lex-api 0.11.21

//! M8 acceptance per spec §12.4.
//!
//! - All CLI commands work end-to-end on §3.13 examples (covered by
//!   crate-level tests across the workspace).
//! - The agent API server starts, handles 100 sequential requests
//!   without leaking memory, and returns the same results as the CLI.
//! - A scripted agent loop (publish → run → trace → patch → run)
//!   completes successfully. We exercise publish → run → trace → diff
//!   here; patch lands in a follow-up.

use std::io::{Read, Write};
use std::net::{SocketAddr, TcpStream};
use std::sync::Arc;
use std::thread;
use std::time::Duration;

use lex_api::handlers::State;
use serde_json::json;
use tempfile::TempDir;

struct Server {
    addr: SocketAddr,
    _join: Option<thread::JoinHandle<()>>,
    _server_holder: Arc<()>,
}

fn start_server() -> (Server, TempDir) {
    let tmp = TempDir::new().unwrap();
    let server = tiny_http::Server::http(("127.0.0.1", 0))
        .expect("bind ephemeral port");
    let addr: SocketAddr = match server.server_addr() {
        tiny_http::ListenAddr::IP(addr) => addr,
        _ => panic!("expected IP listener"),
    };
    let state = Arc::new(State::open(tmp.path().to_path_buf()).unwrap());
    let join = thread::spawn(move || {
        lex_api::serve_on(server, state);
    });
    // The kernel listener is already bound when `Server::http` returns,
    // so `connect()` succeeds immediately — but the serve thread may
    // not yet be inside its `recv()` loop. Under fresh-compile +
    // parallel test launch the spawned thread can stay CPU-starved
    // past the 5s client read timeout, leaving the test panicking at
    // `s.read_to_string(&mut buf).unwrap()`. Sleeping a fixed 20ms
    // didn't survive heavy CI load; poll `/v1/health` until it
    // actually responds.
    wait_until_serving(&addr);
    (Server { addr, _join: Some(join), _server_holder: Arc::new(()) }, tmp)
}

fn wait_until_serving(addr: &SocketAddr) {
    let deadline = std::time::Instant::now() + Duration::from_secs(10);
    let probe = b"GET /v1/health HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n";
    while std::time::Instant::now() < deadline {
        if let Ok(mut s) = TcpStream::connect_timeout(addr, Duration::from_millis(200)) {
            s.set_read_timeout(Some(Duration::from_millis(200))).ok();
            if s.write_all(probe).is_ok() {
                let mut buf = [0u8; 16];
                if s.read(&mut buf).is_ok() && buf.starts_with(b"HTTP/1.1 200") {
                    return;
                }
            }
        }
        thread::sleep(Duration::from_millis(20));
    }
    panic!("test server never became ready within 10s");
}

fn http(addr: &SocketAddr, method: &str, path: &str, body: &str) -> (u16, String) {
    let req = format!(
        "{method} {path} HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
        body.len(), body
    );
    // Retry transient transport errors. Under heavy parallel test load
    // the server thread can be slow to accept the connection or flush
    // the response, which previously surfaced as a panic on
    // `read_to_string` (m8.rs:78). A bounded retry with a generous read
    // timeout keeps the test deterministic without weakening what it
    // asserts: a real HTTP response (any status) is returned as-is and
    // only I/O failures are retried.
    let deadline = std::time::Instant::now() + Duration::from_secs(30);
    loop {
        match try_http(addr, &req) {
            Ok(result) => return result,
            Err(e) => {
                if std::time::Instant::now() >= deadline {
                    panic!("http {method} {path} failed after retries: {e}");
                }
                thread::sleep(Duration::from_millis(50));
            }
        }
    }
}

fn try_http(addr: &SocketAddr, req: &str) -> Result<(u16, String), String> {
    let mut s =
        TcpStream::connect_timeout(addr, Duration::from_secs(5)).map_err(|e| e.to_string())?;
    s.set_read_timeout(Some(Duration::from_secs(15))).map_err(|e| e.to_string())?;
    s.write_all(req.as_bytes()).map_err(|e| e.to_string())?;
    let mut buf = String::new();
    s.read_to_string(&mut buf).map_err(|e| e.to_string())?;
    if buf.is_empty() {
        return Err("empty response".into());
    }
    let (head, body) = buf.split_once("\r\n\r\n").unwrap_or((&buf, ""));
    let status = head.split_whitespace().nth(1).unwrap_or("0").parse().unwrap_or(0);
    Ok((status, body.to_string()))
}

#[test]
fn health_check() {
    let (srv, _tmp) = start_server();
    let (status, body) = http(&srv.addr, "GET", "/v1/health", "");
    assert_eq!(status, 200);
    assert!(body.contains("\"ok\":true"));
}

#[test]
fn parse_then_check_pipeline() {
    let (srv, _tmp) = start_server();
    let src = "fn add(x :: Int, y :: Int) -> Int { x + y }\n";
    let body = json!({"source": src}).to_string();
    let (s1, b1) = http(&srv.addr, "POST", "/v1/parse", &body);
    assert_eq!(s1, 200);
    assert!(b1.contains("FnDecl"));
    let (s2, b2) = http(&srv.addr, "POST", "/v1/check", &body);
    assert_eq!(s2, 200);
    assert!(b2.contains("\"ok\":true"));
}

#[test]
fn parse_returns_4xx_on_syntax_error() {
    let (srv, _tmp) = start_server();
    let body = json!({"source": "fn"}).to_string();
    let (s, _) = http(&srv.addr, "POST", "/v1/parse", &body);
    assert!((400..500).contains(&s), "expected 4xx, got {s}");
}

#[test]
fn check_returns_422_on_type_error() {
    let (srv, _tmp) = start_server();
    let src = "fn bad(x :: Int) -> Str { x }\n";
    let body = json!({"source": src}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/check", &body);
    assert_eq!(s, 422);
    assert!(b.contains("type_mismatch"), "expected type_mismatch, body: {b}");
}

#[test]
fn agent_loop_publish_run_trace_diff() {
    // §12.4: a scripted agent loop completes successfully.
    let (srv, _tmp) = start_server();
    let src = "fn factorial(n :: Int) -> Int { match n { 0 => 1, _ => n * factorial(n - 1) } }\n";

    // 1) publish (and activate so resolve_sig works)
    let pub_body = json!({"source": src, "activate": true}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &pub_body);
    assert_eq!(s, 200, "publish status: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    // Response is {"ops": [...], "head_op": "..."}; first op is AddFunction.
    let ops = v["ops"].as_array().unwrap();
    assert!(!ops.is_empty(), "expected at least one op, got: {b}");
    let first_op = &ops[0];
    let stage_id = first_op["kind"]["stage_id"].as_str().unwrap();
    let _sig_id = first_op["kind"]["sig_id"].as_str().unwrap();
    assert!(v["head_op"].is_string(), "head_op should be set");

    // 2) get the published stage back
    let (s, b) = http(&srv.addr, "GET", &format!("/v1/stage/{stage_id}"), "");
    assert_eq!(s, 200, "stage GET: {b}");
    assert!(b.contains("FnDecl"));

    // 2b) #132: TypeCheck attestation written by the store-write
    // gate is queryable via /v1/stage/<id>/attestations.
    let (s, b) = http(&srv.addr, "GET", &format!("/v1/stage/{stage_id}/attestations"), "");
    assert_eq!(s, 200, "attestations GET: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let atts = v["attestations"].as_array().expect("attestations array");
    assert!(!atts.is_empty(), "publish should have produced a TypeCheck attestation");
    assert_eq!(atts[0]["kind"]["kind"], "type_check");
    assert_eq!(atts[0]["result"]["result"], "passed");
    assert_eq!(atts[0]["produced_by"]["tool"], "lex-store");

    // 2c) Unknown stage_id → 404 (matches /v1/stage/<id>'s shape).
    let (s, _) = http(&srv.addr, "GET", "/v1/stage/nonexistent/attestations", "");
    assert_eq!(s, 404, "unknown stage_id should 404");

    // 3) run the function
    let run_body = json!({"source": src, "fn": "factorial", "args": [5]}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/run", &run_body);
    assert_eq!(s, 200);
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert_eq!(v["output"], json!(120));
    let run_id_a = v["run_id"].as_str().unwrap().to_string();

    // 4) read the trace
    let (s, b) = http(&srv.addr, "GET", &format!("/v1/trace/{run_id_a}"), "");
    assert_eq!(s, 200);
    assert!(b.contains("factorial"));

    // 5) run again with a different argument and diff the two traces
    let run_body2 = json!({"source": src, "fn": "factorial", "args": [4]}).to_string();
    let (_, b2) = http(&srv.addr, "POST", "/v1/run", &run_body2);
    let v2: serde_json::Value = serde_json::from_str(&b2).unwrap();
    let run_id_b = v2["run_id"].as_str().unwrap().to_string();

    let (s, body) = http(&srv.addr, "GET", &format!("/v1/diff?a={run_id_a}&b={run_id_b}"), "");
    assert_eq!(s, 200);
    // Different inputs ⇒ a divergence.
    assert!(body.contains("node_id"), "expected divergence body: {body}");
}

#[test]
fn handles_100_sequential_requests() {
    // §12.4: server handles 100 sequential requests without crashing.
    let (srv, _tmp) = start_server();
    let body = json!({"source": "fn id(x :: Int) -> Int { x }\n"}).to_string();
    for _ in 0..100 {
        let (s, _) = http(&srv.addr, "POST", "/v1/check", &body);
        assert_eq!(s, 200);
    }
}

#[test]
fn run_rejects_undeclared_effect() {
    // §12.5: a program declaring [io] without policy is rejected at policy time.
    let (srv, _tmp) = start_server();
    let src = "import \"std.io\" as io\nfn say(line :: Str) -> [io] Nil { io.print(line) }\n";
    let body = json!({"source": src, "fn": "say", "args": ["x"]}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/run", &body);
    assert_eq!(s, 403, "expected 403, got {s}: {b}");
    assert!(b.contains("policy violation"));
    assert!(b.contains("io"));
}

#[test]
fn run_with_policy_succeeds() {
    let (srv, _tmp) = start_server();
    let src = "import \"std.io\" as io\nfn say(line :: Str) -> [io] Nil { io.print(line) }\n";
    let body = json!({
        "source": src, "fn": "say", "args": ["hello"],
        "policy": {"allow_effects": ["io"]},
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/run", &body);
    assert_eq!(s, 200, "expected 200, got {s}: {b}");
}

#[test]
fn merge_start_unknown_branch_returns_404() {
    let (srv, _tmp) = start_server();
    let body = json!({"src_branch": "nonexistent_a", "dst_branch": "nonexistent_b"}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/merge/start", &body);
    assert_eq!(s, 404, "unknown branch should 404, got {s}: {b}");
}

#[test]
fn merge_start_returns_session_id_and_no_conflicts_for_disjoint_branches() {
    // Two branches that touch *different* sigs auto-resolve into a
    // clean merge — no conflicts. The endpoint should still mint a
    // session, return the conflict list (empty), and report the
    // count of auto-resolved sigs so the agent can audit what the
    // engine took unilaterally.
    let (srv, tmp) = start_server();

    // 1) Publish fn foo on main.
    let src_main = "fn foo(n :: Int) -> Int { n + 1 }\n";
    let pub_main = json!({"source": src_main, "activate": true}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &pub_main);
    assert_eq!(s, 200, "publish main: {b}");

    // 2) Create + switch to feature, publish fn bar.
    {
        let store = lex_store::Store::open(tmp.path()).unwrap();
        store.create_branch("feature", lex_store::DEFAULT_BRANCH)
            .expect("create feature");
        store.set_current_branch("feature").expect("switch to feature");
    }
    let src_feature = "fn foo(n :: Int) -> Int { n + 1 }\nfn bar(n :: Int) -> Int { n - 1 }\n";
    let pub_feat = json!({"source": src_feature, "activate": true}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &pub_feat);
    assert_eq!(s, 200, "publish feature: {b}");

    // 3) Switch back to main so it remains the dst.
    {
        let store = lex_store::Store::open(tmp.path()).unwrap();
        store.set_current_branch(lex_store::DEFAULT_BRANCH).expect("switch back");
    }

    // 4) Start the merge.
    let body = json!({"src_branch": "feature", "dst_branch": lex_store::DEFAULT_BRANCH}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/merge/start", &body);
    assert_eq!(s, 200, "merge/start: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert!(v["merge_id"].as_str().is_some(), "merge_id should be set");
    let conflicts = v["conflicts"].as_array().unwrap();
    assert_eq!(conflicts.len(), 0, "disjoint adds shouldn't conflict, got {conflicts:?}");
    assert!(v["auto_resolved_count"].as_u64().unwrap() >= 1, "at least one sig auto-resolved");
}

/// Set up two branches that *both* modify the same fn (`foo`).
/// Returns the running server, the temp store dir, and the session
/// `merge_id` produced by `/v1/merge/start`. Used by the resolve
/// tests to avoid duplicating the divergence setup.
fn with_modify_modify_session() -> (Server, TempDir, String) {
    let (srv, tmp) = start_server();

    // 1) Publish initial fn on main.
    let v0 = "fn foo(n :: Int) -> Int { n }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": v0, "activate": true}).to_string());
    assert_eq!(s, 200, "publish v0: {b}");

    // 2) Create + switch to feature, modify foo.
    {
        let store = lex_store::Store::open(tmp.path()).unwrap();
        store.create_branch("feature", lex_store::DEFAULT_BRANCH).unwrap();
        store.set_current_branch("feature").unwrap();
    }
    let v_feat = "fn foo(n :: Int) -> Int { n + 1 }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": v_feat, "activate": true}).to_string());
    assert_eq!(s, 200, "publish feature: {b}");

    // 3) Switch back to main, modify foo differently.
    {
        let store = lex_store::Store::open(tmp.path()).unwrap();
        store.set_current_branch(lex_store::DEFAULT_BRANCH).unwrap();
    }
    let v_main = "fn foo(n :: Int) -> Int { n + 2 }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": v_main, "activate": true}).to_string());
    assert_eq!(s, 200, "publish main: {b}");

    // 4) Start the merge — should produce a ModifyModify conflict on `foo`.
    let body = json!({"src_branch": "feature", "dst_branch": lex_store::DEFAULT_BRANCH}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/merge/start", &body);
    assert_eq!(s, 200, "merge/start: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let merge_id = v["merge_id"].as_str().unwrap().to_string();
    let conflicts = v["conflicts"].as_array().unwrap();
    assert_eq!(conflicts.len(), 1, "expected exactly one conflict, got: {conflicts:?}");
    (srv, tmp, merge_id)
}

#[test]
fn merge_resolve_take_ours_clears_the_conflict() {
    let (srv, _tmp, merge_id) = with_modify_modify_session();
    let path = format!("/v1/merge/{merge_id}/resolve");
    // Find the conflict id (same as sig_id of `foo`).
    let (_, start_body) = http(&srv.addr, "POST", "/v1/merge/start", &json!({
        "src_branch": "feature", "dst_branch": lex_store::DEFAULT_BRANCH,
    }).to_string());
    // Re-run start to pull a fresh conflict list keyed to a *new* merge_id —
    // but the resolution we're testing is against `merge_id` from the
    // helper, so the conflict_id is the same (sig).
    let v: serde_json::Value = serde_json::from_str(&start_body).unwrap();
    let conflict_id = v["conflicts"][0]["conflict_id"].as_str().unwrap().to_string();

    let body = json!({
        "resolutions": [
            {"conflict_id": conflict_id, "resolution": {"kind": "take_ours"}}
        ]
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", &path, &body);
    assert_eq!(s, 200, "resolve: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let verdicts = v["verdicts"].as_array().unwrap();
    assert_eq!(verdicts.len(), 1);
    assert_eq!(verdicts[0]["accepted"], true);
    let remaining = v["remaining_conflicts"].as_array().unwrap();
    assert_eq!(remaining.len(), 0, "the take_ours resolution should clear the conflict");
}

#[test]
fn merge_resolve_unknown_conflict_is_rejected_per_entry() {
    let (srv, _tmp, merge_id) = with_modify_modify_session();
    let path = format!("/v1/merge/{merge_id}/resolve");
    let body = json!({
        "resolutions": [
            {"conflict_id": "definitely-not-a-real-sig", "resolution": {"kind": "take_ours"}}
        ]
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", &path, &body);
    assert_eq!(s, 200, "resolve should still 200 with per-entry verdicts");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let verdicts = v["verdicts"].as_array().unwrap();
    assert_eq!(verdicts[0]["accepted"], false);
    assert_eq!(verdicts[0]["rejection"]["kind"], "unknown_conflict");
}

#[test]
fn merge_resolve_rejects_a_pick_that_does_not_typecheck() {
    // #834: `/v1/merge/<id>/resolve` type-checks the projected program
    // per resolution, so a pick that leaves the merged head broken is
    // rejected at submission, not only at commit.
    //
    // Setup — every published program is individually valid:
    //   base (main): { helper, foo } where foo calls helper.
    //   feature:     { foo=n }         → removes helper, foo no longer
    //                                    calls it (both valid).
    //   main:        { helper, foo=helper(helper(n)) } → foo now leans
    //                                    on helper harder.
    // Merge feature→main: helper is a one-sided remove (auto-resolved);
    // foo is a ModifyModify conflict. Picking *ours* (main's foo, which
    // calls helper) composes with a head from which the merge removed
    // helper → an unknown identifier → must be rejected. Picking
    // *theirs* (foo=n) composes → accepted.
    let (srv, tmp) = start_server();

    let base = "fn helper(x :: Int) -> Int { x }\nfn foo(n :: Int) -> Int { helper(n) }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": base, "activate": true}).to_string());
    assert_eq!(s, 200, "publish base: {b}");

    {
        let store = lex_store::Store::open(tmp.path()).unwrap();
        store.create_branch("feature", lex_store::DEFAULT_BRANCH).unwrap();
        store.set_current_branch("feature").unwrap();
    }
    // feature: drop helper, foo becomes identity (whole-program publish
    // diffs helper out).
    let feat = "fn foo(n :: Int) -> Int { n }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": feat, "activate": true}).to_string());
    assert_eq!(s, 200, "publish feature: {b}");

    {
        let store = lex_store::Store::open(tmp.path()).unwrap();
        store.set_current_branch(lex_store::DEFAULT_BRANCH).unwrap();
    }
    let main2 = "fn helper(x :: Int) -> Int { x }\nfn foo(n :: Int) -> Int { helper(helper(n)) }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": main2, "activate": true}).to_string());
    assert_eq!(s, 200, "publish main2: {b}");

    let (s, b) = http(&srv.addr, "POST", "/v1/merge/start",
        &json!({"src_branch": "feature", "dst_branch": lex_store::DEFAULT_BRANCH}).to_string());
    assert_eq!(s, 200, "merge/start: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let merge_id = v["merge_id"].as_str().unwrap().to_string();
    let conflicts = v["conflicts"].as_array().unwrap();
    assert_eq!(conflicts.len(), 1, "exactly the foo conflict expected: {conflicts:?}");
    let foo_conflict = conflicts[0]["conflict_id"].as_str().unwrap().to_string();

    let path = format!("/v1/merge/{merge_id}/resolve");

    // TakeOurs → main's foo calls helper, which the merge removes →
    // type error → rejected.
    let (s, b) = http(&srv.addr, "POST", &path, &json!({
        "resolutions": [{"conflict_id": foo_conflict, "resolution": {"kind": "take_ours"}}]
    }).to_string());
    assert_eq!(s, 200, "resolve: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert_eq!(v["verdicts"][0]["accepted"], false, "take_ours must be rejected: {b}");
    assert_eq!(v["verdicts"][0]["rejection"]["kind"], "type_error", "expected type_error: {b}");
    assert_eq!(v["remaining_conflicts"].as_array().unwrap().len(), 1, "conflict still pending after a rejected pick");

    // TakeTheirs → foo=n, doesn't reference helper → composes → accepted.
    let (s, b) = http(&srv.addr, "POST", &path, &json!({
        "resolutions": [{"conflict_id": foo_conflict, "resolution": {"kind": "take_theirs"}}]
    }).to_string());
    assert_eq!(s, 200, "resolve theirs: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert_eq!(v["verdicts"][0]["accepted"], true, "take_theirs composes; must be accepted: {b}");
    assert_eq!(v["remaining_conflicts"].as_array().unwrap().len(), 0, "theirs clears the conflict");
}

#[test]
fn web_activity_stream_lists_recent_attestations() {
    // The new home page (lex-tea v2) is an activity stream sourced
    // from the attestation log. After a publish, there's at least
    // one TypeCheck::Passed event the page should render.
    let (srv, _tmp) = start_server();
    let src = "fn foo(n :: Int) -> Int { n }\n";
    let (s, _) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200);

    let (s, b) = http(&srv.addr, "GET", "/", "");
    assert_eq!(s, 200, "GET /: {b}");
    assert!(b.contains("<title>") && b.contains("lex-tea"), "html title: {b}");
    assert!(b.contains("activity"), "activity heading expected: {b}");
    assert!(b.contains("TypeCheck"), "auto-emitted TypeCheck row expected: {b}");
    assert!(b.contains("/web/stage/"), "should link to stage detail: {b}");
}

#[test]
fn web_branches_page_lists_branches() {
    // The v1 home moved to /web/branches in v2; verify it still
    // renders the branch list.
    let (srv, _tmp) = start_server();
    let src = "fn foo(n :: Int) -> Int { n }\n";
    let (s, _) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200);

    let (s, b) = http(&srv.addr, "GET", "/web/branches", "");
    assert_eq!(s, 200, "GET /web/branches: {b}");
    assert!(b.contains("main"), "branch list should mention main: {b}");
}

#[test]
fn web_trust_page_groups_by_producer() {
    // After a publish, the trust page should show a row for the
    // store-side producer (`lex-store`) since the type-check gate
    // auto-emitted a TypeCheck attestation under that name.
    let (srv, _tmp) = start_server();
    let src = "fn foo(n :: Int) -> Int { n }\n";
    let (s, _) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200);

    let (s, b) = http(&srv.addr, "GET", "/web/trust", "");
    assert_eq!(s, 200, "GET /web/trust: {b}");
    assert!(b.contains("trust"), "trust heading: {b}");
    assert!(b.contains("lex-store"), "lex-store producer row: {b}");
}

#[test]
fn web_attention_empty_when_only_passed_attestations_exist() {
    // The exceptions table should be empty when every attestation
    // is Passed — the "clear runway" message renders. Exercises
    // the attention page's empty-state path so a regression that
    // accidentally shows passed attestations as exceptions is
    // caught.
    let (srv, _tmp) = start_server();
    let src = "fn foo(n :: Int) -> Int { n }\n";
    let (s, _) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200);

    let (s, b) = http(&srv.addr, "GET", "/web/attention", "");
    assert_eq!(s, 200, "GET /web/attention: {b}");
    assert!(b.contains("attention"), "attention heading: {b}");
    assert!(b.contains("clear runway") || b.contains("no failed"),
        "empty-state copy expected: {b}");
}

#[test]
fn web_branch_page_lists_fn_with_stage_link() {
    let (srv, _tmp) = start_server();
    let src = "fn foo(n :: Int) -> Int { n }\n";
    let (s, _) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200);

    let (s, b) = http(&srv.addr, "GET", "/web/branch/main", "");
    assert_eq!(s, 200, "GET /web/branch/main: {b}");
    assert!(b.contains("foo"), "fn name should appear: {b}");
    assert!(b.contains("/web/stage/"), "should link to stage page: {b}");
}

#[test]
fn web_stage_page_shows_attestations() {
    let (srv, _tmp) = start_server();
    let src = "fn foo(n :: Int) -> Int { n }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200);
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let stage_id = v["ops"][0]["kind"]["stage_id"].as_str().unwrap();

    let (s, b) = http(&srv.addr, "GET", &format!("/web/stage/{stage_id}"), "");
    assert_eq!(s, 200, "GET /web/stage/<id>: {b}");
    // The TypeCheck attestation auto-emitted by publish_program
    // should show up on the page.
    assert!(b.contains("TypeCheck"), "TypeCheck attestation row expected: {b}");
    assert!(b.contains("passed"), "passed result expected: {b}");
    assert!(b.contains("foo"), "fn name in heading expected: {b}");
}

#[test]
fn web_unknown_stage_returns_404_html() {
    let (srv, _tmp) = start_server();
    let (s, _) = http(&srv.addr, "GET", "/web/stage/no_such_stage", "");
    assert_eq!(s, 404);
}

#[test]
fn merge_resolve_unknown_session_returns_404() {
    let (srv, _tmp) = start_server();
    let body = json!({"resolutions": []}).to_string();
    let (s, _) = http(&srv.addr, "POST", "/v1/merge/no_such_session/resolve", &body);
    assert_eq!(s, 404, "unknown merge_id should 404");
}

#[test]
fn merge_commit_advances_dst_branch_after_take_theirs() {
    // Full e2e: start → resolve(take_theirs) → commit. dst branch
    // head must move to a new Merge op whose StageTransition picks
    // up src's stage for the resolved sig.
    let (srv, _tmp, merge_id) = with_modify_modify_session();
    let path_resolve = format!("/v1/merge/{merge_id}/resolve");
    let path_commit  = format!("/v1/merge/{merge_id}/commit");

    // Pull the conflict id.
    let (_, b) = http(&srv.addr, "POST", "/v1/merge/start", &json!({
        "src_branch": "feature", "dst_branch": lex_store::DEFAULT_BRANCH,
    }).to_string());
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let conflict_id = v["conflicts"][0]["conflict_id"].as_str().unwrap().to_string();

    // Resolve as take_theirs.
    let body = json!({
        "resolutions": [
            {"conflict_id": conflict_id, "resolution": {"kind": "take_theirs"}}
        ]
    }).to_string();
    let (s, _) = http(&srv.addr, "POST", &path_resolve, &body);
    assert_eq!(s, 200);

    // Commit.
    let (s, b) = http(&srv.addr, "POST", &path_commit, "");
    assert_eq!(s, 200, "commit: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let new_head = v["new_head_op"].as_str().expect("new_head_op set");
    assert!(!new_head.is_empty());
    assert_eq!(v["dst_branch"], lex_store::DEFAULT_BRANCH);
}

#[test]
fn merge_commit_with_unresolved_conflicts_returns_422() {
    // No resolutions submitted → conflicts remaining → 422.
    let (srv, _tmp, merge_id) = with_modify_modify_session();
    let path_commit = format!("/v1/merge/{merge_id}/commit");
    let (s, b) = http(&srv.addr, "POST", &path_commit, "");
    assert_eq!(s, 422, "expected 422 conflicts remaining: {b}");
    assert!(b.contains("conflicts remaining"));
}

#[test]
fn merge_commit_unknown_session_returns_404() {
    let (srv, _tmp) = start_server();
    let (s, _) = http(&srv.addr, "POST", "/v1/merge/no_such/commit", "");
    assert_eq!(s, 404);
}

#[test]
fn merge_commit_with_custom_resolution_lands_agent_supplied_stage() {
    // Same ModifyModify setup as the take_theirs test, but the
    // agent submits a `Custom { op }` whose ModifyBody.to_stage_id
    // names a brand-new stage. commit folds the op's target into
    // the merge entries.
    let (srv, _tmp, merge_id) = with_modify_modify_session();
    let path_resolve = format!("/v1/merge/{merge_id}/resolve");
    let path_commit  = format!("/v1/merge/{merge_id}/commit");

    // Pull conflict + ours/theirs stage ids from the fresh session
    // start (same merge_id; conflict_id == sig).
    let (_, b) = http(&srv.addr, "POST", "/v1/merge/start", &json!({
        "src_branch": "feature", "dst_branch": lex_store::DEFAULT_BRANCH,
    }).to_string());
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let conflict = &v["conflicts"][0];
    let conflict_id = conflict["conflict_id"].as_str().unwrap().to_string();
    let ours_stage = conflict["ours"].as_str().unwrap().to_string();
    let theirs_stage = conflict["theirs"].as_str().unwrap().to_string();
    // commit is gated (#833): the custom op must name a real stage.
    let custom_stage = {
        let s = lex_store::Store::open(_tmp.path()).unwrap();
        let st = lex_ast::canonicalize_program(
            &lex_syntax::parse_source("fn foo(n :: Int) -> Int { n + 3 }\n").unwrap())
            .into_iter().next().unwrap();
        s.publish(&st).unwrap()
    };

    let resolve_body = json!({
        "resolutions": [
            {
                "conflict_id": conflict_id,
                "resolution": {
                    "kind": "custom",
                    "op": {
                        // Operation's `kind` is #[serde(flatten)],
                        // so OperationKind's tag + fields appear at
                        // the top level alongside `parents`.
                        "op": "modify_body",
                        "sig_id": conflict_id,
                        "from_stage_id": ours_stage,
                        "to_stage_id":   custom_stage,
                        "parents": [
                            // Conflict resolution must list both
                            // sides; MergeSession enforces parents.len() ≥ 2.
                            ours_stage.clone(),
                            theirs_stage,
                        ],
                    }
                }
            }
        ]
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", &path_resolve, &resolve_body);
    assert_eq!(s, 200, "resolve: {b}");
    let rv: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert_eq!(rv["verdicts"][0]["accepted"], true);

    let (s, b) = http(&srv.addr, "POST", &path_commit, "");
    assert_eq!(s, 200, "commit: {b}");
    // After commit, dst's branch_head for `foo` should be the
    // agent-supplied custom stage. We can verify via the public
    // /v1/stage/<id> endpoint isn't present (it's not a real
    // stage), but the merge op recorded the head delta — read the
    // op log via /v1/diff is overkill; instead just check the
    // response's new_head_op is set.
    let cv: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert!(cv["new_head_op"].as_str().is_some());
}

#[test]
fn merge_resolve_rejects_custom_op_referencing_absent_stages() {
    // A custom op targeting a made-up sig with stages that don't exist
    // used to be accepted at resolve (structural check only) and caught
    // at commit ("targets a different sig"). Since #834, resolve
    // type-checks the projection: the projected delta sets a sig to a
    // stage that can't be loaded, so the resolution is rejected on
    // submission — fail-fast, the whole point of the batch loop. The
    // commit-time wrong-sig guard remains in place as defense-in-depth
    // for a wrong-sig op that happens to reference a composing stage.
    let (srv, _tmp, merge_id) = with_modify_modify_session();
    let path_resolve = format!("/v1/merge/{merge_id}/resolve");
    let path_commit  = format!("/v1/merge/{merge_id}/commit");

    let (_, b) = http(&srv.addr, "POST", "/v1/merge/start", &json!({
        "src_branch": "feature", "dst_branch": lex_store::DEFAULT_BRANCH,
    }).to_string());
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let conflict_id = v["conflicts"][0]["conflict_id"].as_str().unwrap().to_string();

    let resolve_body = json!({
        "resolutions": [{
            "conflict_id": conflict_id,
            "resolution": {
                "kind": "custom",
                "op": {
                    "op": "modify_body",
                    "sig_id": "fn::not_the_conflict_sig",
                    "from_stage_id": "x",
                    "to_stage_id":   "y",
                    "parents": ["a", "b"],
                }
            }
        }]
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", &path_resolve, &resolve_body);
    assert_eq!(s, 200, "resolve returns per-entry verdicts: {b}");
    let rv: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert_eq!(rv["verdicts"][0]["accepted"], false, "absent-stage custom op must be rejected at resolve: {b}");
    assert_eq!(rv["verdicts"][0]["rejection"]["kind"], "type_error", "expected type_error: {b}");

    // Nothing was recorded, so the conflict is still pending and commit
    // reports conflicts-remaining (422), never advancing the head.
    let (s, b) = http(&srv.addr, "POST", &path_commit, "");
    assert_eq!(s, 422, "commit must not advance with the conflict still unresolved: {b}");
}

#[test]
fn replay_with_overrides() {
    let (srv, _tmp) = start_server();
    let src = "import \"std.io\" as io\nfn read_one(p :: Str) -> [io] Result[Str, Str] { io.read(p) }\n";

    // First run: io.read fails because path doesn't exist; result is Err(...) value-level.
    let run = json!({
        "source": src, "fn": "read_one", "args": ["/no/such"],
        "policy": {"allow_effects": ["io"]},
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/run", &run);
    assert_eq!(s, 200);
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let run_id = v["run_id"].as_str().unwrap().to_string();

    // Pull the trace, find the io.read NodeId.
    let (_, body) = http(&srv.addr, "GET", &format!("/v1/trace/{run_id}"), "");
    let trace: serde_json::Value = serde_json::from_str(&body).unwrap();
    let mut effect_node_id: Option<String> = None;
    fn find(n: &serde_json::Value, out: &mut Option<String>) {
        if let Some(arr) = n.as_array() {
            for c in arr { find(c, out); }
            return;
        }
        if let Some(kind) = n.get("kind").and_then(|k| k.as_str()) {
            if kind == "effect" {
                if let Some(nid) = n.get("node_id").and_then(|x| x.as_str()) {
                    *out = Some(nid.to_string());
                }
            }
        }
        if let Some(children) = n.get("children") { find(children, out); }
        if let Some(nodes) = n.get("nodes") { find(nodes, out); }
    }
    find(&trace, &mut effect_node_id);
    let nid = effect_node_id.expect("trace has an effect node");

    // Replay with override.
    let injected = json!({"$variant": "Ok", "args": ["INJECTED"]});
    let replay = json!({
        "source": src, "fn": "read_one", "args": ["/no/such"],
        "policy": {"allow_effects": ["io"]},
        "overrides": { nid: injected },
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/replay", &replay);
    assert_eq!(s, 200, "replay status: {s}, body: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert_eq!(v["output"], json!({"$variant": "Ok", "args": ["INJECTED"]}));
}

#[test]
fn patch_replaces_a_subexpression_and_publishes_new_stage() {
    // Publish a stage, patch a sub-expression, run the patched stage.
    let (srv, _tmp) = start_server();
    let src = "fn add_one(x :: Int) -> Int { x + 1 }\n";

    // 1. Publish the original.
    let pub_body = json!({"source": src, "activate": true}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/publish", &pub_body);
    assert_eq!(s, 200, "publish: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let stage_id = v["ops"][0]["kind"]["stage_id"].as_str().unwrap().to_string();

    // 2. Patch the literal `1` with `100`. Body sits at n_0.2 (1 param);
    //    BinOp.rhs is at n_0.2.1.
    let patch_body = json!({
        "stage_id": stage_id,
        "patch": {
            "op": "replace",
            "target": "n_0.2.1",
            "with": { "node": "Literal", "value": { "kind": "Int", "value": 100 } }
        },
        "activate": true,
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/patch", &patch_body);
    assert_eq!(s, 200, "patch: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let new_id = v["new_stage_id"].as_str().unwrap().to_string();
    assert_ne!(new_id, stage_id, "new StageId must differ from original");
    assert_eq!(v["status"], "active");

    // 3. Run the patched function: add_one(5) should now be 105.
    let run_body = json!({"source": "fn add_one(x :: Int) -> Int { x + 100 }\n",
                         "fn": "add_one", "args": [5]}).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/run", &run_body);
    assert_eq!(s, 200);
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    assert_eq!(v["output"], json!(105));
}

#[test]
fn patch_with_type_error_after_apply_returns_422() {
    // Replacing an Int with a Str should fail typecheck and surface 422
    // with the structured TypeError list.
    let (srv, _tmp) = start_server();
    let src = "fn add_one(x :: Int) -> Int { x + 1 }\n";

    let (s, b) = http(&srv.addr, "POST", "/v1/publish",
        &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200);
    let stage_id = serde_json::from_str::<serde_json::Value>(&b).unwrap()
        ["ops"][0]["kind"]["stage_id"].as_str().unwrap().to_string();

    // Replace `1` (Int) with `"oops"` (Str).
    let patch_body = json!({
        "stage_id": stage_id,
        "patch": {
            "op": "replace",
            "target": "n_0.2.1",
            "with": { "node": "Literal", "value": { "kind": "Str", "value": "oops" } }
        },
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/patch", &patch_body);
    assert_eq!(s, 422, "expected 422 on type-incompatible patch, got {s}: {b}");
    assert!(b.contains("type_mismatch"), "body should carry structured TypeError: {b}");
}

#[test]
fn patch_with_unknown_node_returns_422() {
    let (srv, _tmp) = start_server();
    let (s, b) = http(&srv.addr, "POST", "/v1/publish",
        &json!({"source": "fn one() -> Int { 1 }\n", "activate": true}).to_string());
    assert_eq!(s, 200);
    let stage_id = serde_json::from_str::<serde_json::Value>(&b).unwrap()
        ["ops"][0]["kind"]["stage_id"].as_str().unwrap().to_string();

    let patch_body = json!({
        "stage_id": stage_id,
        "patch": {
            "op": "replace",
            "target": "n_0.99.99",
            "with": { "node": "Literal", "value": { "kind": "Int", "value": 0 } }
        },
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/patch", &patch_body);
    assert_eq!(s, 422);
    assert!(b.contains("unknown_node"), "expected unknown_node in body: {b}");
}


// ── #833: the write-time gate on the merge and patch paths ──────────────────

fn branch_head_op(srv: &Server, branch: &str) -> serde_json::Value {
    let (s, b) = http(&srv.addr, "GET", &format!("/v1/branches/{branch}/head"), "");
    assert_eq!(s, 200, "branch head: {b}");
    serde_json::from_str::<serde_json::Value>(&b).unwrap()["head_op"].clone()
}

fn set_current_branch(tmp: &TempDir, name: &str, create_from: Option<&str>) {
    let store = lex_store::Store::open(tmp.path()).unwrap();
    if let Some(from) = create_from {
        store.create_branch(name, from).unwrap();
    }
    store.set_current_branch(name).unwrap();
}

fn stage_id_of(src: &str, name: &str) -> String {
    let st = lex_ast::canonicalize_program(&lex_syntax::parse_source(src).unwrap())
        .into_iter()
        .find(|s| matches!(s, lex_ast::Stage::FnDecl(fd) if fd.name == name))
        .expect("fn not found");
    lex_ast::stage_id(&st).unwrap()
}

// Note on "refuses a broken merge": with every write gated, each branch is
// always individually valid, and the auto-merge engine keeps a
// still-referenced sig rather than dropping it — so a broken *auto*-merge
// isn't reachable through the public HTTP publish surface. The reachable
// broken-merge is an agent-supplied Custom resolution that drops a
// still-referenced sig; that path and the head rollback are tested directly
// against the store in
// lex-store/tests/merge_gate.rs::merge_op_that_drops_a_still_referenced_fn_is_refused_and_head_rolls_back.
// Here we cover the HTTP happy path plus the /v1/patch composed-gate behavior.

#[test]
fn merge_commit_lands_a_merge_whose_result_typechecks() {
    // Unambiguous conflict-free merge: main has helper, feature adds
    // an independent `extra`. { helper, extra } composes → lands.
    let (srv, tmp) = start_server();
    let (s, _) = http(&srv.addr, "POST", "/v1/publish",
        &json!({"source": "fn helper(x :: Int) -> Int { x }\n", "activate": true}).to_string());
    assert_eq!(s, 200);
    set_current_branch(&tmp, "feature", Some(lex_store::DEFAULT_BRANCH));
    let (s, _) = http(&srv.addr, "POST", "/v1/publish", &json!({
        "source": "fn helper(x :: Int) -> Int { x }\nfn extra(x :: Int) -> Int { x + 1 }\n",
        "activate": true,
    }).to_string());
    assert_eq!(s, 200);
    set_current_branch(&tmp, lex_store::DEFAULT_BRANCH, None);
    let before = branch_head_op(&srv, lex_store::DEFAULT_BRANCH);

    let (_, b) = http(&srv.addr, "POST", "/v1/merge/start",
        &json!({"src_branch": "feature", "dst_branch": lex_store::DEFAULT_BRANCH}).to_string());
    let merge_id = serde_json::from_str::<serde_json::Value>(&b).unwrap()["merge_id"]
        .as_str().unwrap().to_string();
    let (s, b) = http(&srv.addr, "POST", &format!("/v1/merge/{merge_id}/commit"), "");
    assert_eq!(s, 200, "commit: {b}");
    assert_ne!(branch_head_op(&srv, lex_store::DEFAULT_BRANCH), before);
}

#[test]
fn patch_may_reference_a_sibling_function() {
    // Before #833 the patched stage was checked in isolation, so a
    // body calling any other function was rejected as an unknown
    // identifier. The composed check sees the whole branch.
    let (srv, _tmp) = start_server();
    let src = "fn g(x :: Int) -> Int { x }\nfn f(x :: Int) -> Int { x + 1 }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish",
        &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200, "publish: {b}");
    let f_stage = stage_id_of(src, "f");
    // Replace f's body (1 param → n_0.2) with g(x).
    let patch_body = json!({
        "stage_id": f_stage,
        "patch": {"op": "replace", "target": "n_0.2",
            "with": {"node": "Call", "callee": {"node": "Var", "name": "g"},
                     "args": [{"node": "Var", "name": "x"}]}},
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/patch", &patch_body);
    assert_eq!(s, 200, "a patch calling a sibling must be accepted: {b}");
}

#[test]
fn patch_that_does_not_compose_is_refused_and_head_is_unchanged() {
    let (srv, _tmp) = start_server();
    let src = "fn g(x :: Int) -> Int { x }\nfn f(x :: Int) -> Int { x + 1 }\n";
    let (s, _) = http(&srv.addr, "POST", "/v1/publish",
        &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200);
    let f_stage = stage_id_of(src, "f");
    let before = branch_head_op(&srv, lex_store::DEFAULT_BRANCH);
    // g(x, x) — wrong arity against the real g, which only the composed
    // program can know.
    let patch_body = json!({
        "stage_id": f_stage,
        "patch": {"op": "replace", "target": "n_0.2",
            "with": {"node": "Call", "callee": {"node": "Var", "name": "g"},
                     "args": [{"node": "Var", "name": "x"}, {"node": "Var", "name": "x"}]}},
    }).to_string();
    let (s, b) = http(&srv.addr, "POST", "/v1/patch", &patch_body);
    assert_eq!(s, 422, "expected 422: {b}");
    assert!(b.contains("type errors after patch"), "body: {b}");
    assert_eq!(branch_head_op(&srv, lex_store::DEFAULT_BRANCH), before,
        "head must not move on a refused patch");
}

// ── #835 Tier 1: behavioral example gate on publish ─────────────────────────

#[test]
fn publish_refuses_a_function_whose_example_is_behaviorally_wrong() {
    // add(1, 2) => 4 type-checks (Int args, Int expected) but is wrong
    // when run. Before #835 it published; now it's a 422 with the
    // structured example-mismatch, and the branch head does not move.
    let (srv, _tmp) = start_server();
    let head_before = branch_head_op(&srv, lex_store::DEFAULT_BRANCH);
    let src = "fn add(x :: Int, y :: Int) -> Int\n  examples { add(1, 2) => 4 }\n{ x + y }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish",
        &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 422, "a wrong example must refuse the publish: {b}");
    assert!(b.contains("example") && b.contains("mismatch"), "structured example error: {b}");
    assert_eq!(branch_head_op(&srv, lex_store::DEFAULT_BRANCH), head_before,
        "head must not move when the publish is refused");
}

#[test]
fn publish_accepts_correct_examples_and_records_an_examples_attestation() {
    let (srv, _tmp) = start_server();
    let src = "fn add(x :: Int, y :: Int) -> Int\n  examples { add(1, 2) => 3, add(0, 0) => 0 }\n{ x + y }\n";
    let (s, b) = http(&srv.addr, "POST", "/v1/publish",
        &json!({"source": src, "activate": true}).to_string());
    assert_eq!(s, 200, "correct examples must publish: {b}");
    let stage_id = serde_json::from_str::<serde_json::Value>(&b).unwrap()
        ["ops"][0]["kind"]["stage_id"].as_str().unwrap().to_string();

    // An Examples::Passed attestation must be recorded for the stage.
    let (s, b) = http(&srv.addr, "GET", &format!("/v1/stage/{stage_id}/attestations"), "");
    assert_eq!(s, 200, "attestations GET: {b}");
    let v: serde_json::Value = serde_json::from_str(&b).unwrap();
    let atts = v["attestations"].as_array().expect("attestations array");
    let has_examples = atts.iter().any(|a| {
        a["kind"]["kind"].as_str() == Some("examples")
            && a["result"]["result"].as_str() == Some("passed")
    });
    assert!(has_examples, "expected a passed Examples attestation on the stage: {atts:?}");
}

#[test]
fn publish_of_a_function_without_examples_is_unaffected() {
    let (srv, _tmp) = start_server();
    let (s, b) = http(&srv.addr, "POST", "/v1/publish",
        &json!({"source": "fn id(x :: Int) -> Int { x }\n", "activate": true}).to_string());
    assert_eq!(s, 200, "example-less publish must be unaffected: {b}");
}