input lacking a field the output sends
    refuses it, over the link (REFUSED, fields lacked) and over HTTP
    (json_field), so nothing is dropped, and once the receiver starts again
    with the field, every waiting message comes, the field kept."""
    import select
    import socket
    import time
    modules = {}
    for name, text in (('sender', FIELDS_SENDER), ('receiver-1', fields_receiver(False)),
                       ('receiver-2', fields_receiver(True))):
        source = work / f'fields-{name}.aup'
        source.write_text(text)
        compile_module(aup, source, source.with_suffix('.pmod'))
        modules[name] = source.with_suffix('.pmod')

    def free_port(kind=socket.SOCK_STREAM):
        with socket.socket(socket.AF_INET, kind) as probe:
            probe.bind(('127.0.0.1', 0))
            return probe.getsockname()[1]

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        line = process.stdout.readline() if ready else b''
        assert line, f'host did not start: {process.stderr.read(2000) if process.poll() is not None else ""}'
        return process, json.loads(line)

    def stop(process):
        process.terminate()
        _, error = process.communicate(timeout=30)
        assert process.returncode == 0, error[-1000:]
        return error.decode()

    def counts(port):
        return [int(n) for n in http(port, 'GET', '/views/counts')[3].split()]

    keys = {}
    for name in ('sender', 'receiver'):
        process, info = start([pure / 'build/pure-serve', '--module', modules['receiver-1'], '--store',
                               work / 'fields-key', '--key', work / f'fields-{name}.key'], 0)
        keys[name] = info['public_key']
        stop(process)
    port_a, port_b, link_port = free_port(), free_port(), free_port(socket.SOCK_DGRAM)
    links = {'swapped': 'swapped_in', 'plain': 'wider', 'noted': 'narrow'}
    sending = [pure / 'build/pure-serve', '--module', modules['sender'], '--store', work / 'fields-a', '--key',
               work / 'fields-sender.key', '--name', 'up',
               '--send', f'over_http=http://127.0.0.1:{port_b}/inputs/wider_http',
               '--send', f'noted_http=http://127.0.0.1:{port_b}/inputs/narrow_http',
               '--seal', f'over_http={keys["receiver"]}', '--seal', f'noted_http={keys["receiver"]}']
    for output, input_name in links.items():
        sending += ['--send', f'{output}=pure://127.0.0.1:{link_port}/{input_name}', '--seal', f'{output}={keys["receiver"]}']

    def receiving(module):
        args = [pure / 'build/pure-serve', '--module', modules[module], '--store', work / 'fields-b', '--key',
                work / 'fields-receiver.key', '--link-port', link_port]
        for output in (*links, 'over_http', 'noted_http'):
            args += ['--sender', f'up.{output}={keys["sender"]}']
        return args

    running, said = {}, ''
    try:
        running['b'] = start(receiving('receiver-1'), port_b)[0]
        running['a'] = start(sending, port_a)[0]
        for i in range(3):
            assert post(port_a, '/inputs/buy', {'item': f'i{i}', 'count': i + 1})[0] == 200
        deadline = time.time() + 20
        while counts(port_b)[:4] + counts(port_b)[6:8] != [3, 6, 3, 3, 3, 3] and time.time() < deadline:
            time.sleep(0.05)
        got = counts(port_b)
        assert got == [3, 6, 3, 3, 0, 0, 3, 3, 0, 0], got  # the narrow inputs took none: nothing is dropped
        time.sleep(1.5)  # the refused link tried with its fields named: the sender has said why
        stop(running.pop('b'))
        running['b'] = start(receiving('receiver-2'), port_b)[0]
        deadline = time.time() + 30
        while counts(port_b)[4:6] + counts(port_b)[8:] != [3, 3, 3, 3] and time.time() < deadline:
            time.sleep(0.1)
        got = counts(port_b)
        assert got == [3, 6, 3, 3, 3, 3, 3, 3, 3, 3], got
    finally:
        for name, process in running.items():
            text = stop(process)
            said += text if name == 'a' else ''
    assert 'its input lacks fields this output sends' in said, said[-2000:]
    return {'links': 3, 'wires': 2, 'waited_then_taken': 6}

def server_links_independent(aup, pure, work):
    """A receiver written from docs/design/012-link-protocol.md alone, in
    Python with the cryptography package and no code of link/: a Pure node
    links to it (pure://). It checks the node's address with a CHALLENGE,
    opens the node's packets, takes its records in order, answers with ACK
    and STORED, and accepts its epoch 1, so the node goes on in the epoch
    the two made. In the end the node knows every order it saved stored,
    and some of them came sealed in epoch 1. None where the cryptography
    package is not there."""
    try:
        from cryptography.hazmat.primitives import hashes, serialization
        from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey, X25519PublicKey
        from cryptography.hazmat.primitives.ciphers.aead import AESGCM
        from cryptography.hazmat.primitives.kdf.hkdf import HKDF
    except ImportError:
        return None
    import os
    import select
    import socket
    import struct
    import threading
    import time

    def hkdf(secret, info, size):
        return HKDF(algorithm=hashes.SHA256(), length=size, salt=b'pure link 0', info=info).derive(secret)

    def raw(key):
        return key.public_key().public_bytes(serialization.Encoding.Raw, serialization.PublicFormat.Raw)

    def key_id(public):
        h = 2166136261
        for byte in public:
            h = (h ^ byte) * 16777619 & 0xffffffff
        return h

    def packet_keys(secret, sender, receiver, sender_run, receiver_run):
        out = hkdf(secret, b'pure link 0 keys' + sender + receiver + struct.pack('<QQ', sender_run, receiver_run), 28)
        return AESGCM(out[:16]), out[16:]

    def nonce(base, pn):
        return base[:4] + bytes(a ^ b for a, b in zip(base[4:], struct.pack('>Q', pn)))

    def names(body, at):
        a = body[at]
        b = body[at + 1 + a]
        return body[at + 1:at + 1 + a], body[at + 2 + a:at + 2 + a + b], at + 2 + a + b

    def varint(body, at):
        value = shift = 0
        while True:
            byte = body[at]
            value |= (byte & 0x7f) << shift
            at += 1
            if not byte & 0x80:
                return value, at
            shift += 7

    module = work / 'independent-sender.pmod'
    source = module.with_suffix('.aup')
    source.write_text(LINK_SENDER)
    compile_module(aup, source, module)

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        line = process.stdout.readline() if ready else b''
        assert line, f'host did not start: {process.stderr.read(2000) if process.poll() is not None else ""}'
        return process, json.loads(line)

    mine = X25519PrivateKey.generate()
    my_public = raw(mine)
    link = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    link.bind(('127.0.0.1', 0))
    with socket.socket() as probe:
        probe.bind(('127.0.0.1', 0))
        port = probe.getsockname()[1]
    node, info = start([pure / 'build/pure-serve', '--module', module, '--store', work / 'independent-a',
                        '--key', work / 'independent.key', '--send',
                        f'ordered=pure://127.0.0.1:{link.getsockname()[1]}/order', '--seal', f'ordered={my_public.hex()}'],
                       port)
    theirs = bytes.fromhex(info['public_key'])
    static = mine.exchange(X25519PublicKey.from_public_bytes(theirs))
    orders = 200

    def buy():
        import http.client
        for n in range(orders):
            connection = http.client.HTTPConnection('127.0.0.1', port, timeout=10)
            body = json.dumps({'item': f'i{n}', 'count': 1}).encode()
            connection.request('POST', '/inputs/buy', body, {'Content-Length': str(len(body)),
                                                             'Content-Type': 'application/json'})
            assert connection.getresponse().status == 200
            connection.close()

    buyer = threading.Thread(target=buy)
    buyer.start()
    runs = {}  # the node's runs: their epochs, answers and the numbers had
    stream, heard, early = None, 0, {}
    opened = {0: 0, 1: 0}
    deadline, done_at = time.time() + 30, None
    try:
        while time.time() < deadline and (done_at is None or time.time() < done_at):
            ready, _, _ = select.select([link], [], [], 0.05)
            if not ready:
                continue
            packet, address = link.recvfrom(2048)
            if not 37 <= len(packet) <= 1452 or packet[0] >> 4 != 0x7:
                continue
            key, run, pn = struct.unpack_from('<IQQ', packet, 1)
            assert key == key_id(theirs), 'a packet under another key id'
            r = runs.setdefault(run, {'epochs': {0: static}, 'now': 0, 'next': None, 'answer_run': 0, 'pn': 0,
                                      'had': set(), 'address': None, 'challenge': int.from_bytes(os.urandom(8), 'little'),
                                      'checked': False, 'bytes_in': 0, 'bytes_out': 0})
            if not r['answer_run']:
                r['answer_run'] = int.from_bytes(os.urandom(8), 'little') or 1
            epoch = packet[0] & 15
            tried = [n for n in {r['now'], r['next'][0] if r['next'] else r['now']} if n & 15 == epoch]
            if epoch == 0 and r['now']:
                tried.append(0)
            body = None
            for n in tried:
                secret = r['epochs'][n] if n in r['epochs'] else r['next'][1]
                aead, base = packet_keys(secret, theirs, my_public, run, 0)
                try:
                    body = aead.decrypt(nonce(base, pn), packet[21:], packet[:21])
                except Exception:
                    continue
                if r['next'] and n == r['next'][0]:  # the epoch accepted is used: it is the run's now
                    r['epochs'][n], r['now'], r['next'] = r['next'][1], n, None
                opened[min(n, 1)] += 1
                break
            assert body is not None, f'a packet of the node did not open (epoch {epoch})'
            if pn in r['had']:
                continue
            newest = not r['had'] or pn > max(r['had'])
            r['had'].add(pn)
            if newest and address != r['address']:
                r['address'], r['checked'], r['bytes_in'], r['bytes_out'] = address, False, 0, 0
            r['bytes_in'] += len(packet)
            at, offer = 0, None
            while at < len(body):
                kind = body[at]
                at += 1
                if kind == 0x01:  # STREAM
                    source_name, input_name, at = names(body, at)
                    at += 4
                    stream = (source_name, input_name)
                    assert input_name == b'order' and source_name == b'independent-sender.ordered', stream
                elif kind == 0x02:  # RECORD: small sends come whole
                    number, size, offset, length = struct.unpack_from('<QIIH', body, at)
                    at += 18
                    assert offset == 0 and length == size, 'a part of a small send'
                    early[number] = body[at:at + length]
                    at += length
                elif kind == 0x06:  # RECORDS
                    first, count = struct.unpack_from('<QB', body, at)
                    at += 9
                    for k in range(count):
                        size, at = varint(body, at)
                        early[first + k] = body[at:at + size]
                        at += size
                elif kind == 0x08:  # RESPONSE
                    if struct.unpack_from('<Q', body, at)[0] == r['challenge']:
                        r['checked'] = True
                    at += 8
                elif kind == 0x09:  # OFFER
                    offer = struct.unpack_from('<I', body, at)[0], body[at + 4:at + 36]
                    at += 36
                elif kind != 0x05:
                    break
            while heard + 1 in early:  # applied and saved, in order
                heard += 1
                del early[heard]
            if offer and not (r['next'] and r['next'][0] == offer[0] and r['next'][3] == offer[1]):
                n, their_half = offer
                if (n == 1 and epoch == 0) or (n == r['now'] + 1 and epoch == r['now'] & 15):
                    half = X25519PrivateKey.generate()
                    fresh = half.exchange(X25519PublicKey.from_public_bytes(their_half))
                    chained = r['epochs'][0] if n == 1 else r['epochs'][r['now']]
                    secret = hkdf(fresh, b'pure link 0 epoch' + struct.pack('<I', n) + chained, 32)
                    r['next'] = (n, secret, raw(half), their_half)
            answer = b''
            if not r['checked']:
                answer += b'\x07' + struct.pack('<Q', r['challenge'])
            if r['next']:
                answer += b'\x0a' + struct.pack('<I', r['next'][0]) + r['next'][2] + r['next'][3][:4]
            had = sorted(r['had'], reverse=True)
            ranges = []
            for number in had:
                if ranges and ranges[-1][0] == number + 1:
                    ranges[-1][0] = number
                elif len(ranges) < 32:
                    ranges.append([number, number])
                else:
                    break
            answer += b'\x03' + struct.pack('<QIB', had[0], 0, len(ranges))
            answer += b''.join(struct.pack('<QQ', first, last) for first, last in ranges)
            if stream:
                answer += (b'\x04' + bytes([len(stream[0])]) + stream[0] + bytes([len(stream[1])]) + stream[1] +
                           struct.pack('<QBI', heard, 0, 1024))
            head = bytes([0x70 | r['now'] & 15]) + struct.pack('<IQQ', key_id(my_public), r['answer_run'], r['pn'])
            aead, base = packet_keys(r['epochs'][r['now']], my_public, theirs, r['answer_run'], run)
            sealed = head + aead.encrypt(nonce(base, r['pn']), answer, head)
            r['pn'] += 1
            if r['checked'] or r['bytes_out'] + len(sealed) <= 3 * r['bytes_in']:
                link.sendto(sealed, r['address'])
                r['bytes_out'] += 0 if r['checked'] else len(sealed)
            if heard == orders and done_at is None:
                done_at = time.time() + 0.5  # the last STORED heard, and answered a while
    finally:
        buyer.join()
        node.terminate()
        _, error = node.communicate(timeout=30)
        link.close()
    assert node.returncode == 0, error[-1000:]
    stats = [json.loads(line) for line in error.decode().splitlines() if line.startswith('{"active"')][-1]
    assert heard == orders and stats['link_stored'] == orders, (heard, stats)
    assert opened[1] > 0 and all(r['checked'] for r in runs.values()), (opened, runs.keys())
    return {'orders': orders, 'opened_in_epoch_0': opened[0], 'opened_in_epoch_1': opened[1],
            'node_packets': stats['link_packets']}


def server_links_moved(aup, pure, work):
    """A receiver's store moved to another address (H3 of
    docs/design/011-pure-transport.md), in namespaces of its own (unshare
    -rmn: its network, and an /etc/hosts of its own): the sender links to
    pure://receiver.test, which names 127.0.0.2. While clients buy, the
    receiver is killed (-9), its store, key and memo (KEY.links) copied
    elsewhere, 127.0.0.2 made unreachable, the name pointed at 127.0.0.3,
    and the copy started there. The sender, its probes unanswered, looks
    the name up again and goes on: every order it saved is applied once,
    and the moved receiver makes no X25519 (its memo came with it). None
    where there is no unshare or ip."""
    import shutil
    unshare = shutil.which('unshare')
    ip = shutil.which('ip') or next((path for path in ('/usr/sbin/ip', '/sbin/ip', '/bin/ip') if Path(path).exists()), None)
    if not unshare or not ip or subprocess.run([unshare, '-rmn', 'true'], capture_output=True).returncode:
        return None
    hosts = work / 'moved-hosts'
    hosts.write_text('127.0.0.1 localhost\n127.0.0.2 receiver.test\n')
    script = f"""
import json, subprocess, sys
from pathlib import Path
sys.path.insert(0, {str(HERE)!r})
import check
subprocess.run([{ip!r}, 'link', 'set', 'lo', 'up'], check=True)
subprocess.run(['mount', '--bind', {str(hosts)!r}, '/etc/hosts'], check=True)
print(json.dumps(check.server_links_moved_inside(Path({str(aup)!r}), Path({str(pure)!r}), Path({str(work)!r}),
                                                 Path({str(hosts)!r}), {ip!r})))
"""
    done = subprocess.run([unshare, '-rmn', sys.executable, '-c', script], capture_output=True, text=True, timeout=600)
    assert done.returncode == 0, done.stderr[-3000:]
    return json.loads(done.stdout.strip().splitlines()[-1])


def server_links_moved_inside(aup, pure, work, hosts, ip):
    import select
    import shutil
    import signal
    import socket
    import threading
    import time
    sender_module, receiver_module = work / 'moved-sender.pmod', work / 'moved-receiver.pmod'
    for module, text in ((sender_module, LINK_SENDER), (receiver_module, LINK_RECEIVER)):
        source = module.with_suffix('.aup')
        source.write_text(text)
        compile_module(aup, source, module)

    def free_port(kind=socket.SOCK_STREAM):
        with socket.socket(socket.AF_INET, kind) as probe:
            probe.bind(('127.0.0.1', 0))
            return probe.getsockname()[1]

    def start(args, port):
        process = subprocess.Popen([str(a) for a in args] + ['--port', str(port)], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        line = process.stdout.readline() if ready else b''
        assert line, f'host did not start: {process.stderr.read(2000) if process.poll() is not None else ""}'
        return process, json.loads(line)

    def post(port, body):
        import http.client
        connection = http.client.HTTPConnection('127.0.0.1', port, timeout=10)
        try:
            data = json.dumps(body).encode()
            connection.request('POST', '/inputs/buy', data, {'Content-Length': str(len(data)),
                                                             'Content-Type': 'application/json'})
            response = connection.getresponse()
            response.read()
            return response.status
        finally:
            connection.close()

    def number(port, view):
        return int(http(port, 'GET', f'/views/{view}')[3])

    keys = {}
    for name in ('sender', 'receiver'):
        process, info = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'moved-key',
                               '--key', work / f'moved-{name}.key'], 0)
        keys[name] = info['public_key']
        process.terminate()
        process.communicate(timeout=30)
    port_a, port_b, link_port = free_port(), free_port(), free_port(socket.SOCK_DGRAM)
    (work / 'moved-senders').write_text(f'moved-sender.ordered {keys["sender"]}\n')

    def receiver(where):
        return [pure / 'build/pure-serve', '--module', receiver_module, '--store', work / f'moved-{where}',
                '--key', work / f'moved-{where}.key', '--link-port', link_port, '--senders', work / 'moved-senders']

    shutil.copy(work / 'moved-receiver.key', work / 'moved-first.key')
    b, _ = start(receiver('first'), port_b)
    a, _ = start([pure / 'build/pure-serve', '--module', sender_module, '--store', work / 'moved-a',
                  '--key', work / 'moved-sender.key', '--send', f'ordered=pure://receiver.test:{link_port}/order',
                  '--seal', f'ordered={keys["receiver"]}'], port_a)
    acknowledged = [0]
    stop = threading.Event()

    def client():
        rng = random.Random(7331)
        while not stop.is_set():
            count = rng.randint(1, 20)
            try:
                if post(port_a, {'item': 'm', 'count': count}) == 200:
                    acknowledged[0] += count
            except OSError:
                time.sleep(0.02)

    thread = threading.Thread(target=client)
    thread.start()
    try:
        time.sleep(0.6)
        b.send_signal(signal.SIGKILL)
        b.wait()
        # The store, key and memo carried to another machine; the old one gone, the name moved.
        shutil.copytree(work / 'moved-first', work / 'moved-second')
        for suffix in ('.key', '.key.links'):
            shutil.copy(work / f'moved-first{suffix}', work / f'moved-second{suffix}')
        subprocess.run([ip, 'route', 'add', 'unreachable', '127.0.0.2/32', 'table', 'local'], check=True)
        hosts.write_text('127.0.0.1 localhost\n127.0.0.3 receiver.test\n')
        b, _ = start(receiver('second'), port_b)
        time.sleep(1.5)
    finally:
        stop.set()
        thread.join()
    try:
        deadline = time.time() + 60
        while time.time() < deadline:
            sent, sent_total = number(port_a, 'sent'), number(port_a, 'sent_total')
            if (number(port_b, 'count'), number(port_b, 'total')) == (sent, sent_total):
                break
            time.sleep(0.1)
        count, total = number(port_b, 'count'), number(port_b, 'total')
        assert (count, total) == (sent, sent_total), (count, total, sent, sent_total)
        assert sent_total >= acknowledged[0] > 0, (sent_total, acknowledged)
    finally:
        stats = {}
        for name, process in (('a', a), ('b', b)):
            process.terminate()
            _, error = process.communicate(timeout=30)
            assert process.returncode == 0, error[-1000:]
            stats[name] = [json.loads(line) for line in error.decode().splitlines() if line.startswith('{"active"')][-1]
    assert stats['b']['listener_woken'] >= 1 and stats['b']['listener_secrets'] == 0, stats['b']
    return {'orders': sent, 'acknowledged_total': acknowledged[0], 'packets': stats['a']['link_packets'],
            'resent': stats['a']['link_resent'], 'received_after_move': stats['b']['listener_received'],
            'secrets_after_move': stats['b']['listener_secrets']}


def server_sealed(aup, pure, work):
    """Sends sealed end to end (--seal to the receiver's --key), in one session
    a wire and authenticated by the sender's own --key: through a relay that
    records what passes, every order is applied once, the relay saw no item
    and no field name, and the wire's requests share one session, numbered
    in order. One byte changed on the way, another number or another
    sender's key is refused (400 seal) and applies nothing; the recorded
    request sent again applies nothing twice; an unsealed delivery is
    refused (403) by a node that keeps its deliveries sealed; a seal to
    another key does not open. Restarted naming its sender (--sender), the
    receiver opens that sender's session again unasked, and refuses another
    node claiming the sender's name with its own key (403 sender)."""
    import select
    import threading
    import time
    from http.client import HTTPConnection
    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
    sender_module, receiver_module = work / 'seal-sender.pmod', work / 'seal-receiver.pmod'
    for module, text in ((sender_module, LINK_SENDER), (receiver_module, LINK_RECEIVER)):
        source = module.with_suffix('.aup')
        source.write_text(text)
        compile_module(aup, source, module)

    def start(args):
        """A host on a port of its own choosing (--port 0: no port probed
        free and then taken by another socket before it binds)."""
        process = subprocess.Popen([str(a) for a in args] + ['--port', '0'], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        assert ready, 'host did not start'
        line = process.stdout.readline()
        assert line, process.communicate()[1][-1000:]
        return process, json.loads(line)

    def request(port, headers, body, path='/inputs/order'):
        connection = HTTPConnection('127.0.0.1', port, timeout=10)
        try:
            connection.request('POST', path, body, headers)
            response = connection.getresponse()
            response.read()
            return response.status, response.getheader('X-Pure-Error')
        finally:
            connection.close()

    def buy(port, item, count):
        assert request(port, {'Content-Type': 'application/json'}, json.dumps({'item': item, 'count': count}).encode(),
                       '/inputs/buy')[0] == 200

    def wait_for(condition, seconds=20):
        deadline = time.time() + seconds
        while not condition() and time.time() < deadline:
            time.sleep(0.05)
        return condition()

    def count():
        return int(http(port_b, 'GET', '/views/count')[3])

    key = work / 'seal-receiver.key'
    receiver, started = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'seal-b',
                               '--key', key, '--sealed-only'])
    port_b, public_key = started['port'], started['public_key']
    assert len(public_key) == 64 and (key.stat().st_mode & 0o777) == 0o600, (public_key, oct(key.stat().st_mode))
    seen = []  # (headers, body, status, X-Pure-Error) of each request relayed

    class Relay(BaseHTTPRequestHandler):
        protocol_version = 'HTTP/1.1'

        def do_POST(self):
            body = self.rfile.read(int(self.headers['Content-Length']))
            headers = {name: value for name, value in self.headers.items()
                       if name.lower().startswith('x-pure-') or name.lower() in ('content-type', 'idempotency-key')}
            connection = HTTPConnection('127.0.0.1', port_b, timeout=10)
            connection.request('POST', self.path, body, headers)
            answer = connection.getresponse()
            data = answer.read()
            seen.append((headers, body, answer.status, answer.getheader('X-Pure-Error')))
            self.send_response(answer.status)
            for name, value in answer.getheaders():
                if name.lower().startswith('x-pure-'):
                    self.send_header(name, value)
            self.send_header('Content-Length', str(len(data)))
            self.end_headers()
            self.wfile.write(data)
            connection.close()

        def log_message(self, *args):
            pass

    relay = ThreadingHTTPServer(('127.0.0.1', 0), Relay)
    port_relay = relay.server_address[1]
    threading.Thread(target=relay.serve_forever, daemon=True).start()
    wire = f'ordered=http://127.0.0.1:{port_relay}/inputs/order'
    sender, sender_started = start([pure / 'build/pure-serve', '--module', sender_module, '--store', work / 'seal-a',
                                    '--key', work / 'seal-sender.key', '--send', wire, '--seal', f'ordered={public_key}'])
    port_a, sender_key = sender_started['port'], sender_started['public_key']
    stranger = impostor = None
    try:
        orders, total = 60, 0
        for i in range(orders):
            total += i % 7 + 1
            buy(port_a, f'secret-{i}', i % 7 + 1)
        assert wait_for(lambda: count() == orders), count()
        assert int(http(port_b, 'GET', '/views/total')[3]) == total
        seals = [headers['X-Pure-Seal'].split() for headers, _, _, _ in seen]
        assert seen and all(len(parts) == 4 and parts[3] == sender_key for parts in seals), seals[:1]
        assert len({parts[1] for parts in seals}) == 1  # one session
        numbers = [int(parts[2]) for parts in seals]
        assert numbers == list(range(len(numbers))), numbers
        assert all(status == 200 for _, _, status, _ in seen)
        assert not any(b'secret' in body or b'item' in body or b'city' in body for _, body, _, _ in seen)
        headers, body, _, _ = seen[0]
        suite, enc, n, _ = headers['X-Pure-Seal'].split()
        changed = bytearray(body)
        changed[len(changed) // 2] ^= 1
        assert request(port_b, headers, bytes(changed)) == (400, 'seal')
        renumbered = dict(headers, **{'X-Pure-Seal': f'{suite} {enc} {int(n) + 1} {sender_key}'})
        assert request(port_b, renumbered, body) == (400, 'seal')
        other_sender = f'{suite} {enc} {n} {public_key}'
        assert request(port_b, dict(headers, **{'X-Pure-Seal': other_sender}), body) == (400, 'seal')
        assert request(port_b, headers, body)[0] == 200  # heard before: applied once
        plain = {name: value for name, value in headers.items() if name != 'X-Pure-Seal'}
        assert request(port_b, plain, json.dumps({'item': 'plain', 'count': 1, 'to': {'city': 'x'}}).encode()) == \
            (403, 'unsealed')
        assert count() == orders
        # A sender sealing to another node's key: the receiver cannot open it.
        other, other_started = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'seal-c',
                                      '--key', work / 'seal-other.key'])
        other.terminate()
        other.wait()
        stranger, stranger_started = start([pure / 'build/pure-serve', '--module', sender_module, '--store',
                                            work / 'seal-d', '--send', wire, '--seal',
                                            f'ordered={other_started["public_key"]}'])
        before = len(seen)
        buy(stranger_started['port'], 'stranger', 5)
        assert wait_for(lambda: len(seen) > before, 5)
        assert seen[before][2:] == (400, 'seal') and len(seen[before][0]['X-Pure-Seal'].split()) == 3
        assert count() == orders
        # Restarted naming its sender: the same key opens the sender's session
        # again, and another node claiming the sender's name is refused.
        source = seen[0][0]['X-Pure-Source']
        receiver.terminate()
        receiver.wait()
        receiver, again = start([pure / 'build/pure-serve', '--module', receiver_module, '--store', work / 'seal-b',
                                 '--key', key, '--sender', f'{source}={sender_key}'])
        port_b = again['port']
        assert again['public_key'] == public_key
        before = len(seen)
        buy(port_a, 'after', 2)
        assert wait_for(lambda: count() == orders + 1), count()
        assert seen[-1][0]['X-Pure-Seal'].split()[1] == enc  # the same session, opened again unasked
        impostor, impostor_started = start([pure / 'build/pure-serve', '--module', sender_module, '--store',
                                            work / 'seal-e', '--key', work / 'seal-impostor.key', '--send', wire,
                                            '--seal', f'ordered={public_key}'])
        before = len(seen)
        buy(impostor_started['port'], 'impostor', 9)
        assert wait_for(lambda: any(h['X-Pure-Seal'].split()[3] == impostor_started['public_key']
                                    for h, _, _, _ in seen[before:]), 5)
        claimed = [entry for entry in seen[before:] if entry[0]['X-Pure-Seal'].split()[3] != sender_key]
        assert claimed and claimed[0][0]['X-Pure-Source'] == source and claimed[0][2:] == (403, 'sender'), claimed[:1]
        assert count() == orders + 1
        return {'orders': orders, 'relayed': len(seen), 'suite': suite, 'sessions': 1}
    finally:
        for process in (sender, receiver, stranger, impostor):
            if process:
                process.terminate()
                process.wait()
        relay.shutdown()


SURFACE_SOURCE = """record Task {
  title: text
  done = 0
}
state tasks: list of Task
state at: index of tasks
input typed = text
input toggle = key Space
on typed {
  tasks.append(Task { title: typed })
  at = tasks.last
}
on toggle.down { at.done = !at.done }
view count = tasks.count
view current = if tasks.count > 0 { at.title } else { "(empty)" }
view finished = at.done
"""


def server_surface(aup, pure, work):
    """A surface in the node (--surface, serve/surface.h): a library that
    pure-serve maps and runs beside its connection threads types text and
    presses a key as a person at the node's display would. The owner applies
    its events with the requests, one save a round, and it reads each save's
    views where they are: its events show in HTTP views, and an HTTP input
    shows in it through the changes descriptor. An event for an input of
    another kind, or for none, is refused; it stops with the server; and a
    module without states cannot have one."""
    import select
    import signal
    import time
    probe = work / 'surface-probe.so'
    subprocess.run(['cc', '-O2', '-std=c17', '-Wall', '-Wextra', '-Werror', '-shared', '-fPIC', f'-I{pure / "core"}',
                    f'-I{pure / "serve"}', str(pure / 'tests' / 'surface-probe.c'), '-o', str(probe)], check=True)
    source, module = work / 'surface.aup', work / 'surface.pmod'
    source.write_text(SURFACE_SOURCE)
    compile_module(aup, source, module)
    out = work / 'surface.jsonl'
    process = subprocess.Popen([str(a) for a in (pure / 'build/pure-serve', '--module', module, '--store',
                                                 work / 'surface-store', '--port', '0', '--surface', probe, '--', out,
                                                 'typed', 'toggle', 'one,two,three', 'count', 'current', 'finished')],
                               stdout=subprocess.PIPE, stderr=subprocess.PIPE)

    def lines():
        return [json.loads(line) for line in out.read_text().splitlines()] if out.exists() else []

    def wait_for(condition):
        deadline = time.time() + 20
        while not condition() and time.time() < deadline:
            time.sleep(0.05)
        return condition()

    try:
        ready, _, _ = select.select([process.stdout], [], [], 10)
        assert ready, 'host did not start'
        port = json.loads(process.stdout.readline())['port']
        assert wait_for(lambda: any(line['event'].startswith('wrong kind') for line in lines())), lines()
        assert http(port, 'GET', '/views/count')[3] == b'3' and http(port, 'GET', '/views/current')[3] == b'three'
        assert http(port, 'POST', '/inputs/typed', b'four')[0] == 200
        assert wait_for(lambda: any(line['event'] == 'changed' and line['views']['count'] == 4 for line in lines()))
    finally:
        process.send_signal(signal.SIGTERM)
        _, error = process.communicate(timeout=30)
    assert process.returncode == 0 and b'"returned":0' in error, error[-500:]
    got = lines()
    views = [line['views'] for line in got]
    assert [line['event'] for line in got[:6]] == ['start', 'typed one: 0', 'typed two: 0', 'typed three: 0', 'pressed: 0',
                                                    'wrong kind: 8, no input: 8'], got[:6]
    assert views[:6] == [{'count': 0, 'current': '(empty)', 'finished': None},
                         {'count': 1, 'current': 'one', 'finished': 0}, {'count': 2, 'current': 'two', 'finished': 0},
                         {'count': 3, 'current': 'three', 'finished': 0}, {'count': 3, 'current': 'three', 'finished': 1},
                         {'count': 3, 'current': 'three', 'finished': 1}], views[:6]
    assert views[-1] == {'count': 4, 'current': 'four', 'finished': 0}, views[-1]
    changes = [line['changes'] for line in got]
    assert changes[1:5] == sorted(set(changes[1:5])) and changes[-1] > changes[4], changes
    # A module without states has no owner to apply a surface's events.
    stateless = work / 'surface-echo.aup'
    stateless.write_text('input shout = text\non shout { }\n')
    compile_module(aup, stateless, stateless.with_suffix('.pmod'))
    refused = subprocess.run([str(a) for a in (pure / 'build/pure-serve', '--module', stateless.with_suffix('.pmod'),
                                               '--store', work / 'surface-echo', '--port', '0', '--surface', probe, '--',
                                               out, 'shout', 'shout', 'x')], capture_output=True, timeout=30)
    assert refused.returncode == 2 and b'needs an app with states' in refused.stderr, refused.stderr
    return {'events': 5, 'lines': len(got)}


SHOP = '''
record Stock {
  item = 0
  left = 0
}
record Line {
  item = 0
  qty = 1
  note: text
}
record Entry {
  item = 0
  qty = 0
  note: text
}
state stock: list of Stock by item
state log: list of Entry
state orders = 0

input restock = message {
  rows: list of Stock
}
input order = message {
  customer: u32
  lines: list of Line
}
input clean = message {
  below: number
}

on restock {
  for r in restock.rows {
    stock.add(Stock { item: r.item, left: r.left })
  }
}
on order {
  let taken = 0
  for l in order.lines {
    let s = stock[l.item]
    s.left = s.left - l.qty
    require s.left >= 0
    log.append(Entry { item: l.item, qty: l.qty, note: l.note })
    taken = taken + 1
  }
  orders = orders + taken
}
on clean {
  for s in stock where s.left < clean.below {
    stock.remove(s)
  }
}
view items = stock.count
view left = sum(s.left for s in stock)
view logged = log.count
view total = sum(e.qty for e in log)
view lines = orders
view notes = each e in log {
  item = e.item
  note = e.note
}
'''


def server_rows(aup, pure, work):
    """A message's rows (a list of a record: a JSON array of objects, or the
    list's stored form as the body) walked with for, all or nothing: 30,000
    stock rows in one request, then 20,000 as bytes, then random orders whose
    rows take stock (an item not stocked or not enough of it fails the whole
    order, none of its rows applied), a walk that removes, and a restart that
    keeps every state and no rows. Checked against a model."""
    import http.client
    import random
    import struct
    import time
    source, module = work / 'shop.aup', work / 'shop.pmod'
    source.write_text(SHOP)
    compile_module(aup, source, module)
    store = work / 'shop-store'
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', store])

    def call(method, path, body=None, kind='application/json'):
        connection = http.client.HTTPConnection('127.0.0.1', host.port, timeout=60)
        try:
            connection.request(method, path, body, {'Content-Type': kind} if body is not None else {})
            answer = connection.getresponse()
            return answer.status, answer.getheader('X-Pure-Error'), answer.read()
        finally:
            connection.close()

    def number(view):
        status, _, data = call('GET', f'/views/{view}')
        assert status == 200, (view, status)
        return float(data)

    stock, log = {}, []
    try:
        began = time.perf_counter()
        rows = [{'item': i, 'left': i % 7} for i in range(30000)]
        assert call('POST', '/inputs/restock', json.dumps({'rows': rows}).encode())[:2] == (200, 'none')
        seconds = time.perf_counter() - began
        stock.update({i: i % 7 for i in range(30000)})
        packed = b''.join(struct.pack('<dd', i, 5) for i in range(30000, 50000))
        assert call('POST', '/inputs/restock', packed, 'application/octet-stream')[:2] == (200, 'none')
        stock.update({i: 5 for i in range(30000, 50000)})
        assert number('items') == 50000 and number('left') == sum(stock.values())
        # All or nothing: a row whose item is there already fails the whole message.
        assert call('POST', '/inputs/restock', json.dumps({'rows': [{'item': 60000}, {'item': 7}]}).encode())[:2] == \
            (409, 'exists')
        assert call('POST', '/inputs/restock', packed[:40], 'application/octet-stream')[:2] == (422, 'limit')
        assert call('POST', '/inputs/restock', json.dumps({'rows': [{'item': 1, 'lft': 2}]}).encode())[:2] == \
            (400, 'json_field')
        assert call('POST', '/inputs/restock', json.dumps({'rows': [{'item': 'one'}]}).encode())[:2] == (400, 'json_type')
        assert number('items') == 50000
        rng = random.Random(21)
        notes = ['', 'fast', '빨리', 'a "quoted" \\ note', 'tab\there', '😀']
        applied = refused = 0
        for _ in range(400):
            lines = [{'item': rng.randrange(50010), 'qty': rng.randrange(4), 'note': rng.choice(notes)}
                     for _ in range(rng.randrange(6))]
            if lines and rng.random() < 0.3:
                del lines[0]['qty']  # a field left out takes its default (1)
            model = dict(stock)
            ok = True
            for line in lines:
                qty = line.get('qty', 1)
                if line['item'] not in model or model[line['item']] - qty < 0:
                    ok = False
                    break
                model[line['item']] -= qty
            status, error, _ = call('POST', '/inputs/order', json.dumps({'customer': 3, 'lines': lines}).encode())
            assert (status == 200) == ok, (status, error, lines)
            if ok:
                stock = model
                log.extend((line['item'], line.get('qty', 1), line['note']) for line in lines)
                applied += 1
            else:
                refused += 1
        assert number('logged') == len(log) and number('total') == sum(q for _, q, _ in log)
        assert number('left') == sum(stock.values()) and number('lines') == len(log)
        shown = json.loads(call('GET', f'/views/notes?from={max(0, len(log) - 50)}')[2])['items']
        assert [(r['item'], r['note']) for r in shown] == [(i, n) for i, _, n in log[-50:]]
        assert call('POST', '/inputs/clean', json.dumps({'below': 2}).encode())[:2] == (200, 'none')
        stock = {item: left for item, left in stock.items() if left >= 2}
        assert number('items') == len(stock) and number('left') == sum(stock.values())
    finally:
        host.stop()
    # Restarted: the states as they were; rows are never kept, and come again.
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', store])
    try:
        assert number('items') == len(stock) and number('logged') == len(log) and number('lines') == len(log)
        assert call('POST', '/inputs/restock', json.dumps({'rows': [{'item': 90000, 'left': 1}]}).encode())[:2] == \
            (200, 'none')
        assert number('items') == len(stock) + 1
    finally:
        host.stop()
    assert applied > 50 and refused > 50
    return {'bulk_rows_json': 30000, 'bulk_rows_bytes': 20000, 'bulk_rows_per_second': round(30000 / seconds),
            'orders_applied': applied, 'orders_refused': refused, 'logged': len(log)}


ARGUED = '''
record Account {
  aid = 0
  bid = 0
  balance = 0
  owner: text
}
state accounts: list of Account by aid
input open = message {
  aid: u32
  bid: u32
  balance: number
  owner: text
}
on open { accounts.add(Account { aid: open.aid, bid: open.bid, balance: open.balance, owner: open.owner }) }

view balance(aid: u32) = accounts[aid].balance
view richer(low: number) = count(a in accounts where a.balance > low)
view hello(name: text, times: u32) = "{name} x{times}"
view branch(b: u32, over: number) = each a in accounts where a.bid == b && a.balance > over {
  aid = a.aid
  share = a.balance / sum(x.balance for x in accounts where x.bid == b)
  owner = a.owner
}
view owned(who: text) = count(a in accounts where a.owner == who)
'''


def server_arguments(aup, pure, work):
    """Views that take arguments, given as the request's query (values %XX
    decoded): a keyed lookup, a count above an argument, texts shown back,
    a table filtered by two arguments whose column folds with one of them,
    paged; a registered query that takes one. Every answer against a model;
    an argument missing, unknown or not of its type is 400 invalid."""
    import http.client
    import random
    import urllib.parse
    source, module = work / 'argued.aup', work / 'argued.pmod'
    source.write_text(ARGUED)
    compile_module(aup, source, module)
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'argued-store'])

    def call(method, path, body=None):
        connection = http.client.HTTPConnection('127.0.0.1', host.port, timeout=30)
        try:
            connection.request(method, path, body, {'Content-Type': 'application/json'} if body is not None else {})
            answer = connection.getresponse()
            return answer.status, answer.getheader('X-Pure-Error'), answer.read()
        finally:
            connection.close()

    rng = random.Random(5)
    owners = ['김철수', 'bob', 'ann marie', 'a&b=c', '100%']
    accounts = {}
    asked = 0
    try:
        for aid in range(1, 201):
            account = (aid % 7, rng.randrange(-500, 5000), rng.choice(owners))
            accounts[aid] = account
            body = json.dumps({'aid': aid, 'bid': account[0], 'balance': account[1], 'owner': account[2]}).encode()
            assert call('POST', '/inputs/open', body)[0] == 200
        for aid in rng.sample(range(1, 260), 60):
            status, error, data = call('GET', f'/views/balance?aid={aid}')
            assert (status, float(data)) == (200, accounts[aid][1]) if aid in accounts else (status, error) == (404, 'no_value')
            asked += 1
        for low in [-1000, -1, 0, 0.5, 1000, 2500.25, 6000]:
            assert float(call('GET', f'/views/richer?low={low}')[2]) == sum(1 for _, b, _ in accounts.values() if b > low)
            asked += 1
        for name in ['세계 world', 'a&b=c', '100% sure', '😀']:
            status, _, data = call('GET', f'/views/hello?name={urllib.parse.quote(name)}&times=3')
            assert (status, data.decode()) == (200, f'{name} x3')
            asked += 1
        for who in owners:
            data = call('GET', f'/views/owned?who={urllib.parse.quote(who)}')[2]
            assert float(data) == sum(1 for _, _, o in accounts.values() if o == who)
            asked += 1
        for b in range(7):
            over = rng.choice([-1000, 0, 1500])
            rows = [(aid, balance, owner) for aid, (bid, balance, owner) in sorted(accounts.items()) if bid == b and balance > over]
            total = sum(balance for bid, balance, _ in accounts.values() if bid == b)
            page = json.loads(call('GET', f'/views/branch?b={b}&over={over}&from=2&count=5')[2])
            assert page['rows'] == len(rows) and page['from'] == min(2, len(rows))
            assert [(r['aid'], r['share'], r['owner']) for r in page['items']] == \
                [(aid, balance / total, owner) for aid, balance, owner in rows[2:7]]
            asked += 1
        # Arguments missing, unknown, not of their type, or badly escaped.
        for path in ['/views/balance', '/views/balance?aid=x', '/views/balance?aid=1&zz=2', '/views/balance?aid=-1',
                     '/views/hello?times=1&name=%zz', '/views/richer?low=1&low=2']:
            assert call('GET', path)[:2] == (400, 'invalid'), path
        assert call('GET', '/views/branch?b=1&from=x')[:2] == (400, 'query')
        # A registered query takes arguments as a view does.
        (work / 'top.aup').write_text('view top(k: u32) = each a in accounts where a.aid <= k {\n  aid = a.aid\n}\n')
        run(aup, 'query', source, work / 'top.aup', '-o', work / 'top.pmod')
        assert call('PUT', '/queries/top', (work / 'top.pmod').read_bytes())[0] == 200
        assert [r['aid'] for r in json.loads(call('GET', '/queries/top?k=4')[2])['items']] == [1, 2, 3, 4]
        assert call('GET', '/queries/top')[:2] == (400, 'invalid')
    finally:
        host.stop()
    return {'accounts': len(accounts), 'asked': asked}


def server_queries(aup, pure, work):
    """Queries as verified programs over a snapshot (PUT and GET /queries/NAME):
    aup query compiles a bank's declarations with views of its own; the node
    checks the module when it is registered (it loads, its states are the
    bank's, it has the view named) and shows that view from the last save's
    snapshot. A per-branch total (a fold reading its column's row, as a
    correlated subquery does), a join of history rows with their accounts and
    tellers (keyed lookups), and a self-join (each rich account's rank) match
    a model of the same events, also asked while transfers go on; a module of
    another app is refused (409), bytes that are no module too (400), and a
    query registered again answers anew."""
    import random
    import threading
    bank = pure / 'benchmarks' / 'bank' / 'bank.aup'
    module = work / 'queries-bank.pmod'
    compile_module(aup, bank, module)
    queries = {
        'per_branch': 'view per_branch = each b in branches {\n  bid = b.bid\n'
                      '  total = sum(a.balance for a in accounts where a.bid == b.bid)\n'
                      '  accounts = count(a in accounts where a.bid == b.bid)\n}\n',
        'large': 'view large = each h in history where h.delta > 4000 {\n  aid = h.aid\n  delta = h.delta\n'
                 '  account = accounts[h.aid].balance\n  teller = tellers[h.tid].balance\n}\n',
        'ranks': 'view ranks = each a in accounts where a.balance > 15000 {\n  aid = a.aid\n'
                 '  richer = count(b in accounts where b.balance > a.balance)\n}\n',
        'rich': 'view rich = count(a in accounts where a.balance > 0)\n',
    }
    compiled = {}
    for name, text in queries.items():
        source = work / f'query-{name}.aup'
        source.write_text(text)
        out = work / f'query-{name}.pmod'
        run(aup, 'query', bank, source, '-o', out)
        compiled[name] = out.read_bytes()
    other = work / 'queries-other.pmod'
    (work / 'queries-other.aup').write_text('state accounts = 0\nview rich = accounts\n')
    compile_module(aup, work / 'queries-other.aup', other)
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'queries-store', '--threads', '2'])

    def call(method, path, body=None, json_body=False):
        import http.client
        connection = http.client.HTTPConnection('127.0.0.1', host.port, timeout=30)
        try:
            connection.request(method, path, body, {'Content-Type': 'application/json'} if json_body else {})
            answer = connection.getresponse()
            return answer.status, answer.getheader('X-Pure-Error'), answer.read()
        finally:
            connection.close()

    try:
        for b in range(1, 4):
            assert call('POST', '/inputs/branch', json.dumps({'bid': b}).encode(), True)[0] == 200
        for t in range(1, 31):
            assert call('POST', '/inputs/teller', json.dumps({'tid': t, 'bid': (t - 1) // 10 + 1}).encode(), True)[0] == 200
        for a in range(1, 301):
            assert call('POST', '/inputs/account', json.dumps({'aid': a, 'bid': (a - 1) // 100 + 1}).encode(), True)[0] == 200
        accounts, tellers, history = {a: 0 for a in range(1, 301)}, {t: 0 for t in range(1, 31)}, []
        rng = random.Random(8)

        def transfer():
            aid, tid, bid, delta = rng.randint(1, 300), rng.randint(1, 30), rng.randint(1, 3), rng.randint(-5000, 5000)
            assert call('POST', '/inputs/transfer', json.dumps({'aid': aid, 'tid': tid, 'bid': bid, 'delta': delta}).encode(),
                        True)[0] == 200
            accounts[aid] += delta
            tellers[tid] += delta
            history.append((aid, tid, delta))

        for _ in range(600):
            transfer()
        for name, bytes_ in compiled.items():
            assert call('PUT', f'/queries/{name}', bytes_) == (200, 'none', b''), name

        def expected(name):
            if name == 'per_branch':
                return [{'bid': b, 'total': sum(v for a, v in accounts.items() if (a - 1) // 100 + 1 == b), 'accounts': 100}
                        for b in range(1, 4)]
            if name == 'large':
                return [{'aid': a, 'delta': d, 'account': accounts[a], 'teller': tellers[t]} for a, t, d in history if d > 4000]
            if name == 'ranks':
                return [{'aid': a, 'richer': sum(1 for v in accounts.values() if v > balance)}
                        for a, balance in sorted(accounts.items()) if balance > 15000]
            return sum(1 for v in accounts.values() if v > 0)

        def answer(name):
            status, error, data = call('GET', f'/queries/{name}')
            assert status == 200, (name, status, error)
            return json.loads(data)['items'] if name != 'rich' else int(data)

        for name in compiled:
            assert answer(name) == expected(name), name
        # Asked while transfers go on, a query sees one save or the next, whole.
        seen, stop = [], threading.Event()

        def ask():
            while not stop.is_set():
                seen.append(sum(row['total'] for row in answer('per_branch')))

        asker = threading.Thread(target=ask)
        asker.start()
        for _ in range(200):
            transfer()
        stop.set()
        asker.join()
        totals = [0]
        for _, _, delta in history:
            totals.append(totals[-1] + delta)
        assert seen and all(total in totals for total in seen), seen[:5]
        assert answer('per_branch') == expected('per_branch')
        page = json.loads(call('GET', '/queries/large?from=1&count=2')[2])
        assert page['items'] == expected('large')[1:3] and page['rows'] == len(expected('large'))
        # Refused: another app's states, bytes that are no module, a module without the view named.
        assert call('PUT', '/queries/rich', other.read_bytes())[:2] == (409, 'conflict')
        assert call('PUT', '/queries/rich', b'not a module')[:2] == (400, 'invalid')
        assert call('PUT', '/queries/missing', compiled['rich'])[:2] == (404, 'not_found')
        assert call('GET', '/queries/missing')[:2] == (404, 'no_value')
        # Registered again: the new module answers.
        (work / 'query-rich2.aup').write_text('view rich = count(a in accounts where a.balance < 0)\n')
        run(aup, 'query', bank, work / 'query-rich2.aup', '-o', work / 'query-rich2.pmod')
        assert call('PUT', '/queries/rich', (work / 'query-rich2.pmod').read_bytes())[0] == 200
        assert answer('rich') == sum(1 for v in accounts.values() if v < 0)
    finally:
        host.stop()
    return {'queries': len(compiled), 'asked_while_writing': len(seen), 'history': len(history)}


def server_webhook(aup, pure, work):
    """An output wired to a third-party HTTPS endpoint (a Python server with
    a certificate of its own): five orders arrive in order as JSON with the
    sender's headers, one answered 503 at first arrives again, and none goes
    to a receiver whose certificate the sender does not trust."""
    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
    import ssl
    import threading
    import time
    module = work / 'hook-sender.pmod'
    module.with_suffix('.aup').write_text(LINK_SENDER)
    compile_module(aup, module.with_suffix('.aup'), module)
    for name in ('trusted', 'other'):
        subprocess.run(['openssl', 'req', '-x509', '-newkey', 'ec', '-pkeyopt', 'ec_paramgen_curve:P-256', '-nodes',
                        '-keyout', work / f'{name}.key', '-out', work / f'{name}.pem', '-days', '1',
                        '-subj', '/CN=127.0.0.1', '-addext', 'subjectAltName=IP:127.0.0.1'],
                       check=True, capture_output=True)
    received, refused_once = [], set()

    class Hook(BaseHTTPRequestHandler):
        protocol_version = 'HTTP/1.1'

        def do_POST(self):
            body = self.rfile.read(int(self.headers['Content-Length']))
            received.append((dict(self.headers), json.loads(body)))
            status = 200
            if self.headers['X-Pure-Sequence'] == '2' and '2' not in refused_once:
                refused_once.add('2')
                status = 503
            self.send_response(status)
            self.send_header('Content-Length', '0')
            self.end_headers()

        def log_message(self, *args):
            pass

    server = ThreadingHTTPServer(('127.0.0.1', 0), Hook)
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    context.load_cert_chain(work / 'trusted.pem', work / 'trusted.key')
    server.socket = context.wrap_socket(server.socket, server_side=True)
    threading.Thread(target=server.serve_forever, daemon=True).start()
    url = f'ordered=https://127.0.0.1:{server.server_address[1]}/hook'
    try:
        def buy(host, count):
            import http.client
            connection = http.client.HTTPConnection('127.0.0.1', host.port, timeout=10)
            data = json.dumps({'item': f'i{count}', 'count': count}).encode()
            connection.request('POST', '/inputs/buy', data, {'Content-Length': str(len(data)), 'Content-Type': 'application/json'})
            assert connection.getresponse().status == 200
            connection.close()

        host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'hook-a', '--send', url,
                         '--send-ca', work / 'trusted.pem'])
        try:
            for count in range(1, 6):
                buy(host, count)
            deadline = time.time() + 20
            while len({h['X-Pure-Sequence'] for h, _ in received}) < 5 and time.time() < deadline:
                time.sleep(0.05)
        finally:
            stats = host.stop()[-1]
        firsts = []
        for headers, body in received:
            seq = int(headers['X-Pure-Sequence'])
            assert headers['X-Pure-Source'] == 'hook-sender.ordered' and headers['Content-Type'] == 'application/json'
            assert headers['Idempotency-Key'] == f'hook-sender.ordered-{seq}' and 'X-Pure-Count' not in headers
            assert body == {'item': f'i{seq}', 'count': seq, 'to': {'city': 'Seoul'}}, body
            if seq not in firsts:
                firsts.append(seq)
        assert firsts == [1, 2, 3, 4, 5] and len(received) == 6 and stats['delivered'] == 5, (firsts, len(received), stats)
        # A receiver the sender cannot trust gets nothing; the send waits in the outbox.
        before = len(received)
        host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'hook-b', '--send', url,
                         '--send-ca', work / 'other.pem'])
        try:
            buy(host, 1)
            time.sleep(1)
        finally:
            host.process.terminate()
            _, error = host.process.communicate(timeout=30)
        assert len(received) == before and b'not trusted' in error, error[-500:]
    finally:
        server.shutdown()
    return {'hooks': len(received), 'delivered': stats['delivered']}


PAY_SOURCE = """state sent = 0
state paid = 0
state declined = 0
state paid_total = 0
input buy = message {
  order: text
  amount: u32
}
output charge = message {
  order: text
  amount: u32
}
input charged = message {
  order: text
  amount: u32
  status: text
  http_status: u32
}
on buy {
  sent = sent + 1
  send charge { order: buy.order, amount: buy.amount }
}
on charged {
  if charged.http_status == 200 {
    paid = paid + 1
    paid_total = paid_total + charged.amount
  } else {
    declined = declined + 1
  }
}
view sent_view = sent
view paid_view = paid
view declined_view = declined
view paid_total_view = paid_total
"""


def server_answers(aup, pure, work):
    """An output wired to a payments API whose answers come back as events
    (--reply): the API answers 200 or 402 and gives a key's first answer to
    every request with that Idempotency-Key. While clients buy, the sender is
    killed (-9) and started again; in the end every saved order was answered
    exactly once: the app's paid and declined counts and paid total match the
    API's answers, one per key."""
    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
    import select
    import signal
    import socket
    import threading
    import time
    module = work / 'pay.pmod'
    module.with_suffix('.aup').write_text(PAY_SOURCE)
    compile_module(aup, module.with_suffix('.aup'), module)
    answers, lock = {}, threading.Lock()

    class Payments(BaseHTTPRequestHandler):
        protocol_version = 'HTTP/1.1'

        def do_POST(self):
            body = json.loads(self.rfile.read(int(self.headers['Content-Length'])))
            with lock:
                key = self.headers['Idempotency-Key']
                if key not in answers:
                    ok = body['amount'] <= 1000
                    answers[key] = (body, 200 if ok else 402,
                                    {'status': 'succeeded' if ok else 'declined', 'id': f'ch_{len(answers)}', 'x': [1, {}]})
                _, status, answer = answers[key]
            data = json.dumps(answer).encode()
            self.send_response(status)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Content-Length', str(len(data)))
            self.end_headers()
            self.wfile.write(data)

        def log_message(self, *args):
            pass

    server = ThreadingHTTPServer(('127.0.0.1', 0), Payments)
    server.handle_error = lambda request, address: None  # a sender killed mid-request
    threading.Thread(target=server.serve_forever, daemon=True).start()
    with socket.socket() as probe:
        probe.bind(('127.0.0.1', 0))
        port = probe.getsockname()[1]
    args = [pure / 'build/pure-serve', '--module', module, '--store', work / 'pay-store', '--port', port,
            '--send', f'charge=http://127.0.0.1:{server.server_address[1]}/charge', '--reply', 'charge=charged']

    def start():
        process = subprocess.Popen([str(a) for a in args], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        ready, _, _ = select.select([process.stdout], [], [], 10)
        assert ready and process.stdout.readline(), 'host did not start'
        return process

    def number(view):
        return int(http(port, 'GET', f'/views/{view}')[3])

    host = start()
    stop = threading.Event()

    def client(which):
        import http.client
        rng = random.Random(which + 8800)
        while not stop.is_set():
            data = json.dumps({'order': f'o{which}-{rng.randrange(10**6)}', 'amount': rng.randint(1, 1500)}).encode()
            try:
                connection = http.client.HTTPConnection('127.0.0.1', port, timeout=10)
                connection.request('POST', '/inputs/buy', data, {'Content-Length': str(len(data)), 'Content-Type': 'application/json'})
                connection.getresponse().read()
                connection.close()
            except OSError:
                time.sleep(0.02)

    clients = [threading.Thread(target=client, args=(n,)) for n in range(3)]
    for thread in clients:
        thread.start()
    try:
        time.sleep(0.8)
        host.send_signal(signal.SIGKILL)
        host.wait()
        host = start()
        time.sleep(0.8)
    finally:
        stop.set()
        for thread in clients:
            thread.join()
    try:
        deadline = time.time() + 30
        while number('paid_view') + number('declined_view') < number('sent_view') and time.time() < deadline:
            time.sleep(0.1)
        sent, paid, declined, total = (number(v) for v in ('sent_view', 'paid_view', 'declined_view', 'paid_total_view'))
        with lock:
            keys = list(answers.values())
        assert paid + declined == sent == len(keys), (paid, declined, sent, len(keys))
        assert paid == sum(1 for _, status, _ in keys if status == 200), (paid, len(keys))
        assert total == sum(body['amount'] for body, status, _ in keys if status == 200)
    finally:
        host.terminate()
        _, error = host.communicate(timeout=30)
        server.shutdown()
    stats = [json.loads(line) for line in error.decode().splitlines() if line.startswith('{"active"')][-1]
    return {'orders': sent, 'paid': paid, 'declined': declined, 'answers_after_restart': stats['answers']}



RECEIPT_SOURCE = """record Receipt {
  order: text
  note: text
  status = 0
}
state receipts: list of Receipt
state sent = 0
state answered = 0
input buy = message {
  order: text
}
output charge = message {
  order: text
}
input charged = message {
  order: text
  note: text
  http_status: u32
}
input clean = message {
  below: u32
}
on buy {
  sent = sent + 1
  send charge { order: buy.order }
}
on charged {
  answered = answered + 1
  receipts.append(Receipt { order: charged.order, note: charged.note, status: charged.http_status })
}
on clean {
  for r in receipts where r.status < clean.below {
    receipts.remove(r)
  }
}
view sent_view = sent
view answered_view = answered
view receipts_view = receipts.count
"""


def server_answers_memory(aup, pure, work):
    """Answers (--reply) under a memory budget: an answer keeps a receipt
    larger than its send, so once receipts fill the budget the next answer
    waits (it is not lost, and not applied twice) and buys are refused, 503
    memory. A clean that frees the receipts lets the answers in, each once."""
    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
    import threading
    import time
    module = work / 'receipt.pmod'
    module.with_suffix('.aup').write_text(RECEIPT_SOURCE)
    compile_module(aup, module.with_suffix('.aup'), module)
    seen, lock = {}, threading.Lock()

    class Api(BaseHTTPRequestHandler):
        protocol_version = 'HTTP/1.1'

        def do_POST(self):
            body = json.loads(self.rfile.read(int(self.headers['Content-Length'])))
            with lock:
                seen[body['order']] = seen.get(body['order'], 0) + 1
            data = json.dumps({'note': 'n' * 200}).encode()
            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Content-Length', str(len(data)))
            self.end_headers()
            self.wfile.write(data)

        def log_message(self, *args):
            pass

    server = ThreadingHTTPServer(('127.0.0.1', 0), Api)
    threading.Thread(target=server.serve_forever, daemon=True).start()
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'receipt-store', '--memory', 3000,
                     '--send', f'charge=http://127.0.0.1:{server.server_address[1]}/charge', '--reply', 'charge=charged'])

    def number(view):
        return int(http(host.port, 'GET', f'/views/{view}')[3])

    try:
        bought, refusals = 0, 0
        while refusals < 3 and bought < 200:
            status = post(host.port, '/inputs/buy', {'order': f'o{bought}'})
            if status[0] == 200:
                bought += 1
            else:
                assert status == (503, 'memory'), status
                refusals += 1
            time.sleep(0.02)
        time.sleep(0.5)
        assert 3 <= bought < 200 and number('sent_view') == bought, bought
        waiting = bought - number('answered_view')
        assert waiting >= 1, (bought, number('answered_view'))
        assert post(host.port, '/inputs/clean', {'below': 1000})[0] == 200
        deadline = time.time() + 10
        while number('answered_view') < bought and time.time() < deadline:
            time.sleep(0.02)
        assert number('answered_view') == bought and number('receipts_view') == waiting, (number('answered_view'), waiting)
    finally:
        stats = host.stop()
        server.shutdown()
    with lock:
        assert len(seen) == bought and all(count == 1 for count in seen.values()), seen
    assert stats[-1]['memory_refused'] >= refusals + 1, stats[-1]
    return {'bought': bought, 'answers_waited': waiting, 'refused': stats[-1]['memory_refused']}

BEAT_SOURCE = """state beats = 0
state last = 0
state stamped = 0
input beat = every 50 ms
input stamp = message {
  note: text
}
on beat {
  beats = beats + 1
  last = now
}
on stamp { stamped = now }
view beats_view = beats
view last_view = last
view stamped_view = stamped
"""


PLAIN_EDIT_SOURCE = """state n = 0
input edit = message { value: number }
on edit { n = edit.value }
view result = n
"""


def server_plain_edit(aup, pure, work):
    """An input named edit that is a plain message (the module keeps no
    document collection) is served as any other input: the app starts, and a
    POST to it changes its state (review 004, an earlier P2)."""
    from http.client import HTTPConnection
    module, source = work / 'plain-edit.pmod', work / 'plain-edit.aup'
    source.write_text(PLAIN_EDIT_SOURCE)
    compile_module(aup, source, module)
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'plain-edit'])
    try:
        connection = HTTPConnection('127.0.0.1', host.port, timeout=10)
        body = json.dumps({'value': 5}).encode()
        connection.request('POST', '/inputs/edit', body, {'Content-Length': str(len(body)), 'Content-Type': 'application/json'})
        status = connection.getresponse().status
        connection.close()
        assert status == 200, status
        result = http(host.port, 'GET', '/views/result')
        assert result[0] == 200 and float(result[3]) == 5, result
    finally:
        host.stop()
    return 5


HEARTBEAT_SOURCE = """input beat = every 20 ms
output pulse = message { value: number }
on beat { send pulse { value: 1 } }
view label = "heartbeat"
"""


def server_timers(aup, pure, work):
    """A served app's timers tick on the server's clock and its events see
    the time they were applied, on one thread and with an owner; the ticks
    are saved, so a restarted server goes on from them. An app with no state
    but an output ticks too: its sends are its state (review 004, F4)."""
    import time
    module, source = work / 'beat.pmod', work / 'beat.aup'
    source.write_text(BEAT_SOURCE)
    compile_module(aup, source, module)
    seen = {}
    for threads in (1, 3):
        store = work / f'beat-{threads}'
        beats = 0
        for run_number in range(2):
            host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', store, '--threads', threads])
            try:
                posted = time.time() * 1000
                assert http(host.port, 'POST', '/inputs/stamp', b'x')[0] == 200
                time.sleep(0.6)
                before = time.time() * 1000
                read = lambda view: float(http(host.port, 'GET', f'/views/{view}')[3])
                count, last, stamped = read('beats_view'), read('last_view'), read('stamped_view')
                after = time.time() * 1000 + 1  # the server's clock reads whole milliseconds
                assert count >= beats + 5, (threads, run_number, count, beats)
                assert before - 1000 < last <= after and posted - 50 <= stamped <= before, (last, stamped, posted, before)
                beats = count
            finally:
                stats = host.stop()
            assert stats[0]['ticks'] >= 5, stats
        seen[threads] = beats
    module, source = work / 'heartbeat.pmod', work / 'heartbeat.aup'
    source.write_text(HEARTBEAT_SOURCE)
    compile_module(aup, source, module)
    host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / 'heartbeat'])
    try:
        time.sleep(0.45)
    finally:
        stats = host.stop()
    assert stats[0]['ticks'] >= 10, stats
    seen['stateless'] = stats[0]['ticks']
    return seen


def cpu_seconds(pid):
    """The CPU time a process has used (user and system)."""
    import os
    with open(f'/proc/{pid}/stat') as stat:
        fields = stat.read().rsplit(')', 1)[1].split()
    return (int(fields[11]) + int(fields[12])) / os.sysconf('SC_CLK_TCK')


def server_clocks(aup, pure, work):
    """The wall clock moved an hour while a node runs (build/clock-back.so
    moves what the node reads of it, from its start): its timers, the pauses
    of a wire whose receiver is down, the owner's waits and a store's group
    commit all count on the monotonic clock. Were a wait's deadline read
    from the wall clock, set back it would end at once, again and again (a
    core spun, the wire tried thousands of times); set forward it would last
    an hour (the timers stopped, the wire tried once, and a lone commit
    after a group waited that long for the others to join it)."""
    import os
    import socket
    import struct
    import threading
    import time
    module, source = work / 'clocks.pmod', work / 'clocks.aup'
    source.write_text(HEARTBEAT_SOURCE)
    compile_module(aup, source, module)
    with socket.socket() as probe:
        probe.bind(('127.0.0.1', 0))
        nobody = probe.getsockname()[1]
    seen = {}
    for shift in (-3600, 3600):
        env = {**os.environ, 'LD_PRELOAD': str(pure / 'build/clock-back.so'), 'CLOCK_BACK_MS': '0',
               'CLOCK_SHIFT_S': str(shift)}
        host = HttpHost([pure / 'build/pure-serve', '--module', module, '--store', work / f'clocks{shift}',
                         '--send', f'pulse=http://127.0.0.1:{nobody}/inputs/pulse'], env=env)
        try:
            time.sleep(0.2)
            began, used = time.time(), cpu_seconds(host.process.pid)
            time.sleep(1.0)
            share = (cpu_seconds(host.process.pid) - used) / (time.time() - began)
        finally:
            stats = host.stop()[-1]
        assert stats['ticks'] >= 30 and share < 0.25 and 3 <= stats['delivery_attempts'] <= 12, \
            (shift, stats['ticks'], share, stats['delivery_attempts'])
        seen[f'shift_{shift}'] = {'ticks': stats['ticks'], 'cpu_share': round(share, 3),
                                  'wire_attempts': stats['delivery_attempts']}
    editor = work / 'clocks-editor.pmod'
    compile_module(aup, EDITOR, editor)
    env = {**os.environ, 'LD_PRELOAD': str(pure / 'build/clock-back.so'), 'CLOCK_BACK_MS': '0', 'CLOCK_SHIFT_S': '3600'}
    host = HttpHost([pure / 'build/pure-serve', '--module', editor, '--store', work / 'clocks-docs', '--threads', 3],
                    env=env)
    new = struct.pack('<II', 0, 0)  # an edit that makes the document: at 0, none removed, then its bytes
    statuses, alone = [], 0.0
    try:
        for round_number in range(20):  # three at once, grouped; then one alone
            together = threading.Barrier(3)

            def put(k):
                together.wait()
                statuses.append(host.request('PUT', f'd{round_number}-{k}', new + b'x' * 100000, 0)[0])

            threads = [threading.Thread(target=put, args=(k,)) for k in range(3)]
            for thread in threads:
                thread.start()
            for thread in threads:
                thread.join()
            began = time.time()
            statuses.append(host.request('PUT', f'alone-{round_number}', new + b'y', 0)[0])
            alone = max(alone, time.time() - began)
    finally:
        stats = host.stop()[-1]
    assert statuses == [200] * 80 and alone < 1 and stats['grouped_commits'] > stats['commit_groups'], \
        (statuses, alone, stats)
    seen['alone_after_groups_s'] = round(alone, 4)
    return seen


def server_app(aup, pure, work, seeds, operations=200, threads=1):
    """An app served by its views and inputs, no routes written: random
    POSTs (a message with query fields and a body, a text, a key) and GETs
    (a number, a text, a table's pages) answer exactly as a Python model
    says, failures with their fault; what was acknowledged is there after
    the server stops, and after it is killed while clients post. The app's
    owner thread applies the inputs; connection threads (one or several)
    show views from the snapshot of its last save."""
    import signal
    import threading
    import time
    module = work / 'served.pmod'
    source = work / 'served.aup'
    source.write_text(SERVED_SOURCE)
    compile_module(aup, source, module)
    names = ['ann', 'bob', 'zed', '가', 'a"b', 'back\\slash', 'tab\t', '', 'bob2']
    compared = 0
    for seed in seeds:
        rng, board, at = random.Random(seed + 9100), {}, 0
        store = work / f'served-{seed}-{threads}'
        serve = [pure / 'build/pure-serve', '--module', module, '--threads', threads]
        host = HttpHost(serve + ['--store', store])
        order = lambda: sorted(board, key=lambda name: name.encode())

        def place(name):
            nonlocal at
            keys = order()
            if name not in board:
                position = sum(1 for k in keys if k.encode() < name.encode())
                board[name] = 0
                if len(board) > 1 and at >= position: at += 1

        try:
            for _ in range(operations):
                roll, keys = rng.random(), order()
                if roll < 0.35:
                    name, points = rng.choice(names), rng.randint(0, 9)
                    if rng.random() < 0.05:
                        request = ('POST', '/inputs/score', b'x')  # no points
                        want = (400, 'missing_field', b'')
                    elif rng.random() < 0.05:
                        request = ('POST', f'/inputs/score?points={points}', b'\xff')
                        want = (422, 'encoding', b'')
                    else:
                        request = ('POST', f'/inputs/score?points={points}', name.encode())
                        place(name)
                        board[name] += points
                        at = order().index(name)
                        want = (200, 'none', name.encode())
                elif roll < 0.5:
                    name = rng.choice(names)
                    request = ('POST', '/inputs/join', name.encode())
                    if name in board: want = (409, 'exists', b'')
                    else:
                        place(name)
                        at = order().index(name)
                        want = (200, 'none', b'')
                elif roll < 0.58:
                    request = ('POST', '/inputs/drop', b'')
                    if not board: want = (404, 'not_found', b'')
                    else:
                        del board[keys[at]]
                        at = min(at, max(len(board) - 1, 0))
                        want = (200, 'none', b'')
                elif roll < 0.68:
                    request = ('GET', '/views/total', b'')
                    want = (200, 'none', str(sum(board.values())).encode())
                elif roll < 0.78:
                    request = ('GET', '/views/current', b'')
                    want = (200, 'none', keys[at].encode()) if board else (404, 'no_value', b'')
                elif roll < 0.96:
                    first, count = rng.randint(0, 4), rng.choice([1, 2, 5, 100])
                    request = ('GET', f'/views/leaders?from={first}&count={count}', b'')
                    shown = min(first, len(keys))
                    rows = [{'name': k, 'points': board[k]} for k in keys[shown:shown + count]]
                    want = (200, 'none', {'rows': len(keys), 'from': shown, 'items': rows})
                else:
                    request, want = rng.choice([(('GET', '/views/nope', b''), (404, 'no_view', b'')),
                                                (('POST', '/inputs/nope', b''), (404, 'no_input', b'')),
                                                (('POST', '/inputs/join?x=1', b'q'), (400, 'query', b'')),
                                                (('GET', '/views/total?from=1', b''), (400, 'query', b''))])
                status, error, kind, body = http(host.port, *request)
                if isinstance(want[2], dict):
                    assert kind == 'application/json', kind
                    body = json.loads(body)
                assert (status, error, body) == want, (seed, request, (status, error, body), want)
                compared += 1
        finally:
            stats = host.stop()
        assert stats[0]['bursts'] <= stats[0]['requests'] and stats[0]['owner'], stats
        assert stats[0]['views_from_snapshots'] > 0, stats
        # A graceful stop kept every acknowledged event.
        host = HttpHost(serve + ['--store', store])
        try:
            got = json.loads(http(host.port, 'GET', '/views/leaders')[3])
            assert got['items'] == [{'name': k, 'points': board[k]} for k in order()], (seed, got)
        finally:
            host.stop()

    # Clients post while the server is killed: each acknowledged point is
    # stored. Readers on other connections meanwhile see every point
    # acknowledged before they asked, never a total going back, and never one
    # that was not saved: the total after the kill is at least any they saw.
    store = work / f'served-kill-{threads}'
    serve = [pure / 'build/pure-serve', '--module', module, '--threads', threads]
    host = HttpHost(serve + ['--store', store])
    acknowledged = [0] * 6
    seen = [0, 0]

    def client(number):
        for _ in range(10000):
            try:
                status, _, _, _ = http(host.port, 'POST', '/inputs/score?points=1', f'c{number}'.encode())
            except OSError:
                return
            if status != 200:
                return
            acknowledged[number] += 1

    def reader(number):
        for _ in range(100000):
            floor = sum(acknowledged)
            try:
                status, _, _, body = http(host.port, 'GET', '/views/total')
            except OSError:
                return
            if status != 200:
                return
            total = int(body)
            assert floor <= total and seen[number] <= total, (floor, seen[number], total)
            seen[number] = total

    clients = [threading.Thread(target=client, args=(n,)) for n in range(len(acknowledged))]
    clients += [threading.Thread(target=reader, args=(n,)) for n in range(len(seen))]
    for thread in clients:
        thread.start()
    time.sleep(0.8)
    host.process.send_signal(signal.SIGKILL)
    host.process.wait()
    for thread in clients:
        thread.join()
    host = HttpHost(serve + ['--store', store])
    try:
        stored = {row['name']: row['points'] for row in json.loads(http(host.port, 'GET', '/views/leaders')[3])['items']}
        for number, count in enumerate(acknowledged):
            assert count > 0 and stored.get(f'c{number}', 0) in (count, count + 1), (number, count, stored)
        assert min(seen) > 0 and max(seen) <= sum(stored.values()), (seen, stored)
    finally:
        host.stop()
    return compared, sum(acknowledged)


MEANING_KEPT = """record Kept {
  id = 0
  n = 0
  u = 0
  t: text
  x = 0
  label: text
}
state kept: list of Kept by id
"""
MEANING_ROWS = """view rows = each k in kept {
  id = k.id
  n = k.n
  u = k.u
  t = k.t
  x = k.x
  label = k.label
}
"""
# A: what comes in (a JSON body, its rows, or a query and a plain body) is kept, and sent on; a put is answered
# with its text.
MEANING_ORIGIN = MEANING_KEPT + """record Part {
  id = 0
  n = 0
  u = 0
  t: text
}
input put = message {
  id: u32
  n: number
  u: u32
  t: text
  at: {
    x: number
    label: text
  }
}
input put_plain = message {
  id: u32
  n: number
  u: u32
  t: text
}
input put_rows = message {
  parts: list of Part
}
input touch = message {
  id: u32
  t: text
}
output passed = message like put
on put {
  kept.add(Kept { id: put.id, n: put.n, u: put.u, t: put.t, x: put.at.x, label: put.at.label })
  send passed { ..put }
  reply put.t
}
on put_rows {
  for p in put_rows.parts {
    kept.add(Kept { id: p.id, n: p.n, u: p.u, t: p.t, x: 0, label: "rows" })
    send passed { id: p.id, n: p.n, u: p.u, t: p.t, at: { x: 0, label: "rows" } }
  }
}
on put_plain {
  kept.add(Kept { id: put_plain.id, n: put_plain.n, u: put_plain.u, t: put_plain.t, x: 0, label: "" })
  send passed { id: put_plain.id, n: put_plain.n, u: put_plain.u, t: put_plain.t, at: { x: 0, label: "" } }
}
on touch {
  kept[touch.id].t = touch.t
}
""" + MEANING_ROWS
# B: A's sends over the link, taken by name (fields in another order, u a number), kept and sent on over HTTP.
MEANING_MIRROR = MEANING_KEPT + """input passed = message {
  at: {
    label: text
    x: number
  }
  t: text
  u: number
  n: number
  id: u32
}
output onward = message like passed
on passed {
  kept.add(Kept { id: passed.id, n: passed.n, u: passed.u, t: passed.t, x: passed.at.x, label: passed.at.label })
  send onward { ..passed }
}
""" + MEANING_ROWS
# C: B's sends over HTTP.
MEANING_END = MEANING_KEPT + """input onward = message {
  id: u32
  n: number
  u: number
  t: text
  at: {
    x: number
    label: text
  }
}
on onward {
  kept.add(Kept { id: onward.id, n: onward.n, u: onward.u, t: onward.t, x: onward.at.x, label: onward.at.label })
}
""" + MEANING_ROWS
# The value set: every number a JSON reader must round correctly, u32s to its ends, texts JSON escapes and UTF-8.
MEANING_NUMBERS = ['0', '-0', '1', '-1', '0.1', '0.3333333333333333', '9007199254740991', '9007199254740992',
                   '9007199254740993', '-9007199254740993', '1e21', '1e20', '1e-7', '123456789012345678901234567890',
                   '1.7976931348623157e308', '1.7976931348623158e308', '2.2250738585072014e-308',
                   '2.2250738585072011e-308', '5e-324', '2.4703282292062328e-324', '1E+2', '-2.5e-10']
MEANING_U32 = [0, 1, 2147483648, 4294967295]
MEANING_TEXTS = ['', 'a', '한글 텍스트', 'emoji 🎉 and 𝄞', 'quote " backslash \\ slash /', 'line\nfeed\ttab\rreturn',
                 'control \x01\x1f\x7f', 'nul \x00 inside', 'separator \u2028 and \u2029', '\ufeffbom',
                 '\uffff not a character', 'x' * 4096]


def server_meaning(aup, pure, work):
    """One value, every path (docs/research/108): values at the edges of what
    JSON, a query and a plain body can say come in to A; A keeps them and sends
    them over a link to B, which takes them by name (fields in another order,
    u widened to a number) and sends them over HTTP to C. Each value must come
    out the same at every exit: A's view, a query on A, B's and C's views, A
    after a restart and after a checkpoint, B after its module was replaced.
    A number keeps its bits (zero has no sign: -0 shows as 0 and counts as 0),
    a text its bytes. What must be refused is refused on every way in, and
    leaves nothing behind (no row, no send)."""
    import socket
    import struct
    import time
    from http.client import HTTPConnection
    from urllib.parse import quote
    modules = {}
    for name, text in (('origin', MEANING_ORIGIN), ('mirror', MEANING_MIRROR), ('end', MEANING_END),
                       ('mirror-2', MEANING_MIRROR.replace('  id = 0\n  n = 0\n  u = 0\n  t: text\n  x = 0\n  label: text\n',
                                                           '  label: text\n  x = 0\n  t: text\n  u = 0\n  n = 0\n  id = 0\n'))):
        source = work / f'meaning-{name}.aup'
        source.write_text(text)
        compile_module(aup, source, source.with_suffix('.pmod'))
        modules[name] = source.with_suffix('.pmod')
    serve = pure / 'build/pure-serve'
    keys = {}
    for name in ('a', 'b', 'c'):
        host = HttpHost([serve, '--module', modules['end'], '--store', work / 'meaning-keys', '--key', work / f'meaning-{name}.key'])
        keys[name] = host.info['public_key']
        host.stop()
    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as probe:
        probe.bind(('127.0.0.1', 0))
        link_port = probe.getsockname()[1]

    def start(name, module):
        args = [serve, '--module', modules[module], '--store', work / f'meaning-{name}', '--key', work / f'meaning-{name}.key',
                '--name', name]
        if name == 'a':
            args += ['--send', f'passed=pure://127.0.0.1:{link_port}/passed', '--seal', f'passed={keys["b"]}']
        if name == 'b':
            args += ['--link-port', link_port, '--sender', f'a.passed={keys["a"]}',
                     '--send', f'onward=http://127.0.0.1:{hosts["c"].port}/inputs/onward', '--seal', f'onward={keys["c"]}']
        if name == 'c':
            args += ['--sender', f'b.onward={keys["b"]}']
        hosts[name] = HttpHost(args)

    def send(port, path, body, kind, answer=None):
        connection = HTTPConnection('127.0.0.1', port, timeout=30)
        try:
            connection.request('POST', path, body, {'Content-Length': str(len(body)), 'Content-Type': kind})
            response = connection.getresponse()
            got = response.read()
            assert answer is None or response.status != 200 or got == answer, (path, got[:80], answer[:80])
            return response.status
        finally:
            connection.close()

    def rows(name, path='/views/rows'):
        status, _, _, body = http(hosts[name].port, 'GET', path)
        assert status == 200, (name, path, status, body[:200])
        return {row['id']: row for row in json.loads(body)['items']}

    def same(shown, want):  # a number's bits, zero having no sign
        return float(shown) == want == 0 or struct.pack('<d', float(shown)) == struct.pack('<d', want)

    def differing(found, expected):
        wrong = [(key, found.get(key)) for key, (n, u, t, x, label) in expected.items()
                 if key not in found or not (same(found[key]['n'], n) and float(found[key]['u']) == u and
                                             found[key]['t'] == t and same(found[key]['x'], x) and found[key]['label'] == label)]
        return wrong + [(key, 'not sent') for key in set(found) - set(expected)]

    hosts, expected, refused = {}, {}, 0
    try:
        start('c', 'end')
        start('b', 'mirror')
        start('a', 'origin')
        a = hosts['a'].port
        count = len(MEANING_NUMBERS)
        # In as JSON, each string once escaped to ASCII and once as UTF-8, a group's fields inside.
        for i, n in enumerate(MEANING_NUMBERS):
            u, t = MEANING_U32[i % len(MEANING_U32)], MEANING_TEXTS[i % len(MEANING_TEXTS)]
            x, label = MEANING_NUMBERS[(i + 5) % count], MEANING_TEXTS[(i + 3) % len(MEANING_TEXTS)]
            ascii_only = i % 2 == 0
            body = '{"id": %d, "n": %s, "u": %d, "t": %s, "at": {"x": %s, "label": %s}}' % (
                i + 1, n, u, json.dumps(t, ensure_ascii=ascii_only), x, json.dumps(label, ensure_ascii=ascii_only))
            assert send(a, '/inputs/put', body.encode(), 'application/json', t.encode()) == 200, body[:200]
            expected[i + 1] = (float(n), u, t, float(x), label)
        # In as rows of one message: a JSON array, placed as its list's stored form.
        parts = [(501 + i, n, MEANING_U32[(i + 2) % len(MEANING_U32)], MEANING_TEXTS[(i + 4) % len(MEANING_TEXTS)])
                 for i, n in enumerate(MEANING_NUMBERS)]
        body = '{"parts": [%s]}' % ', '.join('{"id": %d, "n": %s, "u": %d, "t": %s}' % (key, n, u, json.dumps(t))
                                             for key, n, u, t in parts)
        assert send(a, '/inputs/put_rows', body.encode(), 'application/json') == 200, body[:200]
        expected.update({key: (float(n), u, t, 0.0, 'rows') for key, n, u, t in parts})
        # In as a query (%XX where a client would write it so) and a plain body.
        for i, n in enumerate(MEANING_NUMBERS):
            u, t = MEANING_U32[(i + 1) % len(MEANING_U32)], MEANING_TEXTS[(i + 2) % len(MEANING_TEXTS)]
            assert send(a, f'/inputs/put_plain?id={101 + i}&n={quote(n, safe="")}&u={u}', t.encode(),
                        'text/plain; charset=utf-8') == 200, n
            expected[101 + i] = (float(n), u, t, 0.0, '')
        # What must be refused: numbers past the finite, u32s out of range or not whole, texts that are no UTF-8.
        good = '{"id": %d, "n": %s, "u": %s, "t": %s, "at": {"x": 1, "label": ""}}'
        bad_json = [good % (201, '1e999', '1', '"t"'), good % (202, '-1e999', '1', '"t"'), good % (203, 'NaN', '1', '"t"'),
                    good % (204, '00', '1', '"t"'), good % (205, '+1', '1', '"t"'), good % (206, '.5', '1', '"t"'),
                    good % (207, '1', '4294967296', '"t"'), good % (208, '1', '-1', '"t"'), good % (209, '1', '1.5', '"t"'),
                    good % (210, '1', '1e3', '"t"'), good % (211, '1', '-0', '"t"'), good % (212, '1', '1', '"\\ud800"'),
                    good % (213, '1', '1', '"a\\ud83d"'), good % (214, '1', '1', '"\\udc00\\ud800"')]
        for body in bad_json:
            assert send(a, '/inputs/put', body.encode(), 'application/json') == 400, body
        no_utf8 = [b'\xff', b'\xc3', b'\xed\xa0\x80', b'\xc0\xaf', b'\xf4\x90\x80\x80']  # a surrogate, too long, past U+10FFFF
        for i, bad in enumerate(no_utf8):
            body = b'{"id": %d, "n": 1, "u": 1, "t": "' % (215 + i) + bad + b'", "at": {"x": 1, "label": ""}}'
            assert send(a, '/inputs/put', body, 'application/json') == 400, body
        bad_query = [('1e999', '1'), ('inf', '1'), ('nan', '1'), ('0x10', '1'), ('', '1'), ('1', '4294967296'), ('1', '-1'),
                     ('1', '1.5'), ('1', '1e3'), ('1', '%2D0'), ('1', '%201'), ('1', '%zz')]
        for i, (n, u) in enumerate(bad_query):
            assert send(a, f'/inputs/put_plain?id={301 + i}&n={n}&u={u}', b't', 'text/plain') == 400, (n, u)
        for i, bad in enumerate(no_utf8 + [b'ok \xc3']):
            assert send(a, f'/inputs/put_plain?id={401 + i}&n=1&u=1', bad, 'text/plain') == 422, bad
        # Rows go whole or not at all: one number past the finite refuses them all; a u that a row holds (a
        # number) but a u32 cannot fails the event where it is sent, and none is kept.
        assert send(a, '/inputs/put_rows', b'{"parts": [{"id": 601, "n": 1, "u": 1, "t": "a"}, '
                                           b'{"id": 602, "n": 1e999, "u": 1, "t": "b"}]}', 'application/json') == 400
        assert send(a, '/inputs/put_rows', b'{"parts": [{"id": 603, "n": 1, "u": 1, "t": "a"}, '
                                           b'{"id": 604, "n": 1, "u": 1.5, "t": "b"}]}', 'application/json') != 200
        refused = len(bad_json) + len(no_utf8) + len(bad_query) + len(no_utf8) + 1 + 2
        # A row to change often on A alone, until a checkpoint writes its list anew; it ends as it began.
        assert send(a, '/inputs/put', json.dumps({'id': 900, 'n': 9, 'u': 9, 't': 'filler',
                                                  'at': {'x': 9, 'label': 'filler'}}).encode(), 'application/json') == 200
        expected[900] = (9.0, 9, 'filler', 9.0, 'filler')
        exits = {'a': rows('a')}
        deadline = time.time() + 30
        while time.time() < deadline and (len(rows('b')) < len(expected) or len(rows('c')) < len(expected)):
            time.sleep(0.05)
        time.sleep(0.3)  # anything more (a refused event sent after all) would be here by now
        exits['b'], exits['c'] = rows('b'), rows('c')
        query = work / 'meaning-query.aup'
        query.write_text(MEANING_ROWS.replace('view rows =', 'view rows_asked ='))
        run(aup, 'query', work / 'meaning-origin.aup', query, '-o', work / 'meaning-query.pmod')
        status, _, _, body = http(a, 'PUT', '/queries/rows_asked', (work / 'meaning-query.pmod').read_bytes())
        assert status == 200, body[:200]
        exits['a queried'] = rows('a', '/queries/rows_asked')
        hosts.pop('a').stop()
        start('a', 'origin')
        exits['a restarted'] = rows('a')
        for step in range(400):  # 1.6 MiB of changes to a list of a few KiB: its image is written anew
            assert send(hosts['a'].port, '/inputs/touch', json.dumps({'id': 900, 't': f'{step:04}' * 1024}).encode(),
                        'application/json') == 200
        assert send(hosts['a'].port, '/inputs/touch', json.dumps({'id': 900, 't': 'filler'}).encode(),
                    'application/json') == 200
        checkpoints = hosts.pop('a').stop()[-1]['checkpoints']
        assert checkpoints >= 1, checkpoints
        start('a', 'origin')
        exits['a after a checkpoint'] = rows('a')
        hosts.pop('b').stop()
        start('b', 'mirror-2')
        exits['b replaced'] = rows('b')
        for where, found in exits.items():
            wrong = differing(found, expected)
            assert not wrong, (where, wrong[:3])
    finally:
        for host in hosts.values():
            host.stop()
    return {'values': len(expected), 'refused': refused, 'exits': len(exits), 'checkpoints': checkpoints}


def main():
    global EDITOR
    parser = argparse.ArgumentParser()
    parser.add_argument('--aup', type=Path, required=True, help='the aup compiler')
    parser.add_argument('--aup-root', type=Path, default=ROOT.parent / 'aup', help='its checkout, for examples/editor.aup')
    parser.add_argument('--seeds', type=int, default=4)
    args = parser.parse_args()
    aup, pure = args.aup.resolve(), ROOT
    EDITOR = args.aup_root.resolve() / 'examples' / 'editor.aup'
    report = {}
    with tempfile.TemporaryDirectory(prefix='pure-check-') as directory:
        work = Path(directory)
        report['module_ranges'] = module_ranges(aup, pure, work)
        report['server_parity_requests'] = sum(server_parity(aup, pure, work, range(args.seeds), threads=threads)
                                               for threads in (1, 3))
        report['server_pipelined_answers'] = server_pipelining(aup, pure, work)
        report['server_lent_read_bytes'] = server_lent_reads(aup, pure, work)
        report['server_lent_budget_bytes'] = server_lent_budget(aup, pure, work)
        report['server_lent_views'] = [server_lent_views(aup, pure, work, threads) for threads in (1, 3)]
        report['server_bursts'] = server_bursts(aup, pure, work)
        report['server_bursts_three_threads'] = server_bursts(aup, pure, work, shards=3)
        report['server_app_requests'], report['server_app_acknowledged_before_kill'] = \
            server_app(aup, pure, work, range(args.seeds))
        report['server_app_owner_requests'], report['server_app_owner_acknowledged_before_kill'] = \
            server_app(aup, pure, work, range(args.seeds), threads=3)
        report['server_json_requests'] = server_json(aup, pure, work)
        report['server_timer_beats'] = server_timers(aup, pure, work)
        report['server_clocks'] = server_clocks(aup, pure, work)
        report['server_plain_edit'] = server_plain_edit(aup, pure, work)
        report['server_links'] = server_links(aup, pure, work)
        report['server_links_udp'] = server_links_udp(aup, pure, work)
        report['server_links_udp_lossy'] = server_links_udp_lossy(aup, pure, work)
        report['server_links_refused'] = server_links_refused(aup, pure, work)
        report['server_memory'] = server_memory(aup, pure, work)
        report['server_windows'] = server_windows(aup, pure, work)
        report['server_upgrade'] = server_upgrade(aup, pure, work)
        report['server_fields'] = server_fields(aup, pure, work)
        report['server_links_independent'] = server_links_independent(aup, pure, work)
        report['server_links_moved'] = server_links_moved(aup, pure, work)
        report['server_webhook'] = server_webhook(aup, pure, work)
        report['server_sealed'] = server_sealed(aup, pure, work)
        report['server_surface'] = server_surface(aup, pure, work)
        report['server_queries'] = server_queries(aup, pure, work)
        report['server_rows'] = server_rows(aup, pure, work)
        report['server_arguments'] = server_arguments(aup, pure, work)
        report['server_answers'] = server_answers(aup, pure, work)
        report['server_answers_memory'] = server_answers_memory(aup, pure, work)
        report['server_meaning'] = server_meaning(aup, pure, work)
    print(json.dumps(report))


if __name__ == '__main__':
    sys.exit(main())