"""keycloak — BACKUP overlay (Phase 1e HC3): assertion-only + additive.

ops.pre_backup created the marker realm before the backup op captured mariadb; the orchestrator
performed the backup once (generic tier asserted a snapshot artifact). This overlay ADDS: the marker
realm is present at backup time. backup-bot-two cycles the container during backup, so wait for
serving + re-auth first. The backup→restore divergence (deleting the realm) is in ops.pre_restore."""

import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
import kc_admin  # noqa: E402
from harness import generic  # noqa: E402


def test_backup_captures_realm(live_app, meta):
    generic.assert_serving(live_app, meta)  # container cycled during backup; wait for it to be back
    tok = kc_admin.admin_token(live_app, kc_admin.admin_password(live_app))
    assert kc_admin.marker_realm_exists(live_app, tok), "marker realm not present at backup time"