feat(httpapi): harden control plane and speed up prefix refresh

Очередь job получила lease и fencing, телеметрия и прогресс deploy сохраняются, ревизия пишет manifest входов. Обновление префиксов не переписывает неизменённый снимок, большие наборы идут через COPY, а устаревшая ревизия не попадает в deploy. Бандл ноды кэшируется, prune и постановка job больше не держат горячий путь.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/birddeploy/apply.go

@@ -1,152 +1,433 @@
-// Package birddeploy applies revision preview fragments to a shared BIRD volume with parse-check and LKG (plan §13).
 package birddeploy
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io/fs"
 	"os"
 	"path/filepath"
+	"regexp"
+	"sort"
 	"strings"
+	"time"
 
 	"evobgp/internal/birdfmt"
 	"evobgp/internal/store"
 )
 
-// Config drives two-phase deploy from a revision in the store.
+const recoveryTimeout = 30 * time.Second
+
+var includeLine = regexp.MustCompile(`(?m)^([ \t]*include[ \t]+")([^"]+)("[ \t]*;[ \t]*(?:#[^\n]*)?$)`)
+
+// Config identifies the BIRD instance. StagingDir remains for caller compatibility;
+// generations live inside ActiveDir so referenced files survive process restart.
 type Config struct {
-	ActiveDir  string // e.g. /etc/bird (live config tree)
-	StagingDir string // e.g. /tmp/evobgp-staging (same host/volume as ActiveDir)
+	ActiveDir  string
+	StagingDir string
 	BirdBin    string
 	BirdcBin   string
-	Socket     string // birdc -s
+	Socket     string
+	writeFile  func(string, []byte) error // test-only fault injection; nil uses synced writes
 }
 
-// ApplyRevision writes preview fragments to staging, runs bird -p, swaps into active, runs birdc configure; restores LKG on failure.
+// ApplyRevision installs a checked generation through one atomic bird.conf rename.
 func ApplyRevision(ctx context.Context, ctl *birdfmt.BirdCtl, rev *store.Revision, cfg Config) error {
 	if rev == nil || len(rev.PreviewFragments) == 0 {
 		return fmt.Errorf("birddeploy: no preview fragments")
 	}
-	active := strings.TrimSpace(cfg.ActiveDir)
-	staging := strings.TrimSpace(cfg.StagingDir)
-	if active == "" || staging == "" {
-		return fmt.Errorf("birddeploy: ActiveDir and StagingDir required")
+	if strings.TrimSpace(cfg.ActiveDir) == "" {
+		return fmt.Errorf("birddeploy: ActiveDir required")
 	}
-	if err := os.MkdirAll(staging, 0o755); err != nil {
-		return err
+	active, err := filepath.Abs(cfg.ActiveDir)
+	if err != nil {
+		return fmt.Errorf("birddeploy: resolve active directory: %w", err)
 	}
-	if err := os.MkdirAll(filepath.Join(active, "bird.d"), 0o755); err != nil {
-		return err
+	if err := os.MkdirAll(active, 0o755); err != nil {
+		return fmt.Errorf("birddeploy: create active directory: %w", err)
 	}
-	lkg := filepath.Join(active, ".evobgp_lkg")
-
-	// Phase 1: write staging tree
-	for rel, content := range rev.PreviewFragments {
-		rel = strings.TrimPrefix(rel, "/")
-		if !isDeployableBirdFragment(rel) {
-			continue
+	lock, err := lockTarget(ctx, filepath.Join(active, ".evobgp-apply.lock"))
+	if err != nil {
+		return fmt.Errorf("birddeploy: acquire apply lock: %w", err)
+	}
+	defer func() {
+		if err := lock.Close(); err != nil {
+			fmt.Fprintf(os.Stderr, "birddeploy: release apply lock: %v\n", err)
 		}
-		dst := filepath.Join(staging, rel)
-		if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
-			return err
-		}
-		if err := os.WriteFile(dst, []byte(content), 0o644); err != nil {
-			return err
-		}
-	}
-	mainConf := filepath.Join(staging, "bird.conf")
-	if _, err := os.Stat(mainConf); err != nil {
-		return fmt.Errorf("birddeploy: staging missing bird.conf: %w", err)
+	}()
+	if err := ctx.Err(); err != nil {
+		return fmt.Errorf("birddeploy: apply cancelled: %w", err)
 	}
 	bc := ctl
 	if bc == nil {
 		bc = &birdfmt.BirdCtl{Bird: cfg.BirdBin, Birdc: cfg.BirdcBin, Socket: cfg.Socket}
 	}
-	if err := bc.ParseCheck(ctx, mainConf); err != nil {
-		return fmt.Errorf("birddeploy: bird -p failed: %w", err)
+	writeFile := cfg.writeFile
+	if writeFile == nil {
+		writeFile = writeSynced
 	}
-
-	// Snapshot LKG (best-effort copy of current active bird.conf + bird.d)
-	_ = os.RemoveAll(lkg)
-	_ = snapshotBirdTree(active, lkg)
-
-	// Phase 2: atomic swap into active
-	for rel, content := range rev.PreviewFragments {
-		rel = strings.TrimPrefix(rel, "/")
-		if !isDeployableBirdFragment(rel) {
-			continue
+	mainPath := filepath.Join(active, "bird.conf")
+	mainInfo, err := os.Lstat(mainPath)
+	if err != nil {
+		return fmt.Errorf("birddeploy: inspect current bird.conf: %w", err)
+	}
+	if !mainInfo.Mode().IsRegular() {
+		return fmt.Errorf("birddeploy: current bird.conf must be a regular file; refusing to replace %s", mainInfo.Mode())
+	}
+	oldMain, err := os.ReadFile(mainPath)
+	if err != nil {
+		return fmt.Errorf("birddeploy: read current bird.conf: %w", err)
+	}
+	if err := bc.ParseCheck(ctx, mainPath); err != nil {
+		return fmt.Errorf("birddeploy: current configuration is not a usable LKG: %w", err)
+	}
+	gen, err := os.MkdirTemp(active, ".evobgp-generation-")
+	if err != nil {
+		return fmt.Errorf("birddeploy: create generation: %w", err)
+	}
+	activated := false
+	defer func() {
+		if !activated {
+			if err := os.RemoveAll(gen); err != nil {
+				fmt.Fprintf(os.Stderr, "birddeploy: remove unactivated generation %s: %v\n", gen, err)
+			}
 		}
-		dst := filepath.Join(active, rel)
-		if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
-			_ = restoreLKG(lkg, active)
-			return err
-		}
-		tmp := dst + ".tmp"
-		if err := os.WriteFile(tmp, []byte(content), 0o644); err != nil {
-			_ = restoreLKG(lkg, active)
-			return err
-		}
-		if err := os.Rename(tmp, dst); err != nil {
-			_ = restoreLKG(lkg, active)
-			return err
+	}()
+	if err := writeGenerationWith(active, gen, rev.PreviewFragments, writeFile); err != nil {
+		return err
+	}
+	newMain, err := os.ReadFile(filepath.Join(gen, "bird.conf"))
+	if err != nil {
+		return fmt.Errorf("birddeploy: read generated bird.conf: %w", err)
+	}
+	if err := bc.ParseCheck(ctx, filepath.Join(gen, "bird.conf")); err != nil {
+		return fmt.Errorf("birddeploy: staged bird -p failed: %w", err)
+	}
+	if err := writeFile(filepath.Join(gen, "previous-bird.conf"), oldMain); err != nil {
+		return fmt.Errorf("birddeploy: save LKG: %w", err)
+	}
+	if err := syncDir(gen); err != nil {
+		return fmt.Errorf("birddeploy: sync LKG generation: %w", err)
+	}
+	if err := ctx.Err(); err != nil {
+		return fmt.Errorf("birddeploy: apply cancelled: %w", err)
+	}
+	swapped, err := replaceMain(active, newMain)
+	activated = swapped
+	if err != nil {
+		if swapped {
+			return recoverPrevious(bc, active, gen, oldMain, fmt.Errorf("activate generation: %w", err))
 		}
+		return fmt.Errorf("birddeploy: activate generation: %w", err)
 	}
 	if err := bc.Configure(ctx); err != nil {
-		_ = restoreLKG(lkg, active)
-		_ = bc.Configure(ctx)
-		return fmt.Errorf("birddeploy: birdc configure failed, restored LKG: %w", err)
+		return recoverPrevious(bc, active, gen, oldMain, err)
+	}
+	if err := pruneGenerations(active, gen, oldMain); err != nil {
+		fmt.Fprintf(os.Stderr, "birddeploy: configuration applied; generation cleanup failed: %v\n", err)
 	}
 	return nil
 }
 
-// isDeployableBirdFragment skips UI-only preview keys (e.g. flattened full config) not referenced from bird.conf.
-func isDeployableBirdFragment(rel string) bool {
-	return rel != "" && !strings.HasPrefix(rel, "_")
+func recoverPrevious(bc *birdfmt.BirdCtl, active, gen string, oldMain []byte, cause error) error {
+	ctx, cancel := context.WithTimeout(context.Background(), recoveryTimeout)
+	defer cancel()
+	if _, err := replaceMain(active, oldMain); err != nil {
+		return fmt.Errorf("birddeploy: configure failed: %w; restore failed: %v", cause, err)
+	}
+	if err := bc.Configure(ctx); err != nil {
+		return fmt.Errorf("birddeploy: configure failed: %w; LKG restored on disk but recovery configure failed: %v", cause, err)
+	}
+	if err := os.RemoveAll(gen); err != nil {
+		fmt.Fprintf(os.Stderr, "birddeploy: LKG restored; remove failed generation %s: %v\n", gen, err)
+	}
+	return fmt.Errorf("birddeploy: configure failed: %w; LKG restored and recovery configure succeeded", cause)
 }
 
-func snapshotBirdTree(activeRoot, dstRoot string) error {
-	if err := os.MkdirAll(dstRoot, 0o755); err != nil {
-		return err
-	}
-	mc := filepath.Join(activeRoot, "bird.conf")
-	if b, err := os.ReadFile(mc); err == nil {
-		_ = os.WriteFile(filepath.Join(dstRoot, "bird.conf"), b, 0o644)
-	}
-	bd := filepath.Join(activeRoot, "bird.d")
-	if st, err := os.Stat(bd); err == nil && st.IsDir() {
-		_ = filepath.WalkDir(bd, func(path string, d fs.DirEntry, err error) error {
-			if err != nil || d.IsDir() {
-				return err
-			}
-			suffix, _ := filepath.Rel(activeRoot, path)
-			out := filepath.Join(dstRoot, suffix)
-			_ = os.MkdirAll(filepath.Dir(out), 0o755)
-			b, err := os.ReadFile(path)
-			if err != nil {
-				return nil
-			}
-			return os.WriteFile(out, b, 0o644)
-		})
-	}
-	return nil
+func writeGeneration(active, gen string, fragments map[string]string) error {
+	return writeGenerationWith(active, gen, fragments, writeSynced)
 }
 
-func restoreLKG(lkg, active string) error {
-	if _, err := os.Stat(filepath.Join(lkg, "bird.conf")); err != nil {
-		return err
+func writeGenerationWith(active, gen string, fragments map[string]string, writeFile func(string, []byte) error) error {
+	main, ok := fragments["bird.conf"]
+	if !ok {
+		return fmt.Errorf("birddeploy: preview missing bird.conf")
 	}
-	_ = filepath.WalkDir(lkg, func(path string, d fs.DirEntry, err error) error {
-		if err != nil || d.IsDir() {
-			return err
-		}
-		suffix, _ := filepath.Rel(lkg, path)
-		out := filepath.Join(active, suffix)
-		_ = os.MkdirAll(filepath.Dir(out), 0o755)
-		b, err := os.ReadFile(path)
-		if err != nil {
+	oldBirdD := filepath.Join(active, birdfmt.DirBirdD)
+	newBirdD := filepath.Join(gen, birdfmt.DirBirdD)
+	if err := os.MkdirAll(newBirdD, 0o755); err != nil {
+		return fmt.Errorf("birddeploy: create generation bird.d: %w", err)
+	}
+	if err := filepath.WalkDir(oldBirdD, func(path string, d fs.DirEntry, walkErr error) error {
+		if errors.Is(walkErr, fs.ErrNotExist) && path == oldBirdD {
 			return nil
 		}
-		return os.WriteFile(out, b, 0o644)
+		if walkErr != nil {
+			return walkErr
+		}
+		rel, err := filepath.Rel(oldBirdD, path)
+		if err != nil {
+			return err
+		}
+		if d.Type()&os.ModeSymlink != 0 {
+			return fmt.Errorf("operator snippet %q is a symlink", rel)
+		}
+		if rel == "." {
+			if !d.IsDir() {
+				return fmt.Errorf("birddeploy: bird.d is not a directory")
+			}
+			return nil
+		}
+		if d.IsDir() {
+			return os.MkdirAll(filepath.Join(newBirdD, rel), 0o755)
+		}
+		if !d.Type().IsRegular() {
+			return fmt.Errorf("operator snippet %q is not a regular file", rel)
+		}
+		_, replaced := fragments[filepath.ToSlash(filepath.Join(birdfmt.DirBirdD, rel))]
+		if strings.HasPrefix(filepath.Base(rel), "evobgp_") || replaced {
+			return nil
+		}
+		b, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		if countIncludeTokens(string(b)) > 0 {
+			return fmt.Errorf("operator snippet %q has a nested include; cannot pin the complete tree", rel)
+		}
+		return writeFile(filepath.Join(newBirdD, rel), b)
+	}); err != nil {
+		return fmt.Errorf("birddeploy: copy operator snippets: %w", err)
+	}
+	for rel, content := range fragments {
+		if rel == "bird.conf" || strings.HasPrefix(rel, "_") {
+			continue
+		}
+		if countIncludeTokens(content) > 0 {
+			return fmt.Errorf("birddeploy: nested include in preview fragment %q is unsupported", rel)
+		}
+		clean := filepath.Clean(filepath.FromSlash(rel))
+		if filepath.IsAbs(clean) || clean == "." || clean == ".." || strings.HasPrefix(clean, ".."+string(os.PathSeparator)) || !strings.HasPrefix(clean, birdfmt.DirBirdD+string(os.PathSeparator)) || filepath.Ext(clean) != ".conf" {
+			return fmt.Errorf("birddeploy: unsafe preview path %q", rel)
+		}
+		dst := filepath.Join(gen, clean)
+		if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
+			return fmt.Errorf("birddeploy: create fragment directory: %w", err)
+		}
+		if err := writeFile(dst, []byte(content)); err != nil {
+			return fmt.Errorf("birddeploy: write %s: %w", rel, err)
+		}
+	}
+	var rewriteErr error
+	if !standaloneIncludesOnly(main) {
+		return fmt.Errorf("birddeploy: unsupported include syntax in bird.conf")
+	}
+	rewritten := includeLine.ReplaceAllStringFunc(main, func(line string) string {
+		m := includeLine.FindStringSubmatch(line)
+		inc := m[2]
+		if filepath.IsAbs(inc) {
+			rel, err := filepath.Rel(active, inc)
+			if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
+				rewriteErr = fmt.Errorf("birddeploy: external absolute include %q is unsupported", inc)
+				return line
+			}
+			inc = rel
+		}
+		clean := filepath.Clean(filepath.FromSlash(inc))
+		if clean == ".." || strings.HasPrefix(clean, ".."+string(os.PathSeparator)) || !strings.HasPrefix(clean, birdfmt.DirBirdD+string(os.PathSeparator)) {
+			rewriteErr = fmt.Errorf("birddeploy: unsupported relative include %q", inc)
+			return line
+		}
+		return m[1] + filepath.ToSlash(filepath.Join(gen, clean)) + m[3]
 	})
+	if rewriteErr != nil {
+		return rewriteErr
+	}
+	if err := writeFile(filepath.Join(gen, ".evobgp-owned"), []byte("evobgp-generation-v1\n")); err != nil {
+		return fmt.Errorf("birddeploy: mark generation: %w", err)
+	}
+	if err := writeFile(filepath.Join(gen, "bird.conf"), []byte(rewritten)); err != nil {
+		return fmt.Errorf("birddeploy: write generated bird.conf: %w", err)
+	}
+	return syncTree(gen)
+}
+
+func standaloneIncludesOnly(config string) bool {
+	tokens := includeTokenOffsets(config)
+	matches := includeLine.FindAllStringIndex(config, -1)
+	if len(tokens) != len(matches) {
+		return false
+	}
+	for i, match := range matches {
+		word := strings.Index(config[match[0]:match[1]], "include")
+		if word < 0 || tokens[i] != match[0]+word {
+			return false
+		}
+	}
+	return true
+}
+
+func countIncludeTokens(config string) int { return len(includeTokenOffsets(config)) }
+
+// includeTokenOffsets skips BIRD comments and strings, retaining exact offsets
+// so a commented standalone include cannot mask a live inline include.
+func includeTokenOffsets(config string) []int {
+	var offsets []int
+	quote := byte(0)
+	lineComment, blockComment := false, false
+	for i := 0; i < len(config); {
+		c := config[i]
+		if lineComment {
+			if c == '\n' {
+				lineComment = false
+			}
+			i++
+			continue
+		}
+		if blockComment {
+			if c == '*' && i+1 < len(config) && config[i+1] == '/' {
+				blockComment = false
+				i += 2
+			} else {
+				i++
+			}
+			continue
+		}
+		if quote != 0 {
+			// BIRD quoted text does not use C-style backslash escapes.
+			// Skipping the following quote could hide a live include.
+			if c == quote {
+				quote = 0
+			}
+			i++
+			continue
+		}
+		if c == '#' {
+			lineComment = true
+			i++
+			continue
+		}
+		if c == '/' && i+1 < len(config) && config[i+1] == '*' {
+			blockComment = true
+			i += 2
+			continue
+		}
+		if c == '"' || c == '\'' {
+			quote = c
+			i++
+			continue
+		}
+		if (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c == '_' {
+			start := i
+			for i < len(config) && ((config[i] >= 'a' && config[i] <= 'z') || (config[i] >= 'A' && config[i] <= 'Z') || (config[i] >= '0' && config[i] <= '9') || config[i] == '_') {
+				i++
+			}
+			if config[start:i] == "include" {
+				offsets = append(offsets, start)
+			}
+			continue
+		}
+		i++
+	}
+	return offsets
+}
+
+func syncTree(root string) error {
+	var dirs []string
+	if err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			dirs = append(dirs, path)
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+	sort.Slice(dirs, func(i, j int) bool { return len(dirs[i]) > len(dirs[j]) })
+	for _, dir := range dirs {
+		if err := syncDir(dir); err != nil {
+			return fmt.Errorf("sync %s: %w", dir, err)
+		}
+	}
 	return nil
 }
+
+func pruneGenerations(active, current string, previous []byte) error {
+	entries, err := os.ReadDir(active)
+	if err != nil {
+		return err
+	}
+	var stale []string
+	for _, entry := range entries {
+		if !entry.IsDir() || !strings.HasPrefix(entry.Name(), ".evobgp-generation-") {
+			continue
+		}
+		path := filepath.Join(active, entry.Name())
+		if path == current || strings.Contains(string(previous), filepath.ToSlash(path)+"/") {
+			continue
+		}
+		marker, err := os.ReadFile(filepath.Join(path, ".evobgp-owned"))
+		if errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		if string(marker) != "evobgp-generation-v1\n" {
+			continue
+		}
+		stale = append(stale, path)
+	}
+	sort.Strings(stale)
+	for _, path := range stale {
+		if err := os.RemoveAll(path); err != nil {
+			return fmt.Errorf("remove %s: %w", path, err)
+		}
+	}
+	return nil
+}
+
+func replaceMain(active string, content []byte) (bool, error) {
+	tmp, err := os.CreateTemp(active, ".evobgp-bird-conf-")
+	if err != nil {
+		return false, err
+	}
+	defer func() { _ = os.Remove(tmp.Name()) }()
+	if err := tmp.Chmod(0o644); err != nil {
+		_ = tmp.Close()
+		return false, err
+	}
+	if _, err := tmp.Write(content); err != nil {
+		_ = tmp.Close()
+		return false, err
+	}
+	if err := tmp.Sync(); err != nil {
+		_ = tmp.Close()
+		return false, err
+	}
+	if err := tmp.Close(); err != nil {
+		return false, err
+	}
+	if err := os.Rename(tmp.Name(), filepath.Join(active, "bird.conf")); err != nil {
+		return false, err
+	}
+	return true, syncDir(active)
+}
+
+func writeSynced(path string, b []byte) error {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
+	if err != nil {
+		return err
+	}
+	if _, err := f.Write(b); err != nil {
+		_ = f.Close()
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		_ = f.Close()
+		return err
+	}
+	return f.Close()
+}

internal/birddeploy/apply_linux_test.go

@@ -0,0 +1,279 @@
+//go:build linux
+
+package birddeploy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+
+	"evobgp/internal/birdfmt"
+	"evobgp/internal/store"
+)
+
+func fakeCtl(t *testing.T, active string) *birdfmt.BirdCtl {
+	t.Helper()
+	bin := t.TempDir()
+	parse := filepath.Join(bin, "bird")
+	configure := filepath.Join(bin, "birdc")
+	parseScript := `#!/bin/sh
+if grep -q FAIL_PARSE "$2"; then exit 1; fi
+exit 0
+`
+	configureScript := fmt.Sprintf(`#!/bin/sh
+root=%q
+if [ -e "$root/.configure-wait" ]; then
+  rm "$root/.configure-wait"
+  touch "$root/.configure-started"
+  exec sleep 5
+fi
+if [ -e "$root/.configure-fail-once" ]; then
+  rm "$root/.configure-fail-once"
+  exit 1
+fi
+mkdir "$root/.configuring" || exit 1
+sleep 0.05
+rmdir "$root/.configuring"
+`, active)
+	for path, script := range map[string]string{parse: parseScript, configure: configureScript} {
+		if err := os.WriteFile(path, []byte(script), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return &birdfmt.BirdCtl{Bird: parse, Birdc: configure}
+}
+
+func revision(label string) *store.Revision {
+	return &store.Revision{PreviewFragments: map[string]string{
+		"bird.conf":              "router id 192.0.2.1;\ninclude \"bird.d/*.conf\";\n# " + label + "\n",
+		"bird.d/evobgp_new.conf": "# " + label + "\n",
+	}}
+}
+
+func setupActive(t *testing.T) (string, *birdfmt.BirdCtl, []byte) {
+	t.Helper()
+	active := t.TempDir()
+	if err := os.Mkdir(filepath.Join(active, "bird.d"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	old := []byte("router id 192.0.2.2;\ninclude \"bird.d/*.conf\";\n# old\n")
+	if err := os.WriteFile(filepath.Join(active, "bird.conf"), old, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	for name, content := range map[string]string{"evobgp_removed.conf": "# removed\n", "operator.conf": "# operator\n"} {
+		if err := os.WriteFile(filepath.Join(active, "bird.d", name), []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return active, fakeCtl(t, active), old
+}
+
+func TestApplyRevisionGenerationAndPrune(t *testing.T) {
+	active, ctl, _ := setupActive(t)
+	for _, label := range []string{"one", "two", "three"} {
+		if err := ApplyRevision(context.Background(), ctl, revision(label), Config{ActiveDir: active}); err != nil {
+			t.Fatal(err)
+		}
+		main, err := os.ReadFile(filepath.Join(active, "bird.conf"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !strings.Contains(string(main), "# "+label) {
+			t.Fatalf("wrong active generation: %s", main)
+		}
+		if strings.Contains(string(main), `include "bird.d/`) {
+			t.Fatalf("include not pinned: %s", main)
+		}
+	}
+	gens, err := filepath.Glob(filepath.Join(active, ".evobgp-generation-*"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(gens) != 2 {
+		t.Fatalf("want active and previous generations, got %d", len(gens))
+	}
+	for _, gen := range gens {
+		if _, err := os.Stat(filepath.Join(gen, "bird.d", "evobgp_removed.conf")); !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("removed fragment retained in %s: %v", gen, err)
+		}
+		if _, err := os.Stat(filepath.Join(gen, "bird.d", "operator.conf")); err != nil {
+			t.Fatalf("operator fragment missing: %v", err)
+		}
+	}
+}
+
+func TestApplyRevisionFaults(t *testing.T) {
+	for _, mode := range []string{"parse", "write", "disk-full", "configure", "cancel"} {
+		t.Run(mode, func(t *testing.T) {
+			active, ctl, old := setupActive(t)
+			rev := revision(mode)
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			cfg := Config{ActiveDir: active}
+			switch mode {
+			case "parse":
+				rev.PreviewFragments["bird.conf"] += "FAIL_PARSE\n"
+			case "write":
+				rev.PreviewFragments["../escape.conf"] = "bad"
+			case "disk-full":
+				cfg.writeFile = func(path string, b []byte) error {
+					if filepath.Base(path) == "previous-bird.conf" {
+						return syscall.ENOSPC
+					}
+					return writeSynced(path, b)
+				}
+			case "configure":
+				if err := os.WriteFile(filepath.Join(active, ".configure-fail-once"), nil, 0o644); err != nil {
+					t.Fatal(err)
+				}
+			case "cancel":
+				if err := os.WriteFile(filepath.Join(active, ".configure-wait"), nil, 0o644); err != nil {
+					t.Fatal(err)
+				}
+			}
+			result := make(chan error, 1)
+			go func() { result <- ApplyRevision(ctx, ctl, rev, cfg) }()
+			if mode == "cancel" {
+				deadline := time.After(3 * time.Second)
+				for {
+					if _, err := os.Stat(filepath.Join(active, ".configure-started")); err == nil {
+						break
+					}
+					select {
+					case <-deadline:
+						t.Fatal("configure did not start")
+					case <-time.After(10 * time.Millisecond):
+					}
+				}
+				cancel()
+			}
+			err := <-result
+			if err == nil {
+				t.Fatal("expected apply failure")
+			}
+			main, readErr := os.ReadFile(filepath.Join(active, "bird.conf"))
+			if readErr != nil {
+				t.Fatal(readErr)
+			}
+			if string(main) != string(old) {
+				t.Fatalf("old config not restored: %s; error: %v", main, err)
+			}
+			if mode == "configure" || mode == "cancel" {
+				if !strings.Contains(err.Error(), "recovery configure succeeded") {
+					t.Fatalf("unconfirmed recovery: %v", err)
+				}
+			}
+		})
+	}
+}
+
+func TestApplyRevisionSerializes(t *testing.T) {
+	active, ctl, _ := setupActive(t)
+	var wg sync.WaitGroup
+	errs := make(chan error, 2)
+	for _, label := range []string{"first", "second"} {
+		wg.Add(1)
+		go func(label string) {
+			defer wg.Done()
+			errs <- ApplyRevision(context.Background(), ctl, revision(label), Config{ActiveDir: active})
+		}(label)
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestLockHelperProcess(t *testing.T) {
+	active := os.Getenv("EVOBGP_LOCK_HELPER_ACTIVE")
+	if active == "" {
+		return
+	}
+	lock, err := lockTarget(context.Background(), filepath.Join(active, ".evobgp-apply.lock"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = lock.Close() }()
+	if err := os.WriteFile(filepath.Join(active, ".helper-ready"), nil, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	for {
+		if _, err := os.Stat(filepath.Join(active, ".helper-done")); err == nil {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+func TestApplyRevisionCrossProcessLock(t *testing.T) {
+	active, ctl, old := setupActive(t)
+	cmd := exec.Command(os.Args[0], "-test.run=^TestLockHelperProcess$")
+	cmd.Env = append(os.Environ(), "EVOBGP_LOCK_HELPER_ACTIVE="+active)
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_ = os.WriteFile(filepath.Join(active, ".helper-done"), nil, 0o644)
+		if err := cmd.Wait(); err != nil {
+			t.Errorf("lock helper: %v", err)
+		}
+	}()
+	deadline := time.After(3 * time.Second)
+	for {
+		if _, err := os.Stat(filepath.Join(active, ".helper-ready")); err == nil {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatal("lock helper did not become ready")
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+	if err := ApplyRevision(ctx, ctl, revision("blocked"), Config{ActiveDir: active}); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("want lock timeout, got %v", err)
+	}
+	main, err := os.ReadFile(filepath.Join(active, "bird.conf"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(main) != string(old) {
+		t.Fatalf("apply bypassed cross-process lock: %s", main)
+	}
+}
+
+func TestRealBirdParseGeneration(t *testing.T) {
+	bin := strings.TrimSpace(os.Getenv("EVOBGP_TEST_BIRD_BIN"))
+	if bin == "" {
+		t.Skip("EVOBGP_TEST_BIRD_BIN is not set")
+	}
+	active := t.TempDir()
+	old := []byte("router id 192.0.2.2;\nprotocol device {}\n")
+	if err := os.WriteFile(filepath.Join(active, "bird.conf"), old, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	ctl := fakeCtl(t, active)
+	ctl.Bird = bin
+	rev := &store.Revision{PreviewFragments: map[string]string{
+		"bird.conf":              "router id 192.0.2.1;\ninclude \"bird.d/evobgp_new.conf\";\nprotocol device {}\n",
+		"bird.d/evobgp_new.conf": "# complete generated fragment\n",
+	}}
+	if err := ApplyRevision(context.Background(), ctl, rev, Config{ActiveDir: active}); err != nil {
+		t.Fatal(err)
+	}
+	if err := ctl.ParseCheck(context.Background(), filepath.Join(active, "bird.conf")); err != nil {
+		t.Fatalf("activated config fails real bird -p: %v", err)
+	}
+}

internal/birddeploy/apply_test.go

@@ -0,0 +1,204 @@
+package birddeploy
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"evobgp/internal/store"
+)
+
+func TestWriteGenerationPinsCompleteIncludeTree(t *testing.T) {
+	active := t.TempDir()
+	if err := os.Mkdir(filepath.Join(active, "bird.d"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(active, "bird.d", "operator.conf"), []byte("# operator"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(active, "bird.d", "evobgp_removed.conf"), []byte("# removed"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gen := filepath.Join(active, ".evobgp-generation-test")
+	if err := os.Mkdir(gen, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	fragments := map[string]string{"bird.conf": "include \"bird.d/*.conf\";\n", "bird.d/evobgp_new.conf": "# new"}
+	if err := writeGeneration(active, gen, fragments); err != nil {
+		t.Fatal(err)
+	}
+	main, err := os.ReadFile(filepath.Join(gen, "bird.conf"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(main), filepath.ToSlash(filepath.Join(gen, "bird.d", "*.conf"))) {
+		t.Fatalf("include is not pinned to generation: %s", main)
+	}
+	for _, name := range []string{"operator.conf", "evobgp_new.conf"} {
+		if _, err := os.Stat(filepath.Join(gen, "bird.d", name)); err != nil {
+			t.Fatalf("%s missing: %v", name, err)
+		}
+	}
+	if _, err := os.Stat(filepath.Join(gen, "bird.d", "evobgp_removed.conf")); !os.IsNotExist(err) {
+		t.Fatalf("removed fragment retained: %v", err)
+	}
+}
+
+func TestWriteGenerationRejectsUnsafePaths(t *testing.T) {
+	for _, bad := range []string{"../escape.conf", "bird.d/../../escape.conf", "other.conf"} {
+		t.Run(bad, func(t *testing.T) {
+			active := t.TempDir()
+			gen := filepath.Join(active, ".evobgp-generation-test")
+			if err := os.Mkdir(gen, 0o755); err != nil {
+				t.Fatal(err)
+			}
+			fragments := map[string]string{"bird.conf": "router id 192.0.2.1;\n", bad: "bad"}
+			if err := writeGeneration(active, gen, fragments); err == nil {
+				t.Fatal("unsafe path accepted")
+			}
+		})
+	}
+}
+
+func TestWriteGenerationRejectsExternalAndNestedIncludes(t *testing.T) {
+	for _, main := range []string{
+		`include "/outside/bird.d/peer.conf";` + "\n",
+		`include "other/peer.conf";` + "\n",
+		`include "bird.d/peer.conf"; include "other.conf";` + "\n",
+		`router id 192.0.2.1; include "/outside/peer.conf";` + "\n",
+		"/*\ninclude \"bird.d/decoy.conf\";\n*/\nrouter id 192.0.2.1; include \"/outside/live.conf\";\n",
+	} {
+		active := t.TempDir()
+		gen := filepath.Join(active, ".evobgp-generation-test")
+		if err := os.Mkdir(gen, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := writeGeneration(active, gen, map[string]string{"bird.conf": main}); err == nil {
+			t.Fatalf("include accepted: %s", main)
+		}
+	}
+	active := t.TempDir()
+	if err := os.Mkdir(filepath.Join(active, "bird.d"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(active, "bird.d", "operator.conf"), []byte(`define X=1; include "/outside/foo.conf";`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gen := filepath.Join(active, ".evobgp-generation-test")
+	if err := os.Mkdir(gen, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := writeGeneration(active, gen, map[string]string{"bird.conf": "router id 192.0.2.1;\n"}); err == nil {
+		t.Fatal("nested operator include accepted")
+	}
+}
+
+func TestCountIncludeTokensIgnoresCommentsAndStrings(t *testing.T) {
+	content := "# include \"ignored.conf\";\n" +
+		"/* include \"ignored.conf\"; */\n" +
+		"define note = \"include in string\";\n" +
+		"include \"bird.d/real.conf\";\n"
+	if got := countIncludeTokens(content); got != 1 {
+		t.Fatalf("want one include, got %d", got)
+	}
+}
+
+func TestIncludeAfterBackslashStringCannotHideNestedInclude(t *testing.T) {
+	content := `define note = "\";` + "\n" + `include "/outside/hidden.conf";` + "\n"
+	if got := countIncludeTokens(content); got != 1 {
+		t.Fatalf("live include hidden after quoted backslash: %d", got)
+	}
+	active := t.TempDir()
+	gen := filepath.Join(active, ".evobgp-generation-test")
+	if err := os.Mkdir(gen, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	fragments := map[string]string{"bird.conf": "router id 192.0.2.1;\n", "bird.d/evobgp_test.conf": content}
+	if err := writeGeneration(active, gen, fragments); err == nil {
+		t.Fatal("nested external include accepted after quoted backslash")
+	}
+}
+
+func TestWriteGenerationRewritesAbsoluteActiveInclude(t *testing.T) {
+	active := t.TempDir()
+	gen := filepath.Join(active, ".evobgp-generation-test")
+	if err := os.Mkdir(gen, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	inc := filepath.ToSlash(filepath.Join(active, "bird.d", "peer.conf"))
+	main := "include \"" + inc + "\";\n"
+	if err := writeGeneration(active, gen, map[string]string{"bird.conf": main, "bird.d/peer.conf": "# peer"}); err != nil {
+		t.Fatal(err)
+	}
+	b, err := os.ReadFile(filepath.Join(gen, "bird.conf"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(b), filepath.ToSlash(filepath.Join(gen, "bird.d", "peer.conf"))) {
+		t.Fatalf("absolute include not rewritten: %s", b)
+	}
+}
+
+func TestWriteGenerationRejectsSymlinkBirdDRoot(t *testing.T) {
+	active := t.TempDir()
+	outside := t.TempDir()
+	if err := os.WriteFile(filepath.Join(outside, "operator.conf"), []byte("# operator"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(active, "bird.d")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	old := []byte("router id 192.0.2.2;\n")
+	if err := os.WriteFile(filepath.Join(active, "bird.conf"), old, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gen := filepath.Join(active, ".evobgp-generation-test")
+	if err := os.Mkdir(gen, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := writeGeneration(active, gen, map[string]string{"bird.conf": "router id 192.0.2.1;\n"}); err == nil {
+		t.Fatal("bird.d symlink accepted")
+	}
+	current, err := os.ReadFile(filepath.Join(active, "bird.conf"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(current) != string(old) {
+		t.Fatalf("active config changed: %s", current)
+	}
+	if _, err := os.ReadFile(filepath.Join(outside, "operator.conf")); err != nil {
+		t.Fatalf("operator snippet changed: %v", err)
+	}
+}
+
+func TestApplyRevisionRejectsSymlinkMain(t *testing.T) {
+	active := t.TempDir()
+	target := filepath.Join(t.TempDir(), "operator-bird.conf")
+	old := []byte("router id 192.0.2.2;\n")
+	if err := os.WriteFile(target, old, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, filepath.Join(active, "bird.conf")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	err := ApplyRevision(context.Background(), nil, &store.Revision{PreviewFragments: map[string]string{"bird.conf": "router id 192.0.2.1;\n"}}, Config{ActiveDir: active})
+	if err == nil || !strings.Contains(err.Error(), "regular file") {
+		t.Fatalf("want explicit symlink rejection, got %v", err)
+	}
+	info, err := os.Lstat(filepath.Join(active, "bird.conf"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode()&os.ModeSymlink == 0 {
+		t.Fatal("active symlink replaced")
+	}
+	current, err := os.ReadFile(target)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(current) != string(old) {
+		t.Fatalf("operator target changed: %s", current)
+	}
+}

internal/birddeploy/lock_linux.go

@@ -0,0 +1,35 @@
+//go:build linux
+
+package birddeploy
+
+import (
+	"context"
+	"errors"
+	"os"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+func lockTarget(ctx context.Context, path string) (*os.File, error) {
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	for {
+		err = unix.Flock(int(f.Fd()), unix.LOCK_EX|unix.LOCK_NB)
+		if err == nil {
+			return f, nil
+		}
+		if !errors.Is(err, unix.EWOULDBLOCK) && !errors.Is(err, unix.EAGAIN) {
+			_ = f.Close()
+			return nil, err
+		}
+		select {
+		case <-ctx.Done():
+			_ = f.Close()
+			return nil, ctx.Err()
+		case <-time.After(25 * time.Millisecond):
+		}
+	}
+}

internal/birddeploy/lock_other.go

@@ -0,0 +1,13 @@
+//go:build !linux && !windows
+
+package birddeploy
+
+import (
+	"context"
+	"errors"
+	"os"
+)
+
+func lockTarget(context.Context, string) (*os.File, error) {
+	return nil, errors.New("birddeploy: cross-process apply lock is unsupported on this platform")
+}

internal/birddeploy/lock_windows.go

@@ -0,0 +1,36 @@
+//go:build windows
+
+package birddeploy
+
+import (
+	"context"
+	"errors"
+	"os"
+	"time"
+
+	"golang.org/x/sys/windows"
+)
+
+func lockTarget(ctx context.Context, path string) (*os.File, error) {
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	var overlapped windows.Overlapped
+	for {
+		err = windows.LockFileEx(windows.Handle(f.Fd()), windows.LOCKFILE_EXCLUSIVE_LOCK|windows.LOCKFILE_FAIL_IMMEDIATELY, 0, 1, 0, &overlapped)
+		if err == nil {
+			return f, nil
+		}
+		if !errors.Is(err, windows.ERROR_LOCK_VIOLATION) {
+			_ = f.Close()
+			return nil, err
+		}
+		select {
+		case <-ctx.Done():
+			_ = f.Close()
+			return nil, ctx.Err()
+		case <-time.After(25 * time.Millisecond):
+		}
+	}
+}

internal/birddeploy/sync_unix.go

@@ -0,0 +1,14 @@
+//go:build !windows
+
+package birddeploy
+
+import "os"
+
+func syncDir(path string) error {
+	f, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	return f.Sync()
+}

internal/birddeploy/sync_windows.go

@@ -0,0 +1,6 @@
+//go:build windows
+
+package birddeploy
+
+// Windows does not support syncing a directory handle through os.File.Sync.
+func syncDir(string) error { return nil }