Drain deferred FX parks before the view model is serialized; re-validate track handles per intent; pin the restore-plan round trip

tests/test_view_fx_park.cpp

@@ -8,6 +8,8 @@
 
 #include "../src/shell/view/view_fx_park.h"
 
+#include "core/view/view_mode_model.h"  // makeRestorePlan — the ops' only producer
+
 #include <cstdio>
 #include <string>
 #include <vector>
@@ -189,6 +191,48 @@ static void testSlotKeyedRestoreDoesNotBecomeIdentityKeyedWithNoIdentities() {
     CHECK(fx.states.size() == 2 && fx.states[0].offline == 1 && fx.states[1].offline == 0);
 }
 
+// -- the makeRestorePlan <-> preParkFxFromCancelledRestore round trip ---------
+//
+// The cancel path's whole premise is that a planned restore's ops are a LOSSLESS
+// carrier of the snapshot's FX half. makeRestorePlan is their only producer, so
+// the real claim is that the pair composes to the identity on (fxOffline,
+// fxKeying). Asserting it against hand-built ops would let a change to
+// makeRestorePlan's field mapping or op ordering pass with every test green.
+
+static void testRestorePlanOpsRebuildTheIdentityKeyedSnapshotVerbatim() {
+    TrackSnapshot snap;
+    snap.fxKeying  = FxKeying::Identity;
+    snap.fxOffline = {FxOfflineState{"{ONE}", 1}, FxOfflineState{"{TWO}", 0},
+                      FxOfflineState{"{THREE}", 1}};
+
+    const TrackPlan plan = makeRestorePlan("{TRACK}", snap);
+    const PreParkFx rebuilt = preParkFxFromCancelledRestore(plan.fxOffline);
+
+    CHECK(rebuilt.keying == FxKeying::Identity);
+    // Three DISTINCT entries, compared as a sequence: a dropped fxGuid, a flipped
+    // offline, or a reordering each fail here.
+    CHECK(rebuilt.states == snap.fxOffline);
+}
+
+static void testRestorePlanOpsRebuildTheSlotKeyedSnapshotVerbatim() {
+    TrackSnapshot snap;
+    snap.fxKeying  = FxKeying::Slot;
+    snap.fxOffline = {FxOfflineState{"", 0}, FxOfflineState{"", 1}, FxOfflineState{"", 1}};
+
+    const TrackPlan plan = makeRestorePlan("{TRACK}", snap);
+
+    // Slot keying addresses by POSITION, so the identity holds only while the op
+    // at index i carries slot i.
+    CHECK(plan.fxOffline.size() == 3);
+    CHECK(plan.fxOffline.size() == 3 && plan.fxOffline[0].slot == 0 &&
+          plan.fxOffline[1].slot == 1 && plan.fxOffline[2].slot == 2);
+
+    const PreParkFx rebuilt = preParkFxFromCancelledRestore(plan.fxOffline);
+
+    CHECK(rebuilt.keying == FxKeying::Slot);
+    CHECK(rebuilt.states == snap.fxOffline);
+}
+
 // -- re-entrancy -------------------------------------------------------------
 
 static void testTakeDetachesEverythingAndLeavesTheQueueEmpty() {
@@ -205,9 +249,10 @@ static void testTakeDetachesEverythingAndLeavesTheQueueEmpty() {
 }
 
 static void testIntentsArrivingDuringADrainSurviveIt() {
-    // Applying an intent loads/unloads plugins, which pumps the message loop, so
-    // a switch can re-enter and enqueue mid-drain. Those intents belong to the
-    // NEXT drain — the one in progress must neither see them nor discard them.
+    // [verify — DAW] applying an intent loads/unloads plugins, which is ASSUMED to
+    // pump the message loop, so a switch can re-enter and enqueue mid-drain. Those
+    // intents belong to the NEXT drain — the one in progress must neither see them
+    // nor discard them.
     FxParkQueue q;
     q.park("{A}");
 
@@ -250,6 +295,8 @@ int main() {
     testCancelledRestoreOpsBecomeTheFreshSnapshotsFxHalf();
     testNothingCancelledLeavesTheFxHalfToTheCaller();
     testSlotKeyedRestoreDoesNotBecomeIdentityKeyedWithNoIdentities();
+    testRestorePlanOpsRebuildTheIdentityKeyedSnapshotVerbatim();
+    testRestorePlanOpsRebuildTheSlotKeyedSnapshotVerbatim();
     testTakeDetachesEverythingAndLeavesTheQueueEmpty();
     testIntentsArrivingDuringADrainSurviveIt();
     testAReEntrantParkCancelsOnlyWhatIsStillPending();