Feature: PlanApplyService coverage boost for checkpoint, rollback, and proxy paths
  As a developer
  I want to cover the uncovered lines in plan_apply_service.py
  So that test coverage is comprehensive

  # Targets uncovered lines:
  #   674-688  _try_checkpoint with checkpoint_manager configured (success + exception)
  #   697-707  _try_rollback with checkpoint_manager configured (success + exception + empty list)
  #   777, 782, 787  _ApplyPhaseProxy constructor, sandbox_id, context

  # -- _ApplyPhaseProxy ---------------------------------------------------

  Scenario: ApplyPhaseProxy sets synthetic sandbox ID from plan ID
    Given pacb an ApplyPhaseProxy with plan_id "01ABCDEF12345678XXXX"
    Then pacb the proxy sandbox_id should be "apply-01ABCDEF12345678"

  Scenario: ApplyPhaseProxy context returns None
    Given pacb an ApplyPhaseProxy with plan_id "01ABCDEF12345678XXXX"
    Then pacb the proxy context should be None

  # -- _try_checkpoint success path ----------------------------------------

  Scenario: _try_checkpoint creates checkpoint when manager is configured
    Given pacb a service with a configured checkpoint manager
    When pacb I call _try_checkpoint with plan_id "01CHKPTPLAN00000001" and phase "pre_apply"
    Then pacb the checkpoint manager create_checkpoint should have been called
    And pacb the checkpoint sandbox should have sandbox_id starting with "apply-"

  Scenario: _try_checkpoint passes metadata to checkpoint manager
    Given pacb a service with a configured checkpoint manager
    When pacb I call _try_checkpoint with plan_id "01METAPLAN000000001" and phase "pre_apply" and metadata
    Then pacb the checkpoint manager create_checkpoint should have received metadata

  # -- _try_checkpoint exception path --------------------------------------

  Scenario: _try_checkpoint swallows exception when checkpoint creation fails
    Given pacb a service with a checkpoint manager that raises on create
    When pacb I call _try_checkpoint with plan_id "01FAILCHKPT00000001" and phase "pre_apply"
    Then pacb no exception should have been raised
    And pacb the checkpoint manager create_checkpoint should have been called

  # -- _try_rollback success path ------------------------------------------

  Scenario: _try_rollback calls rollback_to with last checkpoint when checkpoints exist
    Given pacb a service with a checkpoint manager that has existing checkpoints
    When pacb I call _try_rollback with plan_id "01ROLLBACKPLAN00001"
    Then pacb the checkpoint manager list_checkpoints should have been called
    And pacb the checkpoint manager rollback_to should have been called with the last checkpoint

  Scenario: _try_rollback does nothing when no checkpoints exist
    Given pacb a service with a checkpoint manager that returns no checkpoints
    When pacb I call _try_rollback with plan_id "01EMPTYCHKPT000001"
    Then pacb the checkpoint manager list_checkpoints should have been called
    And pacb the checkpoint manager rollback_to should not have been called

  # -- _try_rollback exception path ----------------------------------------

  Scenario: _try_rollback swallows exception when rollback fails
    Given pacb a service with a checkpoint manager that raises on list
    When pacb I call _try_rollback with plan_id "01ROLLBKFAIL000001"
    Then pacb no exception should have been raised

  # -- Integration: apply_with_validation_gate triggers checkpoint ---------

  Scenario: apply_with_validation_gate creates checkpoint on success path
    Given pacb a service with checkpoint manager and a plan with passing validations
    When pacb I call apply_with_validation_gate
    Then pacb the apply result outcome should be "applied"
    And pacb the checkpoint manager create_checkpoint should have been called

  Scenario: apply_with_validation_gate triggers rollback when complete_apply fails
    Given pacb a service with checkpoint manager and complete_apply raises PlanError
    When pacb I call apply_with_validation_gate
    Then pacb the apply result outcome should be "applied"
    And pacb the checkpoint manager create_checkpoint should have been called
    And pacb the checkpoint manager list_checkpoints should have been called