|> validate_format(:sha, ~r/^[0-9a-f]{40}$/)

    |> validate_format(:artifact_digest, ~r/^[0-9a-f]{64}$/)

    |> validate_format(:manifest_digest, ~r/^[0-9a-f]{64}$/)

    |> validate_length(:modules, max: 512)

    |> validate_length(:modules, max: 2_048)

    |> validate_length(:nodes, max: 100)

    |> validate_length(:expected_nodes, max: 100)

    |> validate_length(:canary, max: 255)

    |> Enum.filter(fn entry -> entry["seq"] > applied end)

    |> Enum.each(fn entry -> apply_entry!(repo, entry) end)

    rebuild_if_objects_missing!(repo, index, default_branch)

    converge_refs(repo, index)

    Repos.set_default_branch!(repo, default_branch)

    :ok

  end

  defp rebuild_if_objects_missing!(repo, index, default_branch) do

    unless refs_materialized?(repo, index) do

      Logger.warning("forge_sync_cache_rebuild repo=#{repo} code=missing_ref_object")

      :ok = Repos.delete_repo(repo)

      Repos.ensure_repo!(repo, default_branch)

      index

      |> WAL.entries()

      |> Enum.each(fn entry -> apply_entry!(repo, entry) end)

      unless refs_materialized?(repo, index) do

        raise "forge cache rebuild did not materialize every authoritative ref"

      end

    end

  end

  defp refs_materialized?(repo, index) do

    path = Repos.bare_path(repo)

    index

    |> WAL.refs()

    |> Map.values()

    |> Enum.uniq()

    |> Enum.all?(fn sha ->

      match?({_output, 0}, Repos.git(path, ["cat-file", "-e", sha]))

    end)

  end

  defp apply_entry!(repo, %{"seq" => seq, "object" => object} = entry) do

    path = Repos.bare_path(repo)

    assert String.trim(git_bare!(Repos.bare_path("storage-key"), ["symbolic-ref", "HEAD"])) ==

             "refs/heads/trunk"

    File.rm_rf!(Repos.bare_path("storage-key"))

    bare_path = Repos.bare_path("storage-key")

    File.rm_rf!(Path.join(bare_path, "objects"))

    File.mkdir_p!(Path.join(bare_path, "objects"))

    assert :ok = Sync.ensure_fresh("storage-key", "trunk")

    assert String.trim(git_bare!(bare_path, ["show", "trunk:README.md"])) == "durable import"

    File.rm_rf!(bare_path)

    repository = %Repository{storage_key: "storage-key", default_branch: "trunk"}

    assert {:ok, ^sha} = Browse.head(repository)

             Targets.finish_rolling_replacement(target.id, rolling_result(sha, "live"))

  end

  test "rolling replacement records a complete large module inventory", %{sha: sha} do

    {:ok, target} = Targets.promote("demo", sha, "operator:test")

    {:ok, _building} = Targets.advance(target.id, "building")

    {:ok, _built} = Targets.advance(target.id, "built")

    {:ok, _rolling} = Targets.advance(target.id, "needs_rolling_replace")

    modules = Enum.map(1..600, &"Elixir.OpenAgents.Generated.Module#{&1}")

    insert_build_receipt!(

      target,

      %{"classification" => "needs_rolling_replace", "source_sha" => sha},

      String.duplicate("a", 64),

      modules

    )

    assert {:ok, %{receipt: receipt}} =

             Targets.finish_rolling_replacement(target.id, rolling_result(sha, "live"))

    assert receipt.modules == modules

  end

  test "rolling replacement settlement refuses a superseded target", %{sha: sha} do

    {:ok, first} = Targets.promote("demo", sha, "operator:first")

    {:ok, _building} = Targets.advance(first.id, "building")

    end

  end

  defp insert_build_receipt!(target, manifest, artifact_digest) do

  defp insert_build_receipt!(

         target,

         manifest,

         artifact_digest,

         modules \\ ["Elixir.OpenAgents.BuildInfo"]

       ) do

    %BuildReceipt{}

    |> BuildReceipt.changeset(%{

      repo: target.repo,

      target_id: target.id,

      status: "complete",

      manifest: manifest,

      modules: ["Elixir.OpenAgents.BuildInfo"],

      modules: modules,

      artifact: "#{artifact_digest}.tar.gz",

      artifact_digest: artifact_digest,

      duration_ms: 1,