frame 0.1.7

//! Integration tests for the `fr` CLI.
//!
//! Each test creates a temp project directory, runs `fr` as a subprocess,
//! and verifies stdout and/or file contents.

use std::fs;
use std::path::{Path, PathBuf};
use std::process::Command;

/// Get the path to the built `fr` binary.
fn fr_bin() -> PathBuf {
    // cargo test builds to target/debug/
    let mut path = std::env::current_exe().unwrap();
    path.pop(); // remove test binary name
    path.pop(); // remove deps/
    path.push("fr");
    path
}

/// Create a minimal test project in the given directory.
fn create_test_project(root: &Path) {
    let frame_dir = root.join("frame");
    fs::create_dir_all(frame_dir.join("tracks")).unwrap();

    // Record this working copy as the primary (null) actor, exactly as `fr init`
    // does, so mints stay in the legacy null namespace (e.g. `M-011`) and don't
    // auto-claim a letter token.
    fs::write(frame_dir.join(".actor"), "null\n").unwrap();

    fs::write(
        frame_dir.join("project.toml"),
        r#"[project]
name = "test-project"

[agent]
cc_focus = "main"

[[tracks]]
id = "main"
name = "Main Track"
state = "active"
file = "tracks/main.md"

[[tracks]]
id = "side"
name = "Side Track"
state = "active"
file = "tracks/side.md"

[ids.prefixes]
main = "M"
side = "S"
"#,
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/main.md"),
        "\
# Main Track

> The main work stream.

## Backlog

- [ ] `M-001` First task #core
  - added: 2025-05-01
- [>] `M-002` Second task #core #cc
  - added: 2025-05-02
  - dep: M-001
- [ ] `M-003` Third task with subtasks
  - added: 2025-05-03
  - [ ] `M-003.1` Sub one
    - added: 2025-05-03
  - [ ] `M-003.2` Sub two
    - added: 2025-05-03

## Parked

- [~] `M-010` Parked idea
  - added: 2025-04-15

## Done

- [x] `M-000` Setup project
  - added: 2025-04-20
  - resolved: 2025-04-25
",
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/side.md"),
        "\
# Side Track

## Backlog

- [ ] `S-001` Side task one
  - added: 2025-05-01
- [ ] `S-002` Side task two
  - added: 2025-05-02

## Done
",
    )
    .unwrap();

    fs::write(
        frame_dir.join("inbox.md"),
        "\
# Inbox

- Bug in parser #bug
  Stack trace points to line 142.

- Think about design #design

- Quick note
",
    )
    .unwrap();
}

/// Run `fr` with the given args in the given directory, returning (stdout, stderr, success).
/// Overwrite a track file wholesale, for tests that need a shape the shared
/// fixture doesn't have.
fn write_track(root: &Path, track_id: &str, body: &str) {
    fs::write(
        root.join("frame")
            .join("tracks")
            .join(format!("{track_id}.md")),
        body,
    )
    .unwrap();
}

fn run_fr(dir: &Path, args: &[&str]) -> (String, String, bool) {
    let output = Command::new(fr_bin())
        .args(args)
        .current_dir(dir)
        // Isolate tests from the real global registry (~/.config/frame/projects.toml)
        .env("XDG_CONFIG_HOME", dir.join(".xdg-config"))
        .output()
        .expect("failed to run fr");

    let stdout = String::from_utf8_lossy(&output.stdout).to_string();
    let stderr = String::from_utf8_lossy(&output.stderr).to_string();
    (stdout, stderr, output.status.success())
}

/// Run `fr` with extra environment variables. Used by the crash-injection tests
/// to fail a specific write via `FRAME_FAIL_WRITE` (see `src/io/fault.rs`).
fn run_fr_env(dir: &Path, args: &[&str], env: &[(&str, &str)]) -> (String, String, bool) {
    let mut cmd = Command::new(fr_bin());
    cmd.args(args)
        .current_dir(dir)
        .env("XDG_CONFIG_HOME", dir.join(".xdg-config"));
    for (k, v) in env {
        cmd.env(k, v);
    }
    let output = cmd.output().expect("failed to run fr");
    (
        String::from_utf8_lossy(&output.stdout).to_string(),
        String::from_utf8_lossy(&output.stderr).to_string(),
        output.status.success(),
    )
}

/// Run `fr` expecting success, return stdout.
fn run_fr_ok(dir: &Path, args: &[&str]) -> String {
    let (stdout, stderr, success) = run_fr(dir, args);
    if !success {
        panic!(
            "fr {:?} failed:\nstdout: {}\nstderr: {}",
            args, stdout, stderr
        );
    }
    stdout
}

// ---------------------------------------------------------------------------
// Read command tests
// ---------------------------------------------------------------------------

#[test]
fn test_list_default() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["list"]);
    assert!(out.contains("Main Track"));
    assert!(out.contains("M-001"));
    assert!(out.contains("Side Track"));
    assert!(out.contains("S-001"));
    // Done tasks are omitted from the default listing.
    assert!(
        !out.contains("M-000"),
        "default list should not show done tasks"
    );
}

#[test]
fn test_list_state_done_shows_done_tasks() {
    // `--state done` must surface the Done section in human output, matching the
    // `--json` path — previously the human listing only read Backlog/Parked, so
    // this filter silently returned nothing.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // M-000 ("Setup project") is a done task in the fixture's main track.
    let human = run_fr_ok(tmp.path(), &["list", "main", "--state", "done"]);
    assert!(
        human.contains("M-000") && human.contains("Setup project"),
        "human list --state done should show the done task: {human}"
    );
    // Non-done tasks are filtered out.
    assert!(
        !human.contains("M-001"),
        "should not show todo tasks: {human}"
    );

    // The JSON path already worked; confirm the two agree.
    let json = run_fr_ok(tmp.path(), &["list", "main", "--state", "done", "--json"]);
    assert!(
        json.contains("M-000"),
        "json list --state done should include M-000"
    );
}

#[test]
fn test_projects_prune_removes_not_found() {
    // All `fr` calls share one isolated registry via the XDG anchor `base`.
    let base = tempfile::TempDir::new().unwrap();
    let live = base.path().join("live");
    let ghost = base.path().join("ghost");
    create_test_project(&live);
    create_test_project(&ghost);

    run_fr_ok(base.path(), &["projects", "add", live.to_str().unwrap()]);
    run_fr_ok(base.path(), &["projects", "add", ghost.to_str().unwrap()]);

    // The ghost project's directory disappears (e.g. a temp smoke-test project).
    fs::remove_dir_all(&ghost).unwrap();

    // Dry run reports the ghost but mutates nothing.
    let dry = run_fr_ok(base.path(), &["projects", "prune", "--dry-run", "--json"]);
    assert!(dry.contains("ghost"));
    assert!(!dry.contains("\"live\"") && !dry.contains("/live\""));
    let still = run_fr_ok(base.path(), &["projects", "list", "--json"]);
    assert!(still.contains("/ghost"), "dry-run must not remove anything");

    // Real prune drops the ghost, keeps the live project.
    let pruned = run_fr_ok(base.path(), &["projects", "prune"]);
    assert!(pruned.contains("Removed 1 not-found project"));
    let after = run_fr_ok(base.path(), &["projects", "list", "--json"]);
    assert!(after.contains("/live"));
    assert!(!after.contains("/ghost"));

    // Pruning again is a no-op.
    let again = run_fr_ok(base.path(), &["projects", "prune"]);
    assert!(again.contains("No not-found projects"));
}

#[test]
fn test_list_specific_track() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["list", "main"]);
    assert!(out.contains("M-001"));
    assert!(!out.contains("S-001"));
}

#[test]
fn test_list_with_state_filter() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["list", "main", "--state", "active"]);
    assert!(out.contains("M-002"));
    assert!(!out.contains("M-001")); // M-001 is todo, not active
}

#[test]
fn test_list_with_tag_filter() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["list", "main", "--tag", "cc"]);
    assert!(out.contains("M-002"));
    assert!(!out.contains("M-001")); // M-001 doesn't have #cc
}

#[test]
fn test_list_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["list", "main", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert!(parsed.is_array());
    let arr = parsed.as_array().unwrap();
    assert_eq!(arr.len(), 1); // One track
    assert_eq!(arr[0]["track"], "main");
    assert!(arr[0]["tasks"].is_array());
}

#[test]
fn test_show() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["show", "M-001"]);
    assert!(out.contains("First task"));
    assert!(out.contains("added: 2025-05-01"));
}

#[test]
fn test_show_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["show", "M-002", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert_eq!(parsed["id"], "M-002");
    assert_eq!(parsed["state"], "active");
    assert!(
        parsed["deps"]
            .as_array()
            .unwrap()
            .contains(&serde_json::json!("M-001"))
    );
}

#[test]
fn test_show_not_found() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let (_stdout, stderr, success) = run_fr(tmp.path(), &["show", "NOEXIST-999"]);
    assert!(!success);
    assert!(stderr.contains("not found"));
}

#[test]
fn test_ready() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["ready"]);
    // M-001 is todo with no deps → ready
    assert!(out.contains("M-001"));
    // M-002 is active, not todo → not ready
    assert!(!out.contains("M-002"));
    // S-001 is todo with no deps → ready
    assert!(out.contains("S-001"));
}

#[test]
fn test_ready_cc() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Add a #cc todo task to the side track
    let frame_dir = tmp.path().join("frame");
    fs::write(
        frame_dir.join("tracks/side.md"),
        "\
# Side Track

## Backlog

- [ ] `S-001` Side task one
  - added: 2025-05-01
- [ ] `S-002` Side task two #cc
  - added: 2025-05-02

## Done
",
    )
    .unwrap();

    let out = run_fr_ok(tmp.path(), &["ready", "--cc"]);
    // S-002 is todo with #cc tag → ready (cross-track scan)
    assert!(out.contains("S-002"));
    // M-001 is ready but not cc-tagged → excluded
    assert!(!out.contains("M-001"));
    // M-002 is cc-tagged but active (not todo) → excluded
    assert!(!out.contains("M-002"));
    // S-001 is todo but not cc-tagged → excluded
    assert!(!out.contains("S-001"));
}

#[test]
fn test_ready_cc_no_focus() {
    let tmp = tempfile::TempDir::new().unwrap();
    let frame_dir = tmp.path().join("frame");
    fs::create_dir_all(frame_dir.join("tracks")).unwrap();

    // Project without cc_focus set
    fs::write(
        frame_dir.join("project.toml"),
        r#"[project]
name = "test-project"

[[tracks]]
id = "main"
name = "Main Track"
state = "active"
file = "tracks/main.md"

[ids.prefixes]
main = "M"
"#,
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/main.md"),
        "\
# Main Track

## Backlog

- [ ] `M-001` Task with cc #cc
  - added: 2025-05-01

## Done
",
    )
    .unwrap();

    fs::write(frame_dir.join("inbox.md"), "# Inbox\n").unwrap();

    // Should work without cc_focus (no error)
    let out = run_fr_ok(tmp.path(), &["ready", "--cc"]);
    assert!(out.contains("M-001"));
}

#[test]
fn test_ready_cc_ordering() {
    let tmp = tempfile::TempDir::new().unwrap();
    let frame_dir = tmp.path().join("frame");
    fs::create_dir_all(frame_dir.join("tracks")).unwrap();

    fs::write(
        frame_dir.join("project.toml"),
        r#"[project]
name = "test-project"

[agent]
cc_focus = "main"

[[tracks]]
id = "main"
name = "Main Track"
state = "active"
file = "tracks/main.md"

[[tracks]]
id = "side"
name = "Side Track"
state = "active"
file = "tracks/side.md"

[ids.prefixes]
main = "M"
side = "S"
"#,
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/main.md"),
        "\
# Main Track

## Backlog

- [ ] `M-001` Main cc task #cc
  - added: 2025-05-01

## Done
",
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/side.md"),
        "\
# Side Track

## Backlog

- [ ] `S-001` Side cc task #cc
  - added: 2025-05-01

## Done
",
    )
    .unwrap();

    fs::write(frame_dir.join("inbox.md"), "# Inbox\n").unwrap();

    let out = run_fr_ok(tmp.path(), &["ready", "--cc", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    let tasks = parsed["tasks"].as_array().unwrap();
    assert_eq!(tasks.len(), 2);
    // Focus track (main) tasks should appear first
    assert_eq!(tasks[0]["track"].as_str().unwrap(), "main");
    assert_eq!(tasks[1]["track"].as_str().unwrap(), "side");
}

#[test]
fn test_track_cc_focus_clear() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Clear cc-focus
    let out = run_fr_ok(tmp.path(), &["track", "cc-focus", "--clear"]);
    assert!(out.contains("cleared"));

    // Verify cc_focus is gone from config
    let config_text = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(!config_text.contains("cc_focus"));

    // fr ready --cc should still work (no error)
    let _out = run_fr_ok(tmp.path(), &["ready", "--cc"]);
}

#[test]
fn test_ready_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["ready", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert!(parsed["tasks"].is_array());
}

#[test]
fn test_blocked() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["blocked"]);
    // No tasks are in blocked state in our test data
    assert!(out.is_empty() || !out.contains("M-"));
}

#[test]
fn test_search() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["search", "subtasks"]);
    assert!(out.contains("M-003"));
}

#[test]
fn test_search_with_track_filter() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["search", "task", "--track", "side"]);
    assert!(out.contains("S-001"));
    assert!(!out.contains("M-001"));
}

#[test]
fn test_inbox_list() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["inbox"]);
    assert!(out.contains("Bug in parser"));
    assert!(out.contains("Think about design"));
    assert!(out.contains("Quick note"));
}

#[test]
fn test_inbox_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["inbox", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert!(parsed.is_array());
    let arr = parsed.as_array().unwrap();
    assert_eq!(arr.len(), 3);
    assert_eq!(arr[0]["title"], "Bug in parser");
    assert!(
        arr[0]["tags"]
            .as_array()
            .unwrap()
            .contains(&serde_json::json!("bug"))
    );
}

#[test]
fn test_tracks() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["tracks"]);
    assert!(out.contains("Main Track"));
    assert!(out.contains("Side Track"));
}

#[test]
fn test_tracks_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["tracks", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert!(parsed.is_array());
    let arr = parsed.as_array().unwrap();
    assert_eq!(arr.len(), 2);
}

#[test]
fn test_stats() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["stats"]);
    assert!(out.contains("Main Track"));
    assert!(out.contains("Total"));
}

#[test]
fn test_stats_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["stats", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert!(parsed["totals"].is_object());
}

#[test]
fn test_recent() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["recent"]);
    assert!(out.contains("M-000"));
    assert!(out.contains("Setup project"));
}

#[test]
fn test_deps() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["deps", "M-002"]);
    assert!(out.contains("M-002"));
    assert!(out.contains("M-001"));
}

/// A diamond -- two tasks depending on the same third -- is the ordinary shape
/// of a real backlog. `fr deps` used to report the second path as `(circular)`,
/// because one `visited` set spanned the whole traversal and was never popped.
#[test]
fn deps_reports_a_shared_dependency_as_already_shown() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    write_track(
        tmp.path(),
        "main",
        "# Main Track\n\n## Backlog\n\n\
         - [ ] `M-001` Root\n  - dep: M-002, M-003\n\
         - [ ] `M-002` Left\n  - dep: M-004\n\
         - [ ] `M-003` Right\n  - dep: M-004\n\
         - [ ] `M-004` Shared leaf\n\n## Done\n",
    );

    let out = run_fr_ok(tmp.path(), &["deps", "M-001"]);
    assert!(
        out.contains("M-004 (already shown)"),
        "expected the second path to M-004 to be marked as a repeat:\n{out}"
    );
    assert!(
        !out.contains("(circular)"),
        "a diamond is not a cycle:\n{out}"
    );
    // The first path still expands it in full.
    assert!(out.contains("[ ] M-004 Shared leaf"), "{out}");
}

/// A cycle through the root used to run one lap too far, because the root id
/// was never seeded into the visited set.
#[test]
fn deps_stops_a_cycle_at_the_root() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    write_track(
        tmp.path(),
        "main",
        "# Main Track\n\n## Backlog\n\n\
         - [ ] `M-005` Cycle a\n  - dep: M-006\n\
         - [ ] `M-006` Cycle b\n  - dep: M-005\n\n## Done\n",
    );

    let out = run_fr_ok(tmp.path(), &["deps", "M-005"]);
    assert!(out.contains("M-005 (circular)"), "{out}");
    // Three lines: the root, M-006, and the cycle marker. A fourth means the
    // root was expanded a second time.
    assert_eq!(
        out.lines().filter(|l| !l.trim().is_empty()).count(),
        3,
        "{out}"
    );
}

#[test]
fn deps_reports_a_dangling_dependency_as_not_found() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    write_track(
        tmp.path(),
        "main",
        "# Main Track\n\n## Backlog\n\n- [ ] `M-007` Dangling\n  - dep: M-999\n\n## Done\n",
    );

    let out = run_fr_ok(tmp.path(), &["deps", "M-007"]);
    assert!(out.contains("M-999 (not found)"), "{out}");
}

/// Archives are searched by default; `--no-archive` is the opt-out. The old
/// `--archive` flag was declared and never read, so it did nothing either way.
#[test]
fn search_archive_is_opt_out_not_opt_in() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    let archive = tmp.path().join("frame").join("archive");
    fs::create_dir_all(&archive).unwrap();
    fs::write(
        archive.join("main.md"),
        "# Main Track — Archive\n\n## Done\n\n- [x] `M-900` Archived widget\n  - resolved: 2024-01-02\n",
    )
    .unwrap();

    let out = run_fr_ok(tmp.path(), &["search", "widget"]);
    assert!(out.contains("[archive:main]"), "{out}");
    assert!(out.contains("M-900"), "{out}");

    let out = run_fr_ok(tmp.path(), &["search", "--no-archive", "widget"]);
    assert!(
        !out.contains("M-900"),
        "--no-archive should skip it:\n{out}"
    );

    let (_, stderr, ok) = run_fr(tmp.path(), &["search", "-a", "widget"]);
    assert!(!ok, "the removed -a flag should be an error, not a no-op");
    assert!(stderr.contains("unexpected argument"), "{stderr}");
}

/// `matched_fields` lists every field that matched, not whichever one the scan
/// reached first. Searching for an id matches the task by `id` and its
/// dependents by `dep`.
#[test]
fn search_json_reports_all_matched_fields() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["--json", "search", "M-001"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert_eq!(parsed["pattern"], "M-001");

    let tasks = parsed["tasks"].as_array().unwrap();
    let by_id = |id: &str| {
        tasks
            .iter()
            .find(|t| t["id"] == id)
            .unwrap_or_else(|| panic!("{id} missing from {out}"))
    };
    assert_eq!(by_id("M-001")["matched_fields"][0], "id");
    assert_eq!(by_id("M-002")["matched_fields"][0], "dep");

    // The three arrays are always present, so a consumer never has to test for
    // a key's existence.
    assert!(parsed["archived"].is_array());
    assert!(parsed["inbox"].is_array());
}

#[test]
fn test_check() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["check"]);
    assert!(out.contains("valid"));
}

#[test]
fn test_check_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["check", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert_eq!(parsed["valid"], true);
}

// ---------------------------------------------------------------------------
// Write command tests
// ---------------------------------------------------------------------------

#[test]
fn test_add_task() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["add", "main", "New task from CLI"]);
    assert!(out.contains("M-011")); // Next ID after M-010

    // Verify it appears in the file
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("New task from CLI"));
    assert!(track.contains("M-011"));
}

#[test]
fn test_add_task_after() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(
        tmp.path(),
        &["add", "main", "After first", "--after", "M-001"],
    );
    assert!(out.contains("M-011"));

    // Verify position in file - should appear after M-001
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let pos_001 = track.find("M-001").unwrap();
    let pos_011 = track.find("M-011").unwrap();
    let pos_002 = track.find("M-002").unwrap();
    assert!(pos_011 > pos_001);
    assert!(pos_011 < pos_002);
}

#[test]
fn test_push_task() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["push", "main", "Top priority task"]);
    assert!(out.contains("M-011"));

    // Verify it's at the top of backlog
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let pos_011 = track.find("M-011").unwrap();
    let pos_001 = track.find("M-001").unwrap();
    assert!(pos_011 < pos_001);
}

#[test]
fn test_sub_task() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["sub", "M-001", "New subtask"]);
    assert!(out.contains("M-001.1"));

    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("M-001.1"));
    assert!(track.contains("New subtask"));
}

#[test]
fn test_state_change() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["state", "M-001", "active"]);
    assert!(out.contains("M-001"));
    assert!(out.contains("active"));

    // Verify file changed
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    // M-001 should now have [>] instead of [ ]
    assert!(track.contains("[>] `M-001`"));
}

#[test]
fn test_state_done_adds_resolved() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["state", "M-001", "done"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("[x] `M-001`"));
    assert!(track.contains("resolved:"));
}

/// Every section a state change can start from lands in the right place.
///
/// Written as a loop over the whole (state × starting section) space rather than
/// one case per transition, because enumerating transitions is exactly how the
/// hole below got in: `cmd_state` listed `from → to` pairs and nobody listed
/// Done → Parked.
///
/// `tests/parity.rs` cannot cover this. It compares the CLI to the TUI, and both
/// surfaces had the identical gap — they agreed with each other and disagreed
/// only with `canonical_section`. Verified by reverting both fixes: the parity
/// case for this cell still passed. Agreement is not correctness, so the
/// behaviour needs asserting somewhere that knows the right answer.
#[test]
fn state_change_moves_a_task_to_the_section_its_state_calls_for() {
    // (state to set, expected section header the task must end up under)
    let expectations = [
        ("done", "## Done"),
        ("parked", "## Parked"),
        ("todo", "## Backlog"),
        ("active", "## Backlog"),
        ("blocked", "## Backlog"),
    ];
    // Each starting section, as the track content that puts M-001 there.
    let starts = [
        (
            "backlog",
            "## Backlog\n\n- [ ] `M-001` Task\n\n## Parked\n\n## Done\n",
        ),
        (
            "parked",
            "## Backlog\n\n## Parked\n\n- [~] `M-001` Task\n\n## Done\n",
        ),
        (
            "done",
            "## Backlog\n\n## Parked\n\n## Done\n\n- [x] `M-001` Task\n  - resolved: 2026-01-01\n",
        ),
    ];

    for (start_name, body) in starts {
        for (state, want_section) in expectations {
            let tmp = tempfile::TempDir::new().unwrap();
            create_test_project(tmp.path());
            let path = tmp.path().join("frame/tracks/main.md");
            fs::write(&path, format!("# Main\n\n{body}")).unwrap();

            run_fr_ok(tmp.path(), &["state", "M-001", state]);
            let track = fs::read_to_string(&path).unwrap();

            // The section the task actually landed in: the last header above it.
            let idx = track.find("`M-001`").expect("task survived");
            let landed = track[..idx]
                .rmatch_indices("## ")
                .next()
                .map(|(i, _)| track[i..].lines().next().unwrap())
                .expect("task sits under a section header");

            assert_eq!(
                landed, want_section,
                "M-001 starting in {start_name}, set to {state}, landed under {landed:?}\n{track}"
            );
        }
    }
}

#[test]
fn test_tag_add_remove() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Add tag
    run_fr_ok(tmp.path(), &["tag", "M-001", "add", "urgent"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("#urgent"));

    // Remove tag
    run_fr_ok(tmp.path(), &["tag", "M-001", "rm", "urgent"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(!track.contains("#urgent"));
}

#[test]
fn test_dep_add_remove() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Add dep (use M-010 to avoid conflict with M-002's existing dep: M-001)
    run_fr_ok(tmp.path(), &["dep", "M-003", "add", "M-010"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("dep: M-010"));

    // Remove dep
    run_fr_ok(tmp.path(), &["dep", "M-003", "rm", "M-010"]);
    let track_content = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(
        !track_content.contains("dep: M-010"),
        "dep should be removed from M-003"
    );
}

#[test]
fn test_note() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["note", "M-001", "This is a CLI note."]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("This is a CLI note."));
}

#[test]
fn test_note_append() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["note", "M-001", "First note."]);
    run_fr_ok(tmp.path(), &["note", "M-001", "Second note."]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(
        track.contains("First note."),
        "first note should be preserved"
    );
    assert!(
        track.contains("Second note."),
        "second note should be appended"
    );
}

#[test]
fn test_note_replace() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["note", "M-001", "First note."]);
    run_fr_ok(
        tmp.path(),
        &["note", "M-001", "Replacement note.", "--replace"],
    );
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(
        !track.contains("First note."),
        "first note should be replaced"
    );
    assert!(track.contains("Replacement note."));
}

#[test]
fn test_ref() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["ref", "M-001", "doc/design.md"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("ref: doc/design.md"));
}

#[test]
fn test_spec() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["spec", "M-001", "doc/spec.md#section"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("spec: doc/spec.md#section"));
}

#[test]
fn test_title() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["title", "M-001", "Updated title from CLI"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("Updated title from CLI"));
    assert!(!track.contains("First task"));
}

#[test]
fn test_mv_top() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["mv", "M-003", "--top"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let pos_003 = track.find("M-003").unwrap();
    let pos_001 = track.find("M-001").unwrap();
    assert!(pos_003 < pos_001);
}

#[test]
fn test_mv_after() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["mv", "M-001", "--after", "M-002"]);
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let pos_002 = track.find("M-002").unwrap();
    let pos_001 = track.find("M-001").unwrap();
    assert!(pos_001 > pos_002);
}

#[test]
fn test_mv_done_task_cross_track() {
    // Regression: a completed task lives in the Done section, and `fr mv` used to
    // only scan the Backlog — so moving it cross-track failed with
    // "task not found" even though `fr show` found it. It must move and stay done.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // M-000 is a done task in the fixture's main track.
    let out = run_fr_ok(tmp.path(), &["mv", "M-000", "--track", "side"]);
    assert!(out.contains("(side)"), "unexpected output: {out}");

    // Gone from the source track entirely.
    let main = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(!main.contains("Setup project"), "still in source: {main}");

    // Landed in the *target's* Done section, still checked off and with its
    // resolved date preserved (not reopened into the Backlog).
    let side = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    let done_pos = side
        .find("## Done")
        .expect("side should have a Done section");
    let task_pos = side.find("Setup project").expect("task should be in side");
    assert!(task_pos > done_pos, "task should be under Done: {side}");
    assert!(side.contains("resolved:"), "resolved date lost: {side}");
    // The moved task line is still a checked-off `[x]` box, not reopened.
    let task_line = side
        .lines()
        .find(|l| l.contains("Setup project"))
        .expect("task line");
    assert!(
        task_line.trim_start().starts_with("- [x]"),
        "task should still be done: {task_line}"
    );
}

#[test]
fn test_mv_parked_task_cross_track() {
    // A parked task (M-010) moves cross-track and stays parked.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["mv", "M-010", "--track", "side"]);
    let side = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    let parked_pos = side
        .find("## Parked")
        .expect("side should gain a Parked section");
    let task_pos = side
        .find("Parked idea")
        .expect("parked task should be in side");
    assert!(task_pos > parked_pos, "task should be under Parked: {side}");
}

#[test]
fn test_commands_understand_actor_token_ids() {
    // Every id-taking command must accept the actor-token id form (e.g. M-b1),
    // not just the legacy bare-number form. Claim token `b`, mint tokened ids,
    // and exercise the id-resolving commands — including the cross-track `mv`
    // that first surfaced the issue.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["actor", "set", "b"]);
    // First mint in the `b` namespace → M-b1.
    let add = run_fr_ok(tmp.path(), &["add", "main", "Tokened task"]);
    assert!(add.contains("M-b1"), "expected M-b1, got: {add}");
    run_fr_ok(tmp.path(), &["add", "main", "Second tokened"]); // M-b2

    // Read + metadata commands resolve the tokened id.
    assert!(run_fr_ok(tmp.path(), &["show", "M-b1"]).contains("Tokened task"));
    run_fr_ok(tmp.path(), &["tag", "M-b1", "add", "urgent"]);
    run_fr_ok(tmp.path(), &["dep", "M-b1", "add", "M-b2"]);
    run_fr_ok(tmp.path(), &["note", "M-b1", "a note"]);
    run_fr_ok(tmp.path(), &["title", "M-b1", "Renamed"]);
    run_fr_ok(tmp.path(), &["state", "M-b1", "active"]);
    run_fr_ok(tmp.path(), &["deps", "M-b1"]);

    // Reorder (same-track) and cross-track move both take the tokened id.
    run_fr_ok(tmp.path(), &["mv", "M-b2", "--top"]);
    let out = run_fr_ok(tmp.path(), &["mv", "M-b1", "--track", "side"]);
    assert!(out.contains("(side)"), "cross-track mv failed: {out}");
    // Re-minted into the mover's `b` namespace on the target.
    let side = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    assert!(side.contains("S-b1") && side.contains("Renamed"), "{side}");
}

#[test]
fn test_inbox_add() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["inbox", "New inbox item", "--tag", "bug"]);
    let inbox = fs::read_to_string(tmp.path().join("frame/inbox.md")).unwrap();
    assert!(inbox.contains("New inbox item"));
    assert!(inbox.contains("#bug"));
}

#[test]
fn test_triage() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Triage item 1 (Bug in parser) to main track
    let out = run_fr_ok(tmp.path(), &["triage", "1", "--track", "main"]);
    assert!(out.contains("M-011")); // New task ID

    // Verify it was added to the track
    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("Bug in parser"));
    assert!(track.contains("M-011"));

    // Verify it was removed from inbox
    let inbox = fs::read_to_string(tmp.path().join("frame/inbox.md")).unwrap();
    assert!(!inbox.contains("Bug in parser"));
}

#[test]
fn test_triage_top() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["triage", "2", "--track", "main", "--top"]);

    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    // "Think about design" should be at the top of backlog
    let pos_design = track.find("Think about design").unwrap();
    let pos_001 = track.find("M-001").unwrap();
    assert!(pos_design < pos_001);
}

// ---------------------------------------------------------------------------
// Track management tests
// ---------------------------------------------------------------------------

#[test]
fn test_track_new() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "new", "feat", "Features"]);

    // Verify the track file was created
    assert!(tmp.path().join("frame/tracks/feat.md").exists());

    // Verify config was updated
    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(config.contains("feat"));
    assert!(config.contains("Features"));
}

#[test]
fn test_track_shelve() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    // side track should now be shelved
    assert!(config.contains("\"shelved\""));
}

#[test]
fn test_track_activate() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // First shelve, then re-activate
    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);
    run_fr_ok(tmp.path(), &["track", "activate", "side"]);

    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    // Count active states — both main and side should be active again
    let active_count = config.matches("\"active\"").count();
    assert_eq!(active_count, 2);
}

#[test]
fn test_add_to_shelved_track_blocked() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    let (_out, err, ok) = run_fr(tmp.path(), &["add", "side", "New task"]);
    assert!(!ok, "adding to a shelved track should fail");
    assert!(
        err.contains("shelved"),
        "error should mention shelved: {err}"
    );
    assert!(
        err.contains("fr track activate side"),
        "error should suggest activating the track: {err}"
    );

    // The task must not have been written.
    let side = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    assert!(!side.contains("New task"));
}

#[test]
fn test_push_to_shelved_track_blocked() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    let (_out, err, ok) = run_fr(tmp.path(), &["push", "side", "Urgent"]);
    assert!(!ok, "pushing to a shelved track should fail");
    assert!(
        err.contains("shelved"),
        "error should mention shelved: {err}"
    );
}

#[test]
fn test_sub_to_shelved_track_blocked() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    let (_out, err, ok) = run_fr(tmp.path(), &["sub", "S-001", "A subtask"]);
    assert!(!ok, "adding a subtask in a shelved track should fail");
    assert!(
        err.contains("shelved"),
        "error should mention shelved: {err}"
    );
}

#[test]
fn test_triage_to_shelved_track_blocked() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    let (_out, err, ok) = run_fr(tmp.path(), &["triage", "1", "--track", "side"]);
    assert!(!ok, "triaging into a shelved track should fail");
    assert!(
        err.contains("shelved"),
        "error should mention shelved: {err}"
    );
}

#[test]
fn test_mv_into_shelved_track_blocked() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    let (_out, err, ok) = run_fr(tmp.path(), &["mv", "M-001", "--track", "side"]);
    assert!(!ok, "moving a task into a shelved track should fail");
    assert!(
        err.contains("shelved"),
        "error should mention shelved: {err}"
    );
}

#[test]
fn test_import_to_shelved_track_blocked() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let import_file = tmp.path().join("import.md");
    fs::write(&import_file, "- [ ] Imported task\n").unwrap();

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    let (_out, err, ok) = run_fr(
        tmp.path(),
        &["import", import_file.to_str().unwrap(), "--track", "side"],
    );
    assert!(!ok, "importing into a shelved track should fail");
    assert!(
        err.contains("shelved"),
        "error should mention shelved: {err}"
    );
}

#[test]
fn test_state_active_in_shelved_track_blocked() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    let (_out, err, ok) = run_fr(tmp.path(), &["state", "S-001", "active"]);
    assert!(!ok, "activating a task in a shelved track should fail");
    assert!(
        err.contains("shelved"),
        "error should mention shelved: {err}"
    );

    // `fr start` is a thin alias for `state active` and must be blocked too.
    let (_out, err, ok) = run_fr(tmp.path(), &["start", "S-001"]);
    assert!(!ok, "`fr start` in a shelved track should fail");
    assert!(
        err.contains("shelved"),
        "error should mention shelved: {err}"
    );
}

#[test]
fn test_state_non_active_in_shelved_track_allowed() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "shelve", "side"]);

    // Only *activating* is blocked — you can still close out or re-open work in a
    // shelved track (e.g. mark done, park, or reset to todo).
    run_fr_ok(tmp.path(), &["state", "S-001", "done"]);
    let side = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    assert!(side.contains("[x] `S-001`"));
}

#[test]
fn test_track_cc_focus() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "cc-focus", "side"]);

    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(config.contains("cc_focus = \"side\""));
}

// ---------------------------------------------------------------------------
// Maintenance tests
// ---------------------------------------------------------------------------

#[test]
fn test_clean() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["clean"]);
    // Project should be clean (all IDs and dates assigned)
    assert!(out.contains("clean"));
}

#[test]
fn test_clean_dry_run() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["clean", "--dry-run"]);
    assert!(out.contains("dry run"));
}

#[test]
fn test_import() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Create an import file
    let import_file = tmp.path().join("import.md");
    fs::write(
        &import_file,
        "\
- [ ] Imported task one #core
- [ ] Imported task two #design
  - [ ] Imported sub
",
    )
    .unwrap();

    let out = run_fr_ok(
        tmp.path(),
        &["import", import_file.to_str().unwrap(), "--track", "main"],
    );
    assert!(out.contains("imported"));
    assert!(out.contains("M-011")); // First imported task ID

    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(track.contains("Imported task one"));
    assert!(track.contains("Imported task two"));
    assert!(track.contains("Imported sub"));
}

#[test]
fn test_import_top() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let import_file = tmp.path().join("import.md");
    fs::write(&import_file, "- [ ] Top import\n").unwrap();

    run_fr_ok(
        tmp.path(),
        &[
            "import",
            import_file.to_str().unwrap(),
            "--track",
            "main",
            "--top",
        ],
    );

    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let pos_import = track.find("Top import").unwrap();
    let pos_001 = track.find("M-001").unwrap();
    assert!(pos_import < pos_001);
}

// ---------------------------------------------------------------------------
// Error handling tests
// ---------------------------------------------------------------------------

#[test]
fn test_not_a_project() {
    let tmp = tempfile::TempDir::new().unwrap();
    // Don't create project structure
    let (_stdout, stderr, success) = run_fr(tmp.path(), &["list"]);
    assert!(!success);
    assert!(stderr.contains("not a Frame project") || stderr.contains("error"));
}

#[test]
fn test_add_to_nonexistent_track() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let (_stdout, stderr, success) = run_fr(tmp.path(), &["add", "nonexist", "Task"]);
    assert!(!success);
    assert!(stderr.contains("error"));
}

#[test]
fn test_state_invalid() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let (_stdout, stderr, success) = run_fr(tmp.path(), &["state", "M-001", "invalid_state"]);
    assert!(!success);
    assert!(stderr.contains("unknown state"));
}

#[test]
fn test_help() {
    let out = run_fr_ok(Path::new("."), &["--help"]);
    assert!(out.contains("frame"));
    assert!(out.contains("list"));
    assert!(out.contains("add"));
}

// ---------------------------------------------------------------------------
// Combined workflow tests
// ---------------------------------------------------------------------------

#[test]
fn test_add_then_show() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let add_out = run_fr_ok(tmp.path(), &["add", "main", "Workflow test task"]);
    let id = add_out.trim();

    let show_out = run_fr_ok(tmp.path(), &["show", id]);
    assert!(show_out.contains("Workflow test task"));
}

#[test]
fn test_add_then_state_then_show() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let add_out = run_fr_ok(tmp.path(), &["add", "side", "Side workflow"]);
    let id = add_out.trim();

    run_fr_ok(tmp.path(), &["state", id, "active"]);
    let show_out = run_fr_ok(tmp.path(), &["show", id, "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&show_out).unwrap();
    assert_eq!(parsed["state"], "active");
}

#[test]
fn test_found_from() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(
        tmp.path(),
        &["add", "main", "Found bug", "--found-from", "M-001"],
    );
    let id = out.trim();

    let show_out = run_fr_ok(tmp.path(), &["show", id]);
    assert!(show_out.contains("Found while working on M-001"));
}

// ---------------------------------------------------------------------------
// Track rename / delete tests
// ---------------------------------------------------------------------------

#[test]
fn test_track_rename_name() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(
        tmp.path(),
        &["track", "rename", "side", "--name", "New Side"],
    );

    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(config.contains("\"New Side\""));

    // Track file header should be updated
    let track_content = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    assert!(track_content.starts_with("# New Side"));
}

#[test]
fn test_track_rename_id() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["track", "rename", "side", "--new-id", "aux"]);

    // Old file should be gone, new file exists
    assert!(!tmp.path().join("frame/tracks/side.md").exists());
    assert!(tmp.path().join("frame/tracks/aux.md").exists());

    // Config should reference the new id
    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(config.contains("\"aux\""));
    assert!(config.contains("tracks/aux.md"));
}

#[test]
fn test_track_rename_prefix_yes() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(
        tmp.path(),
        &["track", "rename", "side", "--prefix", "AUX", "--yes"],
    );
    assert!(out.contains("Renaming prefix S → AUX"));

    // Tasks should have new prefix
    let track_content = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    assert!(track_content.contains("AUX-001"));
    assert!(track_content.contains("AUX-002"));
    assert!(!track_content.contains("`S-001`"));

    // Config should have new prefix
    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(config.contains("\"AUX\""));
}

#[test]
fn test_track_rename_prefix_dry_run() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(
        tmp.path(),
        &["track", "rename", "side", "--prefix", "AUX", "--dry-run"],
    );
    assert!(out.contains("dry run"));

    // Tasks should NOT have changed
    let track_content = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    assert!(track_content.contains("`S-001`"));
    assert!(track_content.contains("`S-002`"));
}

#[test]
fn test_track_delete_empty() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Create a new empty track, then delete it
    run_fr_ok(tmp.path(), &["track", "new", "empty", "Empty Track"]);
    assert!(tmp.path().join("frame/tracks/empty.md").exists());

    run_fr_ok(tmp.path(), &["track", "delete", "empty"]);

    // Track file should be gone
    assert!(!tmp.path().join("frame/tracks/empty.md").exists());

    // Config should no longer reference it
    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(!config.contains("\"empty\""));
}

#[test]
fn test_track_delete_non_empty_fails() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let (_, stderr, success) = run_fr(tmp.path(), &["track", "delete", "main"]);
    assert!(!success);
    assert!(stderr.contains("tasks") || stderr.contains("not empty") || stderr.contains("has"));
}

// ---------------------------------------------------------------------------
// Init tests
// ---------------------------------------------------------------------------

#[test]
fn test_init_with_tracks() {
    let tmp = tempfile::TempDir::new().unwrap();

    let out = run_fr_ok(
        tmp.path(),
        &[
            "init",
            "--name",
            "Test Project",
            "--track",
            "api",
            "API Layer",
        ],
    );
    assert!(out.contains("[>] frame initialized"));
    assert!(out.contains("project.toml"));
    assert!(out.contains("inbox.md"));
    assert!(out.contains("tracks/api.md"));

    // project.toml exists and is valid TOML
    let toml_content = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    let parsed: toml::Value = toml::from_str(&toml_content).unwrap();
    assert_eq!(parsed["project"]["name"].as_str().unwrap(), "Test Project");

    // Contains expected sections from the template
    assert!(toml_content.contains("[clean]"));
    assert!(toml_content.contains("[ui]"));
    assert!(toml_content.contains("[agent]"));
    assert!(toml_content.contains("[[tracks]]"));
    assert!(toml_content.contains("id = \"api\""));
    assert!(toml_content.contains("[ids.prefixes]"));

    // Track file exists
    assert!(tmp.path().join("frame/tracks/api.md").exists());
    // Inbox exists
    assert!(tmp.path().join("frame/inbox.md").exists());
}

#[test]
fn test_init_already_exists() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "First"]);

    // Second init without --force should fail
    let (stdout, stderr, success) = run_fr(tmp.path(), &["init", "--name", "Second"]);
    assert!(!success);
    let combined = format!("{}{}", stdout, stderr);
    assert!(combined.contains("frame/ already exists"));
    assert!(combined.contains("--force"));
}

#[test]
fn test_init_force_reinitialize() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "First"]);

    // --force should succeed
    let out = run_fr_ok(tmp.path(), &["init", "--name", "Second", "--force"]);
    assert!(out.contains("[>] frame initialized"));

    // Verify the config was overwritten
    let toml_content = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(toml_content.contains("\"Second\""));
}

/// The `.gitignore` entries `fr init` is expected to add, in order, skipping any
/// in `already_present`. Derived from the one list so adding an entry there
/// updates these expectations instead of breaking them.
#[test]
fn test_init_gitignore_added() {
    let tmp = tempfile::TempDir::new().unwrap();

    // Create a git repo so .gitignore logic triggers
    fs::create_dir(tmp.path().join(".git")).unwrap();

    let out = run_fr_ok(tmp.path(), &["init", "--name", "Git Project"]);
    // One blanket pattern, not an entry per file.
    assert!(
        out.contains("added frame/.* to .gitignore"),
        "summary should name the pattern: {out}"
    );

    let gitignore = fs::read_to_string(tmp.path().join(".gitignore")).unwrap();
    assert!(gitignore.contains("frame/.*"), "{gitignore}");
    assert!(
        !gitignore.contains("frame/.state.json"),
        "should not enumerate individual files: {gitignore}"
    );
}

#[test]
fn test_init_gitignore_no_git() {
    let tmp = tempfile::TempDir::new().unwrap();

    // No .git dir — should not mention .gitignore
    let out = run_fr_ok(tmp.path(), &["init", "--name", "No Git"]);
    assert!(!out.contains(".gitignore"));
}

#[test]
fn test_init_gitignore_already_present() {
    let tmp = tempfile::TempDir::new().unwrap();
    fs::create_dir(tmp.path().join(".git")).unwrap();
    fs::write(
        tmp.path().join(".gitignore"),
        "frame/.state.json\nframe/.lock\nframe/.recovery.log\nframe/.actor\n",
    )
    .unwrap();

    let out = run_fr_ok(tmp.path(), &["init", "--name", "Already"]);
    // Should NOT say it added entries
    assert!(!out.contains("added frame/.state.json"));
}

#[test]
fn test_init_gitignore_partial() {
    let tmp = tempfile::TempDir::new().unwrap();
    fs::create_dir(tmp.path().join(".git")).unwrap();
    fs::write(tmp.path().join(".gitignore"), "frame/.lock\n").unwrap();

    let out = run_fr_ok(tmp.path(), &["init", "--name", "Partial"]);
    // An enumerated entry does not cover future files, so the pattern is still
    // added — and the old line is left alone rather than rewritten.
    assert!(
        out.contains("added frame/.* to .gitignore"),
        "summary should name the pattern: {out}"
    );

    let gitignore = fs::read_to_string(tmp.path().join(".gitignore")).unwrap();
    assert!(gitignore.contains("frame/.*"));
    assert_eq!(
        gitignore
            .lines()
            .filter(|l| l.trim() == "frame/.lock")
            .count(),
        1,
        "pre-existing line preserved exactly once: {gitignore}"
    );
}

// ---------------------------------------------------------------------------
// Reparent tests (fr mv --promote / --parent)
// ---------------------------------------------------------------------------

#[test]
fn test_mv_promote() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Promote M-003.1 to top-level
    let out = run_fr_ok(tmp.path(), &["mv", "M-003.1", "--promote"]);
    // Output should mention the old and new ID
    assert!(out.contains("M-003.1"));

    // The promoted task should now be a top-level task with a new ID
    let list_out = run_fr_ok(tmp.path(), &["list", "main", "--json"]);
    // M-003 should now have only one subtask
    assert!(list_out.contains("Sub two"));
    // The promoted task ("Sub one") should be top-level
    assert!(list_out.contains("Sub one"));
}

#[test]
fn test_mv_parent() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Reparent M-001 under M-002
    let out = run_fr_ok(tmp.path(), &["mv", "M-001", "--parent", "M-002"]);
    assert!(out.contains("M-001"));

    // M-001 should now be a subtask of M-002
    let show_out = run_fr_ok(tmp.path(), &["show", "M-002"]);
    assert!(show_out.contains("First task"));
}

#[test]
fn test_mv_promote_top_level_error() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // M-001 is already top-level — promote should fail
    let (_, stderr, success) = run_fr(tmp.path(), &["mv", "M-001", "--promote"]);
    assert!(!success);
    assert!(stderr.contains("already top-level") || stderr.contains("AlreadyTopLevel"));
}

#[test]
fn test_mv_parent_cycle_error() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Try to reparent M-003 under its own child M-003.1 — should fail
    let (_, stderr, success) = run_fr(tmp.path(), &["mv", "M-003", "--parent", "M-003.1"]);
    assert!(!success);
    assert!(stderr.contains("cycle") || stderr.contains("CycleDetected"));
}

#[test]
fn test_mv_promote_parent_conflict() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // --promote and --parent together should fail
    let (_, stderr, success) = run_fr(
        tmp.path(),
        &["mv", "M-003.1", "--promote", "--parent", "M-001"],
    );
    assert!(!success);
    assert!(
        stderr.contains("cannot be used with")
            || stderr.contains("conflict")
            || stderr.contains("the argument")
    );
}

#[test]
fn test_mv_parent_depth_exceeded() {
    let tmp = tempfile::TempDir::new().unwrap();
    let frame_dir = tmp.path().join("frame");
    fs::create_dir_all(frame_dir.join("tracks")).unwrap();

    fs::write(
        frame_dir.join("project.toml"),
        r#"[project]
name = "depth-test"

[[tracks]]
id = "deep"
name = "Deep Track"
state = "active"
file = "tracks/deep.md"

[ids.prefixes]
deep = "D"
"#,
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/deep.md"),
        "\
# Deep Track

## Backlog

- [ ] `D-001` Root
  - [ ] `D-001.1` Child
    - [ ] `D-001.1.1` Grandchild
- [ ] `D-002` Another root

## Done
",
    )
    .unwrap();

    fs::write(frame_dir.join("inbox.md"), "# Inbox\n").unwrap();

    // Try to reparent D-002 under D-001.1.1 (would exceed depth 2)
    let (_, stderr, success) = run_fr(tmp.path(), &["mv", "D-002", "--parent", "D-001.1.1"]);
    assert!(!success);
    assert!(
        stderr.contains("depth") || stderr.contains("DepthExceeded") || stderr.contains("nesting")
    );
}

// ---------------------------------------------------------------------------
// Show --context tests
// ---------------------------------------------------------------------------

#[test]
fn test_show_context_subtask() {
    let tmp = tempfile::tempdir().unwrap();
    create_test_project(tmp.path());

    let (stdout, _, success) = run_fr(tmp.path(), &["show", "M-003.1", "--context"]);
    assert!(success);

    // Should have parent separator
    assert!(stdout.contains("── Parent ── M-003"));
    // Should have task separator
    assert!(stdout.contains("── Task ── M-003.1"));
    // Parent fields should be present
    assert!(stdout.contains("state: todo"));
}

#[test]
fn test_show_context_top_level() {
    let tmp = tempfile::tempdir().unwrap();
    create_test_project(tmp.path());

    // Top-level task with --context: should show "── Task ──" separator but no parents
    let (stdout, _, success) = run_fr(tmp.path(), &["show", "M-003", "--context"]);
    assert!(success);

    assert!(!stdout.contains("── Parent ──"));
    assert!(stdout.contains("── Task ── M-003"));
}

#[test]
fn test_show_no_context_unchanged() {
    let tmp = tempfile::tempdir().unwrap();
    create_test_project(tmp.path());

    // Without --context, output should not have separators
    let (stdout, _, success) = run_fr(tmp.path(), &["show", "M-003.1"]);
    assert!(success);
    assert!(!stdout.contains("── Parent ──"));
    assert!(!stdout.contains("── Task ──"));
}

#[test]
fn test_show_json_always_has_ancestors() {
    let tmp = tempfile::tempdir().unwrap();
    create_test_project(tmp.path());

    // JSON output always includes ancestors, even without --context
    let (stdout, _, success) = run_fr(tmp.path(), &["show", "M-003.1", "--json"]);
    assert!(success);

    let json: serde_json::Value = serde_json::from_str(&stdout).unwrap();
    let ancestors = json["ancestors"].as_array().unwrap();
    assert_eq!(ancestors.len(), 1);
    assert_eq!(ancestors[0]["id"], "M-003");
    assert_eq!(ancestors[0]["title"], "Third task with subtasks");
}

#[test]
fn test_show_json_top_level_empty_ancestors() {
    let tmp = tempfile::tempdir().unwrap();
    create_test_project(tmp.path());

    // Top-level task JSON should have empty ancestors (omitted by skip_serializing_if)
    let (stdout, _, success) = run_fr(tmp.path(), &["show", "M-003", "--json"]);
    assert!(success);

    let json: serde_json::Value = serde_json::from_str(&stdout).unwrap();
    // ancestors should be absent (empty vec is skipped) or empty array
    assert!(json.get("ancestors").is_none() || json["ancestors"].as_array().unwrap().is_empty());
}

// ---------------------------------------------------------------------------
// Recovery command tests
// ---------------------------------------------------------------------------

#[test]
fn test_recovery_empty() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // No recovery log exists — should succeed with empty output
    let out = run_fr_ok(tmp.path(), &["recovery"]);
    assert!(out.contains("No recovery log entries") || out.is_empty() || out.contains("recovery"));
}

#[test]
fn test_recovery_path() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["recovery", "path"]);
    assert!(out.contains(".recovery.log"));
    assert!(out.contains("frame"));
}

#[test]
fn test_recovery_prune_all_empty() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Prune on empty project should succeed
    let out = run_fr_ok(tmp.path(), &["recovery", "prune", "--all"]);
    assert!(out.contains("0") || out.contains("pruned") || out.contains("No"));
}

#[test]
fn test_recovery_with_entries() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Write a recovery log entry manually
    let recovery_path = tmp.path().join("frame/.recovery.log");
    let ts = "2026-02-10T12:00:00Z";
    let content = format!(
        "<!-- frame recovery log — append-only error recovery data\n     This file captures data that Frame couldn't save normally.\n     If something went missing, check here.\n     View with: fr recovery\n     Prune old entries: fr recovery prune\n     Safe to delete if empty or stale. -->\n\n---\n## {} — write: test failure\n\nSource: tracks/main.md\n\n```text\nlost content here\n```\n\n---\n",
        ts
    );
    fs::write(&recovery_path, content).unwrap();

    let out = run_fr_ok(tmp.path(), &["recovery"]);
    assert!(out.contains("write: test failure") || out.contains("test failure"));
}

#[test]
fn test_recovery_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Write a recovery log entry
    let recovery_path = tmp.path().join("frame/.recovery.log");
    let ts = "2026-02-10T12:00:00Z";
    let content = format!(
        "<!-- frame recovery log — append-only error recovery data\n     This file captures data that Frame couldn't save normally.\n     If something went missing, check here.\n     View with: fr recovery\n     Prune old entries: fr recovery prune\n     Safe to delete if empty or stale. -->\n\n---\n## {} — parser: dropped lines\n\nSource: inbox.md\n\n```text\nstray line\n```\n\n---\n",
        ts
    );
    fs::write(&recovery_path, content).unwrap();

    let out = run_fr_ok(tmp.path(), &["recovery", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert!(parsed.is_array());
    let arr = parsed.as_array().unwrap();
    assert_eq!(arr.len(), 1);
    assert_eq!(arr[0]["category"], "parser");
    assert_eq!(arr[0]["description"], "dropped lines");
}

#[test]
fn test_recovery_prune_all_with_entries() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Write a recovery log entry
    let recovery_path = tmp.path().join("frame/.recovery.log");
    let ts = "2026-02-10T12:00:00Z";
    let content = format!(
        "<!-- frame recovery log — append-only error recovery data\n     This file captures data that Frame couldn't save normally.\n     If something went missing, check here.\n     View with: fr recovery\n     Prune old entries: fr recovery prune\n     Safe to delete if empty or stale. -->\n\n---\n## {} — write: failure\n\n---\n",
        ts
    );
    fs::write(&recovery_path, content).unwrap();

    let out = run_fr_ok(tmp.path(), &["recovery", "prune", "--all"]);
    assert!(out.contains("1") || out.contains("pruned"));

    // After prune, recovery should show no entries
    let out2 = run_fr_ok(tmp.path(), &["recovery"]);
    assert!(out2.contains("No recovery log entries") || !out2.contains("write: failure"));
}

#[test]
fn test_recovery_limit() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Write two recovery log entries
    let recovery_path = tmp.path().join("frame/.recovery.log");
    let content = "\
<!-- frame recovery log — append-only error recovery data
     This file captures data that Frame couldn't save normally.
     If something went missing, check here.
     View with: fr recovery
     Prune old entries: fr recovery prune
     Safe to delete if empty or stale. -->

---
## 2026-02-10T11:00:00Z — parser: first entry

---
## 2026-02-10T12:00:00Z — write: second entry

---
";
    fs::write(&recovery_path, content).unwrap();

    let out = run_fr_ok(tmp.path(), &["recovery", "--limit", "1"]);
    // Should only show the most recent entry
    assert!(out.contains("second entry"));
    assert!(!out.contains("first entry"));
}

#[test]
fn test_check_with_lost_task() {
    let tmp = tempfile::TempDir::new().unwrap();
    let frame_dir = tmp.path().join("frame");
    fs::create_dir_all(frame_dir.join("tracks")).unwrap();

    fs::write(
        frame_dir.join("project.toml"),
        r#"[project]
name = "test-project"

[[tracks]]
id = "main"
name = "Main Track"
state = "active"
file = "tracks/main.md"

[ids.prefixes]
main = "M"
"#,
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/main.md"),
        "\
# Main Track

## Backlog

- [!] `M-001` Recovered task #lost
  - added: 2025-05-01

## Done
",
    )
    .unwrap();

    fs::write(frame_dir.join("inbox.md"), "# Inbox\n").unwrap();

    let out = run_fr_ok(tmp.path(), &["check"]);
    assert!(out.contains("#lost") || out.contains("lost"));
}

#[test]
fn test_check_json_with_recovery_log() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    // Create a recovery log entry
    let recovery_path = tmp.path().join("frame/.recovery.log");
    let content = "\
<!-- frame recovery log — append-only error recovery data
     This file captures data that Frame couldn't save normally.
     If something went missing, check here.
     View with: fr recovery
     Prune old entries: fr recovery prune
     Safe to delete if empty or stale. -->

---
## 2026-02-10T12:00:00Z — write: test

---
";
    fs::write(&recovery_path, content).unwrap();

    let out = run_fr_ok(tmp.path(), &["check", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert!(parsed["info"].is_array());
    let info = parsed["info"].as_array().unwrap();
    assert!(info.iter().any(|i| i["type"] == "recovery_log"));
}

// ---------------------------------------------------------------------------
// Actor token tests
// ---------------------------------------------------------------------------

#[test]
fn test_init_claims_null_and_writes_both_files() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "Tokened"]);

    // actors.toml exists with null claimed active
    let actors = fs::read_to_string(tmp.path().join("frame/actors.toml")).unwrap();
    let parsed: toml::Value = toml::from_str(&actors).unwrap();
    assert_eq!(
        parsed["actors"]["null"]["state"].as_str().unwrap(),
        "active"
    );

    // .actor points to null
    let actor = fs::read_to_string(tmp.path().join("frame/.actor")).unwrap();
    assert_eq!(actor.trim(), "null");
}

#[test]
fn test_init_force_does_not_clobber_actors() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "First"]);

    // Mutate the registry, then reinit with --force.
    run_fr_ok(tmp.path(), &["actor", "set", "a", "--name", "mine"]);
    run_fr_ok(tmp.path(), &["init", "--name", "Second", "--force"]);

    // The registry survived the reinit.
    let actors = fs::read_to_string(tmp.path().join("frame/actors.toml")).unwrap();
    assert!(
        actors.contains("[actors.a]"),
        "actors.toml clobbered: {actors}"
    );
    assert!(actors.contains("mine"));
}

#[test]
fn test_actor_status_missing_registry_reports_unclaimed() {
    // The migration case: no actors.toml and no `.actor`. Remove the primary
    // `.actor` the helper writes to model a pre-actors legacy project.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::remove_file(tmp.path().join("frame/.actor")).unwrap();

    let (stdout, _stderr, success) = run_fr(tmp.path(), &["actor"]);
    assert!(
        success,
        "fr actor should not error on a registry-less project"
    );
    assert!(stdout.contains("unclaimed"), "stdout: {stdout}");
    // No file was created by a read-only status check.
    assert!(!tmp.path().join("frame/actors.toml").exists());
}

#[test]
fn test_first_mint_auto_claims_token() {
    // A fresh clone of an existing project has no `.actor`; the first `fr add`
    // auto-claims a letter token, announces it once, and mints in that namespace.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::remove_file(tmp.path().join("frame/.actor")).unwrap();

    let (stdout, stderr, success) = run_fr(tmp.path(), &["add", "main", "First in fresh clone"]);
    assert!(success, "stderr: {stderr}");

    // The minted ID is tokened (e.g. `M-e1`), not a bare null-namespace number.
    let id = stdout.trim();
    assert!(
        id.starts_with("M-") && id.chars().nth(2).is_some_and(|c| c.is_ascii_alphabetic()),
        "expected a tokened id, got {id}"
    );
    // Announced exactly once, to stderr (stdout stays clean for the id).
    assert!(stderr.contains("Claimed actor token"), "stderr: {stderr}");

    // `.actor` and the registry row were persisted.
    let token = fs::read_to_string(tmp.path().join("frame/.actor"))
        .unwrap()
        .trim()
        .to_string();
    assert_ne!(token, "null");
    assert_eq!(id, format!("M-{token}1"));
    let registry = fs::read_to_string(tmp.path().join("frame/actors.toml")).unwrap();
    assert!(
        registry.contains(&format!("[actors.{token}]")),
        "{registry}"
    );

    // A second mint does not re-announce (token already claimed).
    let (_stdout2, stderr2, success2) = run_fr(tmp.path(), &["add", "main", "Second"]);
    assert!(success2);
    assert!(
        !stderr2.contains("Claimed actor token"),
        "stderr2: {stderr2}"
    );
}

#[test]
fn test_dry_run_clean_on_unclaimed_clone_mints_nothing() {
    // Strict null policy: a passive path (`fr clean --dry-run`) on an unclaimed
    // clone must neither claim a token nor mint a null ID for an ID-less task.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::remove_file(tmp.path().join("frame/.actor")).unwrap();

    // Give the track an ID-less task.
    let main_path = tmp.path().join("frame/tracks/main.md");
    let main = fs::read_to_string(&main_path).unwrap();
    fs::write(
        &main_path,
        main.replace("## Backlog\n", "## Backlog\n\n- [ ] Task with no id\n"),
    )
    .unwrap();

    let (stdout, _stderr, success) = run_fr(tmp.path(), &["clean", "--dry-run"]);
    assert!(success);
    // Nothing was assigned, and no claim happened.
    assert!(
        !stdout.contains("IDs assigned"),
        "unclaimed clone must not mint on a dry run: {stdout}"
    );
    assert!(!tmp.path().join("frame/.actor").exists());
    assert!(!tmp.path().join("frame/actors.toml").exists());
}

#[test]
fn test_mint_errors_when_frontier_empty_and_unclaimed() {
    // No `.actor`, and every safe token is already taken: a mint must fail with
    // the routing message and create nothing.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::remove_file(tmp.path().join("frame/.actor")).unwrap();

    // Fill the entire safe alphabet in the registry so the frontier is empty.
    let alphabet = [
        "a", "b", "c", "d", "e", "f", "g", "h", "j", "k", "m", "n", "p", "q", "r", "s", "t", "u",
        "v", "w", "x", "y", "z",
    ];
    let mut registry = String::new();
    for t in alphabet {
        registry.push_str(&format!(
            "[actors.{t}]\nname = \"other\"\nstate = \"active\"\nclaimed = \"2026-01-01\"\n\n"
        ));
    }
    fs::write(tmp.path().join("frame/actors.toml"), registry).unwrap();

    let track_before = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let (_stdout, stderr, success) = run_fr(tmp.path(), &["add", "main", "Should not be created"]);
    assert!(!success, "mint should fail when no token can be claimed");
    assert!(stderr.contains("fr actor set"), "stderr: {stderr}");

    // Nothing was created or claimed.
    let track_after = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert_eq!(track_before, track_after);
    assert!(!track_after.contains("Should not be created"));
    assert!(!tmp.path().join("frame/.actor").exists());
}

#[test]
fn test_mv_cross_track_mints_in_movers_namespace() {
    // A clone that has claimed token c moves M-001 to the side track. The new id
    // is scanned in c's namespace on the target (which holds only null ids), so
    // it lands as S-c1 — not S-003 and not a token belonging to another actor.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    run_fr_ok(tmp.path(), &["actor", "set", "c"]);

    let out = run_fr_ok(tmp.path(), &["mv", "M-001", "--track", "side"]);
    assert!(out.contains("S-c1"), "out: {out}");

    let side = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();
    assert!(side.contains("S-c1"), "side: {side}");
    let main = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(!main.contains("First task"), "M-001 should have moved out");
}

#[test]
fn test_mv_promote_mints_in_movers_namespace() {
    // A clone that has claimed token c promotes M-003.1 to top-level. The new
    // top-level id is minted in c's namespace: M-c1.
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    run_fr_ok(tmp.path(), &["actor", "set", "c"]);

    let out = run_fr_ok(tmp.path(), &["mv", "M-003.1", "--promote"]);
    assert!(out.contains("M-c1"), "out: {out}");
}

#[test]
fn test_cross_track_move_aborts_when_frontier_empty_and_unclaimed() {
    // An unclaimed clone with an exhausted frontier attempting a cross-track move
    // must fail with the routing message and leave BOTH source and target tracks
    // unchanged (no partial mutation).
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::remove_file(tmp.path().join("frame/.actor")).unwrap();

    // Fill the entire safe alphabet so the frontier is empty.
    let alphabet = [
        "a", "b", "c", "d", "e", "f", "g", "h", "j", "k", "m", "n", "p", "q", "r", "s", "t", "u",
        "v", "w", "x", "y", "z",
    ];
    let mut registry = String::new();
    for t in alphabet {
        registry.push_str(&format!(
            "[actors.{t}]\nname = \"other\"\nstate = \"active\"\nclaimed = \"2026-01-01\"\n\n"
        ));
    }
    fs::write(tmp.path().join("frame/actors.toml"), registry).unwrap();

    let main_before = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let side_before = fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap();

    let (_stdout, stderr, success) = run_fr(tmp.path(), &["mv", "M-001", "--track", "side"]);
    assert!(
        !success,
        "cross-track move should fail when no token is claimable"
    );
    assert!(stderr.contains("fr actor set"), "stderr: {stderr}");

    // Neither track changed, and nothing was claimed.
    assert_eq!(
        main_before,
        fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap()
    );
    assert_eq!(
        side_before,
        fs::read_to_string(tmp.path().join("frame/tracks/side.md")).unwrap()
    );
    assert!(!tmp.path().join("frame/.actor").exists());
}

// ---------------------------------------------------------------------------
// CLI cross-track move updates cross-track dependency references
// ---------------------------------------------------------------------------

/// Project with four tracks and cross-track deps pointing at A-005 (the task we
/// move). `alpha` also holds A-0050, a decoy id that resembles A-005 but must not
/// be touched by a whole-id dep rewrite. Records the primary (null) actor so
/// mints stay in the legacy namespace unless a test claims a token first.
fn create_dep_project(root: &Path) {
    let frame_dir = root.join("frame");
    fs::create_dir_all(frame_dir.join("tracks")).unwrap();
    fs::write(frame_dir.join(".actor"), "null\n").unwrap();

    fs::write(
        frame_dir.join("project.toml"),
        r#"[project]
name = "dep-project"

[[tracks]]
id = "alpha"
name = "Alpha"
state = "active"
file = "tracks/alpha.md"

[[tracks]]
id = "beta"
name = "Beta"
state = "active"
file = "tracks/beta.md"

[[tracks]]
id = "gamma"
name = "Gamma"
state = "active"
file = "tracks/gamma.md"

[[tracks]]
id = "delta"
name = "Delta"
state = "active"
file = "tracks/delta.md"

[ids.prefixes]
alpha = "A"
beta = "B"
gamma = "C"
delta = "D"
"#,
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/alpha.md"),
        "\
# Alpha

## Backlog

- [ ] `A-001` First alpha
  - added: 2025-05-01
- [ ] `A-005` Movable task
  - added: 2025-05-02
- [ ] `A-0050` Decoy with a similar id
  - added: 2025-05-03

## Done
",
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/beta.md"),
        "\
# Beta

## Backlog

- [ ] `B-001` Depends on the movable task
  - added: 2025-05-01
  - dep: A-005
- [ ] `B-002` Depends on the decoy
  - added: 2025-05-02
  - dep: A-0050

## Done
",
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/gamma.md"),
        "\
# Gamma

## Backlog

## Done
",
    )
    .unwrap();

    fs::write(
        frame_dir.join("tracks/delta.md"),
        "\
# Delta

## Backlog

- [ ] `D-001` Also depends on the movable task
  - added: 2025-05-01
  - dep: A-005

## Done
",
    )
    .unwrap();
}

#[test]
fn test_mv_cross_track_updates_dep_reference() {
    // Previously broken: moving A-005 to gamma re-keyed it to C-001 but left
    // B-001's `dep: A-005` dangling. The dependent must now be rewritten.
    let tmp = tempfile::TempDir::new().unwrap();
    create_dep_project(tmp.path());

    let out = run_fr_ok(tmp.path(), &["mv", "A-005", "--track", "gamma"]);
    assert!(out.contains("A-005 → C-001"), "out: {out}");

    let beta = fs::read_to_string(tmp.path().join("frame/tracks/beta.md")).unwrap();
    assert!(beta.contains("dep: C-001"), "beta: {beta}");
    assert!(!beta.contains("dep: A-005\n"), "stale dep remained: {beta}");

    let gamma = fs::read_to_string(tmp.path().join("frame/tracks/gamma.md")).unwrap();
    assert!(gamma.contains("`C-001`"), "gamma: {gamma}");
}

#[test]
fn test_mv_cross_track_updates_dep_in_movers_namespace() {
    // The dependent is rewritten to the fully tokened new id when a tokened clone
    // performs the move: A-005 → C-c1, and B-001's dep follows.
    let tmp = tempfile::TempDir::new().unwrap();
    create_dep_project(tmp.path());
    run_fr_ok(tmp.path(), &["actor", "set", "c"]);

    let out = run_fr_ok(tmp.path(), &["mv", "A-005", "--track", "gamma"]);
    assert!(out.contains("A-005 → C-c1"), "out: {out}");

    let beta = fs::read_to_string(tmp.path().join("frame/tracks/beta.md")).unwrap();
    assert!(beta.contains("dep: C-c1"), "beta: {beta}");
}

#[test]
fn test_mv_cross_track_updates_multiple_dependents() {
    // Two dependents in different tracks (beta and delta) both pointing at the
    // moved id are both updated.
    let tmp = tempfile::TempDir::new().unwrap();
    create_dep_project(tmp.path());

    run_fr_ok(tmp.path(), &["mv", "A-005", "--track", "gamma"]);

    let beta = fs::read_to_string(tmp.path().join("frame/tracks/beta.md")).unwrap();
    let delta = fs::read_to_string(tmp.path().join("frame/tracks/delta.md")).unwrap();
    assert!(beta.contains("dep: C-001"), "beta: {beta}");
    assert!(delta.contains("dep: C-001"), "delta: {delta}");
}

#[test]
fn test_mv_cross_track_no_false_dep_rewrite() {
    // A dep that merely resembles the old id (A-0050 vs A-005) must be left
    // untouched — the rewrite matches whole ids, not substrings.
    let tmp = tempfile::TempDir::new().unwrap();
    create_dep_project(tmp.path());

    run_fr_ok(tmp.path(), &["mv", "A-005", "--track", "gamma"]);

    let beta = fs::read_to_string(tmp.path().join("frame/tracks/beta.md")).unwrap();
    // B-001 (dep: A-005) was rewritten; B-002 (dep: A-0050) was not.
    assert!(beta.contains("dep: C-001"), "beta: {beta}");
    assert!(
        beta.contains("dep: A-0050"),
        "decoy dep was wrongly rewritten: {beta}"
    );
}

#[test]
fn test_mv_cross_track_then_check_clean() {
    // End-to-end guard: after the move, `fr check` reports no dangling dependency.
    let tmp = tempfile::TempDir::new().unwrap();
    create_dep_project(tmp.path());

    run_fr_ok(tmp.path(), &["mv", "A-005", "--track", "gamma"]);

    let check = run_fr_ok(tmp.path(), &["check"]);
    assert!(check.contains("✓ project is valid"), "check: {check}");
    assert!(
        !check.contains("dangling"),
        "check reported a dangling dep: {check}"
    );
}

#[test]
fn test_actor_set_null_creates_registry_on_legacy_project() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    run_fr_ok(tmp.path(), &["actor", "set", "null"]);

    assert!(tmp.path().join("frame/actors.toml").exists());
    let actor = fs::read_to_string(tmp.path().join("frame/.actor")).unwrap();
    assert_eq!(actor.trim(), "null");
}

#[test]
fn test_actor_claim_picks_a_token() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "Claimer"]);

    let out = run_fr_ok(tmp.path(), &["actor", "claim"]);
    assert!(out.contains("claimed token"), "out: {out}");

    // .actor now holds a single safe letter (not null anymore).
    let actor = fs::read_to_string(tmp.path().join("frame/.actor"))
        .unwrap()
        .trim()
        .to_string();
    assert_ne!(actor, "null");
    assert_eq!(actor.len(), 1);
}

#[test]
fn test_actor_set_rejects_invalid_token() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "Strict"]);

    // Uppercase rejected.
    let (_o, _e, ok_upper) = run_fr(tmp.path(), &["actor", "set", "A"]);
    assert!(!ok_upper);
    // Single 'i' rejected (not in safe alphabet).
    let (_o, _e, ok_i) = run_fr(tmp.path(), &["actor", "set", "i"]);
    assert!(!ok_i);
}

#[test]
fn test_actor_retire_then_reclaim() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "Retirer"]);
    run_fr_ok(tmp.path(), &["actor", "set", "a"]);

    run_fr_ok(tmp.path(), &["actor", "retire", "a"]);
    let listing = run_fr_ok(tmp.path(), &["actor", "list"]);
    assert!(listing.contains("retired"), "list: {listing}");

    // Reclaim flips it back to active.
    let out = run_fr_ok(tmp.path(), &["actor", "set", "a"]);
    assert!(out.contains("reclaimed"), "out: {out}");
}

#[test]
fn test_actor_list_json() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "Lister"]);

    let out = run_fr_ok(tmp.path(), &["actor", "list", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    let rows = parsed.as_array().unwrap();
    assert!(rows.iter().any(|r| r["token"] == "null"));
}

#[test]
fn test_actor_set_owned_by_another_refused() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "Owner"]);

    // Hand-build a registry where 'a' is active but owned by a different clone
    // (this clone's .actor is null, not a).
    let actors_path = tmp.path().join("frame/actors.toml");
    let mut content = fs::read_to_string(&actors_path).unwrap();
    content.push_str(
        "\n[actors.a]\nname = \"other-machine\"\nstate = \"active\"\nclaimed = \"2026-06-01\"\n",
    );
    fs::write(&actors_path, content).unwrap();

    let (stdout, stderr, success) = run_fr(tmp.path(), &["actor", "set", "a"]);
    assert!(!success);
    let combined = format!("{stdout}{stderr}");
    assert!(combined.contains("already claimed"), "combined: {combined}");
}

// ---------------------------------------------------------------------------
// `fr info` tests
// ---------------------------------------------------------------------------

#[test]
fn test_info_human_primary() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path()); // .actor = null

    let out = run_fr_ok(tmp.path(), &["info"]);
    assert!(out.contains("version"), "out: {out}");
    assert!(out.contains(env!("CARGO_PKG_VERSION")), "out: {out}");
    assert!(out.contains("test-project"), "out: {out}");
    // null renders as the human-friendly "primary".
    assert!(out.contains("actor"), "out: {out}");
    assert!(out.contains("primary"), "out: {out}");
    assert!(
        !out.contains("null"),
        "human output should not show literal null: {out}"
    );
    // Two active tracks (main, side).
    assert!(out.contains("tracks"), "out: {out}");
    assert!(out.contains('2'), "out: {out}");
}

#[test]
fn test_info_json_primary() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path()); // .actor = null

    let out = run_fr_ok(tmp.path(), &["info", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert_eq!(parsed["version"], env!("CARGO_PKG_VERSION"));
    assert_eq!(parsed["project"], "test-project");
    assert_eq!(parsed["actor"], "null"); // primary is the literal string "null"
    assert_eq!(parsed["tracks"], 2);
    let frame_dir = parsed["frame_dir"].as_str().unwrap();
    assert!(frame_dir.ends_with("frame"), "frame_dir: {frame_dir}");
    assert!(
        Path::new(frame_dir).is_absolute(),
        "frame_dir should be absolute: {frame_dir}"
    );
}

#[test]
fn test_info_json_tokened() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::write(tmp.path().join("frame/.actor"), "a\n").unwrap();

    let out = run_fr_ok(tmp.path(), &["info", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    assert_eq!(parsed["actor"], "a");
}

#[test]
fn test_info_json_unclaimed_is_read_only() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    // Remove the .actor file so the clone is unclaimed.
    fs::remove_file(tmp.path().join("frame/.actor")).unwrap();
    assert!(!tmp.path().join("frame/actors.toml").exists());

    let out = run_fr_ok(tmp.path(), &["info", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&out).unwrap();
    // Unclaimed distinguishes as JSON null.
    assert!(
        parsed["actor"].is_null(),
        "actor should be JSON null: {out}"
    );

    // Read-only invariant: running info must not claim a token.
    assert!(
        !tmp.path().join("frame/.actor").exists(),
        "fr info must not create .actor"
    );
    assert!(
        !tmp.path().join("frame/actors.toml").exists(),
        "fr info must not create actors.toml"
    );
}

#[test]
fn test_info_human_unclaimed() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::remove_file(tmp.path().join("frame/.actor")).unwrap();

    let out = run_fr_ok(tmp.path(), &["info"]);
    assert!(out.contains("unclaimed"), "out: {out}");
}

// ---------------------------------------------------------------------------
// ID frontier — durable and shared across worktrees of a clone
// ---------------------------------------------------------------------------

fn git(dir: &Path, args: &[&str]) -> bool {
    Command::new("git")
        .current_dir(dir)
        .args(args)
        .stdout(std::process::Stdio::null())
        .stderr(std::process::Stdio::null())
        .status()
        .map(|s| s.success())
        .unwrap_or(false)
}

/// A clone whose frame project is committed, plus a linked worktree of it —
/// the shape that used to mint duplicate IDs. `.actor` stays gitignored, so the
/// worktree inherits the main tree's `null` token and both mint in one namespace.
/// `None` when git is unavailable.
fn clone_with_worktree(tmp: &Path) -> Option<(PathBuf, PathBuf)> {
    let main = tmp.join("main");
    fs::create_dir_all(&main).unwrap();
    create_test_project(&main);
    let ignore: String = frame::io::project_io::LOCAL_ONLY_FRAME_FILES
        .iter()
        .map(|name| format!("frame/{}\n", name))
        .collect();
    fs::write(main.join(".gitignore"), ignore).unwrap();

    if !git(&main, &["init", "-q"]) {
        return None;
    }
    git(&main, &["add", "-A"]);
    let committed = git(
        &main,
        &[
            "-c",
            "user.name=frame-test",
            "-c",
            "user.email=frame@test.invalid",
            "commit",
            "-q",
            "-m",
            "init",
        ],
    );
    if !committed {
        return None;
    }
    let worktree = tmp.join("wt");
    if !git(
        &main,
        &["worktree", "add", "-q", "--detach", worktree.to_str()?],
    ) {
        return None;
    }
    Some((main, worktree))
}

/// The reported bug: two worktrees of one clone, each scanning only its own
/// working copy, minting the same ID. The clone-shared frontier prevents it even
/// though the first task is still uncommitted and invisible to the second tree.
#[test]
fn test_worktrees_of_one_clone_do_not_mint_the_same_id() {
    let tmp = tempfile::TempDir::new().unwrap();
    let Some((main, worktree)) = clone_with_worktree(tmp.path()) else {
        return; // git unavailable
    };

    // The fixture's highest main-track number is M-010.
    let first = run_fr_ok(&main, &["add", "main", "from main"]);
    assert_eq!(first.trim(), "M-011");

    // The worktree's copy of tracks/main.md predates that add, so its own scan
    // still tops out at M-010 — it must not reissue M-011.
    let second = run_fr_ok(&worktree, &["add", "main", "from worktree"]);
    assert_eq!(
        second.trim(),
        "M-012",
        "worktree reissued a number the main tree already handed out"
    );

    // Back in the main tree, still monotonic.
    let third = run_fr_ok(&main, &["add", "main", "from main again"]);
    assert_eq!(third.trim(), "M-013");

    // The frontier lives under .git/, shared by both trees and uncommittable.
    assert!(main.join(".git/frame-ids.toml").is_file());
    let (status, _, ok) = run_fr(&main, &["--json", "check"]);
    assert!(ok, "check should pass: {status}");
}

/// The collision the clone-shared frontier deliberately does **not** cover.
///
/// Subtask numbers are allocated per parent by scanning that parent's children,
/// not from the frontier, so two worktrees of one clone adding a subtask to the
/// same parent both mint the same child id. Prevention was weighed and declined
/// (see `src/ops/ids.rs`): a child number means nothing outside its parent, so
/// renumbering one is mechanical — unlike a top-level id, whose reissue `fr
/// check` reports as unrepairable. What has to hold instead is that the
/// collision is detected and repaired.
///
/// This pins the whole path: collide, merge, detect, repair, converge.
#[test]
fn test_colliding_subtask_ids_are_detected_and_repaired() {
    let tmp = tempfile::TempDir::new().unwrap();
    let Some((main, worktree)) = clone_with_worktree(tmp.path()) else {
        return; // git unavailable
    };

    // M-003 already has .1 and .2 in the fixture. Each tree scans only its own
    // copy, sees the same two children, and hands out the same next number.
    let mine = run_fr_ok(&main, &["sub", "M-003", "from main"]);
    let theirs = run_fr_ok(&worktree, &["sub", "M-003", "from worktree"]);
    assert_eq!(
        mine.trim(),
        theirs.trim(),
        "the known open collision; if this ever stops holding, \
         subtask minting grew a frontier and this test is the wrong shape"
    );
    assert_eq!(mine.trim(), "M-003.3");

    // Merge the two working copies: both subtasks survive, carrying one id.
    let merged = fs::read_to_string(main.join("frame/tracks/main.md"))
        .unwrap()
        .replace(
            "  - [ ] `M-003.3` from main\n",
            "  - [ ] `M-003.3` from main\n  - [ ] `M-003.3` from worktree\n",
        );
    fs::write(main.join("frame/tracks/main.md"), &merged).unwrap();
    assert_eq!(merged.matches("`M-003.3`").count(), 2, "merge staged");

    // Detected — the generic duplicate-id error covers subtasks.
    let (out, _, _) = run_fr(&main, &["check"]);
    assert!(
        out.contains("M-003.3 is duplicated"),
        "should report the collision: {out}"
    );

    // Repaired, under the parent — not promoted to a top-level number.
    run_fr_ok(&main, &["clean"]);
    let after = fs::read_to_string(main.join("frame/tracks/main.md")).unwrap();
    assert!(
        after.contains("`M-003.3` from main") && after.contains("`M-003.4` from worktree"),
        "the second copy should take the next child number: {after}"
    );

    // Converged: no duplicate left, and nothing escaped its parent.
    let (recheck, _, _) = run_fr(&main, &["check"]);
    assert!(
        !recheck.contains("duplicated"),
        "duplicate survived: {recheck}"
    );
    assert!(
        !recheck.contains("doesn't extend"),
        "the repair must not misparent anything: {recheck}"
    );
}

/// Archived tasks keep their numbers: `fr clean` moving a done task out of the
/// live track must not free its number for reuse.
#[test]
fn test_archived_ids_are_not_reissued() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::create_dir_all(tmp.path().join("frame/archive")).unwrap();
    fs::write(
        tmp.path().join("frame/archive/main.md"),
        "# Archive — main\n\n- [x] `M-050` archived task\n  - resolved: 2025-06-01\n",
    )
    .unwrap();

    let out = run_fr_ok(tmp.path(), &["add", "main", "after archiving"]);
    assert_eq!(out.trim(), "M-051", "mint ignored the archive");
}

/// A deleted task's number stays spent — the frontier never walks backwards.
#[test]
fn test_deleted_ids_are_not_reissued() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());

    let first = run_fr_ok(tmp.path(), &["add", "main", "doomed"]);
    assert_eq!(first.trim(), "M-011");
    run_fr_ok(tmp.path(), &["delete", "M-011", "--yes"]);

    let second = run_fr_ok(tmp.path(), &["add", "main", "next"]);
    assert_eq!(second.trim(), "M-012", "deleted number was reissued");
}

/// A reissued number that `fr clean` can't see: one holder live, one archived.
/// Surfaced by `fr check` in human and JSON output.
#[test]
fn test_check_flags_a_live_id_colliding_with_an_archived_one() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::create_dir_all(tmp.path().join("frame/archive")).unwrap();
    // M-001 is live in the fixture's main track.
    fs::write(
        tmp.path().join("frame/archive/main.md"),
        "# Archive — main\n\n- [x] `M-001` archived work\n  - resolved: 2025-06-01\n",
    )
    .unwrap();

    let human = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        human.contains("M-001 is live in main but is also archived in archive/main.md"),
        "check should flag the reissue: {human}"
    );
    assert!(human.contains("the number was reissued"), "{human}");

    let json = run_fr_ok(tmp.path(), &["check", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
    let warnings = parsed["warnings"].as_array().unwrap();
    let reissue = warnings
        .iter()
        .find(|w| w["type"] == "id_reissued_after_archive")
        .expect("id_reissued_after_archive warning");
    assert_eq!(reissue["task_id"], "M-001");
    assert_eq!(reissue["tracks"][0], "main");
    assert_eq!(reissue["archives"][0], "archive/main.md");
    // A warning, not an error — there is no automatic repair, and this fires on
    // data that predates the durable frontier.
    assert_eq!(parsed["valid"], true);
}

/// The Lace shape: one archive file holding the same task twice, no live task
/// involved. Reported as duplicated *history* — not as a reissued number, and
/// without naming the same file twice as if two files were involved.
#[test]
fn test_check_flags_a_duplicated_archive_entry() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::create_dir_all(tmp.path().join("frame/archive")).unwrap();
    // M-900 is in no live track; the archive holds it twice.
    fs::write(
        tmp.path().join("frame/archive/main.md"),
        "# Archive — main\n\n- [x] `M-900` archived work\n  - resolved: 2025-06-01\n- [x] `M-900` archived work\n  - resolved: 2025-06-01\n",
    )
    .unwrap();

    let human = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        human.contains("M-900 appears 2 times in archive/main.md and in no live track"),
        "check should flag duplicated history: {human}"
    );
    assert!(
        human.contains("no number was reissued"),
        "and must not claim a reissue: {human}"
    );

    let json = run_fr_ok(tmp.path(), &["check", "--json"]);
    let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
    let warnings = parsed["warnings"].as_array().unwrap();
    let duplicate = warnings
        .iter()
        .find(|w| w["type"] == "duplicate_archived_id")
        .expect("duplicate_archived_id warning");
    assert_eq!(duplicate["task_id"], "M-900");
    assert_eq!(duplicate["total"], 2);
    // One file, named once.
    assert_eq!(duplicate["archives"].as_array().unwrap().len(), 1);
    assert!(
        !warnings
            .iter()
            .any(|w| w["type"] == "id_reissued_after_archive"),
        "must not also report a reissue: {json}"
    );
}

/// A frontier store that doesn't parse is reported, not silently reset.
#[test]
fn test_check_flags_an_unreadable_id_frontier() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    // Outside git, the store is working-copy-local.
    let store = tmp.path().join("frame/.ids.toml");
    fs::write(&store, "not toml {{{").unwrap();

    let human = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        human.contains("is unreadable"),
        "check should flag the store: {human}"
    );
    assert!(store.is_file(), "check must not reset the store");

    // The next mint does reset it, leaving the .bak that check then reports.
    run_fr_ok(tmp.path(), &["add", "main", "after reset"]);
    let human = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        human.contains("ID frontier was reset"),
        "check should flag the leftover .bak: {human}"
    );
}

// ---------------------------------------------------------------------------
// `fr check --fix`
// ---------------------------------------------------------------------------

/// A task note and an inbox body that each leave a code fence open.
fn project_with_open_fences(root: &Path) {
    create_test_project(root);
    fs::write(
        root.join("frame/tracks/main.md"),
        "\
# Main Track

## Backlog

- [ ] `M-001` Task with an open fence
  - added: 2026-07-31
  - note:
    Example:
    ```rust
    let x = 1;

## Done
",
    )
    .unwrap();
    fs::write(
        root.join("frame/inbox.md"),
        "# Inbox\n\n- Item with an open body fence\n  ```lace\n  perform Ask()\n",
    )
    .unwrap();
}

#[test]
fn test_check_stays_read_only_without_fix() {
    let tmp = tempfile::TempDir::new().unwrap();
    project_with_open_fences(tmp.path());

    let before = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let out = run_fr_ok(tmp.path(), &["check"]);
    let after = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();

    assert!(out.contains("code fence open"), "should report it: {out}");
    assert_eq!(before, after, "bare `fr check` must not write");
}

#[test]
fn test_check_fix_dry_run_writes_nothing() {
    let tmp = tempfile::TempDir::new().unwrap();
    project_with_open_fences(tmp.path());

    let before = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let out = run_fr_ok(tmp.path(), &["check", "--fix", "--dry-run"]);
    let after = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();

    assert!(out.contains("close note fence"), "should plan it: {out}");
    assert!(out.contains("dry run"), "should say so: {out}");
    assert_eq!(before, after, "--dry-run must not write");
}

#[test]
fn test_check_fix_closes_note_and_inbox_fences() {
    let tmp = tempfile::TempDir::new().unwrap();
    project_with_open_fences(tmp.path());

    run_fr_ok(tmp.path(), &["check", "--fix"]);

    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    let inbox = fs::read_to_string(tmp.path().join("frame/inbox.md")).unwrap();
    assert!(track.contains("let x = 1;"), "content preserved: {track}");
    assert!(
        track.matches("```").count() >= 2,
        "note fence closed: {track}"
    );
    assert!(
        inbox.matches("```").count() >= 2,
        "inbox fence closed: {inbox}"
    );

    // The findings are gone, and a second run has nothing to do.
    let recheck = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        !recheck.contains("code fence open"),
        "fences should be balanced now: {recheck}"
    );
    let again = run_fr_ok(tmp.path(), &["check", "--fix"]);
    assert!(
        again.contains("nothing to repair"),
        "--fix must be idempotent: {again}"
    );
}

/// An archive holding one task twice, in the shape **`fr clean` actually
/// writes**: a `# Archive — <track>` title and then bare task lines, with no
/// `## Section` header.
///
/// The shape is the point. Both `--fix` tests below used to invent a `## Done`
/// section, which exercised a path no real archive takes and let the dedupe
/// repair ship not working at all — it walked `TrackNode::Section`, found
/// nothing, and reported the task "no longer appears in the archives".
/// `tests/damaged_corpus.rs` caught it by building the archive the way clean
/// does.
const DUPLICATED_ARCHIVE: &str = "\
# Archive — main

- [x] `M-900` Archived twice
  - resolved: 2026-01-01
- [x] `M-900` Archived twice
  - resolved: 2026-01-01
- [x] `M-901` Archived once
  - resolved: 2026-01-02
";

/// A repair that deletes must not run without consent. With stdin closed the
/// prompt reads nothing, which is not `y`, so the run cancels — the behaviour a
/// non-interactive caller (CI, an agent) gets by default.
#[test]
fn test_check_fix_cancels_deleting_repair_without_yes() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::create_dir_all(tmp.path().join("frame/archive")).unwrap();
    let archive = DUPLICATED_ARCHIVE;
    fs::write(tmp.path().join("frame/archive/main.md"), archive).unwrap();

    let (stdout, stderr, ok) = run_fr(tmp.path(), &["check", "--fix"]);
    assert!(ok, "should exit cleanly: {stderr}");
    assert!(
        stdout.contains("duplicate archive") || stdout.contains("delete"),
        "should describe the deleting repair: {stdout}"
    );
    assert!(stderr.contains("cancelled"), "should cancel: {stderr}");

    let after = fs::read_to_string(tmp.path().join("frame/archive/main.md")).unwrap();
    assert_eq!(after, archive, "archive must be untouched after cancelling");
}

#[test]
fn test_check_fix_yes_dedupes_archive_and_logs_recovery() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::create_dir_all(tmp.path().join("frame/archive")).unwrap();
    fs::write(tmp.path().join("frame/archive/main.md"), DUPLICATED_ARCHIVE).unwrap();

    run_fr_ok(tmp.path(), &["check", "--fix", "--yes"]);

    let after = fs::read_to_string(tmp.path().join("frame/archive/main.md")).unwrap();
    assert_eq!(
        after.matches("`M-900`").count(),
        1,
        "one copy should remain: {after}"
    );
    assert!(after.contains("`M-901`"), "other tasks untouched: {after}");
    assert!(
        after.starts_with("# Archive — main"),
        "the archive header is carried verbatim: {after}"
    );

    // What was removed is recoverable, not gone.
    let log = run_fr_ok(tmp.path(), &["recovery"]);
    assert!(
        log.contains("M-900"),
        "removed copy should be in the recovery log: {log}"
    );
}

/// The damage `fr clean` used to leave behind: a duplicated *subtask* id
/// resolved with a top-level number, so the task ends up as `M-020` nested under
/// `M-003`. Projects cleaned before that was fixed still hold it on disk, which
/// is what this repair is for.
#[test]
fn test_check_fix_renumbers_a_subtask_that_escaped_its_parent() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    fs::write(
        tmp.path().join("frame/tracks/main.md"),
        "\
# Main Track

## Backlog

- [ ] `M-003` Parent
  - added: 2025-05-03
  - [ ] `M-003.1` Sub one
    - added: 2025-05-03
  - [ ] `M-020` Escaped, with a child of its own
    - added: 2025-05-03
    - [ ] `M-020.1` Deep
      - added: 2025-05-03
- [ ] `M-004` Waiting on the escapee
  - added: 2025-05-03
  - dep: M-020

## Done
",
    )
    .unwrap();

    let reported = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        reported.contains("M-020 is nested under M-003 but its id doesn't extend it"),
        "should report it: {reported}"
    );

    // It rewrites an id out of existence, so it needs consent.
    let planned = run_fr_ok(tmp.path(), &["check", "--fix", "--dry-run"]);
    assert!(
        planned.contains("renumber under its parent M-003"),
        "should plan it: {planned}"
    );

    run_fr_ok(tmp.path(), &["check", "--fix", "--yes"]);

    let track = fs::read_to_string(tmp.path().join("frame/tracks/main.md")).unwrap();
    assert!(
        track.contains("`M-003.2` Escaped"),
        "should take the next free child number: {track}"
    );
    assert!(
        track.contains("`M-003.2.1` Deep"),
        "descendants follow: {track}"
    );
    assert!(
        track.contains("dep: M-003.2"),
        "deps follow the rekey: {track}"
    );

    let recheck = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        !recheck.contains("doesn't extend"),
        "finding should be gone: {recheck}"
    );
    let again = run_fr_ok(tmp.path(), &["check", "--fix"]);
    assert!(
        again.contains("nothing to repair"),
        "--fix must be idempotent: {again}"
    );
}

/// Repairing `.gitignore` adds the blanket pattern, once, however many local
/// files were reported — it covers all of them and the next one added to
/// `frame/` too, which enumerating never could.
#[test]
fn test_check_fix_adds_the_gitignore_pattern() {
    let tmp = tempfile::TempDir::new().unwrap();
    if !std::process::Command::new("git")
        .args(["init", "-q"])
        .current_dir(tmp.path())
        .status()
        .map(|s| s.success())
        .unwrap_or(false)
    {
        return; // no git available
    }
    create_test_project(tmp.path());
    fs::write(tmp.path().join(".gitignore"), "target/\n").unwrap();

    run_fr_ok(tmp.path(), &["check", "--fix"]);

    let gitignore = fs::read_to_string(tmp.path().join(".gitignore")).unwrap();
    assert!(
        gitignore.contains("frame/.*"),
        "the pattern should be added: {gitignore}"
    );
    assert_eq!(
        gitignore.lines().filter(|l| l.trim() == "frame/.*").count(),
        1,
        "exactly once, however many files were reported: {gitignore}"
    );
    // And it really does cover them.
    for name in frame::io::project_io::LOCAL_ONLY_FRAME_FILES {
        let ok = std::process::Command::new("git")
            .args(["check-ignore", "-q", &format!("frame/{name}")])
            .current_dir(tmp.path())
            .status()
            .map(|s| s.success())
            .unwrap_or(false);
        assert!(ok, "frame/{name} should be ignored by the pattern");
    }
}

// ---------------------------------------------------------------------------
// Crash injection: multi-file write sequences
//
// Single-file writes are atomic (temp file + rename), so the exposure is
// operations that are only complete after two or more files are written. These
// use `FRAME_FAIL_WRITE` (see `src/io/fault.rs`) to cut one specific write of a
// real sequence and then assert on **files on disk** — not on the recovery log,
// which only catches a write that returns an error and would be skipped
// entirely by an abrupt death.
// ---------------------------------------------------------------------------

/// Two tracks, one task in the first, ready to be moved.
fn two_track_project(root: &Path) {
    run_fr_ok(
        root,
        &[
            "init", "--name", "p", "--track", "a", "A", "--track", "b", "B",
        ],
    );
    run_fr_ok(root, &["add", "a", "the task to move"]);
}

/// Which track files still mention the task.
fn tracks_holding(root: &Path, needle: &str) -> Vec<String> {
    let mut out = Vec::new();
    let dir = root.join("frame/tracks");
    let mut entries: Vec<_> = fs::read_dir(&dir)
        .expect("tracks dir")
        .filter_map(|e| e.ok())
        .map(|e| e.path())
        .collect();
    entries.sort();
    for path in entries {
        if fs::read_to_string(&path)
            .map(|c| c.contains(needle))
            .unwrap_or(false)
        {
            out.push(path.file_name().unwrap().to_string_lossy().into_owned());
        }
    }
    out
}

/// A cross-track move writes the target before the source, so an interruption
/// between the two cannot leave the task in neither track.
///
/// Failing the *target* write is the case that used to lose data: the source had
/// already been saved with the task removed, and a task in no track is
/// indistinguishable from one that never existed, so nothing could detect or
/// repair it.
#[test]
fn test_cross_track_move_survives_target_write_failure() {
    let tmp = tempfile::TempDir::new().unwrap();
    two_track_project(tmp.path());

    let (_, _, ok) = run_fr_env(
        tmp.path(),
        &["mv", "A-001", "--track", "b"],
        &[("FRAME_FAIL_WRITE", "tracks/b.md")],
    );
    assert!(!ok, "the injected failure should fail the command");

    assert_eq!(
        tracks_holding(tmp.path(), "the task to move"),
        vec!["a.md"],
        "task must remain in the source track when the target write is cut"
    );
}

/// The other window: the target landed, the source write is cut. The task is now
/// in both tracks — under different ids, since the move re-mints into the mover's
/// namespace. That is a duplicate for a human to reconcile, which is the price of
/// never losing it.
#[test]
fn test_cross_track_move_survives_source_write_failure() {
    let tmp = tempfile::TempDir::new().unwrap();
    two_track_project(tmp.path());

    let (_, _, ok) = run_fr_env(
        tmp.path(),
        &["mv", "A-001", "--track", "b"],
        &[("FRAME_FAIL_WRITE", "tracks/a.md")],
    );
    assert!(!ok, "the injected failure should fail the command");

    let holding = tracks_holding(tmp.path(), "the task to move");
    assert!(
        holding.contains(&"b.md".to_string()),
        "target should hold the moved task: {holding:?}"
    );
    assert!(
        !holding.is_empty(),
        "the task must survive somewhere, whichever write is cut"
    );
}

/// Archiving a track is two steps — mark it archived in config, then move the
/// file into `archive/_tracks/`. Interrupted between them the config says
/// archived while the file is still in `tracks/`; re-running must finish the job
/// rather than wedge.
#[test]
fn test_track_archive_recovers_from_interrupted_file_move() {
    let tmp = tempfile::TempDir::new().unwrap();
    two_track_project(tmp.path());

    let (_, _, ok) = run_fr_env(
        tmp.path(),
        &["track", "archive", "a"],
        &[("FRAME_FAIL_WRITE", "tracks/a.md")],
    );
    assert!(!ok, "the injected failure should fail the command");

    // The half-applied state: config updated, file not yet moved.
    let config = fs::read_to_string(tmp.path().join("frame/project.toml")).unwrap();
    assert!(config.contains("archived"), "config was written first");
    assert!(
        tmp.path().join("frame/tracks/a.md").exists(),
        "the file move is what was cut"
    );

    // Any following write command recovers it — no need to re-run the archive.
    run_fr_ok(tmp.path(), &["add", "b", "unrelated"]);
    assert!(
        !tmp.path().join("frame/tracks/a.md").exists(),
        "recovery should move the file out of tracks/"
    );
    assert!(
        tmp.path().join("frame/archive/_tracks/a.md").exists(),
        "and into archive/_tracks/"
    );
}

/// `fr check --fix` applies a plan of independent repairs. Cutting one must not
/// prevent a re-run from applying the rest, and must not apply anything twice.
#[test]
fn test_check_fix_converges_after_a_partial_application() {
    let tmp = tempfile::TempDir::new().unwrap();
    create_test_project(tmp.path());
    // Two tracks with an unclosed fence each, so the plan has two writes.
    for (file, id) in [("main.md", "M-500"), ("side.md", "S-500")] {
        fs::write(
            tmp.path().join("frame/tracks").join(file),
            format!(
                "# T\n\n## Backlog\n\n- [ ] `{id}` Open fence\n  - note:\n    ```rust\n    let x = 1;\n\n## Done\n"
            ),
        )
        .unwrap();
    }

    let (_, _, ok) = run_fr_env(
        tmp.path(),
        &["check", "--fix"],
        &[("FRAME_FAIL_WRITE", "tracks/side.md")],
    );
    assert!(!ok, "the injected failure should fail the command");

    // Re-run without injection: whatever is left gets repaired.
    run_fr_ok(tmp.path(), &["check", "--fix"]);

    let recheck = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        !recheck.contains("code fence open"),
        "both fences should be closed after the re-run: {recheck}"
    );

    // Nothing was applied twice: each note carries exactly one closing fence, so
    // the opener plus the closer is two markers, not three.
    for file in ["main.md", "side.md"] {
        let content = fs::read_to_string(tmp.path().join("frame/tracks").join(file)).unwrap();
        assert_eq!(
            content.matches("```").count(),
            2,
            "{file} should have one opener and one closer:\n{content}"
        );
    }
}

/// Fault injection must be inert unless asked for — otherwise every other test
/// in the suite would be running against a rigged write path.
#[test]
fn test_fault_injection_is_off_by_default() {
    let tmp = tempfile::TempDir::new().unwrap();
    two_track_project(tmp.path());

    run_fr_ok(tmp.path(), &["mv", "A-001", "--track", "b"]);
    assert_eq!(
        tracks_holding(tmp.path(), "the task to move"),
        vec!["b.md"],
        "an uninjected move should complete normally"
    );
}

/// `fr actor merge` renumbers ids across tracks and archives, then retires the
/// source tokens in `actors.toml`. Cutting the registry write leaves the ids
/// remapped while the source token is still active — the state where a naive
/// implementation would wedge, because there are no source-namespace ids left to
/// find on a retry. Re-running must still finish the retirement.
#[test]
fn test_actor_merge_converges_when_the_registry_write_is_cut() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "p", "--track", "a", "A"]);

    run_fr_ok(tmp.path(), &["actor", "set", "x"]);
    run_fr_ok(tmp.path(), &["add", "a", "from x"]);
    run_fr_ok(tmp.path(), &["actor", "set", "y"]);
    run_fr_ok(tmp.path(), &["add", "a", "from y"]);

    let (_, _, ok) = run_fr_env(
        tmp.path(),
        &["actor", "merge", "x", "--into", "y"],
        &[("FRAME_FAIL_WRITE", "actors.toml")],
    );
    assert!(!ok, "the injected failure should fail the command");

    // Ids were remapped before the registry write was attempted.
    let track = fs::read_to_string(tmp.path().join("frame/tracks/a.md")).unwrap();
    assert!(
        !track.contains("`A-x"),
        "no id should remain in the merged-away namespace: {track}"
    );
    // But the token is still active.
    let listing = run_fr_ok(tmp.path(), &["actor", "list"]);
    assert!(
        listing
            .lines()
            .any(|l| l.contains(" x ") && l.contains("active")),
        "x should still be active after the cut: {listing}"
    );

    // Re-running completes the retirement rather than wedging.
    run_fr_ok(tmp.path(), &["actor", "merge", "x", "--into", "y"]);
    let listing = run_fr_ok(tmp.path(), &["actor", "list"]);
    assert!(
        listing
            .lines()
            .any(|l| l.contains(" x ") && l.contains("retired")),
        "x should be retired after the re-run: {listing}"
    );

    assert!(
        run_fr_ok(tmp.path(), &["check"]).contains("valid"),
        "project should be consistent after recovery"
    );
}

// ---------------------------------------------------------------------------
// In-flight marker and automatic recovery
// ---------------------------------------------------------------------------

/// The state after a cut cross-track move is undetectable by any check — the
/// task is in both tracks under different IDs, which is a legitimate shape. The
/// marker is what makes it knowable, and the next write command completes the
/// move rather than leaving a human to work out which copy to delete.
#[test]
fn test_interrupted_cross_track_move_is_recovered_by_the_next_write() {
    let tmp = tempfile::TempDir::new().unwrap();
    two_track_project(tmp.path());

    let (_, _, ok) = run_fr_env(
        tmp.path(),
        &["mv", "A-001", "--track", "b"],
        &[("FRAME_FAIL_WRITE", "tracks/a.md")],
    );
    assert!(!ok);

    // The interrupted state: in both tracks, and a marker recording the intent.
    assert_eq!(
        tracks_holding(tmp.path(), "the task to move"),
        vec!["a.md", "b.md"],
    );
    assert!(
        tmp.path().join("frame/.inflight").exists(),
        "marker written"
    );

    // Check reports it, where it would otherwise say the project is valid.
    let checked = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        checked.contains("did not finish"),
        "check should report the interrupted operation: {checked}"
    );

    // Any write command completes the move.
    let (_, stderr, _) = run_fr(tmp.path(), &["add", "a", "something else"]);
    assert!(
        stderr.contains("recovered an interrupted"),
        "recovery should be announced: {stderr}"
    );

    assert_eq!(
        tracks_holding(tmp.path(), "the task to move"),
        vec!["b.md"],
        "the move should now be complete — target only"
    );
    assert!(
        !tmp.path().join("frame/.inflight").exists(),
        "marker cleared after recovery"
    );
    assert!(run_fr_ok(tmp.path(), &["check"]).contains("valid"));
}

/// Triage writes the task, then the inbox. Cut in between, the item is both a
/// task and still in the inbox; recovery drops the inbox copy.
#[test]
fn test_interrupted_triage_is_recovered() {
    let tmp = tempfile::TempDir::new().unwrap();
    two_track_project(tmp.path());
    run_fr_ok(tmp.path(), &["inbox", "an idea worth keeping"]);

    let (_, _, ok) = run_fr_env(
        tmp.path(),
        &["triage", "1", "--track", "b"],
        &[("FRAME_FAIL_WRITE", "inbox.md")],
    );
    assert!(!ok);

    let inbox = fs::read_to_string(tmp.path().join("frame/inbox.md")).unwrap();
    assert!(
        inbox.contains("an idea worth keeping"),
        "still in the inbox"
    );

    run_fr_ok(tmp.path(), &["add", "a", "something else"]);

    let inbox = fs::read_to_string(tmp.path().join("frame/inbox.md")).unwrap();
    assert!(
        !inbox.contains("an idea worth keeping"),
        "recovery should remove the inbox copy: {inbox}"
    );
    assert!(
        tracks_holding(tmp.path(), "an idea worth keeping") == vec!["b.md"],
        "and the task should remain"
    );
}

/// `fr actor merge` renumbers before it writes the registry. Cut in between, the
/// source token is still active with no source-namespace ids left to find — the
/// case a naive retry cannot work out. The marker records which tokens to retire.
#[test]
fn test_interrupted_actor_merge_is_recovered() {
    let tmp = tempfile::TempDir::new().unwrap();
    run_fr_ok(tmp.path(), &["init", "--name", "p", "--track", "a", "A"]);
    run_fr_ok(tmp.path(), &["actor", "set", "x"]);
    run_fr_ok(tmp.path(), &["add", "a", "from x"]);
    run_fr_ok(tmp.path(), &["actor", "set", "y"]);
    run_fr_ok(tmp.path(), &["add", "a", "from y"]);

    let (_, _, ok) = run_fr_env(
        tmp.path(),
        &["actor", "merge", "x", "--into", "y"],
        &[("FRAME_FAIL_WRITE", "actors.toml")],
    );
    assert!(!ok);

    run_fr_ok(tmp.path(), &["add", "a", "something else"]);

    let listing = run_fr_ok(tmp.path(), &["actor", "list"]);
    assert!(
        listing
            .lines()
            .any(|l| l.contains(" x ") && l.contains("retired")),
        "recovery should retire the merged-away token: {listing}"
    );
}

/// A completed operation leaves nothing behind — otherwise every command would
/// be doing recovery work and the warning would be permanent noise.
#[test]
fn test_a_completed_operation_leaves_no_marker() {
    let tmp = tempfile::TempDir::new().unwrap();
    two_track_project(tmp.path());

    run_fr_ok(tmp.path(), &["mv", "A-001", "--track", "b"]);
    assert!(
        !tmp.path().join("frame/.inflight").exists(),
        "marker should be cleared on success"
    );
    assert!(run_fr_ok(tmp.path(), &["check"]).contains("valid"));
}

/// When a precondition no longer holds, recovery must not guess. It leaves
/// everything alone and keeps the marker, so the warning stands until a human
/// acknowledges it with `fr check --fix --yes`.
#[test]
fn test_recovery_declines_when_a_precondition_fails() {
    let tmp = tempfile::TempDir::new().unwrap();
    two_track_project(tmp.path());
    run_fr_ok(tmp.path(), &["inbox", "an orphan idea"]);

    // A marker claiming a triage completed, for a task that does not exist.
    // Reachable when the world changed between the crash and the recovery.
    fs::write(
        tmp.path().join("frame/.inflight"),
        "command = \"fr triage 1 --track b\"\n\
         started = \"2026-07-31T00:00:00Z\"\n\
         kind = \"triage\"\n\
         index = 1\n\
         title = \"an orphan idea\"\n\
         track_id = \"b\"\n",
    )
    .unwrap();

    let (_, stderr, _) = run_fr(tmp.path(), &["add", "a", "something else"]);
    assert!(
        stderr.contains("could not be completed automatically"),
        "should decline and say so: {stderr}"
    );

    let inbox = fs::read_to_string(tmp.path().join("frame/inbox.md")).unwrap();
    assert!(
        inbox.contains("an orphan idea"),
        "the inbox item must not be dropped when the task never landed: {inbox}"
    );
    assert!(
        tmp.path().join("frame/.inflight").exists(),
        "marker kept so the warning stands"
    );

    // The escape hatch: acknowledge it.
    run_fr_ok(tmp.path(), &["check", "--fix", "--yes"]);
    assert!(
        !tmp.path().join("frame/.inflight").exists(),
        "--fix --yes should clear a marker recovery declined to act on"
    );
}

/// The in-flight marker exists only between a crash and the next write command,
/// so an existence check almost never catches it — and `fr check --fix` never
/// can, because it recovers first, which removes the marker before the repair
/// plan is computed. Without an exception a project created before the marker
/// existed could never acquire its `.gitignore` line, and a `git add -A` in that
/// window would commit it.
#[test]
fn test_inflight_gitignore_entry_is_reported_even_when_absent() {
    let tmp = tempfile::TempDir::new().unwrap();
    if !std::process::Command::new("git")
        .args(["init", "-q"])
        .current_dir(tmp.path())
        .status()
        .map(|s| s.success())
        .unwrap_or(false)
    {
        return; // no git available
    }
    create_test_project(tmp.path());

    // A .gitignore as a project predating the marker would have it: everything
    // else covered, `.inflight` missing.
    fs::write(
        tmp.path().join(".gitignore"),
        "frame/.state.json\nframe/.lock\nframe/.recovery.log\nframe/.actor\n\
         frame/.ids.toml\nframe/.ids.lock\n",
    )
    .unwrap();
    assert!(
        !tmp.path().join("frame/.inflight").exists(),
        "no operation is in flight — that is the point"
    );

    let checked = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        checked.contains("frame/.inflight"),
        "should be reported even though the file is absent: {checked}"
    );

    run_fr_ok(tmp.path(), &["check", "--fix"]);
    let gitignore = fs::read_to_string(tmp.path().join(".gitignore")).unwrap();
    assert!(
        gitignore.contains("frame/.*"),
        "--fix should add the pattern, which covers it: {gitignore}"
    );

    // The persistent files keep the existence gate: `.ids.toml` never appears
    // inside a git repo, so warning about it would be noise.
    fs::write(tmp.path().join(".gitignore"), "frame/.state.json\n").unwrap();
    let checked = run_fr_ok(tmp.path(), &["check"]);
    assert!(
        !checked.contains("frame/.ids.toml"),
        "an absent persistent file should stay unreported: {checked}"
    );
}