feat: 接入 Instance 扩展能力观测

.agents/skills/homelab-knowledge/SKILL.md

@@ -1,76 +0,0 @@
----
-name: homelab-knowledge
-description: Query and maintain the shared homelab-wiki when working on homelab services, infrastructure, architecture, operations, or current service status. Use it to gather existing context before work and to keep durable knowledge synchronized after relevant changes; do not use it for unrelated software work or as a substitute for commit and PR history.
----
-
-# Homelab Knowledge
-
-Use `homelab-wiki` as the shared long-lived knowledge base for people and agents. Search it directly with `rg`; do not introduce a search index, vector database, or generated copy of the wiki.
-
-## Locate the wiki
-
-Resolve the checkout in this order:
-
-1. `$HOMELAB_WIKI_PATH`, when set.
-2. A sibling directory named `homelab-wiki` next to the current repository.
-3. `/home/panxiao81/homelab-wiki` when it exists.
-
-If no checkout is available, report that constraint. Do not silently skip the knowledge step, clone a repository, or create a replacement wiki without the user's authorization.
-
-Before using the wiki, read its `AGENTS.md` completely. For edits, also read `README.md` and `CONTRIBUTING.md` completely and follow any more specific instructions associated with the target page.
-
-## Gather context
-
-At the beginning of a homelab task:
-
-1. Derive search terms from the component name, service aliases, hostnames, Kubernetes resources, configuration keys, error text, and task intent.
-2. Use `rg -n -i` in the wiki to find candidate pages. Prefer several precise searches over reading the whole repository.
-3. Follow the wiki's task index, service index, architecture constraints, source records, and verification conflicts when they are relevant.
-4. Read the closest authoritative pages and their material links before making decisions. Also read the corresponding source repository README or runbook when changing an implementation.
-5. Distinguish documented design, declared configuration, deployment history, live verification, and work currently in progress. Do not present one as another.
-
-For questions about current project or service status, first obtain the maintainer's current-work and ticket context as required by the wiki, unless the conversation already provides that authorization and scope. Reading documentation does not authorize live-system inspection.
-
-Answer read-only questions from the evidence found. Include paths or links that let the user verify important claims, and state when evidence may be stale or conflicting.
-
-## Maintain knowledge after changes
-
-For any code, configuration, infrastructure, or operational change, perform a documentation-impact check before declaring the task complete.
-
-Update the wiki in the same task when the change affects durable knowledge such as:
-
-- service purpose, lifecycle, entry point, authentication, permissions, dependencies, or first-use path;
-- architecture boundaries or accepted constraints;
-- deployment ownership or persistent operating behavior;
-- troubleshooting, recovery, verification, or maintenance procedures;
-- the addition, replacement, or retirement of a service.
-
-Keep one-time progress, implementation narration, and release-by-release history in commits, PRs, or tickets. Do not copy them into the wiki unless they change a durable stage summary. Implementation-specific parameters may remain in the source repository README or runbook when the wiki convention says to link rather than duplicate them.
-
-When editing:
-
-1. Inspect both the source-repository diff and the wiki working tree before writing. Preserve unrelated user changes in both repositories.
-2. Update the page closest to the fact first, then only the navigation, indexes, constraints, or verification records that the wiki rules require.
-3. Preserve evidence metadata. Never advance `last_verified` without performing the stated live verification; ordinary review may update only fields permitted by the wiki.
-4. Link related source commits, PRs, or paths when available. Clearly mark uncommitted sources and unfinished cross-repository synchronization.
-5. Record conflicts rather than resolving them by assumption. Ask before live inspection or before choosing among materially conflicting current-state claims.
-6. Keep credentials, tokens, private keys, Terraform state, secret values, and sensitive command output out of documentation. Never read or copy known sensitive files merely to improve the wiki.
-
-Wiki edits are a separate repository change. Do not commit, push, open a PR, or modify a live system unless the user has authorized that action.
-
-## Verify and report
-
-After editing the wiki, run from its root:
-
-```bash
-python3 scripts/check_docs.py
-git diff --check
-```
-
-If the checker itself changed, also run:
-
-```bash
-python3 -m unittest discover -s tests -v
-```
-
-In the final response, report source-repository changes and wiki changes separately, including validation performed and anything still awaiting verification or cross-repository linkage. If no wiki update was needed, state the concrete reason; do not merely say that documentation was unaffected.

AGENTS.md

@@ -34,16 +34,6 @@
 - Proxmox VM 的北向管理不能假定单一 API 覆盖完整生命周期。允许按能力组合 Proxmox API、节点
   上的受限强类型 Agent/CLI 操作和 ManualTask；节点 Agent 不得退化为无版本契约的任意远程 shell。
 - 所有 controller 必须考虑幂等、observe、finalizer、conditions、删除策略和恢复行为。
-- Ayatori 会联动 Kubernetes API、虚拟化、存储、网络及其他外部控制面；集成测试是功能完成
-  标准的一部分，不得仅凭 fake client 或 mock 测试宣告 controller、adapter 或生命周期变更完成。
-- 测试应按风险分层：纯领域规则使用快速单元测试；API schema、CEL、status subresource、
-  watch/cache、owner reference 和 reconcile 事件链使用 envtest；需要 scheduler、kubelet、网络、
-  存储或真实后端行为的路径在 Dev 集群或对应后端环境执行端到端测试。
-- fake client 适合穷举状态机和错误分支，但它不会完整执行 API server defaulting、validation、
-  resourceVersion、garbage collection 或新版 Kubernetes 约束；涉及这些语义时必须增加真实 API
-  server 测试。跨 adapter 的共同契约应使用同一套 contract tests，避免各实现产生语义漂移。
-- 集成测试必须覆盖正常路径以及幂等重试、controller 重启、依赖稍后出现、删除/finalizer、
-  后端结果不确定和并发竞态等恢复路径；无法在当前层测试的部分要明确记录由哪一层验证。
 - Secret、token、kubeconfig 及具体生产凭据不得提交到仓库。
 - `deploy/dev/` 与 `deploy/prod/` 使用相同制品；生产版本只通过 promotion 更新。
 - 内部专用不构成降低测试、版本、恢复、安全和可审计要求的理由。

docs/database/README.md

@@ -21,17 +21,15 @@ Database 是 Ayatori 首批实际产品领域之一。第一个迁移切片只
 
 代码被移动到 Ayatori 的 `internal/database/domain/instance`，测试 import 和文档链接相应更新；
 首个后续切片按已批准合同增加 Instance extension observation：观测与当前 target 绑定，进入重新
-验证或删除时失效，且支持判定不授权 Tenant provisioning。后续 Ready 切片实现管理能力判定、
-registry 准备决策与完整回读、Ready 重验及本轮 evidence 前置检查；沿用已批准合同，不能把旧运行
-链路接回该模型。各层验证边界见 [Instance 领域规格](domain-instance.md)。
+验证或删除时失效，且支持判定不授权 Tenant provisioning。其余 Ready/observation 行为仍应先更新
+合同与测试再实现，不能把旧运行链路接回该模型。
 
 ## 边界
 
 - 领域层不依赖 Kubernetes types、数据库 driver 或凭据 provider。
 - CredentialReference 只携带管理 Secret 的名称与字段映射，不包含 Secret 内容或 OpenBao path。
 - Instance checkpoint 不是外部事实；实际能力必须由 application/adapter 观察后交给领域对象判断。
-- 当前代码只检查 Instance 供应前置条件，不授予 Tenant 所有权或外部写入权限，也不表示
-  Database API 已经可用。
+- 当前代码不授权 Tenant provisioning，也不表示 Database API 已经可用。
 
 ## 设计入口
 

docs/database/domain-instance.md

@@ -2,7 +2,7 @@
 
 状态：Draft，含已确认决策。日期：2026-09-13。
 
-上层合并边界见 [ADR-0008](../decisions/0008-merge-postgresql-tenant-operator.md)。本文只展开 Instance，不包含 Tenant 的供应
+上层合并边界见 [ADR-0008](../decisions/0008-merge-Ayatori Database controller.md)。本文只展开 Instance，不包含 Tenant 的供应
 实现，也不新增 CRD 字段。设计签名用于评审职责与行为，不是待复制的 Go 接口代码。
 
 ## 1. 对象职责与生命周期
@@ -228,26 +228,3 @@ Ready --registry 需修复/保存--> InitializingRegistry
 均已确认。其他决策及未决项见总体草案，不增加后台清扫器或状态字段。
 
 批准本对象结构不等于批准这些未决行为，也不意味着立刻实现完整供应链路。
-
-## 8. 领域实现与验证边界（2026-09-21）
-
-`internal/database/domain/instance` 按上述方法合同实现 Ready 纯判定。输入分别表达连接、
-metadata、role、database、grant、extension 管理能力，以及 registry 的未观察、缺失、需迁移、
-可用、不兼容和不可访问状态。检查零值或未知值按证据不足处理；操作失败只使用封闭的安全
-类别，不接收驱动错误。`Snapshot.Failure` 是 Condition 映射的领域输入，不新增 CRD/status 字段。
-
-管理能力分别指目标连接可用、服务器 metadata 可读，以及执行规格 §7 所要求的角色、数据库、
-授权和扩展管理操作的能力；不是仅凭版本查询或扩展可用列表判定权限。具体 SQL 权限探测矩阵、
-最小权限角色和扩展权限例外仍须在 PostgreSQL adapter 切片定义并用真实后端验证。
-registry 不兼容独立保留为领域失败类别，不将其误报为权限不足；公开 Condition Reason 的映射
-留待 API/application 切片按原合同评审。
-
-领域测试验证完整回读、缺少检查项、状态重建、重复判定、目标不匹配、配置变化、依赖失败、
-registry 丢失／不兼容、操作结果不确定和删除限制。只有本轮完整能力判定通过后，Instance
-前置条件检查才通过；这不授予 Tenant 所有权，也不替代实际写入前的并发校验。
-
-本切片不新增 controller、adapter、Secret 读取或外部生命周期操作。checkpoint 保存失败、
-resourceVersion 冲突、watch 与 finalizer 事件链需由后续 application/envtest 验证；SQL 探测、
-registry 初始化／迁移、超时后的真实状态回读和并发幂等由 PostgreSQL 集成测试验证；Secret
-变化后的连接刷新由 Kubernetes API 加真实 PostgreSQL 的集成测试验证。纯领域测试不能证明
-Database 已可运行或这些集成合同已完成。

docs/roadmap.md

@@ -51,10 +51,9 @@
 - 用户集群只暴露 worker node，控制面完全由平台托管。
 - 本节记录候选实现边界，不构成路线图承诺。
 
-## 后续 Compute 验收场景
+## 首个业务里程碑
 
-Database 等首批资源优先落地。Compute 开始实施后，以 Laptop Rebuild Readiness 验证节点
-生命周期与恢复能力；该场景不作为首批 Database、LoadBalancer 或 Bucket 的交付前置条件：
+完成 Laptop Rebuild Readiness：
 
 1. 临时节点加入。
 2. laptop 上的 workload 被重建、迁移或形成可执行人工任务。

internal/database/domain/instance/instance.go

@@ -38,22 +38,22 @@ const (
 )
 
 // Snapshot contains persisted observations only, without credentials or live evidence.
+// Failure detail mapping will be added with capability assessment, not intent transitions.
 type Snapshot struct {
 	Phase            Phase
 	ObservedRevision int64
 	Readiness        Readiness
 	ReportedVersion  string
-	Failure          Failure
 }
 
 // Instance protects registration state and pure lifecycle transitions.
 // Reconstitution does not establish live capability evidence, even for a Ready snapshot.
+// This initial slice deliberately exposes no operation that authorizes provisioning.
 type Instance struct {
 	target     ObservationTarget
 	snapshot   Snapshot
 	deleting   bool
 	extensions ExtensionSupport
-	evidence   *CapabilityObservation
 }
 
 func Reconstitute(target ObservationTarget, snapshot Snapshot, deleting bool) (*Instance, error) {
@@ -85,8 +85,6 @@ func (i *Instance) BeginValidation() error {
 	i.snapshot.Phase = PhaseValidating
 	i.snapshot.Readiness = Unknown
 	i.extensions = ExtensionSupport{}
-	i.evidence = nil
-	i.snapshot.Failure = NoFailure
 	return nil
 }
 
@@ -102,8 +100,6 @@ func (i *Instance) BeginDeletion() error {
 	i.snapshot.Phase = PhaseDeleting
 	i.snapshot.Readiness = Unknown
 	i.extensions = ExtensionSupport{}
-	i.evidence = nil
-	i.snapshot.Failure = NoFailure
 	return nil
 }
 

internal/database/domain/instance/instance_extensions_test.go

@@ -29,10 +29,10 @@ func TestInstanceAcceptsExtensionObservationForCurrentTarget(t *testing.T) {
 	target := value.Target()
 	snapshot := value.Snapshot()
 
-	if err := value.ObserveExtensions(target, instance.ObserveExtensionSupport([]string{testTrigram})); err != nil {
+	if err := value.ObserveExtensions(target, instance.ObserveExtensionSupport([]string{"pg_trgm"})); err != nil {
 		t.Fatal(err)
 	}
-	if got := value.CheckExtensions(instance.NewExtensionSet([]string{testTrigram})); got.Decision != instance.ExtensionsAccepted {
+	if got := value.CheckExtensions(instance.NewExtensionSet([]string{"pg_trgm"})); got.Decision != instance.ExtensionsAccepted {
 		t.Fatalf("CheckExtensions() = %v, want accepted", got)
 	}
 	if value.Snapshot() != snapshot {
@@ -52,20 +52,20 @@ func TestInstanceRejectsExtensionObservationForDifferentTarget(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := value.ObserveExtensions(different, instance.ObserveExtensionSupport([]string{testTrigram})); err == nil {
+	if err := value.ObserveExtensions(different, instance.ObserveExtensionSupport([]string{"pg_trgm"})); err == nil {
 		t.Fatal("observation for a different target was accepted")
 	}
-	if got := value.CheckExtensions(instance.NewExtensionSet([]string{testTrigram})); got.Decision != instance.ExtensionSupportUnobserved {
+	if got := value.CheckExtensions(instance.NewExtensionSet([]string{"pg_trgm"})); got.Decision != instance.ExtensionSupportUnobserved {
 		t.Fatalf("rejected observation changed support: %v", got)
 	}
 }
 
 func TestInstanceClearsExtensionObservationAcrossLifecycleBoundaries(t *testing.T) {
-	requested := instance.NewExtensionSet([]string{testTrigram})
+	requested := instance.NewExtensionSet([]string{"pg_trgm"})
 
 	t.Run("validation", func(t *testing.T) {
 		value := lifecycleInstance(t, instance.Snapshot{Phase: instance.PhaseReady}, false)
-		if err := value.ObserveExtensions(value.Target(), instance.ObserveExtensionSupport([]string{testTrigram})); err != nil {
+		if err := value.ObserveExtensions(value.Target(), instance.ObserveExtensionSupport([]string{"pg_trgm"})); err != nil {
 			t.Fatal(err)
 		}
 		if err := value.BeginValidation(); err != nil {
@@ -78,7 +78,7 @@ func TestInstanceClearsExtensionObservationAcrossLifecycleBoundaries(t *testing.
 
 	t.Run("deletion", func(t *testing.T) {
 		value := lifecycleInstance(t, instance.Snapshot{Phase: instance.PhaseReady}, true)
-		if err := value.ObserveExtensions(value.Target(), instance.ObserveExtensionSupport([]string{testTrigram})); err == nil {
+		if err := value.ObserveExtensions(value.Target(), instance.ObserveExtensionSupport([]string{"pg_trgm"})); err == nil {
 			t.Fatal("deleting instance accepted a new observation")
 		}
 		if err := value.BeginDeletion(); err != nil {
@@ -92,8 +92,8 @@ func TestInstanceClearsExtensionObservationAcrossLifecycleBoundaries(t *testing.
 
 func TestInstanceCanExplicitlyInvalidateExtensionObservation(t *testing.T) {
 	value := lifecycleInstance(t, instance.Snapshot{Phase: instance.PhaseValidating}, false)
-	requested := instance.NewExtensionSet([]string{testTrigram})
-	if err := value.ObserveExtensions(value.Target(), instance.ObserveExtensionSupport([]string{testTrigram})); err != nil {
+	requested := instance.NewExtensionSet([]string{"pg_trgm"})
+	if err := value.ObserveExtensions(value.Target(), instance.ObserveExtensionSupport([]string{"pg_trgm"})); err != nil {
 		t.Fatal(err)
 	}
 	if err := value.ObserveExtensions(value.Target(), instance.ExtensionSupport{}); err != nil {

internal/database/domain/instance/readiness.go

@@ -1,263 +0,0 @@
-/*
-Copyright 2026.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package instance
-
-import "errors"
-
-// Failure 只表示安全类别；驱动错误、凭据和 Condition 文案留在应用边界。
-type Failure uint8
-
-const (
-	NoFailure Failure = iota
-	ObservationIncomplete
-	DependencyUnavailable
-	AuthenticationFailed
-	InsufficientPrivileges
-	RegistryIncompatible
-	RegistryNotUsable
-)
-
-// CheckResult 的零值表示未观察，不能视为成功。
-type CheckResult uint8
-
-const (
-	CheckUnobserved CheckResult = iota
-	CheckPassed
-	CheckUnavailable
-	CheckAuthenticationFailed
-	CheckInsufficientPrivileges
-)
-
-// ManagementChecks 分别记录所需能力；SQL 探测和同轮次关联由 adapter/application 保证。
-// Extensions 不代表任意扩展均可安装；具体请求仍需支持检查、执行及回读。
-type ManagementChecks struct {
-	Connection CheckResult
-	Metadata   CheckResult
-	Roles      CheckResult
-	Databases  CheckResult
-	Grants     CheckResult
-	Extensions CheckResult
-}
-
-func (c ManagementChecks) failure() Failure {
-	for _, check := range []CheckResult{c.Connection, c.Metadata, c.Roles, c.Databases, c.Grants, c.Extensions} {
-		switch check {
-		case CheckPassed:
-		case CheckUnavailable:
-			return DependencyUnavailable
-		case CheckAuthenticationFailed:
-			return AuthenticationFailed
-		case CheckInsufficientPrivileges:
-			return InsufficientPrivileges
-		default:
-			return ObservationIncomplete
-		}
-	}
-	return NoFailure
-}
-
-type RegistryState uint8
-
-const (
-	RegistryUnobserved RegistryState = iota
-	RegistryAbsent
-	RegistryNeedsMigration
-	RegistryUsable
-	RegistryUnsupported
-	RegistryUnavailable
-)
-
-// CapabilityObservation 是值对象，不包含连接、凭据或可变集合。
-type CapabilityObservation struct {
-	target   ObservationTarget
-	version  string
-	checks   ManagementChecks
-	registry RegistryState
-}
-
-func NewCapabilityObservation(target ObservationTarget, version string,
-	checks ManagementChecks, registry RegistryState,
-) (CapabilityObservation, error) {
-	if err := target.Validate(); err != nil {
-		return CapabilityObservation{}, err
-	}
-	return CapabilityObservation{target: target, version: version, checks: checks, registry: registry}, nil
-}
-
-func (o CapabilityObservation) managementFailure() Failure {
-	if failure := o.checks.failure(); failure != NoFailure {
-		return failure
-	}
-	if o.version == "" {
-		return ObservationIncomplete
-	}
-	return NoFailure
-}
-
-func (o CapabilityObservation) registryFailure() Failure {
-	switch o.registry {
-	case RegistryUsable:
-		return NoFailure
-	case RegistryAbsent, RegistryNeedsMigration:
-		return RegistryNotUsable
-	case RegistryUnsupported:
-		return RegistryIncompatible
-	case RegistryUnavailable:
-		return DependencyUnavailable
-	default:
-		return ObservationIncomplete
-	}
-}
-
-type PreparationDecision uint8
-
-const (
-	PreparationDenied PreparationDecision = iota
-	PreparationAllowed
-	AlreadyUsable
-)
-
-func (i *Instance) acceptObservation(o CapabilityObservation, phase Phase) error {
-	if !i.target.Matches(o.target) {
-		return errors.New("capability observation target does not match instance")
-	}
-	if i.deleting || i.snapshot.Phase != phase {
-		return errors.New("capability observation is not allowed in current lifecycle")
-	}
-	return nil
-}
-
-func (i *Instance) fail(failure Failure) {
-	i.evidence = nil
-	i.extensions = ExtensionSupport{}
-	i.snapshot.Readiness = NotReady
-	i.snapshot.Failure = failure
-	i.snapshot.ObservedRevision = i.target.Revision().Value()
-}
-
-// AssessManagement 只推进意图，不执行 registry 写入，也不完成 observedRevision。
-func (i *Instance) AssessManagement(o CapabilityObservation) error {
-	if err := i.acceptObservation(o, PhaseValidating); err != nil {
-		return err
-	}
-	if failure := o.managementFailure(); failure != NoFailure {
-		i.fail(failure)
-		return nil
-	}
-	if failure := o.registryFailure(); failure != NoFailure && failure != RegistryNotUsable {
-		i.fail(failure)
-		return nil
-	}
-	i.snapshot.Phase = PhaseInitializingRegistry
-	i.snapshot.Readiness = Unknown
-	i.snapshot.Failure = NoFailure
-	i.evidence = nil
-	return nil
-}
-
-// PlanRegistryPreparation 不证明 checkpoint 已落盘；应用层必须先保存意图再执行写入。
-func (i *Instance) PlanRegistryPreparation(o CapabilityObservation) (PreparationDecision, error) {
-	if err := i.acceptObservation(o, PhaseInitializingRegistry); err != nil {
-		return PreparationDenied, err
-	}
-	if failure := o.managementFailure(); failure != NoFailure {
-		i.fail(failure)
-		return PreparationDenied, nil
-	}
-	switch o.registry {
-	case RegistryUsable:
-		return AlreadyUsable, nil
-	case RegistryAbsent, RegistryNeedsMigration:
-		return PreparationAllowed, nil
-	default:
-		i.fail(o.registryFailure())
-		return PreparationDenied, nil
-	}
-}
-
-// RegistryPreparationResult 只能是安全失败或完整回读，不能表达裸操作成功。
-type RegistryPreparationResult struct {
-	observation CapabilityObservation
-	failure     Failure
-}
-
-func RegistryReadBack(o CapabilityObservation) RegistryPreparationResult {
-	return RegistryPreparationResult{observation: o}
-}
-
-func RegistryPreparationFailed(target ObservationTarget, failure Failure) (RegistryPreparationResult, error) {
-	if err := target.Validate(); err != nil {
-		return RegistryPreparationResult{}, err
-	}
-	if failure < ObservationIncomplete || failure > RegistryNotUsable {
-		return RegistryPreparationResult{}, errors.New("registry preparation requires a known failure category")
-	}
-	return RegistryPreparationResult{observation: CapabilityObservation{target: target}, failure: failure}, nil
-}
-
-func (i *Instance) AssessRegistryResult(result RegistryPreparationResult) error {
-	o := result.observation
-	if err := i.acceptObservation(o, PhaseInitializingRegistry); err != nil {
-		return err
-	}
-	if result.failure != NoFailure {
-		i.fail(result.failure)
-		return nil
-	}
-	i.assessComplete(o)
-	return nil
-}
-
-func (i *Instance) assessComplete(o CapabilityObservation) {
-	if failure := o.managementFailure(); failure != NoFailure {
-		i.fail(failure)
-		return
-	}
-	if failure := o.registryFailure(); failure != NoFailure {
-		i.fail(failure)
-		return
-	}
-	i.snapshot = Snapshot{Phase: PhaseReady, ObservedRevision: i.target.Revision().Value(),
-		Readiness: Ready, ReportedVersion: o.version}
-	i.evidence = &o
-}
-
-// AssessReadiness 每轮接收完整事实，失败立即撤销本轮供应能力。
-func (i *Instance) AssessReadiness(o CapabilityObservation) error {
-	if err := i.acceptObservation(o, PhaseReady); err != nil {
-		return err
-	}
-	if i.snapshot.ObservedRevision != i.target.Revision().Value() {
-		return i.BeginValidation()
-	}
-	if o.managementFailure() != NoFailure || o.registry == RegistryUnavailable {
-		i.snapshot.Phase = PhaseValidating
-	} else if o.registryFailure() != NoFailure {
-		i.snapshot.Phase = PhaseInitializingRegistry
-	}
-	i.assessComplete(o)
-	return nil
-}
-
-// RequireProvisioningReady 仅检查 Instance 前置条件，不授予 Tenant 所有权或外部写入许可。
-func (i *Instance) RequireProvisioningReady() error {
-	if i.deleting || i.evidence == nil || i.snapshot.Phase != PhaseReady || i.snapshot.Readiness != Ready ||
-		i.snapshot.ObservedRevision != i.target.Revision().Value() {
-		return errors.New("instance is not ready for provisioning")
-	}
-	return nil
-}

internal/database/domain/instance/readiness_test.go

@@ -1,352 +0,0 @@
-/*
-Copyright 2026.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package instance_test
-
-import (
-	"testing"
-
-	"git.ddupan.top/panxiao81/ayatori/internal/database/domain/instance"
-)
-
-const testServerVersion = "17.6"
-
-func completeChecks() instance.ManagementChecks {
-	return instance.ManagementChecks{
-		Connection: instance.CheckPassed, Metadata: instance.CheckPassed,
-		Roles: instance.CheckPassed, Databases: instance.CheckPassed,
-		Grants: instance.CheckPassed, Extensions: instance.CheckPassed,
-	}
-}
-
-func capability(t *testing.T, value *instance.Instance, checks instance.ManagementChecks,
-	registry instance.RegistryState,
-) instance.CapabilityObservation {
-	t.Helper()
-	o, err := instance.NewCapabilityObservation(value.Target(), testServerVersion, checks, registry)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return o
-}
-
-func readyInstance(t *testing.T) *instance.Instance {
-	t.Helper()
-	i := lifecycleInstance(t, instance.Snapshot{Phase: instance.PhaseInitializingRegistry}, false)
-	if err := i.AssessRegistryResult(instance.RegistryReadBack(capability(t, i, completeChecks(), instance.RegistryUsable))); err != nil {
-		t.Fatal(err)
-	}
-	if err := i.RequireProvisioningReady(); err != nil {
-		t.Fatal(err)
-	}
-	return i
-}
-
-func TestReadinessRequiresCompleteReadBack(t *testing.T) {
-	i := lifecycleInstance(t, instance.Snapshot{}, false)
-	if err := i.BeginValidation(); err != nil {
-		t.Fatal(err)
-	}
-	absent := capability(t, i, completeChecks(), instance.RegistryAbsent)
-	if err := i.AssessManagement(absent); err != nil {
-		t.Fatal(err)
-	}
-	if s := i.Snapshot(); s.Phase != instance.PhaseInitializingRegistry || s.ObservedRevision != 0 || s.Readiness != instance.Unknown {
-		t.Fatalf("management observation prematurely concluded readiness: %+v", s)
-	}
-	for range 2 {
-		decision, err := i.PlanRegistryPreparation(absent)
-		if err != nil || decision != instance.PreparationAllowed {
-			t.Fatalf("preparation: %v, %v", decision, err)
-		}
-		if i.RequireProvisioningReady() == nil {
-			t.Fatal("preparation authorized provisioning")
-		}
-	}
-	if err := i.AssessRegistryResult(instance.RegistryReadBack(absent)); err != nil {
-		t.Fatal(err)
-	}
-	if i.Snapshot().Failure != instance.RegistryNotUsable || i.RequireProvisioningReady() == nil {
-		t.Fatal("absent registry accepted as ready")
-	}
-	usable := capability(t, i, completeChecks(), instance.RegistryUsable)
-	decision, err := i.PlanRegistryPreparation(usable)
-	if err != nil || decision != instance.AlreadyUsable {
-		t.Fatalf("retry after external preparation: %v, %v", decision, err)
-	}
-	if err := i.AssessRegistryResult(instance.RegistryReadBack(usable)); err != nil {
-		t.Fatal(err)
-	}
-	if s := i.Snapshot(); s.Readiness != instance.Ready || s.ReportedVersion != testServerVersion || s.ObservedRevision != i.Target().Revision().Value() {
-		t.Fatalf("complete observation not accepted: %+v", s)
-	}
-	if err := i.RequireProvisioningReady(); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// 重启只恢复 checkpoint；依赖稍后恢复时必须重新取得完整事实。
-func TestReadinessRecoveryAndInvalidation(t *testing.T) {
-	i := readyInstance(t)
-	restored, err := instance.Reconstitute(i.Target(), i.Snapshot(), false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if restored.RequireProvisioningReady() == nil {
-		t.Fatal("persisted Ready fabricated fresh evidence")
-	}
-	for range 2 {
-		if err := restored.AssessReadiness(capability(t, restored, completeChecks(), instance.RegistryUsable)); err != nil {
-			t.Fatal(err)
-		}
-		if err := restored.RequireProvisioningReady(); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := restored.BeginValidation(); err != nil {
-		t.Fatal(err)
-	}
-	if restored.RequireProvisioningReady() == nil {
-		t.Fatal("validation retained evidence")
-	}
-	deleted, err := instance.Reconstitute(i.Target(), i.Snapshot(), true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if deleted.RequireProvisioningReady() == nil {
-		t.Fatal("deletion allowed provisioning")
-	}
-	if err := deleted.BeginDeletion(); err != nil {
-		t.Fatal(err)
-	}
-	if deleted.RequireProvisioningReady() == nil {
-		t.Fatal("deleting checkpoint allowed provisioning")
-	}
-}
-
-func TestEachManagementCheckIsRequired(t *testing.T) {
-	for field := range 6 {
-		for _, result := range []instance.CheckResult{instance.CheckUnobserved, instance.CheckUnavailable,
-			instance.CheckAuthenticationFailed, instance.CheckInsufficientPrivileges, 255} {
-			checks := completeChecks()
-			fields := []*instance.CheckResult{&checks.Connection, &checks.Metadata, &checks.Roles,
-				&checks.Databases, &checks.Grants, &checks.Extensions}
-			*fields[field] = result
-			i := readyInstance(t)
-			if err := i.AssessReadiness(capability(t, i, checks, instance.RegistryUsable)); err != nil {
-				t.Fatal(err)
-			}
-			if s := i.Snapshot(); s.Phase != instance.PhaseValidating || s.Readiness != instance.NotReady ||
-				s.Failure == instance.NoFailure || i.RequireProvisioningReady() == nil {
-				t.Fatalf("check %d result %d accepted: %+v", field, result, s)
-			}
-		}
-	}
-}
-
-func TestRegistryDecisionsAndReadinessLoss(t *testing.T) {
-	for _, tc := range []struct {
-		state    instance.RegistryState
-		decision instance.PreparationDecision
-		failure  instance.Failure
-	}{
-		{instance.RegistryUsable, instance.AlreadyUsable, instance.NoFailure},
-		{instance.RegistryAbsent, instance.PreparationAllowed, instance.RegistryNotUsable},
-		{instance.RegistryNeedsMigration, instance.PreparationAllowed, instance.RegistryNotUsable},
-		{instance.RegistryUnsupported, instance.PreparationDenied, instance.RegistryIncompatible},
-		{instance.RegistryUnavailable, instance.PreparationDenied, instance.DependencyUnavailable},
-		{instance.RegistryUnobserved, instance.PreparationDenied, instance.ObservationIncomplete},
-		{255, instance.PreparationDenied, instance.ObservationIncomplete},
-	} {
-		i := lifecycleInstance(t, instance.Snapshot{Phase: instance.PhaseInitializingRegistry}, false)
-		o := capability(t, i, completeChecks(), tc.state)
-		decision, err := i.PlanRegistryPreparation(o)
-		if err != nil || decision != tc.decision {
-			t.Fatalf("registry %d: %v, %v", tc.state, decision, err)
-		}
-		i = readyInstance(t)
-		if err := i.AssessReadiness(o); err != nil {
-			t.Fatal(err)
-		}
-		if i.Snapshot().Failure != tc.failure {
-			t.Fatalf("registry %d: %+v", tc.state, i.Snapshot())
-		}
-		if tc.state != instance.RegistryUsable {
-			wantPhase := instance.PhaseInitializingRegistry
-			if tc.state == instance.RegistryUnavailable {
-				wantPhase = instance.PhaseValidating
-			}
-			if i.Snapshot().Phase != wantPhase || i.RequireProvisioningReady() == nil {
-				t.Fatal("registry drift retained readiness")
-			}
-		}
-	}
-}
-
-func TestInitializationRejectsIncompleteOrFailedManagement(t *testing.T) {
-	for _, tc := range []struct {
-		checks   instance.ManagementChecks
-		registry instance.RegistryState
-		failure  instance.Failure
-	}{
-		{instance.ManagementChecks{}, instance.RegistryUsable, instance.ObservationIncomplete},
-		{completeChecks(), instance.RegistryUnsupported, instance.RegistryIncompatible},
-		{completeChecks(), instance.RegistryUnavailable, instance.DependencyUnavailable},
-	} {
-		i := lifecycleInstance(t, instance.Snapshot{Phase: instance.PhaseValidating}, false)
-		if err := i.AssessManagement(capability(t, i, tc.checks, tc.registry)); err != nil {
-			t.Fatal(err)
-		}
-		if s := i.Snapshot(); s.Phase != instance.PhaseValidating || s.Failure != tc.failure ||
-			s.ObservedRevision != i.Target().Revision().Value() || s.Readiness != instance.NotReady {
-			t.Fatalf("invalid management accepted: %+v", s)
-		}
-	}
-	i := lifecycleInstance(t, instance.Snapshot{Phase: instance.PhaseInitializingRegistry}, false)
-	decision, err := i.PlanRegistryPreparation(capability(t, i, instance.ManagementChecks{}, instance.RegistryAbsent))
-	if err != nil || decision != instance.PreparationDenied || i.Snapshot().Failure != instance.ObservationIncomplete {
-		t.Fatal("incomplete management allowed registry writes")
-	}
-	if err := i.AssessRegistryResult(instance.RegistryReadBack(capability(t, i, completeChecks(), instance.RegistryUsable))); err != nil {
-		t.Fatal(err)
-	}
-	if err := i.RequireProvisioningReady(); err != nil {
-		t.Fatal("dependency recovery did not restore readiness", err)
-	}
-}
-
-func TestReadinessMethodsRejectWrongPhaseAndDeletion(t *testing.T) {
-	for _, deleting := range []bool{false, true} {
-		for _, phase := range []instance.Phase{instance.PhasePending, instance.PhaseValidating,
-			instance.PhaseInitializingRegistry, instance.PhaseReady, instance.PhaseDeleting} {
-			for _, operation := range []struct {
-				phase instance.Phase
-				apply func(*instance.Instance, instance.CapabilityObservation) error
-			}{
-				{instance.PhaseValidating, (*instance.Instance).AssessManagement},
-				{instance.PhaseReady, (*instance.Instance).AssessReadiness},
-				{instance.PhaseInitializingRegistry, func(i *instance.Instance, o instance.CapabilityObservation) error {
-					_, err := i.PlanRegistryPreparation(o)
-					return err
-				}},
-				{instance.PhaseInitializingRegistry, func(i *instance.Instance, o instance.CapabilityObservation) error {
-					return i.AssessRegistryResult(instance.RegistryReadBack(o))
-				}},
-			} {
-				if !deleting && operation.phase == phase {
-					continue
-				}
-				i := lifecycleInstance(t, instance.Snapshot{Phase: phase}, deleting)
-				before := i.Snapshot()
-				if err := operation.apply(i, capability(t, i, completeChecks(), instance.RegistryUsable)); err == nil {
-					t.Fatalf("phase %s deleting=%t accepted operation for %s", phase, deleting, operation.phase)
-				}
-				if i.Snapshot() != before {
-					t.Fatal("rejected operation mutated snapshot")
-				}
-			}
-		}
-	}
-}
-
-func TestOldGenerationObservationDoesNotReplaceEvidence(t *testing.T) {
-	i := readyInstance(t)
-	target := i.Target()
-	revision, err := instance.NewRevision(target.Revision().Value() + 1)
-	if err != nil {
-		t.Fatal(err)
-	}
-	other, err := instance.NewObservationTarget(target.Identity(), revision, target.Definition())
-	if err != nil {
-		t.Fatal(err)
-	}
-	o, err := instance.NewCapabilityObservation(other, testServerVersion, completeChecks(), instance.RegistryUsable)
-	if err != nil {
-		t.Fatal(err)
-	}
-	before := i.Snapshot()
-	if err := i.AssessReadiness(o); err == nil || i.Snapshot() != before {
-		t.Fatal("mismatched generation observation was accepted")
-	}
-	if err := i.RequireProvisioningReady(); err != nil {
-		t.Fatal("rejected unrelated input changed previously accepted evidence", err)
-	}
-}
-
-func TestPreparationFailureCannotEstablishReadiness(t *testing.T) {
-	i := lifecycleInstance(t, instance.Snapshot{Phase: instance.PhaseInitializingRegistry}, false)
-	for _, failure := range []instance.Failure{instance.DependencyUnavailable, instance.AuthenticationFailed,
-		instance.InsufficientPrivileges, instance.RegistryIncompatible} {
-		result, err := instance.RegistryPreparationFailed(i.Target(), failure)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err := i.AssessRegistryResult(result); err != nil {
-			t.Fatal(err)
-		}
-		if s := i.Snapshot(); s.Failure != failure || s.Readiness != instance.NotReady ||
-			s.Phase != instance.PhaseInitializingRegistry || i.RequireProvisioningReady() == nil {
-			t.Fatalf("failed operation accepted: %+v", s)
-		}
-	}
-	for _, failure := range []instance.Failure{instance.NoFailure, 255} {
-		if _, err := instance.RegistryPreparationFailed(i.Target(), failure); err == nil {
-			t.Fatal("invalid failure accepted")
-		}
-	}
-}
-
-func TestCapabilityInputsAndLifecycleGuards(t *testing.T) {
-	i := readyInstance(t)
-	if _, err := instance.NewCapabilityObservation(instance.ObservationTarget{}, testServerVersion,
-		completeChecks(), instance.RegistryUsable); err == nil {
-		t.Fatal("invalid target accepted")
-	}
-	if _, err := instance.RegistryPreparationFailed(instance.ObservationTarget{}, instance.DependencyUnavailable); err == nil {
-		t.Fatal("invalid failure target accepted")
-	}
-	for _, method := range []func(instance.CapabilityObservation) error{
-		i.AssessManagement, i.AssessReadiness,
-		func(o instance.CapabilityObservation) error { _, err := i.PlanRegistryPreparation(o); return err },
-		func(o instance.CapabilityObservation) error {
-			return i.AssessRegistryResult(instance.RegistryReadBack(o))
-		},
-	} {
-		before := i.Snapshot()
-		if err := method(instance.CapabilityObservation{}); err == nil || i.Snapshot() != before {
-			t.Fatal("mismatched observation accepted or mutated state")
-		}
-	}
-	old := i.Snapshot()
-	old.ObservedRevision = 0
-	changed := lifecycleInstance(t, old, false)
-	if err := changed.AssessReadiness(capability(t, changed, completeChecks(), instance.RegistryUsable)); err != nil {
-		t.Fatal(err)
-	}
-	if s := changed.Snapshot(); s.Phase != instance.PhaseValidating || s.ObservedRevision != 0 || s.Readiness != instance.Unknown {
-		t.Fatalf("changed generation accepted old checkpoint: %+v", s)
-	}
-	o, err := instance.NewCapabilityObservation(i.Target(), "", completeChecks(), instance.RegistryUsable)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := i.AssessReadiness(o); err != nil {
-		t.Fatal(err)
-	}
-	if i.Snapshot().Failure != instance.ObservationIncomplete {
-		t.Fatal("missing version accepted")
-	}
-}