…together

Extend the genie_spaces/serialized_space test so a single deploy asserts both
sides of the SHA-only-state contract on the same state:
  - the create requests carry the full serialized_space (existing capture, plus
    an explicit "no sha256 in the request" guard), and
  - the persisted state stores only the sha256 content hash, never the content.

Co-authored-by: Isaac

The two error paths added for state compaction in Bind (adapter lookup and
CompactState) returned without removing the temp state file, unlike every other
error path in the function. Add os.Remove(tmpStatePath) to match.

Co-authored-by: Isaac

…s one token

The generic test replacements split the persisted sha256 digest into pieces:
[0-9a-f]{32} turned it into "[DASHBOARD_ID][DASHBOARD_ID]" in the bind test, and
[0-9]{3,} fragmented it as "sha256:...[NUMID]..." in several plan outputs. Add a
single low-Order replacement in acceptance/bundle/test.toml that collapses the
64-char digest to "sha256:[ALPHANUMID]" before those rules run, so every state and
plan output renders the hash consistently. Also add the missing newline after the
state-assertion title in the genie serialized_space test.

Co-authored-by: Isaac

serialized_space gets the same treatment in a follow-up; keeping this PR to
dashboards only.

Co-authored-by: Isaac

…aration

The per-resource CompactState(state any) (any, error) adapter method (plus its
IResource entry and calladapt plumbing) is removed. Instead, fields persisted as
a content hash are declared under hashed_in_state in resources.yml, and a generic
dresources.CompactState(cfg, state) hashes them via structaccess.

Behaviour is unchanged: new_state still carries the full content (so deploy and
deploy --plan send the real bytes), and only resources.json + the diff use the
hash. dashboards.serialized_dashboard is the sole declared field; acceptance
outputs are identical.

Co-authored-by: Isaac

Spell out that hashing the saved state on read is what lets state written before
this change (or before a field was added to hashed_in_state) still diff correctly
against the now-hashed local config, and that it is read-only normalization (no
state_version bump). Link the PR.

Co-authored-by: Isaac

…nvariant test

- Drop the CompactState call on the remapped remote state in CalculatePlan. Hashing
  only ever helps the local diff (saved vs config); a hashed_in_state field is always
  ignore_remote_changes, so its remote diff is discarded regardless. The plan now shows
  the real remote value instead of a meaningless remote hash.
- Mask the state hash in acceptance output as "sha256:[HASH]" instead of the generic
  "[ALPHANUMID]", so it clearly reads as a content hash.
- Add TestHashedInStateImpliesIgnoreRemoteChanges enforcing, for every resource, that
  any hashed_in_state field is also ignore_remote_changes (a hashed field can only
  detect local changes; its remote diff must be ignored or it would drift forever).

Co-authored-by: Isaac

…ndtrip)

Add dashboard-state-sha: a direct-only test (terraform does not hash state) that runs
both in-memory (READPLAN="") and saved-plan (READPLAN=1, deploy --plan) deploys and
asserts:
  - the create request carries the FULL serialized_dashboard (out.create.serialized.json,
    identical across READPLAN, so the saved plan applies the real content, not the hash);
  - the persisted state holds only the content hash (out.state.direct.txt);
  - the plan keeps full content in new_state but reports the diff as a hash;
  - a re-plan with no local change is a no-op (remote normalization ignored, etag_based).

Local diff detection (edit -> update) is covered by change-serialized-dashboard.

Co-authored-by: Isaac