fix(reboot): surface vmx relink dry-run evidence gate

apps/api/tests/test_awoooi_priority_work_order_readback_api.py

@@ -738,7 +738,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         "windows99_vmx_source_repair_playbook_trust_writeback_ref"
     ].startswith("playbook://awoooi/windows99-vmx-source-repair/")
     assert state["windows99_vmx_source_locator_status"] == (
-        "collector_readback_single_identity_candidate_confirmation_required"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert state["windows99_vmx_source_locator_required"] is True
     assert state["windows99_vmx_source_locator_check_mode_ready"] is True
@@ -752,7 +752,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
     )
     assert state["windows99_vmx_source_locator_target_aliases"] == ["111"]
     assert state["windows99_vmx_source_locator_next_executable_step"] == (
-        "confirm_single_unassigned_ubuntu_candidate_before_scoped_relink_dry_run"
+        "provide_verified_vmx_source_or_identity_evidence_then_scoped_relink_dry_run"
     )
     assert state["windows99_vmx_source_locator_expected_vmx_path_count"] == 1
     assert state["windows99_vmx_source_locator_candidate_source_count"] == 6
@@ -765,6 +765,28 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         == 1
     )
     assert state["windows99_vmx_source_locator_candidate_confirmation_required"] is True
+    assert (
+        state[
+            "windows99_vmx_source_locator_human_confirmation_required_for_dry_run"
+        ]
+        is False
+    )
+    assert (
+        state[
+            "windows99_vmx_source_locator_verified_source_or_identity_evidence_required"
+        ]
+        is True
+    )
+    assert (
+        state["windows99_vmx_source_locator_controlled_relink_dry_run_ready"]
+        is False
+    )
+    assert state[
+        "windows99_vmx_source_locator_controlled_relink_dry_run_blocker"
+    ] == "verified_vmx_source_or_identity_evidence_missing"
+    assert state["windows99_vmx_source_locator_relink_dry_run_plan_id"] == (
+        "windows99-vmx-source-relink-dry-run-111"
+    )
     assert state["windows99_vmx_source_locator_candidate_source_count_known"] is True
     assert state["windows99_vmx_source_locator_collector_readback_present"] is True
     assert state["windows99_vmx_source_locator_file_content_read"] is True
@@ -848,7 +870,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         "111"
     ]
     assert payload["summary"]["windows99_vmx_source_locator_status"] == (
-        "collector_readback_single_identity_candidate_confirmation_required"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert payload["summary"]["windows99_vmx_source_locator_check_mode_ready"] is True
     assert payload["summary"]["windows99_vmx_source_locator_target_aliases"] == [
@@ -867,6 +889,27 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         ]
         is True
     )
+    assert (
+        payload["summary"][
+            "windows99_vmx_source_locator_human_confirmation_required_for_dry_run"
+        ]
+        is False
+    )
+    assert (
+        payload["summary"][
+            "windows99_vmx_source_locator_verified_source_or_identity_evidence_required"
+        ]
+        is True
+    )
+    assert (
+        payload["rollups"][
+            "windows99_vmx_source_locator_controlled_relink_dry_run_ready"
+        ]
+        is False
+    )
+    assert payload["rollups"][
+        "windows99_vmx_source_locator_controlled_relink_dry_run_blocker"
+    ] == "verified_vmx_source_or_identity_evidence_missing"
     assert (
         payload["rollups"]["windows99_vmx_source_locator_remote_write_performed"]
         is False
@@ -925,7 +968,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         "windows99_vmx_source_repair_playbook_trust_writeback_ref"
     ].startswith("playbook://awoooi/windows99-vmx-source-repair/")
     assert in_progress["evidence"]["windows99_vmx_source_locator_status"] == (
-        "collector_readback_single_identity_candidate_confirmation_required"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert (
         in_progress["evidence"]["windows99_vmx_source_locator_check_mode_ready"]
@@ -945,6 +988,24 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         ]
         is True
     )
+    assert (
+        in_progress["evidence"][
+            "windows99_vmx_source_locator_human_confirmation_required_for_dry_run"
+        ]
+        is False
+    )
+    assert (
+        in_progress["evidence"][
+            "windows99_vmx_source_locator_verified_source_or_identity_evidence_required"
+        ]
+        is True
+    )
+    assert (
+        in_progress["evidence"][
+            "windows99_vmx_source_locator_controlled_relink_dry_run_ready"
+        ]
+        is False
+    )
     assert (
         in_progress["evidence"]["windows99_vmx_source_locator_remote_write_performed"]
         is False

apps/api/tests/test_windows99_vmx_source_locator_readback_api.py

@@ -146,7 +146,7 @@ def test_windows99_vmx_source_locator_builder_projects_redacted_receipt() -> Non
     )
 
     assert payload["status"] == (
-        "collector_readback_single_identity_candidate_confirmation_required"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert payload["collector_readback_present"] is True
     assert payload["collector_collection_status"] == (
@@ -161,8 +161,19 @@ def test_windows99_vmx_source_locator_builder_projects_redacted_receipt() -> Non
     assert payload["identity_target_hint_count"] == 0
     assert payload["identity_unassigned_ubuntu_candidate_count"] == 1
     assert payload["candidate_confirmation_required"] is True
+    assert payload["human_confirmation_required_for_dry_run"] is False
+    assert payload["verified_source_or_identity_evidence_required"] is True
+    assert payload["controlled_relink_dry_run_ready"] is False
+    assert payload["controlled_relink_dry_run_blocker"] == (
+        "verified_vmx_source_or_identity_evidence_missing"
+    )
+    assert payload["controlled_relink_dry_run_plan"]["ready"] is False
+    assert payload["controlled_relink_dry_run_plan"]["apply_allowed_by_this_plan"] is False
+    assert payload["controlled_relink_dry_run_plan"]["source_diff"][
+        "raw_path_output"
+    ] is False
     assert payload["next_executable_step"] == (
-        "confirm_single_unassigned_ubuntu_candidate_before_scoped_relink_dry_run"
+        "provide_verified_vmx_source_or_identity_evidence_then_scoped_relink_dry_run"
     )
     assert payload["raw_path_output"] is False
     assert payload["secret_value_read"] is False
@@ -191,7 +202,7 @@ def test_windows99_vmx_source_locator_endpoint_returns_public_safe_readback(
     payload = response.json()
     assert payload["schema_version"] == "windows99_vmx_source_locator_readback_v1"
     assert payload["status"] == (
-        "collector_readback_single_identity_candidate_confirmation_required"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert payload["target_vm_aliases"] == ["111"]
     assert payload["locator_check_mode_ready"] is True
@@ -200,6 +211,16 @@ def test_windows99_vmx_source_locator_endpoint_returns_public_safe_readback(
     assert payload["collector_readback_present"] is True
     assert payload["candidate_source_count"] == 6
     assert payload["candidate_confirmation_required"] is True
+    assert payload["human_confirmation_required_for_dry_run"] is False
+    assert payload["verified_source_or_identity_evidence_required"] is True
+    assert payload["controlled_relink_dry_run_ready"] is False
+    assert payload["controlled_relink_dry_run_blocker"] == (
+        "verified_vmx_source_or_identity_evidence_missing"
+    )
+    assert payload["controlled_relink_dry_run_plan"]["plan_id"] == (
+        "windows99-vmx-source-relink-dry-run-111"
+    )
+    assert payload["controlled_relink_dry_run_plan"]["remote_write_performed"] is False
     assert payload["public_lan_topology_redacted"] is True
     assert payload["raw_path_output"] is False
     assert payload["file_content_read"] is True