"""keycloak — UPGRADE overlay (Phase 1e HC3): data-continuity, assertion-only + additive.

ops.pre_upgrade created a marker realm (mariadb) before the upgrade; the orchestrator performed the
upgrade once (generic tier asserted reconverge/serving/moved). This overlay ADDS: the realm survived
(mariadb data preserved). Re-auths post-upgrade."""

import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
import kc_admin  # noqa: E402


def test_upgrade_preserves_realm(live_app):
    tok = kc_admin.admin_token(live_app, kc_admin.admin_password(live_app))
    assert kc_admin.marker_realm_exists(live_app, tok), "realm did not survive the upgrade"