magi/

config.rs

//! Run configuration: the agent roster, the shape of the graph, and the
//! blindness / verification policy.
//!
//! Layers, lowest precedence first: `<config_dir>/magi/config.toml` (machine),
//! `.magi/config.toml`, `magi.toml`. With none, built-in defaults apply, the
//! agent roster derived from the agent CLIs actually installed on this
//! machine. `--config <path>` replaces the whole stack with that one file.
//!
//! **The repository layers are read from `<remote>/<base>`, never from the
//! working tree.** A primary checkout is often stale or on a detached HEAD, so
//! a gate read from it can be older than the one the branch under review is
//! cut from (run ce6e failed on a gate step `origin/main` had already
//! dropped). `git show <sha>:magi.toml` of the remote-tracking ref's commit is
//! written to a content-addressed directory under the git common dir
//! (`<common>/magi/config/<sha>-<hash of repo>/`, temp dir when that is not
//! writable) and loaded from there. Reviewed branches may additionally enable
//! literal owner-hold switches; these never weaken base policy or load other
//! branch settings, includes or templates.
//!
//! `remote` and `base` are themselves in the file, so they are resolved in a
//! fixed order, first hit wins:
//!
//! 1. `[merge] base` / `remote` of the machine layer, rendered as a real load
//!    would (env templates, includes);
//! 2. the same keys, read minimally (only `[merge]`, nothing deserialized into
//!    `Config`) from the checkout's `magi.toml`, then `.magi/config.toml` -
//!    only to *locate* the ref; an unreadable file is ignored;
//! 3. `remote` defaults to `origin`, `base` to what
//!    `refs/remotes/<remote>/HEAD` points at.
//!
//! [`Config::discover`] is synchronous and reads the remote-tracking ref as it
//! is (`daemon::fetch_loop` keeps it fresh); [`Config::discover_fetched`] runs
//! `git fetch` first and is what every path that starts work uses. A failed
//! fetch, a missing ref or an unresolvable base is an **error**, never a
//! silent fall back to the working tree or a local branch. Two cases are not
//! that: an explicit `--config`, and a `repo` that is not a git working tree
//! at all (no branch exists, so nothing can be stale).
//!
//! A repository layer that declares `include = [...]` gets the whole tree of
//! that commit extracted, so relative includes resolve against the same
//! commit. The directory is built beside its name and renamed in, so a
//! concurrent `discover` never reads a half-written layer.
use std::collections::BTreeMap;
use std::path::{Path, PathBuf};

use anyhow::{Context as _, Result, bail};
use serde::{Deserialize, Serialize};

/// Independently observed configuration failure boundary and its input target.
/// Rendered error wording is diagnostic only, never a notification identity.
#[derive(Debug, thiserror::Error)]
#[error("{stage}: {target}")]
pub(crate) struct ConfigFailure {
    pub(crate) stage: &'static str,
    pub(crate) target: String,
}

impl ConfigFailure {
    fn render(error: &teravars::Error, paths: &[PathBuf]) -> Self {
        let stage = match error {
            teravars::Error::Io(_) => "config-read",
            teravars::Error::Toml(_) | teravars::Error::Extract(_) => "config-parse",
            teravars::Error::Render(_) => "config-template",
            teravars::Error::IncludeCycle { .. } | teravars::Error::IncludeConflict { .. } => {
                "config-include"
            }
            _ => "config-render",
        };
        Self::layers(stage, paths)
    }

    fn layers(stage: &'static str, paths: &[PathBuf]) -> Self {
        let targets: Vec<_> = paths
            .iter()
            .map(|path| {
                // Cache directories include a commit id. The input file, rather
                // than its extraction location, identifies a loading failure.
                path.ancestors()
                    .find(|p| p.join(REPO_MARKER).is_file())
                    .and_then(|root| path.strip_prefix(root).ok())
                    .unwrap_or(path)
                    .to_string_lossy()
                    .into_owned()
            })
            .collect();
        Self {
            stage,
            target: serde_json::to_string(&targets).expect("config paths"),
        }
    }
}

/// Which CLI drives an agent.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum AgentKind {
    /// Anthropic Claude Code (`claude -p`).
    Claude,
    /// opencode (`opencode run`).
    Opencode,
    /// Antigravity CLI (`agy -p`). Gemini CLI is deliberately absent: Google
    /// retired the standalone client for individual accounts in favour of this
    /// one, so an adapter for it would be dead code on a live machine.
    Antigravity,
    /// OpenAI Codex CLI (`codex exec`). The one roster member with a real
    /// read-only mode: `--sandbox read-only` is enforced by the CLI, not by
    /// the prompt.
    Codex,
    /// oh-my-pi (`omp -p --mode=json`). Another CLI with no read-only mode of
    /// its own - `--auto-approve` gates reads and writes together - so a
    /// read-only seat rests on the prompt and on the worktree discipline the
    /// other non-codex seats already rely on. It is also the roster member that
    /// reaches DeepSeek, whose models ship in `omp`'s own catalog.
    Omp,
    /// Arbitrary command. The escape hatch, and what the test suite drives.
    Command,
}

impl AgentKind {
    /// Executable that must be on `PATH` for this kind, if any.
    pub fn program(self) -> Option<&'static str> {
        match self {
            Self::Claude => Some("claude"),
            Self::Opencode => Some("opencode"),
            Self::Antigravity => Some("agy"),
            Self::Codex => Some("codex"),
            Self::Omp => Some("omp"),
            Self::Command => None,
        }
    }

    /// Lowercase name as written in the config file.
    pub fn as_str(self) -> &'static str {
        match self {
            Self::Claude => "claude",
            Self::Opencode => "opencode",
            Self::Antigravity => "antigravity",
            Self::Codex => "codex",
            Self::Omp => "omp",
            Self::Command => "command",
        }
    }

    /// Every kind the roster can name, in display order.
    ///
    /// This is what `magi doctor` lists, and it has to be one list rather than
    /// the same set typed out again wherever a kind is enumerated. The last
    /// time it was typed out twice, `omp` was added as a roster member and the
    /// doctor output went on saying the machine had four CLIs - which reads as
    /// "that agent is not installed" to the person the command exists for.
    pub const ALL: [Self; 6] = [
        Self::Claude,
        Self::Opencode,
        Self::Antigravity,
        Self::Codex,
        Self::Omp,
        Self::Command,
    ];
}

/// How the prompt reaches the agent process.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum Delivery {
    /// Piped on stdin.
    Stdin,
    /// Passed as a positional argument. Beware OS command-line limits.
    Argv,
    /// Written to a file; the agent is told to read it. No length limit.
    File,
}

/// One addressable agent in the roster.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields)]
pub struct AgentSpec {
    /// Stable identifier used by `[roles]` and by the stats tables.
    pub id: String,
    /// Which CLI to drive.
    pub kind: AgentKind,
    /// Model passed through to the CLI (`--model` / `-m`). CLI default if unset.
    #[serde(default)]
    pub model: Option<String>,
    /// `kind = "command"` only: argv. Supports `{prompt_file}`, `{cwd}`,
    /// `{label}`, `{session}` placeholders.
    #[serde(default)]
    pub command: Vec<String>,
    /// Extra arguments appended to the built command line.
    #[serde(default)]
    pub extra_args: Vec<String>,
    /// Extra environment variables for the child process.
    #[serde(default)]
    pub env: BTreeMap<String, String>,
    /// Override the per-kind prompt delivery default.
    #[serde(default)]
    pub prompt_delivery: Option<Delivery>,
    /// Optional per-invocation cap, in seconds, for this CLI. The caller's
    /// remaining budget still wins when shorter; successors keep their budget.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub max_turn_secs: Option<u64>,
}

impl AgentSpec {
    /// Limit one CLI turn without extending the caller's remaining budget.
    pub fn turn_timeout(&self, budget: std::time::Duration) -> std::time::Duration {
        self.max_turn_secs.map_or(budget, |secs| {
            budget.min(std::time::Duration::from_secs(secs))
        })
    }

    /// Default prompt delivery for this agent.
    ///
    /// `opencode` and `agy` take the prompt as an argument, which on Windows
    /// caps out around 32 KiB — well under a judging prompt carrying three
    /// patches — so both get a file instead.
    pub fn delivery(&self) -> Delivery {
        self.prompt_delivery.unwrap_or(match self.kind {
            AgentKind::Claude | AgentKind::Command => Delivery::Stdin,
            // `codex exec -` reads the prompt from stdin, so the whole
            // instruction arrives without an argv length limit and without a
            // tool round-trip to open a file.
            AgentKind::Codex => Delivery::Stdin,
            // `omp -p` reads the prompt from stdin too, and a judging prompt
            // carrying three patches is well past the Windows argv cap, so this
            // is the only delivery that works for every node.
            AgentKind::Omp => Delivery::Stdin,
            AgentKind::Opencode | AgentKind::Antigravity => Delivery::File,
        })
    }

    /// Human-facing label, e.g. `opus (claude:opus)`.
    pub fn display(&self) -> String {
        match &self.model {
            Some(m) => format!("{} ({}:{m})", self.id, self.kind.as_str()),
            None => format!("{} ({})", self.id, self.kind.as_str()),
        }
    }
}

/// A standalone seat's agent: one roster id, or an ordered fallback chain.
///
/// The string form is what every existing config uses and serializes back as
/// a string; the array form tries each id at most once, in order, moving on
/// when a call ends in quota or fails (see [`crate::agent::pick_chain`]).
/// An empty string or array is the same as unset.
#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
#[serde(untagged)]
pub enum AgentChoice {
    /// One agent id.
    One(String),
    /// Ordered fallback chain of agent ids.
    Chain(Vec<String>),
}

impl AgentChoice {
    /// The ids named, in order, with blanks dropped. Empty means unset.
    pub fn ids(&self) -> Vec<&str> {
        let all: Vec<&str> = match self {
            Self::One(id) => vec![id.as_str()],
            Self::Chain(ids) => ids.iter().map(String::as_str).collect(),
        };
        all.into_iter()
            .map(str::trim)
            .filter(|id| !id.is_empty())
            .collect()
    }

    /// The first id named, if any.
    pub fn primary(&self) -> Option<&str> {
        self.ids().into_iter().next()
    }
}

impl From<&str> for AgentChoice {
    fn from(id: &str) -> Self {
        Self::One(id.to_owned())
    }
}

/// The first id of an optional choice: what a single-seat caller resolves.
pub fn primary(choice: Option<&AgentChoice>) -> Option<&str> {
    choice.and_then(AgentChoice::primary)
}

/// Explicit role assignment. Empty lists are filled in by
/// [`Config::resolve_roles`] by rotating the roster.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Roles {
    /// Agents that implement the task, one worktree each.
    pub implementers: Vec<String>,
    /// Agents that rank the candidates blind.
    pub judges: Vec<String>,
    /// Agents that review the winning patch.
    pub reviewers: Vec<String>,
    /// Agent that applies review findings. Defaults to the winner's author.
    ///
    /// Accepts one id or an ordered array of ids: a fallback chain, see
    /// [`AgentChoice`]. The review loop, the gate-fix round, `land`'s fix
    /// rounds and the rebase conflict round move to the next id when one
    /// errors, hits its quota or answers nothing usable; each id is tried at
    /// most once per call, and once a fallback answered, the rest of the run
    /// starts from it (see `crate::fixer`). Unset keeps the winner's author.
    pub fixer: Option<AgentChoice>,
    /// Agent that answers the standing chat's turns (`src/talk.rs`).
    ///
    /// Unset picks a `claude` seat, else the first runnable agent in roster
    /// order (see [`crate::agent::pick`]) - which is roster *order*, not a
    /// judgement about who converses well. Naming one here matters once an
    /// agent is also sitting as a judge: the chat is opened far more often
    /// than any single competition, and every open competes with that judge
    /// seat for the same account's concurrency. A timeout on an ordinary chat
    /// turn traced to exactly this - `opus` triple-booked as chatter and judge
    /// - is what this field exists to let an operator break apart.
    ///
    /// Accepts one id or an ordered array of ids: a fallback chain, see
    /// [`AgentChoice`].
    pub chatter: Option<AgentChoice>,
    /// Agent that judges duplicate-work claims in [`crate::dupes`].
    /// Unset inherits [`Self::chatter`], including its default agent selection.
    /// Accepts a string or an ordered fallback chain, like [`Self::chatter`].
    pub dupes_judge: Option<AgentChoice>,
    /// Agent that arranges the queue between polls: `crate::conduct`'s single
    /// seat, called once per cycle to decide a runnable task's `blocked_by`
    /// and how a stalled or finished task recovers.
    ///
    /// The same precedent as [`Self::chatter`] for a seat that stands alone
    /// rather than rotating through the roster - resolved through
    /// [`crate::agent::pick`], so unset falls back to its own default order
    /// (a claude seat, else the first runnable agent) rather than reusing a
    /// judge or reviewer seat that the conductor's own poll-cycle cadence
    /// would otherwise compete with for the same account's concurrency.
    ///
    /// Accepts a string or a fallback chain, like [`Self::chatter`].
    pub conductor: Option<AgentChoice>,
    /// Seats for the design-deliberation stage `graph::Runner::advise` runs
    /// before `implement`: independent, read-only design proposals gathered
    /// once a run has a settled task instruction and before any implementer
    /// touches the repository.
    ///
    /// Empty falls back to `judges` rather than to the whole roster: a panel
    /// trusted to rank patches independently is exactly the panel worth
    /// asking to sketch a design independently, and an operator who has
    /// already thought about judge diversity gets advisor diversity for free
    /// instead of a fourth roster to maintain.
    pub advisors: Vec<String>,
    /// Agent that blends [`Self::advisors`]' proposals into the one design
    /// brief `graph::Runner::synthesize_brief` carries into every
    /// implementer's prompt.
    ///
    /// The same precedent as [`Self::chatter`] and [`Self::conductor`] for a
    /// seat that stands alone rather than rotating through the roster -
    /// resolved through [`crate::agent::pick`], so unset falls back to its
    /// own default order (a claude seat, else the first runnable agent in
    /// roster order) - exactly today's behavior, unchanged by leaving this
    /// field out.
    ///
    /// Accepts a string or a fallback chain, like [`Self::chatter`].
    pub synthesizer: Option<AgentChoice>,
    /// Agent (normally a `kind = "command"` wrapper around Jev) that decides
    /// whether a pull request title and prose are English, for
    /// [`crate::github_text`]'s posting gate.
    ///
    /// Unset spawns nothing: the gate keeps its built-in heuristics. Set, a
    /// failed, timed-out or unparsable call also falls back to them, so the
    /// gate never depends on this seat being reachable. Accepts a string or a
    /// fallback chain, like [`Self::chatter`].
    pub language_judge: Option<AgentChoice>,
}

/// Requested network access for sandboxed repository editing seats.
/// Enabled permits outbound traffic as well as local test servers; parent
/// restrictions still apply. This is not a loopback-only firewall.
#[derive(Debug, Clone, Copy, Default, Deserialize, Serialize, PartialEq, Eq)]
#[serde(rename_all = "snake_case")]
pub enum EditingNetwork {
    /// Keep networking disabled for sandboxed repository writers.
    #[default]
    Restricted,
    /// Request networking, including outbound traffic and local test servers.
    Enabled,
}

/// Graph shape and limits.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Graph {
    /// Opt-in network access for sandboxed repository writers.
    pub editing_network: EditingNetwork,
    /// Gate GitHub prose before posting. Secret redaction remains mandatory when disabled.
    pub github_text_guard: bool,
    /// Language of pull request / issue titles, bodies and GitHub comments
    /// (`en` / `ja` / any language name). Default `en`. Anything but English
    /// switches off the posting gate's English-only language check for those
    /// texts (secret redaction stays); commit messages are always English.
    /// Independent of [`Self::language`], which is for the operator.
    pub github_language: String,
    /// Parallel implementations of the same task (the number of implementer
    /// seats; pairs with [`Roles::implementers`]). **One by default.**
    ///
    /// Formerly `candidates`, still read as a deprecated alias.
    ///
    /// Competition is the thing magi is for, and it is still here - it is just
    /// no longer what every task buys without being asked. Three days and 13
    /// runs on this repository, which is the workload these numbers are drawn
    /// from:
    ///
    /// - **0 of 13** competed runs reached a merge. Everything that landed in
    ///   that window went through `magi review` - the cheap half, no
    ///   competition - and passed on the first try.
    /// - The judges' first choices **split 73% of the time** (8 of 11
    ///   tallies). Candidates that close together make the ranking a weak
    ///   signal for what it costs to produce.
    /// - One run's own breakdown: implement 60min, judge 40min, fix 40min,
    ///   review 28min, **verify 5min** - and verify is the node that caught a
    ///   defect every reviewer had passed as clean. The cheapest step is the
    ///   one that earns its place every time.
    ///
    /// It is not worthless: `oc` won 3 of those tallies against `sonnet`, so a
    /// single-seat default would have shipped the worse implementation in
    /// roughly a quarter of them. That is exactly why this is a *default* and
    /// not a removal - `magi run --candidates N` and a per-task seat count are
    /// how a task that deserves a competition gets one.
    ///
    /// A single-candidate run needs no special case: `Runner::review`'s doc
    /// records that `execute` already degrades to implement -> review -> gate
    /// -> merge, because `judge` skips a one-candidate field, `deliberate` has
    /// no two first choices to reconcile and `vote` returns early.
    #[serde(alias = "candidates")]
    pub implementers: usize,
    /// Durable owner selection for a replacement implementation. No fallback.
    #[serde(default)]
    pub selected_implementer: Option<String>,
    /// Independent judges.
    pub judges: usize,
    /// Deliberation rounds when the judges' first choices disagree.
    pub deliberate_rounds: usize,
    /// Reviewers per review round. **Three by default** - the smallest panel
    /// a lens cycle (see [`crate::prompt::Lens`]) covers exactly once, so the
    /// default panel reads the patch for spec compliance, regressions, and
    /// simplicity without repeating an angle. Review is also the one stage
    /// [`Self::implementers`]'s doc describes as running on every task
    /// regardless of competition, which is what makes a panel worth its cost
    /// here even though `implementers` itself defaults to one.
    pub reviewers: usize,
    /// Maximum review+fix rounds before the run is declared blocked.
    pub review_rounds: usize,
    /// Fix rounds a failing `verify.gate` gets before the run is blocked. The
    /// fixer is handed the gate's own output; `0` keeps the old behaviour of
    /// blocking on the first red gate. Independent of [`Self::review_rounds`]
    /// so a run that spent its review budget can still repair a one-line gate
    /// failure.
    pub gate_fix_rounds: usize,
    /// Maximum agent processes running at once.
    pub max_parallel: usize,
    /// Language for the prose the agents write (`en` / `ja` / any language name).
    pub language: String,
    /// Keep one CLI conversation per seat, so a judge remembers its own
    /// argument across deliberation rounds and the fixer remembers its own
    /// implementation across review rounds.
    ///
    /// Sessions are scoped to a *seat*, never to an agent id: the same model
    /// sitting as implementer and as judge gets two unrelated conversations,
    /// which is what keeps blind judging blind.
    pub sessions: bool,
    /// Per-node timeouts, seconds.
    pub timeout_implement: u64,
    /// Per-node timeouts, seconds.
    pub timeout_judge: u64,
    /// Per-node timeouts, seconds.
    pub timeout_review: u64,
    /// Timeout for `verify.e2e` and `verify.gate`, seconds. Separate from
    /// [`Self::timeout_review`] so shrinking a reviewer's budget cannot
    /// silently shrink a real-machine command's budget too — the two used to
    /// share `timeout_review`, and turning a slow reviewer down cut the
    /// timeout `cargo test --all-targets` runs under along with it. When
    /// omitted, preserves legacy configurations by using
    /// [`Self::timeout_review`]. Set an explicit value to make verification
    /// independent of later review-seat budget changes.
    pub timeout_verify: Option<u64>,
    /// Per-node timeouts, seconds.
    pub timeout_fix: u64,
    /// Wall-clock limit for one turn of [`crate::talk`]'s standing
    /// conversation, seconds.
    ///
    /// An hour: the operator is not watching this turn resolve in real time,
    /// so the budget can match what the work - reading files, running
    /// commands, checking their output - actually needs rather than what a
    /// person waiting on a phone can tolerate.
    pub timeout_talk: u64,
    /// Longest an agent seat or verification batch may wait for the shared
    /// build cache's lease before starting, seconds.
    ///
    /// A separate clock from every `timeout_*` above: those start when the CLI
    /// or verification command is spawned and never include this wait.
    /// Expiry is a resource block (a
    /// resumable hold that spends no attempt and rotates no agent), not an
    /// agent timeout.
    pub timeout_resource_wait: u64,
    /// Retries for an agent invocation that fails or returns nothing usable.
    pub retries: usize,
    /// Root for candidate / judge worktrees. Defaults to `~/wt/magi`.
    pub worktree_root: Option<PathBuf>,
    /// After the pull request is open, keep going: watch its checks and
    /// reviews, run a fix round when they are unhappy, and ask to merge.
    ///
    /// On, because stopping at an open pull request left the operator doing
    /// the watching by hand - six times in the session this was built in - and
    /// that is the work the loop exists to take. It only engages for
    /// `merge = "pr"`; every other merge mode ends the run as before.
    ///
    /// Turning this on does **not** hand magi the merge button:
    /// [`Graph::land_approval`] is on too, and nothing merges without an
    /// explicit answer. Setting both to their non-defaults is the only way to
    /// get an unattended merge, and it has to be chosen twice.
    pub land: bool,
    /// Land rounds - watch, fix, push - before the run is left for a human.
    pub land_rounds: usize,
    /// When `land` sees a required check fail on the head it is bound to, rerun
    /// that check's workflow run once (`gh run rerun <id> --failed`) before
    /// spending a fix round on it. A run id is rerun at most once, recorded
    /// before the call, and forgotten when the head moves; the rerun costs no
    /// fix round and no attempt. A failure with no workflow run (an external
    /// status) goes straight to the fixer. On; off sends every red check to
    /// the fixer at once.
    pub rerun_flaky_checks: bool,
    /// Ask the owner before merging, showing what is about to land.
    ///
    /// On, and it is what makes `land` safe to have on: the question carries a
    /// rendered panel - the diffstat, the patch, the checks, the review
    /// comments that were addressed, and the subject the squash will use - so
    /// the decision is made on evidence rather than on trust, from wherever
    /// the operator happens to be.
    ///
    /// Silence is a hold. An unanswered approval never merges, and neither
    /// does any answer other than the word `merge`.
    pub land_approval: bool,
    /// Ask the owner when open Major-or-above internal findings OR a final
    /// rejecting reviewer vote remain. Final votes use reconsideration when
    /// answered, otherwise the initial vote. On by default; even a reject with
    /// zero Major findings requires approval when this control is enabled.
    ///
    /// `land_approval` independently asks about every merge. With both controls
    /// off, new ordinary approvals are skipped. Neither control bypasses an
    /// existing question or owner decision, nor the fresh approval required
    /// after merge repair (including repair that leaves the head unchanged).
    /// The pull request is opened either way; only the merge waits.
    pub hold_contested_merge: bool,
    /// Route what used to be a question about a task to the chat attached to
    /// that task (`crate::task_chat`): free text, no choices, no waiting. On by
    /// default; off keeps the question store, deputies and waiter as they were
    /// for this repository.
    pub question_routing: bool,
    /// After a run's pull request merges, file the findings its last review
    /// round left open as follow-up tasks (`crate::followup`) instead of
    /// letting them vanish with the merge: every Major-or-above finding, and
    /// every finding of a seat whose final vote was reject. Other Minor/Nit
    /// findings are only listed in the pull-request comment. Does not affect
    /// whether the merge happens. On; best-effort, a failure is a run event.
    pub file_followups: bool,
    /// After a run's pull request merges, release the follow-up tasks the
    /// merge approval's deputy filed held for that pull request
    /// (`crate::followup::settle_deputy_tasks`): only a task the deputy filed
    /// for this run whose hold reason names this pull request, exactly once,
    /// and never one that duplicates an automatic follow-up (that one is left
    /// held with the reason). The generation cap applies. Independent of
    /// `file_followups`. On; off leaves them held until `magi task release`.
    pub release_deputy_followups: bool,
    /// How long to wait for an owner to answer a question before the run is
    /// abandoned, seconds. A parked run costs nothing, so this is generous;
    /// it exists so a forgotten question cannot pin a worktree forever.
    pub answer_timeout: u64,
    /// What a round does when one or more reviewer seats never answered
    /// (timeout, crash, unparsable output).
    pub incomplete_review: IncompleteReviewPolicy,
    /// Run `verify.e2e` on every round, even one that already has blocking
    /// findings and another round left to try.
    ///
    /// Off by default: a round with a blocking finding and rounds still left
    /// is going back to the fixer regardless of what `verify.e2e` says, so
    /// running it first only spends the round's slowest step (minutes, on a
    /// Rust repo's `cargo test --all-targets`) on a head about to be
    /// rewritten anyway. `verify.e2e` still runs once a round has no
    /// blocking findings left (a round cannot go `clean` without it) and the
    /// final `verify.gate` always runs on the actual tree that would land —
    /// deferring is about *when* e2e runs mid-loop, never about skipping it.
    ///
    /// Set this to restore the old every-round diagnostic behaviour: e2e
    /// output from a round that still has blocking findings is occasionally
    /// useful on its own (a runtime failure a reviewer's panel would not
    /// have caught by reading), and this is the way back to seeing it every
    /// round instead of only once the panel has nothing left to flag.
    pub e2e_every_round: bool,
    /// Run the design-deliberation stage before `implement`: independent
    /// advisor seats each sketch a design, and (when at least one produced a
    /// usable proposal) a synthesis blends them into a brief carried in the
    /// implementer's prompt. See `graph::Runner::advise`.
    ///
    /// On by default. A design sketch is a few paragraphs an agent can write
    /// without touching the repository, where a full implementation is a
    /// tool loop that re-reads the codebase on every turn - so three
    /// sketches, gathered once before `implement` starts, cost a fraction of
    /// a fourth candidate and buy back a form of the same disagreement
    /// [`Self::implementers`]'s doc describes moving away from being the
    /// default, on every run rather than only the ones an operator remembers
    /// to ask for with `--implementers`.
    pub advise: bool,
    /// How many independent design proposals the deliberation stage gathers.
    /// **Three by default** - the same number [`Self::implementers`]'s doc
    /// names as the point where a fourth judge's first choice stopped
    /// changing the tally.
    pub advisors: usize,
    /// After the tally picks a winner and before the review loop, a fixer
    /// round ports the strengths the judges explicitly attributed to the
    /// losing candidates onto the winner (`graph::Runner::graft`). Skipped
    /// for a single candidate, a run with no winner or no quorum, and when
    /// no judge recorded a strength for a loser. Best-effort: a failure, a
    /// quota hit or no change restores the winner's pre-graft commit and the
    /// run carries on as if this were off.
    /// On by default.
    pub graft_runner_up: bool,
}

impl Default for Graph {
    fn default() -> Self {
        Self {
            editing_network: EditingNetwork::default(),
            github_text_guard: true,
            github_language: "en".into(),
            implementers: 1,
            selected_implementer: None,
            judges: 3,
            deliberate_rounds: 1,
            reviewers: 3,
            review_rounds: 6,
            gate_fix_rounds: 1,
            max_parallel: 4,
            language: "en".to_owned(),
            sessions: true,
            timeout_implement: 3600,
            timeout_judge: 1200,
            timeout_review: 1200,
            timeout_verify: None,
            timeout_fix: 1800,
            timeout_talk: 3600,
            timeout_resource_wait: 1800,
            retries: 1,
            worktree_root: None,
            land: true,
            land_rounds: 4,
            rerun_flaky_checks: true,
            land_approval: true,
            hold_contested_merge: true,
            question_routing: true,
            file_followups: true,
            release_deputy_followups: true,
            answer_timeout: 86_400,
            incomplete_review: IncompleteReviewPolicy::Block,
            e2e_every_round: false,
            advise: true,
            advisors: 3,
            graft_runner_up: true,
        }
    }
}

impl Graph {
    /// Effective machine-command budget. Older configuration files had only
    /// `timeout_review`, which also governed verification, so absence is a
    /// compatibility fallback rather than a new 1200-second default.
    pub fn verify_timeout(&self) -> u64 {
        self.timeout_verify.unwrap_or(self.timeout_review)
    }

    /// Does the posting gate enforce English on GitHub text? The one place
    /// that decides it: the guard is on *and* `github_language` is English.
    pub fn language_gate(&self) -> bool {
        self.github_text_guard && self.github_english()
    }

    /// Is GitHub text English (the default), whether or not the gate is on?
    pub fn github_english(&self) -> bool {
        crate::lang::is_english(&self.github_language)
    }
}

/// What a review round does when a reviewer seat never answered.
///
/// A round where half the panel timed out is not evidence of a clean patch —
/// it is evidence of nothing. The default refuses to call that clean; `warn`
/// exists for an operator who would rather keep a flaky seat from stalling
/// every run, and accepts that the gap is on them to read in the report.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum IncompleteReviewPolicy {
    /// A round with a missing seat is never `clean`: with nothing raised to
    /// fix, the round is re-reviewed instead of gating; with the max rounds
    /// exhausted, the run is left `Blocked` rather than declared ready.
    Block,
    /// A round with a missing seat can still gate as clean, once every seat
    /// that *did* answer raised nothing blocking and verification is green.
    /// The record keeps the gap visible (`magi show`, `magi stats`) even
    /// though the run does not wait on it.
    Warn,
}

/// What to do when vendor-identifying text is found in material shown to judges.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum LeakPolicy {
    /// Record the leak, show the patch unmodified.
    Warn,
    /// Replace the token with `[REDACTED]` in the presented patch.
    Redact,
    /// Abort the run.
    Fail,
}

/// Blindness policy.
///
/// Commit messages and candidate summaries are *always* stripped of
/// attribution trailers and redacted — that is where signatures actually
/// appear. [`Blind::on_leak`] governs the patch body only, where blanket
/// redaction would corrupt the artifact under judgement.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Blind {
    /// Install a per-worktree `commit-msg` hook that deletes attribution
    /// trailers before they can land in a candidate's history.
    pub commit_msg_hook: bool,
    /// Literal, case-insensitive substrings. A line containing any of them is
    /// dropped from commit messages and summaries; the `commit-msg` hook is
    /// generated from the same list.
    pub strip_lines: Vec<String>,
    /// Case-insensitive substrings that identify a vendor or model.
    pub vendor_tokens: Vec<String>,
    /// Policy for vendor tokens found in the patch body.
    pub on_leak: LeakPolicy,
    /// Seed for label assignment and per-judge presentation order. Derived from
    /// the run id when unset; set it to make a run reproducible.
    pub seed: Option<u64>,
}

impl Default for Blind {
    fn default() -> Self {
        Self {
            commit_msg_hook: true,
            strip_lines: [
                "Co-Authored-By:",
                "Signed-off-by:",
                "Assisted-by:",
                "Generated-by:",
                "Generated with",
                "\u{1f916}",
            ]
            .iter()
            .map(|s| (*s).to_owned())
            .collect(),
            vendor_tokens: [
                "claude",
                "anthropic",
                "codex",
                "openai",
                "chatgpt",
                "gemini",
                "grok",
                "xai",
                "copilot",
                "opencode",
                "qoder",
                "cursor",
                "\u{1f916}",
            ]
            .iter()
            .map(|s| (*s).to_owned())
            .collect(),
            on_leak: LeakPolicy::Warn,
            seed: None,
        }
    }
}

/// Shell commands that gate the winner.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Verify {
    /// Run in the winner's worktree once per review round. Its output is fed
    /// back to the fixer. This is the "real machine" leg of the review.
    pub e2e: Vec<String>,
    /// Final gate. Must all exit 0 before a merge is attempted.
    pub gate: Vec<String>,
    /// Mechanical fixers (formatters) run in the winner's worktree just before
    /// `gate`, after review is clean. Anything they change is committed as one
    /// neutral-identity commit so the gate and the PR see it. A command that
    /// fails or times out is a warning, never a failed run: the gate stays the
    /// single arbiter. Empty (the default) turns the feature off. Runs under
    /// `graph.verify_timeout()` per command, like the gate. Meant for light
    /// tools: it is not scanned for `CARGO_TARGET_DIR`, and it should be
    /// idempotent since a resumed run may repeat it.
    #[serde(default)]
    pub pre_gate: Vec<String>,
    /// Shell used to run the commands above. Defaults to `sh -c`, or
    /// `cmd /C` when `sh` is not on `PATH`.
    pub shell: Option<Vec<String>>,
}

impl Verify {
    /// The `CARGO_TARGET_DIR=` value of the first rendered command that sets
    /// one, if any. See [`crate::disk::extract_cargo_target_dir`] for the shape
    /// this reads back. One rendering is enough - they all set the same
    /// rendered `{{ vars.cache }}` path via the same shell - and the first e2e
    /// command is checked before the gate because the e2e rebuilds the crate.
    pub fn cache_dir(&self) -> Option<PathBuf> {
        self.e2e
            .iter()
            .chain(self.gate.iter())
            .find_map(|cmd| crate::disk::extract_cargo_target_dir(cmd))
    }

    /// Every `--manifest-path` the e2e and gate commands pass to cargo, for the
    /// shared cache's freshness check in repositories with no root manifest.
    pub fn cargo_manifests(&self) -> Vec<PathBuf> {
        let all: Vec<String> = self.e2e.iter().chain(self.gate.iter()).cloned().collect();
        crate::cache::extract_manifest_paths(&all)
    }
}

/// Per-repository worktree preparation, run right after magi creates a worktree.
#[derive(Debug, Clone, Default, PartialEq, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Worktree {
    /// Ordered steps. Declare in one layer only. Empty (the default) changes
    /// nothing. See [`crate::worktree_setup`].
    pub setup: Vec<SetupStep>,
}

/// One setup step: exactly one of `copy` / `run`.
#[derive(Debug, Clone, Default, PartialEq, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct SetupStep {
    /// `"src -> dst"` (or just `"path"`): copy from the primary checkout (an
    /// absolute source is allowed) into the worktree. Never overwrites.
    pub copy: Option<String>,
    /// With `copy`: a missing source is skipped instead of an error.
    pub optional: bool,
    /// Shell command, run with the worktree as cwd.
    pub run: Option<String>,
    /// With `run`: seconds before the command is killed. Defaults to
    /// `graph.verify_timeout()`.
    pub timeout_secs: Option<u64>,
}

impl Worktree {
    /// Refuse a malformed step at load time rather than in the middle of a run.
    pub fn validate(&self) -> Result<()> {
        for (i, step) in self.setup.iter().enumerate() {
            let n = i + 1;
            match (&step.copy, &step.run) {
                (Some(c), None) => {
                    if step.timeout_secs.is_some() {
                        bail!("[worktree] setup step {n}: `timeout_secs` applies to `run` only");
                    }
                    crate::worktree_setup::validate_copy(c)
                        .with_context(|| format!("[worktree] setup step {n}"))?;
                }
                (None, Some(r)) => {
                    if r.trim().is_empty() {
                        bail!("[worktree] setup step {n}: `run` is empty");
                    }
                    if step.optional {
                        bail!("[worktree] setup step {n}: `optional` applies to `copy` only");
                    }
                }
                _ => bail!("[worktree] setup step {n} must set exactly one of `copy` and `run`"),
            }
        }
        Ok(())
    }
}

/// Disk hygiene: how hard magi is allowed to press on the machine's free space.
///
/// The numbers below come from one incident, not from theory: a machine with
/// 951.8 GB free ran a few competitions and plans and best read 6.7 GB free.
/// Three multi-gigabyte classes of junk accumulated side by side - per-run
/// worktrees that end as `Merged`/`Ready`/`Failed`, a shared build cache whose
/// each verify round and each implementation wave recompiles the derived
/// section of the project into, and the outputs of runs that were removed but
/// whose folders nobody deleted.
#[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Disk {
    /// Free space, in bytes, below which no new run may start: the daemon and
    /// the `magi run` gate answer with "the disk is full" instead of letting
    /// the graph fill it the rest of the way. `0` turns the gate off.
    ///
    /// Default 8 GiB. The incident ran down to 6.7 GB free of 951.8 GB total
    /// before anybody noticed; 8 GiB is enough headroom for the compile a fresh
    /// competition triggers and small enough that a 1 TB disk with 100 GB free
    /// is nowhere near the threshold.
    pub min_free_bytes: u64,
    /// Fold finished runs without being asked. `Merged`, `Ready` and `Failed`
    /// runs older than [`fold_grace_secs`](Self::fold_grace_secs) have their
    /// worktrees removed. `0` turns the janitor off.
    ///
    /// Default true.
    pub auto_fold: bool,
    /// How old a finished run must be before the janitor folds it, seconds.
    ///
    /// Default 6 hours. A run that `Ready` at 8am is the operator's answer; a
    /// run that `Ready` a week ago is worktrees holding a compile each. Six
    /// hours is long enough that nobody loses an answer in the gap between
    /// reading the report and starting from it, and short enough that a backlog
    /// cannot pile up across two nights.
    pub fold_grace_secs: u64,
    /// Ceiling for the shared build cache (`CARGO_TARGET_DIR` in the rendered
    /// verify commands), in bytes. When the janitor runs and the cache is over
    /// it, files are dropped oldest-first until it is not. `0` turns pruning
    /// off - the cache then only ever grows, which is the operator's call.
    ///
    /// Default 10 GiB. This is what the incident measured: 30.61 GB sat in the
    /// shared cache on top of ~16 GB in the primary target directory and 6.7-
    /// 11.15 GB in each of four per-worktree targets. 10 GiB holds a healthy
    /// stack of prebuilt dependencies (cargo's per-file fingerprinting means
    /// pruning only costs the rebuild of the dropped files, not of the world)
    /// without letting one addled cache swallow the machine.
    pub cache_limit_bytes: u64,
    /// Aggregate retained worktree Cargo output cap; 0 disables reclamation.
    pub worktree_limit_bytes: u64,
    /// Maximum declared artifact bytes reclaimed per pass.
    pub worktree_reclaim_bytes: u64,
    /// Maximum unretired attempts of one task before another run may be
    /// created. Resumes do not create worktrees and remain allowed. Automatic
    /// releases and upstream changes never reset this bound; 0 disables it.
    pub retained_attempt_limit: usize,
}

impl Default for Disk {
    fn default() -> Self {
        Self {
            min_free_bytes: 8 * 1024 * 1024 * 1024,
            auto_fold: true,
            fold_grace_secs: 6 * 60 * 60,
            cache_limit_bytes: 10 * 1024 * 1024 * 1024,
            worktree_limit_bytes: 10 * 1024 * 1024 * 1024,
            worktree_reclaim_bytes: 16 * 1024 * 1024 * 1024,
            retained_attempt_limit: 8,
        }
    }
}

/// What to do with the winning branch.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum MergeMode {
    /// Leave the branch alone and print the merge command matching
    /// [`Merge::style`].
    None,
    /// Merge into the base branch in the primary worktree, using
    /// [`Merge::style`].
    Local,
    /// Push the branch and open a PR with `gh pr create`. Landing this PR
    /// (`[graph] land`) always squashes — see `land`'s module doc — so
    /// [`Merge::style`] does not apply here.
    Pr,
}

/// How the winning branch is attached to the base branch: what
/// `mode = "local"` runs, and what `mode = "none"`'s printed guidance tells
/// the operator to run by hand.
///
/// Read from configuration rather than asked of the repository at run time
/// (e.g. `gh api repos/{owner}/{repo}/rulesets`) for two reasons: it keeps
/// `mode = "none"`'s guidance a pure function of `RunState`, assertable in a
/// unit test the same way `land::decide` is kept pure (see that module's
/// doc), and it works for a base branch that is not hosted on GitHub, or not
/// reachable at all, at the moment the report is rendered. An operator whose
/// base branch enforces a ruleset already knows what it allows; declaring it
/// once here is cheaper than magi re-discovering it, with a network call, on
/// every render.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum MergeStyle {
    /// `git merge --no-ff`: every candidate commit lands, plus a merge
    /// commit that records the merge as its own event in history. Rejected
    /// by a base branch whose ruleset requires linear history or forbids
    /// merge commits outright.
    #[default]
    Merge,
    /// `git merge --squash` followed by a commit under an explicit message:
    /// every candidate commit folds into one, and none of the candidate's
    /// own placeholder subjects (`magi: candidate A (uncommitted work)`)
    /// reach the base branch. No merge commit, so this satisfies a linear-
    /// history ruleset.
    Squash,
    /// A fast-forward-only merge: every candidate commit lands verbatim, in
    /// order, with no merge commit. Only succeeds because the winner was
    /// already rebased onto the tracked base tip before this runs (see
    /// `Runner::sync_to_base`) — equivalent to GitHub's "rebase and merge"
    /// once that has happened.
    Rebase,
}

/// Whether pull request landing requires readable CI results.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum MergeCi {
    /// Wait for readable check results before landing (the default).
    #[default]
    Expected,
    /// Ignore the rollup; repository verification and approval still apply.
    None,
}

impl MergeCi {
    /// Translate configuration into the landing decision policy.
    pub fn expectation(self) -> crate::land::CiExpectation {
        match self {
            Self::Expected => crate::land::CiExpectation::Expected,
            Self::None => crate::land::CiExpectation::Absent,
        }
    }
}

/// Merge policy.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Merge {
    /// Default is [`MergeMode::None`]: magi never touches your base branch
    /// unless you ask it to.
    pub mode: MergeMode,
    /// CI expectation for landing. Opt out only in repositories without CI.
    pub ci: MergeCi,
    /// Base branch. Defaults to the branch checked out when the run started.
    pub base: Option<String>,
    /// How the winner is attached to `base`; see [`MergeStyle`]. Ignored by
    /// `mode = "pr"`.
    pub style: MergeStyle,
    /// Remote for `mode = "pr"`.
    pub remote: String,
    /// After a `mode = "pr"` run lands, open a `chore/release-vX.Y.Z` pull
    /// request sized to the change by an agent's own judgement, so a version
    /// bump does not depend on a human remembering to cut one.
    ///
    /// Only acts on Rust repositories (a `Cargo.toml` at the root of the base
    /// branch); on any other repository it is a no-op that records one event.
    ///
    /// On by default. **Turning this off means a merge landed from the phone
    /// never becomes a release**, so `POST /api/upgrade` keeps reporting
    /// "already on the newest release" against a `main` that has moved past
    /// it - the same gap this feature exists to close. Only for a repository
    /// that wants to keep cutting releases by hand.
    pub release_bump: bool,
}

impl Default for Merge {
    fn default() -> Self {
        Self {
            mode: MergeMode::None,
            ci: MergeCi::Expected,
            base: None,
            style: MergeStyle::default(),
            remote: "origin".to_owned(),
            release_bump: true,
        }
    }
}

/// How magi keeps itself current.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum UpdateMode {
    /// Never check.
    Off,
    /// Check in the background and print a one-line banner when a newer
    /// release exists.
    Notify,
    /// Check and install silently.
    Install,
}

/// Self-update policy.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Update {
    /// Default is [`UpdateMode::Notify`]: magi tells you, and lets you decide.
    pub mode: UpdateMode,
    /// Minimum time between checks, e.g. `24h`. kaishin's default when unset.
    pub interval: Option<String>,
    /// Opt in to idle-only update and restart in `magi web`.
    pub auto_restart: bool,
}

impl Default for Update {
    fn default() -> Self {
        Self {
            mode: UpdateMode::Notify,
            interval: None,
            auto_restart: false,
        }
    }
}

/// Who performs the release after a `chore/release-vX.Y.Z` pull request merges.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum ReleaseMode {
    /// The repository's own workflows do (`auto-tag.yml` then `release.yml`),
    /// and the release pull request merges on its checks.
    #[default]
    Actions,
    /// magi does, from this machine: no CI is awaited, the owner approves the
    /// merge, and magi then tags and runs [`Release::commands`]. See
    /// [`crate::release_local`]. For ordinary pull requests without CI, also set
    /// `[merge] ci = "none"` in the repository config.
    Local,
}

/// `[release]`: releasing without GitHub Actions. Opt-in per repository.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Release {
    /// [`ReleaseMode::Actions`] (default: nothing changes) or
    /// [`ReleaseMode::Local`].
    pub mode: ReleaseMode,
    /// Shell commands run in order, from a clean checkout of the merge commit,
    /// once the tag is pushed. The first failure stops the list. They see
    /// `MAGI_RELEASE_VERSION`, `MAGI_RELEASE_TAG`, `MAGI_RELEASE_COMMIT` and
    /// `MAGI_RELEASE_PR` in the environment; `{{ ... }}` cannot carry the
    /// version because teravars renders the whole file before any release
    /// exists. Only read when `mode = "local"`.
    pub commands: Vec<String>,
    /// Minutes each command may run before it is killed and counted as failed.
    pub timeout_minutes: u64,
    /// Files whose version a release bump rewrites, for repositories whose
    /// manifest is not a root `Cargo.toml` (a Tauri app keeps it under
    /// `src-tauri/`, with the app version repeated in `package.json` and
    /// `tauri.conf.json`). Empty (default) means the root `Cargo.toml` and
    /// nothing else. The first entry is the version of record - the file the
    /// repository's own `auto-tag.yml` reads - and must be `kind = "cargo"`.
    /// Never detected: see [`crate::release_manifest`].
    pub version_files: Vec<VersionFile>,
}

/// How a [`VersionFile`] is read and rewritten.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum VersionKind {
    /// A `Cargo.toml` (`[package]` or `[workspace.package]` `version`).
    Cargo,
    /// A JSON file with a top-level `"version"` string.
    Json,
}

/// One entry of [`Release::version_files`].
#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
#[serde(deny_unknown_fields)]
pub struct VersionFile {
    /// Path relative to the repository root, `/`-separated.
    pub path: String,
    /// How to read and rewrite it.
    pub kind: VersionKind,
}

impl Default for Release {
    fn default() -> Self {
        Self {
            mode: ReleaseMode::Actions,
            commands: Vec::new(),
            timeout_minutes: 30,
            version_files: Vec::new(),
        }
    }
}

impl Release {
    /// Refuse a malformed `version_files` at load time.
    pub fn validate(&self) -> Result<()> {
        crate::release_manifest::validate(&self.version_files).context("[release] version_files")
    }

    /// Is this repository released by magi rather than by its workflows?
    pub fn is_local(&self) -> bool {
        self.mode == ReleaseMode::Local
    }
}

/// Optional contract with an external repository updater.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(try_from = "CoordinationFields")]
pub struct Coordination {
    /// Contract file name inside the Git common directory.
    pub contract_file: String,
    /// Accepted trimmed contract contents.
    pub contract_token: String,
    /// Shared OS lock file name inside the Git common directory.
    pub lock_file: String,
}

#[derive(Deserialize, Default)]
#[serde(deny_unknown_fields, default)]
struct CoordinationFields {
    contract_file: String,
    contract_token: String,
    lock_file: String,
}

impl TryFrom<CoordinationFields> for Coordination {
    type Error = anyhow::Error;

    fn try_from(fields: CoordinationFields) -> Result<Self> {
        for (key, name) in [
            ("coordination.contract_file", &fields.contract_file),
            ("coordination.lock_file", &fields.lock_file),
        ] {
            if name.trim().is_empty()
                || name != name.trim()
                || name == "."
                || name.contains("..")
                || name.contains(['/', '\\', ':', '\0'])
            {
                bail!(
                    "{key} must be a plain file name inside the Git common directory (no separators or '..')"
                );
            }
        }
        let token = &fields.contract_token;
        if token.is_empty() || token.trim() != token || token.chars().any(char::is_control) {
            bail!(
                "coordination.contract_token must be a nonempty single-line token without surrounding whitespace"
            );
        }
        Ok(Self {
            contract_file: fields.contract_file,
            contract_token: fields.contract_token,
            lock_file: fields.lock_file,
        })
    }
}

#[cfg(test)]
pub(crate) fn test_coordination() -> Option<Coordination> {
    Some(Coordination {
        contract_file: "updater.contract".into(),
        contract_token: "test-protocol-v1".into(),
        lock_file: "updater.lock".into(),
    })
}

/// Top-level configuration.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Config {
    /// External repository coordination; absent means disabled.
    pub coordination: Option<Coordination>,
    /// Agent roster.
    pub agents: Vec<AgentSpec>,
    /// Role assignment.
    pub roles: Roles,
    /// Graph shape.
    pub graph: Graph,
    /// Blindness policy.
    pub blind: Blind,
    /// Verification commands.
    pub verify: Verify,
    /// Worktree preparation.
    pub worktree: Worktree,
    /// Disk hygiene.
    pub disk: Disk,
    /// Merge policy.
    pub merge: Merge,
    /// Self-update policy.
    pub update: Update,
    /// Project-specific text appended to the node prompts.
    pub prompts: Prompts,
    /// How the operator is told a run is waiting on them.
    pub notify: Notify,
    /// Local repositories the plan surface can start or derive a conversation
    /// against.
    pub repos: Repos,
    /// Policy for the standing conversation ([`crate::talk`]).
    pub talk: Talk,
    /// How many runs `magi serve`'s own loop drives at once.
    pub daemon: Daemon,
    /// Who tags and publishes after a release pull request merges.
    pub release: Release,
    /// Context-window sizes in tokens, keyed by model name, merged over
    /// [`BUILTIN_CONTEXT_WINDOWS`]. See [`Config::context_window`].
    pub context_windows: BTreeMap<String, u64>,
}

/// Context windows of models magi commonly drives, in tokens.
///
/// A convenience, not a source of truth: vendors resize windows and ship new
/// models faster than this table is edited, so an entry that is stale or
/// missing is fixed by `[context_windows]` in `magi.toml`, which wins. Matched
/// by [`Config::context_window`]: exact name first, then the longest key that
/// prefixes the model name (so a dated or suffixed id such as
/// `claude-sonnet-4-5-20250929` finds `claude-sonnet-4-5`). A model matching
/// nothing has no percentage - the UI shows the raw count.
const BUILTIN_CONTEXT_WINDOWS: &[(&str, u64)] = &[
    ("claude-opus-4", 200_000),
    ("claude-sonnet-4", 200_000),
    ("claude-haiku-4", 200_000),
    ("claude-3", 200_000),
    ("opus", 200_000),
    ("sonnet", 200_000),
    ("haiku", 200_000),
    ("gpt-5", 400_000),
    ("gpt-4.1", 1_000_000),
    ("gpt-4o", 128_000),
    ("o3", 200_000),
    ("o4-mini", 200_000),
    ("gemini-2.5", 1_000_000),
    ("deepseek", 128_000),
];

impl Config {
    /// Context window in tokens for `model`: `[context_windows]` first, then
    /// the built-in table; within each, an exact name beats the longest
    /// prefix. `None` for an unknown model, which is a deliberate answer -
    /// guessing a denominator would print a confident wrong percentage.
    pub fn context_window(&self, model: &str) -> Option<u64> {
        fn lookup<'a>(model: &str, entries: impl Iterator<Item = (&'a str, u64)>) -> Option<u64> {
            let mut best: Option<(usize, u64)> = None;
            for (key, window) in entries {
                if key == model {
                    return Some(window);
                }
                if model.starts_with(key) && best.is_none_or(|(len, _)| key.len() > len) {
                    best = Some((key.len(), window));
                }
            }
            best.map(|(_, w)| w)
        }
        lookup(
            model,
            self.context_windows.iter().map(|(k, w)| (k.as_str(), *w)),
        )
        .or_else(|| lookup(model, BUILTIN_CONTEXT_WINDOWS.iter().copied()))
    }
}

/// How the daemon loop itself behaves, as opposed to what one run does.
///
/// Machine-layer material in the same sense [`Repos::roots`] is: how many
/// competitions this machine's own loop is willing to babysit at once is a
/// fact about the machine running `magi serve`, not about any one
/// repository's task, so it belongs in `<config_dir>/magi/config.toml`
/// rather than a repository's own `magi.toml` - though, like `Repos::roots`,
/// nothing stops a repository from setting it too, since a scalar field
/// takes whichever layer has the highest precedence.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Daemon {
    /// How many runs `magi serve` may have actively in flight at once.
    /// **One by default** - today's behaviour, one run at a time.
    ///
    /// This is a different knob from [`Graph::max_parallel`], and the two
    /// must not be confused: `max_parallel` bounds how many agent *processes*
    /// one run starts inside itself (implementers, judges, reviewers -
    /// candidates competing on a single task); this field bounds how many
    /// *runs* - whole competitions, each with its own `max_parallel` budget -
    /// the loop drives side by side, possibly across different tasks and
    /// different repositories. Raising `max_parallel` buys a bigger panel for
    /// one task; raising this buys more tasks worked at once. A config file
    /// that meant one and wrote the other would either starve a competition
    /// of judges or leave the rest of the backlog waiting for no reason.
    ///
    /// A run parked waiting on the operator's land-merge approval - see
    /// [`crate::land`] - does not hold one of these slots while it waits: the
    /// whole point of parking there is to let the loop spend the slot on
    /// something runnable instead of sitting on a decision only a human can
    /// make. So even at the default of `1`, an approval that comes back does
    /// not queue behind whatever else the loop happens to be running.
    pub max_concurrent_runs: usize,
    /// Let a task marked [`crate::queue::Task::interrupt`] (`magi task
    /// interrupt`) cut ahead of whatever `magi serve` already has in flight,
    /// instead of waiting for it to finish.
    ///
    /// **Off by default.** When enabled, a run that is in flight and is not
    /// itself the interrupt candidate may be paused at its next safe node
    /// boundary - see [`crate::graph::Runner::park_here`] - so the marked
    /// task can run alone; the paused run resumes automatically, through the
    /// same path any other parked run does, the moment the interrupting
    /// task's own run reaches a terminal status. This is opt-in because it
    /// bends the loop's own "one run at a time" principle (see this repository's
    /// `magi serve` help) for a specific, explicit operator request, and a
    /// repository that never files an interrupt task pays nothing for having
    /// it on - but an operator who does not want any run of theirs preempted,
    /// ever, should leave this `false`.
    pub pause_for_interrupts: bool,
    /// How many deputies `magi serve` runs at once. A deputy is the short-lived
    /// seat that waits on one open conductor question (see [`crate::deputy`]);
    /// each is a live agent conversation, so this is bounded - **two by
    /// default**, because the agent CLIs' quota is the scarce resource. A
    /// question over the limit keeps its place and starts when a deputy
    /// finishes; `0` runs none.
    pub max_deputies: usize,
    /// Minutes a release-bump pull request may make no progress before
    /// `magi serve` raises a notice and asks the owner (see
    /// [`crate::release_watch`]). Progress is a change of head commit or of any
    /// check's verdict. A required check that stays red after the one rerun the
    /// watcher is allowed escalates at once, whatever this says. **Sixty by
    /// default**; `0` turns the watcher off.
    pub release_stall_minutes: u64,
}

impl Default for Daemon {
    fn default() -> Self {
        Self {
            max_concurrent_runs: 1,
            pause_for_interrupts: false,
            max_deputies: 2,
            release_stall_minutes: 60,
        }
    }
}

/// Where `magi repos` and `GET /api/repos` look for local checkouts.
///
/// `roots` is one of the array keys [`array_merge_policy`] marks as
/// append-across-layers: which checkouts exist in general is a *machine*
/// fact in the same way the agent roster is - a repository's own `magi.toml`
/// cannot state where its siblings live before magi has resolved which
/// repository to read that file from in the first place - but a repository
/// that genuinely has an extra root worth scanning is not forced to choose
/// between an error and losing the machine's roots outright. Both layers'
/// roots are scanned; see [`Config::refuse_split_arrays`] for the keys that
/// are still refused.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Repos {
    /// Roots to scan for a ghq-layout checkout: `<root>/<host>/<owner>/<repo>`
    /// with a `.git` directory. Empty by default - nothing is scanned unless
    /// asked to be.
    pub roots: Vec<PathBuf>,
    /// How long a scan is trusted before the next request re-scans it,
    /// seconds. `0` means never trust it: scan on every request. Defaults to
    /// a day, the same order of magnitude as [`Graph::answer_timeout`] for
    /// the same reason - a checkout does not usually appear or vanish inside
    /// a session, so there is little to gain from scanning more often than
    /// that, and an explicit refresh exists for the moment one does.
    pub scan_ttl: u64,
    /// How often `magi serve` runs `git fetch origin` in every checkout under
    /// `roots`, seconds, so `origin/main` stays fresh whatever state the
    /// working tree is in. Fetch only: no branch, HEAD or working tree is
    /// touched. `0` disables it.
    pub fetch_interval: u64,
}

impl Default for Repos {
    fn default() -> Self {
        Self {
            roots: Vec::new(),
            scan_ttl: 86_400,
            fetch_interval: 600,
        }
    }
}

/// Project-specific text appended to each node's prompt.
///
/// **Additive by construction.** These fields cannot replace magi's prompts,
/// only extend them, and that restriction is the whole design. The built-in
/// prompts carry the invariants the competition rests on: a judging prompt
/// names no authors, every structured answer must arrive as one fenced `json`
/// block, and a judge is told not to speculate about who wrote what. A config
/// that could overwrite them would let a typo silently un-blind the panel or
/// break the parser, and the symptom would be "the judges got worse" rather
/// than an error.
///
/// Repository-wide context belongs in `AGENTS.md`, which every agent already
/// reads from the checkout. Use these fields for the things a *magi node*
/// needs to know and a repository file cannot say - for instance that
/// reviewers here should ignore formatting because a hook owns it.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Prompts {
    /// Appended to every node's prompt.
    pub all: String,
    /// Appended for implementers.
    pub implement: String,
    /// Appended for judges, both ranking and voting.
    pub judge: String,
    /// Appended for reviewers.
    pub review: String,
    /// Appended for the fixer.
    pub fix: String,
}

impl Prompts {
    /// The overlay for one node, or `None` when nothing is configured.
    ///
    /// `node` is the graph's own node name, so a new node gets no overlay
    /// rather than the wrong one.
    pub fn overlay(&self, node: &str) -> Option<String> {
        let specific = match node {
            "implement" => &self.implement,
            "judge" | "vote" | "deliberate" => &self.judge,
            "review" => &self.review,
            "fix" => &self.fix,
            _ => "",
        };
        let mut parts: Vec<&str> = Vec::new();
        for p in [self.all.trim(), specific.trim()] {
            if !p.is_empty() {
                parts.push(p);
            }
        }
        if parts.is_empty() {
            return None;
        }
        Some(parts.join("\n\n"))
    }
}

/// How the operator is told that a run is waiting on them.
///
/// A command rather than a built-in integration: magi is one binary with no
/// network dependencies, and every operator's notification path is different -
/// ntfy, a Slack webhook, a Windows toast, an SSH to a machine that beeps.
/// Shelling out keeps all of them possible and none of them magi's problem.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Notify {
    /// Command and arguments. `{summary}`, `{run}` and `{url}` are replaced.
    /// Empty means no notification - the web UI is then the only surface.
    pub command: Vec<String>,
}

/// Policy for [`crate::talk`], the standing conversation.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Talk {
    /// Let the conversation's agent edit files in the repository instead of
    /// filing a task for one. **Off by default** - see
    /// [`crate::talk`]'s module doc for why an edit made mid-conversation is
    /// an edit no run and no review can be attributed to, which is exactly
    /// the property a repository entered in a competition depends on. A
    /// repository that is never judged - dotfiles, a personal config
    /// checkout - has nothing to lose by turning this on in its own
    /// `magi.toml`, and a one-line fix stops costing a queued task to get.
    pub allow_write: bool,
    /// Extra chat personas, `[[talk.personas]]`. They add to the built-ins in
    /// [`crate::persona`]; an entry with a built-in's id replaces it. Like every
    /// array outside [`array_merge_policy`]'s append list, declaring it in two
    /// layers is refused.
    pub personas: Vec<PersonaSpec>,
    /// What the chat calls the operator: the persona addresses them by this
    /// name and the web Chat labels their turns with it instead of `YOU`.
    /// Blank is unset; at most [`OPERATOR_NAME_MAX`] characters, one line.
    pub operator_name: Option<String>,
}

/// Longest accepted `[talk] operator_name`, in characters.
pub const OPERATOR_NAME_MAX: usize = 64;

impl Talk {
    /// The trimmed operator name, `None` when unset or blank.
    pub fn operator_name(&self) -> Option<&str> {
        self.operator_name
            .as_deref()
            .map(str::trim)
            .filter(|n| !n.is_empty())
    }
}

/// One `[[talk.personas]]` entry: a tone for the standing chat, nothing more.
#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize)]
#[serde(deny_unknown_fields)]
pub struct PersonaSpec {
    /// Stable id the conversation stores. Not `default`.
    pub id: String,
    /// What the selector shows. May be omitted when `id` is a built-in's: the
    /// built-in's name is kept.
    #[serde(default)]
    pub name: String,
    /// The voice instruction appended to the chat's system prompt. May be
    /// omitted when `id` is a built-in's.
    #[serde(default)]
    pub prompt: String,
    /// Optional avatar, display only: a `data:image/(png|jpeg|gif|webp);base64,`
    /// URI or an absolute (or `~/`) path to a raster image. See
    /// [`crate::persona_icon`]. Never part of the briefing.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icon: Option<String>,
}

/// Roles resolved to concrete agent specs for one run.
#[derive(Debug, Clone)]
pub struct ResolvedRoles {
    /// One per candidate.
    pub implementers: Vec<AgentSpec>,
    /// One per judge.
    pub judges: Vec<AgentSpec>,
    /// One per reviewer slot.
    pub reviewers: Vec<AgentSpec>,
    /// The configured fixer chain in order, if `[roles] fixer` is set
    /// (resolved like [`crate::agent::pick_chain`]: unknown or uninstalled ids
    /// skipped, duplicates keep their first place). `None` means the winner's
    /// own author.
    pub fixer: Option<Vec<AgentSpec>>,
    /// Queue conductor, explicitly selected or resolved by the standalone-seat fallback.
    pub conductor: AgentSpec,
    /// The full ordered implementer roster, in [`Roles::implementers`]'s own
    /// order — or `[[agents]]` in file order, when that list is empty. Unlike
    /// [`Self::implementers`], never truncated to `graph.implementers` and
    /// never `rotate`d/wrapped: a solo run (`implementers = 1`) resolves
    /// `implementers` down to a single slot, but `graph::Runner`'s per-seat
    /// quota fallback needs the *whole* list to walk forward through when
    /// that one slot's agent runs out of quota mid-run.
    pub implementer_roster: Vec<AgentSpec>,
    /// [`Self::implementer_roster`]'s counterpart for judge seats: the whole
    /// `[roles] judges` list (or every agent), untruncated and unrotated, for
    /// the per-seat handover when a judge's agent fails.
    pub judge_roster: Vec<AgentSpec>,
    /// Likewise for reviewer seats.
    pub reviewer_roster: Vec<AgentSpec>,
}

/// Every array-valued key in a config table, as a dotted path.
///
/// Dotted so the error names `roles.implementers` rather than `implementers`:
/// an operator with three config files needs to know which key, not just that
/// there was one. `vars` is skipped because it is teravars' own input, merged
/// on purpose and never deserialised into `Config`.
fn array_keys(table: &toml::value::Table, prefix: &str) -> Vec<String> {
    let mut out = Vec::new();
    for (k, v) in table {
        if prefix.is_empty() && k == "vars" {
            continue;
        }
        let path = if prefix.is_empty() {
            k.clone()
        } else {
            format!("{prefix}.{k}")
        };
        match v {
            toml::Value::Array(_) => out.push(path),
            toml::Value::Table(t) => out.extend(array_keys(t, &path)),
            _ => {}
        }
    }
    out
}

/// How an array key behaves when two config layers both declare it.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum ArrayMerge {
    /// Two layers may both declare it; the composed value is the
    /// low-to-high-priority concatenation teravars already produces (see
    /// [`Config::load_layers`]'s doc for why that order and no dedup).
    Append,
    /// Two layers declaring it is refused; see
    /// [`Config::refuse_split_arrays`].
    Replace,
}

/// The single place that decides, for a dotted array key (as returned by
/// [`array_keys`]), whether declaring it in two config layers is a
/// concatenation the operator asked for or a silent accident.
///
/// Kept as one match so the whole policy is visible in one place - the same
/// reason `claude_quota` and `dropped_stream` close their own classification
/// in one spot elsewhere in this codebase. Anything not listed defaults to
/// [`ArrayMerge::Replace`]: refusing is the safe default for a key nobody has
/// reasoned about yet, and a new array key added later has to be added here
/// deliberately to become appendable.
///
/// - `verify.e2e` / `verify.gate` — a "run all of these, all must exit 0"
///   gate. Concatenating two of them is exactly the checks both layers
///   wanted, which is what lets a common gate (e.g. `editorconfig-checker`)
///   live in a shared layer while a repository's own layer adds its own
///   command, instead of every repository copying the shared command into
///   its own file.
/// - `repos.roots` — a set of directories to scan for checkouts. A
///   repository adding its own root on top of the machine's is additive by
///   nature, not a replacement of where the machine looks; see
///   [`Repos::roots`].
///
/// Left on the refuse side, and why:
/// - `roles.implementers` / `roles.judges` / `roles.reviewers` — an ordered
///   list of *seats*, not a set. A machine's two implementers plus a
///   repository's one is three seats nobody asked for and nobody is paying
///   for on purpose.
/// - `notify.command` — an argv. Concatenating two argvs does not produce a
///   program that runs; it produces `["ntfy", "publish", "curl", "-X"]`.
/// - `blind.strip_lines` — technically safe to concatenate (each entry is
///   matched as an independent substring, so a longer list only strips
///   *more*), but left on the refuse side anyway: the same list also drives
///   `commit_msg_hook`'s generated `sed` addresses, where position matters,
///   and a silent three-layer merge is exactly the kind of surprise
///   `refuse_split_arrays` exists to catch rather than to reason about
///   case-by-case. A repository that wants one more stripped phrase restates
///   the whole list; that restatement is visible in review, an accidental
///   concatenation would not be.
fn array_merge_policy(key: &str) -> ArrayMerge {
    match key {
        "verify.e2e" | "verify.gate" | "verify.pre_gate" | "repos.roots" => ArrayMerge::Append,
        _ => ArrayMerge::Replace,
    }
}

impl Config {
    /// Load one file through teravars: Tera rendering, `[vars]` resolution,
    /// and the `include = [...]` directive.
    pub fn load(path: &Path) -> Result<Self> {
        Self::load_layers(&[path.to_path_buf()])
    }

    /// The Tera render context shared by every layer: `system.*` (from
    /// teravars), `env` (magi's own addition - a config that names a shared
    /// build-cache directory or a machine-specific path needs
    /// `{{ env.NAME | default(value='...') }}`), and `repo` / `repo_name`
    /// derived from the last (highest-priority) path's parent directory.
    ///
    /// Factored out so [`Config::array_provenance`] can re-render a single
    /// layer under the exact same context [`Config::load_layers`] uses for
    /// the joint render, rather than drifting from it by accident.
    fn render_ctx(paths: &[PathBuf]) -> teravars::Context {
        let mut ctx = teravars::system_context();
        let env: std::collections::BTreeMap<String, String> = std::env::vars().collect();
        ctx.insert("env", &env);
        if let Some(last) = paths.last()
            && let Some(dir) = last.parent()
        {
            // A layer extracted from `<remote>/<base>` records the checkout it
            // stands for beside itself; its own directory is a cache path.
            let dir = std::fs::read_to_string(dir.join(REPO_MARKER))
                .map(|s| PathBuf::from(s.trim()))
                .unwrap_or_else(|_| dir.to_path_buf());
            ctx.insert("repo", &dir.to_string_lossy());
            ctx.insert(
                "repo_name",
                &dir.file_name().unwrap_or_default().to_string_lossy(),
            );
        }
        ctx
    }

    /// Load and deep-merge a stack of config files, later files winning.
    ///
    /// This is why the config is TOML-through-teravars rather than plain serde:
    /// the roster is a *machine* fact (which CLIs and plans you pay for) while
    /// the gate is a *repository* fact (`cargo make check` here, `pnpm test`
    /// there). Picking one file and ignoring the other would force every repo
    /// to restate the roster.
    pub fn load_layers(paths: &[PathBuf]) -> Result<Self> {
        let mut engine = teravars::Engine::default();
        let ctx = Self::render_ctx(paths);
        if paths.len() > 1 {
            Self::refuse_split_arrays(paths, &mut engine, &ctx).map_err(|error| {
                if error.downcast_ref::<ConfigFailure>().is_some() {
                    error
                } else {
                    // Keep the actionable refusal visible to plain Display
                    // callers while retaining the structured failure identity.
                    let message = error.to_string();
                    error
                        .context(ConfigFailure::layers("config-merge", paths))
                        .context(message)
                }
            })?;
        }
        let merged = teravars::load_merged(paths, &mut engine, &ctx)
            .map_err(|error| {
                let cause = ConfigFailure::render(&error, paths);
                anyhow::Error::new(error).context(cause)
            })
            .with_context(|| {
                format!(
                    "rendering config via teravars: {}",
                    paths
                        .iter()
                        .map(|p| p.display().to_string())
                        .collect::<Vec<_>>()
                        .join(", ")
                )
            })?;
        let mut table = merged.config;
        Self::normalize_renamed_keys(paths, &mut engine, &ctx, &mut table)?;
        // `[vars]` is teravars' own input, already resolved into the render
        // context; `deny_unknown_fields` must not trip over it.
        table.remove("vars");
        // No layer says anything about `agents`: the roster is whatever is on
        // `PATH` now, exactly as when no layer exists at all. An explicit
        // `agents = []` is a statement and is kept.
        let detect_agents = !table.contains_key("agents");
        let mut cfg: Self = toml::Value::Table(table)
            .try_into()
            .context("deserializing magi config")
            .context(ConfigFailure::layers("config-deserialize", paths))?;
        crate::persona::validate(&cfg.talk.personas)?;
        cfg.worktree.validate()?;
        cfg.release.validate()?;
        if let Some(name) = cfg.talk.operator_name() {
            if name.chars().count() > OPERATOR_NAME_MAX || name.chars().any(char::is_control) {
                bail!(
                    "[talk] operator_name must be one line of at most {OPERATOR_NAME_MAX} characters"
                );
            }
        }
        if detect_agents {
            cfg.agents = Self::autodetected().agents;
        }
        Ok(cfg)
    }

    /// `graph.candidates` was renamed `graph.implementers`. Both spellings are
    /// read, but the layers are merged into one table before serde sees it, so
    /// an old name in a lower layer and the new name in a higher one would
    /// arrive together and fail as a duplicate field instead of letting the
    /// higher layer win. Resolve it here: a single layer that writes both is
    /// refused (naming both keys and the file); otherwise the value from the
    /// last layer that wrote either key becomes `implementers`.
    fn normalize_renamed_keys(
        paths: &[PathBuf],
        engine: &mut teravars::Engine,
        ctx: &teravars::Context,
        table: &mut toml::map::Map<String, toml::Value>,
    ) -> Result<()> {
        let both = matches!(
            table.get("graph"),
            Some(toml::Value::Table(g)) if g.contains_key("candidates") && g.contains_key("implementers")
        );
        if !both {
            return Ok(());
        }
        let mut winner: Option<toml::Value> = None;
        for path in paths {
            let one = teravars::load_merged([path], engine, ctx)
                .map_err(|error| {
                    let cause = ConfigFailure::render(&error, std::slice::from_ref(path));
                    anyhow::Error::new(error).context(cause)
                })
                .with_context(|| format!("rendering {}", path.display()))?;
            let Some(toml::Value::Table(g)) = one.config.get("graph") else {
                continue;
            };
            if g.contains_key("candidates") && g.contains_key("implementers") {
                bail!(
                    "`[graph]` sets both `implementers` and its deprecated alias \n                     `candidates` in {}; keep only `implementers`.",
                    path.display()
                );
            }
            if let Some(v) = g.get("implementers").or_else(|| g.get("candidates")) {
                winner = Some(v.clone());
            }
        }
        if let Some(toml::Value::Table(g)) = table.get_mut("graph") {
            g.remove("candidates");
            if let Some(v) = winner {
                g.insert("implementers".to_owned(), v);
            }
        }
        Ok(())
    }

    /// Refuse an array that two layers both declare, unless
    /// [`array_merge_policy`] says that key is meant to accumulate.
    ///
    /// teravars **appends** arrays when it merges layers, and that is wrong for
    /// most arrays magi has: `implementers` is an ordered list of seats,
    /// `notify.command` is an argv. Concatenating two of them yields something
    /// nobody wrote - three implementers out of a machine's two and a
    /// repository's one, or an argv of `["ntfy", "publish", "curl", "-X"]`.
    ///
    /// Replacing instead would be the right merge rule for those keys, but the
    /// rule lives in teravars, which several other projects depend on;
    /// changing it there is a decision for that crate, not something to fake
    /// here by re-reading the files with different semantics and hoping the
    /// two paths agree.
    ///
    /// So magi refuses the ambiguity rather than resolving it silently, for
    /// every array key except the short, deliberate list
    /// [`array_merge_policy`] marks [`ArrayMerge::Append`] - for those, the
    /// concatenation teravars already produces *is* what both files say, so
    /// there is nothing to refuse. The cost of guessing wrong on the refused
    /// keys is a roster the operator did not ask for and is paying for by the
    /// token; the append keys carry no such risk because every element runs
    /// (or every directory is scanned) regardless of order.
    fn refuse_split_arrays(
        paths: &[PathBuf],
        engine: &mut teravars::Engine,
        ctx: &teravars::Context,
    ) -> Result<()> {
        let mut seen: std::collections::BTreeMap<String, PathBuf> = Default::default();
        for path in paths {
            let one = teravars::load_merged([path], engine, ctx)
                .map_err(|error| {
                    let cause = ConfigFailure::render(&error, std::slice::from_ref(path));
                    anyhow::Error::new(error).context(cause)
                })
                .with_context(|| format!("rendering {}", path.display()))?;
            for key in array_keys(&one.config, "") {
                if array_merge_policy(&key) == ArrayMerge::Append {
                    continue;
                }
                if let Some(first) = seen.get(&key) {
                    bail!(
                        "`{key}` is an array declared in two config layers:\n  \
                         {}\n  {}\nteravars appends arrays when it merges, so \
                         magi would run the concatenation of both - which is \
                         not what either file says. Declare `{key}` in exactly \
                         one of them.",
                        first.display(),
                        path.display()
                    );
                }
                seen.insert(key, path.clone());
            }
        }
        Ok(())
    }

    /// Which layers contributed to a composed, appendable array key (e.g.
    /// `"verify.gate"`), in the same low-to-high-priority order
    /// [`Config::load_layers`] concatenates them in. Layers that do not
    /// declare `key` at all are omitted.
    ///
    /// This is a **display aid for `magi doctor` only.** The command list
    /// that actually runs always comes from the one joint
    /// [`teravars::load_merged`] call in `load_layers`, never from this
    /// function - the exact hazard [`Config::refuse_split_arrays`] warns
    /// about is two merge paths that might disagree, so this function must
    /// never become a second source of the *composed* value, only of which
    /// file wrote which line in it.
    ///
    /// Re-rendering each layer alone can, in principle, resolve a
    /// `{{ vars.x }}` differently than the joint render would, if `x` is
    /// defined in one layer and referenced in another - the same caveat
    /// `refuse_split_arrays`'s structural, key-only check already lives with.
    /// None of magi's own gate commands cross that line, and a doctor listing
    /// is read by a human who can compare it against the joint one printed
    /// alongside it, so this is judged worth the simplicity of not
    /// threading provenance through the real load path.
    pub fn array_provenance(paths: &[PathBuf], key: &str) -> Vec<(PathBuf, Vec<String>)> {
        let mut engine = teravars::Engine::default();
        let ctx = Self::render_ctx(paths);
        let mut out = Vec::new();
        for path in paths {
            let Ok(one) = teravars::load_merged([path], &mut engine, &ctx) else {
                continue;
            };
            let mut cur = &one.config;
            let mut found = None;
            let parts: Vec<&str> = key.split('.').collect();
            for (i, part) in parts.iter().enumerate() {
                match cur.get(*part) {
                    Some(toml::Value::Array(a)) if i == parts.len() - 1 => {
                        found = Some(a);
                        break;
                    }
                    Some(toml::Value::Table(t)) => cur = t,
                    _ => break,
                }
            }
            let Some(values) = found else { continue };
            let strings: Vec<String> = values
                .iter()
                .filter_map(|v| v.as_str().map(str::to_owned))
                .collect();
            if !strings.is_empty() {
                out.push((path.clone(), strings));
            }
        }
        out
    }

    /// Each layer rendered on its own, with the outcome per file: the
    /// settings screen's way of saying which layer a value came from and which
    /// layer is the one that does not parse. A **display aid only**, for the
    /// same reason as [`Config::array_provenance`]: the effective config
    /// always comes from the one joint [`Config::load_layers`].
    pub(crate) fn layer_tables(paths: &[PathBuf]) -> Vec<(PathBuf, Result<toml::Table>)> {
        let mut engine = teravars::Engine::default();
        let ctx = Self::render_ctx(paths);
        paths
            .iter()
            .map(|path| {
                let one = teravars::load_merged([path], &mut engine, &ctx)
                    .map(|m| m.config)
                    .with_context(|| format!("rendering {}", path.display()));
                (path.clone(), one)
            })
            .collect()
    }

    /// Render a composed command list for `magi doctor`: the joined command
    /// line the run actually uses, plus - only when more than one layer
    /// contributed - which layer wrote which line.
    ///
    /// A single contributing layer (the common case today) stays the plain
    /// one-line summary magi has always printed, `empty` included: that
    /// honest "(none — ...)" is what caught a real gate-composition gap
    /// before this array could compose at all, and composition should not
    /// make the common case noisier.
    pub fn describe_composed(
        paths: &[PathBuf],
        commands: &[String],
        key: &str,
        empty: &str,
    ) -> String {
        if commands.is_empty() {
            return empty.to_owned();
        }
        let joined = commands.join(" && ");
        let provenance = Self::array_provenance(paths, key);
        if provenance.len() <= 1 {
            return joined;
        }
        let mut out = joined;
        for (path, cmds) in &provenance {
            out.push_str(&format!("\n    [{}] {}", path.display(), cmds.join(" && ")));
        }
        out
    }

    /// Resolve the config for `repo`, honouring an explicit `--config` path.
    ///
    /// Returns the config and the layers it came from, empty for built-in
    /// defaults. The repository layers come from the remote-tracking ref as it
    /// stands (see the module doc); use [`Config::discover_fetched`] where a
    /// stale ref would matter.
    pub fn discover(repo: &Path, explicit: Option<&Path>) -> Result<(Self, Vec<PathBuf>)> {
        #[cfg(test)]
        crate::web::request_cost::discovery();
        if let Some(p) = explicit {
            let paths = vec![p.to_path_buf()];
            return Ok((Self::load_layers(&paths)?, paths));
        }
        let paths = Self::layers_checked(repo)?;
        if paths.is_empty() {
            return Ok((Self::autodetected(), paths));
        }
        Ok((Self::load_layers(&paths)?, paths))
    }

    /// [`Config::discover`] after `git fetch <remote> <base>`: for every path
    /// that is about to start work. A failed fetch is an error.
    pub async fn discover_fetched(
        repo: &Path,
        explicit: Option<&Path>,
    ) -> Result<(Self, Vec<PathBuf>)> {
        if explicit.is_none() && is_git_worktree(repo) {
            // A checkout that was never cloned from the remote has no
            // `<remote>/HEAD`; learn it here (refs/remotes only) so an
            // ordinary start recovers instead of failing in `discover`.
            let (remote, cfg_base) = probe_remote_base(repo);
            let base = crate::git::merge_base_branch(repo, &remote, cfg_base.as_deref())
                .await
                .with_context(|| ConfigFailure {
                    stage: "config-base",
                    target: remote.clone(),
                })?;
            let out = crate::git::fetch(repo, &remote, &base)
                .await
                .with_context(|| format!("fetching {remote}/{base} to read magi.toml"))
                .with_context(|| ConfigFailure {
                    stage: "config-fetch",
                    target: format!("{remote}/{base}"),
                })?;
            if !out.ok() {
                return Err(anyhow::anyhow!(
                    "cannot read magi.toml: `git fetch {remote} {base}` failed ({});                      refusing to use the local checkout's copy, which may be stale",
                    out.stderr.lines().next().unwrap_or("").trim()
                )).context(ConfigFailure { stage: "config-fetch", target: format!("{remote}/{base}") });
            }
            if cfg_base.is_none() {
                crate::git::ensure_remote_head(repo, &remote, &base).await;
            }
        }
        Self::discover(repo, explicit).map_err(|error| {
            if error.downcast_ref::<ConfigFailure>().is_some() {
                error
            } else {
                error.context(ConfigFailure {
                    stage: "config-load",
                    target: explicit.unwrap_or(repo).to_string_lossy().into_owned(),
                })
            }
        })
    }

    /// [`Config::layers`], but an unreadable remote ref is an error.
    fn layers_checked(repo: &Path) -> Result<Vec<PathBuf>> {
        if !is_git_worktree(repo) {
            return Ok(Self::layers(repo));
        }
        let mut paths: Vec<PathBuf> = Self::machine_layer()
            .into_iter()
            .filter(|p| p.is_file())
            .collect();
        paths.extend(Self::repo_layers(repo)?);
        Ok(paths)
    }

    /// Describe a repository layer without directing the operator to its cache.
    pub(crate) fn repo_layer_description(repo: &Path, path: &Path) -> String {
        let cached = path.ancestors().find(|p| p.join(REPO_MARKER).is_file());
        if let Some(root) = cached {
            let relative = path.strip_prefix(root).unwrap_or(path);
            let reference = resolve_remote_base(repo)
                .map(|(remote, base)| format!("{remote}/{base}"))
                .unwrap_or_else(|_| "remote base".to_owned());
            format!(
                "{} at {reference} (including its includes)",
                repo.join(relative).display()
            )
        } else {
            format!("{} (including its includes)", path.display())
        }
    }

    /// Only the repository layers (lowest first), from `<remote>/<base>` in a
    /// git working tree and from disk elsewhere.
    pub(crate) fn repo_layers(repo: &Path) -> Result<Vec<PathBuf>> {
        if !is_git_worktree(repo) {
            return Ok([
                repo.join(".magi").join("config.toml"),
                repo.join("magi.toml"),
            ]
            .into_iter()
            .filter(|p| p.is_file())
            .collect());
        }
        remote_layers(repo)
    }

    /// Environment variable that relocates the machine-wide config layer.
    ///
    /// Set it to a directory and magi reads `<dir>/magi/config.toml` instead
    /// of the one under [`dirs::config_dir`]; set it to the empty string and
    /// magi reads no machine layer at all.
    ///
    /// This exists because the machine layer is otherwise unavoidable, and a
    /// test that builds a config fixture is not asking for the operator's
    /// preferences to be merged into it. Adding `[repos] roots` to the real
    /// machine config on a development box turned two passing tests red -
    /// `repos_list_returns_name_and_path_for_every_configured_root` and
    /// `repos_list_only_rescans_within_the_ttl_when_asked_to`, whose fixtures
    /// declare `[repos] roots` of their own, which [`Config::layers`] then
    /// found in two layers and [`Config::refuse_split_arrays`] correctly
    /// refused. CI never saw it: a runner has no machine config, so the suite
    /// was green there and red only where somebody actually uses magi.
    ///
    /// An operator gets the same escape hatch for free: a second machine
    /// config, or none, without moving files about.
    pub const CONFIG_DIR_ENV: &str = "MAGI_CONFIG_DIR";

    /// Every config layer that applies to `repo`, in increasing precedence.
    ///
    /// The machine layer is whatever [`Config::machine_layer`] resolves to,
    /// which is nothing at all in a test build.
    pub fn layers(repo: &Path) -> Vec<PathBuf> {
        let mut paths = Vec::new();
        paths.extend(Self::machine_layer());
        paths.push(repo.join(".magi").join("config.toml"));
        paths.push(repo.join("magi.toml"));
        paths.retain(|p| p.is_file());
        paths
    }

    /// The machine-wide layer's path, when there is one.
    ///
    /// **A test build has none unless it names one.** A fixture is a complete
    /// statement of the config under test, and the operator's own preferences
    /// have no business being merged into it - least of all silently, on one
    /// machine, in a suite that is green everywhere else.
    #[cfg(test)]
    pub(crate) fn machine_layer() -> Option<PathBuf> {
        std::env::var(Self::CONFIG_DIR_ENV)
            .ok()
            .filter(|dir| !dir.trim().is_empty())
            .map(|dir| PathBuf::from(dir).join("magi").join("config.toml"))
    }

    /// The machine-wide layer's path, when there is one.
    #[cfg(not(test))]
    pub(crate) fn machine_layer() -> Option<PathBuf> {
        match std::env::var(Self::CONFIG_DIR_ENV) {
            // Named, and empty on purpose: no machine layer.
            Ok(dir) if dir.trim().is_empty() => None,
            Ok(dir) => Some(PathBuf::from(dir).join("magi").join("config.toml")),
            Err(_) => dirs::config_dir().map(|dir| dir.join("magi").join("config.toml")),
        }
    }

    /// Built-in config whose roster is the agent CLIs found on `PATH`.
    pub fn autodetected() -> Self {
        let mut cfg = Self::default();
        for (kind, id, model) in [
            (AgentKind::Claude, "opus", Some("opus")),
            (AgentKind::Claude, "sonnet", Some("sonnet")),
            (AgentKind::Antigravity, "antigravity", None),
            (AgentKind::Opencode, "opencode", None),
            (AgentKind::Codex, "codex", None),
            (AgentKind::Omp, "omp", None),
        ] {
            if kind.program().is_some_and(which) && !cfg.agents.iter().any(|a| a.id == id) {
                cfg.agents.push(AgentSpec {
                    id: id.to_owned(),
                    kind,
                    model: model.map(str::to_owned),
                    command: Vec::new(),
                    extra_args: Vec::new(),
                    env: BTreeMap::new(),
                    prompt_delivery: None,
                    max_turn_secs: None,
                });
            }
        }
        cfg
    }

    /// The shared build cache the verify commands and the agents both build
    /// into, when the config declares one. See [`Verify::cache_dir`].
    pub fn cache_dir(&self) -> Option<PathBuf> {
        self.verify.cache_dir()
    }

    /// Look an agent up by id.
    pub fn agent(&self, id: &str) -> Result<&AgentSpec> {
        self.agents
            .iter()
            .find(|a| a.id == id)
            .with_context(|| format!("no agent with id `{id}` in the roster"))
    }

    /// Rotate `count` seats out of `ids`, or out of the whole roster at
    /// `offset` when `ids` is empty.
    ///
    /// The one rotation rule - explicit ids cycle, an empty list rotates the
    /// roster - shared by every seat count [`Config::resolve_roles`] fills in,
    /// rather than each seat reimplementing it and drifting apart.
    fn rotate(&self, ids: &[String], count: usize, offset: usize) -> Result<Vec<AgentSpec>> {
        let mut out = Vec::with_capacity(count);
        for i in 0..count {
            let spec = if ids.is_empty() {
                self.agents[(i + offset) % self.agents.len()].clone()
            } else {
                self.agent(&ids[i % ids.len()])?.clone()
            };
            out.push(spec);
        }
        Ok(out)
    }

    /// `ids`, resolved to specs in the order named, or the whole `[[agents]]`
    /// roster in file order when `ids` is empty — the same "explicit ids
    /// stand alone, an empty list means the whole roster" rule [`Self::rotate`]
    /// applies, but with no `count` to truncate to and no `offset` to wrap by.
    /// See [`ResolvedRoles::implementer_roster`] for why a truncated, rotated
    /// list cannot answer the question this exists for.
    fn full_roster(&self, ids: &[String]) -> Result<Vec<AgentSpec>> {
        if ids.is_empty() {
            Ok(self.agents.clone())
        } else {
            ids.iter().map(|id| self.agent(id).cloned()).collect()
        }
    }

    /// Fill the roles out to the configured widths.
    ///
    /// An empty role list rotates through the whole roster, so a three-agent
    /// roster with `implementers = 3` gives one implementation per agent, and
    /// `judges = 3` rotates the judge seats by one so that judge *i* is not the
    /// author of candidate *i* whenever the roster has more than one agent.
    pub fn resolve_roles(&self) -> Result<ResolvedRoles> {
        if self.agents.is_empty() {
            bail!(
                "agent roster is empty: no agent CLI found on PATH and no \
                 [[agents]] in the config. Run `magi init` to write a starter \
                 magi.toml."
            );
        }
        let pinned = self
            .graph
            .selected_implementer
            .as_ref()
            .map(|id| self.agent(id).cloned())
            .transpose()?;
        Ok(ResolvedRoles {
            implementers: match &pinned {
                Some(agent) => vec![agent.clone()],
                None => self.rotate(&self.roles.implementers, self.graph.implementers, 0)?,
            },
            judges: self.rotate(&self.roles.judges, self.graph.judges, 1)?,
            reviewers: self.rotate(&self.roles.reviewers, self.graph.reviewers, 0)?,
            fixer: match self.roles.fixer.as_ref() {
                // Ids are validated against the roster here; whether the CLI
                // is installed is left to invocation, like every other seat.
                Some(choice) => Some(crate::agent::pick_chain(
                    &self.agents,
                    Some(choice),
                    &|_| true,
                    "fixer",
                )?),
                None => None,
            },
            // Role resolution validates roster shape, but deliberately does
            // not preflight a CLI. The other graph seats have always deferred
            // that failure to invocation; doing it only for the conductor
            // made otherwise usable graph commands and `doctor` fail as one.
            conductor: match self.roles.conductor.as_ref().map(AgentChoice::ids) {
                Some(ids) if ids.len() == 1 => self.agent(ids[0])?.clone(),
                // A fallback chain: the first id the roster knows. The rest
                // are `agent::pick_chain`'s business at invocation.
                Some(ids) if !ids.is_empty() => ids
                    .iter()
                    .find_map(|id| self.agent(id).ok())
                    .cloned()
                    .with_context(|| {
                        format!("[roles] conductor names no agent in the roster: {ids:?}")
                    })?,
                // Keep the normal standalone-seat preference when something
                // is installed, but retain a roster fallback when it is not.
                // Invocation then reports the unavailable CLI in the same
                // place it does for every other graph role.
                _ => crate::agent::pick(&self.agents, None, &crate::agent::installed)
                    .unwrap_or_else(|_| self.agents[0].clone()),
            },
            implementer_roster: match pinned {
                Some(agent) => vec![agent],
                None => self.full_roster(&self.roles.implementers)?,
            },
            judge_roster: self.full_roster(&self.roles.judges)?,
            reviewer_roster: self.full_roster(&self.roles.reviewers)?,
        })
    }

    /// Advisor seats for the design-deliberation stage (see
    /// `graph::Runner::advise`): `[roles] advisors` when set, otherwise the
    /// judge roster - see [`Roles::advisors`] for why that fallback and not
    /// the whole roster.
    ///
    /// The fallback rotates with `offset = 1`, matching the judges line in
    /// [`Config::resolve_roles`] exactly, `ids` and offset both - not just
    /// `roles.judges`, which is empty whenever judges themselves are
    /// unconfigured and rotating the whole roster. Falling back with
    /// `offset = 0` there would silently hand the advisors a *different*
    /// agent set than the judges an unconfigured run would actually get,
    /// which is the one thing [`Roles::advisors`]'s doc promises will not
    /// happen.
    ///
    /// Called lazily from the graph node itself rather than folded into
    /// [`Config::resolve_roles`]: unlike the other roles, a failure here must
    /// not stop a run from starting at all - the deliberation stage is an
    /// enrichment `[graph] advise` can turn off, not a seat later nodes
    /// cannot proceed without - and at the point `resolve_roles` runs (before
    /// [`crate::run::RunState`] exists, on `Runner::start`) there would be no
    /// run yet for a resolution failure to be reported against.
    pub fn advisors(&self) -> Result<Vec<AgentSpec>> {
        if self.agents.is_empty() {
            bail!(
                "agent roster is empty: no agent CLI found on PATH and no \
                 [[agents]] in the config. Run `magi init` to write a starter \
                 magi.toml."
            );
        }
        if !self.roles.advisors.is_empty() {
            return self.rotate(&self.roles.advisors, self.graph.advisors, 0);
        }
        self.rotate(&self.roles.judges, self.graph.advisors, 1)
    }

    /// The untruncated roster advisor seats hand over along: `[roles]
    /// advisors` when set, otherwise the judges' roster, exactly as
    /// [`Self::advisors`] chooses its own list.
    pub fn advisor_roster(&self) -> Result<Vec<AgentSpec>> {
        if self.roles.advisors.is_empty() {
            self.full_roster(&self.roles.judges)
        } else {
            self.full_roster(&self.roles.advisors)
        }
    }

    /// Shell prefix for [`Verify`] commands.
    pub fn shell(&self) -> Vec<String> {
        if let Some(s) = &self.verify.shell {
            return s.clone();
        }
        if which("sh") {
            vec!["sh".to_owned(), "-c".to_owned()]
        } else {
            vec!["cmd".to_owned(), "/C".to_owned()]
        }
    }

    /// Starter config, as written by `magi init`.
    pub fn starter_toml() -> String {
        let detected = Self::autodetected();
        let mut s = String::from(
            "# magi — blind multi-agent implementation competition.\n\
             # `magi run \"<task>\"` walks: implement (N parallel worktrees)\n\
             #   -> blind judging -> deliberation -> private final vote\n\
             #   -> fold losers -> review + E2E loop -> gate -> merge.\n\
             #\n\
             # Rendered by teravars: a `[vars]` table, env\n\
             # and system lookups, and `include = [...]` all work. Tera\n\
             # braces are live everywhere in this file, but comments are\n\
             # stripped before rendering (teravars >= 0.2.2), so a comment\n\
             # may quote `{{ ... }}` freely.\n\
             #\n\
             # Layers deep-merge in increasing\n\
             # precedence, so the roster can live once per machine in\n\
             # <config_dir>/magi/config.toml and each repo only states its own\n\
             # gate:\n\
             #   <config_dir>/magi/config.toml  <  .magi/config.toml  <  magi.toml\n\n\
             [vars]\n\
             # Reference it as vars.cache inside Tera braces, anywhere below.\n\
             # Single quotes inside the braces: teravars renders the raw file\n\
             # text, so TOML's own \\\" escaping never reaches Tera.\n\
             cache = \"{{ env.MAGI_CACHE | default(value='/tmp') }}\"\n\n",
        );
        if detected.agents.is_empty() {
            s.push_str(
                "# No agent CLI was found on PATH. Fill this in by hand.\n\
                 # kind = claude | opencode | antigravity | codex | command\n\
                 [[agents]]\nid = \"opus\"\nkind = \"claude\"\nmodel = \"opus\"\n\n",
            );
        } else {
            for a in &detected.agents {
                s.push_str("[[agents]]\n");
                s.push_str(&format!("id = {:?}\n", a.id));
                s.push_str(&format!("kind = {:?}\n", a.kind.as_str()));
                if let Some(m) = &a.model {
                    s.push_str(&format!("model = {m:?}\n"));
                }
                s.push('\n');
            }
        }
        s.push_str(
            "# Leave a role list empty to rotate through the roster.\n\
             # A non-empty list is also an ordered backup list: seats take entries from the\n\
             # front (see [graph] counts) and a failed or out-of-quota seat moves on to the\n\
             # next agent to its right, each tried once. Same for judges and reviewers.\n\
             # implementers = [\"opus\", \"codex\", \"sonnet\"]  # with implementers = 1 below: opus sits, codex then sonnet are spares\n\
             [roles]\n\
             implementers = []\n\
             judges = []\n\
             reviewers = []\n\
             # conductor = \"opus\"  # arranges the queue; unset picks a seat like chatter does\n\
             # synthesizer = \"opus\"  # blends the advisors into one brief; unset picks a seat like chatter does\n\
             # synthesizer = [\"opus\", \"codex\"]  # array form: fallback chain, each tried once on quota or failure\n\
             # language_judge = \"jev\"  # kind = \"command\" wrapper deciding if PR text is English; unset keeps the built-in heuristics\n\
             # dupes_judge = \"opus\"  # judges duplicate-work claims; unset inherits chatter (string or fallback chain)\n\
             # fixer = \"opus\"  # applies review findings; unset keeps the winner's own author\n\
             # fixer = [\"opus\", \"codex\"]  # array form: fallback chain, each tried once on quota or failure\n\n\
             [graph]\n\
             # Gate GitHub prose; secret redaction is always enabled.\n\
             github_text_guard = true\n\
             # Language of PR / issue titles, bodies and comments; non-English drops the English-only check (commits stay English).\n\
             github_language = \"en\"\n\
             implementers = 3\n\
             judges = 3\n\
             deliberate_rounds = 1\n\
             reviewers = 3\n\
             review_rounds = 6\n\
             # Fix rounds a failing verify.gate gets before the run is blocked (0 = none).\n\
             gate_fix_rounds = 1\n\
             # Rerun a failed required CI check once before a land fix round (flaky tests).\n\
             rerun_flaky_checks = true\n\
             # Port the strengths judges named in the losing candidates onto the\n\
             # winner before review (best-effort; rolled back on failure or a big diff).\n\
             graft_runner_up = true\n\
             max_parallel = 4\n\
             language = \"en\"\n\
             # One CLI conversation per seat: judges keep their own argument\n\
             # across deliberation, the fixer keeps its implementation context.\n\
             sessions = true\n\
             # Reviewer-seat timeout. When timeout_verify is omitted, E2E and\n\
             # the final gate inherit this value for compatibility.\n\
             timeout_review = 1200\n\
             # Optional independent E2E/final-gate timeout; uncomment to keep\n\
             # verification independent if timeout_review changes later.\n\
             # timeout_verify = 1200\n\
             # Longest a seat waits for the shared build cache before it is\n\
             # spawned. Never counted against an agent's own timeout; expiry\n\
             # holds the run (resumable) instead of failing the agent.\n\
             # timeout_resource_wait = 1800\n\n\
             # What the chat calls you (persona address and the Chat's turn label).\n\
             # [talk]\n\
             # operator_name = \"Commander\"\n\n\
             # Chat personas (tone only; the web Chat picks one per conversation).\n\
             # Built in: magi, rei, misato, ritsuko, shinji, asuka, kaworu. Entries add to\n\
             # them, and one with a built-in's id replaces it. `default` is the plain\n\
             # voice and cannot be redefined (it may only set `icon`). Declare this in one\n\
             # layer only. `icon` is an optional avatar, display only: an absolute or\n\
             # ~/ path to a png/jpg/gif/webp, or a data:image/...;base64 URI, up to\n\
             # 256 KiB; a missing or bad one falls back to the built-in avatar.\n\
             # [[talk.personas]]\n\
             # id = \"gendo\"\n\
             # name = \"Gendo Ikari\"\n\
             # prompt = \"Speak coldly and tersely, hands folded.\"\n\
             # icon = \"~/pictures/gendo.png\"\n\n\
             [verify]\n\
             # Run once per review round in the winner's worktree; failures are\n\
             # fed back to the fixer.\n\
             e2e = []\n\
             # Final gate. Every command must exit 0 before a merge.\n\
             gate = []\n\
             # Mechanical fixers (formatters) run in the winner's worktree just\n\
             # before the gate; whatever they change becomes one commit. A failing\n\
             # command only warns - the gate stays the arbiter. Same timeout as the\n\
             # gate (timeout_verify). Keep it light and idempotent.\n\
             # pre_gate = []\n\n\
             # Prepare each worktree magi creates (candidates, judges, advisors,\n\
             # reviewers, the operator-fix and review-takeover checkouts), in order,\n\
             # before any agent or verify command touches it. `copy` reads from the\n\
             # primary checkout and never overwrites; `optional` skips a missing\n\
             # source. `run` goes through the shell with the worktree as cwd and\n\
             # fails the seat on a non-zero exit or timeout (timeout_secs, default\n\
             # the verify timeout). Setup must not edit tracked files, and what it\n\
             # leaves untracked is kept out of magi's commits. Declare this in one\n\
             # layer only.\n\
             # [worktree]\n\
             # setup = [\n\
             #   { copy = \".env.example -> .env\" },\n\
             #   { copy = \".env.local\", optional = true },\n\
             #   { run = \"pnpm install --frozen-lockfile\", timeout_secs = 900 },\n\
             # ]\n\n\
             [merge]\n\
             # none | local | pr\n\
             mode = \"none\"\n\
             # expected (default) | none. Set none only in repository config without CI.\n\
             # Ignores all check statuses; reviews and approval still apply.\n\
             # ci = \"expected\"\n\
             # release_bump = true  # Rust (Cargo.toml) repositories only; a no-op elsewhere\n\n\
             [update]\n\
             # off | notify | install — checked in the background, throttled.\n\
             mode = \"notify\"\n\
             # interval = \"24h\"\n\n\
             # Opt-in: magi web updates and restarts only after runs/chats finish.\n\
             # auto_restart = false\n\
             # Uses interval above; off / MAGI_NO_AUTOUPDATE disable it.\n\
             # Standalone magi serve cannot restart. Busy work waits indefinitely.\n\
             # Failed tags are skipped until process restart or a different tag.\n\
             # Older binaries reject auto_restart: upgrade before adding the key.\n\n\
             [daemon]\n\
             # Minutes a release-bump pull request (chore/release-v*) may sit with\n\
             # no new commit and no check changing state before `magi serve`\n\
             # notices and asks you. A failed check is rerun once on its own;\n\
             # still red after that escalates at once. 0 turns the watcher off.\n\
             # release_stall_minutes = 60\n\n\
             [release]\n\
             # actions (default) | local. \"local\" is for repositories whose GitHub\n\
             # Actions never run (private, no minutes): the release pull request\n\
             # does not wait for CI, you approve the merge in magi, and then\n\
             # `magi serve` pushes the vX.Y.Z tag (never over an existing one) and\n\
             # runs `commands` from a clean checkout of the merge commit. A\n\
             # failure holds the release with a notice; it is never retried blind.\n\
             # Needs `magi serve` running and [daemon] release_stall_minutes > 0.\n\
             # For ordinary pull requests without CI, also set [merge] ci = \"none\".\n\
             # mode = \"actions\"\n\
             # Run in order; the first failure stops. They see MAGI_RELEASE_VERSION,\n\
             # MAGI_RELEASE_TAG, MAGI_RELEASE_COMMIT and MAGI_RELEASE_PR. Make them\n\
             # safe to repeat: a crash mid-command is treated as unfinished.\n\
             # commands = [\"cargo build --release\", \"gh release create \\\"$MAGI_RELEASE_TAG\\\" --generate-notes\"]\n\
             # timeout_minutes = 30\n\
             # Repositories whose Cargo.toml is not at the root (e.g. a Tauri app).\n\
             # The first entry is the version of record and must be the file the\n\
             # repository's auto-tag.yml reads (kind \"cargo\"); the others are\n\
             # rewritten to the same version. Paths are relative to the repository\n\
             # root. Cargo.lock beside the first entry follows; package-lock.json\n\
             # is not touched.\n\
             # version_files = [\n\
             #   { path = \"src-tauri/Cargo.toml\", kind = \"cargo\" },\n\
             #   { path = \"package.json\", kind = \"json\" },\n\
             #   { path = \"src-tauri/tauri.conf.json\", kind = \"json\" },\n\
             # ]\n",
        );
        s
    }
}

/// Is `program` on `PATH`?
pub fn which(program: &str) -> bool {
    find_program(program).is_some()
}

/// The file a bare `program` name resolves to on `PATH`, the way the OS shell
/// would find it.
///
/// Spawn agents through this, not by bare name: on Windows Rust's std
/// only tries `name.exe`, so a CLI installed as an npm `.cmd` shim (codex
/// since its 2026-09-23 reinstall) is "not found" even though a shell runs it.
/// On Windows an extensionless file is never a match: npm writes an `sh`
/// script beside every `.cmd` shim, and spawning that fails with os error 193.
pub fn find_program(program: &str) -> Option<PathBuf> {
    find_program_on(program, &std::env::var_os("PATH")?)
}

/// [`find_program`] against an explicit `PATH`, for a child whose environment
/// overrides it.
pub fn find_program_on(program: &str, paths: &std::ffi::OsStr) -> Option<PathBuf> {
    let pathext = std::env::var("PATHEXT").unwrap_or_else(|_| ".EXE;.CMD;.BAT".into());
    find_program_in(program, paths, cfg!(windows).then_some(pathext.as_str()))
}

fn find_program_in(
    program: &str,
    paths: &std::ffi::OsStr,
    pathext: Option<&str>,
) -> Option<PathBuf> {
    let p = Path::new(program);
    if p.components().count() > 1 {
        return p.is_file().then(|| p.to_path_buf());
    }
    std::env::split_paths(paths).find_map(|dir| match pathext {
        Some(exts) => {
            let bare = dir.join(program);
            if p.extension().is_some() && bare.is_file() {
                return Some(bare);
            }
            exts.split(';')
                .filter(|e| !e.is_empty())
                .map(|e| dir.join(format!("{program}{}", e.to_lowercase())))
                .find(|c| c.is_file())
        }
        None => Some(dir.join(program)).filter(|c| c.is_file()),
    })
}

/// Sidecar naming the checkout an extracted layer stands for.
const REPO_MARKER: &str = ".magi-repo";

fn git_out(repo: &Path, args: &[&str]) -> Option<String> {
    use crate::proc::Quiet as _;
    #[cfg(test)]
    crate::web::request_cost::git();
    let out = std::process::Command::new("git")
        .args(args)
        .quiet()
        .current_dir(repo)
        .stdin(std::process::Stdio::null())
        .output()
        .ok()?;
    out.status
        .success()
        .then(|| String::from_utf8_lossy(&out.stdout).into_owned())
}

/// Is `repo` inside a git working tree? A directory that is not has no branch
/// to be stale against, so its files are read as they are.
fn is_git_worktree(repo: &Path) -> bool {
    git_out(repo, &["rev-parse", "--git-dir"]).is_some()
}

/// Approval switches whose reviewed-branch values can only add owner holds.
/// Keep the allowlist and base-value lookup together when adding a switch.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum OwnerHold {
    /// Ask before every merge.
    LandApproval,
    /// Ask when internal review remains contested.
    HoldContestedMerge,
}

impl OwnerHold {
    /// Complete allowlist of additive approval switches.
    pub const ALL: [Self; 2] = [Self::LandApproval, Self::HoldContestedMerge];

    /// TOML key in the graph table.
    pub fn key(self) -> &'static str {
        match self {
            Self::LandApproval => "land_approval",
            Self::HoldContestedMerge => "hold_contested_merge",
        }
    }

    /// Value from the trusted configuration snapshot.
    pub fn base_value(self, graph: &Graph) -> bool {
        match self {
            Self::LandApproval => graph.land_approval,
            Self::HoldContestedMerge => graph.hold_contested_merge,
        }
    }
}

/// Literal true values only: no defaults, includes, rendering or other config.
/// Both repository files contribute monotonically, independent of precedence.
pub async fn branch_owner_holds(
    repo: &Path,
    head: &str,
) -> (Vec<(OwnerHold, String)>, Vec<String>) {
    let mut holds = Vec::new();
    let mut diagnostics = Vec::new();
    // Git can report a missing path even when the commit itself is absent.
    // Distinguish that read failure before treating missing files as normal.
    if let Err(error) =
        crate::git::git(repo, &["cat-file", "-e", &format!("{head}^{{commit}}")]).await
    {
        diagnostics.push(format!("cannot read reviewed commit {head}: {error:#}"));
        return (holds, diagnostics);
    }
    for file in ["magi.toml", ".magi/config.toml"] {
        let object = format!("{head}:{file}");
        let text = match crate::git::git(repo, &["show", &object]).await {
            Ok(text) => text,
            Err(error) => {
                // Absence is normal; other read failures remain auditable.
                let error = format!("{error:#}");
                if !error.contains("does not exist in")
                    && !error.contains("exists on disk, but not in")
                {
                    diagnostics.push(format!(
                        "cannot read reviewed branch {file} at {head}: {error}"
                    ));
                }
                continue;
            }
        };
        let value = match toml::from_str::<toml::Value>(&text) {
            Ok(value) => value,
            Err(error) => {
                diagnostics.push(format!(
                    "cannot parse reviewed branch {file} at {head}: {error}"
                ));
                continue;
            }
        };
        if value.get("include").is_some() || text.contains("{{") || text.contains("{%") {
            diagnostics.push(format!("reviewed branch {file} at {head}: only literal owner holds are read; includes and templates are ignored"));
        }
        for hold in OwnerHold::ALL {
            if value
                .get("graph")
                .and_then(|g| g.get(hold.key()))
                .and_then(toml::Value::as_bool)
                == Some(true)
            {
                holds.push((hold, file.to_owned()));
            }
        }
    }
    (holds, diagnostics)
}

#[derive(Deserialize, Default)]
struct ProbeMerge {
    base: Option<String>,
    remote: Option<String>,
}

#[derive(Deserialize, Default)]
struct Probe {
    merge: Option<ProbeMerge>,
}

/// `[merge]` base / remote from one file, nothing else. The file is rendered
/// (env templates, includes) exactly as a real load would, so a machine layer
/// saying `base = "{{ env.X }}"` locates the same ref; when rendering fails
/// (a checkout file that needs its own repo context) the plain TOML is read
/// instead. Unreadable is `None`: the real load reports it.
fn probe_merge(path: &Path, repo: &Path) -> Option<ProbeMerge> {
    if !path.is_file() {
        return None;
    }
    let paths = [path.to_path_buf()];
    let mut engine = teravars::Engine::default();
    let mut ctx = Config::render_ctx(&paths);
    // The layered load renders every layer for the checkout being resolved;
    // so does this, or `{{ repo_name }}` would name the file's own directory.
    ctx.insert("repo", &repo.to_string_lossy());
    ctx.insert(
        "repo_name",
        &repo.file_name().unwrap_or_default().to_string_lossy(),
    );
    if let Ok(merged) = teravars::load_merged(&paths, &mut engine, &ctx)
        && let Ok(probe) = toml::Value::Table(merged.config).try_into::<Probe>()
    {
        return probe.merge;
    }
    let text = std::fs::read_to_string(path).ok()?;
    toml::from_str::<Probe>(&text).ok()?.merge
}

/// The `[merge] remote` / `base` the layers name, before any git lookup.
fn probe_remote_base(repo: &Path) -> (String, Option<String>) {
    let mut remote = None;
    let mut base = None;
    let mut sources: Vec<PathBuf> = Config::machine_layer().into_iter().collect();
    sources.push(repo.join("magi.toml"));
    sources.push(repo.join(".magi").join("config.toml"));
    for path in sources {
        if let Some(m) = probe_merge(&path, repo) {
            remote = remote.or(m.remote.filter(|s| !s.trim().is_empty()));
            base = base.or(m.base.filter(|s| !s.trim().is_empty()));
        }
    }
    (remote.unwrap_or_else(|| "origin".to_owned()), base)
}

/// Where the remote ref is: see the module doc for the order.
fn resolve_remote_base(repo: &Path) -> Result<(String, String)> {
    let (remote, base) = probe_remote_base(repo);
    let base = match base {
        Some(b) => b,
        None => {
            let head = format!("refs/remotes/{remote}/HEAD");
            git_out(repo, &["symbolic-ref", "--quiet", &head])
                .and_then(|s| crate::git::remote_head_branch(&remote, &s))
                .with_context(|| {
                    format!(
                        "cannot tell which branch of `{remote}` holds magi.toml: \
                         set [merge] base, or run `git remote set-head {remote} -a`"
                    )
                })?
        }
    };
    Ok((remote, base))
}

fn fnv_hex(text: &str) -> String {
    let mut hash: u64 = 0xcbf2_9ce4_8422_2325;
    for b in text.bytes() {
        hash ^= u64::from(b);
        hash = hash.wrapping_mul(0x0100_0000_01b3);
    }
    format!("{hash:016x}")
}

/// Does the text declare an `include` directive in any form teravars accepts
/// (root `include`, bare or quoted, or `[teravars] include`, as a table or an
/// inline table)? Parsed as TOML when it parses; a templated file that does
/// not parse is judged by a plain search for the word, because over-detecting
/// only costs an extra extraction while missing one fails the load.
fn declares_include(text: &str) -> bool {
    match toml::from_str::<toml::Table>(text) {
        Ok(table) => {
            table.contains_key("include")
                || table
                    .get("teravars")
                    .and_then(toml::Value::as_table)
                    .is_some_and(|t| t.contains_key("include"))
        }
        Err(_) => text.contains("include"),
    }
}

/// Unpack the whole tree of `sha` into `dest`, so relative `include`s of a
/// repository layer resolve against the same commit.
fn extract_tree(repo: &Path, sha: &str, dest: &Path) -> Result<()> {
    use crate::proc::Quiet as _;
    #[cfg(test)]
    crate::web::request_cost::git();
    let mut archive = std::process::Command::new("git")
        .args(["archive", "--format=tar", sha])
        .quiet()
        .current_dir(repo)
        .stdin(std::process::Stdio::null())
        .stdout(std::process::Stdio::piped())
        .stderr(std::process::Stdio::null())
        .spawn()
        .context("running git archive")?;
    let tar = std::process::Command::new("tar")
        .arg("-x")
        .arg("-C")
        .arg(dest)
        .quiet()
        .stdin(archive.stdout.take().context("git archive has no stdout")?)
        .output()
        .context("running tar")?;
    let status = archive.wait().context("waiting for git archive")?;
    if !status.success() || !tar.status.success() {
        bail!(
            "cannot unpack {sha} for the config's includes: {}",
            String::from_utf8_lossy(&tar.stderr).trim()
        );
    }
    Ok(())
}

/// The repository layers (`.magi/config.toml`, `magi.toml`; lowest first) of
/// `<remote>/<base>`, extracted from one commit so both files agree.
fn remote_layers(repo: &Path) -> Result<Vec<PathBuf>> {
    let (remote, base) = resolve_remote_base(repo)?;
    let tracking = format!("refs/remotes/{remote}/{base}");
    let spec = format!("{tracking}^{{commit}}");
    let sha = git_out(repo, &["rev-parse", "--verify", "--quiet", &spec])
        .map(|s| s.trim().to_owned())
        .filter(|s| !s.is_empty())
        .with_context(|| {
            format!(
                "`{remote}/{base}` does not exist in this checkout; fetch it \
                 (`git fetch {remote} {base}`) or set [merge] base/remote. magi will not read \
                 a possibly stale local magi.toml instead"
            )
        })?;
    let key = format!("{sha}-{}", fnv_hex(&repo.to_string_lossy()));
    let rels = [".magi/config.toml", "magi.toml"];
    let mut texts: Vec<(&str, String)> = Vec::new();
    for rel in rels {
        let object = format!("{sha}:{rel}");
        if git_out(repo, &["cat-file", "-e", &object]).is_none() {
            continue;
        }
        let Some(text) = git_out(repo, &["show", &object]) else {
            bail!("cannot read {rel} from {remote}/{base} ({sha})");
        };
        texts.push((rel, text));
    }
    let wants_tree = texts.iter().any(|(_, t)| declares_include(t));
    // Content-addressed and built beside the final name, then renamed in: a
    // concurrent `discover` sees the whole directory or none of it, never a
    // half-written file.
    let build = |root: &Path| -> Result<PathBuf> {
        let final_dir = root.join(&key);
        if !final_dir.is_dir() {
            std::fs::create_dir_all(root)?;
            let tmp = root.join(format!(
                "{key}.tmp-{}-{}",
                std::process::id(),
                std::time::SystemTime::now()
                    .duration_since(std::time::UNIX_EPOCH)
                    .map(|d| d.as_nanos())
                    .unwrap_or_default()
            ));
            let filled = (|| -> Result<()> {
                std::fs::create_dir_all(&tmp)?;
                if wants_tree {
                    extract_tree(repo, &sha, &tmp)?;
                }
                for (rel, text) in &texts {
                    let file = tmp.join(rel);
                    let parent = file.parent().unwrap_or(&tmp);
                    std::fs::create_dir_all(parent)?;
                    std::fs::write(&file, text)?;
                    std::fs::write(parent.join(REPO_MARKER), repo.to_string_lossy().as_bytes())?;
                }
                Ok(())
            })();
            if let Err(e) = filled {
                let _ = std::fs::remove_dir_all(&tmp);
                return Err(e);
            }
            if std::fs::rename(&tmp, &final_dir).is_err() {
                // Lost the race to another process building the same commit.
                let _ = std::fs::remove_dir_all(&tmp);
                if !final_dir.is_dir() {
                    bail!("cannot place {}", final_dir.display());
                }
            }
        }
        Ok(final_dir)
    };
    let common = git_out(
        repo,
        &["rev-parse", "--path-format=absolute", "--git-common-dir"],
    )
    .map(|s| PathBuf::from(s.trim()).join("magi").join("config"));
    let dir = match common.map(|c| build(&c)) {
        Some(Ok(d)) => d,
        _ => build(&std::env::temp_dir().join("magi-config"))
            .with_context(|| format!("extracting config from {remote}/{base}"))?,
    };
    Ok(texts.iter().map(|(rel, _)| dir.join(rel)).collect())
}

#[cfg(test)]
mod tests {
    #[test]
    fn editing_network_defaults_restricted_and_requires_explicit_opt_in() {
        assert_eq!(Graph::default().editing_network, EditingNetwork::Restricted);
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("policy.toml");
        for (value, expected) in [
            ("restricted", EditingNetwork::Restricted),
            ("enabled", EditingNetwork::Enabled),
        ] {
            std::fs::write(&path, format!("[graph]\nediting_network = {value:?}\n")).unwrap();
            let cfg = Config::load(&path).unwrap();
            assert_eq!(cfg.graph.editing_network, expected);
            let restored: Graph = toml::from_str(&toml::to_string(&cfg.graph).unwrap()).unwrap();
            assert_eq!(restored.editing_network, expected);
        }
        std::fs::write(&path, "[graph]\nediting_network = 'loopback'\n").unwrap();
        assert!(Config::load(&path).is_err());
    }

    #[test]
    fn coordination_defaults_off_and_validates_rendered_layer_values() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("repo.toml");
        std::fs::write(&machine, "").unwrap();
        assert!(Config::default().coordination.is_none());
        assert!(Config::load(&machine).unwrap().coordination.is_none());
        std::fs::write(
            &machine,
            r#"
[vars]
contract = "updater.contract"
[coordination]
contract_file = "{{ vars.contract }}"
contract_token = "protocol-v1"
lock_file = "updater.lock"
"#,
        )
        .unwrap();
        let cfg = Config::load(&machine).unwrap();
        let policy = cfg.coordination.unwrap();
        assert_eq!(policy.contract_file, "updater.contract");
        assert_eq!(policy.contract_token, "protocol-v1");
        assert_eq!(policy.lock_file, "updater.lock");
        std::fs::write(&repo, "[coordination]\nlock_file = 'repository.lock'\n").unwrap();
        let cfg = Config::load_layers(&[machine.clone(), repo.clone()]).unwrap();
        let policy = cfg.coordination.unwrap();
        assert_eq!(policy.contract_file, "updater.contract");
        assert_eq!(policy.lock_file, "repository.lock");
        std::fs::write(
            &repo,
            r#"
[vars]
bad = "../escape"
[coordination]
lock_file = "{{ vars.bad }}"
"#,
        )
        .unwrap();
        let error = Config::load_layers(&[machine, repo]).unwrap_err();
        assert!(format!("{error:#}").contains("coordination.lock_file"));
    }

    #[test]
    fn coordination_rejects_invalid_names_tokens_and_incomplete_sections() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("config.toml");
        let valid = toml::toml! {
            [coordination]
            contract_file = "updater.contract"
            contract_token = "protocol-v1"
            lock_file = "updater.lock"
        };
        for key in ["contract_file", "lock_file"] {
            for bad in [
                "",
                " ",
                " file",
                "file ",
                "\tfile",
                "file\t",
                ".",
                "..",
                "file..name",
                "../escape",
                "a/b",
                "a\\b",
                "/absolute",
                "C:drive",
                "C:\\absolute",
                "nul\0name",
            ] {
                let mut table = valid.clone();
                table["coordination"][key] = bad.into();
                std::fs::write(&path, toml::to_string(&table).unwrap()).unwrap();
                let error = Config::load(&path).unwrap_err();
                assert!(
                    format!("{error:#}").contains(&format!("coordination.{key}")),
                    "{bad:?}: {error:#}"
                );
            }
        }
        for bad in ["", " ", " token", "token ", "two\nlines", "two\rlines"] {
            let mut table = valid.clone();
            table["coordination"]["contract_token"] = bad.into();
            std::fs::write(&path, toml::to_string(&table).unwrap()).unwrap();
            let error = Config::load(&path).unwrap_err();
            assert!(
                format!("{error:#}").contains("coordination.contract_token"),
                "{error:#}"
            );
        }
        for key in ["contract_file", "contract_token", "lock_file"] {
            let mut table = valid.clone();
            table["coordination"].as_table_mut().unwrap().remove(key);
            std::fs::write(&path, toml::to_string(&table).unwrap()).unwrap();
            let error = Config::load(&path).unwrap_err();
            assert!(
                format!("{error:#}").contains(&format!("coordination.{key}")),
                "{error:#}"
            );
        }
        let mut table = valid;
        table["coordination"]
            .as_table_mut()
            .unwrap()
            .insert("typo".into(), "value".into());
        std::fs::write(&path, toml::to_string(&table).unwrap()).unwrap();
        assert!(format!("{:#}", Config::load(&path).unwrap_err()).contains("typo"));
    }

    #[test]
    fn context_window_prefers_exact_then_longest_prefix_and_user_over_builtin() {
        let mut cfg = Config::default();
        assert_eq!(
            cfg.context_window("claude-sonnet-4-5-20250929"),
            Some(200_000)
        );
        assert_eq!(cfg.context_window("gpt-4.1-mini"), Some(1_000_000));
        assert_eq!(cfg.context_window("mystery-model"), None);
        cfg.context_windows
            .insert("claude-sonnet-4-5".into(), 1_000_000);
        cfg.context_windows.insert("claude-sonnet-4".into(), 5);
        cfg.context_windows.insert("mystery".into(), 32_768);
        // Longest user prefix beats a shorter one and the built-in table.
        assert_eq!(
            cfg.context_window("claude-sonnet-4-5-20250929"),
            Some(1_000_000)
        );
        // An exact name beats any prefix.
        cfg.context_windows
            .insert("claude-sonnet-4-5-20250929".into(), 7);
        assert_eq!(cfg.context_window("claude-sonnet-4-5-20250929"), Some(7));
        assert_eq!(cfg.context_window("mystery-model"), Some(32_768));
    }

    use super::*;

    /// npm writes an extensionless `sh` script beside `codex.cmd`; on Windows
    /// the `.cmd` is the spawnable one (os error 193 otherwise, 2026-09-23).
    #[test]
    fn windows_lookup_picks_the_cmd_shim_over_the_extensionless_script() {
        let dir = tempfile::tempdir().unwrap();
        std::fs::write(dir.path().join("codex"), "#!/bin/sh\n").unwrap();
        std::fs::write(dir.path().join("codex.cmd"), "@echo off\n").unwrap();
        let paths = dir.path().as_os_str();
        assert_eq!(
            find_program_in("codex", paths, Some(".EXE;.CMD")),
            Some(dir.path().join("codex.cmd"))
        );
        assert_eq!(
            find_program_in("codex", paths, None),
            Some(dir.path().join("codex"))
        );
        assert_eq!(find_program_in("claude", paths, Some(".EXE;.CMD")), None);
    }

    fn spec(id: &str) -> AgentSpec {
        AgentSpec {
            id: id.to_owned(),
            kind: AgentKind::Command,
            model: None,
            command: vec!["true".to_owned()],
            extra_args: Vec::new(),
            env: BTreeMap::new(),
            prompt_delivery: None,
            max_turn_secs: None,
        }
    }

    #[test]
    fn merge_ci_defaults_expected_and_requires_an_explicit_valid_opt_out() {
        let default: Merge = toml::from_str("").unwrap();
        assert_eq!(default.ci, MergeCi::Expected);
        let config = layered("", "[merge]\nci = \"none\"\n").unwrap();
        assert_eq!(
            config.merge.ci.expectation(),
            crate::land::CiExpectation::Absent
        );
        assert!(toml::from_str::<Merge>("ci = \"typo\"").is_err());
        assert!(Config::starter_toml().contains("# ci = \"expected\""));
    }

    #[test]
    fn github_text_guard_defaults_on_and_can_be_disabled() {
        let default: Graph = toml::from_str("").unwrap();
        assert!(default.github_text_guard);
        let disabled: Graph = toml::from_str("github_text_guard = false").unwrap();
        assert!(!disabled.github_text_guard);
        let config = layered("", "[graph]\ngithub_text_guard = false\n").unwrap();
        assert!(!config.graph.github_text_guard);
        assert!(Config::starter_toml().contains("github_text_guard = true"));
    }

    #[test]
    fn rerun_flaky_checks_defaults_on_and_is_in_the_starter() {
        assert!(Graph::default().rerun_flaky_checks);
        let off: Graph = toml::from_str("rerun_flaky_checks = false").unwrap();
        assert!(!off.rerun_flaky_checks);
        assert!(Config::starter_toml().contains("rerun_flaky_checks = true"));
    }

    #[test]
    fn timeout_verify_omitted_from_old_toml_inherits_timeout_review() {
        // `timeout_verify` used to not exist: `verify.e2e`/`verify.gate` ran
        // under `timeout_review`. A config written before this field existed
        // must run exactly as before, which means its default has to be the
        // same 1200s `timeout_review` has always defaulted to.
        let g: Graph = toml::from_str("timeout_review = 3600").expect("parse");
        assert_eq!(g.timeout_verify, None);
        assert_eq!(g.verify_timeout(), 3600);
    }

    #[test]
    fn shrinking_timeout_review_does_not_shrink_timeout_verify() {
        // The bug this field exists to close: `[graph] timeout_review = 45`
        // used to shrink the real-machine `verify.e2e`/`verify.gate` budget
        // along with the reviewer seats' own timeout, because both read the
        // same field.
        let g: Graph = toml::from_str("timeout_review = 45").expect("parse");
        assert_eq!(g.timeout_review, 45);
        assert_eq!(
            g.verify_timeout(),
            45,
            "an omitted legacy value follows review"
        );
        let explicit: Graph = toml::from_str("timeout_review = 45\ntimeout_verify = 1200")
            .expect("parse explicit override");
        assert_eq!(explicit.verify_timeout(), 1200);
    }

    #[test]
    fn graph_implementers_new_key_loads_and_old_key_is_an_alias() {
        let g: Graph = toml::from_str("implementers = 4\n").unwrap();
        assert_eq!(g.implementers, 4);
        let g: Graph = toml::from_str("candidates = 5\n").unwrap();
        assert_eq!(g.implementers, 5);
    }

    fn layered(lower: &str, upper: &str) -> Result<Config> {
        let dir = tempfile::tempdir().unwrap();
        let a = dir.path().join("a.toml");
        let b = dir.path().join("b.toml");
        std::fs::write(&a, lower).unwrap();
        std::fs::write(&b, upper).unwrap();
        Config::load_layers(&[a, b])
    }

    #[test]
    fn graph_implementers_higher_layer_wins_across_spellings() {
        let c = layered("[graph]\ncandidates = 2\n", "[graph]\nimplementers = 5\n").unwrap();
        assert_eq!(c.graph.implementers, 5);
        let c = layered("[graph]\nimplementers = 2\n", "[graph]\ncandidates = 5\n").unwrap();
        assert_eq!(c.graph.implementers, 5);
        let c = layered("[graph]\ncandidates = 2\n", "[graph]\njudges = 3\n").unwrap();
        assert_eq!(c.graph.implementers, 2);
    }

    #[test]
    fn graph_implementers_both_keys_in_one_layer_is_refused() {
        let err = layered("", "[graph]\ncandidates = 2\nimplementers = 3\n")
            .unwrap_err()
            .to_string();
        assert!(
            err.contains("candidates") && err.contains("implementers"),
            "{err}"
        );
        assert!(err.contains("b.toml"), "{err}");
    }

    #[test]
    fn a_toml_layer_written_before_these_fields_existed_still_parses() {
        // `deny_unknown_fields` cuts both ways: a config from before
        // `timeout_verify`/`e2e_every_round` existed must still parse, with
        // both defaulted rather than refused as unknown-in-reverse.
        let g: Graph =
            toml::from_str("candidates = 1\nreviewers = 3\nreview_rounds = 6\nmax_parallel = 4\n")
                .expect("an old-shaped [graph] table must still parse");
        assert_eq!(g.verify_timeout(), Graph::default().timeout_review);
        assert!(
            !g.e2e_every_round,
            "off by default, same as before this field existed"
        );
    }

    #[test]
    fn empty_roles_rotate_judges_off_their_own_candidate() {
        // Three seats, said out loud: this is a test about *rotation*, and it
        // has nothing to say about how many candidates a task buys by default.
        let cfg = Config {
            agents: vec![spec("a"), spec("b"), spec("c")],
            graph: Graph {
                implementers: 3,
                ..Graph::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        let impls: Vec<&str> = roles.implementers.iter().map(|a| a.id.as_str()).collect();
        let judges: Vec<&str> = roles.judges.iter().map(|a| a.id.as_str()).collect();
        assert_eq!(impls, ["a", "b", "c"]);
        assert_eq!(judges, ["b", "c", "a"]);
        for (i, j) in judges.iter().enumerate() {
            assert_ne!(*j, impls[i], "judge {i} must not sit on its own candidate");
        }
    }

    #[test]
    fn single_agent_roster_fills_every_seat() {
        let cfg = Config {
            agents: vec![spec("solo")],
            graph: Graph {
                implementers: 3,
                ..Graph::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        assert_eq!(roles.implementers.len(), 3);
        assert!(roles.judges.iter().all(|a| a.id == "solo"));
    }

    #[test]
    fn implementer_roster_is_the_whole_agent_list_untruncated_when_unset() {
        // `implementers = 1` (a solo run) still resolves `implementers` down to
        // one slot, but `implementer_roster` must carry every agent in the
        // roster, in file order, for `graph::Runner`'s quota fallback to walk
        // forward through once that one slot's agent runs out of quota.
        let cfg = Config {
            agents: vec![spec("a"), spec("b"), spec("c")],
            graph: Graph {
                implementers: 1,
                ..Graph::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        assert_eq!(roles.implementers.len(), 1);
        let roster: Vec<&str> = roles
            .implementer_roster
            .iter()
            .map(|a| a.id.as_str())
            .collect();
        assert_eq!(roster, ["a", "b", "c"]);
    }

    #[test]
    fn implementer_roster_follows_explicit_ids_in_the_order_named() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b"), spec("c")],
            roles: Roles {
                implementers: vec!["c".to_owned(), "a".to_owned()],
                ..Roles::default()
            },
            graph: Graph {
                implementers: 1,
                ..Graph::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        // Unaffected by the new field: still just the first named id.
        assert_eq!(roles.implementers.len(), 1);
        assert_eq!(roles.implementers[0].id, "c");
        let roster: Vec<&str> = roles
            .implementer_roster
            .iter()
            .map(|a| a.id.as_str())
            .collect();
        assert_eq!(roster, ["c", "a"]);
    }

    #[test]
    fn explicit_roles_win() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b")],
            roles: Roles {
                implementers: vec!["b".to_owned()],
                judges: vec!["a".to_owned()],
                reviewers: Vec::new(),
                fixer: Some("a".into()),
                ..Roles::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        assert!(roles.implementers.iter().all(|a| a.id == "b"));
        assert!(roles.judges.iter().all(|a| a.id == "a"));
        let fixer = roles.fixer.unwrap();
        assert_eq!(fixer.len(), 1);
        assert_eq!(fixer[0].id, "a");
        assert_eq!(roles.conductor.id, "a");
    }

    #[test]
    fn fixer_takes_a_string_or_an_ordered_chain() {
        let one: Roles = toml::from_str("fixer = \"a\"").unwrap();
        assert_eq!(one.fixer.as_ref().unwrap().ids(), ["a"]);
        let chain: Roles = toml::from_str("fixer = [\"b\", \"a\"]").unwrap();
        assert_eq!(chain.fixer.as_ref().unwrap().ids(), ["b", "a"]);

        let resolve = |fixer: Option<AgentChoice>| {
            Config {
                agents: vec![spec("a"), spec("b"), spec("c")],
                roles: Roles {
                    fixer,
                    ..Roles::default()
                },
                ..Config::default()
            }
            .resolve_roles()
        };
        let ids = |r: &ResolvedRoles| -> Vec<String> {
            r.fixer
                .as_ref()
                .unwrap()
                .iter()
                .map(|s| s.id.clone())
                .collect()
        };
        // The string form is a chain of one; unset stays unset (the winner's author).
        assert_eq!(ids(&resolve(Some("c".into())).unwrap()), ["c"]);
        assert!(resolve(None).unwrap().fixer.is_none());
        // Order kept, an unknown id skipped, a duplicate keeps its first place.
        let chain = AgentChoice::Chain(vec!["b".into(), "zzz".into(), "a".into(), "b".into()]);
        assert_eq!(ids(&resolve(Some(chain)).unwrap()), ["b", "a"]);
        // Nothing resolving names the role.
        let err = resolve(Some(AgentChoice::Chain(vec!["zzz".into()]))).unwrap_err();
        assert!(format!("{err:#}").contains("fixer"), "{err:#}");
    }

    #[test]
    fn unknown_agent_id_is_an_error() {
        let cfg = Config {
            agents: vec![spec("a")],
            roles: Roles {
                judges: vec!["nope".to_owned()],
                ..Roles::default()
            },
            ..Config::default()
        };
        assert!(cfg.resolve_roles().is_err());
    }

    #[test]
    fn conductor_role_is_resolved_validated_and_has_a_fallback() {
        let mut cfg = Config {
            agents: vec![spec("a"), spec("b")],
            ..Config::default()
        };
        assert_eq!(cfg.resolve_roles().unwrap().conductor.id, "a");

        cfg.roles.conductor = Some("b".into());
        assert_eq!(cfg.resolve_roles().unwrap().conductor.id, "b");

        cfg.roles.conductor = Some("missing".into());
        assert!(cfg.resolve_roles().is_err());
    }

    #[test]
    fn a_standalone_role_takes_a_string_or_an_array_and_round_trips() {
        let one: Roles = toml::from_str("synthesizer = \"opus\"").unwrap();
        assert_eq!(one.synthesizer, Some(AgentChoice::One("opus".to_owned())));
        assert_eq!(primary(one.synthesizer.as_ref()), Some("opus"));

        let chain: Roles = toml::from_str("chatter = [\"opus\", \"codex\"]").unwrap();
        assert_eq!(chain.chatter.as_ref().unwrap().ids(), ["opus", "codex"]);
        assert_eq!(primary(chain.chatter.as_ref()), Some("opus"));

        for roles in [one, chain] {
            let text = toml::to_string(&roles).unwrap();
            let back: Roles = toml::from_str(&text).unwrap();
            assert_eq!(back.synthesizer, roles.synthesizer);
            assert_eq!(back.chatter, roles.chatter);
        }
        let text = toml::to_string(&Roles {
            conductor: Some("x".into()),
            ..Roles::default()
        })
        .unwrap();
        assert!(
            text.contains("conductor = \"x\""),
            "string stays a string: {text}"
        );
        assert!(toml::from_str::<Roles>("synthesizer = 3").is_err());
    }

    #[test]
    fn dupes_judge_role_accepts_strings_and_chains_and_round_trips() {
        for (text, ids) in [
            (r#"dupes_judge = "dedicated""#, vec!["dedicated"]),
            (
                r#"dupes_judge = ["first", "second"]"#,
                vec!["first", "second"],
            ),
            ("dupes_judge = []", vec![]),
        ] {
            let roles: Roles = toml::from_str(text).unwrap();
            assert_eq!(roles.dupes_judge.as_ref().unwrap().ids(), ids);
            let serialized = toml::to_string(&roles).unwrap();
            let back: Roles = toml::from_str(&serialized).unwrap();
            assert_eq!(back.dupes_judge, roles.dupes_judge);
            assert!(serialized.contains(text));
        }
        assert!(toml::from_str::<Roles>("dupes_judge = 3").is_err());
        assert!(Roles::default().dupes_judge.is_none());
        assert!(Config::starter_toml().contains("# dupes_judge ="));

        // Standalone roles are resolved lazily, just like chatter.
        let mut cfg = Config {
            agents: vec![spec("a")],
            ..Config::default()
        };
        cfg.roles.dupes_judge = Some("missing".into());
        assert!(cfg.resolve_roles().is_ok());
    }

    #[test]
    fn an_empty_choice_counts_as_unset() {
        assert!(AgentChoice::Chain(Vec::new()).ids().is_empty());
        assert!(AgentChoice::One("  ".to_owned()).ids().is_empty());
        assert_eq!(primary(Some(&AgentChoice::Chain(vec![]))), None);
    }

    #[test]
    fn synthesizer_role_is_a_lazy_lookup_with_the_same_fallback_as_chatter() {
        // Unlike `conductor`, `synthesizer` is never validated by
        // `resolve_roles` — it is looked up lazily by
        // `graph::Runner::synthesize_brief` the same way `[roles] chatter`
        // is looked up by `talk::begin`, so this exercises `agent::pick`
        // directly instead of going through `resolve_roles`.
        let mut cfg = Config {
            agents: vec![spec("a"), spec("b")],
            ..Config::default()
        };
        let want = primary(cfg.roles.synthesizer.as_ref());
        assert_eq!(
            crate::agent::pick(&cfg.agents, want, &crate::agent::installed)
                .unwrap()
                .id,
            "a",
            "unset falls back to agent::pick's own default order"
        );

        cfg.roles.synthesizer = Some("b".into());
        let want = primary(cfg.roles.synthesizer.as_ref());
        assert_eq!(
            crate::agent::pick(&cfg.agents, want, &crate::agent::installed)
                .unwrap()
                .id,
            "b",
            "the named agent wins over the default order"
        );
    }

    #[test]
    fn empty_roster_is_an_error() {
        assert!(Config::default().resolve_roles().is_err());
    }

    #[test]
    fn advise_defaults_to_on_with_three_proposals() {
        let g = Graph::default();
        assert!(g.advise);
        assert!(g.graft_runner_up, "graft is on by default");
        assert_eq!(g.advisors, 3);
    }

    #[test]
    fn unset_advisors_falls_back_to_the_judge_roster() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b")],
            roles: Roles {
                judges: vec!["b".to_owned()],
                ..Roles::default()
            },
            graph: Graph {
                advisors: 2,
                ..Graph::default()
            },
            ..Config::default()
        };
        let advisors = cfg.advisors().expect("advisors resolve");
        assert_eq!(advisors.len(), 2);
        assert!(
            advisors.iter().all(|a| a.id == "b"),
            "an unset [roles] advisors must fall back to [roles] judges: {advisors:?}"
        );
    }

    #[test]
    fn an_explicit_advisor_roster_wins_over_the_judge_fallback() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b")],
            roles: Roles {
                judges: vec!["b".to_owned()],
                advisors: vec!["a".to_owned()],
                ..Roles::default()
            },
            graph: Graph {
                advisors: 2,
                ..Graph::default()
            },
            ..Config::default()
        };
        let advisors = cfg.advisors().expect("advisors resolve");
        assert!(advisors.iter().all(|a| a.id == "a"));
    }

    /// Neither `[roles] advisors` nor `[roles] judges` set: an unconfigured
    /// advisor roster must resolve to the exact same agents an unconfigured
    /// judge panel would get - same ids, same rotation offset - or the
    /// promise in [`Roles::advisors`]'s doc ("advisor diversity for free")
    /// does not actually hold.
    #[test]
    fn an_unconfigured_advisor_and_judge_roster_resolve_to_the_same_agents() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b"), spec("c")],
            graph: Graph {
                advisors: 3,
                judges: 3,
                ..Graph::default()
            },
            ..Config::default()
        };
        let advisors = cfg.advisors().expect("advisors resolve");
        let judges = cfg.resolve_roles().expect("roles resolve").judges;
        let advisor_ids: Vec<&str> = advisors.iter().map(|a| a.id.as_str()).collect();
        let judge_ids: Vec<&str> = judges.iter().map(|a| a.id.as_str()).collect();
        assert_eq!(
            advisor_ids, judge_ids,
            "an unconfigured advisor roster must be the same seats an unconfigured judge panel gets"
        );
    }

    #[test]
    fn an_unresolvable_advisor_seat_is_an_error_naming_the_id() {
        let cfg = Config {
            agents: vec![spec("a")],
            roles: Roles {
                advisors: vec!["nope".to_owned()],
                ..Roles::default()
            },
            graph: Graph {
                advisors: 1,
                ..Graph::default()
            },
            ..Config::default()
        };
        let err = cfg.advisors().expect_err("`nope` is not in the roster");
        assert!(format!("{err:#}").contains("nope"));
    }

    #[test]
    fn repos_default_to_no_roots_and_a_day_of_trust() {
        assert_eq!(Config::default().repos.roots, Vec::<PathBuf>::new());
        assert_eq!(Config::default().repos.scan_ttl, 86_400);
        assert_eq!(Config::default().repos.fetch_interval, 600);
    }

    #[test]
    fn a_config_file_with_no_repos_table_still_loads() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[graph]\ncandidates = 2\n").unwrap();
        let cfg = Config::load(&path).expect("must load without [repos]");
        assert_eq!(cfg.repos.roots, Vec::<PathBuf>::new());
        assert_eq!(cfg.repos.scan_ttl, 86_400);
    }

    /// A fixture is the whole config under test.
    ///
    /// `layers` used to reach for `dirs::config_dir()` unconditionally, so on
    /// a machine where somebody had written `<config_dir>/magi/config.toml`
    /// the suite silently loaded it as the lowest layer. Adding `[repos]
    /// roots` there turned two web tests red - their fixtures declare
    /// `[repos] roots` too, and `refuse_split_arrays` rightly refuses one
    /// array key spread across two layers. CI stayed green throughout,
    /// because a runner has no such file: the suite failed only where magi is
    /// actually used.
    ///
    /// So a test build has no machine layer unless it asks for one, and this
    /// is that promise. Written against a real file at the real location so
    /// it fails if `machine_layer` starts reading it again.
    #[test]
    fn a_test_build_does_not_read_the_operators_machine_config() {
        let repo = tempfile::tempdir().unwrap();
        std::fs::write(repo.path().join("magi.toml"), "[graph]\ncandidates = 2\n").unwrap();

        let layers = Config::layers(repo.path());
        assert_eq!(
            layers,
            vec![repo.path().join("magi.toml")],
            "only the fixture's own file may be a layer"
        );
        if let Some(real) = dirs::config_dir() {
            let machine = real.join("magi").join("config.toml");
            assert!(
                !layers.contains(&machine),
                "the operator's {} must not be a layer in a test build",
                machine.display()
            );
        }
    }

    #[test]
    fn auto_upgrade_config_defaults_and_opt_in() {
        let default: Update = toml::from_str("").unwrap();
        assert!(!default.auto_restart);
        assert_eq!(default.mode, UpdateMode::Notify);
        let enabled: Update = toml::from_str("auto_restart = true\ninterval = \"2h\"\n").unwrap();
        assert!(enabled.auto_restart);
        assert_eq!(enabled.interval.as_deref(), Some("2h"));
        assert!(toml::from_str::<Update>("auto_restart = \"yes\"").is_err());
    }

    #[test]
    fn starter_toml_loads_through_teravars() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, Config::starter_toml()).unwrap();
        let parsed = Config::load(&path).expect("starter config must load");
        assert_eq!(parsed.graph.implementers, 3);
        assert_eq!(parsed.merge.mode, MergeMode::None);
        assert_eq!(parsed.merge.style, MergeStyle::Merge);
        assert!(parsed.graph.sessions);
        assert!(parsed.graph.github_text_guard);
        assert_eq!(parsed.graph.timeout_review, 1200);
        assert_eq!(parsed.graph.verify_timeout(), 1200);
        assert_eq!(parsed.update.mode, UpdateMode::Notify);
    }

    #[test]
    fn release_defaults_to_actions_and_the_starter_documents_it() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, Config::starter_toml()).unwrap();
        let r = Config::load(&path).unwrap().release;
        assert_eq!(r.mode, ReleaseMode::Actions);
        assert!(!r.is_local());
        assert!(r.commands.is_empty());
        assert_eq!(r.timeout_minutes, 30);
        assert!(Config::starter_toml().contains("# mode = \"actions\""));
    }

    #[test]
    fn release_local_parses_and_unknown_keys_are_refused() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(
            &path,
            "[release]\nmode = \"local\"\ncommands = [\"true\", \"echo $MAGI_RELEASE_TAG\"]\ntimeout_minutes = 5\n",
        )
        .unwrap();
        let r = Config::load(&path).unwrap().release;
        assert!(r.is_local());
        assert_eq!(r.commands.len(), 2);
        assert_eq!(r.timeout_minutes, 5);
        std::fs::write(&path, "[release]\nmode = \"local\"\nbogus = 1\n").unwrap();
        assert!(Config::load(&path).is_err());
        std::fs::write(&path, "[release]\nmode = \"gha\"\n").unwrap();
        assert!(Config::load(&path).is_err());
    }

    #[test]
    fn pre_gate_defaults_to_empty_and_the_starter_documents_it() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, Config::starter_toml()).unwrap();
        assert!(Config::load(&path).unwrap().verify.pre_gate.is_empty());
        assert!(Config::starter_toml().contains("# pre_gate = []"));
    }

    #[test]
    fn release_version_files_parse_default_empty_and_are_validated() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "").unwrap();
        assert!(
            Config::load(&path)
                .unwrap()
                .release
                .version_files
                .is_empty()
        );
        std::fs::write(
            &path,
            "[release]\nversion_files = [\n{ path = \"src-tauri/Cargo.toml\", kind = \"cargo\" },\n{ path = \"package.json\", kind = \"json\" },\n]\n",
        )
        .unwrap();
        let files = Config::load(&path).unwrap().release.version_files;
        assert_eq!(files.len(), 2);
        assert_eq!(files[1].kind, VersionKind::Json);
        for bad in [
            "{ path = \"package.json\", kind = \"json\" }",
            "{ path = \"../Cargo.toml\", kind = \"cargo\" }",
            "{ path = \"Cargo.toml\", kind = \"cargo\", extra = 1 }",
            "{ path = \"Cargo.toml\", kind = \"yaml\" }",
        ] {
            std::fs::write(&path, format!("[release]\nversion_files = [{bad}]\n")).unwrap();
            assert!(Config::load(&path).is_err(), "{bad}");
        }
        assert!(Config::starter_toml().contains("# version_files = ["));
    }

    #[test]
    fn starter_toml_explains_inherited_and_explicit_verify_timeouts() {
        let starter = Config::starter_toml();
        assert!(starter.contains("When timeout_verify is omitted, E2E and"));
        assert!(starter.contains("verification independent if timeout_review changes later"));
        assert!(starter.contains("# timeout_verify = 1200"));
    }

    #[test]
    fn starter_toml_documents_chat_personas() {
        let starter = Config::starter_toml();
        assert!(starter.contains("# [[talk.personas]]"));
        assert!(starter.contains("tone only"));
    }

    #[test]
    fn talk_personas_parse_and_are_validated() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(
            &path,
            "[[talk.personas]]\nid = \"rei\"\nname = \"Quiet\"\nprompt = \"Be brief.\"\n\n\
             [[talk.personas]]\nid = \"gendo\"\nname = \"Gendo\"\nprompt = \"Be cold.\"\n",
        )
        .unwrap();
        let cfg = Config::load(&path).expect("loads");
        assert_eq!(cfg.talk.personas.len(), 2);
        let catalog = crate::persona::catalog(&cfg.talk.personas);
        let rei = catalog.iter().find(|p| p.id == "rei").unwrap();
        assert_eq!(
            (rei.name.as_str(), rei.prompt.as_str()),
            ("Quiet", "Be brief.")
        );
        assert_eq!(catalog.last().unwrap().id, "gendo");

        for (body, needle) in [
            (
                "[[talk.personas]]\nid = \"\"\nname = \"n\"\nprompt = \"p\"\n",
                "empty `id`",
            ),
            (
                "[[talk.personas]]\nid = \"a\"\nname = \"n\"\nprompt = \" \"\n",
                "empty `prompt`",
            ),
            (
                "[[talk.personas]]\nid = \"a\"\nname = \"n\"\nprompt = \"p\"\n\
                 [[talk.personas]]\nid = \"a\"\nname = \"m\"\nprompt = \"q\"\n",
                "more than once",
            ),
            (
                "[[talk.personas]]\nid = \"default\"\nname = \"n\"\nprompt = \"p\"\n",
                "cannot be redefined",
            ),
        ] {
            std::fs::write(&path, body).unwrap();
            let err = format!("{:#}", Config::load(&path).unwrap_err());
            assert!(err.contains(needle), "{needle}: {err}");
        }
    }

    #[test]
    fn talk_operator_name_is_trimmed_and_validated() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        let load = |body: &str| {
            std::fs::write(&path, body).unwrap();
            Config::load(&path)
        };
        let ok = load("[talk]\noperator_name = \"  Commander \"\n").expect("ok");
        assert_eq!(ok.talk.operator_name(), Some("Commander"));
        let blank = load("[talk]\noperator_name = \"   \"\n").expect("blank");
        assert_eq!(blank.talk.operator_name(), None);
        assert!(load("[talk]\noperator_name = \"a\\nb\"\n").is_err());
        let long = "x".repeat(65);
        assert!(load(&format!("[talk]\noperator_name = \"{long}\"\n")).is_err());
    }

    #[test]
    fn talk_persona_icon_parses_and_a_bad_shape_keeps_config_usable() {
        let dir = tempfile::tempdir().unwrap();
        let load = |body: &str| {
            let path = dir.path().join("c.toml");
            std::fs::write(&path, body).unwrap();
            Config::load(&path)
        };
        let ok = load(
            "[[talk.personas]]\nid = \"rei\"\nicon = \"~/rei.png\"\n\n\
             [[talk.personas]]\nid = \"default\"\nicon = \"data:image/png;base64,AAAA\"\n",
        )
        .unwrap();
        let c = crate::persona::catalog(&ok.talk.personas);
        assert_eq!(c[0].icon.as_deref(), Some("data:image/png;base64,AAAA"));
        assert_eq!(c[2].icon.as_deref(), Some("~/rei.png"));
        assert!(c[2].prompt.contains("Rei"), "built-in voice kept");
        let oversized = format!(
            "data:image/png;base64,{}",
            "A".repeat(crate::persona_icon::ICON_MAX_BYTES)
        );
        for bad in ["", "rei.png", "/a/b.svg", "/a/../b.png", &oversized] {
            for (id, fields) in [
                ("rei", ""),
                ("default", ""),
                ("custom", "name = \"Custom\"\nprompt = \"Keep calm\"\n"),
            ] {
                let body = format!("[[talk.personas]]\nid = \"{id}\"\nicon = \"{bad}\"\n{fields}");
                let cfg = load(&body).expect("bad icon must not invalidate config");
                let persona = crate::persona::find(&cfg.talk.personas, id).unwrap();
                assert_eq!(persona.id, id);
                assert!(crate::persona_icon::load(bad).is_err());
            }
        }
        let doc = Config::starter_toml();
        assert!(doc.contains("# icon = "));
    }

    #[test]
    fn talk_personas_in_two_layers_are_refused() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("repo.toml");
        let one = "[[talk.personas]]\nid = \"a\"\nname = \"n\"\nprompt = \"p\"\n";
        std::fs::write(&machine, one).unwrap();
        std::fs::write(&repo, one.replace("\"a\"", "\"b\"")).unwrap();
        let err = format!("{:#}", Config::load_layers(&[machine, repo]).unwrap_err());
        assert!(err.contains("talk.personas"), "{err}");
    }

    #[test]
    fn starter_toml_documents_role_lists_as_backup_order() {
        let starter = Config::starter_toml();
        assert!(starter.contains("also an ordered backup list"));
        assert!(starter.contains("codex then sonnet are spares"));
    }

    /// A repository whose ruleset forbids merge commits declares that once,
    /// here, rather than magi asking GitHub about it on every render (see
    /// [`MergeStyle`]'s own doc for why).
    #[test]
    fn a_repository_can_declare_a_linear_history_merge_style() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[merge]\nmode = \"none\"\nstyle = \"squash\"\n").unwrap();
        let parsed = Config::load(&path).expect("config must load");
        assert_eq!(parsed.merge.style, MergeStyle::Squash);
    }

    #[test]
    fn later_layers_win_and_vars_render() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let project = dir.path().join("magi.toml");
        // The machine layer owns the roster...
        std::fs::write(
            &machine,
            "[[agents]]\nid = \"opus\"\nkind = \"claude\"\nmodel = \"opus\"\n\n\
             [graph]\ncandidates = 3\nmax_parallel = 8\n",
        )
        .unwrap();
        // ...and the project layer only states what is repo-specific, plus a
        // `[vars]` value interpolated into a command.
        std::fs::write(
            &project,
            "[vars]\ncache = \"/shared\"\n\n\
             [graph]\ncandidates = 2\n\n\
             [verify]\ngate = [\"CARGO_TARGET_DIR={{ vars.cache }}/t cargo test\"]\n",
        )
        .unwrap();

        let cfg = Config::load_layers(&[machine, project]).expect("layered load");
        assert_eq!(cfg.agents.len(), 1, "roster comes from the machine layer");
        assert_eq!(cfg.graph.implementers, 2, "project layer wins");
        assert_eq!(cfg.graph.max_parallel, 8, "machine layer survives");
        assert_eq!(
            cfg.verify.gate,
            ["CARGO_TARGET_DIR=/shared/t cargo test".to_owned()]
        );
        // The rendered command is where the cache path is read back from.
        assert_eq!(cfg.cache_dir(), Some(PathBuf::from("/shared/t")));
    }

    #[test]
    fn talk_defaults_to_an_hour_and_an_unwritten_config_still_gets_it() {
        // An operator who writes no `[graph]` timeout keys at all must still
        // land on the hour, not on the five/fifteen minutes this turn used
        // to hardcode before it read from config.
        let g = Graph::default();
        assert_eq!(g.timeout_talk, 3600);

        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[graph]\ncandidates = 2\n").unwrap();
        let cfg = Config::load(&path).expect("must load without timeout_talk set");
        assert_eq!(cfg.graph.timeout_talk, 3600);
    }

    #[test]
    fn an_overridden_talk_timeout_reaches_the_loaded_config() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[graph]\ntimeout_talk = 120\n").unwrap();
        let cfg = Config::load(&path).expect("must load");
        assert_eq!(cfg.graph.timeout_talk, 120);
    }

    #[test]
    fn the_disk_defaults_are_the_measurements_made_up_front() {
        let cfg = Config::default();
        assert_eq!(cfg.disk.min_free_bytes, 8 * 1024 * 1024 * 1024);
        assert!(cfg.disk.auto_fold);
        assert_eq!(cfg.disk.fold_grace_secs, 6 * 60 * 60);
        assert_eq!(cfg.disk.cache_limit_bytes, 10 * 1024 * 1024 * 1024);
    }

    #[test]
    fn an_unset_disk_section_is_the_safe_default() {
        let dir = tempfile::tempdir().unwrap();
        std::fs::write(dir.path().join("magi.toml"), "[graph]\ncandidates = 1\n").unwrap();
        let cfg = Config::load(&dir.path().join("magi.toml")).expect("load");
        assert_eq!(cfg.disk, Disk::default());
    }

    #[test]
    fn env_is_available_to_templates_with_a_default() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        // teravars ships no `env`; magi adds it, and the `default` filter has
        // to cover the unset case or every machine would need the variable.
        //
        // Deliberately no named variable: `env` is keyed by the exact spelling
        // the OS reports, and Windows says `Path` where POSIX says `PATH`, so a
        // test asserting `env.PATH` passes on one runner and fails on another.
        // The map's non-emptiness is the platform-neutral claim.
        std::fs::write(
            &path,
            "[verify]\n\
             gate = [\"cache={{ env.MAGI_TEST_UNSET_XYZ | default(value='fallback') }}\", \
             \"populated={{ env | length > 0 }}\"]\n",
        )
        .unwrap();
        let cfg = Config::load(&path).expect("env lookup must render");
        assert_eq!(cfg.verify.gate[0], "cache=fallback");
        assert_eq!(cfg.verify.gate[1], "populated=true");
    }

    #[test]
    fn a_broken_template_names_the_file() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[graph]\nlanguage = \"{{ nope.\"\n").unwrap();
        let err = Config::load(&path).expect_err("must not silently ignore");
        assert!(err.to_string().contains("teravars"), "{err}");
    }

    #[test]
    fn tera_syntax_in_comments_is_inert() {
        // teravars >= 0.2.2 strips `#` comments before Tera sees the file, so a
        // comment may quote template syntax without rendering. Before 0.2.2 this
        // load failed: the commented-out braces reached the template parser.
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(
            &path,
            "# a comment may quote templates: `{{ env.NOPE | default(value='x') }}` and `{% if %}`\n\
             [graph]\ncandidates = 2\n",
        )
        .unwrap();
        let cfg = Config::load(&path).expect("comments must be inert, not rendered");
        assert_eq!(cfg.graph.implementers, 2);
    }

    #[test]
    fn agent_turn_cap_round_trips_and_never_extends_the_budget() {
        use std::time::Duration;

        let mut s: AgentSpec =
            toml::from_str("id = 'slow'\nkind = 'command'\ncommand = ['true']\n").unwrap();
        let budget = Duration::from_millis(1500);
        assert_eq!(s.max_turn_secs, None);
        assert_eq!(s.turn_timeout(budget), budget);
        assert!(!toml::to_string(&s).unwrap().contains("max_turn_secs"));
        for (cap, expected) in [
            (1, Duration::from_secs(1)),
            (2, budget),
            (0, Duration::ZERO),
        ] {
            s.max_turn_secs = Some(cap);
            let saved = toml::to_string(&s).unwrap();
            let loaded: AgentSpec = toml::from_str(&saved).unwrap();
            assert_eq!(loaded.max_turn_secs, Some(cap));
            assert_eq!(loaded.turn_timeout(budget), expected);
        }
    }

    #[test]
    fn opencode_defaults_to_file_delivery() {
        let mut s = spec("oc");
        s.kind = AgentKind::Opencode;
        assert_eq!(s.delivery(), Delivery::File);
        s.prompt_delivery = Some(Delivery::Argv);
        assert_eq!(s.delivery(), Delivery::Argv);
    }
    #[test]
    fn the_land_loop_is_on_but_it_cannot_merge_without_being_asked() {
        // Both default on, and that pair is the safety property: `land` takes
        // over the watching an operator was doing by hand, `land_approval`
        // keeps the irreversible step a human decision. An unattended merge
        // needs BOTH flipped, which has to be chosen deliberately twice.
        let g = Graph::default();
        assert!(
            g.land,
            "stopping at an open PR left the watching to a human"
        );
        assert!(
            g.land_approval,
            "on-by-default land is only defensible while this is also on"
        );
        assert!(g.land_rounds > 0, "a loop with no budget never terminates");
        assert!(
            g.hold_contested_merge,
            "a contested hand-off must still reach a human when approvals are off"
        );
    }
    #[test]
    fn an_array_declared_in_two_layers_is_refused_instead_of_concatenated() {
        // teravars appends arrays. For an ordered list of seats, or an argv,
        // the concatenation is something neither file says - and the operator
        // pays for the extra seats by the token.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[roles]\nimplementers = [\"a\", \"b\"]\n").unwrap();
        std::fs::write(&repo, "[roles]\nimplementers = [\"oc\"]\n").unwrap();

        let err = Config::load_layers(&[machine.clone(), repo.clone()])
            .expect_err("two layers naming one array must not merge silently");
        assert_eq!(
            err.downcast_ref::<ConfigFailure>().unwrap().stage,
            "config-merge"
        );
        let err = err.to_string();
        assert!(err.contains("roles.implementers"), "{err}");
        // Both files are named: the fix is to delete one of them, and the
        // operator has to know which two to choose between.
        assert!(err.contains("machine.toml"), "{err}");
        assert!(err.contains("magi.toml"), "{err}");
    }

    #[test]
    fn a_scalar_in_one_layer_and_an_array_in_another_still_merges() {
        // The split the layering exists for: state a preference machine-wide,
        // let the repository own its own lists.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[roles]\nchatter = \"opus\"\n").unwrap();
        std::fs::write(
            &repo,
            "[[agents]]\nid = \"oc\"\nkind = \"opencode\"\n\n\
             [roles]\nimplementers = [\"oc\"]\n",
        )
        .unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("layers merge");
        assert_eq!(primary(cfg.roles.chatter.as_ref()), Some("opus"));
        assert_eq!(cfg.roles.implementers, ["oc"]);
        assert_eq!(cfg.agents.len(), 1, "the roster is not doubled");
    }

    #[test]
    fn two_layers_declaring_verify_gate_run_both_in_priority_order() {
        // The `editorconfig-checker` distribution problem: a shared layer
        // wants to add a gate command without erasing the repository's own.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[verify]\ngate = [\"editorconfig-checker\"]\n").unwrap();
        std::fs::write(&repo, "[verify]\ngate = [\"cargo make check\"]\n").unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("appendable arrays must merge");
        assert_eq!(
            cfg.verify.gate,
            [
                "editorconfig-checker".to_owned(),
                "cargo make check".to_owned()
            ],
            "low-priority (machine) command first, high-priority (repo) command after"
        );
    }

    fn load_one(body: &str) -> Result<Config> {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, body).unwrap();
        Config::load_layers(&[path])
    }

    #[test]
    fn worktree_setup_defaults_to_empty_and_parses_steps() {
        assert!(Config::default().worktree.setup.is_empty());
        let cfg = load_one(
            "[worktree]\nsetup = [\n  { copy = \".env.example -> .env\" },\n  \
             { copy = \"x\", optional = true },\n  { run = \"true\", timeout_secs = 5 },\n]\n",
        )
        .unwrap();
        assert_eq!(cfg.worktree.setup.len(), 3);
        assert!(cfg.worktree.setup[1].optional);
        assert_eq!(cfg.worktree.setup[2].timeout_secs, Some(5));
    }

    #[test]
    fn worktree_setup_rejects_malformed_steps() {
        for bad in [
            "{ copy = \"a\", run = \"b\" }",
            "{ optional = true }",
            "{ copy = \"a -> ../b\" }",
            "{ copy = \"a -> /abs\" }",
            "{ copy = \"a -> .git/config\" }",
            "{ run = \"b\", optional = true }",
            "{ copy = \"a\", timeout_secs = 3 }",
            "{ run = \"b\", bogus = 1 }",
        ] {
            let body = format!("[worktree]\nsetup = [{bad}]\n");
            assert!(load_one(&body).is_err(), "{bad}");
        }
    }

    #[test]
    fn worktree_setup_in_two_layers_is_refused() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[worktree]\nsetup = [{ run = \"a\" }]\n").unwrap();
        std::fs::write(&repo, "[worktree]\nsetup = [{ run = \"b\" }]\n").unwrap();
        assert!(Config::load_layers(&[machine, repo]).is_err());
    }

    #[test]
    fn starter_toml_documents_worktree_setup() {
        let starter = Config::starter_toml();
        assert!(starter.contains("# [worktree]") && starter.contains("setup = ["));
        // The commented example must be valid once uncommented.
        let body = starter.replace("# [worktree]", "[worktree]");
        let mut out = String::new();
        let mut live = false;
        for line in body.lines() {
            if line == "[worktree]" {
                live = true;
            } else if live && !line.starts_with("# ") {
                live = false;
            }
            out.push_str(&if live {
                line.replacen("# ", "", 1)
            } else {
                line.to_owned()
            });
            out.push('\n');
        }
        let cfg = load_one(&out).expect("uncommented example loads");
        assert_eq!(cfg.worktree.setup.len(), 3);
    }

    #[test]
    fn two_layers_declaring_verify_e2e_run_both_in_priority_order() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[verify]\ne2e = [\"shared-smoke-test\"]\n").unwrap();
        std::fs::write(&repo, "[verify]\ne2e = [\"cargo test\"]\n").unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("appendable arrays must merge");
        assert_eq!(
            cfg.verify.e2e,
            ["shared-smoke-test".to_owned(), "cargo test".to_owned()]
        );
    }

    #[test]
    fn two_layers_declaring_repos_roots_are_both_scanned() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[repos]\nroots = [\"/machine/root\"]\n").unwrap();
        std::fs::write(&repo, "[repos]\nroots = [\"/repo/root\"]\n").unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("appendable arrays must merge");
        assert_eq!(
            cfg.repos.roots,
            [PathBuf::from("/machine/root"), PathBuf::from("/repo/root")]
        );
    }

    #[test]
    fn duplicate_gate_commands_across_layers_both_run() {
        // Dropping the duplicate would be a silent surprise; the operator
        // sees a slower gate, never a missing one.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[verify]\ngate = [\"same-command\"]\n").unwrap();
        std::fs::write(&repo, "[verify]\ngate = [\"same-command\"]\n").unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("appendable arrays must merge");
        assert_eq!(
            cfg.verify.gate,
            ["same-command".to_owned(), "same-command".to_owned()]
        );
    }

    #[test]
    fn notify_command_is_still_refused_across_two_layers() {
        // An argv, not a set: concatenating two of them is not a program.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[notify]\ncommand = [\"ntfy\", \"publish\"]\n").unwrap();
        std::fs::write(&repo, "[notify]\ncommand = [\"curl\", \"-X\"]\n").unwrap();

        let err = Config::load_layers(&[machine.clone(), repo.clone()])
            .expect_err("an argv split across layers must not concatenate");
        assert_eq!(
            err.downcast_ref::<ConfigFailure>().unwrap().stage,
            "config-merge"
        );
        let err = err.to_string();
        assert!(err.contains("notify.command"), "{err}");
        assert!(err.contains("machine.toml"), "{err}");
        assert!(err.contains("magi.toml"), "{err}");
    }

    #[test]
    fn one_layer_declaring_verify_gate_runs_unchanged() {
        // The classification must not change behaviour for the configuration
        // this very repository has today: exactly one layer names the gate.
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[verify]\ngate = [\"cargo make check\"]\n").unwrap();

        let cfg = Config::load(&path).expect("single layer must still load");
        assert_eq!(cfg.verify.gate, ["cargo make check".to_owned()]);
    }

    #[test]
    fn layered_parse_failures_name_the_failing_input() {
        let dir = tempfile::tempdir().unwrap();
        let a = dir.path().join("a.toml");
        let b = dir.path().join("b.toml");
        std::fs::write(&a, "[graph").unwrap();
        std::fs::write(&b, "[verify").unwrap();
        let paths = [a.clone(), b.clone()];
        let first = Config::load_layers(&paths).unwrap_err();
        let first_cause = first.downcast_ref::<ConfigFailure>().unwrap();
        assert_eq!(first_cause.stage, "config-parse");
        assert_eq!(first_cause.target, serde_json::to_string(&[&a]).unwrap());
        std::fs::write(&a, "").unwrap();
        let second = Config::load_layers(&paths).unwrap_err();
        let second_cause = second.downcast_ref::<ConfigFailure>().unwrap();
        assert_eq!(second_cause.stage, "config-parse");
        assert_eq!(second_cause.target, serde_json::to_string(&[&b]).unwrap());
        assert_ne!(first_cause.target, second_cause.target);
    }

    #[test]
    fn describe_composed_names_the_contributing_layers_only_when_there_are_two() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[verify]\ngate = [\"editorconfig-checker\"]\n").unwrap();
        std::fs::write(&repo, "[verify]\ngate = [\"cargo make check\"]\n").unwrap();
        let paths = vec![machine.clone(), repo.clone()];

        let cfg = Config::load_layers(&paths).expect("appendable arrays must merge");
        let described =
            Config::describe_composed(&paths, &cfg.verify.gate, "verify.gate", "(none)");
        assert!(described.contains("editorconfig-checker && cargo make check"));
        assert!(
            described.contains(&machine.display().to_string()),
            "{described}"
        );
        assert!(
            described.contains(&repo.display().to_string()),
            "{described}"
        );

        // A single contributing layer stays the plain one-line summary.
        let single = vec![repo.clone()];
        let solo_cfg = Config::load_layers(&single).expect("single layer loads");
        let solo_described =
            Config::describe_composed(&single, &solo_cfg.verify.gate, "verify.gate", "(none)");
        assert_eq!(solo_described, "cargo make check");
    }

    mod remote_layers {
        use super::*;

        fn git(dir: &Path, args: &[&str]) {
            use crate::proc::Quiet as _;
            let out = std::process::Command::new("git")
                .args(args)
                .quiet()
                .current_dir(dir)
                .output()
                .unwrap();
            assert!(out.status.success(), "git {args:?}: {out:?}");
        }

        /// A checkout whose origin/main carries `remote` as magi.toml and whose
        /// working tree carries `disk`.
        fn fixture(remote: &str, disk: &str) -> (tempfile::TempDir, PathBuf) {
            let tmp = tempfile::tempdir().unwrap();
            let bare = tmp.path().join("o.git");
            git(tmp.path(), &["init", "--bare", "-b", "trunk", "o.git"]);
            let repo = tmp.path().join("repo");
            std::fs::create_dir_all(&repo).unwrap();
            git(&repo, &["init", "-b", "trunk"]);
            git(&repo, &["config", "user.name", "t"]);
            git(&repo, &["config", "user.email", "t@example.com"]);
            std::fs::write(repo.join("magi.toml"), remote).unwrap();
            git(&repo, &["add", "-A"]);
            git(&repo, &["commit", "-m", "x"]);
            git(&repo, &["remote", "add", "origin", &bare.to_string_lossy()]);
            git(&repo, &["push", "origin", "trunk"]);
            git(&repo, &["fetch", "origin"]);
            git(&repo, &["remote", "set-head", "origin", "trunk"]);
            std::fs::write(repo.join("magi.toml"), disk).unwrap();
            (tmp, repo)
        }

        #[tokio::test]
        async fn branch_owner_holds_only_add_literal_true_values() {
            for (text, expected) in [
                ("[graph]\nland_approval = true\n", true),
                ("[graph]\nland_approval = false\n", false),
                ("[graph]\nland = true\n", false),
                ("[graph\n", false),
                ("[graph]\nland_approval = \"yes\"\n", false),
                ("[graph]\nland_approval = 1\n", false),
            ] {
                let (_tmp, repo) = fixture(text, "[graph]\nland_approval = false\n");
                let head = crate::git::rev_parse(&repo, "HEAD").await.unwrap();
                let (holds, _) = branch_owner_holds(&repo, &head).await;
                assert_eq!(
                    holds.contains(&(OwnerHold::LandApproval, "magi.toml".into())),
                    expected
                );
                assert!(
                    !holds
                        .iter()
                        .any(|(h, _)| *h == OwnerHold::HoldContestedMerge)
                );
                for base in [false, true] {
                    let mut cfg = Config::default();
                    cfg.graph.land_approval = base;
                    let mut state = crate::run::RunState::new(
                        repo.clone(),
                        "trunk".into(),
                        head.clone(),
                        "review".into(),
                        cfg,
                    );
                    state.observe_branch_owner_holds(&head).await;
                    assert!(
                        state.branch_owner_holds.is_empty(),
                        "competition candidates are excluded"
                    );
                    state.reviewed_commits = Some(Vec::new());
                    state.observe_branch_owner_holds(&head).await;
                    assert_eq!(state.owner_hold(OwnerHold::LandApproval), base || expected);
                }
            }
        }

        #[tokio::test]
        async fn branch_owner_holds_missing_and_unreadable_preserve_base() {
            let (_tmp, repo) = fixture(
                "[graph]\nland_approval = true\n",
                "[graph]\nland_approval = true\n",
            );
            git(&repo, &["rm", "magi.toml"]);
            std::fs::create_dir(repo.join(".magi")).unwrap();
            std::fs::write(
                repo.join(".magi/config.toml"),
                "[graph]\nhold_contested_merge = true\n",
            )
            .unwrap();
            git(&repo, &["add", "."]);
            git(&repo, &["commit", "-m", "nested hold"]);
            let head = crate::git::rev_parse(&repo, "HEAD").await.unwrap();
            let (holds, _) = branch_owner_holds(&repo, &head).await;
            assert_eq!(
                holds,
                [(OwnerHold::HoldContestedMerge, ".magi/config.toml".into())]
            );
            let (holds, diagnostics) =
                branch_owner_holds(&repo, "0000000000000000000000000000000000000000").await;
            assert!(holds.is_empty());
            assert!(!diagnostics.is_empty());
            let (holds, diagnostics) = branch_owner_holds(&repo, "").await;
            assert!(holds.is_empty());
            assert!(!diagnostics.is_empty());
            for base in [false, true] {
                let mut cfg = Config::default();
                cfg.graph.land_approval = base;
                let mut state = crate::run::RunState::new(
                    repo.clone(),
                    "trunk".into(),
                    head.clone(),
                    "review".into(),
                    cfg,
                );
                state.reviewed_commits = Some(Vec::new());
                state.observe_branch_owner_holds(&head).await;
                assert_eq!(state.owner_hold(OwnerHold::LandApproval), base);
                state
                    .observe_branch_owner_holds("0000000000000000000000000000000000000000")
                    .await;
                assert_eq!(state.owner_hold(OwnerHold::LandApproval), base);
            }
        }

        #[test]
        fn reads_the_remote_blob_not_the_working_tree() {
            let (_t, repo) = fixture("[graph]\ncandidates = 2\n", "[graph]\ncandidates = 5\n");
            let (cfg, _) = Config::discover(&repo, None).unwrap();
            assert_eq!(cfg.graph.implementers, 2);
        }

        #[test]
        fn detached_head_still_reads_the_remote() {
            let (_t, repo) = fixture("[graph]\ncandidates = 2\n", "[graph]\ncandidates = 5\n");
            git(&repo, &["checkout", "--detach"]);
            let (cfg, _) = Config::discover(&repo, None).unwrap();
            assert_eq!(cfg.graph.implementers, 2);
        }

        #[test]
        fn a_missing_ref_is_an_error_not_a_fallback() {
            let (_t, repo) = fixture("[graph]\ncandidates = 2\n", "[graph]\ncandidates = 5\n");
            git(&repo, &["update-ref", "-d", "refs/remotes/origin/trunk"]);
            let err = format!("{:#}", Config::discover(&repo, None).unwrap_err());
            assert!(err.contains("origin"), "{err}");
        }

        #[test]
        fn merge_base_in_the_checkout_locates_the_ref() {
            let (_t, repo) = fixture("[graph]\ncandidates = 2\n", "[merge]\nbase = \"nope\"\n");
            assert!(Config::discover(&repo, None).is_err());
        }

        #[test]
        fn the_magi_dir_layer_is_read_too() {
            let (_t, repo) = fixture("[graph]\ncandidates = 2\n", "");
            std::fs::write(repo.join("magi.toml"), "[graph]\ncandidates = 2\n").unwrap();
            std::fs::create_dir_all(repo.join(".magi")).unwrap();
            std::fs::write(repo.join(".magi/config.toml"), "[graph]\njudges = 3\n").unwrap();
            git(&repo, &["add", "-A"]);
            git(&repo, &["commit", "-m", "y"]);
            git(&repo, &["push", "origin", "trunk"]);
            git(&repo, &["fetch", "origin"]);
            let (cfg, layers) = Config::discover(&repo, None).unwrap();
            assert_eq!((cfg.graph.implementers, cfg.graph.judges), (2, 3));
            assert_eq!(layers.len(), 2);
        }

        #[test]
        fn an_include_in_a_repository_layer_resolves_against_the_same_commit() {
            let (_t, repo) = fixture("include = [\"gate.toml\"]\n", "");
            std::fs::write(repo.join("magi.toml"), "include = [\"gate.toml\"]\n").unwrap();
            std::fs::write(repo.join("gate.toml"), "[graph]\ncandidates = 2\n").unwrap();
            git(&repo, &["add", "-A"]);
            git(&repo, &["commit", "-m", "inc"]);
            git(&repo, &["push", "origin", "trunk"]);
            git(&repo, &["fetch", "origin"]);
            // The working tree's copy differs and must not be used.
            std::fs::write(repo.join("gate.toml"), "[graph]\ncandidates = 9\n").unwrap();
            let (cfg, _) = Config::discover(&repo, None).unwrap();
            assert_eq!(cfg.graph.implementers, 2);
        }

        #[test]
        fn a_machine_layer_base_is_rendered_before_locating_the_ref() {
            let (t, repo) = fixture("[graph]\ncandidates = 2\n", "[merge]\nbase = \"nope\"\n");
            let m = t.path().join("machine.toml");
            std::fs::write(
                &m,
                "[merge]\nbase = \"{{ env.MAGI_TEST_NO_SUCH | default(value='trunk') }}\"\n",
            )
            .unwrap();
            let (remote, base) = {
                let probe = probe_merge(&m, &repo).unwrap();
                (probe.remote, probe.base)
            };
            assert_eq!((remote, base), (None, Some("trunk".to_owned())));
        }

        #[test]
        fn a_machine_layer_base_sees_the_checkouts_repo_name() {
            let (t, repo) = fixture("[graph]\ncandidates = 2\n", "");
            let m = t.path().join("machine.toml");
            std::fs::write(&m, "[merge]\nbase = \"{{ repo_name }}\"\n").unwrap();
            let probe = probe_merge(&m, &repo).unwrap();
            assert_eq!(probe.base.as_deref(), Some("repo"));
        }

        #[test]
        fn every_include_form_is_recognised() {
            assert!(declares_include("include = [\"a.toml\"]\n"));
            assert!(declares_include("\"include\" = [\"a.toml\"]\n"));
            assert!(declares_include("teravars = { include = [\"a.toml\"] }\n"));
            assert!(declares_include("[teravars]\ninclude = [\"a.toml\"]\n"));
            assert!(!declares_include("[graph]\ncandidates = 2\n"));
        }

        #[test]
        fn an_explicit_config_is_read_as_named() {
            let (t, repo) = fixture("[graph]\ncandidates = 2\n", "");
            let own = t.path().join("own.toml");
            std::fs::write(&own, "[graph]\ncandidates = 4\n").unwrap();
            let (cfg, _) = Config::discover(&repo, Some(&own)).unwrap();
            assert_eq!(cfg.graph.implementers, 4);
        }

        #[test]
        fn discover_fetched_fails_when_the_fetch_does() {
            let (t, repo) = fixture("[graph]\ncandidates = 2\n", "");
            std::fs::remove_dir_all(t.path().join("o.git")).unwrap();
            let rt = tokio::runtime::Builder::new_current_thread()
                .enable_all()
                .build()
                .unwrap();
            let err = rt
                .block_on(Config::discover_fetched(&repo, None))
                .unwrap_err();
            assert!(format!("{err:#}").contains("fetch"), "{err:#}");
        }

        #[test]
        fn fetch_and_remote_parse_failures_have_distinct_verified_causes() {
            let (tmp, repo) = fixture("[graph\ncandidates = 2\n", "");
            let remote = tmp.path().join("o.git");
            let offline = tmp.path().join("offline.git");
            std::fs::rename(&remote, &offline).unwrap();
            let rt = tokio::runtime::Builder::new_current_thread()
                .enable_all()
                .build()
                .unwrap();
            let fetch = rt
                .block_on(Config::discover_fetched(&repo, None))
                .unwrap_err();
            let fetch_cause = fetch.downcast_ref::<ConfigFailure>().unwrap();
            assert_eq!(fetch_cause.stage, "config-fetch");
            assert_eq!(fetch_cause.target, "origin/trunk");

            std::fs::rename(&offline, &remote).unwrap();
            let parse = rt
                .block_on(Config::discover_fetched(&repo, None))
                .unwrap_err();
            let parse_cause = parse.downcast_ref::<ConfigFailure>().unwrap();
            assert_eq!(parse_cause.stage, "config-parse");
            assert!(parse_cause.target.contains("magi.toml"));
            assert!(
                !parse_cause.target.contains("/magi/config/"),
                "cache commit paths are incidental"
            );
            assert_ne!(fetch_cause.stage, parse_cause.stage);
        }

        #[test]
        fn discover_fetched_survives_a_fetch_that_leaves_no_origin_head() {
            // Never-fetched remote + followRemoteHEAD=never: fetch creates
            // origin/trunk but not origin/HEAD, which discovery then re-reads.
            let (_t, repo) = fixture("[graph]\ncandidates = 2\n", "");
            git(&repo, &["remote", "set-head", "origin", "-d"]);
            git(&repo, &["update-ref", "-d", "refs/remotes/origin/trunk"]);
            git(
                &repo,
                &["config", "remote.origin.followRemoteHEAD", "never"],
            );
            let rt = tokio::runtime::Builder::new_current_thread()
                .enable_all()
                .build()
                .unwrap();
            let (cfg, _) = rt.block_on(Config::discover_fetched(&repo, None)).unwrap();
            assert_eq!(cfg.graph.implementers, 2);
        }

        #[test]
        fn a_non_git_directory_reads_its_files() {
            let dir = tempfile::tempdir().unwrap();
            std::fs::write(dir.path().join("magi.toml"), "[graph]\ncandidates = 4\n").unwrap();
            let (cfg, _) = Config::discover(dir.path(), None).unwrap();
            assert_eq!(cfg.graph.implementers, 4);
        }
    }

    #[test]
    fn github_language_defaults_to_english_and_accepts_japanese() {
        let default: Graph = toml::from_str("").unwrap();
        assert_eq!(default.github_language, "en");
        assert!(default.github_english() && default.language_gate());
        let ja: Graph = toml::from_str("github_language = \"ja\"").unwrap();
        assert!(!ja.github_english() && !ja.language_gate());
        // Independent of the operator-facing language.
        let only_ops: Graph = toml::from_str("language = \"ja\"").unwrap();
        assert!(only_ops.language_gate());
        let off: Graph = toml::from_str("github_text_guard = false").unwrap();
        assert!(!off.language_gate() && off.github_english());
        assert!(Config::starter_toml().contains("github_language = \"en\""));
    }
}