diff --git a/cts/cts-cli.in b/cts/cts-cli.in
index 10e70ec16b..421a954088 100755
--- a/cts/cts-cli.in
+++ b/cts/cts-cli.in
@@ -1,2589 +1,2589 @@
 #!@BASH_PATH@
 #
 # Copyright 2008-2022 the Pacemaker project contributors
 #
 # The version control history for this file may have further details.
 #
 # This source code is licensed under the GNU General Public License version 2
 # or later (GPLv2+) WITHOUT ANY WARRANTY.
 #
 
 # Set the exit status of a command to the exit code of the last program to
 # exit non-zero.  This is bash-specific.
 set -o pipefail
 
 #
 # Note on portable usage of sed: GNU/POSIX/*BSD sed have a limited subset of
 # compatible functionality. Do not use the -i option, alternation (\|),
 # \0, or character sequences such as \n or \s.
 #
 
 USAGE_TEXT="Usage: cts-cli [<options>]
 Options:
  --help          Display this text, then exit
  -V, --verbose   Display any differences from expected output
  -t 'TEST [...]' Run only specified tests
                  (default: 'daemons dates error_codes tools crm_mon acls
                             validity upgrade rules feature_set').
                  Other tests: agents (must be run in an installed environment).
  -p DIR          Look for executables in DIR (may be specified multiple times)
  -v, --valgrind  Run all commands under valgrind
  -s              Save actual output as expected output"
 
 # If readlink supports -e (i.e. GNU), use it
 readlink -e / >/dev/null 2>/dev/null
 if [ $? -eq 0 ]; then
     test_home="$(dirname "$(readlink -e "$0")")"
 else
     test_home="$(dirname "$0")"
 fi
 
 : ${shadow=cts-cli}
 shadow_dir=$(mktemp -d ${TMPDIR:-/tmp}/cts-cli.shadow.XXXXXXXXXX)
 num_errors=0
 num_passed=0
 verbose=0
 tests="daemons dates error_codes tools crm_mon acls validity upgrade rules "
 tests="$tests feature_set"
 do_save=0
 XMLLINT_CMD=
 VALGRIND_CMD=
 VALGRIND_OPTS="
     -q
     --gen-suppressions=all
     --show-reachable=no
     --leak-check=full
     --trace-children=no
     --time-stamp=yes
     --num-callers=20
     --suppressions=$test_home/valgrind-pcmk.suppressions
 "
 
 # Temp files for saving a command's stdout/stderr in _test_assert()
 test_assert_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_outfile.XXXXXXXXXX)
 test_assert_errfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_errfile.XXXXXXXXXX)
 xmllint_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.xmllint_outfile.XXXXXXXXXX)
 
 # Log test errors to stderr
 export PCMK_stderr=1
 
 # Output when PCMK_trace_functions is undefined is different from when it's
 # empty. Later we save the value of PCMK_trace_functions, do work, and restore
 # the original value. Getting back to the initial state is simplest if we assume
 # the variable is defined.
 : ${PCMK_trace_functions=""}
 export PCMK_trace_functions
 
 # These constants must track crm_exit_t values
 CRM_EX_OK=0
 CRM_EX_ERROR=1
 CRM_EX_INVALID_PARAM=2
 CRM_EX_UNIMPLEMENT_FEATURE=3
 CRM_EX_INSUFFICIENT_PRIV=4
 CRM_EX_NOT_CONFIGURED=6
 CRM_EX_USAGE=64
 CRM_EX_DATAERR=65
 CRM_EX_CONFIG=78
 CRM_EX_OLD=103
 CRM_EX_DIGEST=104
 CRM_EX_NOSUCH=105
 CRM_EX_UNSAFE=107
 CRM_EX_EXISTS=108
 CRM_EX_MULTIPLE=109
 CRM_EX_EXPIRED=110
 CRM_EX_NOT_YET_IN_EFFECT=111
 
 reset_shadow_cib_version() {
     local SHADOWPATH
 
     SHADOWPATH="$(crm_shadow --file)"
     # sed -i isn't portable :-(
     cp -p "$SHADOWPATH" "${SHADOWPATH}.$$" # preserve permissions
     sed -e 's/epoch="[0-9]*"/epoch="1"/g' \
         -e 's/num_updates="[0-9]*"/num_updates="0"/g' \
         -e 's/admin_epoch="[0-9]*"/admin_epoch="0"/g' \
         "$SHADOWPATH" > "${SHADOWPATH}.$$"
     mv -- "${SHADOWPATH}.$$" "$SHADOWPATH"
 }
 
 # A newly created empty CIB might or might not have a rsc_defaults section
 # depending on whether the --with-resource-stickiness-default configure
 # option was used. To ensure regression tests behave the same either way,
 # delete any rsc_defaults after creating or erasing a CIB.
 delete_shadow_resource_defaults() {
     cibadmin --delete --xml-text '<rsc_defaults/>'
 
     # The above command might or might not bump the CIB version, so reset it
     # to ensure future changes result in the same version for comparison.
     reset_shadow_cib_version
 }
 
 create_shadow_cib() {
     local VALIDATE_WITH
     local SHADOW_CMD
 
     VALIDATE_WITH="$1"
 
     export CIB_shadow_dir="${shadow_dir}"
 
     SHADOW_CMD="$VALGRIND_CMD crm_shadow --batch --force --create-empty"
     if [ -z "$VALIDATE_WITH" ]; then
         $SHADOW_CMD "$shadow" 2>&1
     else
         $SHADOW_CMD "$shadow" --validate-with="${VALIDATE_WITH}" 2>&1
     fi
 
     export CIB_shadow="$shadow"
     delete_shadow_resource_defaults
 }
 
 function _test_assert() {
     target=$1; shift
     validate=$1; shift
     cib=$1; shift
     app=`echo "$cmd" | sed 's/\ .*//'`
     printf "* Running: $app - $desc\n" 1>&2
 
     printf "=#=#=#= Begin test: $desc =#=#=#=\n"
 
     # Capture stderr and stdout separately, then print them consecutively
     eval $VALGRIND_CMD $cmd > "$test_assert_outfile" 2> "$test_assert_errfile"
     rc=$?
     cat "$test_assert_errfile"
     cat "$test_assert_outfile"
 
     if [ x$cib != x0 ]; then
         printf "=#=#=#= Current cib after: $desc =#=#=#=\n"
         CIB_user=root cibadmin -Q
     fi
 
     # Do not validate if running under valgrind, even if told to do so.  Valgrind
     # will output a lot more stuff that is not XML, so it wouldn't validate anyway.
     if [ "$validate" = "1" ] && [ "$VALGRIND_CMD" = "" ] && [ $rc = 0 ] && [ "$XMLLINT_CMD" != "" ]; then
         # The sed command filters out the "- validates" line that xmllint will output
         # on success.  grep cannot be used here because "grep -v 'validates$'" will
         # return an exit code of 1 if its input consists entirely of "- validates".
         $XMLLINT_CMD --noout --relaxng \
             "$PCMK_schema_directory/api/api-result.rng" "$test_assert_outfile" \
             > "$xmllint_outfile" 2>&1
         rc=$?
 
         sed -n '/validates$/ !p' "$xmllint_outfile"
 
         if [ $rc = 0 ]; then
             printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
         else
             printf "=#=#=#= End test: %s - Failed to validate (%d) =#=#=#=\n" "$desc" $rc
         fi
     else
         printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
     fi
 
     if [ $rc -ne $target ]; then
         num_errors=$(( $num_errors + 1 ))
         printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc"
         printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc (`which $app`)" 1>&2
         return
         exit $CRM_EX_ERROR
     else
         printf "* Passed: %-14s - %s\n" $app "$desc"
         num_passed=$(( $num_passed + 1 ))
     fi
 }
 
 function test_assert() {
     _test_assert $1 0 $2
 }
 
 function test_assert_validate() {
     _test_assert $1 1 $2
 }
 
 # Tests that depend on resource agents and must be run in an installed
 # environment
 function test_agents() {
     desc="Validate a valid resource configuration"
     cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
     test_assert $CRM_EX_OK 0
 
     desc="Validate a valid resource configuration (XML)"
     cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
     cmd="$cmd --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Make the Dummy configuration invalid (op_sleep can't be a generic string)
     export OCF_RESKEY_op_sleep=asdf
 
     desc="Validate an invalid resource configuration"
     cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
     test_assert $CRM_EX_NOT_CONFIGURED 0
 
     desc="Validate an invalid resource configuration (XML)"
     cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
     cmd="$cmd --output-as=xml"
     test_assert_validate $CRM_EX_NOT_CONFIGURED 0
 
     unset OCF_RESKEY_op_sleep
     export OCF_RESKEY_op_sleep
 }
 
 function test_daemons() {
     desc="Get CIB manager metadata"
     cmd="pacemaker-based metadata"
     test_assert $CRM_EX_OK 0
 
     desc="Get controller metadata"
     cmd="pacemaker-controld metadata"
     test_assert $CRM_EX_OK 0
 
     desc="Get fencer metadata"
     cmd="pacemaker-fenced metadata"
     test_assert $CRM_EX_OK 0
 
     desc="Get scheduler metadata"
     cmd="pacemaker-schedulerd metadata"
     test_assert $CRM_EX_OK 0
 }
 
 function test_crm_mon() {
     local TMPXML
     export CIB_file="$test_home/cli/crm_mon.xml"
 
     desc="Basic text output"
     cmd="crm_mon -1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output"
     cmd="crm_mon --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output without node section"
     cmd="crm_mon -1 --exclude=nodes"
     test_assert $CRM_EX_OK 0
 
     desc="XML output without the node section"
     cmd="crm_mon --output-as=xml --exclude=nodes"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Text output with only the node section"
     cmd="crm_mon -1 --exclude=all --include=nodes"
     test_assert $CRM_EX_OK 0
 
     # The above test doesn't need to be performed for other output formats.  It's
     # really just a test to make sure that blank lines are correct.
 
     desc="Complete text output"
     cmd="crm_mon -1 --include=all"
     test_assert $CRM_EX_OK 0
 
     # XML includes everything already so there's no need for a complete test
 
     desc="Complete text output with detail"
     cmd="crm_mon -1R --include=all"
     test_assert $CRM_EX_OK 0
 
     # XML includes detailed output already
 
     desc="Complete brief text output"
     cmd="crm_mon -1 --include=all --brief"
     test_assert $CRM_EX_OK 0
 
     desc="Complete text output grouped by node"
     cmd="crm_mon -1 --include=all --group-by-node"
     test_assert $CRM_EX_OK 0
 
     # XML does not have a brief output option
 
     desc="Complete brief text output grouped by node"
     cmd="crm_mon -1 --include=all --group-by-node --brief"
     test_assert $CRM_EX_OK 0
 
     desc="XML output grouped by node"
     cmd="crm_mon -1 --output-as=xml --group-by-node"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by node"
     cmd="crm_mon -1 --include=all --node=cluster01"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by node"
     cmd="crm_mon --output-as xml --include=all --node=cluster01"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by tag"
     cmd="crm_mon -1 --include=all --node=even-nodes"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by tag"
     cmd="crm_mon --output-as=xml --include=all --node=even-nodes"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by resource tag"
     cmd="crm_mon -1 --include=all --resource=fencing-rscs"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by resource tag"
     cmd="crm_mon --output-as=xml --include=all --resource=fencing-rscs"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output filtered by node that doesn't exist"
     cmd="crm_mon -1 --node=blah"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by node that doesn't exist"
     cmd="crm_mon --output-as=xml --node=blah"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources"
     cmd="crm_mon -1 -r"
     test_assert $CRM_EX_OK 0
 
     # XML already includes inactive resources
 
     desc="Basic text output with inactive resources, filtered by node"
     cmd="crm_mon -1 -r --node=cluster02"
     test_assert $CRM_EX_OK 0
 
     # XML already includes inactive resources
 
     desc="Complete text output filtered by primitive resource"
     cmd="crm_mon -1 --include=all --resource=Fencing"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by primitive resource"
     cmd="crm_mon --output-as=xml --resource=Fencing"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by group resource"
     cmd="crm_mon -1 --include=all --resource=exim-group"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by group resource"
     cmd="crm_mon --output-as=xml --resource=exim-group"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by group resource member"
     cmd="crm_mon -1 --include=all --resource=Public-IP"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by group resource member"
     cmd="crm_mon --output-as=xml --resource=Email"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by clone resource"
     cmd="crm_mon -1 --include=all --resource=ping-clone"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by clone resource"
     cmd="crm_mon --output-as=xml --resource=ping-clone"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by clone resource instance"
     cmd="crm_mon -1 --include=all --resource=ping"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by clone resource instance"
     cmd="crm_mon --output-as=xml --resource=ping"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by exact clone resource instance"
     cmd="crm_mon -1 --include=all --show-detail --resource=ping:0"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by exact clone resource instance"
     cmd="crm_mon --output-as=xml --resource=ping:1"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output filtered by resource that doesn't exist"
     cmd="crm_mon -1 --resource=blah"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by resource that doesn't exist"
     cmd="crm_mon --output-as=xml --resource=blah"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by tag"
     cmd="crm_mon -1 -r --resource=inactive-rscs"
     test_assert $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundle resource"
     cmd="crm_mon -1 -r --resource=httpd-bundle"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by inactive bundle resource"
     cmd="crm_mon --output-as=xml --resource=httpd-bundle"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundled IP address resource"
     cmd="crm_mon -1 -r --resource=httpd-bundle-ip-192.168.122.131"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by bundled IP address resource"
     cmd="crm_mon --output-as=xml --resource=httpd-bundle-ip-192.168.122.132"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundled container"
     cmd="crm_mon -1 -r --resource=httpd-bundle-docker-1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by bundled container"
     cmd="crm_mon --output-as=xml --resource=httpd-bundle-docker-2"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundle connection"
     cmd="crm_mon -1 -r --resource=httpd-bundle-0"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by bundle connection"
     cmd="crm_mon --output-as=xml --resource=httpd-bundle-0"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundled primitive resource"
     cmd="crm_mon -1 -r --resource=httpd"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by bundled primitive resource"
     cmd="crm_mon --output-as=xml --resource=httpd"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by clone name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-clone-group"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by clone name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-clone-group"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by group name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by group name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-group"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by exact group instance name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group:1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by exact group instance name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-group:1"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by primitive name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by primitive name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-proxy"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by exact primitive instance name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy:1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by exact primitive instance name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-proxy:1"
     test_assert_validate $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon-partial.xml"
 
     desc="Text output of partially active resources"
     cmd="crm_mon -1 --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="XML output of partially active resources"
     cmd="crm_mon -1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Text output of partially active resources, with inactive resources"
     cmd="crm_mon -1 -r --show-detail"
     test_assert $CRM_EX_OK 0
 
     # XML already includes inactive resources
 
     desc="Complete brief text output, with inactive resources"
     cmd="crm_mon -1 -r --include=all --brief --show-detail"
     test_assert $CRM_EX_OK 0
 
     # XML does not have a brief output option
 
     desc="Text output of partially active group"
     cmd="crm_mon -1 --resource=partially-active-group"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of partially active group, with inactive resources"
     cmd="crm_mon -1 --resource=partially-active-group -r"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of active member of partially active group"
     cmd="crm_mon -1 --resource=dummy-1"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of inactive member of partially active group"
     cmd="crm_mon -1 --resource=dummy-2 --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="Complete brief text output grouped by node, with inactive resources"
     cmd="crm_mon -1 -r --include=all --group-by-node --brief --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of partially active resources, with inactive resources, filtered by node"
     cmd="crm_mon -1 -r --node=cluster01"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of partially active resources, filtered by node"
     cmd="crm_mon -1 --output-as=xml --node=cluster01"
     test_assert_validate $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon-unmanaged.xml"
 
     desc="Text output of active unmanaged resource on offline node"
     cmd="crm_mon -1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output of active unmanaged resource on offline node"
     cmd="crm_mon -1 --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     desc="Brief text output of active unmanaged resource on offline node"
     cmd="crm_mon -1 --brief"
     test_assert $CRM_EX_OK 0
 
     desc="Brief text output of active unmanaged resource on offline node, grouped by node"
     cmd="crm_mon -1 --brief --group-by-node"
     test_assert $CRM_EX_OK 0
 
     export CIB_file=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_mon.xml.XXXXXXXXXX)
     sed -e '/maintenance-mode/ s/false/true/' "$test_home/cli/crm_mon.xml" > $CIB_file
 
     desc="Text output of all resources with maintenance-mode enabled"
     cmd="crm_mon -1 -r"
     test_assert $CRM_EX_OK 0
 
     rm -r "$CIB_file"
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon-T180.xml"
 
     desc="Text output of guest node's container on different node from its"
     desc="$desc remote resource"
     cmd="crm_mon -1"
     test_assert $CRM_EX_OK 0
 
     desc="Complete text output of guest node's container on different node from"
     desc="$desc its remote resource"
     cmd="crm_mon -1 --show-detail"
     test_assert $CRM_EX_OK 0
 
     unset CIB_file
 }
 
 function test_error_codes() {
     # Note: At the time of this writing, crm_error returns success even for
     # unknown error codes. We don't want to cause a regression by changing that.
 
     # Due to the way _test_assert() formats output, we need "crm_error" to be
     # the first token of cmd. We can't start with a parenthesis or variable
     # assignment. However, in the "list result codes" tests, we also need to
     # save some output for later processing. We'll use a temp file for this.
     local TMPFILE
     TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_error_out.XXXXXXXXXX)
 
     # Legacy return codes
     #
     # Don't test unknown legacy code. FreeBSD includes a colon in strerror(),
     # while other distros do not.
     desc="Get legacy return code"
     cmd="crm_error -- 201"
     test_assert $CRM_EX_OK 0
 
     desc="Get legacy return code (XML)"
     cmd="crm_error --output-as=xml -- 201"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get legacy return code (with name)"
     cmd="crm_error -n -- 201"
     test_assert $CRM_EX_OK 0
 
     desc="Get legacy return code (with name) (XML)"
     cmd="crm_error -n --output-as=xml -- 201"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get multiple legacy return codes"
     cmd="crm_error -- 201 202"
     test_assert $CRM_EX_OK 0
 
     desc="Get multiple legacy return codes (XML)"
     cmd="crm_error --output-as=xml -- 201 202"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get multiple legacy return codes (with names)"
     cmd="crm_error -n -- 201 202"
     test_assert $CRM_EX_OK 0
 
     desc="Get multiple legacy return codes (with names) (XML)"
     cmd="crm_error -n --output-as=xml -- 201 202"
     test_assert_validate $CRM_EX_OK 0
 
     # We can only rely on our custom codes, so we'll spot-check codes 201-209
     desc="List legacy return codes (spot check)"
     cmd="crm_error -l | grep 20[1-9]"
     test_assert $CRM_EX_OK 0
 
     desc="List legacy return codes (spot check) (XML)"
     cmd="crm_error -l --output-as=xml > $TMPFILE; rc=$?"
     cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]|2[^0]|20[^1-9])' $TMPFILE"
     cmd="$cmd; (exit $rc)"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List legacy return codes (spot check) (with names)"
     cmd="crm_error -n -l | grep 20[1-9]"
     test_assert $CRM_EX_OK 0
 
     desc="List legacy return codes (spot check) (with names) (XML)"
     cmd="crm_error -n -l --output-as=xml > $TMPFILE; rc=$?"
     cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]|2[^0]|20[^1-9])' $TMPFILE"
     cmd="$cmd; (exit $rc)"
     test_assert_validate $CRM_EX_OK 0
 
     # Standard Pacemaker return codes
     #
     # Don't test positive (system) error codes, which may vary by OS
 
     desc="Get unknown Pacemaker return code"
     cmd="crm_error -r -- -10000"
     test_assert $CRM_EX_OK 0
 
     desc="Get unknown Pacemaker return code (XML)"
     cmd="crm_error -r --output-as=xml -- -10000"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get unknown Pacemaker return code (with name)"
     cmd="crm_error -n -r -- -10000"
     test_assert $CRM_EX_OK 0
 
     desc="Get unknown Pacemaker return code (with name) (XML)"
     cmd="crm_error -n -r --output-as=xml -- -10000"
     test_assert_validate $CRM_EX_OK 0
 
     # Negative return codes require parsing out the "--" explicitly, so we need
     # to test them as a separate case
     desc="Get negative Pacemaker return code"
     cmd="crm_error -r -- -1005"
     test_assert $CRM_EX_OK 0
 
     desc="Get negative Pacemaker return code (XML)"
     cmd="crm_error -r --output-as=xml -- -1005"
     test_assert_validate $CRM_EX_OK 0
 
     # Testing name lookups for negative return codes only is sufficient
     desc="Get negative Pacemaker return code (with name)"
     cmd="crm_error -n -r -- -1005"
     test_assert $CRM_EX_OK 0
 
     desc="Get negative Pacemaker return code (with name) (XML)"
     cmd="crm_error -n -r --output-as=xml -- -1005"
     test_assert_validate $CRM_EX_OK 0
 
     # We can only rely on our custom codes (negative and zero)
     desc="List Pacemaker return codes (non-positive)"
     cmd="crm_error -l -r | grep -E '^[[:blank:]]*(-[[:digit:]]+|0):'"
     test_assert $CRM_EX_OK 0
 
     desc="List Pacemaker return codes (non-positive) (XML)"
     cmd="crm_error -l -r --output-as=xml > $TMPFILE; rc=$?"
     cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
     cmd="$cmd; (exit $rc)"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List Pacemaker return codes (non-positive) (with names)"
     cmd="crm_error -n -l -r | grep -E '^[[:blank:]]*(-[[:digit:]]+|0):'"
     test_assert $CRM_EX_OK 0
 
     desc="List Pacemaker return codes (non-positive) (with names) (XML)"
     cmd="crm_error -n -l -r --output-as=xml > $TMPFILE; rc=$?"
     cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
     cmd="$cmd; (exit $rc)"
     test_assert_validate $CRM_EX_OK 0
 
     # crm_exit_t exit codes
 
     desc="Get unknown crm_exit_t exit code"
     cmd="crm_error -X -- -10000"
     test_assert $CRM_EX_OK 0
 
     desc="Get unknown crm_exit_t exit code (XML)"
     cmd="crm_error -X --output-as=xml -- -10000"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get unknown crm_exit_t exit code (with name)"
     cmd="crm_error -n -X -- -10000"
     test_assert $CRM_EX_OK 0
 
     desc="Get unknown crm_exit_t exit code (with name) (XML)"
     cmd="crm_error -n -X --output-as=xml -- -10000"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get crm_exit_t exit code"
     cmd="crm_error -X -- 1"
     test_assert $CRM_EX_OK 0
 
     desc="Get crm_exit_t exit code (XML)"
     cmd="crm_error -X --output-as=xml -- 1"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get crm_exit_t exit code (with name)"
     cmd="crm_error -n -X -- 1"
     test_assert $CRM_EX_OK 0
 
     desc="Get crm_exit_t exit code (with name) (XML)"
     cmd="crm_error -n -X --output-as=xml -- 1"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get all crm_exit_t exit codes"
     cmd="crm_error -l -X"
     test_assert $CRM_EX_OK 0
 
     desc="Get all crm_exit_t exit codes (XML)"
     cmd="crm_error -l -X --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get all crm_exit_t exit codes (with name)"
     cmd="crm_error -l -n -X"
     test_assert $CRM_EX_OK 0
 
     desc="Get all crm_exit_t exit codes (with name) (XML)"
     cmd="crm_error -l -n -X --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     rm -f "$TMPFILE"
 }
 
 function test_tools() {
     local TMPXML
     local TMPORIG
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     TMPORIG=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.existing.xml.XXXXXXXXXX)
 
     create_shadow_cib
 
     desc="Validate CIB"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK
 
     desc="Query the value of an attribute that does not exist"
     cmd="crm_attribute -n ABCD --query --quiet"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Configure something before erasing"
     cmd="crm_attribute -n cluster-delay -v 60s"
     test_assert $CRM_EX_OK
 
     desc="Require --force for CIB erasure"
     cmd="cibadmin -E"
     test_assert $CRM_EX_UNSAFE
 
     desc="Allow CIB erasure with --force"
     cmd="cibadmin -E --force"
     test_assert $CRM_EX_OK 0
 
     # Skip outputting the resulting CIB in the previous command, and delete
     # rsc_defaults now, so tests behave the same regardless of build options.
     delete_shadow_resource_defaults
 
     # Verify the output after erasure
     desc="Query CIB"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK
 
     # Save a copy of the CIB for a later test
     cibadmin -Q > "$TMPORIG"
 
     desc="Set cluster option"
     cmd="crm_attribute -n cluster-delay -v 60s"
     test_assert $CRM_EX_OK
 
     desc="Query new cluster option"
     cmd="cibadmin -Q -o crm_config | grep cib-bootstrap-options-cluster-delay"
     test_assert $CRM_EX_OK
 
     desc="Query cluster options"
     cmd="cibadmin -Q -o crm_config > $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Set no-quorum policy"
     cmd="crm_attribute -n no-quorum-policy -v ignore"
     test_assert $CRM_EX_OK
 
     desc="Delete nvpair"
     cmd="cibadmin -D -o crm_config --xml-text '<nvpair id=\"cib-bootstrap-options-cluster-delay\"/>'"
     test_assert $CRM_EX_OK
 
     desc="Create operation should fail"
     cmd="cibadmin -C -o crm_config --xml-file $TMPXML"
     test_assert $CRM_EX_EXISTS
 
     desc="Modify cluster options section"
     cmd="cibadmin -M -o crm_config --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Query updated cluster option"
     cmd="cibadmin -Q -o crm_config | grep cib-bootstrap-options-cluster-delay"
     test_assert $CRM_EX_OK
 
     desc="Set duplicate cluster option"
     cmd="crm_attribute -n cluster-delay -v 40s -s duplicate"
     test_assert $CRM_EX_OK
 
     desc="Setting multiply defined cluster option should fail"
     cmd="crm_attribute -n cluster-delay -v 30s"
     test_assert $CRM_EX_MULTIPLE
 
     desc="Set cluster option with -s"
     cmd="crm_attribute -n cluster-delay -v 30s -s duplicate"
     test_assert $CRM_EX_OK
 
     desc="Delete cluster option with -i"
     cmd="crm_attribute -n cluster-delay -D -i cib-bootstrap-options-cluster-delay"
     test_assert $CRM_EX_OK
 
     desc="Create node1 and bring it online"
     cmd="crm_simulate --live-check --in-place --node-up=node1"
     test_assert $CRM_EX_OK
 
     desc="Create node attribute"
     cmd="crm_attribute -n ram -v 1024M -N node1 -t nodes"
     test_assert $CRM_EX_OK
 
     desc="Query new node attribute"
     cmd="cibadmin -Q -o nodes | grep node1-ram"
     test_assert $CRM_EX_OK
 
     desc="Set a transient (fail-count) node attribute"
     cmd="crm_attribute -n fail-count-foo -v 3 -N node1 -t status"
     test_assert $CRM_EX_OK
 
     desc="Query a fail count"
     cmd="crm_failcount --query -r foo -N node1"
     test_assert $CRM_EX_OK
 
     desc="Show node attributes with crm_simulate"
     cmd="crm_simulate --live-check --show-attrs"
     test_assert $CRM_EX_OK 0
 
     desc="Set a second transient node attribute"
     cmd="crm_attribute -n fail-count-bar -v 5 -N node1 -t status"
     test_assert $CRM_EX_OK
 
     desc="Query node attributes by pattern"
     cmd="crm_attribute -t status -P fail-count -N node1 --query"
     test_assert $CRM_EX_OK 0
 
     desc="Update node attributes by pattern"
     cmd="crm_attribute -t status -P fail-count -N node1 -v 10"
     test_assert $CRM_EX_OK
 
     desc="Delete node attributes by pattern"
     cmd="crm_attribute -t status -P fail-count -N node1 -D"
     test_assert $CRM_EX_OK
 
     desc="crm_attribute given invalid pattern usage"
     cmd="crm_attribute -t nodes -P fail-count -N node1 -D"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_attribute given invalid delete usage"
     cmd="crm_attribute -t nodes -N node1 -D"
     test_assert $CRM_EX_USAGE 0
 
     desc="Set a utilization node attribute"
     cmd="crm_attribute -n cpu -v 1 -N node1 -z"
     test_assert $CRM_EX_OK
 
     desc="Query utilization node attribute"
     cmd="crm_attribute --query -n cpu -N node1 -z"
     test_assert $CRM_EX_OK 0
 
     desc="Digest calculation"
     cmd="cibadmin -Q | cibadmin -5 -p 2>&1 > /dev/null"
     test_assert $CRM_EX_OK
 
     # This update will fail because it has version numbers
     desc="Replace operation should fail"
     cmd="cibadmin -R --xml-file $TMPORIG"
     test_assert $CRM_EX_OLD
 
     desc="Default standby value"
     cmd="crm_standby -N node1 -G"
     test_assert $CRM_EX_OK
 
     desc="Set standby status"
     cmd="crm_standby -N node1 -v true"
     test_assert $CRM_EX_OK
 
     desc="Query standby value"
     cmd="crm_standby -N node1 -G"
     test_assert $CRM_EX_OK
 
     desc="Delete standby value"
     cmd="crm_standby -N node1 -D"
     test_assert $CRM_EX_OK
 
     desc="Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_OK
 
     desc="crm_resource run with extra arguments"
     cmd="crm_resource foo bar"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_resource given both -r and resource config"
     cmd="crm_resource -r xyz --class ocf --provider pacemaker --agent Dummy"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_resource given resource config with invalid action"
     cmd="crm_resource --class ocf --provider pacemaker --agent Dummy -D"
     test_assert $CRM_EX_USAGE 0
 
     desc="Create a resource meta attribute"
     cmd="crm_resource -r dummy --meta -p is-managed -v false"
     test_assert $CRM_EX_OK
 
     desc="Query a resource meta attribute"
     cmd="crm_resource -r dummy --meta -g is-managed"
     test_assert $CRM_EX_OK
 
     desc="Remove a resource meta attribute"
     cmd="crm_resource -r dummy --meta -d is-managed"
     test_assert $CRM_EX_OK
 
     desc="Create another resource meta attribute"
     cmd="crm_resource -r dummy --meta -p target-role -v Stopped --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Show why a resource is not running"
     cmd="crm_resource -Y -r dummy --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Remove another resource meta attribute"
     cmd="crm_resource -r dummy --meta -d target-role --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Create a resource attribute"
     cmd="crm_resource -r dummy -p delay -v 10s"
     test_assert $CRM_EX_OK
 
     desc="List the configured resources"
     cmd="crm_resource -L"
     test_assert $CRM_EX_OK
 
     desc="List the configured resources in XML"
     cmd="crm_resource -L --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Implicitly list the configured resources"
     cmd="crm_resource"
     test_assert $CRM_EX_OK 0
 
     desc="List IDs of instantiated resources"
     cmd="crm_resource -l"
     test_assert $CRM_EX_OK 0
 
     desc="Show XML configuration of resource"
     cmd="crm_resource -q -r dummy"
     test_assert $CRM_EX_OK 0
 
     desc="Show XML configuration of resource, output as XML"
     cmd="crm_resource -q -r dummy --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     desc="Require a destination when migrating a resource that is stopped"
     cmd="crm_resource -r dummy -M"
     test_assert $CRM_EX_USAGE
 
     desc="Don't support migration to non-existent locations"
     cmd="crm_resource -r dummy -M -N i.do.not.exist"
     test_assert $CRM_EX_NOSUCH
 
     desc="Create a fencing resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"Fence\" class=\"stonith\" type=\"fence_true\"/>'"
     test_assert $CRM_EX_OK
 
     desc="Bring resources online"
     cmd="crm_simulate --live-check --in-place -S"
     test_assert $CRM_EX_OK
 
     desc="Try to move a resource to its existing location"
     cmd="crm_resource -r dummy --move --node node1"
     test_assert $CRM_EX_EXISTS
 
     desc="Try to move a resource that doesn't exist"
     cmd="crm_resource -r xyz --move --node node1"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Move a resource from its existing location"
     cmd="crm_resource -r dummy --move"
     test_assert $CRM_EX_OK
 
     desc="Clear out constraints generated by --move"
     cmd="crm_resource -r dummy --clear"
     test_assert $CRM_EX_OK
 
     desc="Default ticket granted state"
     cmd="crm_ticket -t ticketA -G granted -d false"
     test_assert $CRM_EX_OK
 
     desc="Set ticket granted state"
     cmd="crm_ticket -t ticketA -r --force"
     test_assert $CRM_EX_OK
 
     desc="Query ticket granted state"
     cmd="crm_ticket -t ticketA -G granted"
     test_assert $CRM_EX_OK
 
     desc="Delete ticket granted state"
     cmd="crm_ticket -t ticketA -D granted --force"
     test_assert $CRM_EX_OK
 
     desc="Make a ticket standby"
     cmd="crm_ticket -t ticketA -s"
     test_assert $CRM_EX_OK
 
     desc="Query ticket standby state"
     cmd="crm_ticket -t ticketA -G standby"
     test_assert $CRM_EX_OK
 
     desc="Activate a ticket"
     cmd="crm_ticket -t ticketA -a"
     test_assert $CRM_EX_OK
 
     desc="Delete ticket standby state"
     cmd="crm_ticket -t ticketA -D standby"
     test_assert $CRM_EX_OK
 
     desc="Ban a resource on unknown node"
     cmd="crm_resource -r dummy -B -N host1"
     test_assert $CRM_EX_NOSUCH
 
     desc="Create two more nodes and bring them online"
     cmd="crm_simulate --live-check --in-place --node-up=node2 --node-up=node3"
     test_assert $CRM_EX_OK
 
     desc="Ban dummy from node1"
     cmd="crm_resource -r dummy -B -N node1"
     test_assert $CRM_EX_OK
 
     desc="Show where a resource is running"
     cmd="crm_resource -r dummy -W"
     test_assert $CRM_EX_OK 0
 
     desc="Show constraints on a resource"
     cmd="crm_resource -a -r dummy"
     test_assert $CRM_EX_OK 0
 
     desc="Ban dummy from node2"
     cmd="crm_resource -r dummy -B -N node2 --output-as=xml"
     test_assert_validate $CRM_EX_OK
 
     desc="Relocate resources due to ban"
     cmd="crm_simulate --live-check --in-place -S"
     test_assert $CRM_EX_OK
 
     desc="Move dummy to node1"
     cmd="crm_resource -r dummy -M -N node1 --output-as=xml"
     test_assert_validate $CRM_EX_OK
 
     desc="Clear implicit constraints for dummy on node2"
     cmd="crm_resource -r dummy -U -N node2"
     test_assert $CRM_EX_OK
 
     desc="Drop the status section"
     cmd="cibadmin -R -o status --xml-text '<status/>'"
     test_assert $CRM_EX_OK 0
 
     desc="Create a clone"
     cmd="cibadmin -C -o resources --xml-text '<clone id=\"test-clone\"><primitive id=\"test-primitive\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/></clone>'"
     test_assert $CRM_EX_OK 0
 
     desc="Create a resource meta attribute"
     cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in the primitive"
     cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
     test_assert $CRM_EX_OK
 
     desc="Update resource meta attribute with duplicates"
     cmd="crm_resource -r test-clone --meta -p is-managed -v true"
     test_assert $CRM_EX_OK
 
     desc="Update resource meta attribute with duplicates (force clone)"
     cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
     test_assert $CRM_EX_OK
 
     desc="Update child resource meta attribute with duplicates"
     cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
     test_assert $CRM_EX_OK
 
     desc="Delete resource meta attribute with duplicates"
     cmd="crm_resource -r test-clone --meta -d is-managed"
     test_assert $CRM_EX_OK
 
     desc="Delete resource meta attribute in parent"
     cmd="crm_resource -r test-primitive --meta -d is-managed"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in the primitive"
     cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
     test_assert $CRM_EX_OK
 
     desc="Update existing resource meta attribute"
     cmd="crm_resource -r test-clone --meta -p is-managed -v true"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in the parent"
     cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
     test_assert $CRM_EX_OK
 
     desc="Copy resources"
     cmd="cibadmin -Q -o resources > $TMPXML"
     test_assert $CRM_EX_OK 0
 
     desc="Delete resource parent meta attribute (force)"
     cmd="crm_resource -r test-clone --meta -d is-managed --force"
     test_assert $CRM_EX_OK
 
     desc="Restore duplicates"
     cmd="cibadmin -R -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Delete resource child meta attribute"
     cmd="crm_resource -r test-primitive --meta -d is-managed"
     test_assert $CRM_EX_OK
 
     cibadmin -C -o resources --xml-text '<group id="dummy-group"> \
         <primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"\/> \
         <primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"\/> \
       </group>'
 
     desc="Create a resource meta attribute in dummy1"
     cmd="crm_resource -r dummy1 --meta -p is-managed -v true"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in dummy-group"
     cmd="crm_resource -r dummy-group --meta -p is-managed -v false"
     test_assert $CRM_EX_OK
 
     cibadmin -D -o resource --xml-text '<group id="dummy-group">'
 
     desc="Specify a lifetime when moving a resource"
     cmd="crm_resource -r dummy --move --node node2 --lifetime=PT1H"
     test_assert $CRM_EX_OK
 
     desc="Try to move a resource previously moved with a lifetime"
     cmd="crm_resource -r dummy --move --node node1"
     test_assert $CRM_EX_OK
 
     desc="Ban dummy from node1 for a short time"
     cmd="crm_resource -r dummy -B -N node1 --lifetime=PT1S"
     test_assert $CRM_EX_OK
 
     desc="Remove expired constraints"
     sleep 2
     cmd="crm_resource --clear --expired"
     test_assert $CRM_EX_OK
 
     # Clear has already been tested elsewhere, but we need to get rid of the
     # constraints so testing delete works.  It won't delete if there's still
     # a reference to the resource somewhere.
     desc="Clear all implicit constraints for dummy"
     cmd="crm_resource -r dummy -U"
     test_assert $CRM_EX_OK
 
     desc="Set a node health strategy"
     cmd="crm_attribute -n node-health-strategy -v migrate-on-red"
     test_assert $CRM_EX_OK
 
     desc="Set a node health attribute"
     cmd="crm_attribute -N node3 -n '#health-cts-cli' -v red"
     test_assert $CRM_EX_OK
 
     desc="Show why a resource is not running on an unhealthy node"
     cmd="crm_resource -N node3 -Y -r dummy --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Delete a resource"
     cmd="crm_resource -D -r dummy -t primitive"
     test_assert $CRM_EX_OK
 
     unset CIB_shadow
     unset CIB_shadow_dir
 
     desc="Create an XML patchset"
     cmd="crm_diff -o $test_home/cli/crm_diff_old.xml -n $test_home/cli/crm_diff_new.xml"
     test_assert $CRM_EX_ERROR 0
 
     export CIB_file="$test_home/cli/constraints.xml"
 
     for rsc in prim1 prim2 prim3 prim4 prim5 prim6 prim7 prim8 prim9 \
                prim10 prim11 prim12 prim13 group clone; do
         desc="Check locations and constraints for $rsc"
         cmd="crm_resource -a -r $rsc"
         test_assert $CRM_EX_OK 0
 
         desc="Recursively check locations and constraints for $rsc"
         cmd="crm_resource -A -r $rsc"
         test_assert $CRM_EX_OK 0
 
         desc="Check locations and constraints for $rsc in XML"
         cmd="crm_resource -a -r $rsc --output-as=xml"
         test_assert_validate $CRM_EX_OK 0
 
         desc="Recursively check locations and constraints for $rsc in XML"
         cmd="crm_resource -A -r $rsc --output-as=xml"
         test_assert_validate $CRM_EX_OK 0
     done
 
     desc="Check locations and constraints for group member (referring to group)"
     cmd="crm_resource -a -r gr2"
     test_assert $CRM_EX_OK 0
 
     desc="Check locations and constraints for group member (without referring to group)"
     cmd="crm_resource -a -r gr2 --force"
     test_assert $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_resource_digests.xml"
 
     desc="Show resource digests"
     cmd="crm_resource --digests -r rsc1 -N node1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Show resource digests with overrides"
     cmd="$cmd CRM_meta_interval=10000 CRM_meta_timeout=20000"
     test_assert $CRM_EX_OK 0
 
     desc="Show resource operations"
     cmd="crm_resource --list-operations"
     test_assert $CRM_EX_OK 0
 
     desc="Show resource operations (XML)"
     cmd="crm_resource --list-operations --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crmadmin-cluster-remote-guest-nodes.xml"
 
     desc="List all nodes"
     cmd="crmadmin -N"
     test_assert $CRM_EX_OK 0
 
     desc="Minimally list all nodes"
     cmd="crmadmin -N -q"
     test_assert $CRM_EX_OK 0
 
     desc="List all nodes as bash exports"
     cmd="crmadmin -N -B"
     test_assert $CRM_EX_OK 0
 
     desc="List cluster nodes"
     cmd="crmadmin -N cluster | wc -l | grep 6"
     test_assert $CRM_EX_OK 0
 
     desc="List guest nodes"
     cmd="crmadmin -N guest | wc -l | grep 2"
     test_assert $CRM_EX_OK 0
 
     desc="List remote nodes"
     cmd="crmadmin -N remote | wc -l | grep 3"
     test_assert $CRM_EX_OK 0
 
     desc="List cluster,remote nodes"
     cmd="crmadmin -N cluster,remote | wc -l | grep 9"
     test_assert $CRM_EX_OK 0
 
     desc="List guest,remote nodes"
     cmd="crmadmin -N guest,remote | wc -l | grep 5"
     test_assert $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon.xml"
     export CIB_shadow_dir="${shadow_dir}"
 
     desc="Show allocation scores with crm_simulate"
     cmd="crm_simulate -x $CIB_file --show-scores --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Show utilization with crm_simulate"
     cmd="crm_simulate -x $CIB_file --show-utilization"
     test_assert $CRM_EX_OK 0
 
     desc="Simulate injecting a failure"
     cmd="crm_simulate -x $CIB_file -S -i ping_monitor_10000@cluster02=1"
     test_assert $CRM_EX_OK 0
 
     desc="Simulate bringing a node down"
     cmd="crm_simulate -x $CIB_file -S --node-down=cluster01"
     test_assert $CRM_EX_OK 0
 
     desc="Simulate a node failing"
     cmd="crm_simulate -x $CIB_file -S --node-fail=cluster02"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow_dir
 
     desc="List a promotable clone resource"
     cmd="crm_resource --locate -r promotable-clone"
     test_assert $CRM_EX_OK 0
 
     desc="List the primitive of a promotable clone resource"
     cmd="crm_resource --locate -r promotable-rsc"
     test_assert $CRM_EX_OK 0
 
     desc="List a single instance of a promotable clone resource"
     cmd="crm_resource --locate -r promotable-rsc:0"
     test_assert $CRM_EX_OK 0
 
     desc="List another instance of a promotable clone resource"
     cmd="crm_resource --locate -r promotable-rsc:1"
     test_assert $CRM_EX_OK 0
 
     desc="List a promotable clone resource in XML"
     cmd="crm_resource --locate -r promotable-clone --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List the primitive of a promotable clone resource in XML"
     cmd="crm_resource --locate -r promotable-rsc --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List a single instance of a promotable clone resource in XML"
     cmd="crm_resource --locate -r promotable-rsc:0 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List another instance of a promotable clone resource in XML"
     cmd="crm_resource --locate -r promotable-rsc:1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Try to move an instance of a cloned resource"
     cmd="crm_resource -r promotable-rsc:0 --move --node node1"
     test_assert $CRM_EX_INVALID_PARAM 0
 
     # Create a sandbox copy of crm_mon.xml
     cibadmin -Q > "$TMPXML"
     export CIB_file="$TMPXML"
 
     desc="Query a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Query a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Delete a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
     test_assert $CRM_EX_OK 0
 
     desc="Delete a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Query after deleting a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Query after deleting a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Update a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1"
     test_assert $CRM_EX_OK 0
 
     desc="Update a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Query after updating a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_OK 0
 
     desc="Query after updating a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Update an existing promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5"
     test_assert $CRM_EX_OK 0
 
     desc="Update an existing promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Query after updating an existing promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_OK 0
 
     desc="Query after updating an existing promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Delete an existing promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
     test_assert $CRM_EX_OK 0
 
     desc="Delete an existing promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Query after deleting an existing promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Query after deleting an existing promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     unset CIB_file
 
     export CIB_file="-"
 
     desc="Check that CIB_file=\"-\" works - crm_mon"
     cmd="cat $test_home/cli/crm_mon.xml | crm_mon -1"
     test_assert $CRM_EX_OK 0
 
     desc="Check that CIB_file=\"-\" works - crm_resource"
     cmd="cat $test_home/cli/crm_resource_digests.xml | crm_resource --digests -r rsc1 -N node1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Check that CIB_file=\"-\" works - crmadmin"
     cmd="cat $test_home/cli/crmadmin-cluster-remote-guest-nodes.xml | crmadmin -N | wc -l | grep 11"
     test_assert $CRM_EX_OK 0
 
     unset CIB_file
     rm -f "$TMPXML" "$TMPORIG"
 }
 
 INVALID_PERIODS=(
     "2019-01-01 00:00:00Z"              # Start with no end
     "2019-01-01 00:00:00Z/"             # Start with only a trailing slash
     "PT2S/P1M"                          # Two durations
     "2019-13-01 00:00:00Z/P1M"          # Out-of-range month
     "20191077T15/P1M"                   # Out-of-range day
     "2019-10-01T25:00:00Z/P1M"          # Out-of-range hour
     "2019-10-01T24:00:01Z/P1M"          # Hour 24 with anything but :00:00
     "PT5H/20191001T007000Z"             # Out-of-range minute
     "2019-10-01 00:00:80Z/P1M"          # Out-of-range second
     "2019-10-01 00:00:10 +25:00/P1M"    # Out-of-range offset hour
     "20191001T000010 -00:61/P1M"        # Out-of-range offset minute
     "P1Y/2019-02-29 00:00:00Z"          # Feb. 29 in non-leap-year
     "2019-01-01 00:00:00Z/P"            # Duration with no values
     "P1Z/2019-02-20 00:00:00Z"          # Invalid duration unit
     "P1YM/2019-02-20 00:00:00Z"         # No number for duration unit
 )
 
 function test_dates() {
     # Ensure invalid period specifications are rejected
     for spec in '' "${INVALID_PERIODS[@]}"; do
         desc="Invalid period - [$spec]"
         cmd="iso8601 -p \"$spec\""
         test_assert $CRM_EX_INVALID_PARAM 0
     done
 
     desc="2014-01-01 00:30:00 - 1 Hour"
     cmd="iso8601 -d '2014-01-01 00:30:00Z' -D P-1H -E '2013-12-31 23:30:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="Valid date - Feb 29 in leap year"
     cmd="iso8601 -d '2020-02-29 00:00:00Z' -E '2020-02-29 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="Valid date - using 'T' and offset"
     cmd="iso8601 -d '20191201T131211 -05:00' -E '2019-12-01 18:12:11Z'"
     test_assert $CRM_EX_OK 0
 
     desc="24:00:00 equivalent to 00:00:00 of next day"
     cmd="iso8601 -d '2019-12-31 24:00:00Z' -E '2020-01-01 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     for y in 06 07 08 09 10 11 12 13 14 15 16 17 18 40; do
         desc="20$y-W01-7"
         cmd="iso8601 -d '20$y-W01-7 00Z'"
         test_assert $CRM_EX_OK 0
 
         desc="20$y-W01-7 - round-trip"
         cmd="iso8601 -d '20$y-W01-7 00Z' -W -E '20$y-W01-7 00:00:00Z'"
         test_assert $CRM_EX_OK 0
 
         desc="20$y-W01-1"
         cmd="iso8601 -d '20$y-W01-1 00Z'"
         test_assert $CRM_EX_OK 0
 
         desc="20$y-W01-1 - round-trip"
         cmd="iso8601 -d '20$y-W01-1 00Z' -W -E '20$y-W01-1 00:00:00Z'"
         test_assert $CRM_EX_OK 0
     done
 
     desc="2009-W53-07"
     cmd="iso8601 -d '2009-W53-7 00:00:00Z' -W -E '2009-W53-7 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="epoch + 2 Years 5 Months 6 Minutes"
     cmd="iso8601 -d 'epoch' -D P2Y5MT6M -E '1972-06-01 00:06:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2009-01-31 + 1 Month"
     cmd="iso8601 -d '20090131T000000Z' -D P1M -E '2009-02-28 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2009-01-31 + 2 Months"
     cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P2M -E '2009-03-31 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2009-01-31 + 3 Months"
     cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P3M -E '2009-04-30 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2009-03-31 - 1 Month"
     cmd="iso8601 -d '2009-03-31 01:00:00 +01:00' -D P-1M -E '2009-02-28 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2038-01-01 + 3 Months"
     cmd="iso8601 -d '2038-01-01 00:00:00Z' -D P3M -E '2038-04-01 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 }
 
 function test_acl_loop() {
     local TMPXML
 
     TMPXML="$1"
 
     # Make sure we're rejecting things for the right reasons
     orig_trace_fns="$PCMK_trace_functions"
     export PCMK_trace_functions=pcmk__check_acl,pcmk__apply_creation_acl
 
     CIB_user=root cibadmin --replace --xml-text '<resources/>'
 
     ### no ACL ###
     export CIB_user=unknownguy
     desc="$CIB_user: Query configuration"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set enable-acl"
     cmd="crm_attribute -n enable-acl -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set stonith-enabled"
     cmd="crm_attribute -n stonith-enabled -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     ### deny /cib permission ###
     export CIB_user=l33t-haxor
     desc="$CIB_user: Query configuration"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set enable-acl"
     cmd="crm_attribute -n enable-acl -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set stonith-enabled"
     cmd="crm_attribute -n stonith-enabled -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     ### observer role ###
     export CIB_user=niceguy
     desc="$CIB_user: Query configuration"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK 0
 
     desc="$CIB_user: Set enable-acl"
     cmd="crm_attribute -n enable-acl -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set stonith-enabled"
     cmd="crm_attribute -n stonith-enabled -v false"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     export CIB_user=root
     desc="$CIB_user: Query configuration"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK 0
 
     desc="$CIB_user: Set stonith-enabled"
     cmd="crm_attribute -n stonith-enabled -v true"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_OK
 
     ### deny /cib permission ###
     export CIB_user=l33t-haxor
 
     desc="$CIB_user: Create a resource meta attribute"
     cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Query a resource meta attribute"
     cmd="crm_resource -r dummy --meta -g target-role"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Remove a resource meta attribute"
     cmd="crm_resource -r dummy --meta -d target-role"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     ### observer role ###
     export CIB_user=niceguy
 
     desc="$CIB_user: Create a resource meta attribute"
     cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Query a resource meta attribute"
     cmd="crm_resource -r dummy --meta -g target-role"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Remove a resource meta attribute"
     cmd="crm_resource -r dummy --meta -d target-role"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Create a resource meta attribute"
     cmd="crm_resource -r dummy --meta -p target-role -v Started"
     test_assert $CRM_EX_OK
 
     ### read //meta_attributes ###
     export CIB_user=badidea
     desc="$CIB_user: Query configuration - implied deny"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK 0
 
     ### deny /cib, read //meta_attributes ###
     export CIB_user=betteridea
     desc="$CIB_user: Query configuration - explicit deny"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --delete --xml-text '<acls/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     ### observer role ###
     export CIB_user=niceguy
     desc="$CIB_user: Replace - remove acls"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create resource"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" crm_attribute -n enable-acl -v false
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (deny)"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace --xml-text '<nvpair id="cib-bootstrap-options-enable-acl" name="enable-acl"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (deny)"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (deny)"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     ### admin role ###
     CIB_user=bob
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (direct allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (direct allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (direct allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     ### super_user role ###
     export CIB_user=joe
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (inherited allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (inherited allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (inherited allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     ### rsc_writer role ###
     export CIB_user=mike
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (allow overrides deny)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (allow overrides deny)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (allow overrides deny)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     ### rsc_denied role ###
     export CIB_user=chris
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (deny overrides allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     # Set as root since setting as chris failed
     CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (deny overrides allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     # Set as root since setting as chris failed
     CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (deny overrides allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     export PCMK_trace_functions="$orig_trace_fns"
 }
 
 function test_acls() {
     local SHADOWPATH
     local TMPXML
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.acls.xml.XXXXXXXXXX)
 
     create_shadow_cib pacemaker-1.3
 
     cat <<EOF > "$TMPXML"
     <acls>
       <acl_user id="l33t-haxor">
         <deny id="crook-nothing" xpath="/cib"/>
       </acl_user>
       <acl_user id="niceguy">
         <role_ref id="observer"/>
       </acl_user>
       <acl_user id="bob">
         <role_ref id="admin"/>
       </acl_user>
       <acl_user id="joe">
         <role_ref id="super_user"/>
       </acl_user>
       <acl_user id="mike">
         <role_ref id="rsc_writer"/>
       </acl_user>
       <acl_user id="chris">
         <role_ref id="rsc_denied"/>
       </acl_user>
       <acl_role id="observer">
         <read id="observer-read-1" xpath="/cib"/>
         <write id="observer-write-1" xpath="//nvpair[@name=&apos;stonith-enabled&apos;]"/>
         <write id="observer-write-2" xpath="//nvpair[@name=&apos;target-role&apos;]"/>
       </acl_role>
       <acl_role id="admin">
         <read id="admin-read-1" xpath="/cib"/>
         <write id="admin-write-1" xpath="//resources"/>
       </acl_role>
       <acl_role id="super_user">
         <write id="super_user-write-1" xpath="/cib"/>
       </acl_role>
       <acl_role id="rsc_writer">
         <deny id="rsc-writer-deny-1" xpath="/cib"/>
         <write id="rsc-writer-write-1" xpath="//resources"/>
       </acl_role>
       <acl_role id="rsc_denied">
         <write id="rsc-denied-write-1" xpath="/cib"/>
         <deny id="rsc-denied-deny-1" xpath="//resources"/>
       </acl_role>
     </acls>
 EOF
 
     desc="Configure some ACLs"
     cmd="cibadmin -M -o acls --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Enable ACLs"
     cmd="crm_attribute -n enable-acl -v true"
     test_assert $CRM_EX_OK
 
     desc="Set cluster option"
     cmd="crm_attribute -n no-quorum-policy -v ignore"
     test_assert $CRM_EX_OK
 
     desc="New ACL"
     cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"badidea\"><read id=\"badidea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
     test_assert $CRM_EX_OK
 
     desc="Another ACL"
     cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"betteridea\"><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
     test_assert $CRM_EX_OK
 
     desc="Updated ACL"
     cmd="cibadmin --replace -o acls --xml-text '<acl_user id=\"betteridea\"><deny id=\"betteridea-nothing\" xpath=\"/cib\"/><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
     test_assert $CRM_EX_OK
 
     test_acl_loop "$TMPXML"
 
     printf "\n\n    !#!#!#!#! Upgrading to latest CIB schema and re-testing !#!#!#!#!\n"
     printf "\nUpgrading to latest CIB schema and re-testing\n" 1>&2
 
     export CIB_user=root
     desc="$CIB_user: Upgrade to latest CIB schema"
     cmd="cibadmin --upgrade --force -V"
     test_assert $CRM_EX_OK
 
     reset_shadow_cib_version
 
     test_acl_loop "$TMPXML"
 
     unset CIB_shadow_dir
     rm -f "$TMPXML"
 }
 
 function test_validity() {
     local TMPGOOD
     local TMPBAD
 
     TMPGOOD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.good.xml.XXXXXXXXXX)
     TMPBAD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.bad.xml.XXXXXXXXXX)
 
     create_shadow_cib pacemaker-1.2
     orig_trace_fns="$PCMK_trace_functions"
     export PCMK_trace_functions=apply_upgrade,update_validation
 
     cibadmin -C -o resources --xml-text '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'
     cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
     cibadmin -C -o constraints --xml-text '<rsc_order id="ord_1-2" first="dummy1" first-action="start" then="dummy2"/>'
     cibadmin -Q > "$TMPGOOD"
 
 
     desc="Try to make resulting CIB invalid (enum violation)"
     cmd="cibadmin -M -o constraints --xml-text '<rsc_order id=\"ord_1-2\" first=\"dummy1\" first-action=\"break\" then=\"dummy2\"/>'"
     test_assert $CRM_EX_CONFIG
 
     sed 's|"start"|"break"|' "$TMPGOOD" > "$TMPBAD"
     desc="Run crm_simulate with invalid CIB (enum violation)"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_CONFIG 0
 
 
     desc="Try to make resulting CIB invalid (unrecognized validate-with)"
     cmd="cibadmin -M --xml-text '<cib validate-with=\"pacemaker-9999.0\"/>'"
     test_assert $CRM_EX_CONFIG
 
     sed 's|"pacemaker-1.2"|"pacemaker-9999.0"|' "$TMPGOOD" > "$TMPBAD"
     desc="Run crm_simulate with invalid CIB (unrecognized validate-with)"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_CONFIG 0
 
 
     desc="Try to make resulting CIB invalid, but possibly recoverable (valid with X.Y+1)"
     cmd="cibadmin -C -o configuration --xml-text '<tags/>'"
     test_assert $CRM_EX_CONFIG
 
     sed 's|</configuration>|<tags/></configuration>|' "$TMPGOOD" > "$TMPBAD"
     desc="Run crm_simulate with invalid, but possibly recoverable CIB (valid with X.Y+1)"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_OK 0
 
 
     sed 's|[ 	][ 	]*validate-with="[^"]*"||' "$TMPGOOD" > "$TMPBAD"
     desc="Make resulting CIB valid, although without validate-with attribute"
     cmd="cibadmin -R --xml-file $TMPBAD"
     test_assert $CRM_EX_OK
 
     desc="Run crm_simulate with valid CIB, but without validate-with attribute"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_OK 0
 
 
     # this will just disable validation and accept the config, outputting
     # validation errors
     sed -e 's|[ 	][ 	]*validate-with="[^"]*"||' \
         -e 's|\([ 	][ 	]*epoch="[^"]*\)"|\10"|' -e 's|"start"|"break"|' \
         "$TMPGOOD" > "$TMPBAD"
     desc="Make resulting CIB invalid, and without validate-with attribute"
     cmd="cibadmin -R --xml-file $TMPBAD"
     test_assert $CRM_EX_OK
 
     desc="Run crm_simulate with invalid CIB, also without validate-with attribute"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow_dir
     rm -f "$TMPGOOD" "$TMPBAD"
     export PCMK_trace_functions="$orig_trace_fns"
 }
 
 test_upgrade() {
     local TMPXML
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
 
     create_shadow_cib pacemaker-2.10
     orig_trace_fns="$PCMK_trace_functions"
     export PCMK_trace_functions=apply_upgrade,update_validation
 
     desc="Set stonith-enabled=false"
     cmd="crm_attribute -n stonith-enabled -v false"
     test_assert $CRM_EX_OK
 
     cat <<EOF > "$TMPXML"
     <resources>
       <primitive id="mySmartFuse" class="ocf" provider="experiment" type="SmartFuse">
         <operations>
           <op id="mySmartFuse-start" name="start" interval="0" timeout="40s"/>
           <op id="mySmartFuse-monitor-inputpower" name="monitor" interval="30s">
             <instance_attributes id="mySmartFuse-inputpower-instanceparams">
               <nvpair id="mySmartFuse-inputpower-requires" name="requires" value="inputpower"/>
             </instance_attributes>
           </op>
           <op id="mySmartFuse-monitor-outputpower" name="monitor" interval="2s">
             <instance_attributes id="mySmartFuse-outputpower-instanceparams">
               <nvpair id="mySmartFuse-outputpower-requires" name="requires" value="outputpower"/>
             </instance_attributes>
           </op>
         </operations>
         <instance_attributes id="mySmartFuse-params">
           <nvpair id="mySmartFuse-params-ip" name="ip" value="192.0.2.10"/>
         </instance_attributes>
 	<!-- a bit hairy but valid -->
         <instance_attributes id-ref="mySmartFuse-outputpower-instanceparams"/>
       </primitive>
     </resources>
 EOF
 
     desc="Configure the initial resource"
     cmd="cibadmin -M -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Upgrade to latest CIB schema (trigger 2.10.xsl + the wrapping)"
     cmd="cibadmin --upgrade --force -V -V"
     test_assert $CRM_EX_OK
 
     desc="Query a resource instance attribute (shall survive)"
     cmd="crm_resource -r mySmartFuse -g requires"
     test_assert $CRM_EX_OK
 
     unset CIB_shadow_dir
     rm -f "$TMPXML"
     export PCMK_trace_functions="$orig_trace_fns"
 }
 
 test_rules() {
     local TMPXML
 
     create_shadow_cib
 
     cibadmin -C -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="false"/></cluster_property_set>'
     cibadmin -C -o resources --xml-text '<primitive class="ocf" id="dummy" provider="heartbeat" type="Dummy" />'
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-too-many-date-expressions" rsc="dummy">
   <rule id="cli-rule-too-many-date-expressions" score="INFINITY" boolean-op="or">
     <date_expression id="cli-date-expression-1" operation="gt" start="2020-01-01 01:00:00 -0500"/>
     <date_expression id="cli-date-expression-2" operation="lt" end="2019-01-01 01:00:00 -0500"/>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-expired" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-expired" score="INFINITY">
     <date_expression id="cli-prefer-lifetime-end-dummy-expired" operation="lt" end="2019-01-01 12:00:00 -05:00"/>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     if [ "$(uname)" == "FreeBSD" ]; then
         tomorrow=$(date -v+1d +"%F %T %z")
     else
         tomorrow=$(date --date=tomorrow +"%F %T %z")
     fi
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-not-yet" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-not-yet" score="INFINITY">
     <date_expression id="cli-prefer-lifetime-end-dummy-not-yet" operation="gt" start="${tomorrow}"/>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-date_spec-only-years" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-date_spec-only-years" score="INFINITY">
     <date_expression id="cli-prefer-dummy-date_spec-only-years-expr" operation="date_spec">
       <date_spec id="cli-prefer-dummy-date_spec-only-years-spec" years="2019"/>
     </date_expression>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-date_spec-without-years" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-date_spec-without-years" score="INFINITY">
     <date_expression id="cli-prefer-dummy-date_spec-without-years-expr" operation="date_spec">
       <date_spec id="cli-prefer-dummy-date_spec-without-years-spec" hours="20" months="1,3,5,7"/>
     </date_expression>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-date_spec-years-moon" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-date_spec-years-moon" score="INFINITY">
     <date_expression id="cli-prefer-dummy-date_spec-years-moon-expr" operation="date_spec">
       <date_spec id="cli-prefer-dummy-date_spec-years-moon-spec" years="2019" moon="1"/>
     </date_expression>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-no-date_expression" rsc="dummy">
   <rule id="cli-no-date_expression-rule" score="INFINITY">
     <expression id="ban-apache-expr" attribute="#uname" operation="eq" value="node3"/>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     desc="crm_rule given no arguments"
     cmd="crm_rule"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_rule given no arguments (XML)"
     cmd="crm_rule --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="crm_rule given no rule to check"
     cmd="crm_rule -c"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_rule given no rule to check (XML)"
     cmd="crm_rule -c --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="crm_rule given invalid input XML"
     cmd="crm_rule -c -r blahblah -X 'invalidxml'"
     test_assert $CRM_EX_DATAERR 0
 
     desc="crm_rule given invalid input XML (XML)"
     cmd="crm_rule -c -r blahblah -X 'invalidxml' --output-as=xml"
     test_assert_validate $CRM_EX_DATAERR 0
 
     desc="crm_rule given invalid input XML on stdin"
     cmd="echo 'invalidxml' | crm_rule -c -r blahblah -X -"
     test_assert $CRM_EX_DATAERR 0
 
     desc="crm_rule given invalid input XML on stdin (XML)"
     cmd="echo 'invalidxml' | crm_rule -c -r blahblah -X - --output-as=xml"
     test_assert_validate $CRM_EX_DATAERR 0
 
     desc="Try to check a rule that doesn't exist"
     cmd="crm_rule -c -r blahblah"
     test_assert $CRM_EX_NOSUCH
 
     desc="Try to check a rule that doesn't exist, with XML output"
     cmd="crm_rule -c -r blahblah --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Try to check a rule that has too many date_expressions"
     cmd="crm_rule -c -r cli-rule-too-many-date-expressions"
     test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule that has too many date_expressions (XML)"
     cmd="crm_rule -c -r cli-rule-too-many-date-expressions --output-as=xml"
     test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Verify basic rule is expired"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-expired"
     test_assert $CRM_EX_EXPIRED 0
 
     desc="Verify basic rule is expired, with XML output"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-expired --output-as=xml"
     test_assert_validate $CRM_EX_EXPIRED 0
 
     desc="Verify basic rule worked in the past"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101"
     test_assert $CRM_EX_OK 0
 
     desc="Verify basic rule worked in the past (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Verify basic rule is not yet in effect"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet"
     test_assert $CRM_EX_NOT_YET_IN_EFFECT 0
 
     desc="Verify basic rule is not yet in effect (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet --output-as=xml"
     test_assert_validate $CRM_EX_NOT_YET_IN_EFFECT 0
 
     desc="Verify date_spec rule with years has expired"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years"
     test_assert $CRM_EX_EXPIRED 0
 
     desc="Verify date_spec rule with years has expired (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
     test_assert_validate $CRM_EX_EXPIRED 0
 
     desc="Verify multiple rules at once"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years"
     test_assert $CRM_EX_EXPIRED 0
 
     desc="Verify multiple rules at once, with XML output"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
     test_assert_validate $CRM_EX_EXPIRED 0
 
     desc="Verify date_spec rule with years is in effect"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201"
     test_assert $CRM_EX_OK 0
 
     desc="Verify date_spec rule with years is in effect (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Try to check a rule whose date_spec does not contain years="
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years"
     test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule whose date_spec does not contain years= (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years --output-as=xml"
     test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule whose date_spec contains years= and moon="
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon"
     test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule whose date_spec contains years= and moon= (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon --output-as=xml"
     test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule with no date_expression"
     cmd="crm_rule -c -r cli-no-date_expression-rule"
     test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule with no date_expression (XML)"
     cmd="crm_rule -c -r cli-no-date_expression-rule --output-as=xml"
     test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     unset CIB_shadow_dir
 }
 
 # Ensure all command output is in portable locale for comparison
 export LC_ALL="C"
 test_access_render() {
     local TMPXML
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.access_render.xml.XXXXXXXXXX)
     export CIB_shadow_dir="${shadow_dir}"
 
     $VALGRIND_CMD crm_shadow --batch --force --create-empty $shadow 2>&1
     export CIB_shadow=$shadow
 
     # Create a test CIB that has ACL roles
     cat <<EOF > "$TMPXML"
     <acls>
       <acl_role id="role-deny-acls">
         <acl_permission id="deny-acls" kind="deny" xpath="/cib/configuration/acls"/>
         <acl_permission id="read-rest" kind="read" xpath="/cib"/>
       </acl_role>
       <acl_target id="tony">
         <role id="role-deny-acls"/>
       </acl_target>
     </acls>
 EOF
 
     desc="Configure some ACLs"
     cmd="cibadmin -M -o acls --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Enable ACLs"
     cmd="crm_attribute -n enable-acl -v true"
     test_assert $CRM_EX_OK
 
     unset CIB_user
 
     # Run cibadmin --show-access on the test CIB with different users (tony here)
 
     desc="An instance of ACLs render (into color)"
     cmd="cibadmin --force --show-access=color -Q --user tony"
     test_assert $CRM_EX_OK 0
 
     desc="An instance of ACLs render (into namespacing)"
     cmd="cibadmin --force --show-access=namespace -Q --user tony"
     test_assert $CRM_EX_OK 0
 
     desc="An instance of ACLs render (into text)"
     cmd="cibadmin --force --show-access=text -Q --user tony"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow_dir
     rm -f "$TMPXML"
 }
 
 function test_feature_set() {
     create_shadow_cib
 
     # Import the initial test CIB with non-mixed versions
     desc="Import the test CIB"
     cmd="cibadmin --replace --xml-file $test_home/cli/crm_mon-feature_set.xml"
     test_assert $CRM_EX_OK
 
     desc="Complete text output, no mixed status"
     cmd="crm_mon -1 --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, no mixed status"
     cmd="crm_mon --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     # Modify the CIB to fake that the cluster has mixed versions
     desc="Fake inconsistent feature set"
     cmd="crm_attribute --node=cluster02 --name=#feature-set --update=3.15.0 --lifetime=reboot"
     test_assert $CRM_EX_OK
 
     desc="Complete text output, mixed status"
     cmd="crm_mon -1 --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, mixed status"
     cmd="crm_mon --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow_dir
 }
 
 # Process command-line arguments
 while [ $# -gt 0 ]; do
     case "$1" in
         -t)
             tests="$2"
             shift 2
             ;;
         -V|--verbose)
             verbose=1
             shift
             ;;
         -v|--valgrind)
             export G_SLICE=always-malloc
             VALGRIND_CMD="valgrind $VALGRIND_OPTS"
             shift
             ;;
         -s)
             do_save=1
             shift
             ;;
         -p)
             export PATH="$2:$PATH"
             shift
             ;;
         --help)
             echo "$USAGE_TEXT"
             exit $CRM_EX_OK
             ;;
         *)
             echo "error: unknown option $1"
             echo
             echo "$USAGE_TEXT"
             exit $CRM_EX_USAGE
             ;;
     esac
 done
 
 for t in $tests; do
     case "$t" in
         agents) ;;
         daemons) ;;
         dates) ;;
         error_codes) ;;
         tools) ;;
         acls) ;;
         validity) ;;
         upgrade) ;;
         rules) ;;
         crm_mon) ;;
         feature_set) ;;
         *)
             echo "error: unknown test $t"
             echo
             echo "$USAGE_TEXT"
             exit $CRM_EX_USAGE
             ;;
     esac
 done
 
 XMLLINT_CMD=$(which xmllint 2>/dev/null)
 if [ $? -ne 0 ]; then
     XMLLINT_CMD=""
     echo "xmllint is missing - install it to validate command output"
 fi
 
 # Check whether we're running from source directory
 SRCDIR=$(dirname $test_home)
 if [ -x "$SRCDIR/tools/crm_simulate" ]; then
     path_dirs="$SRCDIR/tools"
     for daemon in based controld fenced schedulerd; do
         if [ -x "$SRCDIR/daemons/$daemon/pacemaker-${daemon}" ]; then
             path_dirs="$path_dirs:$SRCDIR/daemons/$daemon"
         fi
     done
     export PATH="$path_dirs:$PATH"
 
     echo "Using local binaries from: ${path_dirs//:/ }"
 
     if [ -x "$SRCDIR/xml" ]; then
         export PCMK_schema_directory="$SRCDIR/xml"
         echo "Using local schemas from: $PCMK_schema_directory"
     fi
 else
     export PATH="@CRM_DAEMON_DIR@:$PATH"
     export PCMK_schema_directory=@CRM_SCHEMA_DIRECTORY@
 fi
 
 for t in $tests; do
     echo "Testing $t"
     TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.$t.XXXXXXXXXX)
     eval TMPFILE_$t="$TMPFILE"
     test_$t > "$TMPFILE"
 
     # last-rc-change= is always numeric in the CIB. However, for the crm_mon
     # test we also need to compare against the XML output of the crm_mon
     # program. There, these are shown as human readable strings (like the
     # output of the `date` command).
     sed -e 's/cib-last-written.*>/>/'\
         -e 's/Last updated: .*/Last updated:/' \
         -e 's/Last change: .*/Last change:/' \
         -e 's/(version .*)/(version)/' \
         -e 's/last_update time=\".*\"/last_update time=\"\"/' \
         -e 's/last_change time=\".*\"/last_change time=\"\"/' \
         -e 's/ api-version="[^"]*"/ api-version="X"/' \
         -e 's/ default="[^"]*"/ default=""/' \
         -e 's/ version="[^"]*"/ version=""/' \
         -e 's/request=\".*\(crm_[a-zA-Z0-9]*\)/request=\"\1/' \
         -e 's/crm_feature_set="[^"]*" //'\
         -e 's/validate-with="[^"]*" //'\
         -e 's/Created new pacemaker-.* configuration/Created new pacemaker configuration/'\
         -e 's/.*\(crm_time_parse_duration\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(crm_time_parse_period\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(crm_time_parse_sec\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(log_xmllib_err\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(parse_date\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(pcmk__.*\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(unpack_.*\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(update_validation\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(apply_upgrade\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e "s/ last-rc-change=['\"][-+A-Za-z0-9: ]*['\"],\{0,1\}//" \
         -e 's|^/tmp/cts-cli\.validity\.bad.xml\.[^:]*:|validity.bad.xml:|'\
         -e 's/^Entity: line [0-9][0-9]*: //'\
         -e 's/\(validation ([0-9][0-9]* of \)[0-9][0-9]*\().*\)/\1X\2/' \
         -e 's/^Migration will take effect until: .*/Migration will take effect until:/' \
         -e 's/ end=\"[0-9][-+: 0-9]*Z*\"/ end=\"\"/' \
         -e 's/ start=\"[0-9][-+: 0-9]*Z*\"/ start=\"\"/' \
         -e 's/^Error checking rule: Device not configured/Error checking rule: No such device or address/' \
         -e 's/Error performing operation: Device not configured/Error performing operation: No such device or address/' \
         -e 's/\(Injecting attribute last-failure-ping#monitor_10000=\)[0-9]*/\1/' \
         -e 's/^lt-//' \
         -e 's/ocf::/ocf:/' \
         -e 's/Masters:/Promoted:/' \
         -e 's/Slaves:/Unpromoted:/' \
         -e 's/Master/Promoted/' \
         -e 's/Slave/Unpromoted/' \
         -e 's/\x1b/\\x1b/' \
         "$TMPFILE" > "${TMPFILE}.$$"
     mv -- "${TMPFILE}.$$" "$TMPFILE"
 
     if [ $do_save -eq 1 ]; then
         cp "$TMPFILE" $test_home/cli/regression.$t.exp
     fi
 done
 
 rm -rf "${shadow_dir}"
 rm -f "${test_assert_outfile}"
 rm -f "${test_assert_errfile}"
-rm -f "${xmllint_errfile}"
+rm -f "${xmllint_outfile}"
 
 failed=0
 
 if [ $verbose -eq 1 ]; then
     echo -e "\n\nResults"
 fi
 for t in $tests; do
     eval TMPFILE="\$TMPFILE_$t"
     if [ $verbose -eq 1 ]; then
         diff -wu $test_home/cli/regression.$t.exp "$TMPFILE"
     else
         diff -w $test_home/cli/regression.$t.exp "$TMPFILE" >/dev/null 2>&1
     fi
     if [ $? -ne 0 ]; then
         failed=1
     fi
 done
 
 echo -e "\n\nSummary"
 for t in $tests; do
     eval TMPFILE="\$TMPFILE_$t"
     grep -e '^\* \(Passed\|Failed\)' "$TMPFILE"
 done
 
 function print_or_remove_file() {
 
   eval TMPFILE="\$TMPFILE_$1"
   if [[ ! $(diff -wq $test_home/cli/regression.$1.exp "$TMPFILE") ]]; then
     rm -f "$TMPFILE"
   else
     echo "    $TMPFILE"
   fi
 }
 
 if [ $num_errors -ne 0 ] && [ $failed -ne 0 ]; then
     echo "$num_errors tests failed; see output in:"
     for t in $tests; do
       print_or_remove_file "$t"
     done
     exit $CRM_EX_ERROR
 elif [ $num_errors -ne 0 ]; then
     echo "$num_errors tests failed"
     for t in $tests; do
       print_or_remove_file "$t"
     done
     exit $CRM_EX_ERROR
 elif [ $failed -eq 1 ]; then
     echo "$num_passed tests passed but output was unexpected; see output in:"
     for t in $tests; do
       print_or_remove_file "$t"
     done
     exit $CRM_EX_DIGEST
 else
     echo $num_passed tests passed
     for t in $tests; do
         eval TMPFILE="\$TMPFILE_$t"
         rm -f "$TMPFILE"
     done
     crm_shadow --force --delete $shadow >/dev/null 2>&1
     exit $CRM_EX_OK
 fi
diff --git a/daemons/attrd/attrd_attributes.c b/daemons/attrd/attrd_attributes.c
index e08908d553..f1da16a934 100644
--- a/daemons/attrd/attrd_attributes.c
+++ b/daemons/attrd/attrd_attributes.c
@@ -1,185 +1,187 @@
 /*
  * Copyright 2013-2022 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU General Public License version 2
  * or later (GPLv2+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 
 #include <errno.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <glib.h>
 
 #include <crm/msg_xml.h>
 #include <crm/common/logging.h>
 #include <crm/common/results.h>
 #include <crm/common/strings_internal.h>
 #include <crm/common/xml.h>
 
 #include "pacemaker-attrd.h"
 
 static attribute_t *
 attrd_create_attribute(xmlNode *xml)
 {
     int dampen = 0;
     const char *value = crm_element_value(xml, PCMK__XA_ATTR_DAMPENING);
     attribute_t *a = calloc(1, sizeof(attribute_t));
 
+    CRM_ASSERT(a != NULL);
+
     a->id      = crm_element_value_copy(xml, PCMK__XA_ATTR_NAME);
     a->set     = crm_element_value_copy(xml, PCMK__XA_ATTR_SET);
     a->uuid    = crm_element_value_copy(xml, PCMK__XA_ATTR_UUID);
     a->values = pcmk__strikey_table(NULL, attrd_free_attribute_value);
 
     crm_element_value_int(xml, PCMK__XA_ATTR_IS_PRIVATE, &a->is_private);
 
     a->user = crm_element_value_copy(xml, PCMK__XA_ATTR_USER);
     crm_trace("Performing all %s operations as user '%s'", a->id, a->user);
 
     if (value != NULL) {
         dampen = crm_get_msec(value);
     }
     crm_trace("Created attribute %s with %s write delay", a->id,
               (a->timeout_ms == 0)? "no" : pcmk__readable_interval(a->timeout_ms));
 
     if(dampen > 0) {
         a->timeout_ms = dampen;
         a->timer = attrd_add_timer(a->id, a->timeout_ms, a);
     } else if (dampen < 0) {
         crm_warn("Ignoring invalid delay %s for attribute %s", value, a->id);
     }
 
     g_hash_table_replace(attributes, a->id, a);
     return a;
 }
 
 static int
 attrd_update_dampening(attribute_t *a, xmlNode *xml, const char *attr)
 {
     const char *dvalue = crm_element_value(xml, PCMK__XA_ATTR_DAMPENING);
     int dampen = 0;
 
     if (dvalue == NULL) {
         crm_warn("Could not update %s: peer did not specify value for delay",
                  attr);
         return EINVAL;
     }
 
     dampen = crm_get_msec(dvalue);
     if (dampen < 0) {
         crm_warn("Could not update %s: invalid delay value %dms (%s)",
                  attr, dampen, dvalue);
         return EINVAL;
     }
 
     if (a->timeout_ms != dampen) {
         mainloop_timer_del(a->timer);
         a->timeout_ms = dampen;
         if (dampen > 0) {
             a->timer = attrd_add_timer(attr, a->timeout_ms, a);
             crm_info("Update attribute %s delay to %dms (%s)",
                      attr, dampen, dvalue);
         } else {
             a->timer = NULL;
             crm_info("Update attribute %s to remove delay", attr);
         }
 
         /* If dampening changed, do an immediate write-out,
          * otherwise repeated dampening changes would prevent write-outs
          */
         attrd_write_or_elect_attribute(a);
     }
 
     return pcmk_rc_ok;
 }
 
 GHashTable *attributes = NULL;
 
 /*!
  * \internal
  * \brief Create an XML representation of an attribute for use in peer messages
  *
  * \param[in,out] parent      Create attribute XML as child element of this
  * \param[in]     a           Attribute to represent
  * \param[in]     v           Attribute value to represent
  * \param[in]     force_write If true, value should be written even if unchanged
  *
  * \return XML representation of attribute
  */
 xmlNode *
 attrd_add_value_xml(xmlNode *parent, const attribute_t *a,
                     const attribute_value_t *v, bool force_write)
 {
     xmlNode *xml = create_xml_node(parent, __func__);
 
     crm_xml_add(xml, PCMK__XA_ATTR_NAME, a->id);
     crm_xml_add(xml, PCMK__XA_ATTR_SET, a->set);
     crm_xml_add(xml, PCMK__XA_ATTR_UUID, a->uuid);
     crm_xml_add(xml, PCMK__XA_ATTR_USER, a->user);
     pcmk__xe_add_node(xml, v->nodename, v->nodeid);
     if (v->is_remote != 0) {
         crm_xml_add_int(xml, PCMK__XA_ATTR_IS_REMOTE, 1);
     }
     crm_xml_add(xml, PCMK__XA_ATTR_VALUE, v->current);
     crm_xml_add_int(xml, PCMK__XA_ATTR_DAMPENING, a->timeout_ms / 1000);
     crm_xml_add_int(xml, PCMK__XA_ATTR_IS_PRIVATE, a->is_private);
     crm_xml_add_int(xml, PCMK__XA_ATTR_FORCE, force_write);
 
     return xml;
 }
 
 void
 attrd_clear_value_seen(void)
 {
     GHashTableIter aIter;
     GHashTableIter vIter;
     attribute_t *a;
     attribute_value_t *v = NULL;
 
     g_hash_table_iter_init(&aIter, attributes);
     while (g_hash_table_iter_next(&aIter, NULL, (gpointer *) & a)) {
         g_hash_table_iter_init(&vIter, a->values);
         while (g_hash_table_iter_next(&vIter, NULL, (gpointer *) & v)) {
             v->seen = FALSE;
             crm_trace("Clear seen flag %s[%s] = %s.", a->id, v->nodename, v->current);
         }
     }
 }
 
 attribute_t *
 attrd_populate_attribute(xmlNode *xml, const char *attr)
 {
     attribute_t *a = NULL;
     bool update_both = false;
 
     const char *op = crm_element_value(xml, PCMK__XA_TASK);
 
     // NULL because PCMK__ATTRD_CMD_SYNC_RESPONSE has no PCMK__XA_TASK
     update_both = pcmk__str_eq(op, PCMK__ATTRD_CMD_UPDATE_BOTH,
                                pcmk__str_null_matches);
 
     // Look up or create attribute entry
     a = g_hash_table_lookup(attributes, attr);
     if (a == NULL) {
         if (update_both || pcmk__str_eq(op, PCMK__ATTRD_CMD_UPDATE, pcmk__str_none)) {
             a = attrd_create_attribute(xml);
         } else {
             crm_warn("Could not update %s: attribute not found", attr);
             return NULL;
         }
     }
 
     // Update attribute dampening
     if (update_both || pcmk__str_eq(op, PCMK__ATTRD_CMD_UPDATE_DELAY, pcmk__str_none)) {
         int rc = attrd_update_dampening(a, xml, attr);
 
         if (rc != pcmk_rc_ok || !update_both) {
             return NULL;
         }
     }
 
     return a;
 }
diff --git a/lib/pacemaker/pcmk_sched_migration.c b/lib/pacemaker/pcmk_sched_migration.c
index 0e302d325c..7e6ba8ef90 100644
--- a/lib/pacemaker/pcmk_sched_migration.c
+++ b/lib/pacemaker/pcmk_sched_migration.c
@@ -1,383 +1,386 @@
 /*
  * Copyright 2004-2022 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU General Public License version 2
  * or later (GPLv2+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 
 #include <stdbool.h>
 
 #include <crm/msg_xml.h>
 #include <pacemaker-internal.h>
 
 #include "libpacemaker_private.h"
 
 /*!
  * \internal
  * \brief Add migration source and target meta-attributes to an action
  *
  * \param[in,out] action  Action to add meta-attributes to
  * \param[in]     source  Node to add as migration source
  * \param[in]     target  Node to add as migration target
  */
 static void
 add_migration_meta(pe_action_t *action, const pe_node_t *source,
                    const pe_node_t *target)
 {
     add_hash_param(action->meta, XML_LRM_ATTR_MIGRATE_SOURCE,
                    source->details->uname);
 
     add_hash_param(action->meta, XML_LRM_ATTR_MIGRATE_TARGET,
                    target->details->uname);
 }
 
 /*!
  * \internal
  * \brief Create internal migration actions for a migrateable resource
  *
  * \param[in,out] rsc      Resource to create migration actions for
  * \param[in]     current  Node that resource is originally active on
  */
 void
 pcmk__create_migration_actions(pe_resource_t *rsc, const pe_node_t *current)
 {
     pe_action_t *migrate_to = NULL;
     pe_action_t *migrate_from = NULL;
     pe_action_t *start = NULL;
     pe_action_t *stop = NULL;
 
     pe_rsc_trace(rsc, "Creating actions to %smigrate %s from %s to %s",
                  ((rsc->partial_migration_target == NULL)? "" : "partially "),
                  rsc->id, pe__node_name(current),
                  pe__node_name(rsc->allocated_to));
     start = start_action(rsc, rsc->allocated_to, TRUE);
     stop = stop_action(rsc, current, TRUE);
 
     if (rsc->partial_migration_target == NULL) {
         migrate_to = custom_action(rsc, pcmk__op_key(rsc->id, RSC_MIGRATE, 0),
                                    RSC_MIGRATE, current, TRUE, TRUE,
                                    rsc->cluster);
     }
     migrate_from = custom_action(rsc, pcmk__op_key(rsc->id, RSC_MIGRATED, 0),
                                  RSC_MIGRATED, rsc->allocated_to, TRUE, TRUE,
                                  rsc->cluster);
 
     if ((migrate_from != NULL)
         && ((migrate_to != NULL) || (rsc->partial_migration_target != NULL))) {
 
         pe__set_action_flags(start, pe_action_migrate_runnable);
         pe__set_action_flags(stop, pe_action_migrate_runnable);
 
         // This is easier than trying to delete it from the graph
         pe__set_action_flags(start, pe_action_pseudo);
 
         if (rsc->partial_migration_target == NULL) {
             pe__set_action_flags(migrate_from, pe_action_migrate_runnable);
-            pe__set_action_flags(migrate_to, pe_action_migrate_runnable);
-            migrate_to->needs = start->needs;
+
+            if (migrate_to != NULL) {
+                pe__set_action_flags(migrate_to, pe_action_migrate_runnable);
+                migrate_to->needs = start->needs;
+            }
 
             // Probe -> migrate_to -> migrate_from
             pcmk__new_ordering(rsc, pcmk__op_key(rsc->id, RSC_STATUS, 0), NULL,
                                rsc, pcmk__op_key(rsc->id, RSC_MIGRATE, 0),
                                NULL, pe_order_optional, rsc->cluster);
             pcmk__new_ordering(rsc, pcmk__op_key(rsc->id, RSC_MIGRATE, 0), NULL,
                                rsc, pcmk__op_key(rsc->id, RSC_MIGRATED, 0),
                                NULL,
                                pe_order_optional|pe_order_implies_first_migratable,
                                rsc->cluster);
         } else {
             pe__set_action_flags(migrate_from, pe_action_migrate_runnable);
             migrate_from->needs = start->needs;
 
             // Probe -> migrate_from (migrate_to already completed)
             pcmk__new_ordering(rsc, pcmk__op_key(rsc->id, RSC_STATUS, 0), NULL,
                                rsc, pcmk__op_key(rsc->id, RSC_MIGRATED, 0),
                                NULL, pe_order_optional, rsc->cluster);
         }
 
         // migrate_from before stop or start
         pcmk__new_ordering(rsc, pcmk__op_key(rsc->id, RSC_MIGRATED, 0), NULL,
                            rsc, pcmk__op_key(rsc->id, RSC_STOP, 0), NULL,
                            pe_order_optional|pe_order_implies_first_migratable,
                            rsc->cluster);
         pcmk__new_ordering(rsc, pcmk__op_key(rsc->id, RSC_MIGRATED, 0), NULL,
                            rsc, pcmk__op_key(rsc->id, RSC_START, 0), NULL,
                            pe_order_optional|pe_order_implies_first_migratable|pe_order_pseudo_left,
                            rsc->cluster);
     }
 
     if (migrate_to != NULL) {
         add_migration_meta(migrate_to, current, rsc->allocated_to);
 
         if (!rsc->is_remote_node) {
             /* migrate_to takes place on the source node, but can affect the
              * target node depending on how the agent is written. Because of
              * this, pending migrate_to actions must be recorded in the CIB,
              * in case the source node loses membership while the migrate_to
              * action is still in flight.
              *
              * However we know Pacemaker Remote connection resources don't
              * require this, so we skip this for them. (Although it wouldn't
              * hurt, and now that record-pending defaults to true, skipping it
              * matters even less.)
              */
             add_hash_param(migrate_to->meta, XML_OP_ATTR_PENDING, "true");
         }
     }
 
     if (migrate_from != NULL) {
         add_migration_meta(migrate_from, current, rsc->allocated_to);
     }
 }
 
 /*!
  * \internal
  * \brief Abort a dangling migration by scheduling a stop (and possibly cleanup)
  *
  * \param[in]     data       Source node of dangling migration
  * \param[in,out] user_data  Resource involved in dangling migration
  */
 void
 pcmk__abort_dangling_migration(void *data, void *user_data)
 {
     const pe_node_t *dangling_source = (const pe_node_t *) data;
     pe_resource_t *rsc = (pe_resource_t *) user_data;
 
     pe_action_t *stop = NULL;
     bool cleanup = pcmk_is_set(rsc->cluster->flags, pe_flag_remove_after_stop);
 
     pe_rsc_trace(rsc,
                  "Scheduling stop%s for %s on %s due to dangling migration",
                  (cleanup? " and cleanup" : ""), rsc->id,
                  pe__node_name(dangling_source));
     stop = stop_action(rsc, dangling_source, FALSE);
     pe__set_action_flags(stop, pe_action_dangle);
     if (cleanup) {
         pcmk__schedule_cleanup(rsc, dangling_source, false);
     }
 }
 
 /*!
  * \internal
  * \brief Check whether a resource can migrate
  *
  * \param[in] rsc   Resource to check
  * \param[in] node  Resource's current node
  *
  * \return true if \p rsc can migrate, otherwise false
  */
 bool
 pcmk__rsc_can_migrate(const pe_resource_t *rsc, const pe_node_t *current)
 {
     CRM_CHECK(rsc != NULL, return false);
 
     if (!pcmk_is_set(rsc->flags, pe_rsc_allow_migrate)) {
         pe_rsc_trace(rsc, "%s cannot migrate because "
                           "the configuration does not allow it",
                      rsc->id);
         return false;
     }
 
     if (!pcmk_is_set(rsc->flags, pe_rsc_managed)) {
         pe_rsc_trace(rsc, "%s cannot migrate because it is not managed",
                      rsc->id);
         return false;
     }
 
     if (pcmk_is_set(rsc->flags, pe_rsc_failed)) {
         pe_rsc_trace(rsc, "%s cannot migrate because it is failed",
                      rsc->id);
         return false;
     }
 
     if (pcmk_is_set(rsc->flags, pe_rsc_start_pending)) {
         pe_rsc_trace(rsc, "%s cannot migrate because it has a start pending",
                      rsc->id);
         return false;
     }
 
     if ((current == NULL) || current->details->unclean) {
         pe_rsc_trace(rsc, "%s cannot migrate because "
                           "its current node (%s) is unclean",
                      rsc->id, pe__node_name(current));
         return false;
     }
 
     if ((rsc->allocated_to == NULL) || rsc->allocated_to->details->unclean) {
         pe_rsc_trace(rsc, "%s cannot migrate because "
                           "its next node (%s) is unclean",
                      rsc->id, pe__node_name(rsc->allocated_to));
         return false;
     }
 
     return true;
 }
 
 /*!
  * \internal
  * \brief Get an action name from an action or operation key
  *
  * \param[in] action  If not NULL, get action name from here
  * \param[in] key     If not NULL, get action name from here
  *
  * \return Newly allocated copy of action name (or NULL if none available)
  */
 static char *
 task_from_action_or_key(const pe_action_t *action, const char *key)
 {
     char *res = NULL;
 
     if (action != NULL) {
         res = strdup(action->task);
         CRM_ASSERT(res != NULL);
     } else if (key != NULL) {
         parse_op_key(key, NULL, &res, NULL);
     }
     return res;
 }
 
 /*!
  * \internal
  * \brief Order migration actions equivalent to a given ordering
  *
  * Orderings involving start, stop, demote, and promote actions must be honored
  * during a migration as well, so duplicate any such ordering for the
  * corresponding migration actions.
  *
  * \param[in,out] order     Ordering constraint to check
  */
 void
 pcmk__order_migration_equivalents(pe__ordering_t *order)
 {
     char *first_task = NULL;
     char *then_task = NULL;
     bool then_migratable;
     bool first_migratable;
 
     // Only orderings between unrelated resources are relevant
     if ((order->lh_rsc == NULL) || (order->rh_rsc == NULL)
         || (order->lh_rsc == order->rh_rsc)
         || is_parent(order->lh_rsc, order->rh_rsc)
         || is_parent(order->rh_rsc, order->lh_rsc)) {
         return;
     }
 
     // Only orderings involving at least one migratable resource are relevant
     first_migratable = pcmk_is_set(order->lh_rsc->flags, pe_rsc_allow_migrate);
     then_migratable = pcmk_is_set(order->rh_rsc->flags, pe_rsc_allow_migrate);
     if (!first_migratable && !then_migratable) {
         return;
     }
 
     // Check which actions are involved
     first_task = task_from_action_or_key(order->lh_action,
                                          order->lh_action_task);
     then_task = task_from_action_or_key(order->rh_action,
                                         order->rh_action_task);
 
     if (pcmk__str_eq(first_task, RSC_START, pcmk__str_none)
         && pcmk__str_eq(then_task, RSC_START, pcmk__str_none)) {
 
         uint32_t flags = pe_order_optional;
 
         if (first_migratable && then_migratable) {
             /* A start then B start
              * -> A migrate_from then B migrate_to */
             pcmk__new_ordering(order->lh_rsc,
                                pcmk__op_key(order->lh_rsc->id, RSC_MIGRATED, 0),
                                NULL, order->rh_rsc,
                                pcmk__op_key(order->rh_rsc->id, RSC_MIGRATE, 0),
                                NULL, flags, order->lh_rsc->cluster);
         }
 
         if (then_migratable) {
             if (first_migratable) {
                 pe__set_order_flags(flags, pe_order_apply_first_non_migratable);
             }
 
             /* A start then B start
              * -> A start then B migrate_to (if start is not part of a
              *    migration)
              */
             pcmk__new_ordering(order->lh_rsc,
                                pcmk__op_key(order->lh_rsc->id, RSC_START, 0),
                                NULL, order->rh_rsc,
                                pcmk__op_key(order->rh_rsc->id, RSC_MIGRATE, 0),
                                NULL, flags, order->lh_rsc->cluster);
         }
 
     } else if (then_migratable
                && pcmk__str_eq(first_task, RSC_STOP, pcmk__str_none)
                && pcmk__str_eq(then_task, RSC_STOP, pcmk__str_none)) {
 
         uint32_t flags = pe_order_optional;
 
         if (first_migratable) {
             pe__set_order_flags(flags, pe_order_apply_first_non_migratable);
         }
 
         /* For an ordering "stop A then stop B", if A is moving via restart, and
          * B is migrating, enforce that B's migrate_to occurs after A's stop.
          */
         pcmk__new_ordering(order->lh_rsc,
                            pcmk__op_key(order->lh_rsc->id, RSC_STOP, 0), NULL,
                            order->rh_rsc,
                            pcmk__op_key(order->rh_rsc->id, RSC_MIGRATE, 0),
                            NULL, flags, order->lh_rsc->cluster);
 
         // Also order B's migrate_from after A's stop during partial migrations
         if (order->rh_rsc->partial_migration_target) {
             pcmk__new_ordering(order->lh_rsc,
                                pcmk__op_key(order->lh_rsc->id, RSC_STOP, 0),
                                NULL, order->rh_rsc,
                                pcmk__op_key(order->rh_rsc->id, RSC_MIGRATED, 0),
                                NULL, flags, order->lh_rsc->cluster);
         }
 
     } else if (pcmk__str_eq(first_task, RSC_PROMOTE, pcmk__str_none)
                && pcmk__str_eq(then_task, RSC_START, pcmk__str_none)) {
 
         uint32_t flags = pe_order_optional;
 
         if (then_migratable) {
             /* A promote then B start
              * -> A promote then B migrate_to */
             pcmk__new_ordering(order->lh_rsc,
                                pcmk__op_key(order->lh_rsc->id, RSC_PROMOTE, 0),
                                NULL, order->rh_rsc,
                                pcmk__op_key(order->rh_rsc->id, RSC_MIGRATE, 0),
                                NULL, flags, order->lh_rsc->cluster);
         }
 
     } else if (pcmk__str_eq(first_task, RSC_DEMOTE, pcmk__str_none)
                && pcmk__str_eq(then_task, RSC_STOP, pcmk__str_none)) {
 
         uint32_t flags = pe_order_optional;
 
         if (then_migratable) {
             /* A demote then B stop
              * -> A demote then B migrate_to */
             pcmk__new_ordering(order->lh_rsc,
                                pcmk__op_key(order->lh_rsc->id, RSC_DEMOTE, 0),
                                NULL, order->rh_rsc,
                                pcmk__op_key(order->rh_rsc->id, RSC_MIGRATE, 0),
                                NULL, flags, order->lh_rsc->cluster);
 
             // Also order B migrate_from after A demote during partial migrations
             if (order->rh_rsc->partial_migration_target) {
                 pcmk__new_ordering(order->lh_rsc,
                                    pcmk__op_key(order->lh_rsc->id, RSC_DEMOTE, 0),
                                    NULL, order->rh_rsc,
                                    pcmk__op_key(order->rh_rsc->id, RSC_MIGRATED, 0),
                                    NULL, flags, order->lh_rsc->cluster);
             }
         }
     }
 
     free(first_task);
     free(then_task);
 }
diff --git a/lib/pengine/pe_notif.c b/lib/pengine/pe_notif.c
index 4427358e0e..3d090f1188 100644
--- a/lib/pengine/pe_notif.c
+++ b/lib/pengine/pe_notif.c
@@ -1,983 +1,992 @@
 /*
  * Copyright 2004-2022 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU General Public License version 2
  * or later (GPLv2+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 #include <crm/msg_xml.h>
 #include <pacemaker-internal.h>
 
 typedef struct notify_entry_s {
     pe_resource_t *rsc;
     pe_node_t *node;
 } notify_entry_t;
 
 /*!
  * \internal
  * \brief Compare two notification entries
  *
  * Compare two notification entries, where the one with the alphabetically first
  * resource name (or if equal, node name) sorts as first, with NULL sorting as
  * less than non-NULL.
  *
  * \param[in] a  First notification entry to compare
  * \param[in] b  Second notification entry to compare
  *
  * \return -1 if \p a sorts before \p b, 0 if they are equal, otherwise 1
  */
 static gint
 compare_notify_entries(gconstpointer a, gconstpointer b)
 {
     int tmp;
     const notify_entry_t *entry_a = a;
     const notify_entry_t *entry_b = b;
 
     // NULL a or b is not actually possible
     if ((entry_a == NULL) && (entry_b == NULL)) {
         return 0;
     }
     if (entry_a == NULL) {
         return 1;
     }
     if (entry_b == NULL) {
         return -1;
     }
 
     // NULL resources sort first
     if ((entry_a->rsc == NULL) && (entry_b->rsc == NULL)) {
         return 0;
     }
     if (entry_a->rsc == NULL) {
         return 1;
     }
     if (entry_b->rsc == NULL) {
         return -1;
     }
 
     // Compare resource names
     tmp = strcmp(entry_a->rsc->id, entry_b->rsc->id);
     if (tmp != 0) {
         return tmp;
     }
 
     // Otherwise NULL nodes sort first
     if ((entry_a->node == NULL) && (entry_b->node == NULL)) {
         return 0;
     }
     if (entry_a->node == NULL) {
         return 1;
     }
     if (entry_b->node == NULL) {
         return -1;
     }
 
     // Finally, compare node names
     return strcmp(entry_a->node->details->id, entry_b->node->details->id);
 }
 
 /*!
  * \internal
  * \brief Duplicate a notification entry
  *
  * \param[in] entry  Entry to duplicate
  *
  * \return Newly allocated duplicate of \p entry
  * \note It is the caller's responsibility to free the return value.
  */
 static notify_entry_t *
 dup_notify_entry(notify_entry_t *entry)
 {
     notify_entry_t *dup = calloc(1, sizeof(notify_entry_t));
 
     CRM_ASSERT(dup != NULL);
     dup->rsc = entry->rsc;
     dup->node = entry->node;
     return dup;
 }
 
 /*!
  * \internal
  * \brief Given a list of nodes, create strings with node names
  *
  * \param[in]  list             List of nodes (as pe_node_t *)
  * \param[out] all_node_names   If not NULL, will be set to space-separated list
  *                              of the names of all nodes in \p list
  * \param[out] host_node_names  Same as \p all_node_names, except active
  *                              guest nodes will list the name of their host
  *
  * \note The caller is responsible for freeing the output argument values using
  *       \p g_string_free().
  */
 static void
 get_node_names(GList *list, GString **all_node_names, GString **host_node_names)
 {
     if (all_node_names != NULL) {
         *all_node_names = NULL;
     }
     if (host_node_names != NULL) {
         *host_node_names = NULL;
     }
 
     for (GList *iter = list; iter != NULL; iter = iter->next) {
         pe_node_t *node = (pe_node_t *) iter->data;
 
         if (node->details->uname == NULL) {
             continue;
         }
 
         // Always add to list of all node names
         if (all_node_names != NULL) {
             pcmk__add_word(all_node_names, 1024, node->details->uname);
         }
 
         // Add to host node name list if appropriate
         if (host_node_names != NULL) {
             if (pe__is_guest_node(node)
                 && (node->details->remote_rsc->container->running_on != NULL)) {
                 node = pe__current_node(node->details->remote_rsc->container);
                 if (node->details->uname == NULL) {
                     continue;
                 }
             }
             pcmk__add_word(host_node_names, 1024, node->details->uname);
         }
     }
 
     if ((all_node_names != NULL) && (*all_node_names == NULL)) {
         *all_node_names = g_string_new(" ");
     }
     if ((host_node_names != NULL) && (*host_node_names == NULL)) {
         *host_node_names = g_string_new(" ");
     }
 }
 
 /*!
  * \internal
  * \brief Create strings of instance and node names from notification entries
  *
  * \param[in,out] list        List of notification entries (will be sorted here)
  * \param[out]    rsc_names   If not NULL, will be set to space-separated list
  *                            of clone instances from \p list
  * \param[out]    node_names  If not NULL, will be set to space-separated list
  *                            of node names from \p list
  *
  * \return (Possibly new) head of sorted \p list
  * \note The caller is responsible for freeing the output argument values using
  *       \p g_list_free_full() and \p g_string_free().
  */
 static GList *
 notify_entries_to_strings(GList *list, GString **rsc_names,
                           GString **node_names)
 {
     const char *last_rsc_id = NULL;
 
     // Initialize output lists to NULL
     if (rsc_names != NULL) {
         *rsc_names = NULL;
     }
     if (node_names != NULL) {
         *node_names = NULL;
     }
 
     // Sort input list for user-friendliness (and ease of filtering duplicates)
     list = g_list_sort(list, compare_notify_entries);
 
     for (GList *gIter = list; gIter != NULL; gIter = gIter->next) {
         notify_entry_t *entry = (notify_entry_t *) gIter->data;
 
         // Entry must have a resource (with ID)
         CRM_LOG_ASSERT((entry != NULL) && (entry->rsc != NULL)
                        && (entry->rsc->id != NULL));
         if ((entry == NULL) || (entry->rsc == NULL)
             || (entry->rsc->id == NULL)) {
             continue;
         }
 
         // Entry must have a node unless listing inactive resources
         CRM_LOG_ASSERT((node_names == NULL) || (entry->node != NULL));
         if ((node_names != NULL) && (entry->node == NULL)) {
             continue;
         }
 
         // Don't add duplicates of a particular clone instance
         if (pcmk__str_eq(entry->rsc->id, last_rsc_id, pcmk__str_none)) {
             continue;
         }
         last_rsc_id = entry->rsc->id;
 
         if (rsc_names != NULL) {
             pcmk__add_word(rsc_names, 1024, entry->rsc->id);
         }
         if ((node_names != NULL) && (entry->node->details->uname != NULL)) {
             pcmk__add_word(node_names, 1024, entry->node->details->uname);
         }
     }
 
     // If there are no entries, return "empty" lists
     if ((rsc_names != NULL) && (*rsc_names == NULL)) {
         *rsc_names = g_string_new(" ");
     }
     if ((node_names != NULL) && (*node_names == NULL)) {
         *node_names = g_string_new(" ");
     }
 
     return list;
 }
 
 /*!
  * \internal
  * \brief Copy a meta-attribute into a notify action
  *
  * \param[in] key        Name of meta-attribute to copy
  * \param[in] value      Value of meta-attribute to copy
  * \param[in] user_data  Notify action to copy into
  */
 static void
 copy_meta_to_notify(gpointer key, gpointer value, gpointer user_data)
 {
     pe_action_t *notify = (pe_action_t *) user_data;
 
     /* Any existing meta-attributes (for example, the action timeout) are for
      * the notify action itself, so don't override those.
      */
     if (g_hash_table_lookup(notify->meta, (const char *) key) != NULL) {
         return;
     }
 
     g_hash_table_insert(notify->meta, strdup((const char *) key),
                         strdup((const char *) value));
 }
 
 static void
 add_notify_data_to_action_meta(notify_data_t *n_data, pe_action_t *action)
 {
     for (GSList *item = n_data->keys; item; item = item->next) {
         pcmk_nvpair_t *nvpair = item->data;
 
         add_hash_param(action->meta, nvpair->name, nvpair->value);
     }
 }
 
 /*!
  * \internal
  * \brief Create a new notify pseudo-action for a clone resource
  *
  * \param[in] rsc           Clone resource that notification is for
  * \param[in] action        Action to use in notify action key
  * \param[in] notif_action  RSC_NOTIFY or RSC_NOTIFIED
  * \param[in] notif_type    "pre", "post", "confirmed-pre", or "confirmed-post"
  *
  * \return Newly created notify pseudo-action
  */
 static pe_action_t *
 new_notify_pseudo_action(pe_resource_t *rsc, const pe_action_t *action,
                          const char *notif_action, const char *notif_type)
 {
     pe_action_t *notify = NULL;
 
     notify = custom_action(rsc,
                            pcmk__notify_key(rsc->id, notif_type, action->task),
                            notif_action, NULL,
                            pcmk_is_set(action->flags, pe_action_optional),
                            TRUE, rsc->cluster);
     pe__set_action_flags(notify, pe_action_pseudo);
     add_hash_param(notify->meta, "notify_key_type", notif_type);
     add_hash_param(notify->meta, "notify_key_operation", action->task);
     return notify;
 }
 
 /*!
  * \internal
  * \brief Create a new notify action for a clone instance
  *
  * \param[in] rsc           Clone instance that notification is for
  * \param[in] node          Node that notification is for
  * \param[in] op            Action that notification is for
  * \param[in] notify_done   Parent pseudo-action for notifications complete
  * \param[in] n_data        Notification values to add to action meta-data
  *
  * \return Newly created notify action
  */
 static pe_action_t *
 new_notify_action(pe_resource_t *rsc, pe_node_t *node, pe_action_t *op,
                   pe_action_t *notify_done, notify_data_t *n_data)
 {
     char *key = NULL;
     pe_action_t *notify_action = NULL;
     const char *value = NULL;
     const char *task = NULL;
     const char *skip_reason = NULL;
 
     CRM_CHECK((rsc != NULL) && (node != NULL), return NULL);
 
     // Ensure we have all the info we need
     if (op == NULL) {
         skip_reason = "no action";
     } else if (notify_done == NULL) {
         skip_reason = "no parent notification";
     } else if (!node->details->online) {
         skip_reason = "node offline";
     } else if (!pcmk_is_set(op->flags, pe_action_runnable)) {
         skip_reason = "original action not runnable";
     }
     if (skip_reason != NULL) {
         pe_rsc_trace(rsc, "Skipping notify action for %s on %s: %s",
                      rsc->id, pe__node_name(node), skip_reason);
         return NULL;
     }
 
     value = g_hash_table_lookup(op->meta, "notify_type");     // "pre" or "post"
     task = g_hash_table_lookup(op->meta, "notify_operation"); // original action
 
     pe_rsc_trace(rsc, "Creating notify action for %s on %s (%s-%s)",
                  rsc->id, pe__node_name(node), value, task);
 
     // Create the notify action
     key = pcmk__notify_key(rsc->id, value, task);
     notify_action = custom_action(rsc, key, op->task, node,
                                   pcmk_is_set(op->flags, pe_action_optional),
                                   TRUE, rsc->cluster);
 
     // Add meta-data to notify action
     g_hash_table_foreach(op->meta, copy_meta_to_notify, notify_action);
     add_notify_data_to_action_meta(n_data, notify_action);
 
     // Order notify after original action and before parent notification
     order_actions(op, notify_action, pe_order_optional);
     order_actions(notify_action, notify_done, pe_order_optional);
     return notify_action;
 }
 
 /*!
  * \internal
  * \brief Create a new "post-" notify action for a clone instance
  *
  * \param[in] rsc           Clone instance that notification is for
  * \param[in] node          Node that notification is for
  * \param[in] n_data        Notification values to add to action meta-data
  */
 static void
 new_post_notify_action(pe_resource_t *rsc, pe_node_t *node,
                        notify_data_t *n_data)
 {
     pe_action_t *notify = NULL;
 
+    CRM_ASSERT(n_data != NULL);
+
     // Create the "post-" notify action for specified instance
     notify = new_notify_action(rsc, node, n_data->post, n_data->post_done,
                                n_data);
     if (notify != NULL) {
         notify->priority = INFINITY;
     }
 
     // Order recurring monitors after all "post-" notifications complete
     if (n_data->post_done == NULL) {
         return;
     }
     for (GList *iter = rsc->actions; iter != NULL; iter = iter->next) {
         pe_action_t *mon = (pe_action_t *) iter->data;
         const char *interval_ms_s = NULL;
 
         interval_ms_s = g_hash_table_lookup(mon->meta,
                                             XML_LRM_ATTR_INTERVAL_MS);
         if (pcmk__str_eq(interval_ms_s, "0", pcmk__str_null_matches)
             || pcmk__str_eq(mon->task, RSC_CANCEL, pcmk__str_none)) {
             continue; // Not a recurring monitor
         }
         order_actions(n_data->post_done, mon, pe_order_optional);
     }
 }
 
 /*!
  * \internal
  * \brief Create and order notification pseudo-actions for a clone action
  *
  * In addition to the actual notify actions needed for each clone instance,
  * clone notifications also require pseudo-actions to provide ordering points
  * in the notification process. This creates the notification data, along with
  * appropriate pseudo-actions and their orderings.
  *
  * For example, the ordering sequence for starting a clone is:
  *
  *     "pre-" notify pseudo-action for clone
  *     -> "pre-" notify actions for each clone instance
  *     -> "pre-" notifications complete pseudo-action for clone
  *     -> start actions for each clone instance
  *     -> "started" pseudo-action for clone
  *     -> "post-" notify pseudo-action for clone
  *     -> "post-" notify actions for each clone instance
  *     -> "post-" notifications complete pseudo-action for clone
  *
  * \param[in] rsc       Clone that notifications are for
  * \param[in] task      Name of action that notifications are for
  * \param[in] action    If not NULL, create a "pre-" pseudo-action ordered
  *                      before a "pre-" complete pseudo-action, ordered before
  *                      this action
  * \param[in] complete  If not NULL, create a "post-" pseudo-action ordered
  *                      after this action, and a "post-" complete pseudo-action
  *                      ordered after that
  *
  * \return Newly created notification data
  */
 notify_data_t *
 pe__clone_notif_pseudo_ops(pe_resource_t *rsc, const char *task,
                            pe_action_t *action, pe_action_t *complete)
 {
     notify_data_t *n_data = NULL;
 
     if (!pcmk_is_set(rsc->flags, pe_rsc_notify)) {
         return NULL;
     }
 
     n_data = calloc(1, sizeof(notify_data_t));
     CRM_ASSERT(n_data != NULL);
 
     n_data->action = task;
 
     if (action != NULL) { // Need "pre-" pseudo-actions
 
         // Create "pre-" notify pseudo-action for clone
         n_data->pre = new_notify_pseudo_action(rsc, action, RSC_NOTIFY, "pre");
         pe__set_action_flags(n_data->pre, pe_action_runnable);
         add_hash_param(n_data->pre->meta, "notify_type", "pre");
         add_hash_param(n_data->pre->meta, "notify_operation", n_data->action);
 
         // Create "pre-" notifications complete pseudo-action for clone
         n_data->pre_done = new_notify_pseudo_action(rsc, action, RSC_NOTIFIED,
                                                     "confirmed-pre");
         pe__set_action_flags(n_data->pre_done, pe_action_runnable);
         add_hash_param(n_data->pre_done->meta, "notify_type", "pre");
         add_hash_param(n_data->pre_done->meta,
                        "notify_operation", n_data->action);
 
         // Order "pre-" -> "pre-" complete -> original action
         order_actions(n_data->pre, n_data->pre_done, pe_order_optional);
         order_actions(n_data->pre_done, action, pe_order_optional);
     }
 
     if (complete != NULL) { // Need "post-" pseudo-actions
 
         // Create "post-" notify pseudo-action for clone
         n_data->post = new_notify_pseudo_action(rsc, complete, RSC_NOTIFY,
                                                 "post");
         n_data->post->priority = INFINITY;
         if (pcmk_is_set(complete->flags, pe_action_runnable)) {
             pe__set_action_flags(n_data->post, pe_action_runnable);
         } else {
             pe__clear_action_flags(n_data->post, pe_action_runnable);
         }
         add_hash_param(n_data->post->meta, "notify_type", "post");
         add_hash_param(n_data->post->meta, "notify_operation", n_data->action);
 
         // Create "post-" notifications complete pseudo-action for clone
         n_data->post_done = new_notify_pseudo_action(rsc, complete,
                                                      RSC_NOTIFIED,
                                                      "confirmed-post");
         n_data->post_done->priority = INFINITY;
         if (pcmk_is_set(complete->flags, pe_action_runnable)) {
             pe__set_action_flags(n_data->post_done, pe_action_runnable);
         } else {
             pe__clear_action_flags(n_data->post_done, pe_action_runnable);
         }
         add_hash_param(n_data->post_done->meta, "notify_type", "post");
         add_hash_param(n_data->post_done->meta,
                        "notify_operation", n_data->action);
 
         // Order original action complete -> "post-" -> "post-" complete
         order_actions(complete, n_data->post, pe_order_implies_then);
         order_actions(n_data->post, n_data->post_done, pe_order_implies_then);
     }
 
     // If we created both, order "pre-" complete -> "post-"
     if ((action != NULL) && (complete != NULL)) {
         order_actions(n_data->pre_done, n_data->post, pe_order_optional);
     }
     return n_data;
 }
 
 /*!
  * \internal
  * \brief Create a new notification entry
  *
  * \param[in] rsc   Resource for notification
  * \param[in] node  Node for notification
  *
  * \return Newly allocated notification entry
  * \note The caller is responsible for freeing the return value.
  */
 static notify_entry_t *
 new_notify_entry(pe_resource_t *rsc, pe_node_t *node)
 {
     notify_entry_t *entry = calloc(1, sizeof(notify_entry_t));
 
     CRM_ASSERT(entry != NULL);
     entry->rsc = rsc;
     entry->node = node;
     return entry;
 }
 
 /*!
  * \internal
  * \brief Add notification data for resource state and optionally actions
  *
  * \param[in] rsc        Clone or clone instance being notified
  * \param[in] activity   Whether to add notification entries for actions
  * \param[in] n_data     Notification data for clone
  */
 static void
 collect_resource_data(pe_resource_t *rsc, bool activity, notify_data_t *n_data)
 {
     GList *iter = NULL;
     notify_entry_t *entry = NULL;
     pe_node_t *node = NULL;
 
+    if (n_data == NULL) {
+        return;
+    }
+
     if (n_data->allowed_nodes == NULL) {
         n_data->allowed_nodes = rsc->allowed_nodes;
     }
 
     // If this is a clone, call recursively for each instance
     if (rsc->children != NULL) {
         for (iter = rsc->children; iter != NULL; iter = iter->next) {
             pe_resource_t *child = (pe_resource_t *) iter->data;
 
             collect_resource_data(child, activity, n_data);
         }
         return;
     }
 
     // This is a notification for a single clone instance
 
     if (rsc->running_on != NULL) {
         node = rsc->running_on->data; // First is sufficient
     }
     entry = new_notify_entry(rsc, node);
 
     // Add notification indicating the resource state
     switch (rsc->role) {
         case RSC_ROLE_STOPPED:
             n_data->inactive = g_list_prepend(n_data->inactive, entry);
             break;
 
         case RSC_ROLE_STARTED:
             n_data->active = g_list_prepend(n_data->active, entry);
             break;
 
         case RSC_ROLE_UNPROMOTED:
             n_data->unpromoted = g_list_prepend(n_data->unpromoted, entry);
             n_data->active = g_list_prepend(n_data->active,
                                             dup_notify_entry(entry));
             break;
 
         case RSC_ROLE_PROMOTED:
             n_data->promoted = g_list_prepend(n_data->promoted, entry);
             n_data->active = g_list_prepend(n_data->active,
                                             dup_notify_entry(entry));
             break;
 
         default:
             crm_err("Resource %s role on %s (%s) is not supported for "
                     "notifications (bug?)",
                     rsc->id, pe__node_name(node), role2text(rsc->role));
             free(entry);
             break;
     }
 
     if (!activity) {
         return;
     }
 
     // Add notification entries for each of the resource's actions
     for (iter = rsc->actions; iter != NULL; iter = iter->next) {
         pe_action_t *op = (pe_action_t *) iter->data;
 
         if (!pcmk_is_set(op->flags, pe_action_optional) && (op->node != NULL)) {
             enum action_tasks task = text2task(op->task);
 
             if ((task == stop_rsc) && op->node->details->unclean) {
                 // Create anyway (additional noise if node can't be fenced)
             } else if (!pcmk_is_set(op->flags, pe_action_runnable)) {
                 continue;
             }
 
             entry = new_notify_entry(rsc, op->node);
 
             switch (task) {
                 case start_rsc:
                     n_data->start = g_list_prepend(n_data->start, entry);
                     break;
                 case stop_rsc:
                     n_data->stop = g_list_prepend(n_data->stop, entry);
                     break;
                 case action_promote:
                     n_data->promote = g_list_prepend(n_data->promote, entry);
                     break;
                 case action_demote:
                     n_data->demote = g_list_prepend(n_data->demote, entry);
                     break;
                 default:
                     free(entry);
                     break;
             }
         }
     }
 }
 
 // For (char *) value
 #define add_notify_env(n_data, key, value) do {                         \
          n_data->keys = pcmk_prepend_nvpair(n_data->keys, key, value);  \
     } while (0)
 
 // For (GString *) value
 #define add_notify_env_gs(n_data, key, value) do {                      \
          n_data->keys = pcmk_prepend_nvpair(n_data->keys, key,          \
                                             (const char *) value->str); \
     } while (0)
 
 // For (GString *) value
 #define add_notify_env_free_gs(n_data, key, value) do {                 \
          n_data->keys = pcmk_prepend_nvpair(n_data->keys, key,          \
                                             (const char *) value->str); \
          g_string_free(value, TRUE); value = NULL;                      \
     } while (0)
 
 /*!
  * \internal
  * \brief Create notification name/value pairs from structured data
  *
  * \param[in]     rsc       Resource that notification is for
  * \param[in,out] n_data    Notification data
  */
 static void
 add_notif_keys(pe_resource_t *rsc, notify_data_t *n_data)
 {
     bool required = false; // Whether to make notify actions required
     GString *rsc_list = NULL;
     GString *node_list = NULL;
     GString *metal_list = NULL;
     const char *source = NULL;
     GList *nodes = NULL;
 
     n_data->stop = notify_entries_to_strings(n_data->stop,
                                              &rsc_list, &node_list);
     if ((strcmp(" ", (const char *) rsc_list->str) != 0)
         && pcmk__str_eq(n_data->action, RSC_STOP, pcmk__str_none)) {
         required = true;
     }
     add_notify_env_free_gs(n_data, "notify_stop_resource", rsc_list);
     add_notify_env_free_gs(n_data, "notify_stop_uname", node_list);
 
     if ((n_data->start != NULL)
         && pcmk__str_eq(n_data->action, RSC_START, pcmk__str_none)) {
         required = true;
     }
     n_data->start = notify_entries_to_strings(n_data->start,
                                               &rsc_list, &node_list);
     add_notify_env_free_gs(n_data, "notify_start_resource", rsc_list);
     add_notify_env_free_gs(n_data, "notify_start_uname", node_list);
 
     if ((n_data->demote != NULL)
         && pcmk__str_eq(n_data->action, RSC_DEMOTE, pcmk__str_none)) {
         required = true;
     }
     n_data->demote = notify_entries_to_strings(n_data->demote,
                                                &rsc_list, &node_list);
     add_notify_env_free_gs(n_data, "notify_demote_resource", rsc_list);
     add_notify_env_free_gs(n_data, "notify_demote_uname", node_list);
 
     if ((n_data->promote != NULL)
         && pcmk__str_eq(n_data->action, RSC_PROMOTE, pcmk__str_none)) {
         required = true;
     }
     n_data->promote = notify_entries_to_strings(n_data->promote,
                                                 &rsc_list, &node_list);
     add_notify_env_free_gs(n_data, "notify_promote_resource", rsc_list);
     add_notify_env_free_gs(n_data, "notify_promote_uname", node_list);
 
     n_data->active = notify_entries_to_strings(n_data->active,
                                                &rsc_list, &node_list);
     add_notify_env_free_gs(n_data, "notify_active_resource", rsc_list);
     add_notify_env_free_gs(n_data, "notify_active_uname", node_list);
 
     n_data->unpromoted = notify_entries_to_strings(n_data->unpromoted,
                                                    &rsc_list, &node_list);
     add_notify_env_gs(n_data, "notify_unpromoted_resource", rsc_list);
     add_notify_env_gs(n_data, "notify_unpromoted_uname", node_list);
 
     // Deprecated: kept for backward compatibility with older resource agents
     add_notify_env_free_gs(n_data, "notify_slave_resource", rsc_list);
     add_notify_env_free_gs(n_data, "notify_slave_uname", node_list);
 
     n_data->promoted = notify_entries_to_strings(n_data->promoted,
                                                  &rsc_list, &node_list);
     add_notify_env_gs(n_data, "notify_promoted_resource", rsc_list);
     add_notify_env_gs(n_data, "notify_promoted_uname", node_list);
 
     // Deprecated: kept for backward compatibility with older resource agents
     add_notify_env_free_gs(n_data, "notify_master_resource", rsc_list);
     add_notify_env_free_gs(n_data, "notify_master_uname", node_list);
 
     n_data->inactive = notify_entries_to_strings(n_data->inactive,
                                                  &rsc_list, NULL);
     add_notify_env_free_gs(n_data, "notify_inactive_resource", rsc_list);
 
     nodes = g_hash_table_get_values(n_data->allowed_nodes);
     if (!pcmk__is_daemon) {
         /* For display purposes, sort the node list, for consistent
          * regression test output (while avoiding the performance hit
          * for the live cluster).
          */
         nodes = g_list_sort(nodes, pe__cmp_node_name);
     }
     get_node_names(nodes, &node_list, NULL);
     add_notify_env_free_gs(n_data, "notify_available_uname", node_list);
     g_list_free(nodes);
 
     source = g_hash_table_lookup(rsc->meta, XML_RSC_ATTR_TARGET);
     if (pcmk__str_eq("host", source, pcmk__str_none)) {
         get_node_names(rsc->cluster->nodes, &node_list, &metal_list);
         add_notify_env_free_gs(n_data, "notify_all_hosts", metal_list);
     } else {
         get_node_names(rsc->cluster->nodes, &node_list, NULL);
     }
     add_notify_env_free_gs(n_data, "notify_all_uname", node_list);
 
     if (required && (n_data->pre != NULL)) {
         pe__clear_action_flags(n_data->pre, pe_action_optional);
         pe__clear_action_flags(n_data->pre_done, pe_action_optional);
     }
 
     if (required && (n_data->post != NULL)) {
         pe__clear_action_flags(n_data->post, pe_action_optional);
         pe__clear_action_flags(n_data->post_done, pe_action_optional);
     }
 }
 
 /*
  * \internal
  * \brief Find any remote connection start relevant to an action
  *
  * \param[in] action  Action to check
  *
  * \return If action is behind a remote connection, connection's start
  */
 static pe_action_t *
 find_remote_start(pe_action_t *action)
 {
     if ((action != NULL) && (action->node != NULL)) {
         pe_resource_t *remote_rsc = action->node->details->remote_rsc;
 
         if (remote_rsc != NULL) {
             return find_first_action(remote_rsc->actions, NULL, RSC_START,
                                      NULL);
         }
     }
     return NULL;
 }
 
 /*!
  * \internal
  * \brief Create notify actions, and add notify data to original actions
  *
  * \param[in] rsc       Clone or clone instance that notification is for
  * \param[in] n_data    Clone notification data for some action
  */
 static void
 create_notify_actions(pe_resource_t *rsc, notify_data_t *n_data)
 {
     GList *iter = NULL;
     pe_action_t *stop = NULL;
     pe_action_t *start = NULL;
     enum action_tasks task = text2task(n_data->action);
 
     // If this is a clone, call recursively for each instance
     if (rsc->children != NULL) {
         g_list_foreach(rsc->children, (GFunc) create_notify_actions, n_data);
         return;
     }
 
     // Add notification meta-attributes to original actions
     for (iter = rsc->actions; iter != NULL; iter = iter->next) {
         pe_action_t *op = (pe_action_t *) iter->data;
 
         if (!pcmk_is_set(op->flags, pe_action_optional) && (op->node != NULL)) {
             switch (text2task(op->task)) {
                 case start_rsc:
                 case stop_rsc:
                 case action_promote:
                 case action_demote:
                     add_notify_data_to_action_meta(n_data, op);
                     break;
                 default:
                     break;
             }
         }
     }
 
     // Skip notify action itself if original action was not needed
     switch (task) {
         case start_rsc:
             if (n_data->start == NULL) {
                 pe_rsc_trace(rsc, "No notify action needed for %s %s",
                              rsc->id, n_data->action);
                 return;
             }
             break;
 
         case action_promote:
             if (n_data->promote == NULL) {
                 pe_rsc_trace(rsc, "No notify action needed for %s %s",
                              rsc->id, n_data->action);
                 return;
             }
             break;
 
         case action_demote:
             if (n_data->demote == NULL) {
                 pe_rsc_trace(rsc, "No notify action needed for %s %s",
                              rsc->id, n_data->action);
                 return;
             }
             break;
 
         default:
             // We cannot do same for stop because it might be implied by fencing
             break;
     }
 
     pe_rsc_trace(rsc, "Creating notify actions for %s %s",
                  rsc->id, n_data->action);
 
     // Create notify actions for stop or demote
     if ((rsc->role != RSC_ROLE_STOPPED)
         && ((task == stop_rsc) || (task == action_demote))) {
 
         stop = find_first_action(rsc->actions, NULL, RSC_STOP, NULL);
 
         for (iter = rsc->running_on; iter != NULL; iter = iter->next) {
             pe_node_t *current_node = (pe_node_t *) iter->data;
 
             /* If a stop is a pseudo-action implied by fencing, don't try to
              * notify the node getting fenced.
              */
             if ((stop != NULL) && pcmk_is_set(stop->flags, pe_action_pseudo)
                 && (current_node->details->unclean
                     || current_node->details->remote_requires_reset)) {
                 continue;
             }
 
             new_notify_action(rsc, current_node, n_data->pre,
                               n_data->pre_done, n_data);
 
             if ((task == action_demote) || (stop == NULL)
                 || pcmk_is_set(stop->flags, pe_action_optional)) {
                 new_post_notify_action(rsc, current_node, n_data);
             }
         }
     }
 
     // Create notify actions for start or promote
     if ((rsc->next_role != RSC_ROLE_STOPPED)
         && ((task == start_rsc) || (task == action_promote))) {
 
         start = find_first_action(rsc->actions, NULL, RSC_START, NULL);
         if (start != NULL) {
             pe_action_t *remote_start = find_remote_start(start);
 
             if ((remote_start != NULL)
                 && !pcmk_is_set(remote_start->flags, pe_action_runnable)) {
                 /* Start and promote actions for a clone instance behind
                  * a Pacemaker Remote connection happen after the
                  * connection starts. If the connection start is blocked, do
                  * not schedule notifications for these actions.
                  */
                 return;
             }
         }
         if (rsc->allocated_to == NULL) {
             pe_proc_err("Next role '%s' but %s is not allocated",
                         role2text(rsc->next_role), rsc->id);
             return;
         }
         if ((task != start_rsc) || (start == NULL)
             || pcmk_is_set(start->flags, pe_action_optional)) {
 
             new_notify_action(rsc, rsc->allocated_to, n_data->pre,
                               n_data->pre_done, n_data);
         }
         new_post_notify_action(rsc, rsc->allocated_to, n_data);
     }
 }
 
 /*!
  * \internal
  * \brief Create notification data and actions for a clone
  *
  * \param[in] rsc     Clone resource that notification is for
  * \param[in] n_data  Clone notification data for some action
  */
 void
 pe__create_notifications(pe_resource_t *rsc, notify_data_t *n_data)
 {
     if ((rsc == NULL) || (n_data == NULL)) {
         return;
     }
     collect_resource_data(rsc, true, n_data);
     add_notif_keys(rsc, n_data);
     create_notify_actions(rsc, n_data);
 }
 
 /*!
  * \internal
  * \brief Free notification data
  *
  * \param[in] n_data  Notification data to free
  */
 void
 pe__free_notification_data(notify_data_t *n_data)
 {
     if (n_data == NULL) {
         return;
     }
     g_list_free_full(n_data->stop, free);
     g_list_free_full(n_data->start, free);
     g_list_free_full(n_data->demote, free);
     g_list_free_full(n_data->promote, free);
     g_list_free_full(n_data->promoted, free);
     g_list_free_full(n_data->unpromoted, free);
     g_list_free_full(n_data->active, free);
     g_list_free_full(n_data->inactive, free);
     pcmk_free_nvpairs(n_data->keys);
     free(n_data);
 }
 
 /*!
  * \internal
  * \brief Order clone "notifications complete" pseudo-action after fencing
  *
  * If a stop action is implied by fencing, the usual notification pseudo-actions
  * will not be sufficient to order things properly, or even create all needed
  * notifications if the clone is also stopping on another node, and another
  * clone is ordered after it. This function creates new notification
  * pseudo-actions relative to the fencing to ensure everything works properly.
  *
  * \param[in] stop        Stop action implied by fencing
  * \param[in] rsc         Clone resource that notification is for
  * \param[in] stonith_op  Fencing action that implies \p stop
  */
 void
 pe__order_notifs_after_fencing(pe_action_t *stop, pe_resource_t *rsc,
                                pe_action_t *stonith_op)
 {
     notify_data_t *n_data;
 
     crm_info("Ordering notifications for implied %s after fencing", stop->uuid);
     n_data = pe__clone_notif_pseudo_ops(rsc, RSC_STOP, NULL, stonith_op);
-    collect_resource_data(rsc, false, n_data);
-    add_notify_env(n_data, "notify_stop_resource", rsc->id);
-    add_notify_env(n_data, "notify_stop_uname", stop->node->details->uname);
-    create_notify_actions(uber_parent(rsc), n_data);
-    pe__free_notification_data(n_data);
+
+    if (n_data != NULL) {
+        collect_resource_data(rsc, false, n_data);
+        add_notify_env(n_data, "notify_stop_resource", rsc->id);
+        add_notify_env(n_data, "notify_stop_uname", stop->node->details->uname);
+        create_notify_actions(uber_parent(rsc), n_data);
+        pe__free_notification_data(n_data);
+    }
 }