pitboss 0.3.0

//! `.pitboss/config.toml` schema and loader.
//!
//! `Config` is the typed view of the project's `.pitboss/config.toml`. Every
//! field has a sensible default, so a missing file or missing section
//! round-trips to the same shape as a fully populated one. Unknown keys are
//! logged via [`tracing::warn`] and otherwise ignored, so a forward-compatible
//! config written by a newer pitboss can still be loaded by an older binary.
//!
//! [`load`] reads `<workspace>/.pitboss/config.toml`, returning
//! [`Config::default()`] when the file is missing. [`parse`] is the same logic
//! against an in-memory string, used by both [`load`] and the unit tests.
//!
//! Type errors (wrong-type values, malformed TOML) surface as anyhow errors
//! with file context. The runner halts on these rather than silently falling
//! back to defaults, because a typo'd budget or model name should never be
//! silently lost.

use std::collections::HashMap;
use std::fs;
use std::path::{Path, PathBuf};

use anyhow::{Context, Result};
use serde::{Deserialize, Serialize};
use tracing::warn;

use crate::grind::plan::{Hooks, PlanBudgets};
use crate::util::paths;

/// Path of the workspace's configuration file
/// (`<workspace>/.pitboss/config.toml`).
pub fn config_path(workspace: impl AsRef<Path>) -> PathBuf {
    paths::config_path(workspace)
}

/// Fully resolved pitboss configuration. Every section has a [`Default`] so
/// `Config::default()` is a valid runtime config.
///
/// `Eq` is intentionally not derived because [`Budgets`] holds `f64` values
/// (`max_total_usd`, pricing rates), and `f64` is only `PartialEq`. Compare
/// with `==`/`assert_eq!` as usual.
#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
#[serde(default)]
pub struct Config {
    /// Per-role model selection.
    pub models: ModelRoles,
    /// Bounded-retry budgets for the runner loop.
    pub retries: RetryBudgets,
    /// Auditor pass configuration.
    pub audit: AuditConfig,
    /// Git integration tunables (branch naming, PR creation).
    pub git: GitConfig,
    /// Test runner overrides — by default the runner auto-detects from the
    /// project layout (see [`crate::tests::detect`]).
    pub tests: TestsConfig,
    /// Cost-tracking limits and per-model pricing. When either limit is set,
    /// the runner halts before the next agent dispatch that would exceed it.
    pub budgets: Budgets,
    /// Backend selection and per-backend overrides. A missing `[agent]`
    /// section keeps today's behavior (Claude Code).
    pub agent: AgentConfig,
    /// Optional terse-output mode. When `caveman.enabled` is `true` the
    /// runner prepends a "talk like caveman" directive to every agent
    /// dispatch's system prompt to cut output tokens.
    pub caveman: CavemanConfig,
    /// `pitboss grind` defaults. When a plan file leaves `[hooks]` /
    /// `[budgets]` empty, the runner falls back to the values declared here.
    pub grind: GrindConfig,
    /// Deferred-sweep tunables. Controls whether the runner inserts a sweep
    /// dispatch between regular phases and how aggressively it does so. A
    /// missing `[sweep]` section round-trips to [`SweepConfig::default()`].
    pub sweep: SweepConfig,
}

/// Model identifiers used for each agent role. Strings are passed verbatim to
/// the configured `Agent` implementation, so they must match whatever model id
/// the active agent (e.g., `claude` CLI) accepts.
///
/// Every role defaults to `claude-opus-4-7`. Users wanting a cheaper
/// implementer/fixer split can override per role in `.pitboss/config.toml`.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct ModelRoles {
    /// Model used by `pitboss plan` to generate `plan.md` from a goal.
    pub planner: String,
    /// Model used for the per-phase implementation pass — the bulk of token
    /// spend for most runs.
    pub implementer: String,
    /// Model used for the post-phase audit pass (see [`AuditConfig`]).
    pub auditor: String,
    /// Model used to fix failing tests, retried up to
    /// [`RetryBudgets::fixer_max_attempts`] times per phase.
    pub fixer: String,
}

impl Default for ModelRoles {
    fn default() -> Self {
        Self {
            planner: "claude-opus-4-7".to_string(),
            implementer: "claude-opus-4-7".to_string(),
            auditor: "claude-opus-4-7".to_string(),
            fixer: "claude-opus-4-7".to_string(),
        }
    }
}

/// Bounded-retry budgets. Pitboss never loops indefinitely; once a budget is
/// exhausted the runner halts and surfaces the failure.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct RetryBudgets {
    /// Maximum number of fixer dispatches the runner will issue for a single
    /// phase before halting. Set to `0` to disable the fixer entirely.
    pub fixer_max_attempts: u32,
    /// Maximum total agent dispatches per phase across all roles
    /// (implementer + fixer + auditor). Once exceeded the runner halts even
    /// if `fixer_max_attempts` would otherwise allow another retry.
    pub max_phase_attempts: u32,
}

impl Default for RetryBudgets {
    fn default() -> Self {
        Self {
            fixer_max_attempts: 2,
            max_phase_attempts: 3,
        }
    }
}

/// Auditor-role tunables.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct AuditConfig {
    /// When `false`, the auditor pass is skipped entirely and the runner
    /// commits straight after tests pass.
    pub enabled: bool,
    /// Threshold (in changed lines of diff) that distinguishes "small fix"
    /// from "large enough to defer". The auditor inlines fixes at or below
    /// this size and writes anything larger to `deferred.md`.
    pub small_fix_line_limit: u32,
}

impl Default for AuditConfig {
    fn default() -> Self {
        Self {
            enabled: true,
            small_fix_line_limit: 30,
        }
    }
}

/// Git integration tunables.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct GitConfig {
    /// Prefix prepended to the per-run branch name. The full branch is
    /// `<branch_prefix><utc_timestamp>` (e.g., `pitboss/play/20260429T143022Z`).
    pub branch_prefix: String,
    /// When `true`, the runner shells out to `gh pr create` after the final
    /// phase commits. Equivalent to passing `--pr` on the CLI.
    pub create_pr: bool,
}

impl Default for GitConfig {
    fn default() -> Self {
        Self {
            branch_prefix: "pitboss/play/".to_string(),
            create_pr: false,
        }
    }
}

/// Cost-tracking budgets and per-model pricing.
///
/// Either limit being [`Some`] activates budget enforcement: before every
/// agent dispatch the runner totals [`crate::state::RunState::token_usage`]
/// and halts with [`crate::runner::HaltReason::BudgetExceeded`] when usage
/// already meets or exceeds the configured cap. Both limits can be set
/// independently — the first to fire wins.
///
/// USD costs are computed from `pricing`: each role's accumulated tokens are
/// multiplied by the per-model rate associated with that role's model in
/// [`ModelRoles`]. Roles whose model is missing from `pricing` contribute zero
/// USD (and a `tracing::warn` is emitted on the first dispatch); the `tokens`
/// budget still applies. The default pricing table covers the Claude models
/// pitboss ships defaults for; `.pitboss/config.toml` may override or extend it.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(default)]
pub struct Budgets {
    /// Hard cap on total tokens (input + output, summed across roles). `None`
    /// disables the token-budget check.
    pub max_total_tokens: Option<u64>,
    /// Hard cap on total cost in USD computed from [`pricing`](Self::pricing).
    /// `None` disables the USD-budget check.
    pub max_total_usd: Option<f64>,
    /// Per-model price points. Keyed by the same model identifier strings
    /// used in [`ModelRoles`] (e.g., `"claude-opus-4-7"`).
    pub pricing: HashMap<String, ModelPricing>,
}

impl Default for Budgets {
    fn default() -> Self {
        let mut pricing = HashMap::new();
        pricing.insert(
            "claude-opus-4-7".to_string(),
            ModelPricing {
                input_per_million_usd: 15.0,
                output_per_million_usd: 75.0,
            },
        );
        pricing.insert(
            "claude-sonnet-4-6".to_string(),
            ModelPricing {
                input_per_million_usd: 3.0,
                output_per_million_usd: 15.0,
            },
        );
        pricing.insert(
            "claude-haiku-4-5".to_string(),
            ModelPricing {
                input_per_million_usd: 1.0,
                output_per_million_usd: 5.0,
            },
        );
        Self {
            max_total_tokens: None,
            max_total_usd: None,
            pricing,
        }
    }
}

/// Price points for a single model, in USD per million tokens.
#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
pub struct ModelPricing {
    /// Cost in USD for one million input tokens.
    pub input_per_million_usd: f64,
    /// Cost in USD for one million output tokens.
    pub output_per_million_usd: f64,
}

impl ModelPricing {
    /// USD cost for the supplied input/output token counts at this rate.
    pub fn cost_usd(&self, input: u64, output: u64) -> f64 {
        let input = (input as f64) * self.input_per_million_usd / 1_000_000.0;
        let output = (output as f64) * self.output_per_million_usd / 1_000_000.0;
        input + output
    }
}

/// Test-runner tunables. When `command` is `None` the runner auto-detects
/// from the project layout (see [`crate::tests::detect`]); otherwise the
/// configured command is used verbatim, bypassing detection entirely.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct TestsConfig {
    /// Shell-style command to run the project's test suite (e.g.,
    /// `"cargo test --workspace"`). Whitespace-split into program + args, so
    /// shell metacharacters like pipes or env-var assignments require an
    /// explicit `sh -c "..."` wrapper. `None` enables autodetection.
    pub command: Option<String>,
}

/// `[agent]` section — backend selection plus per-backend overrides.
///
/// The `backend` field is the canonical lowercase string form of
/// [`crate::agent::backend::BackendKind`] (e.g., `"claude_code"`, `"codex"`).
/// It is left as a [`String`] here rather than the enum directly so the
/// config layer stays decoupled from the agent layer's parser; the factory
/// in [`crate::agent::build_agent`] handles validation and surfaces a clear
/// error if the value is unknown. `None` means "use the default backend"
/// (today, Claude Code).
///
/// The four sub-tables (`claude_code`, `codex`, `aider`, `gemini`) all share
/// the same base shape (`binary`, `extra_args`, `model`), plus backend-specific
/// policy overrides, and all four are active:
/// [`crate::agent::build_agent`] reads whichever sub-table matches the selected
/// backend and forwards its overrides to the constructed agent.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct AgentConfig {
    /// Which backend to dispatch through. `None` selects the default
    /// (`claude_code`) so a workspace with no `[agent]` section keeps
    /// today's behavior.
    pub backend: Option<String>,
    /// Overrides applied when the active backend is `claude_code`.
    pub claude_code: BackendOverrides,
    /// Overrides applied when the active backend is `codex`.
    pub codex: BackendOverrides,
    /// Overrides applied when the active backend is `aider`.
    pub aider: BackendOverrides,
    /// Overrides applied when the active backend is `gemini`.
    pub gemini: BackendOverrides,
}

/// `[caveman]` section — opt-in terse-response mode that prepends a
/// "talk like caveman" directive to the system prompt of every agent
/// dispatch. The skill itself is from <https://github.com/JuliusBrussee/caveman>;
/// pitboss inlines the directive rather than depending on the plugin so the
/// same behavior applies to every backend (Claude Code, Codex, Aider).
///
/// Disabled by default — token-budget reductions come at the cost of slightly
/// terser plan/audit/fix prose, which can lose detail downstream roles depend
/// on. Enable per-workspace when output token spend is the bottleneck.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct CavemanConfig {
    /// Master switch. When `false` (the default) the directive is the empty
    /// string and pitboss behaves exactly as it did before this section
    /// existed.
    pub enabled: bool,
    /// Terseness level. `lite` drops only filler words; `full` (the skill's
    /// canonical default) also drops articles and allows fragments; `ultra`
    /// abbreviates aggressively. See [`CavemanIntensity`] for details.
    pub intensity: CavemanIntensity,
}

/// Caveman terseness level. See [`CavemanConfig`].
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
#[serde(rename_all = "lowercase")]
pub enum CavemanIntensity {
    /// Drop only filler/hedging. Keep articles + full sentences. Professional
    /// but tight. Lowest risk to downstream artifact quality.
    Lite,
    /// The skill's canonical default. Drop articles, fragments OK, short
    /// synonyms. Classic caveman.
    #[default]
    Full,
    /// Maximum compression. Abbreviate (DB/auth/config/req/res/fn/impl),
    /// arrows for causality (X → Y), one word when one word does. Highest
    /// risk to downstream artifact readability.
    Ultra,
}

/// `[grind]` section — defaults that cover a `pitboss grind` run when no
/// rotation file overrides them.
///
/// `prompts_dir` corresponds to the `--prompts-dir` CLI flag's persistent
/// counterpart and defaults to `None` (the standard project + global
/// discovery rule lands in Phase 02). `default_rotation` is the rotation
/// name to load when the user runs `pitboss grind` with no `--rotation`. The
/// remaining fields are the run-wide caps and inherited hook / budget tables
/// that fall through to a rotation that doesn't override them.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(default)]
pub struct GrindConfig {
    /// Optional override for where to discover grind prompts. `None` keeps
    /// the precedence chain (project, then global) from Phase 02.
    pub prompts_dir: Option<PathBuf>,
    /// Rotation name to load when `pitboss grind` is invoked without
    /// `--rotation`. `None` means "synthesize the default rotation from
    /// discovered prompts".
    pub default_rotation: Option<String>,
    /// Cap on concurrently-running sessions. Must be `>= 1`. Defaults to `1`
    /// (sequential).
    pub max_parallel: u32,
    /// Number of consecutive failing sessions that trip the
    /// consecutive-failure escape valve (Phase 08 exit code 5). Defaults to
    /// `3`.
    pub consecutive_failure_limit: u32,
    /// Wall-clock cap applied to each plan-level shell hook (Phase 10).
    /// Defaults to `60`.
    pub hook_timeout_secs: u64,
    /// Extra environment variables to forward into each plan-level hook on
    /// top of the built-in allowlist (`HOME`, `USER`, `LANG`, `SHELL`,
    /// `SSH_AUTH_SOCK`). Names listed here are looked up in the parent
    /// process's environment at hook-fire time and, when present, copied
    /// into the child. Useful for credential vars hooks need to talk to
    /// GitHub / Slack / oncall systems (`GITHUB_TOKEN`, `SLACK_TOKEN`, …)
    /// without inheriting the entire parent environment.
    pub hook_env_passthrough: Vec<String>,
    /// What to do with per-session transcripts on the disk. Defaults to
    /// [`TranscriptRetention::KeepAll`].
    pub transcript_retention: TranscriptRetention,
    /// Run-wide budgets. Mirrors the plan-level budgets so an unconfigured
    /// plan still inherits these.
    pub budgets: PlanBudgets,
    /// Run-wide shell hooks. Mirrors the plan-level hooks so an unconfigured
    /// plan still inherits these.
    pub hooks: Hooks,
}

impl Default for GrindConfig {
    fn default() -> Self {
        Self {
            prompts_dir: None,
            default_rotation: None,
            max_parallel: 1,
            consecutive_failure_limit: 3,
            hook_timeout_secs: 60,
            hook_env_passthrough: Vec::new(),
            transcript_retention: TranscriptRetention::default(),
            budgets: PlanBudgets::default(),
            hooks: Hooks::default(),
        }
    }
}

/// `[sweep]` section — controls the deferred-sweep pass that runs between
/// regular phases.
///
/// The runner sweeps `deferred.md` automatically when its unchecked-item
/// count crosses [`Self::trigger_min_items`], at most [`Self::max_consecutive`]
/// times in a row before yielding to a real phase again. The agent picks how
/// many items to address per dispatch — clamping a 7-easy-fixes sweep to 5
/// would just defer the rest, so [`Self::trigger_max_items`] is *advisory*:
/// it documents the expected upper bound rather than gating behavior.
///
/// [`Self::escalate_after`] (consumed by the staleness tracker) and
/// [`Self::audit_enabled`] (consumed by the post-sweep auditor pass) are
/// declared here so this section is the single source of truth for sweep
/// tunables; later phases plug their behavior in without growing new sections.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct SweepConfig {
    /// Master switch. When `false` the runner never dispatches a sweep
    /// between phases, regardless of the rest of this section.
    pub enabled: bool,
    /// Lower bound on unchecked `## Deferred items` entries that triggers a
    /// sweep at the next phase boundary.
    pub trigger_min_items: u32,
    /// Advisory upper bound — the documented "expected" cap on items the
    /// sweep agent picks per dispatch. The runner does not enforce this; the
    /// agent decides how many items to actually address.
    pub trigger_max_items: u32,
    /// Maximum number of sweeps the runner may dispatch back-to-back before
    /// it must run a real phase. Prevents the loop from livelocking on a
    /// deferred list it can't fully drain.
    pub max_consecutive: u32,
    /// Number of consecutive sweep attempts an item may survive before the
    /// staleness tracker escalates it. Consumed by phase 05.
    pub escalate_after: u32,
    /// Whether the auditor pass runs after a sweep dispatch the way it does
    /// after a regular phase. Consumed by phase 04.
    pub audit_enabled: bool,
    /// Whether the runner runs a bounded final-sweep drain loop after the
    /// final regular phase commits. Independent of [`Self::enabled`] so an
    /// operator can disable between-phase sweeps while keeping the trailing
    /// drain on, or vice versa. Consumed by phase 08. To disable the loop
    /// entirely set this to `false` rather than reducing
    /// [`Self::final_sweep_max_iterations`] to zero.
    pub final_sweep_enabled: bool,
    /// Maximum number of iterations the final-sweep drain loop may run
    /// before exiting. The loop also exits early when the unchecked-item
    /// count reaches zero or when an iteration resolves no items
    /// (no-progress guard). Consumed by phase 08; validation rejects zero.
    pub final_sweep_max_iterations: u32,
}

impl Default for SweepConfig {
    fn default() -> Self {
        Self {
            enabled: true,
            trigger_min_items: 5,
            trigger_max_items: 8,
            max_consecutive: 1,
            escalate_after: 3,
            audit_enabled: true,
            final_sweep_enabled: true,
            final_sweep_max_iterations: 3,
        }
    }
}

/// Per-session transcript retention policy.
///
/// Phase 04 only ships the two end-points of the spectrum so an operator can
/// either preserve every transcript for forensics or drop all of them after a
/// session resolves. Intermediate variants (e.g., keep-last-N) can land in a
/// later phase if needed.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
#[serde(rename_all = "snake_case")]
pub enum TranscriptRetention {
    /// Keep every per-session transcript on disk indefinitely. Default.
    #[default]
    KeepAll,
    /// Discard a session's transcript once the session resolves successfully.
    /// Failed sessions' transcripts are kept regardless so post-mortems still
    /// have something to look at.
    KeepNone,
}

/// Per-backend overrides shared by every backend table.
///
/// Every field is optional / additive — defaults match today's behavior
/// (look up the binary on `PATH`, no extra args, fall back to the role's
/// model from [`ModelRoles`]).
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct BackendOverrides {
    /// Path to the backend binary. `None` resolves the default name on `PATH`.
    pub binary: Option<PathBuf>,
    /// Extra arguments appended to every invocation of this backend.
    pub extra_args: Vec<String>,
    /// Model identifier override. When set, this wins over [`ModelRoles`]
    /// for any role dispatched through this backend.
    pub model: Option<String>,
    /// Codex approval policy for generated command execution. Only consumed by
    /// the Codex adapter today; when unset, Codex runs with `never` so
    /// non-interactive pitboss dispatches cannot block on prompts.
    pub approval_policy: Option<String>,
    /// Pin the permission mode for every dispatch through this backend.
    /// Only consumed by the Claude Code adapter today (other backends ignore
    /// it). When `None`, the adapter picks per-model: `auto` for Opus,
    /// `acceptEdits` for everything else, since Anthropic's Auto Mode is
    /// Opus-only and Sonnet/Haiku otherwise gate every edit on a prompt
    /// nobody answers in headless mode.
    pub permission_mode: Option<String>,
}

/// Read the workspace's `.pitboss/config.toml`.
///
/// A missing file returns [`Config::default()`] (pitboss is usable without any
/// config), but a present-but-malformed file is an error. Unknown keys emit a
/// [`tracing::warn`] and are otherwise ignored.
pub fn load(workspace: impl AsRef<Path>) -> Result<Config> {
    let path = config_path(workspace.as_ref());
    let text = match fs::read_to_string(&path) {
        Ok(s) => s,
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(Config::default()),
        Err(e) => {
            return Err(anyhow::Error::new(e).context(format!("config::load: reading {:?}", path)));
        }
    };
    parse(&text).with_context(|| format!("config::load: parsing {:?}", path))
}

/// Parse a `config.toml` body. Empty / whitespace-only input yields
/// [`Config::default()`]. Unknown keys are logged at warn level.
pub fn parse(text: &str) -> Result<Config> {
    if text.trim().is_empty() {
        return Ok(Config::default());
    }
    let value: toml::Value = toml::from_str(text).context("config.toml is not valid TOML")?;
    for unknown in find_unknown_keys(&value) {
        warn!(key = %unknown, "config.toml: unknown key {:?} (ignored)", unknown);
    }
    let cfg: Config = value
        .try_into()
        .context("config.toml does not match the expected schema")?;
    validate(&cfg)?;
    Ok(cfg)
}

/// Semantic checks beyond what serde can express. Run after deserialization so
/// every field has its concrete type.
fn validate(cfg: &Config) -> Result<()> {
    if cfg.grind.max_parallel == 0 {
        anyhow::bail!("config.toml: [grind] max_parallel must be >= 1");
    }
    if cfg.grind.consecutive_failure_limit == 0 {
        anyhow::bail!("config.toml: [grind] consecutive_failure_limit must be >= 1");
    }
    if cfg.grind.hook_timeout_secs == 0 {
        anyhow::bail!("config.toml: [grind] hook_timeout_secs must be >= 1");
    }
    if cfg.sweep.trigger_min_items < 1 {
        anyhow::bail!("config.toml: [sweep] trigger_min_items must be >= 1");
    }
    if cfg.sweep.trigger_min_items > cfg.sweep.trigger_max_items {
        anyhow::bail!(
            "config.toml: [sweep] trigger_min_items ({}) must be <= trigger_max_items ({})",
            cfg.sweep.trigger_min_items,
            cfg.sweep.trigger_max_items
        );
    }
    if cfg.sweep.max_consecutive < 1 {
        anyhow::bail!("config.toml: [sweep] max_consecutive must be >= 1");
    }
    if cfg.sweep.escalate_after < 1 {
        anyhow::bail!("config.toml: [sweep] escalate_after must be >= 1");
    }
    if cfg.sweep.final_sweep_max_iterations < 1 {
        anyhow::bail!("config.toml: [sweep] final_sweep_max_iterations must be >= 1");
    }
    Ok(())
}

/// Walk a parsed `config.toml` value and return any keys not in the schema.
/// Returned in `section.key` form for nested keys, bare `section` for unknown
/// top-level keys. Order follows the document.
fn find_unknown_keys(value: &toml::Value) -> Vec<String> {
    let mut out = Vec::new();
    let toml::Value::Table(top) = value else {
        return out;
    };
    for (section, sub) in top {
        let known_subkeys: &[&str] = match section.as_str() {
            "models" => &["planner", "implementer", "auditor", "fixer"],
            "retries" => &["fixer_max_attempts", "max_phase_attempts"],
            "audit" => &["enabled", "small_fix_line_limit"],
            "git" => &["branch_prefix", "create_pr"],
            "tests" => &["command"],
            // `budgets.pricing` is keyed by user-supplied model ids — we can't
            // enumerate them up front, so we only validate the top-level keys
            // here and accept any pricing entry shape via serde.
            "budgets" => &["max_total_tokens", "max_total_usd", "pricing"],
            // Each per-backend sub-table is itself a TOML table; the walker
            // only descends one level so unknown keys *inside*
            // `[agent.codex]` etc. are not flagged here. That's a deliberate
            // tradeoff — backend adapters may grow new fields without forcing
            // a config-schema bump.
            "agent" => &["backend", "claude_code", "codex", "aider", "gemini"],
            "caveman" => &["enabled", "intensity"],
            // `grind.budgets` and `grind.hooks` are sub-tables. The walker
            // only descends one level so unknown keys *inside* them are not
            // flagged here — same tradeoff as `[agent.codex]`. Fields like
            // `prompts_dir` and `default_rotation` may themselves be
            // sub-tables in future, so this is the right level to check.
            "grind" => &[
                "prompts_dir",
                "default_rotation",
                "max_parallel",
                "consecutive_failure_limit",
                "hook_timeout_secs",
                "hook_env_passthrough",
                "transcript_retention",
                "budgets",
                "hooks",
            ],
            "sweep" => &[
                "enabled",
                "trigger_min_items",
                "trigger_max_items",
                "max_consecutive",
                "escalate_after",
                "audit_enabled",
                "final_sweep_enabled",
                "final_sweep_max_iterations",
            ],
            _ => {
                out.push(section.clone());
                continue;
            }
        };
        if let toml::Value::Table(sub_table) = sub {
            for sub_key in sub_table.keys() {
                if !known_subkeys.contains(&sub_key.as_str()) {
                    out.push(format!("{}.{}", section, sub_key));
                }
            }
        }
    }
    out
}

#[cfg(test)]
mod tests {
    use super::*;
    use tempfile::tempdir;

    #[test]
    fn defaults_are_self_consistent() {
        let cfg = Config::default();
        assert_eq!(cfg.models.planner, "claude-opus-4-7");
        assert_eq!(cfg.models.implementer, "claude-opus-4-7");
        assert_eq!(cfg.models.auditor, "claude-opus-4-7");
        assert_eq!(cfg.models.fixer, "claude-opus-4-7");
        assert_eq!(cfg.retries.fixer_max_attempts, 2);
        assert_eq!(cfg.retries.max_phase_attempts, 3);
        assert!(cfg.audit.enabled);
        assert_eq!(cfg.audit.small_fix_line_limit, 30);
        assert_eq!(cfg.git.branch_prefix, "pitboss/play/");
        assert!(!cfg.git.create_pr);
        assert!(cfg.tests.command.is_none());
        // Budget enforcement disabled by default; default pricing table covers
        // the model id `[models]` defaults to so users can opt in by adding
        // just `max_total_usd` without re-declaring rates.
        assert_eq!(cfg.budgets.max_total_tokens, None);
        assert_eq!(cfg.budgets.max_total_usd, None);
        assert!(cfg.budgets.pricing.contains_key("claude-opus-4-7"));
        // Agent backend defaults to unset → factory selects ClaudeCode.
        assert_eq!(cfg.agent, AgentConfig::default());
        assert_eq!(cfg.agent.backend, None);
        // Caveman mode is opt-in — disabled by default with intensity `full`
        // so a workspace with no `[caveman]` section behaves identically to
        // pre-feature pitboss.
        assert!(!cfg.caveman.enabled);
        assert_eq!(cfg.caveman.intensity, CavemanIntensity::Full);
        // Grind config defaults; an unconfigured workspace runs sequentially
        // with no plan-level overrides.
        assert_eq!(cfg.grind, GrindConfig::default());
        assert_eq!(cfg.grind.max_parallel, 1);
        assert_eq!(cfg.grind.consecutive_failure_limit, 3);
        assert_eq!(cfg.grind.hook_timeout_secs, 60);
        assert_eq!(cfg.grind.transcript_retention, TranscriptRetention::KeepAll);
        assert!(cfg.grind.prompts_dir.is_none());
        assert!(cfg.grind.default_rotation.is_none());
        // Sweep defaults: enabled with a 5-item trigger and a single sweep
        // per phase boundary. The advisory upper bound stays at 8 even though
        // it doesn't gate behavior, so a config dump documents the expected
        // ceiling.
        assert_eq!(cfg.sweep, SweepConfig::default());
        assert!(cfg.sweep.enabled);
        assert_eq!(cfg.sweep.trigger_min_items, 5);
        assert_eq!(cfg.sweep.trigger_max_items, 8);
        assert_eq!(cfg.sweep.max_consecutive, 1);
        assert_eq!(cfg.sweep.escalate_after, 3);
        assert!(cfg.sweep.audit_enabled);
        // Phase 08 final-sweep drain defaults: enabled with a 3-iteration cap.
        assert!(cfg.sweep.final_sweep_enabled);
        assert_eq!(cfg.sweep.final_sweep_max_iterations, 3);
    }

    #[test]
    fn caveman_section_round_trips_full_form() {
        let text = "
[caveman]
enabled = true
intensity = \"ultra\"
";
        let cfg = parse(text).unwrap();
        assert!(cfg.caveman.enabled);
        assert_eq!(cfg.caveman.intensity, CavemanIntensity::Ultra);

        // Canonical input must not trip the unknown-keys walker.
        let value: toml::Value = toml::from_str(text).unwrap();
        assert!(find_unknown_keys(&value).is_empty());
    }

    #[test]
    fn caveman_section_accepts_each_intensity_level() {
        for (s, expected) in [
            ("lite", CavemanIntensity::Lite),
            ("full", CavemanIntensity::Full),
            ("ultra", CavemanIntensity::Ultra),
        ] {
            let text = format!("[caveman]\nenabled = true\nintensity = \"{s}\"\n");
            let cfg = parse(&text).unwrap();
            assert_eq!(cfg.caveman.intensity, expected, "intensity {s}");
        }
    }

    #[test]
    fn caveman_section_rejects_unknown_intensity() {
        let text = "
[caveman]
enabled = true
intensity = \"galaxybrain\"
";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(
            msg.contains("expected schema"),
            "expected schema error for unknown intensity, got: {msg}"
        );
    }

    #[test]
    fn caveman_unknown_subkeys_are_flagged() {
        let text = "
[caveman]
enabled = true
mode = \"wenyan\"
";
        let value: toml::Value = toml::from_str(text).unwrap();
        let unknown = find_unknown_keys(&value);
        assert!(unknown.contains(&"caveman.mode".to_string()));
    }

    #[test]
    fn model_pricing_cost_usd_is_per_million_tokens() {
        let p = ModelPricing {
            input_per_million_usd: 10.0,
            output_per_million_usd: 100.0,
        };
        // 1M input tokens → $10. 100k output → $10. Total $20.
        let cost = p.cost_usd(1_000_000, 100_000);
        assert!((cost - 20.0).abs() < 1e-9, "cost: {cost}");
    }

    #[test]
    fn budgets_section_parses_full_form() {
        let text = "
[budgets]
max_total_tokens = 1_000_000
max_total_usd = 5.0

[budgets.pricing.claude-opus-4-7]
input_per_million_usd = 12.5
output_per_million_usd = 60.0

[budgets.pricing.custom-model]
input_per_million_usd = 0.5
output_per_million_usd = 2.0
";
        let cfg = parse(text).unwrap();
        assert_eq!(cfg.budgets.max_total_tokens, Some(1_000_000));
        assert_eq!(cfg.budgets.max_total_usd, Some(5.0));
        let opus = cfg.budgets.pricing.get("claude-opus-4-7").unwrap();
        assert_eq!(opus.input_per_million_usd, 12.5);
        assert_eq!(opus.output_per_million_usd, 60.0);
        let custom = cfg.budgets.pricing.get("custom-model").unwrap();
        assert_eq!(custom.input_per_million_usd, 0.5);
    }

    #[test]
    fn budgets_pricing_subkeys_are_not_flagged_as_unknown() {
        let text = "
[budgets]
max_total_tokens = 100

[budgets.pricing.brand-new-model]
input_per_million_usd = 1.0
output_per_million_usd = 2.0
";
        let value: toml::Value = toml::from_str(text).unwrap();
        let unknown = find_unknown_keys(&value);
        // `pricing` itself is recognized; arbitrary model ids inside it are
        // not validated and therefore not flagged.
        assert!(unknown.is_empty(), "unexpected unknown keys: {:?}", unknown);
    }

    #[test]
    fn agent_section_round_trips_full_form() {
        // The schema must accept `[agent]` plus all four per-backend
        // sub-tables. This is the canonical shape phase 19 introduces; the
        // factory wired in `crate::agent::build_agent` is what reads `backend`
        // back out and dispatches.
        let text = "
[agent]
backend = \"codex\"

[agent.claude_code]
binary = \"/opt/anthropic/claude\"
extra_args = [\"--max-turns\", \"50\"]
model = \"claude-opus-4-7\"
permission_mode = \"bypassPermissions\"

[agent.codex]
binary = \"/usr/local/bin/codex\"
extra_args = [\"--quiet\"]
model = \"gpt-5\"
approval_policy = \"on-request\"

[agent.aider]
binary = \"/usr/local/bin/aider\"
extra_args = []
model = \"sonnet\"

[agent.gemini]
binary = \"/usr/local/bin/gemini\"
extra_args = [\"--no-stream\"]
model = \"gemini-2.5-pro\"
";
        let cfg = parse(text).unwrap();
        assert_eq!(cfg.agent.backend.as_deref(), Some("codex"));
        assert_eq!(
            cfg.agent.claude_code.binary,
            Some(PathBuf::from("/opt/anthropic/claude"))
        );
        assert_eq!(
            cfg.agent.claude_code.extra_args,
            vec!["--max-turns".to_string(), "50".to_string()]
        );
        assert_eq!(
            cfg.agent.claude_code.model.as_deref(),
            Some("claude-opus-4-7")
        );
        assert_eq!(
            cfg.agent.claude_code.permission_mode.as_deref(),
            Some("bypassPermissions")
        );
        assert_eq!(
            cfg.agent.codex.binary,
            Some(PathBuf::from("/usr/local/bin/codex"))
        );
        assert_eq!(cfg.agent.codex.extra_args, vec!["--quiet".to_string()]);
        assert_eq!(cfg.agent.codex.model.as_deref(), Some("gpt-5"));
        assert_eq!(
            cfg.agent.codex.approval_policy.as_deref(),
            Some("on-request")
        );
        assert_eq!(
            cfg.agent.aider.binary,
            Some(PathBuf::from("/usr/local/bin/aider"))
        );
        assert!(cfg.agent.aider.extra_args.is_empty());
        assert_eq!(cfg.agent.aider.model.as_deref(), Some("sonnet"));
        assert_eq!(
            cfg.agent.gemini.binary,
            Some(PathBuf::from("/usr/local/bin/gemini"))
        );
        assert_eq!(cfg.agent.gemini.extra_args, vec!["--no-stream".to_string()]);
        assert_eq!(cfg.agent.gemini.model.as_deref(), Some("gemini-2.5-pro"));

        // The known sub-keys list must cover the new section so canonical
        // input doesn't trip the warn-on-unknown path.
        let value: toml::Value = toml::from_str(text).unwrap();
        assert!(find_unknown_keys(&value).is_empty());
    }

    #[test]
    fn agent_backend_alone_round_trips_with_defaults() {
        // Setting just the backend selector is the common case for users
        // opting in to a non-default backend without further customization.
        let text = "
[agent]
backend = \"codex\"
";
        let cfg = parse(text).unwrap();
        assert_eq!(cfg.agent.backend.as_deref(), Some("codex"));
        assert_eq!(cfg.agent.codex, BackendOverrides::default());
        assert_eq!(cfg.agent.claude_code, BackendOverrides::default());
        assert_eq!(cfg.agent.aider, BackendOverrides::default());
        assert_eq!(cfg.agent.gemini, BackendOverrides::default());
    }

    #[test]
    fn empty_input_yields_defaults() {
        assert_eq!(parse("").unwrap(), Config::default());
        assert_eq!(parse("   \n\t\n").unwrap(), Config::default());
    }

    #[test]
    fn full_input_overrides_every_field() {
        let text = "
[models]
planner = \"a\"
implementer = \"b\"
auditor = \"c\"
fixer = \"d\"

[retries]
fixer_max_attempts = 7
max_phase_attempts = 11

[audit]
enabled = false
small_fix_line_limit = 5

[git]
branch_prefix = \"work/\"
create_pr = true

[tests]
command = \"make check\"
";
        let cfg = parse(text).unwrap();
        assert_eq!(cfg.models.planner, "a");
        assert_eq!(cfg.models.implementer, "b");
        assert_eq!(cfg.models.auditor, "c");
        assert_eq!(cfg.models.fixer, "d");
        assert_eq!(cfg.retries.fixer_max_attempts, 7);
        assert_eq!(cfg.retries.max_phase_attempts, 11);
        assert!(!cfg.audit.enabled);
        assert_eq!(cfg.audit.small_fix_line_limit, 5);
        assert_eq!(cfg.git.branch_prefix, "work/");
        assert!(cfg.git.create_pr);
        assert_eq!(cfg.tests.command.as_deref(), Some("make check"));
    }

    #[test]
    fn partial_input_fills_remaining_with_defaults() {
        let text = "
[git]
create_pr = true
";
        let cfg = parse(text).unwrap();
        // Specified field took effect.
        assert!(cfg.git.create_pr);
        // Untouched field within the same section stays at default.
        assert_eq!(cfg.git.branch_prefix, "pitboss/play/");
        // Whole sections missing → defaults.
        assert_eq!(cfg.models, ModelRoles::default());
        assert_eq!(cfg.retries, RetryBudgets::default());
        assert_eq!(cfg.audit, AuditConfig::default());
    }

    #[test]
    fn partial_section_fills_missing_subkeys() {
        let text = "
[models]
implementer = \"custom-impl\"
";
        let cfg = parse(text).unwrap();
        assert_eq!(cfg.models.implementer, "custom-impl");
        // Other model fields still at default.
        assert_eq!(cfg.models.planner, ModelRoles::default().planner);
        assert_eq!(cfg.models.auditor, ModelRoles::default().auditor);
        assert_eq!(cfg.models.fixer, ModelRoles::default().fixer);
    }

    #[test]
    fn malformed_toml_is_an_error() {
        let err = parse("[models\nplanner = \"x\"").unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("not valid TOML"), "msg: {msg}");
    }

    #[test]
    fn wrong_value_type_is_an_error() {
        let text = "
[retries]
fixer_max_attempts = \"two\"
";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(
            msg.contains("expected schema"),
            "expected schema error, got: {msg}"
        );
    }

    #[test]
    fn unknown_keys_are_collected_not_errored() {
        let text = "
something_extra = 1

[models]
planner = \"p\"
new_role = \"x\"

[telemetry]
sink = \"stdout\"
";
        let cfg = parse(text).unwrap();
        // Known fields still loaded.
        assert_eq!(cfg.models.planner, "p");
        // Unknown fields surfaced by the helper.
        let toml_value: toml::Value = toml::from_str(text).unwrap();
        let unknown = find_unknown_keys(&toml_value);
        assert!(unknown.contains(&"something_extra".to_string()));
        assert!(unknown.contains(&"models.new_role".to_string()));
        assert!(unknown.contains(&"telemetry".to_string()));
    }

    #[test]
    fn no_unknown_keys_for_canonical_input() {
        let text = "
[models]
planner = \"p\"
implementer = \"i\"
auditor = \"a\"
fixer = \"f\"

[retries]
fixer_max_attempts = 1
max_phase_attempts = 2

[audit]
enabled = true
small_fix_line_limit = 10

[git]
branch_prefix = \"x/\"
create_pr = false

[tests]
command = \"cargo test\"
";
        let value: toml::Value = toml::from_str(text).unwrap();
        assert!(find_unknown_keys(&value).is_empty());
    }

    #[test]
    fn load_returns_defaults_when_file_missing() {
        let dir = tempdir().unwrap();
        let cfg = load(dir.path()).unwrap();
        assert_eq!(cfg, Config::default());
    }

    #[test]
    fn load_reads_file_from_workspace() {
        let dir = tempdir().unwrap();
        let cfg_path = config_path(dir.path());
        std::fs::create_dir_all(cfg_path.parent().unwrap()).unwrap();
        std::fs::write(&cfg_path, "[git]\nbranch_prefix = \"loaded/\"\n").unwrap();
        let cfg = load(dir.path()).unwrap();
        assert_eq!(cfg.git.branch_prefix, "loaded/");
    }

    #[test]
    fn load_surfaces_parse_errors_with_path_context() {
        let dir = tempdir().unwrap();
        let cfg_path = config_path(dir.path());
        std::fs::create_dir_all(cfg_path.parent().unwrap()).unwrap();
        std::fs::write(&cfg_path, "[broken").unwrap();
        let err = load(dir.path()).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("config.toml"), "msg: {msg}");
    }

    #[test]
    fn init_template_round_trips_through_loader() {
        // The seed `config.toml` written by `pitboss init` must parse cleanly
        // and produce defaults equivalent to `Config::default()`. If the two
        // ever drift this test catches it.
        let dir = tempdir().unwrap();
        crate::cli::init::run(dir.path()).unwrap();
        let cfg = load(dir.path()).unwrap();
        assert_eq!(cfg, Config::default());
    }
}

/// `[grind]` section parser tests, kept in their own `#[cfg(test)] mod grind`
/// so they show up under `pitboss::config::grind::…` and can be filtered with
/// `cargo test config::grind`.
#[cfg(test)]
mod grind {
    use super::*;

    #[test]
    fn missing_section_yields_default() {
        // A `config.toml` with no `[grind]` block must round-trip to
        // `GrindConfig::default()` so existing workspaces are untouched.
        let cfg = parse("[git]\nbranch_prefix = \"x/\"\n").unwrap();
        assert_eq!(cfg.grind, GrindConfig::default());
    }

    #[test]
    fn full_section_round_trips() {
        let text = r#"
[grind]
prompts_dir = "/var/pitboss/prompts"
default_rotation = "nightly"
max_parallel = 4
consecutive_failure_limit = 7
hook_timeout_secs = 90
transcript_retention = "keep_none"

[grind.budgets]
max_iterations = 50
until = "2026-05-01T00:00:00Z"
max_cost_usd = 5.0
max_tokens = 1000000

[grind.hooks]
pre_session = "echo before"
post_session = "echo after"
on_failure = "echo failed"
"#;
        let cfg = parse(text).unwrap();
        assert_eq!(
            cfg.grind.prompts_dir,
            Some(PathBuf::from("/var/pitboss/prompts"))
        );
        assert_eq!(cfg.grind.default_rotation.as_deref(), Some("nightly"));
        assert_eq!(cfg.grind.max_parallel, 4);
        assert_eq!(cfg.grind.consecutive_failure_limit, 7);
        assert_eq!(cfg.grind.hook_timeout_secs, 90);
        assert_eq!(
            cfg.grind.transcript_retention,
            TranscriptRetention::KeepNone
        );
        assert_eq!(cfg.grind.budgets.max_iterations, Some(50));
        assert_eq!(cfg.grind.budgets.max_cost_usd, Some(5.0));
        assert_eq!(cfg.grind.budgets.max_tokens, Some(1_000_000));
        assert!(cfg.grind.budgets.until.is_some());
        assert_eq!(cfg.grind.hooks.pre_session.as_deref(), Some("echo before"));
        assert_eq!(cfg.grind.hooks.post_session.as_deref(), Some("echo after"));
        assert_eq!(cfg.grind.hooks.on_failure.as_deref(), Some("echo failed"));

        // Canonical input must not trip the unknown-keys walker.
        let value: toml::Value = toml::from_str(text).unwrap();
        assert!(find_unknown_keys(&value).is_empty());
    }

    #[test]
    fn partial_section_fills_missing_with_defaults() {
        let text = r#"
[grind]
max_parallel = 2
"#;
        let cfg = parse(text).unwrap();
        assert_eq!(cfg.grind.max_parallel, 2);
        // Other fields untouched.
        assert_eq!(cfg.grind.consecutive_failure_limit, 3);
        assert_eq!(cfg.grind.hook_timeout_secs, 60);
        assert_eq!(cfg.grind.transcript_retention, TranscriptRetention::KeepAll);
        assert!(cfg.grind.budgets.max_iterations.is_none());
        assert!(cfg.grind.hooks.pre_session.is_none());
    }

    #[test]
    fn transcript_retention_accepts_each_variant() {
        for (s, expected) in [
            ("keep_all", TranscriptRetention::KeepAll),
            ("keep_none", TranscriptRetention::KeepNone),
        ] {
            let text = format!("[grind]\ntranscript_retention = \"{s}\"\n");
            let cfg = parse(&text).unwrap();
            assert_eq!(
                cfg.grind.transcript_retention, expected,
                "transcript_retention {s}"
            );
        }
    }

    #[test]
    fn transcript_retention_rejects_unknown_value() {
        let text = "[grind]\ntranscript_retention = \"shred\"\n";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(
            msg.contains("expected schema"),
            "expected schema error for unknown retention, got: {msg}"
        );
    }

    #[test]
    fn unknown_top_level_grind_key_is_flagged() {
        let text = "[grind]\nturbo = true\n";
        let value: toml::Value = toml::from_str(text).unwrap();
        let unknown = find_unknown_keys(&value);
        assert!(unknown.contains(&"grind.turbo".to_string()));
    }

    #[test]
    fn max_parallel_zero_is_rejected() {
        let text = "[grind]\nmax_parallel = 0\n";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("max_parallel"), "msg: {msg}");
    }

    #[test]
    fn consecutive_failure_limit_zero_is_rejected() {
        let text = "[grind]\nconsecutive_failure_limit = 0\n";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("consecutive_failure_limit"), "msg: {msg}");
    }

    #[test]
    fn hook_timeout_secs_zero_is_rejected() {
        let text = "[grind]\nhook_timeout_secs = 0\n";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("hook_timeout_secs"), "msg: {msg}");
    }
}

/// `[sweep]` section parser tests, kept under `pitboss::config::sweep::…` so
/// they can be filtered with `cargo test config::sweep`.
#[cfg(test)]
mod sweep {
    use super::*;

    #[test]
    fn missing_section_yields_default() {
        let cfg = parse("[git]\nbranch_prefix = \"x/\"\n").unwrap();
        assert_eq!(cfg.sweep, SweepConfig::default());
    }

    #[test]
    fn full_section_round_trips() {
        let text = "
[sweep]
enabled = false
trigger_min_items = 3
trigger_max_items = 10
max_consecutive = 2
escalate_after = 4
audit_enabled = false
final_sweep_enabled = false
final_sweep_max_iterations = 5
";
        let cfg = parse(text).unwrap();
        assert!(!cfg.sweep.enabled);
        assert_eq!(cfg.sweep.trigger_min_items, 3);
        assert_eq!(cfg.sweep.trigger_max_items, 10);
        assert_eq!(cfg.sweep.max_consecutive, 2);
        assert_eq!(cfg.sweep.escalate_after, 4);
        assert!(!cfg.sweep.audit_enabled);
        assert!(!cfg.sweep.final_sweep_enabled);
        assert_eq!(cfg.sweep.final_sweep_max_iterations, 5);

        let value: toml::Value = toml::from_str(text).unwrap();
        assert!(find_unknown_keys(&value).is_empty());
    }

    #[test]
    fn pre_phase_08_section_picks_up_final_sweep_defaults() {
        // A `pitboss.toml` written before phase 08 has no `final_sweep_*`
        // keys; the fields must round-trip to their defaults.
        let text = "
[sweep]
enabled = true
trigger_min_items = 4
escalate_after = 2
";
        let cfg = parse(text).unwrap();
        assert!(cfg.sweep.final_sweep_enabled);
        assert_eq!(cfg.sweep.final_sweep_max_iterations, 3);
    }

    #[test]
    fn final_sweep_max_iterations_zero_is_rejected() {
        let text = "[sweep]\nfinal_sweep_max_iterations = 0\n";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("final_sweep_max_iterations"), "msg: {msg}");
    }

    #[test]
    fn partial_section_fills_missing_with_defaults() {
        let text = "
[sweep]
trigger_min_items = 7
";
        let cfg = parse(text).unwrap();
        assert_eq!(cfg.sweep.trigger_min_items, 7);
        // Other fields untouched.
        assert!(cfg.sweep.enabled);
        // trigger_max_items default (8) >= the override (7), so this still
        // satisfies the trigger_min <= trigger_max validator.
        assert_eq!(cfg.sweep.trigger_max_items, 8);
        assert_eq!(cfg.sweep.max_consecutive, 1);
        assert_eq!(cfg.sweep.escalate_after, 3);
        assert!(cfg.sweep.audit_enabled);
        assert!(cfg.sweep.final_sweep_enabled);
        assert_eq!(cfg.sweep.final_sweep_max_iterations, 3);
    }

    #[test]
    fn unknown_subkey_is_flagged() {
        let text = "[sweep]\naggressive = true\n";
        let value: toml::Value = toml::from_str(text).unwrap();
        let unknown = find_unknown_keys(&value);
        assert!(unknown.contains(&"sweep.aggressive".to_string()));
    }

    #[test]
    fn trigger_min_items_zero_is_rejected() {
        let text = "[sweep]\ntrigger_min_items = 0\n";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("trigger_min_items"), "msg: {msg}");
    }

    #[test]
    fn trigger_min_above_max_is_rejected() {
        let text = "
[sweep]
trigger_min_items = 9
trigger_max_items = 4
";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("trigger_min_items"), "msg: {msg}");
        assert!(msg.contains("trigger_max_items"), "msg: {msg}");
    }

    #[test]
    fn max_consecutive_zero_is_rejected() {
        let text = "[sweep]\nmax_consecutive = 0\n";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("max_consecutive"), "msg: {msg}");
    }

    #[test]
    fn escalate_after_zero_is_rejected() {
        let text = "[sweep]\nescalate_after = 0\n";
        let err = parse(text).unwrap_err();
        let msg = format!("{:#}", err);
        assert!(msg.contains("escalate_after"), "msg: {msg}");
    }

    #[test]
    fn missing_sweep_section_uses_documented_defaults() {
        // Phase 02 acceptance: a config.toml with no [sweep] section parses
        // and applies the documented defaults verbatim.
        let text = "
[git]
branch_prefix = \"work/\"

[audit]
enabled = true
";
        let cfg = parse(text).unwrap();
        assert_eq!(cfg.sweep, SweepConfig::default());
    }
}