package acceptance

import (
	"context"
	"errors"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

// --- parsing -------------------------------------------------------------

func TestParseLedgerRunnableAndManualGates(t *testing.T) {
	doc := ParseLedger(`# Gates

- [ ] AC-001: binary builds clean
  CHECK: go build ./...
  EXPECT: ok
  CWD: engine
  EVIDENCE: pending

- [x] AC-002: spec reviewed by a human
  EVIDENCE: reviewed 2024-06-01 by ops
`)
	if len(doc.Errors) != 0 {
		t.Fatalf("errors=%v", doc.Errors)
	}
	if len(doc.Gates) != 2 {
		t.Fatalf("gates=%d", len(doc.Gates))
	}
	runnable, manual := doc.Gates[0], doc.Gates[1]
	if runnable.ID != "AC-001" || runnable.Check != "go build ./..." || runnable.Expect != "ok" || runnable.Cwd != "engine" {
		t.Fatalf("runnable gate misparsed: %+v", runnable)
	}
	if runnable.Checked || runnable.Evidence != "pending" {
		t.Fatalf("runnable state misparsed: %+v", runnable)
	}
	if manual.ID != "AC-002" || !manual.Checked || manual.Evidence != "reviewed 2024-06-01 by ops" {
		t.Fatalf("manual gate misparsed: %+v", manual)
	}
}

func TestParseLedgerIgnoresFencedExamples(t *testing.T) {
	doc := ParseLedger(`# Gates

Example ledger, do not parse:

` + "```markdown" + `
- [ ] FAKE-1: fenced gate
  EVIDENCE: fenced evidence
` + "```" + `

- [x] REAL-1: real gate
  EVIDENCE: attested

` + "```" + `
  EVIDENCE: fenced attribute decoy
` + "```" + `
`)
	if len(doc.Errors) != 0 {
		t.Fatalf("errors=%v", doc.Errors)
	}
	if len(doc.Gates) != 1 || doc.Gates[0].ID != "REAL-1" {
		t.Fatalf("fenced gate leaked into parse: %+v", doc.Gates)
	}
	if doc.Gates[0].Evidence != "attested" {
		t.Fatalf("fenced attribute decoy overwrote evidence: %q", doc.Gates[0].Evidence)
	}
}

func TestParseLedgerErrors(t *testing.T) {
	cases := map[string]string{
		"empty":              "# Gates\n",
		"partial-check":      "- [ ] G1: x\n  CHECK: cmd\n",
		"partial-expect":     "- [ ] G1: x\n  EXPECT: out\n",
		"unindented-attr":    "- [ ] G1: x\nCHECK: cmd\n  EXPECT: out\n",
		"orphan-attr":        "  EVIDENCE: nowhere\n- [ ] G1: x\n",
		"duplicate-id":       "- [ ] G1: a\n- [ ] G1: b\n",
		"long-id":            "- [ ] " + strings.Repeat("G", 65) + ": x\n",
		"indented-abandon":   "- [ ] G1: x\n  ABANDON: G1 nope\n",
		"abandon-unknown":    "- [ ] G1: x\nABANDON: G2 gone\n",
		"abandon-no-reason":  "- [ ] G1: x\nABANDON: G1\n",
		"absolute-cwd":       "- [ ] G1: x\n  CHECK: c\n  EXPECT: o\n  CWD: /etc\n",
		"windows-abs-cwd":    "- [ ] G1: x\n  CHECK: c\n  EXPECT: o\n  CWD: C:\\tmp\n",
		"traversal-cwd":      "- [ ] G1: x\n  CHECK: c\n  EXPECT: o\n  CWD: a/../b\n",
		"bad-expect-pattern": "- [ ] G1: x\n  CHECK: c\n  EXPECT: /[/\n",
	}
	for name, text := range cases {
		doc := ParseLedger(text)
		if len(doc.Errors) == 0 {
			t.Errorf("%s: expected parse error, got none", name)
		}
	}
}

func TestParseLedgerAbandonRecordsReason(t *testing.T) {
	doc := ParseLedger("- [ ] G1: x\n- [ ] G2: y\n\nABANDON: G1 upstream API removed\n")
	if len(doc.Errors) != 0 {
		t.Fatalf("errors=%v", doc.Errors)
	}
	if doc.Abandoned["G1"] != "upstream API removed" {
		t.Fatalf("abandoned=%v", doc.Abandoned)
	}
}

func TestParseLedgerPreservesCRLF(t *testing.T) {
	doc := ParseLedger("- [ ] G1: x\r\n  EVIDENCE: pending\r\n")
	if doc.Newline() != "\r\n" {
		t.Fatalf("newline=%q", doc.Newline())
	}
}

func TestCompileExpectForms(t *testing.T) {
	sub, err := CompileExpect("all tests pass")
	if err != nil || sub.Kind != "substring" || !sub.Matches("ok all tests pass ok") {
		t.Fatalf("substring: %+v %v", sub, err)
	}
	re, err := CompileExpect(`/PASS \d+ files/`)
	if err != nil || re.Kind != "regex" || !re.Matches("PASS 3 files") {
		t.Fatalf("regex: %+v %v", re, err)
	}
	if re.PathLike {
		t.Fatalf("non-path regex misflagged: %+v", re)
	}
	pathRe, err := CompileExpect(`/tmp/out\.txt/`)
	if err != nil || !pathRe.PathLike {
		t.Fatalf("path-like regex not flagged: %+v %v", pathRe, err)
	}
	ci, err := CompileExpect(`/success/i`)
	if err != nil || !ci.Matches("SUCCESS") {
		t.Fatalf("case-insensitive: %v", err)
	}
	if _, err := CompileExpect(""); err == nil {
		t.Fatal("empty EXPECT must error")
	}
	// A /…/ form with non-flag trailing characters is a substring, not a
	// regex — `/a/b/c` stays a usable literal path expectation.
	subLiteral, err := CompileExpect(`/a/b/c`)
	if err != nil || subLiteral.Kind != "substring" {
		t.Fatalf("slash literal: %+v %v", subLiteral, err)
	}
}

// --- state reduction ------------------------------------------------------

func runnableGate(id string, checked bool, evidence string) *Gate {
	return &Gate{ID: id, Title: "outcome", Checked: checked, Check: "probe", Expect: "ok", Evidence: evidence}
}

func TestGateStateManual(t *testing.T) {
	doc := &Document{Abandoned: map[string]string{}}
	manual := &Gate{ID: "M1", Evidence: "pending"}
	if got := GateState(manual, doc); got != StateUnmet {
		t.Fatalf("unchecked manual=%s", got)
	}
	manual.Checked = true
	if got := GateState(manual, doc); got != StateUnmet {
		t.Fatalf("pending-evidence manual=%s", got)
	}
	manual.Evidence = "human verified on staging"
	if got := GateState(manual, doc); got != StateMet {
		t.Fatalf("attested manual=%s", got)
	}
}

func TestGateStateRunnable(t *testing.T) {
	doc := &Document{Abandoned: map[string]string{}}
	gate := runnableGate("R1", false, "pending")
	if got := GateState(gate, doc); got != StateUnmet {
		t.Fatalf("unchecked=%s", got)
	}
	gate.Checked = true
	gate.Evidence = "looks good to me"
	if got := GateState(gate, doc); got != StateStaleUnmet {
		t.Fatalf("prose evidence on runnable gate must be stale, got %s", got)
	}
	gate.Evidence = FormatEvidence(gate, OutputDigest("out"), 3, "2024-01-01T00:00:00Z")
	if got := GateState(gate, doc); got != StateMet {
		t.Fatalf("bound evidence=%s", got)
	}
}

func TestGateStateDefinitionDriftStale(t *testing.T) {
	doc := &Document{Abandoned: map[string]string{}}
	gate := runnableGate("R1", true, "")
	gate.Evidence = FormatEvidence(gate, OutputDigest("out"), 3, "t")
	for _, mutate := range []func(*Gate){
		func(g *Gate) { g.Check = "probe --verbose" },
		func(g *Gate) { g.Expect = "ok2" },
		func(g *Gate) { g.Cwd = "sub" },
	} {
		edited := *gate
		mutate(&edited)
		if got := GateState(&edited, doc); got != StateStaleUnmet {
			t.Fatalf("edited definition must be stale, got %s", got)
		}
	}
}

func TestGateStateAbandonedWins(t *testing.T) {
	doc := &Document{Abandoned: map[string]string{"R1": "vendor removed"}}
	gate := runnableGate("R1", true, "")
	gate.Evidence = FormatEvidence(gate, OutputDigest("o"), 1, "t")
	if got := GateState(gate, doc); got != StateAbandoned {
		t.Fatalf("abandoned=%s", got)
	}
}

func TestReduceCountsAndIds(t *testing.T) {
	doc := &Document{Abandoned: map[string]string{"G3": "handoff"}}
	met := runnableGate("G1", true, "")
	met.Evidence = FormatEvidence(met, OutputDigest("o"), 1, "t")
	unmet := runnableGate("G2", false, "pending")
	stale := runnableGate("G4", true, "stale prose")
	doc.Gates = []*Gate{met, unmet, {ID: "G3", Title: "gone"}, stale}

	red := doc.Reduce([]ApprovedCommand{{Command: "probe", Cwd: ""}})
	if red.Total != 4 || red.Met != 1 || red.Unmet != 2 || red.Abandoned != 1 || red.Stale != 1 {
		t.Fatalf("reduction=%+v", red)
	}
	if red.AllMet() || !red.HandoffRequired() {
		t.Fatalf("verdict wrong: %+v", red)
	}
	// G2 and G4 are unmet runnable gates whose CHECK "probe" IS approved.
	if len(red.UnapprIDs) != 0 {
		t.Fatalf("unapproved=%v", red.UnapprIDs)
	}
	red = doc.Reduce([]ApprovedCommand{{Command: "other", Cwd: ""}})
	if len(red.UnapprIDs) != 2 {
		t.Fatalf("unapproved ids=%v", red.UnapprIDs)
	}
	// A nil approval surface approves nothing: every unmet runnable gate is unapproved.
	red = doc.Reduce(nil)
	if len(red.UnapprIDs) != 2 {
		t.Fatalf("nil approved must flag every unmet runnable gate: %v", red.UnapprIDs)
	}
}

func TestReduceAllMet(t *testing.T) {
	doc := &Document{Abandoned: map[string]string{}}
	gate := runnableGate("G1", true, "")
	gate.Evidence = FormatEvidence(gate, OutputDigest("o"), 1, "t")
	doc.Gates = []*Gate{gate}
	if !doc.Reduce(nil).AllMet() {
		t.Fatal("single met gate must reduce all-met")
	}
}

// --- approval -------------------------------------------------------------

const testPlanPreflight = `# Test plan

## Build-entry preflight

| Command | Cwd | Purpose |
| --- | --- | --- |
| go test ./internal/acceptance | engine | package tests |
| ./scripts/scan.sh \| tail -1 | repository | escaped pipe survives |
| make build | . | root convention |

## Consumptive actions

| Command | Cwd |
| --- | --- |
| rm -rf dist | . |
`

func TestApprovedCommandsPreflightOnly(t *testing.T) {
	approved := ApprovedCommands([]byte(testPlanPreflight))
	if len(approved) != 3 {
		t.Fatalf("approved=%+v", approved)
	}
	if !Approved("go test ./internal/acceptance", "engine", approved) {
		t.Fatal("exact pair must approve")
	}
	if Approved("go test ./internal/acceptance", ".", approved) {
		t.Fatal("same command, different cwd must not approve")
	}
	if !Approved(" go test ./internal/acceptance ", "engine/", approved) {
		t.Fatal("whitespace/slash normalization must approve the same pair")
	}
	if Approved("rm -rf dist", ".", approved) {
		t.Fatal("non-preflight section must not approve")
	}
	if !Approved("./scripts/scan.sh | tail -1", "root", approved) {
		t.Fatal("escaped-pipe command and root cwd must approve")
	}
}

func TestApprovedCommandsNoSection(t *testing.T) {
	if approved := ApprovedCommands([]byte("# Plan\n\nno table\n")); len(approved) != 0 {
		t.Fatalf("approved=%+v", approved)
	}
	// A nil plan approves nothing and reports it as an empty value, never nil.
	if approved := ApprovedCommands(nil); approved == nil || len(approved) != 0 {
		t.Fatalf("nil plan must approve nothing, and report it as a value: %+v", approved)
	}
}

func TestNormalizeApprovedCwd(t *testing.T) {
	for _, root := range []string{"", ".", "./", "repository", "root", "repo", "n/a", "-", "`.`"} {
		if got := normalizeApprovedCwd(root); got != "" {
			t.Fatalf("root convention %q -> %q", root, got)
		}
	}
	if got := normalizeApprovedCwd("engine/"); got != "engine" {
		t.Fatalf("engine/ -> %q", got)
	}
}

// --- execution ------------------------------------------------------------

func writeWorkspace(t *testing.T) (project, ledgerPath string) {
	t.Helper()
	project = t.TempDir()
	root := filepath.Join(project, ".devrites")
	work := filepath.Join(root, "work", "feat")
	if err := os.MkdirAll(work, 0o755); err != nil {
		t.Fatal(err)
	}
	return project, filepath.Join(work, GatesFile)
}

func writeLedger(t *testing.T, ledgerPath, body string) {
	t.Helper()
	if err := os.WriteFile(ledgerPath, []byte(body), 0o644); err != nil {
		t.Fatal(err)
	}
}

func TestRunGatesExecutesAndBindsEvidence(t *testing.T) {
	project, ledgerPath := writeWorkspace(t)
	writeLedger(t, ledgerPath, "- [ ] G1: probe prints marker\n  CHECK: echo RUN-MARKER\n  EXPECT: RUN-MARKER\n  EVIDENCE: pending\n")
	doc := ParseLedger(mustRead(t, ledgerPath))
	approved := []ApprovedCommand{{Command: "echo RUN-MARKER", Cwd: ""}}

	results := RunGates(context.Background(), project, ledgerPath, doc, approved, false, 10*time.Second)
	if len(results) != 1 || !results[0].Ran || !results[0].Passed || results[0].WriteErr != nil {
		t.Fatalf("results=%+v", results)
	}
	doc = ParseLedger(mustRead(t, ledgerPath))
	if len(doc.Errors) != 0 {
		t.Fatalf("rewritten ledger malformed: %v", doc.Errors)
	}
	gate := doc.Gates[0]
	if !gate.Checked || !strings.HasPrefix(gate.Evidence, EvidenceMarker) {
		t.Fatalf("ledger not updated: %+v", gate)
	}
	if GateState(gate, doc) != StateMet {
		t.Fatalf("gate not met after run: %s", GateState(gate, doc))
	}
	// Already met: skipped without reverify.
	results = RunGates(context.Background(), project, ledgerPath, doc, approved, false, 10*time.Second)
	if !results[0].Passed || results[0].Ran {
		t.Fatalf("met gate must skip: %+v", results[0])
	}
	// Reverify re-executes it.
	results = RunGates(context.Background(), project, ledgerPath, doc, approved, true, 10*time.Second)
	if !results[0].Ran || !results[0].Passed {
		t.Fatalf("reverify must re-run: %+v", results[0])
	}
}

func TestRunGatesFailureClearsBox(t *testing.T) {
	project, ledgerPath := writeWorkspace(t)
	writeLedger(t, ledgerPath, "- [x] G1: prior pass\n  CHECK: echo nothing\n  EXPECT: NEVER-PRESENT\n  EVIDENCE: bogus\n")
	doc := ParseLedger(mustRead(t, ledgerPath))
	approved := []ApprovedCommand{{Command: "echo nothing", Cwd: ""}}

	results := RunGates(context.Background(), project, ledgerPath, doc, approved, true, 10*time.Second)
	if !results[0].Ran || results[0].Passed {
		t.Fatalf("results=%+v", results)
	}
	doc = ParseLedger(mustRead(t, ledgerPath))
	if doc.Gates[0].Checked || doc.Gates[0].Evidence != "pending" {
		t.Fatalf("failed gate must uncheck and reset evidence: %+v", doc.Gates[0])
	}
}

func TestRunGatesSkipsUnapprovedManualAbandoned(t *testing.T) {
	project, ledgerPath := writeWorkspace(t)
	writeLedger(t, ledgerPath,
		"- [ ] G1: unvetted\n  CHECK: echo hi\n  EXPECT: hi\n  EVIDENCE: pending\n"+
			"- [ ] G2: judged\n  EVIDENCE: pending\n"+
			"- [ ] G3: gone\n  CHECK: echo hi\n  EXPECT: hi\n  EVIDENCE: pending\n"+
			"ABANDON: G3 removed upstream\n")
	doc := ParseLedger(mustRead(t, ledgerPath))
	results := RunGates(context.Background(), project, ledgerPath, doc, []ApprovedCommand{}, false, 10*time.Second)
	if len(results) != 3 {
		t.Fatalf("results=%+v", results)
	}
	for _, r := range results {
		if r.Ran {
			t.Fatalf("gate %s must not execute: %+v", r.ID, r)
		}
	}
	// Ledger untouched: no evidence was written for skipped gates.
	doc = ParseLedger(mustRead(t, ledgerPath))
	for _, gate := range doc.Gates {
		if gate.Checked {
			t.Fatalf("skipped gate %s mutated", gate.ID)
		}
	}
}

func TestWriteResultDiscardsMovedOracle(t *testing.T) {
	_, ledgerPath := writeWorkspace(t)
	writeLedger(t, ledgerPath, "- [ ] G1: probe\n  CHECK: echo hi\n  EXPECT: hi\n  EVIDENCE: pending\n")
	doc := ParseLedger(mustRead(t, ledgerPath))
	ran := doc.Gates[0]
	// The oracle moves between execution and writeback.
	writeLedger(t, ledgerPath, "- [ ] G1: probe\n  CHECK: echo hi --verbose\n  EXPECT: hi\n  EVIDENCE: pending\n")
	if err := writeResult(ledgerPath, ran, "evidence", true); !errors.Is(err, ErrOracleMoved) {
		t.Fatalf("err=%v", err)
	}
	// The ledger still shows the new, unchecked definition.
	doc = ParseLedger(mustRead(t, ledgerPath))
	if doc.Gates[0].Checked || doc.Gates[0].Check != "echo hi --verbose" {
		t.Fatalf("ledger clobbered: %+v", doc.Gates[0])
	}
}

func TestWriteResultIgnoresFencedEvidenceDecoy(t *testing.T) {
	_, ledgerPath := writeWorkspace(t)
	writeLedger(t, ledgerPath,
		"- [ ] G1: probe\n  CHECK: echo hi\n  EXPECT: hi\n\n"+
			"```\n  EVIDENCE: fenced decoy\n```\n")
	doc := ParseLedger(mustRead(t, ledgerPath))
	if err := writeResult(ledgerPath, doc.Gates[0], "automatic-evidence=v1; def=x; exit=0; expect=matched; output-sha256=y; output-bytes=1; at=t", true); err != nil {
		t.Fatal(err)
	}
	text := mustRead(t, ledgerPath)
	if strings.Contains(text, "fenced decoy") == false {
		t.Fatalf("fenced decoy must survive:\n%s", text)
	}
	doc = ParseLedger(text)
	if doc.Gates[0].Evidence == "fenced decoy" || !strings.HasPrefix(doc.Gates[0].Evidence, EvidenceMarker) {
		t.Fatalf("evidence misrouted: %q", doc.Gates[0].Evidence)
	}
}

func TestReadLedgerFileBounds(t *testing.T) {
	_, ledgerPath := writeWorkspace(t)
	if _, err := ReadLedgerFile(ledgerPath); err == nil {
		t.Fatal("missing ledger must error")
	}
	dir := filepath.Join(filepath.Dir(ledgerPath), "notafile")
	if err := os.Mkdir(dir, 0o755); err != nil {
		t.Fatal(err)
	}
	if _, err := ReadLedgerFile(dir); err == nil {
		t.Fatal("non-regular file must error")
	}
}

// --- lint -----------------------------------------------------------------

func TestLintFindings(t *testing.T) {
	doc := ParseLedger(`- [ ] G1: echo done
  CHECK: echo done
  EXPECT: pass

- [ ] G2: Improve coverage by 40 percent
  EVIDENCE: pending

- [ ] G3: real probe
  CHECK: ./probe.sh
  EXPECT: /tmp/out\.txt/

- [ ] G4: unvetted
  CHECK: ./other.sh
  EXPECT: marker
`)
	if len(doc.Errors) != 0 {
		t.Fatalf("errors=%v", doc.Errors)
	}
	findings := LintLedger(doc, []ApprovedCommand{{Command: "./probe.sh", Cwd: ""}})
	rules := map[string]string{}
	for _, f := range findings {
		rules[f.Gate+":"+f.Rule] = f.Level
	}
	for _, want := range []string{
		"G1:tautological-check", "G1:weak-expect",
		"G2:manual-gate", "G2:unmeasured-number", "G2:activity-not-outcome",
		"G3:path-read-as-regex",
		"G4:unapproved-check",
	} {
		if _, ok := rules[want]; !ok {
			t.Errorf("missing finding %s in %+v", want, rules)
		}
	}
	if rules["G4:unapproved-check"] != "error" {
		t.Fatalf("unapproved must be an error: %+v", rules)
	}
	// 3 of 4 live gates runnable → no mostly-manual warning.
	if _, ok := rules[":mostly-manual"]; ok {
		t.Fatalf("unexpected mostly-manual: %+v", rules)
	}
}

func TestLintDuplicateOracle(t *testing.T) {
	doc := ParseLedger(`- [ ] G1: first
  CHECK: ./probe.sh
  EXPECT: marker

- [ ] G2: same oracle, reworded title
  CHECK:   ./probe.sh  
  EXPECT: marker

- [ ] G3: different oracle
  CHECK: ./probe.sh
  EXPECT: other

- [ ] G4: abandoned duplicate
  CHECK: ./probe.sh
  EXPECT: marker

- [ ] G5: same check in another cwd
  CHECK: ./probe.sh
  EXPECT: marker
  CWD: engine

ABANDON: G4 superseded
`)
	if len(doc.Errors) != 0 {
		t.Fatalf("errors=%v", doc.Errors)
	}
	findings := LintLedger(doc, []ApprovedCommand{{Command: "./probe.sh", Cwd: ""}, {Command: "./probe.sh", Cwd: "engine"}})
	rules := map[string]bool{}
	for _, f := range findings {
		rules[f.Gate+":"+f.Rule] = true
	}
	if !rules["G2:duplicate-oracle"] {
		t.Errorf("missing G2 duplicate-oracle in %+v", rules)
	}
	for _, absent := range []string{"G3:duplicate-oracle", "G4:duplicate-oracle", "G5:duplicate-oracle"} {
		if rules[absent] {
			t.Errorf("unexpected %s in %+v", absent, rules)
		}
	}
}

func TestLintMostlyManualAndCounts(t *testing.T) {
	doc := ParseLedger("- [ ] G1: a\n  CHECK: c\n  EXPECT: o\n- [ ] G2: b\n- [ ] G3: c\n")
	findings := LintLedger(doc, nil)
	var mostlyManual bool
	for _, f := range findings {
		if f.Rule == "mostly-manual" {
			mostlyManual = true
		}
	}
	if !mostlyManual {
		t.Fatalf("findings=%+v", findings)
	}
	// The one runnable gate (G1) has no approved row, so lint reports an error.
	errs, warns := LintCounts(findings)
	if errs != 1 || warns == 0 {
		t.Fatalf("counts=%d/%d", errs, warns)
	}
}

// --- scaffold -------------------------------------------------------------

func TestScaffoldLedger(t *testing.T) {
	empty := ScaffoldLedger("feat", nil)
	doc := ParseLedger(empty)
	if len(doc.Errors) != 0 || len(doc.Gates) != 1 || doc.Gates[0].ID != "G1" {
		t.Fatalf("placeholder scaffold malformed: %v %+v", doc.Errors, doc.Gates)
	}
	spec := []byte("# Spec\n\n## Acceptance criteria\n\n- AC-002 first\n- AC-001 second\n- AC-002 repeated\n\n## Non-goals\n\n- AC-003 not required\n")
	scaffolded := ScaffoldLedger("feat", spec)
	doc = ParseLedger(scaffolded)
	if len(doc.Errors) != 0 || len(doc.Gates) != 2 || doc.Gates[0].ID != "AC-002" || doc.Gates[1].ID != "AC-001" {
		t.Fatalf("scaffolded gates: %v %+v", doc.Errors, doc.Gates)
	}
}

// --- CLI ------------------------------------------------------------------

func TestRunCLIStatusAndScaffold(t *testing.T) {
	project := t.TempDir()
	root := filepath.Join(project, ".devrites")
	work := filepath.Join(root, "work", "feat")
	if err := os.MkdirAll(work, 0o755); err != nil {
		t.Fatal(err)
	}
	var stdout, stderr strings.Builder

	if code := Run(root, []string{"bogus"}, &stdout, &stderr); code != ExitUsage {
		t.Fatalf("unknown sub=%d", code)
	}
	if code := Run(root, []string{"status", "feat"}, &stdout, &stderr); code != ExitBlocked {
		t.Fatalf("missing ledger status=%d", code)
	}
	if code := Run(root, []string{"scaffold", "feat"}, &stdout, &stderr); code != ExitOK {
		t.Fatalf("scaffold=%d stderr=%q", code, stderr.String())
	}
	if !strings.Contains(stdout.String(), "created:") {
		t.Fatalf("scaffold stdout=%q", stdout.String())
	}
	// Scaffold never clobbers.
	if code := Run(root, []string{"scaffold", "feat"}, &stdout, &stderr); code != ExitBlocked {
		t.Fatalf("second scaffold=%d", code)
	}
	// The scaffolded ledger parses and reports all-unmet.
	stdout.Reset()
	if code := Run(root, []string{"status", "feat"}, &stdout, &stderr); code != ExitBlocked {
		t.Fatalf("status=%d out=%q", code, stdout.String())
	}
	if !strings.Contains(stdout.String(), "result: not-met") {
		t.Fatalf("status stdout=%q", stdout.String())
	}
}

func TestRunCLIAttestAbandon(t *testing.T) {
	project := t.TempDir()
	root := filepath.Join(project, ".devrites")
	work := filepath.Join(root, "work", "feat")
	if err := os.MkdirAll(work, 0o755); err != nil {
		t.Fatal(err)
	}
	writeLedger(t, filepath.Join(work, GatesFile),
		"- [ ] M1: human judged\n  EVIDENCE: pending\n- [ ] M2: other\n  EVIDENCE: pending\n")
	var stdout, stderr strings.Builder

	if code := Run(root, []string{"attest", "feat", "M1", "verified", "on staging"}, &stdout, &stderr); code != ExitOK {
		t.Fatalf("attest=%d stderr=%q", code, stderr.String())
	}
	if code := Run(root, []string{"attest", "feat", "M9", "nope"}, &stdout, &stderr); code != ExitBlocked {
		t.Fatalf("unknown gate attest=%d", code)
	}
	if code := Run(root, []string{"abandon", "feat", "M2", "vendor gone"}, &stdout, &stderr); code != ExitOK {
		t.Fatalf("abandon=%d stderr=%q", code, stderr.String())
	}
	// Abandoned gates refuse attestation.
	if code := Run(root, []string{"attest", "feat", "M2", "too late"}, &stdout, &stderr); code != ExitBlocked {
		t.Fatalf("abandoned attest=%d", code)
	}
	stdout.Reset()
	if code := Run(root, []string{"status", "feat"}, &stdout, &stderr); code != ExitBlocked {
		t.Fatalf("status=%d", code)
	}
	if !strings.Contains(stdout.String(), "result: handoff") || !strings.Contains(stdout.String(), "handoff-id: M2") {
		t.Fatalf("status stdout=%q", stdout.String())
	}
}

func mustRead(t *testing.T, path string) string {
	t.Helper()
	raw, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	return string(raw)
}

// An unresolvable approval surface is refused, never executed. Each consumer
// (run, reduce, lint) is asserted at its own guard, and nil and empty surfaces
// must behave identically.

func TestApprovedCommandsNeverNilSurface(t *testing.T) {
	// ApprovedCommands never returns nil: a consumer must be able to refuse on an
	// empty surface.
	cases := map[string][]byte{
		"absent file (empty input)": nil,
		"invalid utf8":              {0xff, 0xfe, 0x00, 'a'},
		"no preflight section":      []byte("# Test plan\n\n## Plan\nnothing here\n"),
		"heading only":              []byte("## Build-entry preflight\n"),
		"header row only":           []byte("## Build-entry preflight\n| command | cwd |\n"),
	}
	for name, in := range cases {
		got := ApprovedCommands(in)
		if got == nil {
			t.Errorf("CASE %s: ApprovedCommands returned nil; nil reads as 'approval not applicable' so every CHECK executes unreviewed. Must return a non-nil (possibly empty) surface.", name)
			continue
		}
		if len(got) != 0 {
			t.Errorf("CASE %s: ApprovedCommands = %v; want non-nil empty (nothing was approved)", name, got)
		}
	}
}

func TestRunGatesRefusesUnresolvableApprovalSurface(t *testing.T) {
	for _, tc := range []struct {
		name     string
		approved []ApprovedCommand
	}{
		{"nil surface", nil},
		{"empty non-nil surface", []ApprovedCommand{}},
	} {
		t.Run(tc.name, func(t *testing.T) {
			project := t.TempDir()
			work := filepath.Join(project, ".devrites", "work", "feat")
			if err := os.MkdirAll(work, 0o755); err != nil {
				t.Fatal(err)
			}
			ledgerPath := filepath.Join(work, GatesFile)
			body := "- [ ] G1: unreviewed oracle\n  CHECK: echo UNAPPROVED-MUST-NOT-RUN\n  EXPECT: UNAPPROVED-MUST-NOT-RUN\n  EVIDENCE: pending\n"
			if err := os.WriteFile(ledgerPath, []byte(body), 0o644); err != nil {
				t.Fatal(err)
			}
			doc := ParseLedger(mustRead(t, ledgerPath))
			results := RunGates(context.Background(), project, ledgerPath, doc, tc.approved, false, 10*time.Second)
			if len(results) != 1 {
				t.Fatalf("results=%+v", results)
			}
			r := results[0]
			if r.Ran {
				t.Errorf("DEFECT: gate executed under a %s approval surface (passed=%v detail=%q). An unreviewed CHECK must not execute when approvals cannot be established.", tc.name, r.Passed, r.Detail)
			}
			if r.Passed {
				t.Errorf("DEFECT: gate reported passed under a %s approval surface; certification must not happen.", tc.name)
			}
			if !strings.Contains(r.Detail, "not an approved") {
				t.Errorf("detail=%q; want a refusal naming the unapproved CHECK", r.Detail)
			}
			after := mustRead(t, ledgerPath)
			if strings.Contains(after, EvidenceMarker) {
				t.Errorf("DEFECT: ledger was certified with automatic evidence under a %s approval surface:\n%s", tc.name, after)
			}
			if !strings.Contains(after, "EVIDENCE: pending") {
				t.Errorf("ledger evidence was mutated under a %s approval surface:\n%s", tc.name, after)
			}
			if red := doc.Reduce(tc.approved); red.Unapproved != 1 {
				t.Errorf("reduction under %s surface: Unapproved=%d; want 1 so `gates status` cannot report unapproved: 0", tc.name, red.Unapproved)
			}
		})
	}
}

func TestLintFlagsNilAndEmptyApprovalSurfaceIdentically(t *testing.T) {
	for _, tc := range []struct {
		name     string
		approved []ApprovedCommand
	}{
		{"nil surface", nil},
		{"empty surface", []ApprovedCommand{}},
	} {
		doc := &Document{Abandoned: map[string]string{}}
		g := runnableGate("G1", true, "pending")
		g.Check = "echo anything"
		g.Cwd = ""
		doc.Gates = []*Gate{g}
		found := false
		for _, f := range LintLedger(doc, tc.approved) {
			if f.Rule == "unapproved-check" && strings.Contains(f.Message, "echo anything") {
				found = true
			}
		}
		if !found {
			t.Errorf("DEFECT: Lint(%s) reported no unapproved-check finding; `gates lint --strict` reports LINT OK instead of the authorization error.", tc.name)
		}
	}
}

// Refusal applies only where a command would actually execute; manual and
// already-met gates must not be blocked by an unresolvable approval surface.
func TestUnresolvableApprovalDoesNotBlockNonExecutingGates(t *testing.T) {
	project := t.TempDir()

	// Manual gates execute nothing, so there is nothing to authorize.
	manualOnly := ParseLedger("- [x] M1: human judged\n  EVIDENCE: a stranger checked the transcript\n")
	if red := manualOnly.Reduce(nil); !red.AllMet() {
		t.Errorf("a manual-only ledger has no CHECK to approve and must still reduce all-met: %+v", red)
	}
	if red := manualOnly.Reduce(nil); red.Unapproved != 0 {
		t.Errorf("manual gates are not executions and must not count as unapproved: %+v", red)
	}
	for _, f := range LintLedger(manualOnly, nil) {
		if f.Rule == "unapproved-check" {
			t.Errorf("manual gates must never be flagged unapproved: %+v", f)
		}
	}

	// An already-met runnable gate returns before the approval guard, so a
	// workspace whose gates were vetted and met in an earlier run keeps its state.
	met := runnableGate("R1", true, "")
	met.Check = "echo already"
	met.Expect = "already"
	met.Evidence = FormatEvidence(met, OutputDigest("already\n"), 8, "2026-01-01T00:00:00Z")
	if got := GateState(met, &Document{Abandoned: map[string]string{}}); got != StateMet {
		t.Fatalf("fixture must be genuinely met, not %s", got)
	}
	manualUnmet := &Gate{ID: "M2", Title: "human judged", Evidence: "pending"}
	doc := &Document{Abandoned: map[string]string{}, Gates: []*Gate{manualUnmet, met}}
	for _, r := range RunGates(context.Background(), project, filepath.Join(project, "unused.md"), doc, nil, false, 10*time.Second) {
		if strings.Contains(r.Detail, "not an approved") {
			t.Errorf("gate %s was refused for approval although it never executes: %q", r.ID, r.Detail)
		}
		switch r.ID {
		case "M2":
			if !strings.Contains(r.Detail, "manual gate") {
				t.Errorf("M2 detail=%q; want the manual-gate wording, proving the approval guard was never reached", r.Detail)
			}
		case "R1":
			if !strings.Contains(r.Detail, "already met") {
				t.Errorf("R1 detail=%q; want already-met, proving a vetted pass is not re-litigated", r.Detail)
			}
		}
	}
}

// An unreadable test-plan.md leaves every runnable CHECK unapproved: the runner
// refuses it and the reduction and lint report it, whatever the value's nil-ness.
func TestLoadTestPlanUnreadableApprovesNothing(t *testing.T) {
	approved := loadTestPlan(filepath.Join(t.TempDir(), "missing", "test-plan.md"))
	if Approved("echo hi", "", approved) {
		t.Fatalf("unreadable plan approved a command: %+v", approved)
	}
	g := runnableGate("G1", true, "pending")
	g.Check = "echo hi"
	doc := &Document{Abandoned: map[string]string{}, Gates: []*Gate{g}}
	if red := doc.Reduce(approved); red.Unapproved != 1 {
		t.Fatalf("Unapproved=%d; want 1", red.Unapproved)
	}
	errs, _ := LintCounts(LintLedger(doc, approved))
	if errs != 1 {
		t.Fatalf("lint errs=%d; want 1 unapproved-check", errs)
	}
}

// `gates attest` refuses a placeholder note at write time, so a manual gate is
// never left checked on evidence the reader would later reject.
func TestAttestRefusesPlaceholderNotes(t *testing.T) {
	placeholders := []string{"n/a", "tbd", "-", "ok", "done", "yes", "pending", "PENDING", "verified", "TODO", "N/A", "none", "n/a (see notes)", "done.", "AC-004: outcome seen", "outcome seen", "AC-004 - outcome seen", "**done**"}
	for _, note := range placeholders {
		project := t.TempDir()
		root := filepath.Join(project, ".devrites")
		work := filepath.Join(root, "work", "feat")
		if err := os.MkdirAll(work, 0o755); err != nil {
			t.Fatal(err)
		}
		ledgerPath := filepath.Join(work, GatesFile)
		body := "- [ ] AC-004: outcome seen\n  EVIDENCE: pending\n"
		writeLedger(t, ledgerPath, body)
		var stdout, stderr strings.Builder
		if code := Run(root, []string{"attest", "feat", "AC-004", note}, &stdout, &stderr); code == ExitOK {
			t.Errorf("placeholder %q was accepted at write time", note)
		}
		if !strings.Contains(stderr.String(), "placeholder") {
			t.Errorf("placeholder %q: stderr=%q; want a message naming the placeholder", note, stderr.String())
		}
		if got := mustRead(t, ledgerPath); got != body {
			t.Errorf("placeholder %q mutated the ledger:\n%s", note, got)
		}
	}
}

// The refusal must say a trailing parenthetical after a placeholder word is
// ignored, since the note otherwise appears to already cite who and where.
func TestAttestRefusalExplainsIgnoredParenthetical(t *testing.T) {
	project := t.TempDir()
	root := filepath.Join(project, ".devrites")
	work := filepath.Join(root, "work", "feat")
	if err := os.MkdirAll(work, 0o755); err != nil {
		t.Fatal(err)
	}
	writeLedger(t, filepath.Join(work, GatesFile), "- [ ] AC-004: outcome seen\n  EVIDENCE: pending\n")
	var stdout, stderr strings.Builder
	note := "done (verified on staging by Ann, q-12)"
	if code := Run(root, []string{"attest", "feat", "AC-004", note}, &stdout, &stderr); code == ExitOK {
		t.Fatalf("note %q was accepted", note)
	}
	for _, want := range []string{"placeholder", "trailing (", "is ignored"} {
		if !strings.Contains(stderr.String(), want) {
			t.Errorf("stderr=%q; want it to contain %q", stderr.String(), want)
		}
	}
}

func TestAttestAcceptsSubstantiveNote(t *testing.T) {
	project := t.TempDir()
	root := filepath.Join(project, ".devrites")
	work := filepath.Join(root, "work", "feat")
	if err := os.MkdirAll(work, 0o755); err != nil {
		t.Fatal(err)
	}
	ledgerPath := filepath.Join(work, GatesFile)
	writeLedger(t, ledgerPath, "- [ ] AC-004: outcome seen\n  EVIDENCE: pending\n")
	var stdout, stderr strings.Builder
	if code := Run(root, []string{"attest", "feat", "AC-004", "verified on staging by reviewer"}, &stdout, &stderr); code != ExitOK {
		t.Fatalf("substantive note refused: code=%d stderr=%q", code, stderr.String())
	}
	doc := ParseLedger(mustRead(t, ledgerPath))
	if len(doc.Gates) != 1 || GateState(doc.Gates[0], doc) != StateMet {
		t.Fatalf("substantive attestation not met: %+v", doc.Gates)
	}
}

func manualLedger(note string) *Document {
	return ParseLedger("# Gates\n\n- [x] AC-004: outcome seen\n  EVIDENCE: " + note + "\n")
}

func TestManualGatePlaceholdersNeverMet(t *testing.T) {
	for _, ev := range []string{"n/a", "tbd", "-", "ok", "done", "yes", "pending", "PENDING", "Pending", "verified", "TODO", "N/A", "TBD", "none", "n/a (see notes)", "done.",
		"AC-004 — outcome seen", "AC-004 - outcome seen", "`done`", "**done**", "\"n/a\"",
		"AC-004: outcome seen", "outcome seen", "AC-004", "AC-004 – outcome seen", "*done*", "_done_", "'done'", "Done!", "  yes.  ", "N.A.", "—", "✅", "✓ done", "[done]", "> done", "~~tbd~~", "outcome seen (AC-004)", "AC-004 (outcome seen)", "AC004 outcome seen", "ac-004: OUTCOME SEEN.", "pass", "passed", "true", "0", "okay", "none.", "TODO: later", "not applicable", "N/A - not applicable", "AC-004 done", "done - AC-004", "AC004 outcome seen", "AC 004 done", "see above", "(done)", "TBD (see notes)"} {
		d := manualLedger(ev)
		if len(d.Gates) != 1 || d.Gates[0].ID != "AC-004" || d.Gates[0].Evidence == "" {
			t.Logf("PARSE %q: gates=%d errs=%v", ev, len(d.Gates), d.Errors)
			continue
		}
		if got := GateState(d.Gates[0], d); got == StateMet {
			t.Errorf("placeholder %q reached met", ev)
		}
		if d.Reduce(nil).AllMet() {
			t.Errorf("placeholder %q: AllMet", ev)
		}
	}
}

// A title's own trailing parenthetical is part of the title, so a note that
// repeats only that parenthetical restates the title and stays unmet.
func TestManualGateTitleParentheticalIsTitleText(t *testing.T) {
	for _, title := range []string{"Refund appears in ledger. (REQ-002)", "Refund appears in ledger (REQ-002)"} {
		for _, note := range []string{"REQ-002", "(REQ-002)", "req 002", "Refund appears in ledger (REQ-002)"} {
			d := ParseLedger("# Gates\n\n- [x] AC-004: " + title + "\n  EVIDENCE: " + note + "\n")
			if len(d.Gates) != 1 {
				t.Fatalf("title %q note %q: gates=%d errs=%v", title, note, len(d.Gates), d.Errors)
			}
			if got := GateState(d.Gates[0], d); got == StateMet {
				t.Errorf("title %q: title-only note %q reached met", title, note)
			}
		}
		d := ParseLedger("# Gates\n\n- [x] AC-004: " + title + "\n  EVIDENCE: REQ-002 confirmed on staging by Brooke\n")
		if got := GateState(d.Gates[0], d); got != StateMet {
			t.Errorf("title %q: substantive note = %s, want met", title, got)
		}
	}
}

func TestManualGateSubstantiveNotesMet(t *testing.T) {
	for _, ev := range []string{"verified on staging by reviewer", "Verified on staging by reviewer (ticket 42)", "done on prod: 3 orders replayed, outcome seen in dashboard",
		"Done: reviewer confirmed checkout on staging (q-12)", "q-12: Brooke confirmed the outcome seen on staging", "Yes - Brooke saw the banner on iPhone 15 (q-7)",
		"(q-12) Brooke confirmed refund on staging", "outcome seen on staging by Brooke", "AC-004 outcome seen on staging by Brooke, q-3", "(Brooke confirmed refund on staging, q-12)"} {
		d := manualLedger(ev)
		if got := GateState(d.Gates[0], d); got != StateMet {
			t.Errorf("substantive %q = %s, want met", ev, got)
		}
		if !d.Reduce(nil).AllMet() {
			t.Errorf("substantive %q not AllMet", ev)
		}
	}
}