alef 0.83.1

use super::*;

fn gen_file(rel: &str, content: &str) -> crate::core::backend::GeneratedFile {
    crate::core::backend::GeneratedFile {
        path: std::path::PathBuf::from(rel),
        content: content.to_string(),
        generated_header: true,
    }
}

fn gen_file_unheadered(rel: &str, content: &str) -> crate::core::backend::GeneratedFile {
    crate::core::backend::GeneratedFile {
        path: std::path::PathBuf::from(rel),
        content: content.to_string(),
        generated_header: false,
    }
}

/// The defect this closes: a pre-existing file at a path alef would emit
/// and mark, but that predates the marker system, deadlocks the write
/// guard forever (see `FrozenFile`'s doc). `alef verify` must surface it
/// even though it never carries a hash to compare, which is why this is a
/// distinct check from `verify_walk`'s stale-hash comparison.
#[test]
fn frozen_managed_paths_reports_an_unmarked_pre_existing_file() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("SomeType.java"), "final class SomeType {}\n").unwrap();
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(frozen.len(), 1);
    assert_eq!(frozen[0].path, dir.path().join("SomeType.java").display().to_string());
    assert_eq!(
        frozen[0].remedy.as_deref(),
        Some("// This file is auto-generated by alef — DO NOT EDIT.")
    );
    assert_eq!(
        frozen[0].near_miss, None,
        "plain hand-written content has no near miss to report"
    );
}

/// A pre-existing file whose leading lines look like a failed attempt at a marker (mentions
/// both "alef" and "generated" without matching `content_has_alef_marker`) is still frozen,
/// but the report should name what's already there, not just what's missing.
#[test]
fn frozen_managed_paths_reports_a_near_miss_when_one_is_present() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(
        dir.path().join("SomeType.java"),
        "// This alef-generated file should not be edited.\nfinal class SomeType {}\n",
    )
    .unwrap();
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(frozen.len(), 1);
    assert_eq!(
        frozen[0].near_miss.as_deref(),
        Some("// This alef-generated file should not be edited.")
    );
}

/// A managed file that already carries the marker is stale-or-fresh
/// territory (`verify_walk`'s job), never frozen — the guard that would
/// deadlock a write never engages once a marker is present.
#[test]
fn frozen_managed_paths_reports_nothing_when_the_existing_file_already_carries_the_marker() {
    let dir = tempfile::tempdir().expect("tempdir");
    let marked = format!(
        "{}final class SomeType {{}}\n",
        crate::core::hash::header(crate::core::hash::CommentStyle::DoubleSlash)
    );
    std::fs::write(dir.path().join("SomeType.java"), &marked).unwrap();
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    assert!(frozen_managed_paths(&files, dir.path(), &[]).is_empty());
}

/// A managed file that does not yet exist is `missing_managed_paths`'
/// territory, not frozen's -- there is nothing on disk to be frozen.
#[test]
fn frozen_managed_paths_reports_nothing_when_the_file_does_not_exist() {
    let dir = tempfile::tempdir().expect("tempdir");
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    assert!(frozen_managed_paths(&files, dir.path(), &[]).is_empty());
}

/// The required negative control: a legitimately user-owned, unmarked
/// scaffold-once file (`Cargo.toml`, `package.json`, gemspec, lockfiles)
/// must never be reported frozen, even though it exists on disk without a
/// marker -- exactly the shape a naive "unmarked file that looks
/// generated" heuristic would misfire on. Getting this wrong would tell
/// users to hand ownership of their own hand-edited files to alef.
#[test]
fn frozen_managed_paths_ignores_a_hand_written_scaffold_file() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("Cargo.toml"), "[package]\nname = \"demo\"\n").unwrap();
    let files = vec![gen_file_unheadered("Cargo.toml", "[package]\nname = \"demo\"\n")];

    assert!(frozen_managed_paths(&files, dir.path(), &[]).is_empty());
}

/// A self-marking backend (custom Swift/Kotlin/Dart/Gleam/Zig headers,
/// `docs::render`'s `.md` pages) bakes its literal header straight into
/// `GeneratedFile::content` regardless of `generated_header`. The remedy
/// must be read from that content, not reconstructed from the path -- a
/// path-derived generic header would be the wrong text to hand back here.
#[test]
fn frozen_managed_paths_reads_the_remedy_from_self_marked_content() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("Foo.swift"), "struct Foo {}\n").unwrap();
    let files = vec![gen_file_unheadered(
        "Foo.swift",
        "// Generated by alef. Do not edit by hand.\nstruct Foo {}\n",
    )];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(frozen.len(), 1);
    assert_eq!(
        frozen[0].remedy.as_deref(),
        Some("// Generated by alef. Do not edit by hand.")
    );
}

/// A managed path whose format has no comment syntax at all (`.json`) and carries no
/// `.alef-ownership.toml` record either is still reported frozen when `generated_header`
/// claims ownership, with no literal marker line to hand back -- there is nothing to
/// paste in, and (unlike the paired positive control below) alef genuinely has no proof
/// of authorship for this path yet, so the write guard would refuse it too.
#[test]
fn frozen_managed_paths_reports_no_remedy_for_an_unmarkable_extension() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("manifest.json"), "{}\n").unwrap();
    let files = vec![gen_file("manifest.json", "{}\n")];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(frozen.len(), 1);
    assert_eq!(frozen[0].remedy, None);
}

/// The defect this closes (alef #-frozen-verify-disagreement): a `.json`-style path that
/// cannot carry a marker but that alef *has* durably recorded owning -- exactly what
/// `alef adopt` or a delete-and-regenerate leaves behind -- must not be reported frozen.
/// Before `frozen_managed_paths` consulted `is_owned_by_ownership_record`, this positive
/// control failed identically to the negative control above: the function only ever
/// checked the content marker, so a file the write guard would happily accept stayed
/// "frozen" in `alef verify`'s report forever.
#[test]
fn frozen_managed_paths_reports_nothing_for_an_unmarkable_extension_with_a_committed_ownership_record() {
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("manifest.json");
    std::fs::write(&path, "{}\n").unwrap();
    crate::cli::cache::record_scaffold_owned_path(dir.path(), &path).expect("record ownership");
    let files = vec![gen_file("manifest.json", "{}\n")];

    assert!(
        frozen_managed_paths(&files, dir.path(), &[]).is_empty(),
        "a path the committed ownership record already proves alef owns must agree with \
         the write guard, which would happily overwrite it"
    );
}

/// Defect B: `.clang-format` is YAML underneath (`#` line comments), so once
/// `marker_header_syntax` recognizes it by file name, a pre-existing unmarked copy must
/// get a real, pasteable remedy -- not the "no comment syntax" message that is only true
/// for genuinely unmarkable formats like `.json`/`DESCRIPTION`. Reporting an impossible
/// remedy for a format that can actually carry one is exactly the failure mode this
/// closes.
#[test]
fn frozen_managed_paths_offers_a_real_remedy_for_clang_format() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join(".clang-format"), "---\nBasedOnStyle: LLVM\n").unwrap();
    let files = vec![gen_file(".clang-format", "---\nBasedOnStyle: LLVM\n")];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(frozen.len(), 1);
    assert_eq!(
        frozen[0].remedy.as_deref(),
        Some("# This file is auto-generated by alef — DO NOT EDIT.")
    );
}

/// Defect: `carries_alef_marker()` is `generated_header || content_has_alef_marker`, so a
/// `GeneratedFile` with `generated_header: false` whose content embeds no marker at all --
/// exactly the PHP backend's `config.m4` (`generate_config_m4`,
/// `src/backends/php/gen_bindings/rust_items.rs`, emitted with `generated_header: false`
/// alongside `.m4` content that carries no alef marker text) -- is filtered out by
/// `managed_generated_files` before `frozen_managed_paths` ever runs its own
/// ownership-record fallback (`is_owned_by_ownership_record`) over it. The write guard
/// (`write_files_report`, `src/cli/pipeline/generate/write.rs`) still refuses to overwrite
/// such a path once it exists without a committed ownership record -- so this was a real
/// write refusal `alef generate` reports but `alef verify` had no way to see, because the
/// candidate never reached the frozen check at all. ~keep
#[test]
fn frozen_managed_paths_reports_an_unmarkable_generated_header_false_file_with_no_ownership_record() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("config.m4"), "dnl old content\n").unwrap();
    let files = vec![gen_file_unheadered(
        "config.m4",
        "dnl Configuration for Rust-based PHP extension via ext-php-rs.\n",
    )];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(
        frozen.len(),
        1,
        "an unmarkable, generated_header: false, unmarked-content file the write guard would \
         refuse must be surfaced by alef verify too"
    );
    assert_eq!(frozen[0].path, dir.path().join("config.m4").display().to_string());
    assert_eq!(
        frozen[0].remedy, None,
        "`.m4` has no comment syntax alef stamps, so there is no literal marker line to hand back"
    );
}

/// The paired positive control: once `.alef-ownership.toml` durably records this exact
/// path -- what `alef generate`'s writer itself does on the run that first authors it
/// (`write_files_report`'s `record_scaffold_owned_path` call) -- the write guard would
/// happily accept the file again, so `alef verify` must agree and stay silent.
#[test]
fn frozen_managed_paths_reports_nothing_for_an_unmarkable_generated_header_false_file_with_a_committed_ownership_record()
 {
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("config.m4");
    std::fs::write(&path, "dnl old content\n").unwrap();
    crate::cli::cache::record_scaffold_owned_path(dir.path(), &path).expect("record ownership");
    let files = vec![gen_file_unheadered(
        "config.m4",
        "dnl Configuration for Rust-based PHP extension via ext-php-rs.\n",
    )];

    assert!(
        frozen_managed_paths(&files, dir.path(), &[]).is_empty(),
        "a path the committed ownership record already proves alef owns must agree with the \
         write guard, which would happily overwrite it"
    );
}

/// THE REGRESSION TEST for the frozen/adopt disagreement (task #133): `alef verify` used
/// to report every frozen path under one heading with one remedy ("run `alef adopt
/// <path>`"), and `alef adopt --write` then refused every create-once seed among them
/// outright -- measured at 85 of 85 frozen paths refused in one consumer repo and 99 of
/// 99 (all of them seeds) in another, naming a flag (`--clobber-create-once-seeds`) the
/// report never mentioned.
///
/// A test that only checked the report's message text would miss this entirely -- the
/// message could say the right words and the command could still refuse the exact path
/// named. This instead drives the real `alef adopt` command against every path
/// `frozen_managed_paths` reports, using exactly the flags its own `create_once` field
/// implies (see `FrozenFile::create_once`'s doc for the remedies `alef verify` actually
/// prints for each), and asserts the command accepts what the report told the operator
/// to run. It is a property of the *pair*, not of either side alone: `create_once` is
/// computed by calling `crate::cli::commands::adopt::is_create_once_seed` directly, so
/// this test cannot pass by the two sides coincidentally agreeing today and silently
/// drifting apart again tomorrow -- only by them sharing one predicate, which is the fix. ~keep
#[test]
fn every_frozen_path_is_actually_accepted_by_the_adopt_invocation_its_create_once_flag_implies() {
    let dir = tempfile::tempdir().expect("tempdir");
    let base = dir.path();

    // A create-once seed: unmarkable format, no prior ownership record -- the exact
    // shape that was 100% of both consumer repos' frozen reports.
    std::fs::write(base.join("config.m4"), "dnl old content\n").unwrap();
    let seed_file = gen_file_unheadered(
        "config.m4",
        "dnl Configuration for Rust-based PHP extension via ext-php-rs.\n",
    );

    // A genuinely adoptable frozen file: on the marker rail, markable format -- the
    // other remedy `alef verify` prints under the split heading.
    std::fs::write(base.join("SomeType.java"), "final class SomeType {}\n").unwrap();
    let marker_rail_file = gen_file("SomeType.java", "final class SomeType {}\n");

    let files = vec![seed_file, marker_rail_file];
    let frozen = frozen_managed_paths(&files, base, &[]);
    assert_eq!(
        frozen.len(),
        2,
        "fixture precondition: both paths must be reported frozen"
    );

    let seed = frozen
        .iter()
        .find(|f| f.path.ends_with("config.m4"))
        .expect("config.m4 must be in the frozen report");
    assert!(
        seed.create_once,
        "an unmarkable, unrecorded seed must classify as create-once"
    );

    let adoptable = frozen
        .iter()
        .find(|f| f.path.ends_with("SomeType.java"))
        .expect("SomeType.java must be in the frozen report");
    assert!(
        !adoptable.create_once,
        "a marker-rail file must never classify as create-once"
    );

    let managed = crate::cli::commands::adopt::managed_outputs(&files, base);

    // The create-once remedy `alef verify` prints names `--clobber-create-once-seeds`
    // explicitly -- prove a plain `--write` is still refused (the old, wrong remedy)
    // and that the flag verify actually names is what the command accepts.
    let plain_write = crate::cli::commands::adopt::AdoptOptions {
        target: "config.m4".to_owned(),
        base_dir: base.to_path_buf(),
        write: true,
        converged_only: false,
        clobber_create_once_seeds: false,
    };
    assert!(
        crate::cli::commands::adopt::run(&plain_write, &managed).is_err(),
        "a plain `alef adopt --write` must still refuse a create-once seed -- if this ever \
         passes, `is_create_once_seed` and this fixture's `config.m4` have drifted apart"
    );
    let clobbering = crate::cli::commands::adopt::AdoptOptions {
        clobber_create_once_seeds: true,
        ..plain_write
    };
    let seed_report = crate::cli::commands::adopt::run(&clobbering, &managed)
        .expect("the exact remedy `alef verify` prints for a create-once seed must be accepted");
    assert_eq!(seed_report.adopted, vec![std::path::PathBuf::from("config.m4")]);

    // The genuinely-adoptable remedy `alef verify` prints under the other heading is a
    // plain `--write`, no clobber flag -- prove that succeeds too.
    let adopt_marker_rail = crate::cli::commands::adopt::AdoptOptions {
        target: "SomeType.java".to_owned(),
        base_dir: base.to_path_buf(),
        write: true,
        converged_only: false,
        clobber_create_once_seeds: false,
    };
    let adoptable_report = crate::cli::commands::adopt::run(&adopt_marker_rail, &managed).expect(
        "the remedy `alef verify` prints for a genuinely adoptable frozen file must be accepted \
         under a plain --write",
    );
    assert_eq!(
        adoptable_report.adopted,
        vec![std::path::PathBuf::from("SomeType.java")]
    );
}

/// The paired control for the create-once-only case: a single genuinely adoptable
/// (non-create-once) frozen file must still be reported, even sitting alongside a create-once
/// seed that must not. Mixing both shapes in one fixture proves `has_adoptable_frozen_files`
/// reads each entry's own `create_once` flag rather than, say, checking only the first element
/// or the list length. Salvaged from a superseded branch whose fix landed by another route. ~keep
#[test]
fn has_adoptable_frozen_files_is_true_when_one_of_several_frozen_files_is_adoptable() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("seed.zzz"), "old seed content\n").unwrap();
    std::fs::write(dir.path().join("SomeType.java"), "final class SomeType {}\n").unwrap();
    let files = vec![
        gen_file_unheadered("seed.zzz", "fresh seed content\n"),
        gen_file("SomeType.java", "final class SomeType {}\n"),
    ];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);
    assert_eq!(frozen.len(), 2, "fixture precondition: both paths must be frozen");

    assert!(
        has_adoptable_frozen_files(&frozen),
        "a genuinely adoptable frozen file must still be detected even alongside a \
         create-once seed that must not gate the exit code on its own"
    );
}

/// Base case: nothing frozen means nothing to adopt.
#[test]
fn has_adoptable_frozen_files_is_false_for_an_empty_list() {
    assert!(!super::has_adoptable_frozen_files(&[]));
}

/// Drives the real `frozen_managed_paths` on a fixture whose only frozen path is a create-once
/// seed -- `generated_header: false`, no self-marked content, no ownership record, and an
/// extension `is_alef_derived_output` does not recognize (the `.csproj`/`.zon`/`.m4` shape two
/// consumer repos hit, 85 of 85 and 99 of 99 frozen paths respectively). Before the exit-code
/// fix the gate was "is the frozen list non-empty", which this fixture would have failed
/// forever, since a plain `alef generate` deliberately never adds a seed's marker. ~keep
#[test]
fn has_adoptable_frozen_files_is_false_when_every_frozen_file_is_a_create_once_seed() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("seed.zzz"), "old seed content\n").unwrap();
    let files = vec![crate::core::backend::GeneratedFile {
        path: std::path::PathBuf::from("seed.zzz"),
        content: "fresh seed content\n".to_string(),
        generated_header: false,
    }];

    let frozen = super::frozen_managed_paths(&files, dir.path(), &[]);
    assert_eq!(
        frozen.len(),
        1,
        "fixture precondition: exactly one frozen create-once seed"
    );
    assert!(
        frozen[0].create_once,
        "fixture precondition: the seed must classify as create-once"
    );
    assert!(
        !super::has_adoptable_frozen_files(&frozen),
        "a frozen list of only create-once seeds has nothing `alef adopt --write` accepts, so \
         verify must not gate its exit code on it"
    );
}

/// Negative control: a genuinely adoptable frozen file MUST still gate. Without this the test
/// above would pass just as well if the predicate always returned false. ~keep
#[test]
fn has_adoptable_frozen_files_is_true_when_a_real_adoptable_frozen_file_remains() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("binding.rs"), "fn hand_written() {}\n").unwrap();
    let files = vec![crate::core::backend::GeneratedFile {
        path: std::path::PathBuf::from("binding.rs"),
        content: "fn generated() {}\n".to_string(),
        generated_header: true,
    }];

    let frozen = super::frozen_managed_paths(&files, dir.path(), &[]);
    assert_eq!(frozen.len(), 1, "fixture precondition: exactly one frozen file");
    assert!(
        !frozen[0].create_once,
        "fixture precondition: this one is on the marker rail"
    );
    assert!(super::has_adoptable_frozen_files(&frozen));
}

/// THE Part 1 regression, end to end through the same call `alef verify` makes.
///
/// A create-once seed on disk with no marker must not appear in the frozen report at all, and
/// the report must not name `--clobber-create-once-seeds`. Measured cause: a consumer's two CI
/// jobs failed on "Frozen generated files detected" listing 102 paths, of which `alef adopt
/// --converged-only` adopted zero -- 72 refused by alef itself as create-once seeds (13 LICENSE
/// files, `mvnw`, `gradlew`, `build.zig.zon`, `.gitkeep`s), leaving the destructive flag as the
/// only escape alef offered for files its own documentation calls user-owned after scaffold.
///
/// Driven through `frozen_managed_paths` rather than a hand-built `FrozenFile`, so a
/// classification change that stopped marking these `create_once` would fail here rather than
/// pass by accident. `LICENSE` has no extension and so no comment syntax alef will key on,
/// which is exactly the shape every one of the 72 refused paths had: unmarkABLE, emitted
/// `generated_header: false`, and therefore a create-once seed by `is_create_once_seed`. ~keep
#[test]
fn report_lines_omits_a_create_once_seed_and_never_names_the_clobber_flag() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("LICENSE"), "Copyright the consumer\n").unwrap();
    let files = vec![gen_file_unheadered("LICENSE", "Copyright <holder>\n")];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);
    assert_eq!(frozen.len(), 1, "the seed is still classified");
    assert!(
        frozen[0].create_once,
        "an unmarked seed with unmarked content is create-once"
    );

    let report = super::report_lines(&frozen);
    assert!(
        report.is_empty(),
        "a create-once seed must not be reported as frozen: {report:?}"
    );
    assert_eq!(super::unmarked_create_once_seeds(&frozen).len(), 1);
}

/// The other half: a genuinely adoptable frozen file must still get its heading and a pointer
/// to `alef adopt <path> --write` -- never an instruction to hand-paste the marker, which
/// `crate::cli::pipeline::generate::write::report_refused_writes` (the write guard's own
/// refusal message) explicitly warns against. Without this, deleting the whole report would
/// satisfy the test above. ~keep
#[test]
fn report_lines_still_reports_a_genuinely_adoptable_frozen_file() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("SomeType.java"), "final class SomeType {}\n").unwrap();
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);
    let report = super::report_lines(&frozen).join("\n");
    assert!(report.contains("Frozen generated files detected"), "{report}");
    assert!(report.contains("SomeType.java"), "{report}");
    assert!(report.contains("alef adopt <path> --write"), "{report}");
    assert!(
        !report.contains("add marker:"),
        "the report must never instruct a reader to hand-paste the marker -- that is the exact \
         workflow the write guard warns against: {report}"
    );
    assert!(super::unmarked_create_once_seeds(&frozen).is_empty());
}

/// THE DEFECT this file's new assertions close: a frozen file was described only by its
/// ownership ("carries no marker"), never by its content. A frozen file that already IS what
/// alef would generate and one whose withheld content has gone stale were reported the same
/// way, so a refusal on version-derived content was indistinguishable from a file that is
/// simply up to date -- which is how three consumer repositories shipped a generated installer
/// pinned to a stale release for weeks. ~keep
#[test]
fn frozen_managed_paths_marks_a_frozen_file_whose_body_differs_as_drifted() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(
        dir.path().join("Widget.java"),
        "final class Widget { String v = \"1.2.1\"; }\n",
    )
    .unwrap();
    let files = vec![gen_file(
        "Widget.java",
        "final class Widget { String v = \"1.4.2\"; }\n",
    )];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(frozen.len(), 1);
    assert!(
        frozen[0].drifted,
        "the file on disk is not what alef would write, and the report has to be able to say so"
    );
}

/// THE CONTROL. Without it, "report every frozen file as drifted" passes the test above and the
/// distinction buys nothing. A `generated_header: true` file whose body already matches is
/// frozen -- alef cannot prove it owns it -- but nothing about it is stale: the only difference
/// is the provenance header alef itself would prepend, and that is the ordinary shape of an
/// entire consumer tree that predates alef stamping its extension. ~keep
#[test]
fn frozen_managed_paths_does_not_mark_a_body_identical_frozen_file_as_drifted() {
    let dir = tempfile::tempdir().expect("tempdir");
    let body = "final class Widget { String v = \"1.4.2\"; }\n";
    std::fs::write(dir.path().join("Widget.java"), body).unwrap();
    let files = vec![gen_file("Widget.java", body)];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(frozen.len(), 1, "still frozen: alef cannot prove it owns the file");
    assert!(
        !frozen[0].drifted,
        "but not stale -- the only withheld difference is the header alef would add"
    );
}

/// A shebang takes the header on the line BELOW it, so for every generated shell script the
/// provenance alef would add is interior rather than a prefix. A convergence test written as
/// "the generated bytes are the existing bytes plus a prefix" reports every one of them stale
/// on every run -- a false positive on exactly the file type this whole change is about. ~keep
#[test]
fn frozen_managed_paths_does_not_mark_a_converged_shell_script_as_drifted() {
    let dir = tempfile::tempdir().expect("tempdir");
    let body = "#!/usr/bin/env bash\nset -euo pipefail\nrun\n";
    std::fs::write(dir.path().join("run_tests.sh"), body).unwrap();
    let files = vec![gen_file("run_tests.sh", body)];

    let frozen = frozen_managed_paths(&files, dir.path(), &[]);

    assert_eq!(frozen.len(), 1);
    assert!(
        !frozen[0].drifted,
        "the header goes below the shebang, which is a header-only difference like any other"
    );
}

/// The classification has to reach the operator. A report that classified correctly and printed
/// the same lines as before would leave the defect exactly where it was.
#[test]
fn report_lines_distinguish_a_stale_frozen_file_from_a_settled_one() {
    let lines = report_lines(&[
        adoptable_frozen("/repo/Stale.java", true),
        adoptable_frozen("/repo/Settled.java", false),
    ])
    .join("\n");

    assert!(
        lines.contains("/repo/Stale.java"),
        "the drifted file must be named, since no count identifies which file went stale"
    );
    assert!(
        lines.contains("content DIFFERS from what alef would generate"),
        "and must be described as differing, not merely as unowned: {lines}"
    );
    assert!(
        lines.contains("content already matches what alef would generate"),
        "the settled file must read as benign -- otherwise a reader has to open every file to \
         find the one that matters: {lines}"
    );
}

fn adoptable_frozen(path: &str, drifted: bool) -> FrozenFile {
    FrozenFile {
        path: path.to_owned(),
        remedy: None,
        near_miss: None,
        create_once: false,
        drifted,
        rewritten_every_run: true,
    }
}

/// THE HOLE this closes, in the exact shape a consumer hit it: a markable, `generated_header:
/// false` file under a root the e2e writer rewrites with `overwrite = true`. It carries no
/// marker in memory, so `managed_generated_files` skips it; its extension IS markable, so
/// `unmarkable_unclaimed_files` skips it too -- and `alef verify` could not see it at all, not
/// as a finding, not as a seed, not in any count, while the write guard refused the same
/// differing write on every single run. ~keep
#[test]
fn a_markable_unmarked_seed_under_a_rewritten_root_is_reported_as_drifted() {
    let dir = tempfile::tempdir().expect("tempdir");
    let root = dir.path().join("e2e");
    std::fs::create_dir_all(root.join("php")).unwrap();
    std::fs::write(root.join("php/install.sh"), "#!/usr/bin/env bash\nVERSION=1.2.1\n").unwrap();
    let files = vec![gen_file_unheadered(
        "e2e/php/install.sh",
        "#!/usr/bin/env bash\nVERSION=1.4.2\n",
    )];

    let frozen = frozen_managed_paths(&files, dir.path(), &[root]);

    assert_eq!(frozen.len(), 1, "the file must reach the frozen walk at all");
    assert!(frozen[0].drifted && frozen[0].create_once && frozen[0].rewritten_every_run);
    assert_eq!(
        drifted_frozen_seeds(&frozen),
        vec![dir.path().join("e2e/php/install.sh").display().to_string()],
        "a seed alef re-renders every run, whose content differs, is the withheld-and-stale case"
    );
    let report = drifted_seed_report_lines(&frozen).join("\n");
    assert!(
        report.contains("install.sh"),
        "the report must name the file, not only count it: {report}"
    );
}

/// THE CONTROL for the case above: the identical file shape whose content already matches. It
/// is still an unmarked seed and still unverified, but there is nothing withheld and nothing to
/// act on, so it must not appear on the drifted list or in its report. ~keep
#[test]
fn a_markable_unmarked_seed_under_a_rewritten_root_that_matches_is_not_reported_as_drifted() {
    let dir = tempfile::tempdir().expect("tempdir");
    let root = dir.path().join("e2e");
    std::fs::create_dir_all(root.join("php")).unwrap();
    let body = "#!/usr/bin/env bash\nVERSION=1.4.2\n";
    std::fs::write(root.join("php/install.sh"), body).unwrap();
    let files = vec![gen_file_unheadered("e2e/php/install.sh", body)];

    let frozen = frozen_managed_paths(&files, dir.path(), &[root]);

    assert_eq!(
        frozen.len(),
        1,
        "still an unmarked seed alef makes no content claim about"
    );
    assert!(!frozen[0].drifted);
    assert!(drifted_frozen_seeds(&frozen).is_empty());
    assert!(
        drifted_seed_report_lines(&frozen).is_empty(),
        "a benign frozen seed must produce no heading at all"
    );
}

/// THE SCOPING CONTROL. The same drifted file under an `overwrite = false` writer is skipped by
/// `can_skip` before any check runs: alef never attempts the write, so nothing is withheld and
/// the difference is a seed a human grew past the placeholder. Reporting it would put user-owned
/// files back on a findings list, which is the measured failure `report_lines` was narrowed to
/// escape. ~keep
#[test]
fn the_same_drifted_seed_outside_a_rewritten_root_is_not_reported() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::create_dir_all(dir.path().join("packages/php")).unwrap();
    std::fs::write(
        dir.path().join("packages/php/install.sh"),
        "#!/usr/bin/env bash\nVERSION=1.2.1\n",
    )
    .unwrap();
    let files = vec![gen_file_unheadered(
        "packages/php/install.sh",
        "#!/usr/bin/env bash\nVERSION=1.4.2\n",
    )];

    assert!(
        frozen_managed_paths(&files, dir.path(), &[dir.path().join("e2e")]).is_empty(),
        "a create-once seed alef never re-attempts is not frozen and not drifted"
    );
}

/// xberg#1535: `alef verify` printed the "frozen path(s) DRIFTED"
/// block naming 21 version-bearing manifests, then three lines later asserted the unqualified
/// "All bindings and versions are up to date." for that very same run and exited 0. This proves
/// [`report_sign_off_line`] -- what `alef verify` actually prints as its closing line -- can
/// never again produce that unqualified sentence once [`drifted_frozen_seeds`] is non-empty,
/// using the real [`frozen_managed_paths`] walk (not a hand-built `FrozenFile` list) so the two
/// cannot drift apart without failing here. Before the fix this test's first assertion failed:
/// the call site printed the bare literal regardless of the finding count. ~keep
#[test]
fn sign_off_line_is_not_the_unqualified_up_to_date_sentence_when_seeds_have_drifted() {
    let dir = tempfile::tempdir().expect("tempdir");
    let root = dir.path().join("e2e");
    std::fs::create_dir_all(root.join("php")).unwrap();
    std::fs::create_dir_all(root.join("node")).unwrap();
    std::fs::write(root.join("php/install.sh"), "#!/usr/bin/env bash\nVERSION=1.2.1\n").unwrap();
    std::fs::write(root.join("node/install.sh"), "#!/usr/bin/env bash\nVERSION=1.2.1\n").unwrap();
    let files = vec![
        gen_file_unheadered("e2e/php/install.sh", "#!/usr/bin/env bash\nVERSION=1.4.2\n"),
        gen_file_unheadered("e2e/node/install.sh", "#!/usr/bin/env bash\nVERSION=1.4.2\n"),
    ];

    let frozen = frozen_managed_paths(&files, dir.path(), &[root]);
    let drifted = drifted_frozen_seeds(&frozen);
    assert_eq!(
        drifted.len(),
        2,
        "both version-bearing fixtures must be counted as drifted create-once seeds: {drifted:?}"
    );

    let sign_off = report_sign_off_line(drifted.len());

    assert_ne!(
        sign_off, "All bindings and versions are up to date.",
        "a run that just reported drifted frozen paths must never also assert the unqualified \
         sign-off for the same run: {sign_off}"
    );
    assert_eq!(
        sign_off,
        "2 frozen path(s) drifted and not enforced (see the DRIFTED block above); everything \
         else is up to date.",
        "the sign-off must state the exact count and stay honest about what it does and does \
         not cover"
    );
}

/// The converse control: an otherwise-clean run (no drifted seeds at all) must still get the
/// plain, unqualified sentence -- this fix must not turn every clean `alef verify` run into a
/// qualified one. ~keep
#[test]
fn sign_off_line_stays_the_unqualified_sentence_when_nothing_has_drifted() {
    assert_eq!(report_sign_off_line(0), "All bindings and versions are up to date.");
}