supercode-harness 0.4.13

//! Acceptance tests for TR-7 (`.volter/tracker/markdown/TR-7.md`, T20): LLM-
//! written summary placeholders over an A10 `TurnsCleared` span, gated by
//! `ReductionPolicy::summarize_cleared_turns` (default off) and driven by the
//! injectable `reduce::summarize::SpanSummarizer` side-call
//! (`reduce::prepare_cleared_turns_summary`, always run OUTSIDE
//! `project_messages` — mirrors A8's `probe_read_freshness` split).
//!
//! No test here ever performs a real network/model call: every summarizer
//! below is a small deterministic (or deliberately failing) in-process fake.
//!
//! ACs covered (dev/01-05; dev/06 is the separate archived demo artifact in
//! `reduce_summaries_demo.rs`, and the disk-reload guarantor lives in
//! `tr7_summary_guarantor.rs`):
//! - dev/01: summaries on -> banner + summary + reduction_id; summaries off
//!   (default) -> byte-identical to the pre-TR-7 deterministic stub.
//! - dev/02: invert/export purity — zero summary text, byte-exact restore,
//!   regardless of summaries on/off.
//! - dev/03: summarizer failure/empty output falls back to the deterministic
//!   stub, never blocking/failing the pass.
//! - dev/04: audit trail — model id, prompt version, summary hash recorded;
//!   `verify_log` passes (sidecar-bytes-anchored).
//! - dev/05: cost guard — a span below the floor never even calls the
//!   summarizer (tested at the boundary).

use std::sync::atomic::{AtomicUsize, Ordering};

use supercode_harness::reduce::summarize::{SpanSummarizer, PROMPT_VERSION};
use supercode_harness::reduce::{
    content_hash, export_session, invert, prepare_cleared_turns_summary, project_messages,
    verify_log, ReductionError, ReductionKind, ReductionLog, ReductionPolicy, ReductionResult,
};
use supercode_harness::session::SessionFormat;
use supercode_harness::{ChatMessage, Session};

/// A deterministic all-ASCII filler string of exactly `len` bytes.
fn filler(len: usize) -> String {
    (0..len).map(|i| (b'a' + (i % 26) as u8) as char).collect()
}

fn empty_session() -> Session {
    Session::from_claude_code_str("").unwrap()
}

/// Append `n` (user, assistant) turn pairs with enough padding that the
/// resulting cleared span comfortably clears `ReductionPolicy::default()`'s
/// cost-guard floor (400 * 4 = 1600 bytes) without needing to fiddle with
/// those knobs in every test. Deliberately duplicated from
/// `reduce_projection.rs::append_synthetic_turns` (padded) rather than
/// shared — each integration test binary stands on its own, matching this
/// crate's established convention (see e.g. `export_sidecar.rs`'s `msg_eq`).
fn append_padded_turns(session: &mut Session, n: usize) {
    let pad = filler(120);
    for i in 0..n {
        session
            .messages
            .push(ChatMessage::user(format!("user turn {i}: {pad}")));
        session.messages.push(ChatMessage::assistant(format!(
            "assistant reply {i}: {pad}"
        )));
    }
}

/// Every message's serialized wire bytes for `assert_identity`-style
/// byte-exact comparison (mirrors `reduce_projection.rs::messages_identical`,
/// duplicated for the same standalone-test-binary reason).
fn messages_identical(a: &[ChatMessage], b: &[ChatMessage]) -> bool {
    a.len() == b.len()
        && a.iter().zip(b).all(|(x, y)| {
            x.role == y.role
                && x.content == y.content
                && x.content_parts == y.content_parts
                && x.tool_call_id == y.tool_call_id
                && x.name == y.name
                && x.metadata == y.metadata
        })
}

/// A canned, deterministic summarizer: always succeeds with a fixed string.
/// Never calls out to a real model — this is exactly the "injected
/// deterministic fake" TR-7 requires every test to use instead.
struct FakeSummarizer {
    text: &'static str,
    model: &'static str,
}
impl SpanSummarizer for FakeSummarizer {
    fn summarize(&self, _span_text: &str) -> ReductionResult<String> {
        Ok(self.text.to_string())
    }
    fn model_id(&self) -> &str {
        self.model
    }
}

/// A summarizer that always errors — models a provider failure or a
/// caller-enforced timeout (dev/03's fault-injection fixture).
struct FailingSummarizer;
impl SpanSummarizer for FailingSummarizer {
    fn summarize(&self, _span_text: &str) -> ReductionResult<String> {
        Err(ReductionError::new("simulated summarization timeout"))
    }
    fn model_id(&self) -> &str {
        "unreachable-model"
    }
}

/// A summarizer that always succeeds but counts how many times it was
/// actually invoked — dev/05 needs to prove the cost-guard floor skips the
/// side-call ENTIRELY for a too-small span, not merely discards its result.
struct CountingSummarizer {
    calls: AtomicUsize,
    text: &'static str,
}
impl SpanSummarizer for CountingSummarizer {
    fn summarize(&self, _span_text: &str) -> ReductionResult<String> {
        self.calls.fetch_add(1, Ordering::SeqCst);
        Ok(self.text.to_string())
    }
    fn model_id(&self) -> &str {
        "counting-model"
    }
}

/// Extract the singleton `TurnsCleared` reduction's `(first, last)` from a
/// log, panicking with a useful message if it isn't there.
fn find_cleared(log: &ReductionLog) -> (usize, usize) {
    log.reductions
        .iter()
        .find_map(|r| match r.kind {
            ReductionKind::TurnsCleared { first, last, .. } => Some((first, last)),
            _ => None,
        })
        .expect("expected exactly one TurnsCleared reduction")
}

// ---- dev/01: off by default is byte-identical; on renders the summary -----

#[test]
fn dev01_summaries_off_by_default_matches_the_pre_tr7_deterministic_stub() {
    let mut session = empty_session();
    append_padded_turns(&mut session, 10); // 20 messages
    let msgs = session.messages.clone();

    // `ReductionPolicy::default()` leaves `summarize_cleared_turns` off —
    // this IS the "default" dev/01 cares about, not a hand-picked value.
    let policy = ReductionPolicy {
        clear_turns_older_than: Some(8),
        ..ReductionPolicy::default()
    };
    assert!(
        !policy.summarize_cleared_turns,
        "summaries must default to OFF"
    );
    let prior = ReductionLog::default();

    let (view, log) = project_messages(&msgs, &policy, &prior);
    let (first, last) = find_cleared(&log);
    let r = log
        .reductions
        .iter()
        .find(|r| matches!(r.kind, ReductionKind::TurnsCleared { .. }))
        .unwrap();

    // The exact pre-TR-7 grammar: `[sc-reduced turns-cleared <id>: turns
    // <first>..<last+1> cleared (<n> messages: ...) — full turns in session
    // sidecar]` — the deterministic stub, unchanged. Pin the structural
    // pieces (never a hand-computed byte count, which is a derived,
    // formatting-sensitive figure) so a future change to TR-7's summarized
    // branch can never silently alter the off-by-default path.
    assert_eq!(first, 0);
    assert_eq!(last, 15);
    assert!(
        r.placeholder.starts_with(&format!(
            "[sc-reduced turns-cleared {}: turns {first}..{} cleared (16 messages: 8 user, 8 \
             assistant, 0 tool; ",
            r.id,
            last + 1,
        )),
        "{}",
        r.placeholder
    );
    assert!(
        !r.placeholder.contains("sc-summary"),
        "off by default must never carry a summary banner: {}",
        r.placeholder
    );
    assert!(
        r.placeholder.starts_with("[sc-reduced turns-cleared "),
        "{}",
        r.placeholder
    );
    assert!(
        r.placeholder.contains("full turns in session sidecar"),
        "{}",
        r.placeholder
    );
    assert!(matches!(
        r.kind,
        ReductionKind::TurnsCleared { summary: None, .. }
    ));

    // Defense in depth: even if a caller mistakenly populated
    // `cleared_turns_summary` while `summarize_cleared_turns` stays off, the
    // rendered placeholder must be UNCHANGED — the policy gate alone decides
    // this, not merely "was a prepared summary present."
    let mut policy_with_stray_data = policy.clone();
    let fake = FakeSummarizer {
        text: "should never be used",
        model: "never-called-model",
    };
    policy_with_stray_data.cleared_turns_summary = prepare_cleared_turns_summary(
        &msgs,
        &{
            let mut p = policy.clone();
            p.summarize_cleared_turns = true;
            p
        },
        &prior,
        &fake,
    );
    let (_, log_stray) = project_messages(&msgs, &policy_with_stray_data, &prior);
    let r_stray = log_stray
        .reductions
        .iter()
        .find(|r| matches!(r.kind, ReductionKind::TurnsCleared { .. }))
        .unwrap();
    assert_eq!(
        r_stray.placeholder, r.placeholder,
        "policy gate off must win even with a prepared summary sitting in the policy"
    );

    let _ = view;
}

#[test]
fn dev01_summaries_on_projects_banner_llm_summary_and_reduction_id() {
    let mut session = empty_session();
    append_padded_turns(&mut session, 10);
    let msgs = session.messages.clone();

    let mut policy = ReductionPolicy {
        clear_turns_older_than: Some(8),
        summarize_cleared_turns: true,
        ..ReductionPolicy::default()
    };
    let prior = ReductionLog::default();

    let fake = FakeSummarizer {
        text: "The user asked about widgets; the assistant explained the API.",
        model: "fake-summary-model-v1",
    };
    let prepared = prepare_cleared_turns_summary(&msgs, &policy, &prior, &fake)
        .expect("a large-enough span above the cost floor must be prepared");
    policy.cleared_turns_summary = Some(prepared);

    let (view, log) = project_messages(&msgs, &policy, &prior);
    let (first, last) = find_cleared(&log);
    let r = log
        .reductions
        .iter()
        .find(|r| matches!(r.kind, ReductionKind::TurnsCleared { .. }))
        .unwrap();

    assert!(
        r.placeholder.contains("widgets"),
        "the LLM summary text must appear in the placeholder: {}",
        r.placeholder
    );
    assert!(
        r.placeholder.contains(&format!("sc-summary of {}", r.id)),
        "{}",
        r.placeholder
    );
    assert!(
        r.placeholder
            .contains(&format!("expand_reduction(\"{}\")", r.id)),
        "the honesty banner must spell out the exact escape hatch: {}",
        r.placeholder
    );
    assert!(
        r.placeholder.contains("original 16 messages in sidecar"),
        "{}",
        r.placeholder
    );
    assert!(matches!(
        r.kind,
        ReductionKind::TurnsCleared {
            summary: Some(_),
            ..
        }
    ));

    let placeholder_msg = &view[first];
    assert_eq!(
        supercode_harness::reduce::reduction_id(placeholder_msg),
        Some(r.id.as_str())
    );
    let _ = last;
}

// ---- dev/02: invert/export purity, both on and off -------------------------

#[test]
fn dev02_invert_restores_original_byte_exact_and_never_carries_summary_text() {
    for summaries_on in [false, true] {
        let mut session = empty_session();
        append_padded_turns(&mut session, 10);
        let msgs = session.messages.clone();

        let mut policy = ReductionPolicy {
            clear_turns_older_than: Some(8),
            summarize_cleared_turns: summaries_on,
            ..ReductionPolicy::default()
        };
        let prior = ReductionLog::default();
        if summaries_on {
            let fake = FakeSummarizer {
                text: "UNIQUE-SUMMARY-MARKER-9f3c should never survive invert or export",
                model: "fake-model",
            };
            policy.cleared_turns_summary =
                prepare_cleared_turns_summary(&msgs, &policy, &prior, &fake);
            assert!(policy.cleared_turns_summary.is_some());
        }

        let (view, log) = project_messages(&msgs, &policy, &prior);
        if summaries_on {
            let r = log
                .reductions
                .iter()
                .find(|r| matches!(r.kind, ReductionKind::TurnsCleared { .. }))
                .unwrap();
            assert!(r.placeholder.contains("UNIQUE-SUMMARY-MARKER-9f3c"));
        }

        // B10 conformance: verify_log is anchored on sidecar bytes alone —
        // passes identically whether summaries are on or off.
        verify_log(&log, &session)
            .unwrap_or_else(|e| panic!("verify_log must pass (summaries_on={summaries_on}): {e}"));

        let inverted = invert(&view, &log, &session)
            .unwrap_or_else(|e| panic!("invert must pass (summaries_on={summaries_on}): {e}"));
        assert!(
            messages_identical(&inverted, &msgs),
            "invert must restore the original byte-exact (summaries_on={summaries_on})"
        );
        for m in &inverted {
            let content = m.content.as_deref().unwrap_or("");
            assert!(
                !content.contains("UNIQUE-SUMMARY-MARKER-9f3c"),
                "invert leaked summary text into a restored original (summaries_on={summaries_on})"
            );
        }

        // A11 export purity: export_session reads ONLY the sidecar, never
        // the view/log — so the summary marker can never appear in it,
        // regardless of whether a summary was ever minted for this session.
        let sidecar_jsonl = empty_session().to_native_jsonl_v2(&msgs);
        let exported = export_session(&sidecar_jsonl, SessionFormat::ClaudeCode)
            .unwrap_or_else(|e| panic!("export_session failed (summaries_on={summaries_on}): {e}"));
        assert!(
            !exported.contains("UNIQUE-SUMMARY-MARKER-9f3c"),
            "export leaked summary text (summaries_on={summaries_on}):\n{exported}"
        );
        assert!(!exported.contains(supercode_harness::reduce::REDUCTION_SENTINEL));
    }
}

// ---- dev/03: failure/empty fallback ----------------------------------------

#[test]
fn dev03_erroring_summarizer_falls_back_to_the_deterministic_stub() {
    let mut session = empty_session();
    append_padded_turns(&mut session, 10);
    let msgs = session.messages.clone();

    let mut policy = ReductionPolicy {
        clear_turns_older_than: Some(8),
        summarize_cleared_turns: true,
        ..ReductionPolicy::default()
    };
    let prior = ReductionLog::default();

    // The side-call itself must never panic or propagate an error: it simply
    // yields `None`.
    let prepared = prepare_cleared_turns_summary(&msgs, &policy, &prior, &FailingSummarizer);
    assert!(
        prepared.is_none(),
        "an erroring summarizer must never be treated as prepared"
    );
    policy.cleared_turns_summary = prepared;

    let (_, log) = project_messages(&msgs, &policy, &prior);
    let r = log
        .reductions
        .iter()
        .find(|r| matches!(r.kind, ReductionKind::TurnsCleared { .. }))
        .unwrap();
    assert!(
        !r.placeholder.contains("sc-summary"),
        "failure must fall back to the deterministic stub, never a partial/blocked one: {}",
        r.placeholder
    );
    assert!(matches!(
        r.kind,
        ReductionKind::TurnsCleared { summary: None, .. }
    ));

    // Same fallback for a summarizer that "succeeds" with nothing usable.
    struct BlankSummarizer;
    impl SpanSummarizer for BlankSummarizer {
        fn summarize(&self, _: &str) -> ReductionResult<String> {
            Ok("   \n  ".to_string())
        }
        fn model_id(&self) -> &str {
            "blank-model"
        }
    }
    let prepared_blank = prepare_cleared_turns_summary(&msgs, &policy, &prior, &BlankSummarizer);
    assert!(
        prepared_blank.is_none(),
        "a blank/whitespace-only summary must also fall back to the deterministic stub"
    );
}

// ---- dev/04: audit trail ----------------------------------------------------

#[test]
fn dev04_audit_trail_records_model_id_prompt_version_and_summary_hash() {
    let mut session = empty_session();
    append_padded_turns(&mut session, 10);
    let msgs = session.messages.clone();

    let mut policy = ReductionPolicy {
        clear_turns_older_than: Some(8),
        summarize_cleared_turns: true,
        ..ReductionPolicy::default()
    };
    let prior = ReductionLog::default();
    let fake = FakeSummarizer {
        text: "audit-trail summary text",
        model: "audit-model-42",
    };
    policy.cleared_turns_summary = prepare_cleared_turns_summary(&msgs, &policy, &prior, &fake);
    assert!(policy.cleared_turns_summary.is_some());

    let (_, log) = project_messages(&msgs, &policy, &prior);
    let r = log
        .reductions
        .iter()
        .find(|r| matches!(r.kind, ReductionKind::TurnsCleared { .. }))
        .unwrap();
    let audit = match &r.kind {
        ReductionKind::TurnsCleared { summary, .. } => summary
            .as_ref()
            .expect("a summarized span must carry audit metadata"),
        _ => unreachable!(),
    };
    assert_eq!(audit.model_id, "audit-model-42");
    assert_eq!(audit.prompt_version, PROMPT_VERSION);
    assert_eq!(
        audit.summary_hash,
        content_hash("audit-trail summary text".as_bytes()),
        "summary_hash must hash the summarizer's own text, independent of the placeholder's \
         surrounding banner/id punctuation"
    );

    // Persisted-log shape: this all rides `Reduction`/`ReductionLog`'s normal
    // `Serialize`, so it's already covered by the sidecar-family round trip
    // elsewhere (`sidecar_family_reduction_resolve.rs`) — reconfirm here that
    // a log carrying this field still round-trips through JSON verbatim.
    let json = serde_json::to_string(&log).unwrap();
    let reloaded: ReductionLog = serde_json::from_str(&json).unwrap();
    assert_eq!(reloaded, log);

    verify_log(&log, &session).expect("verify_log must pass — anchored on sidecar bytes only");
}

// ---- dev/05: cost guard floor -----------------------------------------------

#[test]
fn dev05_spans_at_or_below_the_floor_are_never_summarized_no_side_call_at_all() {
    // A small session whose cleared span is intentionally tiny, with a
    // policy whose floor is set explicitly so the boundary is exact rather
    // than dependent on serialization-format incidentals.
    let mut session = empty_session();
    // 10 pairs -> 20 messages, threshold 8 -> clears messages [0..=15]
    // (16 messages), same shape as every other test above.
    append_padded_turns(&mut session, 10);
    let msgs = session.messages.clone();

    let prior = ReductionLog::default();

    // Point 1: an unreachably high floor -> even a large span must be
    // skipped, and the summarizer must NEVER be called.
    let counting = CountingSummarizer {
        calls: AtomicUsize::new(0),
        text: "should not be produced",
    };
    let policy_above_floor = ReductionPolicy {
        clear_turns_older_than: Some(8),
        summarize_cleared_turns: true,
        expected_summary_bytes: 1_000_000,
        summary_cost_floor_multiple: 1,
        ..ReductionPolicy::default()
    };
    let prepared = prepare_cleared_turns_summary(&msgs, &policy_above_floor, &prior, &counting);
    assert!(
        prepared.is_none(),
        "a span below the cost-guard floor must never be prepared"
    );
    assert_eq!(
        counting.calls.load(Ordering::SeqCst),
        0,
        "the summarizer must never be CALLED for a below-floor span — not just have its result discarded"
    );

    // Point 2: a floor of 0 (trivially satisfied by any non-empty span) ->
    // the same span (same messages, same threshold) is now prepared, and the
    // summarizer WAS called exactly once.
    let counting2 = CountingSummarizer {
        calls: AtomicUsize::new(0),
        text: "now above the floor",
    };
    let policy_below_floor = ReductionPolicy {
        clear_turns_older_than: Some(8),
        summarize_cleared_turns: true,
        expected_summary_bytes: 1,
        summary_cost_floor_multiple: 1,
        ..ReductionPolicy::default()
    };
    let prepared2 = prepare_cleared_turns_summary(&msgs, &policy_below_floor, &prior, &counting2);
    assert!(
        prepared2.is_some(),
        "the identical span must be prepared once it clears the floor"
    );
    assert_eq!(counting2.calls.load(Ordering::SeqCst), 1);

    // Exact boundary: floor == range_bytes must skip (strictly-greater-than
    // required, never greater-or-equal) — derive the true range_bytes first
    // via a policy definitely below it, then pin the boundary exactly.
    let probe = CountingSummarizer {
        calls: AtomicUsize::new(0),
        text: "probe",
    };
    let policy_probe = ReductionPolicy {
        clear_turns_older_than: Some(8),
        summarize_cleared_turns: true,
        expected_summary_bytes: 1,
        summary_cost_floor_multiple: 1,
        ..ReductionPolicy::default()
    };
    let _ = prepare_cleared_turns_summary(&msgs, &policy_probe, &prior, &probe);
    // Reconstruct the exact byte figure `hash_turns_range` would report,
    // through the one place it's observable on the public surface: the
    // deterministic stub's own summary clause (`; <N>B) — full turns`).
    let policy_off = ReductionPolicy {
        clear_turns_older_than: Some(8),
        ..ReductionPolicy::default()
    };
    let (_, log_off) = project_messages(&msgs, &policy_off, &prior);
    let r = log_off
        .reductions
        .iter()
        .find(|r| matches!(r.kind, ReductionKind::TurnsCleared { .. }))
        .unwrap();
    // The stub's byte figure is comma-grouped (`format_commas`, e.g.
    // `3,296B)`) — strip the grouping commas before parsing.
    let n_bytes: usize = r
        .placeholder
        .split(';')
        .nth(1)
        .and_then(|s| s.split("B)").next())
        .map(|s| s.trim().replace(',', ""))
        .and_then(|s| s.parse().ok())
        .expect("deterministic stub must carry a parseable `; <N>B)` clause");

    let counting_at_floor = CountingSummarizer {
        calls: AtomicUsize::new(0),
        text: "at floor",
    };
    let policy_at_floor = ReductionPolicy {
        clear_turns_older_than: Some(8),
        summarize_cleared_turns: true,
        expected_summary_bytes: n_bytes,
        summary_cost_floor_multiple: 1, // floor == n_bytes exactly
        ..ReductionPolicy::default()
    };
    let prepared_at_floor =
        prepare_cleared_turns_summary(&msgs, &policy_at_floor, &prior, &counting_at_floor);
    assert!(
        prepared_at_floor.is_none(),
        "a span exactly AT the floor (not strictly above) must still be skipped"
    );
    assert_eq!(counting_at_floor.calls.load(Ordering::SeqCst), 0);

    let counting_above_floor = CountingSummarizer {
        calls: AtomicUsize::new(0),
        text: "one byte above the floor",
    };
    let policy_one_above = ReductionPolicy {
        clear_turns_older_than: Some(8),
        summarize_cleared_turns: true,
        expected_summary_bytes: n_bytes - 1,
        summary_cost_floor_multiple: 1, // floor == n_bytes - 1, span == n_bytes -> above
        ..ReductionPolicy::default()
    };
    let prepared_one_above =
        prepare_cleared_turns_summary(&msgs, &policy_one_above, &prior, &counting_above_floor);
    assert!(
        prepared_one_above.is_some(),
        "a span one byte above the floor must be summarized"
    );
    assert_eq!(counting_above_floor.calls.load(Ordering::SeqCst), 1);
}