doctrine 0.15.2

// SPDX-License-Identifier: GPL-3.0-only
//! `doctrine revision` — the REV change-axis kind (SL-066, ADR-013). A Revision is
//! a first-class **work-lifecycle** entity, peer to slice/REC on the change axis: it
//! carries a pending revise-intent against authored governance/spec truth plus a
//! staged delta payload (the `[[change]]` rows). PHASE-02 stood up the kind itself —
//! schema + scaffold/show/status — and the THREE corpus-walk arms a new `KINDS` row is
//! consumed by (G1 partition, G2 `dep_seq`, G3 outbound). PHASE-03 adds the typed
//! `[[change]]` `revises` payload (§4.4), the `revision change add` writer, and fills
//! the `relation_edges` accessor — each `[[change]]` row projects to one `Revises`
//! edge, surfaced outbound on `inspect REV-N` and inbound on `inspect ADR-X`/`REQ-N`.
//!
//! REV rides the REC eager-materialise seam verbatim (no parallel impl): a numbered
//! authored kind with an eager-materialised fileset (`revision-NNN.toml` +
//! `revision-NNN.md` plus the `NNN-slug` symlink), a `KINDS` row, and a status-ful
//! scan. Its fields exceed `ScaffoldCtx` (`status`, `approval`, the seeded dep/seq
//! block, and the future `[[change]]` payload), so like REC it materialises eagerly
//! rather than via `Kind.scaffold`.
//!
//! Lifecycle borrows backlog's work FSM — `proposed → started → done` (+ `abandoned`
//! from any non-terminal) — NOT slice's 9-state classifier. `approval` is a SEPARATE
//! field (`none | requested | approved | rejected`), ORTHOGONAL to status (entity-
//! model "approval is not lifecycle", ADR-009): lifecycle transitions are
//! approval-blind, so a `started` REV at `approval=none` is valid. The default `gate`
//! posture is a baked v1 default (ADR-009's slice-FSM-state-keyed `[conduct]` table
//! does not address Revision; extending it is deferred). `approval` is seeded `none`
//! and not mutated this phase — the `approve` verb is PHASE-05.

use std::fs;
use std::io::{self, Write};
use std::path::{Path, PathBuf};

use anyhow::Context;
use serde::{Deserialize, Serialize};

use crate::CommonListArgs;
use crate::entity::{self, Kind, Materialised};
use crate::listing::{self, Column, Format, ListArgs};
use crate::requirement::ReqStatus;
use crate::tomlfmt::toml_string;

use std::str::FromStr;

use clap::Subcommand;

// ---------------------------------------------------------------------------
// CLI enums & dispatch (PHASE-03 relocation from main.rs)
// ---------------------------------------------------------------------------

#[derive(Subcommand)]
pub(crate) enum RevisionChangeCommand {
    /// Append one `[[change]]` row to a revision (design §4.4). Shape-routed by
    /// `--action`: a creation op (`introduce`/`create`) takes `--new-label` (required,
    /// frozen) + `--member-of` (a live SPEC); an existing-target op
    /// (`modify`/`retire`/`move`/`status`) takes `--target` (a live peer FK), with
    /// `--to-status` and an auto-captured `from` for a `status` row.
    Add {
        /// REV reference — `REV-007` or the bare id `7`.
        reference: String,

        /// The change action.
        #[arg(long)]
        action: ChangeAction,

        /// Existing-target ops: the live peer FK (`REQ-201`, `ADR-006`).
        #[arg(long)]
        target: Option<String>,

        /// `status` rows: the requested target status.
        #[arg(long = "to-status")]
        to_status: Option<String>,

        /// Creation ops: the frozen membership label (required for `introduce`/`create`).
        #[arg(long = "new-label")]
        new_label: Option<String>,

        /// Creation ops: the destination spec (a live `SPEC-NNN`).
        #[arg(long = "member-of")]
        member_of: Option<String>,

        /// `introduce`: the new requirement's statement line (optional).
        #[arg(long = "new-statement")]
        new_statement: Option<String>,

        /// Mark this row the revision's headline subject (display-only; at most one).
        #[arg(long)]
        primary: bool,

        /// Explicit project root (default: auto-detect).
        #[arg(short = 'p', long)]
        path: Option<PathBuf>,
    },
}

#[derive(Subcommand)]
pub(crate) enum RevisionCommand {
    /// Create a new revision.
    /// A fresh REV is a skeleton (`proposed`,
    /// `approval=none`, no change rows); `revision change add` (PHASE-03) populates
    /// the typed `[[change]]` payload.
    New {
        /// REV title.
        title: Option<String>,

        /// Explicit slug (default: derived from the title).
        #[arg(long)]
        slug: Option<String>,

        /// Provenance RFC reference (e.g. `RFC-007`). Authors ONE `originates_from`
        /// relation row — a typed provenance edge, NOT a `[[change]]` payload.
        #[arg(long)]
        originates_from: Option<String>,

        /// Explicit project root (default: auto-detect).
        #[arg(short = 'p', long)]
        path: Option<PathBuf>,
    },

    /// Show one revision: status, approval, change rows, rationale.
    Show {
        /// REV reference — `REV-007` or the bare id `7`.
        reference: String,

        /// Output format.
        #[arg(long, value_parser = Format::from_str, default_value_t = Format::Table)]
        format: Format,

        /// Shorthand for `--format json`.
        #[arg(long)]
        json: bool,

        /// Explicit project root (default: auto-detect).
        #[arg(short = 'p', long)]
        path: Option<PathBuf>,
    },

    /// Transition a revision's status.
    /// States: proposed→started→done; abandoned from any non-terminal. Approval-blind.
    Status {
        /// REV reference — `REV-007` or the bare id `7`.
        reference: String,

        /// Target lifecycle state.
        state: RevStatus,

        /// Explicit project root (default: auto-detect).
        #[arg(short = 'p', long)]
        path: Option<PathBuf>,
    },

    /// Author the typed `[[change]]` payload — the `revises` rows (the touched-entity
    /// set). The ONLY writer of a `revises` edge; `doctrine link … revises …` is
    /// refused (`TypedVerbOnly`).
    Change {
        #[command(subcommand)]
        command: RevisionChangeCommand,
    },

    /// Approve a revision.
    /// `revision apply` refuses unless approved (invoker-blind: a solo dev
    /// self-approves; ADR-009).
    Approve {
        /// REV reference — `REV-007` or the bare id `7`.
        reference: String,

        /// Explicit project root (default: auto-detect).
        #[arg(short = 'p', long)]
        path: Option<PathBuf>,
    },

    /// Apply an approved revision.
    /// Auto-lands `status` rows (each via the requirement status setter + one REC),
    /// surfaces introduce/create/modify/move/prose rows for manual handling.
    /// Refused unless `approval = approved`. A pre-flight all-or-nothing
    /// from-guard aborts the whole apply if any target moved since the change was drafted.
    Apply {
        /// REV reference — `REV-007` or the bare id `7`.
        reference: String,

        /// Explicit project root (default: auto-detect).
        #[arg(short = 'p', long)]
        path: Option<PathBuf>,
    },

    /// Print the file paths of each revision entity directory.
    Paths {
        /// Revision reference(s) — `REV-007` or the bare id `7`.
        refs: Vec<String>,

        #[arg(short = 't', long)]
        toml: bool,
        #[arg(short = 'm', long)]
        md: bool,
        #[arg(short = 'e', long)]
        entity: bool,
        #[arg(short = 's', long)]
        single: bool,

        #[arg(short = 'p', long)]
        path: Option<PathBuf>,
    },

    /// List revisions with filtering, column selection, and tag surfacing.
    List {
        #[command(flatten)]
        list: CommonListArgs,

        #[arg(short = 'p', long)]
        path: Option<PathBuf>,
    },
}

pub(crate) fn dispatch(cmd: RevisionCommand, color: bool) -> anyhow::Result<()> {
    match cmd {
        RevisionCommand::New {
            title,
            slug,
            path,
            originates_from,
        } => run_new(path, title, slug, originates_from.as_deref()),
        RevisionCommand::Show {
            reference,
            format,
            json,
            path,
        } => run_show(path, &reference, if json { Format::Json } else { format }),
        RevisionCommand::Status {
            reference,
            state,
            path,
        } => run_status(path, &reference, state, color),
        RevisionCommand::Change { command } => match command {
            RevisionChangeCommand::Add {
                reference,
                action,
                target,
                to_status,
                new_label,
                member_of,
                new_statement,
                primary,
                path,
            } => run_change_add(
                path,
                &reference,
                &ChangeAddArgs {
                    action,
                    target,
                    to_status,
                    new_label,
                    member_of,
                    new_statement,
                    primary,
                },
            ),
        },
        RevisionCommand::Approve { reference, path } => run_approve(path, &reference),
        RevisionCommand::Apply { reference, path } => run_apply(path, &reference),
        RevisionCommand::List { list, path } => run_list(path, list.into_list_args(color)),
        RevisionCommand::Paths {
            refs,
            toml,
            md,
            entity,
            single,
            path,
        } => {
            use std::io::Write;
            let root = crate::root::find(path, &crate::root::default_markers())?;
            let rev_root = root.join(REV_DIR);
            let sel = crate::paths::PathSelection {
                toml,
                md,
                entity,
                single,
            };
            let mut all_lines: Vec<String> = Vec::new();
            for r in &refs {
                let id = parse_ref(r)?;
                let name = format!("{id:03}");
                let entity_dir = rev_root.join(&name);
                let toml_name = format!("revision-{name}.toml");
                let md_name = format!("revision-{name}.md");
                let set = crate::paths::scan_entity_dir(
                    &entity_dir,
                    &entity_dir.join(&toml_name),
                    Some(&entity_dir.join(&md_name)),
                    &root,
                )?;
                let lines = crate::paths::select_paths(&set, &sel)?;
                all_lines.extend(lines);
            }
            write!(std::io::stdout(), "{}", all_lines.join("\n"))?;
            Ok(())
        }
    }
}

// ---------------------------------------------------------------------------
// Pure core — the two closed vocabularies REV owns (`status`, `approval`), each
// with a kebab serde derive (the single variant↔string source) + an `as_str`
// render mirror + a `&[&str]` known-set kept in lockstep by a drift canary test
// (the backlog.rs / rec.rs pattern).
// ---------------------------------------------------------------------------

/// A Revision's work-lifecycle status. Closed set, kebab serde (round-trips the
/// toml's `status`), `clap::ValueEnum` (the `revision status <state>` positional —
/// the slice-status precedent). Borrows backlog's work shape, NOT slice's 9-state
/// (R: backlog and slice lifecycles are independent vocabularies).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, clap::ValueEnum)]
#[serde(rename_all = "kebab-case")]
pub(crate) enum RevStatus {
    Proposed,
    Started,
    Done,
    Abandoned,
}

impl RevStatus {
    /// The kebab string for render (matches the serde rename). Lockstep-guarded
    /// against [`REV_STATUSES`] by `rev_statuses_matches_the_variants`.
    pub(crate) const fn as_str(self) -> &'static str {
        match self {
            RevStatus::Proposed => "proposed",
            RevStatus::Started => "started",
            RevStatus::Done => "done",
            RevStatus::Abandoned => "abandoned",
        }
    }

    /// Whether this status is terminal (`done`/`abandoned`). A **REV-local**
    /// predicate — explicitly NOT slice's or backlog's terminal set (independent
    /// vocabularies). Drives the FSM `validate_transition` refuse-leave-terminal
    /// rule, and binds the G1 partition's `terminal` set (the VT-2 canary).
    const fn is_terminal(self) -> bool {
        matches!(self, RevStatus::Done | RevStatus::Abandoned)
    }
}

/// The REV status known-set — the four `RevStatus` variants, REV's OWN vocabulary
/// (NOT backlog's `open/triaged/started/resolved/closed`). The authority the G1
/// [`crate::priority::partition`] canary binds against; lockstep-guarded against the
/// enum by `rev_statuses_matches_the_variants`. Consumed only by the cross-module
/// G1 drift canary (`revision_partition_covers_the_real_vocabulary`) — a `cfg(test)`
/// reference — and by this module's own canary, so it is dead in the non-test lib;
/// the partition row spells its vocab literally, the canary proves they agree. The
pub(crate) const REV_STATUSES: &[&str] = &["proposed", "started", "done", "abandoned"];

/// A Revision's approval state — a SEPARATE field, ORTHOGONAL to `status` (hard
/// canon: entity-model "approval is not lifecycle", ADR-009). Closed set, kebab
/// serde. Seeded `none`; mutated by the `approve` verb (PHASE-05), NOT this phase.
/// Lifecycle transitions are approval-blind, so a `started` REV at `approval=none`
/// is valid (the apply-time checkpoint that consults approval is PHASE-05).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "kebab-case")]
pub(crate) enum Approval {
    None,
    Requested,
    Approved,
    Rejected,
}

impl Approval {
    /// The kebab string for render (matches the serde rename). Lockstep-guarded
    /// against [`APPROVALS`] by `approvals_matches_the_variants`.
    const fn as_str(self) -> &'static str {
        match self {
            Approval::None => "none",
            Approval::Requested => "requested",
            Approval::Approved => "approved",
            Approval::Rejected => "rejected",
        }
    }
}

/// The `Approval` known-set — lockstep-guarded against the enum by
/// `approvals_matches_the_variants`. Test-only drift canary anchor this phase (the
/// `approve` verb that reads it in non-test builds is PHASE-05).
#[cfg_attr(
    not(test),
    expect(
        dead_code,
        reason = "SL-066 PHASE-02: approval vocab SSoT — consumed only by the drift canary now; the PHASE-05 approve verb reads it in non-test builds"
    )
)]
const APPROVALS: &[&str] = &["none", "requested", "approved", "rejected"];

// ---------------------------------------------------------------------------
// SL-155: list surface — constants consumed by list_rows (PHASE-01)
// ---------------------------------------------------------------------------

/// Statuses hidden from the default list view (terminal states).
const REV_HIDDEN: &[&str] = &["done", "abandoned"];

// ---------------------------------------------------------------------------
// Pure FSM — the REV-local legal-transition guard (NOT slice's classifier).
// ---------------------------------------------------------------------------

/// The pure REV-local lifecycle gate (design §4.2; the backlog `validate_transition`
/// shape — pure, returns Ok/err): the legal graph is `proposed → started`,
/// `started → done`, and `{proposed, started} → abandoned`. Refuses leaving a
/// terminal source (`done`/`abandoned`) and refuses a skip (`proposed → done`). A
/// no-op (`from == to`) is allowed (idempotent). APPROVAL-BLIND — `approval` is never
/// consulted (lifecycle transitions are approval-blind, ADR-009). No clock/disk.
fn validate_transition(from: RevStatus, to: RevStatus) -> anyhow::Result<()> {
    if from == to {
        return Ok(()); // idempotent no-op.
    }
    if from.is_terminal() {
        anyhow::bail!(
            "revision is terminal (`{}`) — no transition out of a terminal status",
            from.as_str()
        );
    }
    let legal = matches!(
        (from, to),
        (RevStatus::Proposed, RevStatus::Started)
            | (RevStatus::Started, RevStatus::Done)
            | (
                RevStatus::Proposed | RevStatus::Started,
                RevStatus::Abandoned
            )
    );
    if legal {
        Ok(())
    } else {
        anyhow::bail!(
            "illegal revision transition `{}` → `{}` (legal: proposed→started, \
             started→done, proposed/started→abandoned)",
            from.as_str(),
            to.as_str()
        )
    }
}

// ---------------------------------------------------------------------------
// Schema — the authored `revision-NNN.toml` shape (PHASE-02 subset). The
// `[[change]]` payload is PHASE-03; this phase seeds an empty `[relationships]`
// dep/seq block so the G2 `dep_seq::read` arm is total now (D4).
// ---------------------------------------------------------------------------

/// The full `revision-NNN.toml` read/written as data (design §4.1, PHASE-02 subset).
/// `id/slug/title/status` round-trip into the shared `meta::Meta`; `approval` is the
/// orthogonal field. The `[[change]]` payload rows are PHASE-03 — NOT modelled here.
#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
pub(crate) struct RevDoc {
    pub(crate) id: u32,
    pub(crate) slug: String,
    pub(crate) title: String,
    pub(crate) status: RevStatus,
    pub(crate) approval: Approval,
    #[serde(default)]
    pub(crate) tags: Vec<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "crate::estimate::deserialize_lenient"
    )]
    pub(crate) estimate: Option<crate::estimate::EstimateFacet>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "crate::value::deserialize_lenient"
    )]
    pub(crate) value: Option<crate::value::ValueFacet>,
}

// ---------------------------------------------------------------------------
// Kind row + eager render (design §4.1; the rec.rs eager-materialise shape).
// ---------------------------------------------------------------------------

/// Relative dir of the REV tree inside the project root — a distinct top-level
/// authored tree (design §4.1), parallel to `.doctrine/rec`.
pub(crate) const REV_DIR: &str = ".doctrine/revision";

/// The REV kind: `revision-NNN.toml` + `revision-NNN.md` + `NNN-slug` symlink,
/// riding the kind-blind engine. The scaffold is inert — REV's fields exceed
/// `ScaffoldCtx` (`status`/`approval`/seeded dep/seq/future `[[change]]`), so it
/// renders its fileset eagerly in [`run_new`] (the rec rationale); this stub exists
/// only to satisfy the `Kind` descriptor `integrity::KINDS` references.
pub(crate) const REV_KIND: Kind = Kind {
    dir: REV_DIR,
    prefix: crate::kinds::REV,
    stem: "revision",
    scaffold: rev_scaffold_unused,
};

/// Inert scaffold — see [`REV_KIND`]. REV never rides `Kind.scaffold`; this is the
/// descriptor stub.
fn rev_scaffold_unused(_ctx: &entity::ScaffoldCtx<'_>) -> anyhow::Result<entity::Fileset> {
    anyhow::bail!("revision materialises eagerly, not via Kind.scaffold")
}

/// Render `revision-NNN.toml` from the embedded template (design §4.1). Every
/// user-supplied string (`slug`/`title`) is spliced through `toml_string`, so a
/// hostile value can neither break the document nor inject a key
/// (mem.pattern.render.toml-splice-escape-user-values). A fresh REV seeds
/// `status = "proposed"`, `approval = "none"`, the `updated` stamp, and an empty
/// `[relationships]` dep/seq block (so the G2 read arm is total). `date` is the
/// injected clock (the shell stamps it; the pure render stays clock-free).
fn render_revision_toml(
    id: u32,
    slug: &str,
    title: &str,
    date: &str,
    originates_from: Option<&str>,
) -> anyhow::Result<String> {
    let mut toml = crate::install::asset_text("templates/revision.toml")?
        .replace("{{id}}", &id.to_string())
        .replace("{{slug}}", &toml_string(slug))
        .replace("{{title}}", &toml_string(title))
        .replace("{{date}}", date);
    if let Some(rfcref) = originates_from {
        use std::fmt::Write;
        writeln!(toml, "\n[[relation]]")?;
        writeln!(toml, "label = \"originates_from\"")?;
        writeln!(toml, "target = \"{rfcref}\"")?;
    }
    Ok(toml)
}

/// Render `revision-NNN.md` — the rationale companion (design §4.1). Plain markdown
/// token substitution (no toml-splice escaping: markdown body, not a structured
/// value).
fn render_revision_md(canonical: &str, title: &str) -> anyhow::Result<String> {
    Ok(crate::install::asset_text("templates/revision.md")?
        .replace("{{ref}}", canonical)
        .replace("{{title}}", title))
}

// ---------------------------------------------------------------------------
// The `[[change]]` payload (design §4.3/§4.4) — the typed `revises` rows. TWO row
// shapes share one table (F3 — creation ops cannot key on an FK that does not exist
// yet): existing-target ops (`modify|retire|move|status`) key on a live FK; creation
// ops (`introduce|create`) carry a frozen `new_label` + a live `member_of` SPEC. The
// rows ARE the edges (members.toml precedent): each row projects to one `Revises`
// edge whose target is the FK (existing-target ops) or the destination SPEC (creation
// ops), so inbound reciprocity on `inspect ADR-X` covers every touching REV uniformly.
// ---------------------------------------------------------------------------

/// A `[[change]]` row's action verb (design §4.4). Closed set, kebab serde + a
/// `clap::ValueEnum` for the `revision change add --action` selector. Splits into two
/// shapes by [`ChangeAction::is_creation`]: creation ops (`introduce`/`create`) mint a
/// new entity (frozen `new_label` + `member_of`); existing-target ops key on a live FK
/// (`from` auto-captured for `status`). Lockstep-guarded against [`CHANGE_ACTIONS`].
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, clap::ValueEnum)]
#[serde(rename_all = "kebab-case")]
pub(crate) enum ChangeAction {
    /// Existing-target: edit a peer's statement / prose (surfaced-for-manual at apply).
    Modify,
    /// Existing-target: lifecycle-retire a peer (surfaced-for-manual at apply).
    Retire,
    /// Existing-target: move a requirement's spec membership (surfaced-for-manual).
    Move,
    /// Existing-target: a requirement status move — the one auto-applied row (PHASE-05),
    /// `from` auto-captured at `change add` (the §4.5 from-guard input).
    Status,
    /// Creation: introduce a new requirement into a live `member_of` SPEC.
    Introduce,
    /// Creation: create a new spec.
    Create,
}

impl ChangeAction {
    /// The kebab string for render (matches the serde rename). Lockstep-guarded against
    /// [`CHANGE_ACTIONS`] by `change_actions_matches_the_variants`.
    const fn as_str(self) -> &'static str {
        match self {
            ChangeAction::Modify => "modify",
            ChangeAction::Retire => "retire",
            ChangeAction::Move => "move",
            ChangeAction::Status => "status",
            ChangeAction::Introduce => "introduce",
            ChangeAction::Create => "create",
        }
    }

    /// Whether this is a CREATION op (`introduce`/`create`) — keys on no pre-existing
    /// FK, so it carries a frozen `new_label` (REQUIRED, E4) + a live `member_of`
    /// instead of a `target`. The complement is the existing-target ops, which key on a
    /// live FK with `from` auto-captured for `status`.
    const fn is_creation(self) -> bool {
        matches!(self, ChangeAction::Introduce | ChangeAction::Create)
    }
}

/// The `ChangeAction` known-set — lockstep-guarded against the enum by
/// `change_actions_matches_the_variants`. Consumed only by that drift canary (a
/// `cfg(test)` reference), so it reads as dead in the non-test lib; the `--action`
/// surface binds the enum directly via `clap::ValueEnum`, not this set.
#[cfg_attr(
    not(test),
    expect(
        dead_code,
        reason = "SL-066 PHASE-03: ChangeAction vocab SSoT — consumed only by the drift canary; clap binds the enum directly"
    )
)]
const CHANGE_ACTIONS: &[&str] = &["modify", "retire", "move", "status", "introduce", "create"];

/// One authored `[[change]]` row (design §4.4) — the typed `revises` payload. TWO
/// shapes share the struct via optional columns: existing-target ops populate `target`
/// (the live FK); creation ops populate `new_label` (required, frozen) + `member_of`
/// (a live SPEC). `primary` is a display/headline hint only (F1 — at most one,
/// optional; nothing functional keys on it). Detail columns (`from`/`to_status`/
/// `new_statement`/`allocated`) are optional, populated only where the action warrants.
/// `#[serde(default)]` keeps a minimal hand-trimmed row parseable (the read-tolerant
/// convention).
#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
pub(crate) struct ChangeRow {
    /// Existing-target ops: the live peer FK (`REQ-201`, `ADR-006`). Absent on
    /// creation ops (no id exists until apply).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) target: Option<String>,
    /// The action verb (the row discriminant).
    pub(crate) action: ChangeAction,
    /// Display/headline hint only — at most one per REV (F1). NOT a dep anchor.
    #[serde(default)]
    pub(crate) primary: bool,
    /// `status` rows: the target's `ReqStatus` AT `change add` (auto-captured) — the
    /// pre-flight from-guard input (PHASE-05).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) from: Option<String>,
    /// `status` rows: the requested target status.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) to_status: Option<String>,
    /// Creation ops: the FROZEN membership label (REQUIRED, E4 — keeps approved ==
    /// landed against membership churn between draft and apply).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) new_label: Option<String>,
    /// Creation ops: the destination spec (a live `SPEC-NNN`; no cross-row creation
    /// deps in v1).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) member_of: Option<String>,
    /// `introduce`: the new requirement's statement line (optional detail).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) new_statement: Option<String>,
    /// Apply back-fill (PHASE-05): the id a creation op allocated. Absent until applied.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) allocated: Option<String>,
}

/// The `[[change]]`-row document shape — the array of payload rows. `#[serde(default)]`
/// so a REV with no rows (a fresh `revision new`) parses to an empty payload (the
/// read-tolerant convention every kind module follows). Every other key (`id`/`status`/
/// `[relationships]` …) is ignored by this targeted parse.
#[derive(Debug, Default, Deserialize)]
struct ChangeDoc {
    #[serde(default)]
    change: Vec<ChangeRow>,
}

impl ChangeRow {
    /// The `Revises` edge target of this row: the existing-target FK, or the creation
    /// op's destination `member_of` SPEC. `None` for a malformed row carrying neither —
    /// such a row contributes no edge (a dangler-free skip; `change add` refuses to
    /// author one, so this only guards a hand-broken file).
    fn edge_target(&self) -> Option<&str> {
        self.target.as_deref().or(self.member_of.as_deref())
    }
}

/// A revision's authored outbound relations (design §4.3/§4.4). Reads the `[[change]]`
/// payload and projects each row to ONE `Revises` edge (the rows ARE the edges,
/// members.toml precedent): existing-target ops emit an edge to their FK, creation ops
/// to their destination `member_of` SPEC. The engine [`crate::relation_graph`] interns
/// these as outbound `revises` (on `inspect REV-N`) and, via the indexed `in_edges`
/// reverse-adjacency, surfaces them as inbound `revises` on the touched targets
/// (`inspect ADR-X` / `inspect REQ-N`) — uniform over ALL rows, NOT keyed on `primary`.
/// A REV with no `[[change]]` rows (or only malformed rows) yields no edges. NEVER reads
/// `show` (ADR-004 §3 reserves inbound completeness to the scan-backed `inspect`).
pub(crate) fn relation_edges(
    root: &Path,
    id: u32,
) -> anyhow::Result<Vec<crate::relation::RelationEdge>> {
    let name = format!("{id:03}");
    let path = root
        .join(REV_DIR)
        .join(&name)
        .join(format!("revision-{name}.toml"));
    let text = fs::read_to_string(&path)
        .with_context(|| format!("revision {name} not found at {}", path.display()))?;
    let doc: ChangeDoc =
        toml::from_str(&text).with_context(|| format!("Failed to parse {}", path.display()))?;
    Ok(doc
        .change
        .iter()
        .filter_map(|row| {
            row.edge_target().map(|t| {
                crate::relation::RelationEdge::new(
                    crate::relation::RelationLabel::Revises,
                    t.to_owned(),
                )
            })
        })
        .collect())
}

// ---------------------------------------------------------------------------
// CLI: `revision new`
// ---------------------------------------------------------------------------

/// `doctrine revision new "<title>" [--slug S] [--originates-from RFC-NNN]` — allocate
/// a fresh REV and write its skeleton (`status = proposed`, `approval = none`, empty
/// dep/seq + no `[[change]]` rows) plus the rationale md. When `originates_from` is
/// supplied, the skeleton carries ONE `[[relation]]` `originates_from` row (a typed
/// provenance edge, NOT a `[[change]]` payload). Mirrors `rec::run_new`'s claim-retry
/// materialise. Prints the canonical `REV-NNN` id.
pub(crate) fn run_new(
    path: Option<PathBuf>,
    title: Option<String>,
    slug: Option<String>,
    originates_from: Option<&str>,
) -> anyhow::Result<()> {
    let root = crate::root::find(path, &crate::root::default_markers())?;
    let trunk_ids = crate::git::trunk_entity_ids(&root, REV_DIR)?;
    let (backend, mut reserved) =
        crate::reserve::backend(&root, REV_KIND.prefix, crate::install::prompt_confirm)?;
    let title = crate::input::resolve_title(title)?;
    let slug = crate::input::resolve_slug(&title, slug)?;
    let date = crate::clock::today();

    // Validate and canonicalise the optional originates-from ref.
    let rfcref: Option<String> = match originates_from {
        Some(raw) => {
            use crate::integrity;
            let (kref, id) = integrity::parse_canonical_ref(raw)
                .map_err(|e| anyhow::anyhow!("invalid --originates-from `{raw}`: {e}"))?;
            anyhow::ensure!(
                kref.kind.prefix == "RFC",
                "--originates-from must be an RFC reference, got `{raw}` (prefix `{}`)",
                kref.kind.prefix
            );
            let canonical = crate::listing::canonical_id(kref.kind.prefix, id);
            integrity::ensure_ref_resolves(&root, &canonical).map_err(|e| {
                anyhow::anyhow!("--originates-from `{canonical}` does not resolve: {e}")
            })?;
            Some(canonical)
        }
        None => None,
    };

    let out: Materialised = entity::materialise_fresh_prebuilt(
        &*backend,
        &root,
        REV_DIR,
        REV_KIND.prefix,
        &trunk_ids,
        &mut reserved,
        |id, canonical| {
            let name = format!("{id:03}");
            Ok(vec![
                entity::Artifact::File {
                    rel_path: PathBuf::from(format!("{name}/revision-{name}.toml")),
                    body: render_revision_toml(id, &slug, &title, &date, rfcref.as_deref())?,
                },
                entity::Artifact::File {
                    rel_path: PathBuf::from(format!("{name}/revision-{name}.md")),
                    body: render_revision_md(canonical, &title)?,
                },
                entity::Artifact::Symlink {
                    rel_path: PathBuf::from(format!("{name}-{slug}")),
                    target: name,
                },
            ])
        },
    )?;

    let id = out
        .eid
        .numeric_id()
        .context("revision kind must yield a numeric id")?;
    writeln!(
        io::stdout(),
        "Created revision {id:03}: {}",
        out.dir.display()
    )?;
    Ok(())
}

// ---------------------------------------------------------------------------
// show — REV is status-ful; the reader surfaces its own local state (no derived
// status, no cross-corpus scan — the show reader is pure over the entity's own
// file, ADR-004 §3).
// ---------------------------------------------------------------------------

/// The `REV-NNN` canonical id for a numeric rev id, via the single id-form authority.
fn canonical_id(id: u32) -> String {
    listing::canonical_id(REV_KIND.prefix, id)
}

/// Parse a revision reference — `REV-007`, `revision-7`, or the bare id `7` — to its
/// id.
fn parse_ref(reference: &str) -> anyhow::Result<u32> {
    let digits = reference
        .strip_prefix("REV-")
        .or_else(|| reference.strip_prefix("revision-"))
        .unwrap_or(reference);
    digits.parse::<u32>().with_context(|| {
        format!("not a revision reference: `{reference}` (expected `REV-007` or `7`)")
    })
}

/// Read one REV's `revision-NNN.toml` as data.
fn read_revision(rev_root: &Path, id: u32) -> anyhow::Result<RevDoc> {
    let name = format!("{id:03}");
    let path = rev_root.join(&name).join(format!("revision-{name}.toml"));
    let text = fs::read_to_string(&path)
        .with_context(|| format!("revision {name} not found at {}", path.display()))?;
    toml::from_str(&text).with_context(|| format!("Failed to parse {}", path.display()))
}

/// Read the `revision-NNN.md` rationale body (the prose companion).
fn read_rationale(rev_root: &Path, id: u32) -> anyhow::Result<String> {
    let name = format!("{id:03}");
    let path = rev_root.join(&name).join(format!("revision-{name}.md"));
    fs::read_to_string(&path).with_context(|| format!("Failed to read {}", path.display()))
}

/// `doctrine revision show <REV-NNN>` — read the REV as data and render the readable
/// whole (`Table`) or the faithful toml-as-data + rationale (`Json`).
pub(crate) fn run_show(
    path: Option<PathBuf>,
    reference: &str,
    format: Format,
) -> anyhow::Result<()> {
    let root = crate::root::find(path, &crate::root::default_markers())?;
    let rev_root = root.join(REV_DIR);
    let id = parse_ref(reference)?;
    let doc = read_revision(&rev_root, id)?;
    let body = read_rationale(&rev_root, id)?;
    let out = match format {
        Format::Table => {
            let cfg = crate::dtoml::load_doctrine_toml(&root)?;
            let estimation_unit = crate::estimate::resolve_unit(&cfg.estimation);
            let value_unit = crate::value::resolve_unit(&cfg.value);
            let (lower_pct, upper_pct) = crate::estimate::resolve_confidence(&cfg.estimation)?;
            format_show(
                &doc,
                &body,
                &estimation_unit,
                &value_unit,
                lower_pct,
                upper_pct,
            )
        }
        Format::Json => show_json(&doc, &body)?,
    };
    write!(io::stdout(), "{out}")?;
    Ok(())
}

/// Render the `Table` show: identity header, the status + approval, then the
/// rationale body. House style — `Vec<String>` joined by `concat`.
fn format_show(
    doc: &RevDoc,
    body: &str,
    estimation_unit: &str,
    value_unit: &str,
    lower_pct: f64,
    upper_pct: f64,
) -> String {
    let mut parts: Vec<String> = Vec::new();
    parts.push(format!("{} — {}\n", canonical_id(doc.id), doc.title));
    parts.push(format!(
        "status={} · approval={}\n",
        doc.status.as_str(),
        doc.approval.as_str()
    ));
    if let Some(ref est) = doc.estimate {
        parts.push(format!(
            "{}\n",
            crate::estimate::display::format_estimate_confidence(
                est,
                lower_pct,
                upper_pct,
                estimation_unit,
            )
        ));
    }
    if let Some(ref val) = doc.value {
        parts.push(format!(
            "{}\n",
            crate::value::format_value_normal(val, value_unit)
        ));
    }
    parts.push(format!("\n{body}"));
    parts.concat()
}

/// Render the `Json` show under the shared `{kind, …}` envelope. The closed enums
/// render via `as_str` (a hand-projected row, not a derive that would leak Rust
/// idents).
fn show_json(doc: &RevDoc, body: &str) -> anyhow::Result<String> {
    let mut value = serde_json::json!({
        "kind": "revision",
        "revision": {
            "id": canonical_id(doc.id),
            "slug": doc.slug,
            "title": doc.title,
            "status": doc.status.as_str(),
            "approval": doc.approval.as_str(),
            "tags": doc.tags,
        },
        "body": body,
    });
    if let Some(ref est) = doc.estimate
        && let Some(obj) = value.get_mut("revision").and_then(|v| v.as_object_mut())
    {
        obj.insert(
            "estimate".to_string(),
            serde_json::json!({
                "lower": est.lower,
                "upper": est.upper,
            }),
        );
    }
    if let Some(ref val) = doc.value
        && let Some(obj) = value.get_mut("revision").and_then(|v| v.as_object_mut())
    {
        obj.insert(
            "value".to_string(),
            serde_json::json!({
                "value": val.value,
            }),
        );
    }
    serde_json::to_string_pretty(&value).context("failed to serialize revision show JSON")
}

// ---------------------------------------------------------------------------
// status — the positional `<REV-N> <state>` FSM transition verb (slice precedent),
// gated by the REV-local `validate_transition`, written edit-preservingly via the
// shared `dep_seq::set_authored_status` seam (approval untouched).
// ---------------------------------------------------------------------------

/// `doctrine revision status <REV-N> <state>` — classify and write a REV lifecycle
/// transition (design §4.2; the slice-status precedent). Reads the current authored
/// status, gates the move via [`validate_transition`] (approval-blind), writes it
/// edit-preservingly via the shared `dep_seq::set_authored_status` seam, and prints
/// the move. `approval` is NEVER touched (orthogonal — the `approve` verb is
/// PHASE-05). A missing item hard-errors (read fails); never an implicit create.
pub(crate) fn run_status(
    path: Option<PathBuf>,
    reference: &str,
    state: RevStatus,
    color: bool,
) -> anyhow::Result<()> {
    let root = crate::root::find(path, &crate::root::default_markers())?;
    let rev_root = root.join(REV_DIR);
    let id = parse_ref(reference)?;
    let from = read_revision(&rev_root, id)?.status;
    // Gate in the shell, BEFORE the write: the REV-local legal-transition guard.
    validate_transition(from, state)?;
    set_revision_status(&rev_root, id, state, &crate::clock::today())?;
    writeln!(
        io::stdout(),
        "{} → {}",
        crate::listing::status_colored(from.as_str(), color),
        crate::listing::status_colored(state.as_str(), color)
    )?;
    Ok(())
}

/// Edit-preserving status transition on one authored `revision-NNN.toml` — the
/// backlog `set_backlog_status` precedent: delegates the write-core (no-op guard +
/// F-1 refuse + edit-preserving insert) to the shared `dep_seq::set_authored_status`
/// seam, so the inert `[relationships]` table, hand-added comments, the `approval`
/// field, and unknown keys all survive (the file is never reserialised). Stamps
/// `updated`; leaves `approval` untouched (orthogonal axis). The gate is the
/// caller's; this owns only the write.
fn set_revision_status(
    rev_root: &Path,
    id: u32,
    state: RevStatus,
    today: &str,
) -> anyhow::Result<()> {
    let name = format!("{id:03}");
    let path = rev_root.join(&name).join(format!("revision-{name}.toml"));
    let hint = format!(
        "malformed revision {name}: missing seeded `status`/`updated` (regenerate via `revision new`)"
    );
    crate::dep_seq::set_authored_status(
        &path,
        &[("status", state.as_str()), ("updated", today)],
        &hint,
    )?;
    Ok(())
}

// ---------------------------------------------------------------------------
// CLI: `revision change add` — author one `[[change]]` payload row (design §4.4).
// The ONLY writer of a `Revises` edge (the rule row is `TypedVerbOnly`; `doctrine
// link … revises …` is refused at `validate_link`). Validates the row against the
// rule (target kind + existence), auto-captures `from` for a status row, freezes
// `new_label` for a creation row, enforces at-most-one `primary` and the OQ-1 dedup,
// then appends edit-preservingly. NEVER mutates the target — that is `apply` (PHASE-05).
// ---------------------------------------------------------------------------

/// The parsed `revision change add` arguments (the thin CLI carrier). `clap` parses
/// `--action` to the closed [`ChangeAction`]; the optional columns are validated in
/// [`run_change_add`] against the row shape (so a missing `--new-label` on a creation
/// op or a missing `--target` on an existing-target op is a clean, testable refusal —
/// NOT a clap arity error that couples the two shapes into one required-arg set).
pub(crate) struct ChangeAddArgs {
    pub(crate) action: ChangeAction,
    pub(crate) target: Option<String>,
    pub(crate) to_status: Option<String>,
    pub(crate) new_label: Option<String>,
    pub(crate) member_of: Option<String>,
    pub(crate) new_statement: Option<String>,
    pub(crate) primary: bool,
}

/// `doctrine revision change add REV-N --action <a> …` — author one `[[change]]` row.
///
/// Shape-routed (F3): a CREATION op (`introduce`/`create`) carries a frozen
/// `--new-label` (REQUIRED, E4) + a live `--member-of` SPEC, NO `--target`; an
/// existing-target op (`modify`/`retire`/`move`/`status`) keys on a live `--target` FK
/// validated against the `revises` rule (`{SPEC,PRD,REQ,ADR,POL,STD}` — off-target
/// refused), with `from` AUTO-captured from the target's current `ReqStatus` for a
/// `status` row. `primary` is at-most-one (F1). OQ-1: a second row of the same
/// `(action, target)` for an existing-target op is refused (the change is named once).
pub(crate) fn run_change_add(
    path: Option<PathBuf>,
    reference: &str,
    args: &ChangeAddArgs,
) -> anyhow::Result<()> {
    let root = crate::root::find(path, &crate::root::default_markers())?;
    let rev_root = root.join(REV_DIR);
    let id = parse_ref(reference)?;
    // The REV must exist (never an implicit create); also reads the current payload
    // for the primary + dedup guards.
    read_revision(&rev_root, id)?;
    let existing = read_change_rows(&rev_root, id)?;

    let row = build_row(&root, args, &existing)?;
    append_change_row(&rev_root, id, &row)?;

    let subject = row
        .target
        .clone()
        .or_else(|| row.member_of.clone())
        .unwrap_or_default();
    writeln!(
        io::stdout(),
        "{}: change {} {}",
        canonical_id(id),
        row.action.as_str(),
        subject
    )?;
    Ok(())
}

/// Build + validate the row from the args and the REV's existing rows — PURE over the
/// inputs save the from-capture / existence reads it performs against `root`. Splits on
/// [`ChangeAction::is_creation`]; both arms enforce the at-most-one `primary` guard.
fn build_row(
    root: &Path,
    args: &ChangeAddArgs,
    existing: &[ChangeRow],
) -> anyhow::Result<ChangeRow> {
    // F1 — at most one primary per REV. Refuse a second.
    if args.primary && existing.iter().any(|r| r.primary) {
        anyhow::bail!(
            "this revision already has a primary change row — `primary` is at most one (F1)"
        );
    }

    if args.action.is_creation() {
        build_creation_row(root, args)
    } else {
        build_existing_target_row(root, args, existing)
    }
}

/// A creation op (`introduce`/`create`): `new_label` REQUIRED + frozen (E4), `member_of`
/// a live `SPEC-NNN` (no cross-row creation deps in v1). `target`/`from`/`to_status`
/// MUST be absent (a creation op keys on no FK).
fn build_creation_row(root: &Path, args: &ChangeAddArgs) -> anyhow::Result<ChangeRow> {
    anyhow::ensure!(
        args.target.is_none(),
        "`--target` is not valid for a creation op (`{}`) — it keys on no pre-existing FK; use `--member-of`",
        args.action.as_str()
    );
    anyhow::ensure!(
        args.to_status.is_none(),
        "`--to-status` is only valid for a `status` row"
    );
    // E4 — `new_label` is REQUIRED + frozen at change add (membership churn between
    // draft and apply would otherwise silently change what lands).
    let new_label = args.new_label.clone().with_context(|| {
        format!(
            "a creation op (`{}`) requires `--new-label` (frozen at change add, E4)",
            args.action.as_str()
        )
    })?;
    // `member_of` must name a live SPEC (the destination spec; not a PRD/other kind).
    let member_of = args.member_of.clone().with_context(|| {
        format!(
            "a creation op (`{}`) requires `--member-of` naming a live SPEC-NNN",
            args.action.as_str()
        )
    })?;
    let (kref, _) = crate::integrity::parse_canonical_ref(&member_of)?;
    anyhow::ensure!(
        kref.kind.prefix == "SPEC",
        "`--member-of` must name a SPEC, got a {}",
        kref.kind.prefix
    );
    crate::integrity::ensure_ref_resolves(root, &member_of)?;

    Ok(ChangeRow {
        target: None,
        action: args.action,
        primary: args.primary,
        from: None,
        to_status: None,
        new_label: Some(new_label),
        member_of: Some(member_of),
        new_statement: args.new_statement.clone(),
        allocated: None,
    })
}

/// An existing-target op (`modify`/`retire`/`move`/`status`): keys on a live `--target`
/// FK, validated against the `revises` rule (target kind ∈ {SPEC,PRD,REQ,ADR,POL,STD},
/// off-target refused) + existence. For `status`: `--to-status` REQUIRED and `from`
/// AUTO-captured from the target's CURRENT `ReqStatus` (the §4.5 from-guard input).
/// OQ-1 dedup: a second row of the same `(action, target)` is refused.
fn build_existing_target_row(
    root: &Path,
    args: &ChangeAddArgs,
    existing: &[ChangeRow],
) -> anyhow::Result<ChangeRow> {
    anyhow::ensure!(
        args.new_label.is_none() && args.member_of.is_none(),
        "`--new-label` / `--member-of` are only valid for a creation op (`introduce`/`create`)"
    );
    let target = args.target.clone().with_context(|| {
        format!(
            "an existing-target op (`{}`) requires `--target` naming a live peer FK",
            args.action.as_str()
        )
    })?;

    // Validate the target against the `revises` rule: kind ∈ the six authored-truth
    // kinds (off-target — e.g. `revises SL-001` — refused), then existence.
    let (kref, _) = crate::integrity::parse_canonical_ref(&target)?;
    let rule = crate::relation::lookup(&REV_KIND, crate::relation::RelationLabel::Revises, None)
        .context("internal: missing `revises` rule row")?;
    crate::relation::check_target_kind(rule, &REV_KIND, kref.kind.prefix)?;
    crate::integrity::ensure_ref_resolves(root, &target)?;

    // OQ-1 — the change is named once per target: refuse a second row of the same
    // (action, target). (Against the table shape: existing-target ops key on the FK, so
    // two `status` rows for one REQ are contradictory; the rule generalises to every
    // existing-target action.)
    anyhow::ensure!(
        !existing
            .iter()
            .any(|r| r.action == args.action && r.target.as_deref() == Some(target.as_str())),
        "this revision already carries a `{}` change for {target} (OQ-1: a change is named once)",
        args.action.as_str()
    );

    // `status` rows: auto-capture `from` from the target's current ReqStatus; require
    // `--to-status`. Only REQ carries a ReqStatus, so a `status` row targets a REQ.
    let (from, to_status) = if args.action == ChangeAction::Status {
        anyhow::ensure!(
            kref.kind.prefix == "REQ",
            "a `status` change targets a requirement (REQ), got a {}",
            kref.kind.prefix
        );
        let to = args
            .to_status
            .clone()
            .context("a `status` change requires `--to-status`")?;
        let current = crate::requirement::load(root, &target)?.status;
        (Some(current.as_str().to_owned()), Some(to))
    } else {
        anyhow::ensure!(
            args.to_status.is_none(),
            "`--to-status` is only valid for a `status` row"
        );
        (None, None)
    };

    Ok(ChangeRow {
        target: Some(target),
        action: args.action,
        primary: args.primary,
        from,
        to_status,
        new_label: None,
        member_of: None,
        new_statement: args.new_statement.clone(),
        allocated: None,
    })
}

/// Read the REV's existing `[[change]]` rows (for the primary + dedup guards). An
/// absent payload (a fresh REV) reads as empty (the read-tolerant convention).
fn read_change_rows(rev_root: &Path, id: u32) -> anyhow::Result<Vec<ChangeRow>> {
    let name = format!("{id:03}");
    let path = rev_root.join(&name).join(format!("revision-{name}.toml"));
    let text = fs::read_to_string(&path)
        .with_context(|| format!("revision {name} not found at {}", path.display()))?;
    let doc: ChangeDoc =
        toml::from_str(&text).with_context(|| format!("Failed to parse {}", path.display()))?;
    Ok(doc.change)
}

/// Append one `[[change]]` row to `revision-NNN.toml` edit-preservingly (the
/// `toml_edit::DocumentMut` in-place idiom — the `[relationships]` block, comments,
/// `approval`, and unknown keys all survive; never a parse→serialise round-trip). Every
/// user free-text value (`new_statement`) rides `toml_string`; structured fields are
/// closed vocab / validated refs, spliced as bare literals. The `[[change]]` array is
/// CREATED if absent (unlike `[relationships]`, it is not scaffold-seeded — a fresh REV
/// carries none).
fn append_change_row(rev_root: &Path, id: u32, row: &ChangeRow) -> anyhow::Result<()> {
    let name = format!("{id:03}");
    let path = rev_root.join(&name).join(format!("revision-{name}.toml"));
    let text = fs::read_to_string(&path)
        .with_context(|| format!("revision {name} not found at {}", path.display()))?;
    let mut doc = text
        .parse::<toml_edit::DocumentMut>()
        .with_context(|| format!("Failed to parse {}", path.display()))?;

    let array = doc
        .entry("change")
        .or_insert_with(|| toml_edit::Item::ArrayOfTables(toml_edit::ArrayOfTables::new()))
        .as_array_of_tables_mut()
        .context("malformed revision: `change` is present but is not an array-of-tables")?;

    let mut table = toml_edit::Table::new();
    if let Some(t) = &row.target {
        table.insert("target", toml_edit::value(t.as_str()));
    }
    table.insert("action", toml_edit::value(row.action.as_str()));
    table.insert("primary", toml_edit::value(row.primary));
    if let Some(f) = &row.from {
        table.insert("from", toml_edit::value(f.as_str()));
    }
    if let Some(to) = &row.to_status {
        table.insert("to_status", toml_edit::value(to.as_str()));
    }
    if let Some(l) = &row.new_label {
        table.insert("new_label", toml_edit::value(l.as_str()));
    }
    if let Some(m) = &row.member_of {
        table.insert("member_of", toml_edit::value(m.as_str()));
    }
    if let Some(s) = &row.new_statement {
        table.insert("new_statement", toml_edit::value(s.as_str()));
    }
    array.push(table);

    crate::fsutil::write_atomic(&path, doc.to_string().as_bytes())
        .with_context(|| format!("Failed to write {}", path.display()))
}

// ---------------------------------------------------------------------------
// CLI: `revision approve` — the orthogonal approval flip (design §4.2). Sets
// `approval = approved` edit-preservingly (the orthogonal field; `status` untouched).
// This is the apply-time forcing-function checkpoint's enabling act — NOT
// actor-attributed authz (ADR-009 §invoker-blind: a solo dev self-approves). A
// missing REV hard-errors (read fails); never an implicit create.
// ---------------------------------------------------------------------------

/// `doctrine revision approve <REV-N>` — record an explicit approval on the orthogonal
/// `approval` axis (sets `approval = approved`), edit-preservingly. `status` is NEVER
/// touched (orthogonal — approval is not lifecycle, ADR-009). This is the enabling act
/// for the apply checkpoint (§4.2): `revision apply` REFUSES unless `approval =
/// approved`. Invoker-blind — it records THAT an approval happened, not WHO.
pub(crate) fn run_approve(path: Option<PathBuf>, reference: &str) -> anyhow::Result<()> {
    let root = crate::root::find(path, &crate::root::default_markers())?;
    let rev_root = root.join(REV_DIR);
    let id = parse_ref(reference)?;
    // The REV must exist (read fails otherwise — never an implicit create).
    let doc = read_revision(&rev_root, id)?;
    set_revision_approval(&rev_root, id, Approval::Approved, &crate::clock::today())?;
    writeln!(
        io::stdout(),
        "{} approval: {} → approved",
        canonical_id(id),
        doc.approval.as_str()
    )?;
    Ok(())
}

/// Edit-preserving approval transition on one authored `revision-NNN.toml` — the
/// `set_revision_status` precedent, but over the orthogonal `approval` key (plus the
/// `updated` stamp). Delegates to the shared `dep_seq::set_authored_status` seam, so
/// the `[relationships]` table, the `[[change]]` payload, comments, `status`, and
/// unknown keys all survive (the file is never reserialised). Leaves `status`
/// untouched (orthogonal axis).
fn set_revision_approval(
    rev_root: &Path,
    id: u32,
    approval: Approval,
    today: &str,
) -> anyhow::Result<()> {
    let name = format!("{id:03}");
    let path = rev_root.join(&name).join(format!("revision-{name}.toml"));
    let hint = format!(
        "malformed revision {name}: missing seeded `approval`/`updated` (regenerate via `revision new`)"
    );
    crate::dep_seq::set_authored_status(
        &path,
        &[("approval", approval.as_str()), ("updated", today)],
        &hint,
    )?;
    Ok(())
}

// ---------------------------------------------------------------------------
// CLI: `revision apply` — auto-land `status` rows, surface the rest for manual
// (design §4.5). v1 auto-lands ONLY rows whose action is `status`: each rides the
// engine-callable `requirement::set_status` + composes one `RecDoc` (REC untouched,
// `owning_slice = None`). introduce/create/modify/move + ADR/POL/STD prose rows are
// surfaced-for-manual (listed, never auto-applied — only `status` has an engine seam).
// Apply REFUSES unless `approval = approved` (the §4.2 checkpoint). A pre-flight
// all-or-nothing from-guard sweep reads the CURRENT ReqStatus for every status row and
// aborts the WHOLE apply if any `current != row.from` (or the target is missing) —
// writing nothing (never silently clobbers an intervening reconcile move). Terminal
// disposition (§4.2): status-only → `done` (dependents unblock); a REV also carrying
// surfaced-for-manual rows stays `started` (status landed, manual list printed) until
// the operator completes them and marks `done` by hand (done never lies).
// ---------------------------------------------------------------------------

/// One status row resolved for apply — the parsed `to_status` plus the requirement's
/// numeric id and FK. PURE-derived in the pre-flight, consumed by the writer.
struct PlannedStatus {
    fk: String,
    req_id: u32,
    to: ReqStatus,
}

/// A from-guard staleness finding (pure): the status row whose stored `from` no longer
/// matches the target's current `ReqStatus` (the target moved since the change was
/// drafted), or whose target cannot be resolved. Surfaced as the stale set; ANY entry
/// aborts the whole apply before the first write.
struct StaleFinding {
    fk: String,
    expected_from: String,
    actual: String,
}

/// Parse a `ReqStatus` from its kebab string (the inverse of `as_str`), via serde over
/// the closed enum — no hand-maintained match that could drift from the variants. Used
/// to turn a stored `to_status` / a current-status string into the typed status the
/// setter takes. Pure.
fn parse_req_status(s: &str) -> anyhow::Result<ReqStatus> {
    serde_json::from_value::<ReqStatus>(serde_json::Value::String(s.to_owned()))
        .with_context(|| format!("not a known requirement status: `{s}`"))
}

/// Partition the REV's change rows into the auto-landable `status` set and the
/// surfaced-for-manual remainder (PURE over the rows). Only `status` rows have a v1
/// engine seam; everything else (introduce/create/modify/move + ADR/POL/STD prose) is
/// surfaced-for-manual.
fn partition_change_rows(rows: &[ChangeRow]) -> (Vec<&ChangeRow>, Vec<&ChangeRow>) {
    rows.iter().partition(|r| r.action == ChangeAction::Status)
}

/// `doctrine revision apply <REV-N>` — land the approved change rows (design §4.5).
///
/// The shell: resolve root, read the REV, enforce the approval checkpoint, partition
/// the rows, run the pre-flight all-or-nothing from-guard sweep over the `status` rows
/// (existence + `from` vs current `ReqStatus`), then — only if the sweep is clean —
/// write each status row (`set_status` + one `RecDoc`), print the surfaced-for-manual
/// list, and settle the terminal disposition. All git/disk live here; the from-guard
/// classification + `RecDoc` composition are pure over the resolved inputs (mirrors
/// reconcile.rs).
pub(crate) fn run_apply(path: Option<PathBuf>, reference: &str) -> anyhow::Result<()> {
    let root = crate::root::find(path, &crate::root::default_markers())?;
    let rev_root = root.join(REV_DIR);
    let id = parse_ref(reference)?;
    let doc = read_revision(&rev_root, id)?;

    // The apply-time forcing-function checkpoint (§4.2 / E3): refuse unless an explicit
    // approval act has been recorded. Invoker-blind — not actor-attributed authz.
    anyhow::ensure!(
        doc.approval == Approval::Approved,
        "{} is not approved (approval = `{}`) — run `doctrine revision approve {}` before apply",
        canonical_id(id),
        doc.approval.as_str(),
        canonical_id(id)
    );

    let rows = read_change_rows(&rev_root, id)?;
    let (status_rows, manual_rows) = partition_change_rows(&rows);

    // Pre-flight all-or-nothing from-guard sweep (§4.5, F7→E1): read CURRENT ReqStatus
    // for every status row (existence + from-guard), THEN write. Any refusal here aborts
    // the WHOLE apply before the first write — never a partial land, never a silent
    // clobber of an intervening reconcile move. Builds the resolved write plan as it
    // sweeps; collects every stale/missing finding so the operator sees the full set.
    let mut planned: Vec<PlannedStatus> = Vec::new();
    let mut stale: Vec<StaleFinding> = Vec::new();
    for row in &status_rows {
        let fk = row
            .target
            .clone()
            .context("internal: a `status` change row carries no target")?;
        let expected_from = row
            .from
            .clone()
            .context("internal: a `status` change row carries no captured `from`")?;
        let to_str = row
            .to_status
            .clone()
            .context("internal: a `status` change row carries no `to_status`")?;
        // Parse `to_status` up front — an unknown target status is a hard refusal BEFORE
        // any write (still all-or-nothing).
        let to = parse_req_status(&to_str)?;
        // Existence + current-status read (the staleness compare). A missing target is a
        // stale finding too (the target vanished since draft).
        match crate::requirement::load(&root, &fk) {
            Ok(req) => {
                let actual = req.status.as_str().to_owned();
                if actual == expected_from {
                    let req_id = crate::requirement::id_from_fk(&fk)?;
                    planned.push(PlannedStatus { fk, req_id, to });
                } else {
                    stale.push(StaleFinding {
                        fk: fk.clone(),
                        expected_from,
                        actual,
                    });
                }
            }
            Err(_) => stale.push(StaleFinding {
                fk: fk.clone(),
                expected_from,
                actual: "missing".to_owned(),
            }),
        }
    }

    // Abort the WHOLE apply on ANY stale finding — surface the full set, write nothing.
    if !stale.is_empty() {
        use std::fmt::Write as _;
        let mut msg = String::from(
            "apply aborted — the requirement status drifted since the change was drafted (all-or-nothing; nothing written):",
        );
        for f in &stale {
            write!(
                msg,
                "\n  {} expected from `{}`, found `{}` — re-draft the status change",
                f.fk, f.expected_from, f.actual
            )?;
        }
        anyhow::bail!(msg);
    }

    let mut out = io::stdout();

    // Land the status rows: each a `set_status` write + one self-describing RecDoc
    // (owning_slice = None — a standalone, non-slice-close status change). One commit
    // carries the N status edits + N RecDocs (the operator commits; this writes the
    // worktree like reconcile.rs). REC schema untouched.
    for p in &planned {
        let prior = crate::requirement::load(&root, &p.fk)?.status;
        let rec = compose_apply_rec(&p.fk, prior, p.to);
        let rec_id = crate::rec::materialise_populated(&root, &rec)?; // WAL-first (NF-003)
        crate::requirement::set_status(&root, p.req_id, p.to)?;
        writeln!(
            out,
            "{}: status {} → {} (rec {rec_id:03})",
            p.fk,
            prior.as_str(),
            p.to.as_str()
        )?;
    }

    // Surface-for-manual: list the rows with no v1 engine seam (NOT auto-applied).
    if !manual_rows.is_empty() {
        writeln!(
            out,
            "\nsurfaced for manual handling ({} row(s) — land by operator hand-edit):",
            manual_rows.len()
        )?;
        for row in &manual_rows {
            let subject = row
                .target
                .clone()
                .or_else(|| row.member_of.clone())
                .unwrap_or_default();
            writeln!(out, "  {} {}", row.action.as_str(), subject)?;
        }
    }

    // Terminal disposition (§4.2 / E5 / M1): a status-only REV → `done` (dependents
    // unblock). A REV ALSO carrying surfaced-for-manual rows stays `started` (status
    // landed, manual list printed) — `done` never lies (every row landed). Drive the
    // REV FSM through legal steps toward the target.
    let target = if manual_rows.is_empty() {
        RevStatus::Done
    } else {
        RevStatus::Started
    };
    settle_disposition(&rev_root, id, doc.status, target)?;
    writeln!(out, "{} → {}", canonical_id(id), target.as_str())?;
    Ok(())
}

/// Compose the standalone-apply `RecDoc` for one landed status row (PURE) — the
/// reconcile.rs `compose_status_rec` shape, but `owning_slice = None` (a standalone,
/// non-slice-close status change, §4.6) and NO evidence (apply rests on the approved
/// Revision, not a coverage scan — REC's `evidence_ref` is empty for this subset). The
/// `id` is a placeholder; the engine assigns the reserved id at materialise. REC schema
/// is untouched — one `[[status_delta]]`, an empty `[[evidence_ref]]`.
fn compose_apply_rec(req: &str, prior: ReqStatus, written: ReqStatus) -> crate::rec::RecDoc {
    crate::rec::RecDoc {
        id: 0,
        slug: format!("apply-{}", req.to_lowercase()),
        title: format!("apply {req}"),
        rec: crate::rec::RecMeta {
            r#move: crate::rec::RecMove::Revise.as_str().to_owned(),
            owning_slice: None,
            decision_ref: None,
        },
        status_delta: vec![crate::rec::StatusDelta {
            requirement: req.to_owned(),
            from: prior.as_str().to_owned(),
            to: written.as_str().to_owned(),
        }],
        evidence_ref: Vec::new(),
        tags: Vec::new(),
        estimate: None,
        value: None,
    }
}

/// Drive the REV lifecycle from `current` toward `target` (`done` or `started`) through
/// LEGAL FSM steps (`proposed → started → done`), each gated by `validate_transition`.
/// Idempotent: a REV already at/past the target writes nothing (the no-op guard in the
/// setter holds content + mtime). Used by apply's terminal disposition (§4.2).
fn settle_disposition(
    rev_root: &Path,
    id: u32,
    current: RevStatus,
    target: RevStatus,
) -> anyhow::Result<()> {
    let today = crate::clock::today();
    // The path proposed → started → done; stop at `target`. Skip any step already at or
    // beyond it. (A terminal current is left untouched — apply on a terminal REV is a
    // no-op disposition; the FSM would refuse leaving it anyway.)
    if current.is_terminal() {
        return Ok(());
    }
    let steps: &[RevStatus] = match target {
        RevStatus::Started => &[RevStatus::Started],
        RevStatus::Done => &[RevStatus::Started, RevStatus::Done],
        _ => &[],
    };
    let mut from = current;
    for &step in steps {
        if from == step {
            continue;
        }
        validate_transition(from, step)?;
        set_revision_status(rev_root, id, step, &today)?;
        from = step;
    }
    Ok(())
}

// ---------------------------------------------------------------------------
// SL-155: list surface — list_rows + run_list (PHASE-01)
// ---------------------------------------------------------------------------

/// List revisions: read all revision TOMLs, filter, sort, render.
fn list_rows(root: &Path, args: ListArgs) -> anyhow::Result<String> {
    listing::validate_statuses(&args.status, REV_STATUSES)?;
    let render = args.render;
    let columns = args.columns.clone();
    let (filter, format) = listing::build(args)?;
    let rev_root = root.join(REV_DIR);
    if !rev_root.is_dir() {
        return match format {
            Format::Table => Ok(listing::render_columns::<RevDoc>(
                &[],
                &listing::select_columns(&REV_COLUMNS, REV_DEFAULT, columns.as_deref())?,
                render,
            )),
            Format::Json => listing::json_envelope::<ListRow>("revision", &[]),
        };
    }
    let mut docs = listing::retain(
        read_revs(&rev_root)?,
        &filter,
        |s| REV_HIDDEN.contains(&s),
        key,
    );
    docs.sort_by_key(|d| d.id);
    match format {
        Format::Table => {
            let sel = listing::select_columns(&REV_COLUMNS, REV_DEFAULT, columns.as_deref())?;
            Ok(listing::render_columns(&docs, &sel, render))
        }
        Format::Json => listing::json_envelope("revision", &json_rows(&docs)),
    }
}

/// `doctrine revision list` entry point.
pub(crate) fn run_list(path: Option<PathBuf>, args: ListArgs) -> anyhow::Result<()> {
    let root = crate::root::find(path, &crate::root::default_markers())?;
    let mut out = io::stdout();
    write!(out, "{}", list_rows(&root, args)?)?;
    Ok(())
}

/// Read a single revision TOML by id.
fn read_rev(rev_root: &Path, id: u32) -> anyhow::Result<RevDoc> {
    let name = format!("{id:03}");
    let path = rev_root.join(&name).join(format!("revision-{name}.toml"));
    let text = fs::read_to_string(&path)
        .with_context(|| format!("revision {name} not found at {}", path.display()))?;
    toml::from_str(&text).with_context(|| format!("Failed to parse {}", path.display()))
}

/// Read all revision TOMLs under the REV tree.
fn read_revs(rev_root: &Path) -> anyhow::Result<Vec<RevDoc>> {
    let mut docs = Vec::new();
    for id in entity::scan_ids(rev_root)? {
        docs.push(read_rev(rev_root, id)?);
    }
    Ok(docs)
}

/// A revision's filterable projection for `listing::retain`.
fn key(d: &RevDoc) -> listing::FilterFields {
    listing::FilterFields {
        canonical: canonical_id(d.id),
        slug: d.slug.clone(),
        title: d.title.clone(),
        status: d.status.as_str().to_owned(),
        tags: d.tags.clone(),
    }
}

/// JSON list row.
#[derive(Debug, Serialize)]
struct ListRow {
    id: String,
    status: String,
    approval: String,
    tags: Vec<String>,
    title: String,
}

fn json_rows(docs: &[RevDoc]) -> Vec<ListRow> {
    docs.iter()
        .map(|d| ListRow {
            id: canonical_id(d.id),
            status: d.status.as_str().to_owned(),
            approval: d.approval.as_str().to_owned(),
            tags: d.tags.clone(),
            title: d.title.clone(),
        })
        .collect()
}

const REV_COLUMNS: [Column<RevDoc>; 5] = [
    Column {
        name: "id",
        header: "id",
        cell: |d| canonical_id(d.id),
        paint: listing::ColumnPaint::Fixed(owo_colors::DynColors::Ansi(
            owo_colors::AnsiColors::Cyan,
        )),
    },
    Column {
        name: "status",
        header: "status",
        cell: |d| d.status.as_str().to_owned(),
        paint: listing::ColumnPaint::ByValue(|d| listing::status_hue(d.status.as_str())),
    },
    Column {
        name: "approval",
        header: "approval",
        cell: |d| d.approval.as_str().to_owned(),
        paint: listing::ColumnPaint::None,
    },
    Column {
        name: "tags",
        header: "tags",
        cell: |d| d.tags.join(", "),
        paint: listing::ColumnPaint::None,
    },
    Column {
        name: "title",
        header: "title",
        cell: |d| d.title.clone(),
        paint: listing::ColumnPaint::Alternate([listing::TITLE_EVEN, listing::TITLE_ODD]),
    },
];

const REV_DEFAULT: &[&str] = &["id", "status", "approval", "title"];

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;
    use std::fs;

    /// Drift canary (the backlog.rs `*_matches_the_variants` pattern): every
    /// `RevStatus` variant's `as_str` is in the known-set and vice versa, in order.
    #[test]
    fn rev_statuses_matches_the_variants() {
        let variants = [
            RevStatus::Proposed,
            RevStatus::Started,
            RevStatus::Done,
            RevStatus::Abandoned,
        ];
        let from_variants: Vec<&str> = variants.iter().map(|s| s.as_str()).collect();
        assert_eq!(
            from_variants, REV_STATUSES,
            "REV_STATUSES drifted from the RevStatus variants"
        );
    }

    /// Drift canary: every `ChangeAction` variant's `as_str` is in the known-set and
    /// vice versa, in order (the `*_matches_the_variants` pattern).
    #[test]
    fn change_actions_matches_the_variants() {
        let variants = [
            ChangeAction::Modify,
            ChangeAction::Retire,
            ChangeAction::Move,
            ChangeAction::Status,
            ChangeAction::Introduce,
            ChangeAction::Create,
        ];
        let from_variants: Vec<&str> = variants.iter().map(|a| a.as_str()).collect();
        assert_eq!(
            from_variants, CHANGE_ACTIONS,
            "CHANGE_ACTIONS drifted from the ChangeAction variants"
        );
    }

    /// `is_creation` partitions the vocabulary: exactly `introduce`/`create` are
    /// creation ops; the existing-target ops key on a live FK.
    #[test]
    fn is_creation_partitions_the_actions() {
        assert!(ChangeAction::Introduce.is_creation());
        assert!(ChangeAction::Create.is_creation());
        for a in [
            ChangeAction::Modify,
            ChangeAction::Retire,
            ChangeAction::Move,
            ChangeAction::Status,
        ] {
            assert!(!a.is_creation(), "{a:?} is an existing-target op");
        }
    }

    /// A `[[change]]` row's `edge_target` is its FK (existing-target) or its
    /// destination `member_of` SPEC (creation) — the projection `relation_edges` reads.
    #[test]
    fn change_row_edge_target_picks_fk_then_member_of() {
        let existing = ChangeRow {
            target: Some("ADR-006".to_owned()),
            action: ChangeAction::Modify,
            primary: false,
            from: None,
            to_status: None,
            new_label: None,
            member_of: None,
            new_statement: None,
            allocated: None,
        };
        assert_eq!(existing.edge_target(), Some("ADR-006"));
        let creation = ChangeRow {
            target: None,
            action: ChangeAction::Introduce,
            primary: false,
            from: None,
            to_status: None,
            new_label: Some("FR-007".to_owned()),
            member_of: Some("SPEC-018".to_owned()),
            new_statement: None,
            allocated: None,
        };
        assert_eq!(creation.edge_target(), Some("SPEC-018"));
    }

    /// The `[[change]]` table parses both row shapes from one array (the read-tolerant
    /// targeted parse — every other key in the file is ignored).
    #[test]
    fn change_doc_parses_both_row_shapes() {
        let text = r#"
id = 1
status = "started"
[[change]]
target = "REQ-201"
action = "status"
primary = false
from = "active"
to_status = "retired"
[[change]]
action = "introduce"
member_of = "SPEC-018"
new_label = "FR-007"
primary = true
"#;
        let doc: ChangeDoc = toml::from_str(text).unwrap();
        assert_eq!(doc.change.len(), 2);
        assert_eq!(doc.change[0].action, ChangeAction::Status);
        assert_eq!(doc.change[0].from.as_deref(), Some("active"));
        assert_eq!(doc.change[1].action, ChangeAction::Introduce);
        assert!(doc.change[1].primary);
        assert_eq!(doc.change[1].new_label.as_deref(), Some("FR-007"));
    }

    /// Drift canary for the orthogonal approval axis.
    #[test]
    fn approvals_matches_the_variants() {
        let variants = [
            Approval::None,
            Approval::Requested,
            Approval::Approved,
            Approval::Rejected,
        ];
        let from_variants: Vec<&str> = variants.iter().map(|a| a.as_str()).collect();
        assert_eq!(
            from_variants, APPROVALS,
            "APPROVALS drifted from the Approval variants"
        );
    }

    /// The schema round-trips through serde: id/slug/title/status/approval survive
    /// toml → struct → toml, and the closed enums render kebab.
    #[test]
    fn schema_round_trips_through_serde() {
        let doc = RevDoc {
            id: 7,
            slug: "revise-adr-006".to_owned(),
            title: "revise ADR-006".to_owned(),
            status: RevStatus::Started,
            approval: Approval::None,
            tags: vec![],
            estimate: None,
            value: None,
        };
        let text = toml::to_string(&doc).unwrap();
        assert!(
            text.contains("status = \"started\""),
            "kebab status: {text}"
        );
        assert!(
            text.contains("approval = \"none\""),
            "kebab approval: {text}"
        );
        let back: RevDoc = toml::from_str(&text).unwrap();
        assert_eq!(back, doc);
    }

    // -- FSM: the REV-local legal-transition guard --------------------------

    #[test]
    fn fsm_advances_proposed_started_done() {
        assert!(validate_transition(RevStatus::Proposed, RevStatus::Started).is_ok());
        assert!(validate_transition(RevStatus::Started, RevStatus::Done).is_ok());
    }

    #[test]
    fn fsm_abandons_from_any_non_terminal() {
        assert!(validate_transition(RevStatus::Proposed, RevStatus::Abandoned).is_ok());
        assert!(validate_transition(RevStatus::Started, RevStatus::Abandoned).is_ok());
    }

    #[test]
    fn fsm_refuses_leaving_a_terminal_source() {
        assert!(validate_transition(RevStatus::Done, RevStatus::Started).is_err());
        assert!(validate_transition(RevStatus::Abandoned, RevStatus::Started).is_err());
        // even terminal → terminal is refused (leaving a terminal source).
        assert!(validate_transition(RevStatus::Done, RevStatus::Abandoned).is_err());
    }

    #[test]
    fn fsm_refuses_a_skip() {
        // proposed → done skips `started` — refused.
        let err =
            validate_transition(RevStatus::Proposed, RevStatus::Done).expect_err("skip refused");
        assert!(
            format!("{err}").contains("illegal"),
            "names the illegal move: {err}"
        );
    }

    #[test]
    fn fsm_allows_idempotent_no_op() {
        // from == to is allowed (idempotent), even on a terminal status — the
        // value does not change, so no terminal-leave occurs.
        assert!(validate_transition(RevStatus::Started, RevStatus::Started).is_ok());
        assert!(validate_transition(RevStatus::Done, RevStatus::Done).is_ok());
    }

    #[test]
    fn is_terminal_marks_done_and_abandoned() {
        assert!(RevStatus::Done.is_terminal());
        assert!(RevStatus::Abandoned.is_terminal());
        assert!(!RevStatus::Proposed.is_terminal());
        assert!(!RevStatus::Started.is_terminal());
    }

    /// Hostile free-text in a title rides `toml_string`: a `"` / newline cannot
    /// break the rendered document or inject a key (the rec.rs precedent).
    #[test]
    fn render_escapes_a_hostile_title() {
        let text = render_revision_toml(1, "s", "T\"\ninjected = \"x", "2026-06-14", None).unwrap();
        // The document still parses (the breaker was escaped, not spliced raw) …
        let back: RevDoc = toml::from_str(&text).unwrap();
        // … and the hostile value round-trips verbatim, no injected key.
        assert_eq!(back.title, "T\"\ninjected = \"x");
        assert_eq!(back.status, RevStatus::Proposed, "seeded proposed");
        assert_eq!(back.approval, Approval::None, "seeded none");
    }

    // -- PHASE-05 apply pure helpers ----------------------------------------

    /// `parse_req_status` is the exact inverse of `ReqStatus::as_str` over every
    /// variant (round-trips the kebab strings), and rejects an unknown token — so a
    /// stored `to_status` / current-status string maps back to the typed status the
    /// setter takes, with no hand-maintained match to drift.
    #[test]
    fn parse_req_status_round_trips_and_rejects_unknown() {
        for s in crate::requirement::REQ_STATUSES {
            let parsed = parse_req_status(s).expect("known status parses");
            assert_eq!(parsed.as_str(), *s, "round-trips `{s}`");
        }
        assert!(
            parse_req_status("not-a-status").is_err(),
            "an unknown status token is refused"
        );
    }

    /// `partition_change_rows` auto-lands ONLY `status` rows; every other action
    /// (creation/modify/move) is surfaced-for-manual (the v1 engine-seam boundary).
    #[test]
    fn partition_splits_status_from_surfaced_for_manual() {
        let row = |action: ChangeAction, target: &str| ChangeRow {
            target: Some(target.to_owned()),
            action,
            primary: false,
            from: None,
            to_status: None,
            new_label: None,
            member_of: None,
            new_statement: None,
            allocated: None,
        };
        let rows = vec![
            row(ChangeAction::Status, "REQ-201"),
            row(ChangeAction::Modify, "ADR-006"),
            row(ChangeAction::Move, "REQ-202"),
            row(ChangeAction::Status, "REQ-203"),
        ];
        let (status, manual) = partition_change_rows(&rows);
        assert_eq!(status.len(), 2, "only the two status rows auto-land");
        assert!(status.iter().all(|r| r.action == ChangeAction::Status));
        assert_eq!(manual.len(), 2, "modify + move are surfaced-for-manual");
        assert!(manual.iter().all(|r| r.action != ChangeAction::Status));
    }

    /// `compose_apply_rec` mirrors the reconcile status-REC shape but is STANDALONE:
    /// `owning_slice = None` (a non-slice-close status change, §4.6), one
    /// `[[status_delta]]` carrying the from→to move, and NO evidence (apply rests on the
    /// approved Revision, not a coverage scan). REC schema untouched.
    #[test]
    fn compose_apply_rec_is_standalone_with_one_delta_no_evidence() {
        let rec = compose_apply_rec("REQ-201", ReqStatus::Active, ReqStatus::Retired);
        assert_eq!(
            rec.rec.owning_slice, None,
            "standalone: owning_slice = None"
        );
        assert_eq!(rec.status_delta.len(), 1, "one status_delta");
        let d = &rec.status_delta[0];
        assert_eq!(
            (d.requirement.as_str(), d.from.as_str(), d.to.as_str()),
            ("REQ-201", "active", "retired")
        );
        assert!(
            rec.evidence_ref.is_empty(),
            "apply rests on the approved REV, not coverage — no evidence"
        );
    }

    // -- SL-155: revision list ---------------------------------------------

    /// Seed a single revision TOML under the tempdir for list tests.
    fn seed_rev(root: &Path, id: u32, status: &str, title: &str, tags: &[&str]) {
        let name = format!("{id:03}");
        let dir = root.join(REV_DIR).join(&name);
        fs::create_dir_all(&dir).unwrap();
        let tags_toml = if tags.is_empty() {
            String::from("tags = []")
        } else {
            format!(
                "tags = [{}]",
                tags.iter()
                    .map(|t| format!("\"{t}\""))
                    .collect::<Vec<_>>()
                    .join(", ")
            )
        };
        let toml = format!(
            "id = {id}\nslug = \"s-{id}\"\ntitle = \"{title}\"\nstatus = \"{status}\"\napproval = \"none\"\n{tags_toml}\n"
        );
        fs::write(dir.join(format!("revision-{name}.toml")), toml).unwrap();
        fs::write(dir.join(format!("revision-{name}.md")), "# body\n").unwrap();
    }

    /// `REV_HIDDEN` covers exactly the two terminal statuses.
    #[test]
    fn rev_hidden_covers_terminal_statuses() {
        assert_eq!(REV_HIDDEN, &["done", "abandoned"]);
    }

    /// `list_rows` with no revisions returns empty string (mirrors REC behaviour).
    #[test]
    fn list_rows_empty_tree_is_empty() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let out = list_rows(root, ListArgs::default()).unwrap();
        assert!(out.is_empty(), "empty tree → empty string: {out:?}");
    }

    /// Default list hides `done` and `abandoned` revisions.
    #[test]
    fn list_rows_hides_done_and_abandoned() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        seed_rev(root, 1, "proposed", "Active rev", &[]);
        seed_rev(root, 2, "done", "Done rev", &[]);
        seed_rev(root, 3, "abandoned", "Abandoned rev", &[]);

        let out = list_rows(root, ListArgs::default()).unwrap();
        assert!(out.contains("REV-001"), "proposed visible: {out}");
        assert!(!out.contains("REV-002"), "done hidden: {out}");
        assert!(!out.contains("REV-003"), "abandoned hidden: {out}");
    }

    /// `--all` reveals hidden terminal revisions.
    #[test]
    fn list_rows_all_reveals_hidden() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        seed_rev(root, 1, "done", "Done rev", &[]);

        let mut args = ListArgs::default();
        args.all = true;
        let out = list_rows(root, args).unwrap();
        assert!(out.contains("REV-001"), "--all reveals done: {out}");
    }

    /// `--status` with explicit hidden status reveals it.
    #[test]
    fn list_rows_explicit_status_reveals_hidden() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        seed_rev(root, 1, "done", "Done rev", &[]);

        let mut args = ListArgs::default();
        args.status = vec!["done".to_owned()];
        let out = list_rows(root, args).unwrap();
        assert!(
            out.contains("REV-001"),
            "explicit --status done reveals: {out}"
        );
    }

    /// Substring filter matches slug and title.
    #[test]
    fn list_rows_filter_matches_slug_and_title() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        seed_rev(root, 1, "proposed", "Alpha", &[]);
        seed_rev(root, 2, "proposed", "Beta", &[]);

        let mut args = ListArgs::default();
        args.substr = Some("Alpha".to_owned());
        let out = list_rows(root, args).unwrap();
        assert!(out.contains("REV-001"), "title match: {out}");
        assert!(!out.contains("REV-002"), "no match: {out}");
    }

    /// `--tag` filter matches authored tags.
    #[test]
    fn list_rows_tag_filter_matches() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        seed_rev(root, 1, "proposed", "Tagged", &["cli"]);
        seed_rev(root, 2, "proposed", "Untagged", &[]);

        let mut args = ListArgs::default();
        args.tags = vec!["cli".to_owned()];
        let out = list_rows(root, args).unwrap();
        assert!(out.contains("REV-001"), "tagged match: {out}");
        assert!(!out.contains("REV-002"), "untagged excluded: {out}");
    }

    /// `--status bogus` errors with the known-set.
    #[test]
    fn list_rows_unknown_status_errors() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let mut args = ListArgs::default();
        args.status = vec!["bogus".to_owned()];
        let err = list_rows(root, args).unwrap_err();
        let msg = format!("{err}");
        assert!(msg.contains("bogus"), "names the bad token: {msg}");
        assert!(msg.contains("proposed"), "names known set: {msg}");
    }

    /// `--columns bogus` errors with the available-column set.
    #[test]
    fn list_rows_unknown_column_errors() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let mut args = ListArgs::default();
        args.columns = Some(vec!["bogus".to_owned()]);
        let err = list_rows(root, args).unwrap_err();
        let msg = format!("{err}");
        assert!(msg.contains("bogus"), "names the bad column: {msg}");
        assert!(msg.contains("id"), "names available set: {msg}");
    }

    /// JSON output carries prefixed ids and a tags array.
    #[test]
    fn list_rows_json_is_faithful_envelope() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        seed_rev(root, 1, "proposed", "Test", &["cli"]);

        let mut args = ListArgs::default();
        args.format = Format::Json;
        let out = list_rows(root, args).unwrap();
        assert!(out.contains("\"id\": \"REV-001\""), "prefixed id: {out}");
        assert!(
            out.contains("\"tags\"") && out.contains("\"cli\""),
            "tags present: {out}"
        );
        assert!(out.contains("\"revision\""), "json envelope: {out}");
    }

    /// `--columns` selects and orders visible columns.
    #[test]
    fn list_rows_columns_selects_and_orders() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        seed_rev(root, 1, "proposed", "Test", &["cli"]);

        let mut args = ListArgs::default();
        args.columns = Some(vec![
            "id".to_owned(),
            "tags".to_owned(),
            "status".to_owned(),
        ]);
        let out = list_rows(root, args).unwrap();
        let header = out.lines().next().unwrap();
        assert!(header.contains("id"), "id column: {header}");
        assert!(header.contains("tags"), "tags column: {header}");
        assert!(header.contains("status"), "status column: {header}");
        assert!(!header.contains("title"), "title excluded: {header}");
    }

    /// `render_revision_toml` includes `tags = []`.
    #[test]
    fn render_revision_toml_includes_tags() {
        let text = render_revision_toml(1, "s", "T", "2026-06-14", None).unwrap();
        assert!(
            text.contains("tags") && text.contains("[]"),
            "tags scaffolded: {text}"
        );
    }

    /// A revision TOML without a `tags` field (pre-IMP-144) survives
    /// read → render → parse round-trip without corruption.
    #[test]
    fn tagless_revision_round_trips() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let rev_dir = root.join(REV_DIR).join("001");
        fs::create_dir_all(&rev_dir).unwrap();
        let tagless_toml = concat!(
            "id = 1\n",
            "slug = \"s\"\n",
            "title = \"Tagless Old Rev\"\n",
            "status = \"proposed\"\n",
            "approval = \"none\"\n",
        );
        fs::write(rev_dir.join("revision-001.toml"), tagless_toml).unwrap();
        let rev_root = root.join(REV_DIR);
        let doc = read_rev(&rev_root, 1).unwrap();
        assert_eq!(doc.id, 1);
        assert_eq!(doc.slug, "s");
        assert_eq!(doc.title, "Tagless Old Rev");
        assert!(
            doc.tags.is_empty(),
            "tags default to empty vec: {:?}",
            doc.tags
        );
        let text = render_revision_toml(doc.id, &doc.slug, &doc.title, "2026-01-01", None).unwrap();
        assert!(
            text.contains("tags"),
            "re-rendered text contains tags field: {text}"
        );
        let back: RevDoc = toml::from_str(&text).unwrap();
        assert_eq!(back.id, 1);
        assert_eq!(back.slug, "s");
        assert_eq!(back.title, "Tagless Old Rev");
    }
}