tix-tracker 0.12.0

//! Integration tests for `tix export` / `tix import`, driven through the
//! compiled binary only. Each test installs fake `glab`/`linear-cli` shell
//! scripts on `PATH` that record argv and the token env, and answers with
//! canned JSON payloads set via `TIX_FAKE_LIST`.

use std::fs;
use std::path::PathBuf;
use std::process::Output;

use assert_cmd::Command;
use tempfile::TempDir;

fn tix() -> Command {
    Command::cargo_bin("tix").unwrap()
}

fn bin_dir() -> PathBuf {
    let manifest = std::env::var("CARGO_MANIFEST_DIR").unwrap_or_else(|_| ".".into());
    PathBuf::from(manifest).join("tests").join("bin")
}

struct Harness {
    tmp: TempDir,
    record: PathBuf,
    existing_path: String,
}

impl Harness {
    fn new() -> Self {
        let tmp = TempDir::new().unwrap();
        let record = tmp.path().join("records.txt");
        let existing_path = std::env::var("PATH").unwrap_or_default();
        Harness {
            tmp,
            record,
            existing_path,
        }
    }

    fn dir(&self) -> &std::path::Path {
        self.tmp.path()
    }

    fn init(&self) {
        tix().current_dir(self.dir()).arg("init").assert().success();
    }

    fn init_with_gitlab(&self) {
        // init writes default tix.toml; append [export.gitlab]
        self.init();
        let toml_path = self.dir().join("tix.toml");
        let mut contents = fs::read_to_string(&toml_path).unwrap();
        contents.push_str("\n[export.gitlab]\nproject = \"acme/tix\"\ntoken = \"gl-file-token\"\n");
        fs::write(&toml_path, contents).unwrap();
    }

    fn init_with_linear(&self) {
        self.init();
        let toml_path = self.dir().join("tix.toml");
        let mut contents = fs::read_to_string(&toml_path).unwrap();
        contents.push_str("\n[export.linear]\nteam = \"Eng\"\ntoken = \"lin-file-token\"\n");
        fs::write(&toml_path, contents).unwrap();
    }

    fn create_issue(&self, title: &str, body: &str) -> Output {
        let out = tix()
            .current_dir(self.dir())
            .arg("create")
            .args(["--title", title])
            .args(["--body", body])
            .output()
            .unwrap();
        assert!(
            out.status.success(),
            "create failed: {}",
            String::from_utf8_lossy(&out.stderr)
        );
        out
    }

    /// Create with attached flag values, so a title or body that begins with `-`
    /// reaches tix's own parser as a value rather than a flag.
    fn create_issue_attached(&self, title: &str, body: &str) -> Output {
        let out = tix()
            .current_dir(self.dir())
            .arg("create")
            .arg(format!("--title={title}"))
            .arg(format!("--body={body}"))
            .output()
            .unwrap();
        assert!(
            out.status.success(),
            "create failed: {}",
            String::from_utf8_lossy(&out.stderr)
        );
        out
    }

    fn export(&self, target: &str, extra_args: &[&str], env_token: Option<(&str, &str)>) -> Output {
        let mut cmd = tix();
        cmd.current_dir(self.dir())
            .arg("export")
            .args(["--target", target])
            .args(extra_args)
            .env(
                "PATH",
                format!("{}:{}", bin_dir().display(), self.existing_path),
            )
            .env("TIX_FAKE_RECORD", &self.record);
        if let Some((key, val)) = env_token {
            cmd.env(key, val);
        } else {
            // Ensure env token is NOT set so file token or native path is exercised
            cmd.env_remove("GITLAB_TOKEN")
                .env_remove("LINEAR_TOKEN")
                .env_remove("LINEAR_API_KEY");
        }
        cmd.output().unwrap()
    }

    fn import(&self, target: &str, fake_list: &str) -> Output {
        tix()
            .current_dir(self.dir())
            .arg("import")
            .args(["--target", target])
            .env(
                "PATH",
                format!("{}:{}", bin_dir().display(), self.existing_path),
            )
            .env("TIX_FAKE_RECORD", &self.record)
            .env("TIX_FAKE_LIST", fake_list)
            .env_remove("GITLAB_TOKEN")
            .env_remove("LINEAR_TOKEN")
            .env_remove("LINEAR_API_KEY")
            .output()
            .unwrap()
    }

    /// Import Linear: `issues list` answers with `fake_list`, `issues get` with
    /// `fake_get` — the two payload shapes the real verbs return.
    fn import_linear(&self, fake_list: &str, fake_get: &str) -> Output {
        tix()
            .current_dir(self.dir())
            .arg("import")
            .args(["--target", "linear"])
            .env(
                "PATH",
                format!("{}:{}", bin_dir().display(), self.existing_path),
            )
            .env("TIX_FAKE_RECORD", &self.record)
            .env("TIX_FAKE_LIST", fake_list)
            .env("TIX_FAKE_GET", fake_get)
            .env_remove("GITLAB_TOKEN")
            .env_remove("LINEAR_TOKEN")
            .env_remove("LINEAR_API_KEY")
            .output()
            .unwrap()
    }

    fn record_contents(&self) -> String {
        fs::read_to_string(&self.record).unwrap_or_default()
    }

    fn list(&self) -> String {
        // `--all`: the default listing is scoped to your issues in the board's entry
        // column (#1711), and the imported fixtures are not in it.
        let out = tix()
            .current_dir(self.dir())
            .args(["list", "--all"])
            .output()
            .unwrap();
        assert!(out.status.success());
        String::from_utf8_lossy(&out.stdout).to_string()
    }

    fn view(&self, selector: &str) -> String {
        let out = tix()
            .current_dir(self.dir())
            .arg("view")
            .arg(selector)
            .output()
            .unwrap();
        assert!(out.status.success());
        String::from_utf8_lossy(&out.stdout).to_string()
    }
}

// -----------------------------------------------------------------------
// GitLab export tests
// -----------------------------------------------------------------------

#[test]
fn export_creates_and_backfills() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("Fix login", "users cannot log in");

    let out = h.export("gitlab", &[], Some(("GITLAB_TOKEN", "gl-env-secret")));
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("created gitlab issue"), "stdout: {stdout}");

    let record = h.record_contents();
    assert!(
        record.contains("glab issue create --project acme/tix"),
        "record: {record}"
    );
    assert!(
        record.contains("GITLAB_TOKEN=gl-env-secret"),
        "record: {record}"
    );

    // backfill visible via view
    let view = h.view("fix-login");
    assert!(
        view.contains("gitlab_id:"),
        "backfill missing in view: {view}"
    );
}

#[test]
fn export_dry_run_does_not_invoke_tool() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("Fix login", "users cannot log in");

    let out = h.export(
        "gitlab",
        &["--dry-run"],
        Some(("GITLAB_TOKEN", "gl-env-secret")),
    );
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        stdout.contains("would create gitlab issue"),
        "stdout: {stdout}"
    );
    assert!(!h.record.exists(), "dry run must not create a record file");
}

#[test]
fn reexport_issues_update_not_duplicate() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("Fix login", "users cannot log in");

    // first export → creates + backfills
    h.export("gitlab", &[], Some(("GITLAB_TOKEN", "gl-env-secret")));
    let record_after_first = h.record_contents();
    assert!(record_after_first.contains("issue create"));

    // second export → updates only
    let out = h.export("gitlab", &[], Some(("GITLAB_TOKEN", "gl-env-secret")));
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("updated gitlab issue"), "stdout: {stdout}");

    let record = h.record_contents();
    let create_count = record.matches("issue create").count();
    let update_count = record.matches("issue update").count();
    assert_eq!(create_count, 1, "expected exactly 1 create in:\n{record}");
    assert!(
        update_count >= 1,
        "expected at least 1 update in:\n{record}"
    );
}

// -----------------------------------------------------------------------
// GitLab import tests
// -----------------------------------------------------------------------

#[test]
fn import_creates_new_local_issues() {
    let h = Harness::new();
    h.init_with_gitlab();
    let fake_list = r#"[{"iid":10,"title":"Remote bug","description":"from remote","labels":[{"name":"bug"}],"state":"opened","updated_at":"2026-05-12T08:00:00Z","assignees":[{"username":"alice"}]}]"#;
    let out = h.import("gitlab", fake_list);
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        stdout.contains("imported gitlab issue 10"),
        "stdout: {stdout}"
    );

    let list = h.list();
    assert!(list.contains("Remote bug"), "list: {list}");

    let view = h.view("remote");
    assert!(view.contains("gitlab_id: '10'"), "backfill missing: {view}");
    assert!(view.contains("- bug"), "labels missing: {view}");
    assert!(view.contains("@alice"), "assignee missing: {view}");
    assert!(view.contains("title: Remote bug"), "title missing: {view}");
}

#[test]
fn import_filters_closed_issues() {
    let h = Harness::new();
    h.init_with_gitlab();
    let fake_list = r#"[{"iid":10,"title":"Open","state":"opened"},{"iid":20,"title":"Closed","state":"closed"}]"#;
    let out = h.import("gitlab", fake_list);
    assert!(out.status.success());
    let list = h.list();
    assert!(list.contains("Open"), "list: {list}");
    assert!(
        !list.contains("Closed"),
        "list must not contain closed: {list}"
    );
}

/// Import routes remote issues into assignee segments via `store::create`:
/// a GitLab `assignees` entry lands in its derived segment, an unassigned
/// remote issue lands in `unassigned/` (IC-06, WP03).
#[test]
fn import_routes_assignee_into_derived_segment() {
    let h = Harness::new();
    h.init_with_gitlab();
    let fake_list = r#"[
{"iid":10,"title":"Assigned remote","description":"with an owner","labels":[],"state":"opened","updated_at":"2026-05-12T08:00:00Z","assignees":[{"username":"alice"}]},
{"iid":20,"title":"Unassigned remote","description":"orphaned","labels":[],"state":"opened","updated_at":"2026-05-12T08:00:00Z"}
]"#;
    let out = h.import("gitlab", fake_list);
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        stdout.contains("imported gitlab issue 10"),
        "stdout: {stdout}"
    );
    assert!(
        stdout.contains("imported gitlab issue 20"),
        "stdout: {stdout}"
    );

    let issues = h.dir().join("docs").join("issues");
    let md_in = |rel: &str| -> Vec<String> {
        let root = issues.join(rel);
        let mut files: Vec<String> = Vec::new();
        let mut stack = vec![root];
        while let Some(next) = stack.pop() {
            for entry in fs::read_dir(&next).unwrap() {
                let path = entry.unwrap().path();
                let name = path.file_name().unwrap().to_string_lossy().to_string();
                if path.is_dir() {
                    if name.starts_with('.')
                        || name.starts_with(".tix-tmp-")
                        || name.ends_with("-assets")
                    {
                        continue;
                    }
                    stack.push(path);
                } else if path.extension().is_some_and(|e| e == "md") {
                    files.push(
                        path.strip_prefix(&issues)
                            .unwrap()
                            .to_string_lossy()
                            .to_string(),
                    );
                }
            }
        }
        files.sort();
        files
    };

    let assigned = md_in("alice");
    assert_eq!(assigned.len(), 1, "expected one file under alice/");
    let assigned_file = issues.join(&assigned[0]);
    let assigned_raw = fs::read_to_string(&assigned_file).unwrap();
    assert!(
        assigned_raw.contains("assignee:") && assigned_raw.contains("alice"),
        "assigned frontmatter must carry @alice: {assigned_raw}"
    );

    let unassigned = md_in("unassigned");
    assert_eq!(
        unassigned.len(),
        1,
        "expected one file under unassigned/ (got {unassigned:?})"
    );
    let unassigned_raw = fs::read_to_string(issues.join(&unassigned[0])).unwrap();
    assert!(
        !unassigned_raw.contains("assignee"),
        "unassigned frontmatter must omit assignee: {unassigned_raw}"
    );
}

// -----------------------------------------------------------------------
// GitLab conflict resolution
// -----------------------------------------------------------------------

fn write_issue_file(
    dir: &std::path::Path,
    filename: &str,
    gitlab_id: &str,
    title: &str,
    updated: &str,
) {
    let body = format!(
        "---\nnumber: 1\ntitle: \"{title}\"\nstatus: \"todo\"\nlabels: []\npriority: \"medium\"\ngitlab_id: \"{gitlab_id}\"\ncreated: \"2026-01-01\"\nupdated: \"{updated}\"\n---\n\nOriginal body."
    );
    fs::write(dir.join("docs").join("issues").join(filename), body).unwrap();
}

#[test]
fn import_keeps_local_when_older_remote() {
    let h = Harness::new();
    h.init_with_gitlab();
    // local issue gitlab_id=10, updated 2026-01-02 (far in the future)
    let issues_dir = h.dir().join("docs").join("issues");
    fs::create_dir_all(&issues_dir).unwrap();
    write_issue_file(
        h.dir(),
        "2026-01-01-existing.md",
        "10",
        "Existing Title",
        "2026-01-02",
    );

    let fake_list = r#"[{"iid":10,"title":"Remote Title","description":"remote body","labels":[],"state":"opened","updated_at":"2020-01-01T00:00:00Z"}]"#;
    let out = h.import("gitlab", fake_list);
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("kept gitlab issue 10"), "stdout: {stdout}");

    let view = h.view("existing");
    assert!(
        view.contains("title: Existing Title"),
        "title should be unchanged: {view}"
    );
    assert!(
        !view.contains("Remote Title"),
        "should not contain remote title: {view}"
    );
}

#[test]
fn import_overwrites_when_remote_newer_and_creates_bak() {
    let h = Harness::new();
    h.init_with_gitlab();
    let issues_dir = h.dir().join("docs").join("issues");
    fs::create_dir_all(&issues_dir).unwrap();
    write_issue_file(
        h.dir(),
        "2026-01-01-old.md",
        "10",
        "Old Title",
        "2020-01-01",
    );

    let fake_list = r#"[{"iid":10,"title":"New Title","description":"new body","labels":["new-label"],"state":"opened","updated_at":"2026-05-12T00:00:00Z","assignees":[{"username":"bob"}]}]"#;
    let out = h.import("gitlab", fake_list);
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("overwrote"), "stdout: {stdout}");

    let view = h.view("old");
    assert!(
        view.contains("title: New Title"),
        "title should be updated: {view}"
    );
    assert!(
        view.contains("gitlab_id: '10'"),
        "gitlab_id preserved: {view}"
    );
    assert!(
        view.contains("created: 2026-01-01"),
        "created must be preserved: {view}"
    );

    // The previous content is backed up in the centralized `.tix-backups/`
    // directory (#1581), never as a scattered `.md.bak` beside the issue.
    let backups = tix::backup::list(&issues_dir);
    assert_eq!(backups.len(), 1, "one overwrite, one backup");
    let bak = &backups[0];
    assert!(bak.is_file(), "backup must exist at {}", bak.display());
    assert!(
        !issues_dir.join("2026-01-01-old.md.bak").exists(),
        "the backup is centralized, not beside the issue"
    );
    let bak_contents = fs::read_to_string(bak).unwrap();
    assert!(
        bak_contents.contains("Old Title"),
        "backup must hold original: {bak_contents}"
    );
}

// -----------------------------------------------------------------------
// Missing binary (exit 3)
// -----------------------------------------------------------------------

#[test]
fn export_missing_binary_exits_3() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("Fix login", "users cannot log in");

    let mut cmd = tix();
    cmd.current_dir(h.dir())
        .arg("export")
        .args(["--target", "gitlab"])
        // PATH points to a real but non-glab-producing dir: just /usr/bin
        // where no "glab" binary exists
        .env("PATH", "/usr/bin")
        .env_remove("GITLAB_TOKEN");
    let out = cmd.output().unwrap();
    assert_eq!(
        out.status.code(),
        Some(3),
        "expected exit 3, got: {:?}",
        out.status
    );
    let stderr = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(
        stderr.contains(
            "required tool not found: glab — install from https://gitlab.com/gitlab-org/cli"
        ),
        "stderr: {stderr}"
    );
}

// -----------------------------------------------------------------------
// Token scrub
// -----------------------------------------------------------------------

#[test]
fn export_token_scrubbed_on_tool_failure() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("Fix login", "users cannot log in");
    // token comes from the env var; the fake leaks what it saw into stderr.
    let mut cmd = tix();
    cmd.current_dir(h.dir())
        .arg("export")
        .args(["--target", "gitlab"])
        .env("PATH", format!("{}:{}", bin_dir().display(), "/usr/bin"))
        .env("TIX_FAKE_RECORD", &h.record)
        .env("TIX_FAKE_FAIL", "1")
        .env("GITLAB_TOKEN", "gl-env-secret");
    let out = cmd.output().unwrap();
    assert_eq!(
        out.status.code(),
        Some(3),
        "expected exit 3, got: {:?}",
        out.status
    );
    let stderr = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(
        !stderr.contains("gl-env-secret"),
        "token leaked to stderr: {stderr}"
    );
    assert!(
        stderr.contains("<token>"),
        "expected redaction, stderr: {stderr}"
    );
}

// -----------------------------------------------------------------------
// Linear export + import
// -----------------------------------------------------------------------

#[test]
fn linear_export_import_roundtrip() {
    let h = Harness::new();
    h.init_with_linear();
    h.create_issue("Fix login", "linear body");

    // export
    let out = h.export("linear", &[], Some(("LINEAR_TOKEN", "lin-env")));
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("created linear issue"), "stdout: {stdout}");
    let view = h.view("fix-login");
    assert!(view.contains("linear_id:"), "backfill missing: {view}");
    let record = h.record_contents();
    assert!(
        record.contains("linear-cli issues create -t=Eng -d=linear body"),
        "values are attached; recorded:\n{record}"
    );
    assert!(
        record.contains("-o json -- Fix login"),
        "the positional title follows `--`; recorded:\n{record}"
    );
    assert!(
        record.contains("LINEAR_API_KEY=lin-env"),
        "recorded:\n{record}"
    );

    // import: `issues list` enumerates (no body/labels/timestamp), then
    // `issues get` returns the detail the local file needs.
    let fake_list =
        r#"[{"id":"u1","identifier":"TIX-200","title":"Linear task","state":{"name":"Todo"}}]"#;
    let fake_get = r##"{"id":"u1","identifier":"TIX-200","title":"Linear task","description":"desc",
        "updatedAt":"2026-05-12T00:00:00Z","state":{"name":"Todo"},
        "labels":{"nodes":[{"name":"feature","color":"#00f"}]}}"##;
    let out = h.import_linear(fake_list, fake_get);
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        stdout.contains("imported linear issue TIX-200"),
        "stdout: {stdout}"
    );
    let list = h.list();
    assert!(list.contains("Linear task"), "list: {list}");
    // The detail fields actually landed — a list-only read would have imported an
    // empty body and no labels.
    let imported = h.view("linear-task");
    assert!(
        imported.contains("desc") && imported.contains("feature"),
        "detail body/labels must be imported: {imported}"
    );
}

#[test]
fn linear_export_dry_run() {
    let h = Harness::new();
    h.init_with_linear();
    h.create_issue("Task", "body");

    let out = h.export("linear", &["--dry-run"], Some(("LINEAR_TOKEN", "lin-env")));
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        stdout.contains("would create linear issue"),
        "stdout: {stdout}"
    );
    assert!(!h.record.exists());
}

/// A markdown body whose first line is `- item`, and a title starting with `-`,
/// export cleanly: the adapter attaches values with `=` and guards the positional
/// title with `--`, and the fake rejects the separated form the way clap does — so
/// this fails if either regresses.
#[test]
fn a_hyphen_leading_body_and_title_export_without_clap_rejecting_them() {
    let h = Harness::new();
    h.init_with_linear();
    h.create_issue_attached("-leading title", "- bullet one\n- bullet two");

    let out = h.export("linear", &[], Some(("LINEAR_TOKEN", "lin-env")));
    assert!(
        out.status.success(),
        "export failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("created linear issue"), "stdout: {stdout}");
    let record = h.record_contents();
    assert!(
        record.contains("-d=- bullet one\n- bullet two") && record.contains("-- -leading title"),
        "attached body and `--`-guarded title; recorded:\n{record}"
    );
}

/// A first export's dry run previews a resolvable edge as sendable — pass 1 would
/// give the target a remote id — rather than reporting it "has not been exported
/// yet".
#[test]
fn linear_dry_run_previews_a_resolvable_edge_instead_of_reporting_it_unsendable() {
    let h = Harness::new();
    h.init_with_linear();
    h.create_issue("Blocker", "");
    h.create_issue("Blocked work", "");
    link(&h, "1", "2", "blocks");

    let out = h.export("linear", &["--dry-run"], Some(("LINEAR_TOKEN", "lin-env")));
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        !stdout.contains("not been exported"),
        "a first-export edge is resolvable and must not preview as unsendable: {stdout}"
    );
    assert!(
        stdout.contains("would export linear blocks"),
        "the preview names the edge pass 2 would send: {stdout}"
    );
    assert!(h.record_contents().is_empty(), "a dry run invokes nothing");
}

#[test]
fn linear_reexport_updates_not_duplicates() {
    let h = Harness::new();
    h.init_with_linear();
    h.create_issue("Task", "body");

    h.export("linear", &[], Some(("LINEAR_TOKEN", "lin-env")));
    let out = h.export("linear", &[], Some(("LINEAR_TOKEN", "lin-env")));
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("updated linear issue"), "stdout: {stdout}");
    let record = h.record_contents();
    assert_eq!(
        record.matches("issues create").count(),
        1,
        "create must happen once: {record}"
    );
    assert!(
        record.matches("issues update").count() >= 1,
        "expected at least 1 update: {record}"
    );
}

// -----------------------------------------------------------------------
// No-issues paths
// -----------------------------------------------------------------------

#[test]
fn export_nothing_to_export_prints_message() {
    let h = Harness::new();
    h.init_with_gitlab();
    let out = h.export("gitlab", &[], Some(("GITLAB_TOKEN", "gl-env")));
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("nothing to export"), "stdout: {stdout}");
}

#[test]
fn import_nothing_to_import_prints_message() {
    let h = Harness::new();
    h.init_with_gitlab();
    let out = h.import("gitlab", "[]");
    assert!(out.status.success());
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(stdout.contains("nothing to import"), "stdout: {stdout}");
}

// -----------------------------------------------------------------------
// Missing config targets
// -----------------------------------------------------------------------

#[test]
fn export_missing_gitlab_config_fails() {
    let h = Harness::new();
    h.init(); // no [export.gitlab] section
    let out = h.export("gitlab", &[], Some(("GITLAB_TOKEN", "x")));
    assert!(!out.status.success());
    let stderr = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(
        stderr.contains("[export.gitlab]") || stderr.contains("tix.toml"),
        "stderr: {stderr}"
    );
}

// -----------------------------------------------------------------------
// WP07 T033 — relationship mapping, diagnostics, and idempotency
// -----------------------------------------------------------------------

/// Link two issues in the harness's repo, through the real binary.
fn link(h: &Harness, a: &str, b: &str, kind: &str) {
    let out = tix()
        .current_dir(h.dir())
        .args(["link", a, b, "--type", kind])
        .output()
        .unwrap();
    assert!(
        out.status.success(),
        "link {a} {b} --type {kind} failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );
}

/// The recorded remote id of an issue, read back from `tix view` (which prints
/// the file's frontmatter).
fn linear_id(h: &Harness, selector: &str) -> String {
    let view = h.view(selector);
    view.lines()
        .find_map(|l| l.strip_prefix("linear_id:").map(|v| v.trim().to_string()))
        .unwrap_or_else(|| panic!("no `linear_id:` in view:\n{view}"))
}

fn issue_id(view: &str) -> String {
    view.lines()
        .find_map(|line| line.strip_prefix("id: "))
        .map(str::trim)
        .filter(|id| tix::id::is_issue_id(id))
        .unwrap_or_else(|| panic!("view carries no canonical id:\n{view}"))
        .to_string()
}

/// A `blocks` edge is the only kind either tracker can express, so it is the only
/// one that reaches the remote CLI. Asserted on the **recorded argv**, not on the
/// tool's own output: the question is what would have been sent.
#[test]
fn a_blocks_edge_diagnoses_as_unverified_and_a_related_edge_diagnoses_as_unrepresentable() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("Blocker", "");
    h.create_issue("Blocked work", "");
    h.create_issue("Merely related", "");
    link(&h, "1", "2", "blocks");
    link(&h, "1", "3", "related");

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "a partial export must be visible to a calling script: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    assert_eq!(
        out.status.code(),
        Some(1),
        "partial export uses the documented non-zero status"
    );
    // The per-issue report and summary stay on stdout; the unsupported-field
    // diagnostics are warnings and go to stderr.
    let report = String::from_utf8_lossy(&out.stdout).to_string();
    let diagnostics = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(
        !report.contains("cannot represent"),
        "unsupported-field diagnostics do not pollute the report stream: {report}"
    );
    let record = h.record_contents();

    // **Nothing is sent.** `glab` is verified to expose no relation command (#1354),
    // so even the `blocks` edge diagnoses. Asserted negatively on purpose: the point
    // is that the adapter does *not* guess a command line.
    assert!(
        !record.contains("--blocking") && !record.contains("relation"),
        "no relation verb exists to send, so none may be; recorded:\n{record}"
    );
    assert!(
        diagnostics.contains("exposes no issue-relation command")
            && !diagnostics.contains("not verified"),
        "and the blocks edge must say glab has no relation command, not that a verb is \
         merely unverified: {diagnostics}"
    );
    // The related edge produced a diagnostic naming the field — and the tool, and
    // the relationship. "Something was skipped" would satisfy none of FR-005's
    // point or `data-model.md` §6's `field` requirement.
    assert!(
        diagnostics.contains("cannot represent"),
        "diagnostics: {diagnostics}"
    );
    assert!(
        diagnostics.contains("blocking") || diagnostics.contains("blocks"),
        "the diagnostic must name the remote field: {diagnostics}"
    );
    assert!(
        diagnostics.contains("gitlab"),
        "and the tool: {diagnostics}"
    );
    assert!(
        diagnostics.contains("related"),
        "and the kind: {diagnostics}"
    );
}

/// The local edge survives the round trip (C-005, acceptance scenario 4).
///
/// Asserted by reading the file, not the output: the contract is that a relation
/// the remote cannot hold is **kept locally**, and the only way to see that is to
/// look at what is still on disk afterwards.
#[test]
fn an_unrepresentable_relationship_survives_the_export() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("A", "");
    h.create_issue("B", "");
    link(&h, "1", "2", "related");
    link(&h, "2", "1", "duplicates");

    let list = || {
        let listing = tix()
            .current_dir(h.dir())
            .args(["link", "list"])
            .output()
            .unwrap();
        assert!(
            listing.status.success(),
            "{}",
            String::from_utf8_lossy(&listing.stderr)
        );
        String::from_utf8_lossy(&listing.stdout).to_string()
    };
    let before = list();
    assert!(before.contains("--related-->"), "{before}");

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "the unsupported relationship is a partial export"
    );

    let after = list();
    assert_eq!(
        after, before,
        "an export that cannot express the related edge must leave it byte-identical"
    );
    // An edge is stored **once**, in its canonical source's file, so `2 duplicates 1`
    // lives on issue 1 — not on 2. Asserted through `tix link list` rather than
    // through one issue's view, because which file owns an edge is the service's
    // decision and a test that hard-coded it would break on a correct change.
    let rows = after;
    assert!(rows.contains("--related-->"), "tix link list: {rows}");
    assert!(rows.contains("--duplicates-->"), "tix link list: {rows}");
    assert_eq!(
        rows.lines().filter(|l| l.contains("rel_")).count(),
        2,
        "both edges survive, and neither was duplicated:\n{rows}"
    );
}

/// A dry run reports the same diagnostics a real run would (NFR-003's spirit:
/// preview must not be the only way to *not* find out).
#[test]
fn a_dry_run_reports_the_same_relationship_diagnostics() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("A", "");
    h.create_issue("B", "");
    link(&h, "1", "2", "related");

    let out = h.export("gitlab", &["--dry-run"], None);
    assert!(
        !out.status.success(),
        "a dry run previews the partial status a real run would have"
    );
    let report = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(
        report.contains("cannot represent"),
        "a dry run must surface the same diagnostic: {report}"
    );
    // And it invoked nothing.
    assert!(
        h.record_contents().is_empty(),
        "a dry run must not call the tool: {}",
        h.record_contents()
    );
}

/// Re-exporting an unchanged snapshot is a no-op locally, and appends no History
/// entry for it (T032 steps 2 and 3).
#[test]
fn a_second_export_changes_nothing_and_appends_no_history() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("A", "");
    h.create_issue("B", "");
    link(&h, "1", "2", "blocks");

    let first = h.export("gitlab", &[], None);
    assert!(
        !first.status.success(),
        "the unsupported blocks edge makes the export partial"
    );
    let after_first = h.view("1");

    let second = h.export("gitlab", &[], None);
    assert!(
        !second.status.success(),
        "the second export is still a partial mirror: {}",
        String::from_utf8_lossy(&second.stderr)
    );
    assert_eq!(
        h.view("1"),
        after_first,
        "a second export of an unchanged snapshot must change nothing — including \\
         appending no second relationship_added event"
    );
}

/// A remote-side rename does not create a duplicate edge (T032 step 1).
///
/// The stable relationship id is what an import matches on, so a renamed issue is
/// still the same relationship. This is the case a title- or position-based match
/// would fail and a happy-path test would not reach.
#[test]
fn a_remote_rename_does_not_duplicate_the_relationship() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("Original title", "");
    h.create_issue("Other", "");
    link(&h, "1", "2", "blocks");

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "the unsupported blocks edge makes the export partial"
    );
    let after_export = h.view("1");

    // The remote now reports the same issue under a different title, and with an
    // `updated_at` far in the future so the import overwrites rather than keeping
    // local.
    // The ids must be the ones `export` recorded — the fake assigner hands out
    // `100`, `101`, … — or the import matches nothing and *creates* new issues
    // instead of overwriting, which would pass a "no duplicates" assertion for the
    // wrong reason. `iid` is a **number** on the wire (`RemoteIssue.id` is a `String`
    // parsed from a numeric JSON field), so quoting it fails to deserialize.
    let remote = r#"[{"iid":100,"title":"Renamed remotely","description":"","labels":[],
        "state":"opened","updated_at":"2099-01-01T00:00:00Z","assignee":null},
        {"iid":101,"title":"Other","description":"","labels":[],
        "state":"opened","updated_at":"2099-01-01T00:00:00Z","assignee":null}]"#;
    let imported = h.import("gitlab", remote);
    assert!(
        imported.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&imported.stderr)
    );

    let listing = tix()
        .current_dir(h.dir())
        .args(["link", "list"])
        .output()
        .unwrap();
    let rows = String::from_utf8_lossy(&listing.stdout);
    let edges = rows.lines().filter(|l| l.contains("rel_")).count();
    assert_eq!(edges, 1, "exactly one edge after a rename:\\n{rows}");
    // And the relationship itself is untouched by the title change.
    let after_import = h.view("1");
    assert!(
        after_import.contains("blocks #2"),
        "the display names the target, which the rename did not change: {after_import}"
    );
    assert_ne!(
        after_import, after_export,
        "the rename must have been applied, or this test proves nothing"
    );
}

/// A Linear `blocks` edge is sent **exactly once**, from its declaring side, with
/// **both** endpoints' remote identifiers.
///
/// Regression for two defects found by the end-to-end smoke: `relationships_for`
/// is an adjacency lookup, so iterating it per issue resolved the target as the
/// source itself (a self-edge) and sent every edge twice (Linear's `relations add`
/// is additive — the second call duplicates the remote edge). Asserted on the
/// **recorded argv**: exactly one `relations add`, a real from→to pair, no
/// equal-endpoint call, and the report line printed once. The ids are read back
/// from `tix view` because export order (and so which id the fake hands out first)
/// is filename order, not creation order.
#[test]
fn a_blocks_edge_is_sent_exactly_once_from_its_declaring_side() {
    let h = Harness::new();
    h.init_with_linear();
    h.create_issue("Blocker", "");
    h.create_issue("Blocked work", "");
    link(&h, "1", "2", "blocks");

    let out = h.export("linear", &[], Some(("LINEAR_TOKEN", "lin-env")));
    assert!(
        out.status.success(),
        "export failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );

    let from = linear_id(&h, "1"); // the declaring side
    let to = linear_id(&h, "2"); // the target
    assert_ne!(from, to, "each issue must have its own remote id");

    let record = h.record_contents();
    let adds: Vec<&str> = record
        .lines()
        .filter(|l| l.contains("relations add"))
        .collect();
    assert_eq!(
        adds.len(),
        1,
        "one edge must be sent exactly once, from its declaring side:\n{record}"
    );
    let expected = format!("linear-cli relations add -r blocks {from} {to}");
    assert_eq!(adds[0], expected.as_str());
    assert!(
        !record.contains(&format!("relations add -r blocks {from} {from}"))
            && !record.contains(&format!("relations add -r blocks {to} {to}")),
        "no self-edge may be sent:\n{record}"
    );

    let report = String::from_utf8_lossy(&out.stdout).to_string();
    assert_eq!(
        report
            .matches(&format!("exported linear blocks {to}"))
            .count(),
        1,
        "the mapped edge must be reported exactly once: {report}"
    );
}

/// A relation whose target was never exported is **reported, not sent**: Linear
/// needs the target's remote identifier, and there is none to guess.
#[test]
fn a_relation_whose_target_is_not_exported_is_reported_not_sent() {
    let h = Harness::new();
    h.init_with_linear();
    h.create_issue("A", "");
    h.create_issue("B", "");
    link(&h, "1", "2", "blocks");

    // Archive the target, so it is no longer part of the export set and never
    // receives a remote identifier.
    let archived = tix()
        .current_dir(h.dir())
        .args(["archive", "2"])
        .output()
        .unwrap();
    assert!(
        archived.status.success(),
        "archive failed: {}",
        String::from_utf8_lossy(&archived.stderr)
    );

    let out = h.export("linear", &[], Some(("LINEAR_TOKEN", "lin-env")));
    assert!(
        !out.status.success(),
        "the unexported target makes the export partial: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    let report = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(
        report.contains("not been exported"),
        "the missing target must be reported: {report}"
    );
    let record = h.record_contents();
    assert!(
        !record.contains("relations add"),
        "no edge may be sent when the target has no remote id:\n{record}"
    );
}

/// GitLab still reports a relationship: its CLI exposes **no relation command at
/// all** (tix #1354), so nothing is sent and the diagnostic says *that*, never
/// "not verified".
#[test]
fn gitlab_reports_a_relation_because_its_cli_has_no_relation_command() {
    let h = Harness::new();
    h.init_with_gitlab();
    h.create_issue("A", "");
    h.create_issue("B", "");
    link(&h, "1", "2", "blocks");

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "the unsupported relation makes the export partial: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    let record = h.record_contents();
    assert!(
        !record.contains("--blocking") && !record.contains("relation"),
        "no relation verb exists to send, so none may be; recorded:\n{record}"
    );
    let report = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(
        report.contains("gitlab: ")
            && report.contains("exposes no issue-relation command")
            && !report.contains("not verified"),
        "the per-tool reason must be the permanent one: {report}"
    );
}

// ---------------------------------------------------------------------------
// WP08 / T032-T035 — the parent reference across a sync
//
// A raw implementation, deliberately: the seam maps, the reference survives, and
// nothing is sent to a remote until a verb is verified by hand. `PARENT_WIRE_VERIFIED`
// is empty for the same reason `RELATION_WIRE_VERIFIED` is — the fakes in
// `tests/bin/` were written before this work and accept no parent flag, and
// whether `glab issue create --parent` exists is a claim about a program this
// repository cannot run. Flipping a tool on is a one-line change plus its adapter.
// ---------------------------------------------------------------------------

/// A repo with `#1 Epic` and children `#2 Alpha`, `#3 Bravo`.
fn hierarchy(h: &Harness) {
    h.create_issue("Epic", "");
    h.create_issue("Alpha", "");
    h.create_issue("Bravo", "");
    for child in ["2", "3"] {
        let out = tix()
            .current_dir(h.dir())
            .args(["edit", child, "--parent", "1"])
            .output()
            .unwrap();
        assert!(
            out.status.success(),
            "setting the parent of #{child} failed: {}",
            String::from_utf8_lossy(&out.stderr)
        );
    }
}

/// A parent the remote cannot express is **retained** and **named** (T032 step 3,
/// T033 step 3). Retained because deleting it would lose local data on the
/// strength of a remote limitation; named because a diagnostic that says only
/// "unsupported" gives a reader nowhere to go.
#[test]
fn t032_an_unrepresentable_parent_survives_an_export_and_is_named_in_a_diagnostic() {
    let h = Harness::new();
    h.init_with_gitlab();
    hierarchy(&h);

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "the unsupported parent references make the export partial"
    );
    let stderr = String::from_utf8_lossy(&out.stderr).to_string();

    // The reference survives, byte for byte, on both children.
    let epic_id = issue_id(&h.view("1"));
    for child in ["2", "3"] {
        let view = h.view(child);
        assert!(
            view.contains(&format!("parent: {epic_id}")),
            "the local reference must survive an export that cannot send it:\n{view}"
        );
    }

    // And the diagnostic names the issue, the parent, and the field.
    assert!(
        stderr.contains("#2's parent #1"),
        "the diagnostic must name the reference: {stderr}"
    );
    assert!(
        stderr.contains("parent"),
        "and the remote field it would have used: {stderr}"
    );
    assert!(
        stderr.contains("not verified"),
        "and must distinguish 'expressible but not drivable' from 'unsupported', \\
         so a reader knows what to go and check: {stderr}"
    );
    // Nothing parent-shaped was sent.
    let recorded = h.record_contents();
    assert!(
        !recorded.contains("--parent"),
        "no parent flag may reach a CLI whose verb is unverified:\n{recorded}"
    );
}

/// A dry run reports what a real run would, parents included. Otherwise "preview
/// then commit" is the only way to find out a reference cannot leave the machine
/// \u2014 the same property the relationship dry run already has.
#[test]
fn t032_a_dry_run_reports_the_parent_diagnostic_too() {
    let h = Harness::new();
    h.init_with_gitlab();
    hierarchy(&h);

    let out = h.export("gitlab", &["--dry-run"], None);
    assert!(
        !out.status.success(),
        "a dry run previews the same partial status"
    );
    let report = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(
        report.contains("#2's parent #1"),
        "a dry run must surface the same diagnostic a real run would: {report}"
    );
    assert!(
        h.record_contents().is_empty(),
        "and must still not invoke the tool"
    );
}

/// T034: a second export changes nothing. A parent that was re-emitted, re-appended
/// or reordered on every run would make the file churn on a no-op, and the History
/// would accumulate a `parent_set` entry per export that recorded nothing.
#[test]
fn t034_a_second_export_appends_no_parent_history_and_changes_no_bytes() {
    let h = Harness::new();
    h.init_with_gitlab();
    hierarchy(&h);

    let first = h.export("gitlab", &[], None);
    assert!(
        !first.status.success(),
        "parent diagnostics make the export partial"
    );
    let before = h.view("2");

    let second = h.export("gitlab", &[], None);
    assert!(
        !second.status.success(),
        "the unchanged parent references still cannot travel"
    );
    let after = h.view("2");

    assert_eq!(
        before, after,
        "a second export with no remote change must be byte-identical"
    );
    let events = after.matches("parent_set").count();
    assert_eq!(
        events, 1,
        "exactly one parent_set entry after two exports, not one per export:\n{after}"
    );
}

/// The import side of the round trip: a payload naming a parent restores the
/// reference, through the same storage path a CLI write takes.
#[test]
fn t035_an_imported_parent_reference_is_restored_through_the_storage_path() {
    let h = Harness::new();
    h.init_with_gitlab();
    let payload = r#"[{"iid":100,"title":"Remote Epic","description":"","labels":[],
        "state":"opened","updated_at":"2026-05-11T10:00:00Z","assignee":null},
        {"iid":101,"title":"Remote Child","description":"","labels":[],
        "state":"opened","updated_at":"2026-05-11T10:00:00Z","assignee":null,
        "epic_iid":100}]"#;
    let out = h.import("gitlab", payload);
    assert!(
        out.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );

    let epic = h.view("1");
    let child = h.view("2");
    assert!(epic.contains("Remote Epic"), "{epic}");
    let epic_id = issue_id(&epic);
    assert!(
        child.contains(&format!("parent: {epic_id}")),
        "the imported child must carry the parent the remote reported:\n{child}"
    );
    // And through the storage path means through the service: one History entry,
    // with the same spelling a CLI write would produce.
    let events = child.matches("parent_set").count();
    assert_eq!(
        events, 1,
        "exactly one parent_set entry, written by the same path as a CLI write:\n{child}"
    );
}

/// A child imported **before** its parent must still get the reference. The
/// restore is a second pass precisely so the outcome does not depend on the order
/// the remote returned \u2014 NFR-003 forbids order-dependence, and a payload order
/// is not under this program's control.
#[test]
fn t035_the_parent_is_restored_even_when_the_child_comes_first_in_the_payload() {
    let h = Harness::new();
    h.init_with_gitlab();
    let payload = r#"[{"iid":101,"title":"Remote Child","description":"","labels":[],
        "state":"opened","updated_at":"2026-05-11T10:00:00Z","assignee":null,
        "epic_iid":100},
        {"iid":100,"title":"Remote Epic","description":"","labels":[],
        "state":"opened","updated_at":"2026-05-11T10:00:00Z","assignee":null}]"#;
    let out = h.import("gitlab", payload);
    assert!(
        out.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );

    let epic_id = issue_id(&h.view("2"));
    let child = h.view("1");
    assert!(
        child.contains(&format!("parent: {epic_id}")),
        "the child is #1 here and its parent #2, restored regardless of payload \
         order:\n{child}"
    );
}

/// A parent this run did not import is **not** manufactured. Writing a reference
/// to an issue that is not there would produce exactly the unresolved-parent state
/// WP05 added a finding for \u2014 so the import declines and says which id it could
/// not resolve.
#[test]
fn t035_a_parent_the_import_did_not_create_leaves_the_issue_parentless() {
    let h = Harness::new();
    h.init_with_gitlab();
    let payload = r#"[{"iid":101,"title":"Orphan","description":"","labels":[],
        "state":"opened","updated_at":"2026-05-11T10:00:00Z","assignee":null,
        "epic_iid":999}]"#;
    let out = h.import("gitlab", payload);
    assert!(
        out.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );

    let view = h.view("1");
    // Asserted as the hierarchy *says none*, not as the string `parent:` is absent:
    // WP04 added a `## Hierarchy` block to every view, so `- parent: none` is on
    // every parentless issue and an absence check can never pass.
    assert!(
        view.contains("- parent: none"),
        "the issue must read as parentless, not merely lack a `parent:` line:\n{view}"
    );
    assert!(
        !view.lines().any(|l| l.starts_with("parent: ")),
        "and no frontmatter key may be written at all:\n{view}"
    );
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        stdout.contains("999"),
        "and the diagnostic must name the id it could not resolve: {stdout}"
    );
    assert!(
        stdout.contains("parentless"),
        "and must say what it did instead: {stdout}"
    );
}

/// A payload whose reported parent would close a cycle is refused by the service,
/// and the file is left byte-identical. T032's note: "an import that would create
/// a cycle is a defect, not a special case" \u2014 so the import must not be the
/// exception.
#[test]
fn t035_an_import_that_would_close_a_cycle_is_refused_and_writes_nothing() {
    let h = Harness::new();
    h.init_with_gitlab();
    hierarchy(&h);
    // `#2 Alpha` is a child of `#1 Epic`. A payload claiming `#1` is a child of
    // `#2` would close a cycle, and this run already tracks both locally.
    let payload = r#"[{"iid":900,"title":"Existing Epic","description":"","labels":[],
        "state":"opened","updated_at":"2026-05-11T10:00:00Z","assignee":null},
        {"iid":901,"title":"Existing Child","description":"","labels":[],
        "state":"opened","updated_at":"2026-05-11T10:00:00Z","assignee":null,
        "epic_iid":900}]"#;
    // Not a cycle on its own; the point is that the *restore* goes through the
    // service, so assert the guarantee directly on the store's own path instead of
    // inventing a payload that happens to close one.
    let before = h.view("1");
    let _ = h.import("gitlab", payload);
    let after = h.view("1");
    assert_eq!(
        before, after,
        "an import that cannot place a reference must leave the file untouched"
    );

    // And the cycle refusal itself, through the shared path the restore uses.
    let out = tix()
        .current_dir(h.dir())
        .args(["edit", "1", "--parent", "2"])
        .output()
        .unwrap();
    assert!(
        !out.status.success(),
        "the service must refuse a cycle, and the restore inherits that refusal"
    );
    let err = String::from_utf8_lossy(&out.stderr).to_string();
    assert!(err.contains("cycle"), "and say so: {err}");
    assert_eq!(
        h.view("1"),
        before,
        "a refused cycle leaves the file byte-identical"
    );
}

/// A diagnostic built from remote output carries no credential material (T033
/// step 6). The token is in the environment and in the record file, so a message
/// that quoted the tool's output verbatim would leak it into the report.
#[test]
fn t035_a_parent_diagnostic_carries_no_credential_material() {
    let h = Harness::new();
    h.init_with_gitlab();
    hierarchy(&h);
    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "parent diagnostics make the export partial"
    );
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    let stderr = String::from_utf8_lossy(&out.stderr).to_string();

    // The token's **value**, not the variable's name. `tix` emits "prefer the
    // GITLAB_TOKEN environment variable" on every run against a file token, and
    // naming that variable in a diagnostic is the advice working — asserting its
    // absence flagged tix's own advisory as a leak, which is how this test came to
    // be measuring the wrong thing.
    for secret in ["gl-file-token", "glpat-"] {
        assert!(
            !stdout.contains(secret) && !stderr.contains(secret),
            "the export report leaked the token value `{secret}`.\n  \
             out: {stdout}\n  err: {stderr}"
        );
    }
    // The value the harness actually configured, asserted by reading it back from
    // `tix.toml` rather than by trusting the literal above — if the fixture ever
    // changes its token, this still tests the real one.
    let configured = fs::read_to_string(h.dir().join("tix.toml"))
        .unwrap()
        .lines()
        .find_map(|l| l.strip_prefix("token = \""))
        .map(|v| v.trim_end_matches('"').to_string())
        .expect("the fixture configures a token");
    assert!(
        !stdout.contains(&configured) && !stderr.contains(&configured),
        "the configured token reached the report: {configured}\n  out: {stdout}"
    );
}

// ---------------------------------------------------------------------------
// WP07 T031/T033 — an imported status is a transition, and the policy holds
// ---------------------------------------------------------------------------

/// A harness whose board **declares a `category_map`**, so transition policy applies.
///
/// `triage=backlog, wip=active, review=active, shipped=completed,
/// abandoned=canceled`. The default board declares none, and on such a board the
/// seam imposes **no** transition policy at all (WP03's opt-in) — so an import test
/// written against it would pass vacuously.
fn init_with_gitlab_and_categories(h: &Harness) {
    h.init_with_gitlab();
    // The board is a file store now (`docs/boards/default.md`), and the file
    // wins over any `[kanban]` table, so the custom columns are written there.
    // `tix init` no longer writes `[kanban]`, so its starter `[triage]` section
    // (which names `wontfix`, a column this custom board does not have) must be
    // dropped explicitly rather than along with a `[kanban]` tail.
    let toml_path = h.dir().join("tix.toml");
    let contents = fs::read_to_string(&toml_path).unwrap();
    let mut kept = Vec::new();
    let mut skipping = false;
    for line in contents.lines() {
        if line.starts_with('[') {
            skipping = line.starts_with("[triage");
        }
        if !skipping {
            kept.push(line);
        }
    }
    fs::write(&toml_path, format!("{}\n", kept.join("\n"))).unwrap();

    let board_path = h.dir().join("docs").join("boards").join("default.md");
    fs::write(
        &board_path,
        "---\nname: default\ncolumns:\n\
         - triage\n- wip\n- review\n- shipped\n- abandoned\n\
         done_column: shipped\n\
         category_map:\n  triage: backlog\n  wip: active\n  review: active\n  \
         shipped: completed\n  abandoned: canceled\n\
         hidden_columns: []\nshow_mismatch: false\nwrap_titles: true\ntitle_lines: 3\n\
         card_order: []\norder_by: created_at_desc\n---\n\n",
    )
    .unwrap();
}

/// Every byte under `docs/issues`, so "the local file is unchanged" can be asserted
/// over the whole directory rather than one file.
fn issue_bytes(h: &Harness) -> Vec<(PathBuf, Vec<u8>)> {
    let mut out = Vec::new();
    let mut stack = vec![h.dir().join("docs").join("issues")];
    while let Some(cur) = stack.pop() {
        for entry in fs::read_dir(&cur).unwrap() {
            let path = entry.unwrap().path();
            if path.is_dir() {
                stack.push(path);
            } else {
                out.push((path.clone(), fs::read(&path).unwrap()));
            }
        }
    }
    out.sort();
    out
}

#[test]
fn t031_a_terminal_exit_is_refused_and_a_reason_unlocks_it() {
    // **Renamed.** The first version of this test was called
    // `…_imported_status_that_policy_refuses_is_reported_…` and claimed to pin the
    // import's skip-and-report disposition. It did not: it drove the *service*
    // directly, so the import's `if let` guard could have been deleted and the test
    // would still have passed. The name asserted a property the test never read.
    //
    // What it can honestly establish is the **precondition** the import's skip rests
    // on: a terminal exit is refused without a reason, and accepted with one. So an
    // import that tried one is refusing something genuinely refusable, and the skip is
    // a real refusal rather than a blanket "imports never move things".
    //
    // The import's own branch is **not** exercised here, and the reason is worth
    // stating: both adapters filter to non-done states, so an imported column is
    // either the first column or a name-matched one, and on a board with a sane
    // vocabulary both are forward or same-category moves. Reaching a refusal needs a
    // remote whose state *name* matches a column behind the issue's current one —
    // e.g. a Linear state called "Triage" on an issue the board has shipped. That is
    // reachable in principle and contrived in practice, so the branch is pinned
    // structurally (see `the_import_path_validates_through_the_service`) rather than
    // by a fixture built to force it.
    let (_tmp, config, store) = {
        let tmp = tempfile::TempDir::new().unwrap();
        let dir = tmp.path().to_path_buf();
        fs::create_dir_all(dir.join("docs").join("issues")).unwrap();
        let cfg = tix::config::Config {
            issues_dir: dir.join("docs").join("issues"),
            kanban: tix::config::KanbanSection {
                configurations: indexmap::IndexMap::from([(
                    "default".to_string(),
                    tix::config::BoardConfiguration {
                        columns: vec!["triage".into(), "wip".into(), "shipped".into()],
                        done_column: Some("shipped".to_string()),
                        category_map: indexmap::IndexMap::from([
                            ("triage".to_string(), "backlog".to_string()),
                            ("wip".to_string(), "active".to_string()),
                            ("shipped".to_string(), "completed".to_string()),
                        ]),
                        ..Default::default()
                    },
                )]),
            },
            ..tix::config::Config::default()
        };
        cfg.save(&dir.join("tix.toml")).unwrap();
        let loaded = tix::config::Config::load_with_warning(&dir.join("tix.toml"), |_| {}).unwrap();
        let store = tix::storage::Store {
            issues_dir: loaded.issues_dir.clone(),
            config: loaded.clone(),
        };
        (tmp, loaded, store)
    };
    let _ = &config;

    // An issue already in the completion column, with a decision recorded.
    tix::commands::create::create(
        &store.config,
        &store,
        "Local",
        None,
        Some(tix::model::Status::new("triage")),
        None,
        None,
        None,
        None,
        None,
        None,
        None,
        None,
        None,
        None,
        None,
        None,
        None,
    )
    .unwrap();
    tix::commands::mv::run(
        &store.config,
        &store,
        "1",
        "shipped",
        Some("abc"),
        None,
        true,
        false,
    )
    .unwrap();
    assert_eq!(
        store
            .get(tix::storage::IssueSelector::Number(1))
            .unwrap()
            .status
            .display(),
        "shipped"
    );

    // Leaving a terminal category is refused without a reason, so an import that
    // tried it must be refused too — and the column kept.
    let issue = store.get(tix::storage::IssueSelector::Number(1)).unwrap();
    let (_, resolution) = tix::workflow::active_resolution(&store.config);
    let outcome =
        tix::workflow::validate_transition(&issue, "triage", &resolution, &store.config, None);
    let tix::workflow::TransitionOutcome::Rejected(diagnostic) = outcome else {
        panic!("precondition: the transition must be refused");
    };
    assert!(diagnostic.to_string().contains("invalid_transition"));

    // And the same transition **with** a reason is accepted, which is what makes the
    // import's skip a real refusal rather than a blanket "imports never move things".
    let accepted = tix::workflow::validate_transition(
        &issue,
        "triage",
        &resolution,
        &store.config,
        Some("because"),
    );
    assert!(matches!(
        accepted,
        tix::workflow::TransitionOutcome::Accepted { .. }
    ));
}

#[test]
fn t031_the_import_path_runs_and_is_idempotent() {
    // **Renamed** too: it claimed to report a skipped status and does not — the skip
    // branch is unreachable through this adapter, as
    // `t031_a_terminal_exit_is_refused_…` records.
    //
    // What it does establish is T031 steps 4-5 at the level this harness reaches: a
    // real `sync::import` with a fake `glab` on PATH reports what it did, and a second
    // identical import leaves the local state **byte-stable**. Idempotency is the
    // property an import most needs and the one a new validation step could most
    // plausibly break — a second import that appended a decision or bumped a date
    // would show up here as a byte difference.
    let h = Harness::new();
    init_with_gitlab_and_categories(&h);
    // The remote is open, so it maps to the first column. Seed a local issue that is
    // already in the completion column, with a *newer local* date, so the import
    // reports "kept" — the shape that proves the import did not blindly overwrite.
    let seed =
        r#"[{"iid":10,"title":"Remote","state":"opened","updated_at":"2020-01-01T00:00:00Z"}]"#;
    let out = h.import("gitlab", seed);
    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        stdout.contains("imported gitlab issue 10") || stdout.contains("kept gitlab issue 10"),
        "the import reports what it did: {stdout} / stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    // A second, identical import is byte-stable: import is idempotent (T031 step 5).
    let before = issue_bytes(&h);
    let out2 = h.import("gitlab", seed);
    assert!(out2.status.success());
    assert_eq!(
        issue_bytes(&h),
        before,
        "a second identical import must leave the local state byte-stable"
    );
}

// ---------------------------------------------------------------------------
// WP08 — project associations across a sync round trip
//
// Mission `first-class-projects-01M3BYBW`. The export says what cannot leave the
// machine (C-005, C-006); the import applies what a payload reported, through the
// project **service**, matching on the project **id** (C-002). Every assertion
// about survival reads the issue file, because "the local associations remain" is
// a claim about bytes on disk and not about a returned value.
//
// No test here needs the network or a TTY: every tool invocation goes through the
// fake `glab`/`linear-cli` scripts in `tests/bin`, whose argv is recorded to a file
// and whose payload comes from `TIX_FAKE_LIST`.
// ---------------------------------------------------------------------------

/// Declare projects in the harness's `tix.toml`, in the order given.
///
/// The ids are the registry keys and therefore the stable identity every
/// association is matched on (C-002); the names are display labels, which is why a
/// remote that uses one of them cannot become an association.
fn declare_projects(h: &Harness, projects: &[(&str, &str)]) {
    let toml_path = h.dir().join("tix.toml");
    let mut contents = fs::read_to_string(&toml_path).unwrap();
    for (id, name) in projects {
        contents.push_str(&format!("\n[projects.\"{id}\"]\nname = \"{name}\"\n"));
    }
    fs::write(&toml_path, contents).unwrap();
}

/// Write an issue file by hand, with the associations under test.
///
/// Written rather than created through a command because this work package owns
/// `tests/sync.rs` and not the project CLI surface: the file is the canonical
/// input either way, and the assertions read it back from disk.
fn write_project_issue(
    h: &Harness,
    number: u32,
    filename: &str,
    title: &str,
    gitlab_id: Option<&str>,
    projects: &[&str],
    updated: &str,
) {
    let issues = h.dir().join("docs").join("issues");
    fs::create_dir_all(&issues).unwrap();
    let mut text = format!(
        "---\nnumber: {number}\ntitle: \"{title}\"\nstatus: \"todo\"\nlabels: []\npriority: \"medium\"\n"
    );
    if let Some(id) = gitlab_id {
        text.push_str(&format!("gitlab_id: \"{id}\"\n"));
    }
    if !projects.is_empty() {
        text.push_str("projects:\n");
        for project in projects {
            text.push_str(&format!("- {project}\n"));
        }
    }
    text.push_str(&format!(
        "created: \"2026-01-01\"\nupdated: \"{updated}\"\n---\n\nBody.\n"
    ));
    fs::write(issues.join(filename), text).unwrap();
}

/// The whole text of the issue file whose frontmatter numbers it `number`.
///
/// Skips dot-directories: `docs/issues/.tix-backups/` holds copies of issues an
/// import overwrote, and a scan that read them would report the *previous* state of
/// a file as though it were the current one.
fn issue_text(h: &Harness, number: u32) -> String {
    let needle = format!("number: {number}\n");
    for text in find_issue_texts(h) {
        if text.contains(&needle) {
            return text;
        }
    }
    panic!("no issue file carrying `number: {number}`");
}

/// Every issue file's text, for assertions that span the whole corpus.
fn find_issue_texts(h: &Harness) -> Vec<String> {
    let mut out = Vec::new();
    let mut stack = vec![h.dir().join("docs").join("issues")];
    while let Some(next) = stack.pop() {
        for entry in fs::read_dir(&next).unwrap() {
            let path = entry.unwrap().path();
            let name = path.file_name().unwrap().to_string_lossy().to_string();
            if path.is_dir() {
                if name.starts_with('.') || name.ends_with("-assets") {
                    continue;
                }
                stack.push(path);
            } else if path.extension().is_some_and(|e| e == "md") {
                out.push(fs::read_to_string(&path).unwrap());
            }
        }
    }
    out
}

/// The project associations of issue `number`, **in the order the file carries
/// them** — the property a round trip must not disturb (NFR-002).
fn projects_of(h: &Harness, number: u32) -> Vec<String> {
    let text = issue_text(h, number);
    let mut lines = text.lines();
    while let Some(line) = lines.next() {
        if line.trim_end() == "projects:" {
            let mut ids = Vec::new();
            for entry in lines.by_ref() {
                match entry.strip_prefix("- ") {
                    Some(id) => ids.push(id.trim().to_string()),
                    None => break,
                }
            }
            return ids;
        }
    }
    Vec::new()
}

/// How many `project_associated` events the issue's History carries.
///
/// Counted from the file, because "a no-op appends no History entry" is a claim
/// about the appended log and not about the returned outcome.
fn association_events(h: &Harness, number: u32) -> usize {
    issue_text(h, number)
        .lines()
        .filter(|line| line.contains("project_associated"))
        .count()
}

/// An association the remote cannot hold still produces a diagnostic naming the
/// field, and it survives a full export → import round trip (C-005, C-006,
/// acceptance scenario 3).
#[test]
fn t038_an_unrepresentable_project_association_survives_the_round_trip_and_is_named() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_projects(
        &h,
        &[("p-platform", "Platform hardening"), ("p-docs", "Docs")],
    );
    write_project_issue(
        &h,
        1,
        "2026-01-01-platform.md",
        "In two projects",
        None,
        &["p-platform", "p-docs"],
        "2026-01-01",
    );

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "unsupported project memberships make the export partial: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    let report = String::from_utf8_lossy(&out.stderr).to_string();

    // **Nothing was sent for a membership.** The recorded argv is the evidence: the
    // `--project` flag the adapter legitimately passes names the *tracker's* project
    // (`acme/tix`), so the assertion is on the local ids, which must appear nowhere.
    let record = h.record_contents();
    assert!(
        !record.contains("p-platform") && !record.contains("p-docs"),
        "no local project id may reach the command line:\n{record}"
    );
    // And the diagnostic names the field, the tool, and the issue.
    for needle in [
        "gitlab: projects",
        "cannot represent",
        "#1",
        "p-platform",
        "p-docs",
    ] {
        assert!(report.contains(needle), "`{needle}` missing from: {report}");
    }
    // The local list is untouched by the export, read back from the file.
    assert_eq!(projects_of(&h, 1), ["p-platform", "p-docs"]);

    // The remote could not have received them, so the import reports none — and the
    // associations are still there afterwards. This is the round trip: the export
    // could not send them, and nothing on the way back removed them.
    let remote = r#"[{"iid":100,"title":"In two projects","description":"Body.","labels":[],
        "state":"opened","updated_at":"2099-01-01T00:00:00Z"}]"#;
    let imported = h.import("gitlab", remote);
    assert!(
        imported.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&imported.stderr)
    );
    assert_eq!(
        projects_of(&h, 1),
        ["p-platform", "p-docs"],
        "an association the remote cannot hold survives the whole round trip"
    );
}

/// An issue in three projects keeps all three, in order, after a round trip
/// (C-003, NFR-002 — the intake's named risk).
///
/// The payload lists them in a **different order**, which is what makes this an
/// order test rather than a set test: a merge that re-sorted would pass an equality
/// of sets and fail here.
#[test]
fn t038_an_issue_in_three_projects_keeps_all_three_in_order() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_projects(&h, &[("p-1", "One"), ("p-2", "Two"), ("p-3", "Three")]);
    write_project_issue(
        &h,
        1,
        "2026-01-01-triple.md",
        "Three projects",
        Some("100"),
        &["p-1", "p-2", "p-3"],
        "2026-01-01",
    );

    assert_eq!(projects_of(&h, 1), ["p-1", "p-2", "p-3"]);
    // A first export, so the round trip starts from a recorded remote id.
    let _ = h.export("gitlab", &[], None);

    let remote = r#"[{"iid":100,"title":"Three projects","description":"Body.","labels":[],
        "state":"opened","updated_at":null,
        "projects":["p-3","p-1","p-2"]}]"#;
    let imported = h.import("gitlab", remote);
    assert!(
        imported.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&imported.stderr)
    );

    assert_eq!(
        projects_of(&h, 1),
        ["p-1", "p-2", "p-3"],
        "every association is kept, in the local order — the remote's order is not \
         the local list's order"
    );
    assert_eq!(
        association_events(&h, 1),
        0,
        "all three were already associated, so the import was a no-op"
    );
}

/// Two export cycles change nothing locally, and a second import of the same
/// payload adds no association, reorders nothing and appends no History entry
/// (T037 steps 2, 3 and 5).
#[test]
fn t038_a_second_export_and_a_second_import_are_true_no_ops() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_projects(&h, &[("p-1", "One"), ("p-2", "Two")]);
    write_project_issue(
        &h,
        1,
        "2026-01-01-local.md",
        "Local only",
        Some("100"),
        &[],
        "2026-01-01",
    );

    // A payload whose `updated_at` is absent: the issue's own fields are **kept**,
    // so the only thing this import can change is the membership — which is exactly
    // the case that proves the project pass does not ride on the overwrite branch.
    let remote = r#"[{"iid":100,"title":"Local only","description":"Body.","labels":[],
        "state":"opened","updated_at":null,"projects":["p-1","p-2"]}]"#;

    let first = h.import("gitlab", remote);
    assert!(first.status.success());
    let first_report = String::from_utf8_lossy(&first.stdout).to_string();
    assert!(
        first_report.contains("kept gitlab issue 100"),
        "the issue's own fields must be kept, or this test is about a different \
         branch: {first_report}"
    );
    assert_eq!(projects_of(&h, 1), ["p-1", "p-2"]);
    assert_eq!(
        association_events(&h, 1),
        2,
        "one History entry per accepted association: {first_report}"
    );
    let after_first = issue_text(&h, 1);

    let second = h.import("gitlab", remote);
    assert!(second.status.success());
    let second_report = String::from_utf8_lossy(&second.stdout).to_string();
    assert_eq!(
        issue_text(&h, 1),
        after_first,
        "a second identical import must change no byte of the file — no duplicate, no \
         reorder, no History entry"
    );
    assert_eq!(
        association_events(&h, 1),
        2,
        "and no third association event"
    );
    assert!(
        !second_report.contains("associated"),
        "an association that is already present is not reported as work: {second_report}"
    );

    // Two exports: the first records the remote id, the second is a no-op on disk.
    let first_export = h.export("gitlab", &[], None);
    assert!(
        !first_export.status.success(),
        "the first export reports unsupported project memberships"
    );
    let after_export = issue_text(&h, 1);
    let again = h.export("gitlab", &[], None);
    assert!(
        !again.status.success(),
        "the second export remains partial for the same unsupported memberships"
    );
    assert_eq!(
        issue_text(&h, 1),
        after_export,
        "re-exporting an unchanged snapshot must not change a byte"
    );
    assert_eq!(projects_of(&h, 1), ["p-1", "p-2"]);
}

/// Matching is on the project **id**, never on the name (C-002).
///
/// The fixture makes the two answers disagree: the remote calls project `p-1`
/// *"Remotely renamed"*, which is the local **name of a different project** (`p-2`).
/// A name-based merge would associate `p-2` as well — or instead.
#[test]
fn t038_a_remote_project_rename_matches_on_the_id_and_never_on_the_name() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_projects(
        &h,
        &[("p-1", "Platform hardening"), ("p-2", "Remotely renamed")],
    );
    write_project_issue(
        &h,
        1,
        "2026-01-01-renamed.md",
        "Renamed remotely",
        Some("100"),
        &["p-1"],
        "2026-01-01",
    );
    let toml_before = fs::read_to_string(h.dir().join("tix.toml")).unwrap();

    let remote = r#"[{"iid":100,"title":"Renamed remotely","description":"Body.","labels":[],
        "state":"opened","updated_at":null,
        "projects":[{"id":"p-1","name":"Remotely renamed"}]}]"#;
    let out = h.import("gitlab", remote);
    assert!(
        out.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );

    assert_eq!(
        projects_of(&h, 1),
        ["p-1"],
        "the remote renamed a project and the association is still the *same* one"
    );
    assert_eq!(
        association_events(&h, 1),
        0,
        "an already-present association is a no-op even when the remote renames it"
    );
    assert_eq!(
        fs::read_to_string(h.dir().join("tix.toml")).unwrap(),
        toml_before,
        "the local registry's display labels are not the remote's to rewrite"
    );

    // A payload that identifies the project only by a *name* the local registry uses
    // is refused: a name cannot be matched on, so nothing is associated and the
    // refusal names the field.
    let by_name = r#"[{"iid":100,"title":"Renamed remotely","description":"Body.","labels":[],
        "state":"opened","updated_at":null,
        "projects":[{"name":"Platform hardening"}]}]"#;
    let out = h.import("gitlab", by_name);
    assert!(out.status.success());
    let report = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        report.contains("gitlab: projects") && report.contains("no id"),
        "a name is not an identity, and the diagnostic says so: {report}"
    );
    assert_eq!(
        projects_of(&h, 1),
        ["p-1"],
        "and no association was invented from a name"
    );
}

/// A remote project the local registry does not declare is **diagnosed, never
/// written** — once per issue and association, with no dangling reference, no
/// registry write, and a stable end state (T037 step 4, C-005).
///
/// The payload is deliberately ordered with the *already tracked* issue last: the
/// association pass must not depend on the order the remote listed its issues in.
#[test]
fn t038_a_remote_project_the_registry_does_not_know_creates_no_dangling_reference() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_projects(&h, &[("p-1", "One")]);
    write_project_issue(
        &h,
        1,
        "2026-01-01-tracked.md",
        "Tracked",
        Some("10"),
        &[],
        "2026-01-01",
    );
    let toml_before = fs::read_to_string(h.dir().join("tix.toml")).unwrap();

    let remote = r#"[{"iid":11,"title":"Created one","description":"","labels":[],
        "state":"opened","updated_at":null,"projects":["p-1","p-ghost"]},
        {"iid":12,"title":"Created two","description":"","labels":[],
        "state":"opened","updated_at":null,"projects":["p-1","p-ghost"]},
        {"iid":10,"title":"Tracked","description":"","labels":[],
        "state":"opened","updated_at":null,"projects":["p-1","p-ghost"]}]"#;
    let out = h.import("gitlab", remote);
    assert!(
        out.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    let report = String::from_utf8_lossy(&out.stdout).to_string();

    // One diagnostic per (issue, project) — three, not six, and not one per pass.
    assert_eq!(
        report.matches("registry does not declare").count(),
        3,
        "one diagnostic per unknown reference, not a storm: {report}"
    );
    for needle in ["gitlab: projects", "p-ghost", "cannot represent"] {
        assert!(report.contains(needle), "`{needle}` missing from: {report}");
    }
    // The known association landed on all three issues, including the tracked one
    // listed last, and the unknown one on none of them.
    let all = find_issue_texts(&h).join("\n");
    assert!(
        !all.contains("p-ghost"),
        "an unknown project must not be written into any issue file as a dangling \
         reference:\n{all}"
    );
    for number in [1, 2, 3] {
        assert_eq!(
            projects_of(&h, number),
            ["p-1"],
            "issue #{number} keeps exactly the association the registry can resolve"
        );
    }
    // The registry was not written, so no partial registry can exist.
    assert_eq!(
        fs::read_to_string(h.dir().join("tix.toml")).unwrap(),
        toml_before,
        "a sync never writes the project registry"
    );

    // The end state is stable: a second import reports the same three diagnostics and
    // changes nothing.
    let before = find_issue_texts(&h).join("\n");
    let second = h.import("gitlab", remote);
    assert!(second.status.success());
    let second_report = String::from_utf8_lossy(&second.stdout).to_string();
    assert_eq!(
        second_report.matches("registry does not declare").count(),
        3,
        "still one per reference: {second_report}"
    );
    assert_eq!(
        find_issue_texts(&h).join("\n"),
        before,
        "the end state is stable"
    );
}

/// Both adapters present the **same** membership seam, and neither sends a verb
/// for it (T036 steps 3 and 5, T038 step 6).
///
/// The compile-time half is the trait: `set_projects` is required, so an adapter
/// that forgot it would not build. The half asserted here is that both adapters
/// answer the **same** call identically — and that the empty set spawns nothing.
#[test]
fn t038_both_adapters_present_the_same_project_seam_and_send_no_verb() {
    use tix::sync::glab::GitLabAdapter;
    use tix::sync::linear::LinearAdapter;
    use tix::sync::{ProcessRunner, Tool, TrackerAdapter};

    // `ProcessRunner` is deliberate: it spawns a real process, so a membership list
    // that caused a spawn would fail loudly here — no `glab` or `linear-cli` is on
    // this test's `PATH`. The empty set must return before any spawn, on both tools.
    let mut gitlab = GitLabAdapter::new(ProcessRunner, None, None, "acme/tix".into());
    let mut linear = LinearAdapter::new(ProcessRunner, None, "Eng".into());
    let seams: [(Tool, &mut dyn TrackerAdapter); 2] =
        [(Tool::GitLab, &mut gitlab), (Tool::Linear, &mut linear)];
    for (tool, adapter) in seams {
        assert_eq!(adapter.tool(), tool);
        adapter
            .set_projects("100", &[])
            .unwrap_or_else(|e| panic!("{tool}: the empty membership seam must be a no-op: {e}"));
    }

    // And through the compiled CLI for both targets: no local project id reaches a
    // command line, and the report names the tool's own field and reason.
    for (target, setup, field, reason, project) in [
        (
            "gitlab",
            Harness::init_with_gitlab as fn(&Harness),
            "gitlab: projects",
            "--project",
            "p-1",
        ),
        (
            "linear",
            Harness::init_with_linear as fn(&Harness),
            "linear: project",
            "one `project`",
            "p-1",
        ),
    ] {
        let h = Harness::new();
        setup(&h);
        declare_projects(&h, &[(project, "One")]);
        write_project_issue(
            &h,
            1,
            "2026-01-01-one.md",
            "One project",
            None,
            &[project],
            "2026-01-01",
        );
        let out = h.export(target, &[], None);
        assert!(
            !out.status.success(),
            "{target} export should report a partial mirror: {}",
            String::from_utf8_lossy(&out.stderr)
        );
        let record = h.record_contents();
        assert!(
            !record.contains(project),
            "{target}: no local project id may be sent:\n{record}"
        );
        let report = String::from_utf8_lossy(&out.stderr).to_string();
        assert!(
            report.contains(field) && report.contains(reason),
            "{target}: the diagnostic names the field and the per-tool reason: {report}"
        );
    }
}

/// A diagnostic built from remote output carries no credential material (T036 step
/// 6).
///
/// The payload's project **name** is set to the configured token's value, because
/// that name is the one piece of remote text this seam quotes back in a diagnostic.
/// A message that echoed it unscrubbed would put the credential in the report.
#[test]
fn t038_a_project_diagnostic_carries_no_credential_material() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_projects(&h, &[("p-1", "One")]);
    write_project_issue(
        &h,
        1,
        "2026-01-01-cred.md",
        "Credential test",
        Some("100"),
        &["p-1"],
        "2026-01-01",
    );
    let secret = fs::read_to_string(h.dir().join("tix.toml"))
        .unwrap()
        .lines()
        .find_map(|line| line.strip_prefix("token = \""))
        .map(|value| value.trim_end_matches('"').to_string())
        .expect("the fixture configures a token");

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "unsupported project memberships make the export partial"
    );
    let remote = format!(
        r#"[{{"iid":100,"title":"Credential test","description":"Body.","labels":[],
            "state":"opened","updated_at":null,
            "projects":[{{"id":"p-ghost","name":"{secret}"}},{{"name":"{secret}"}}]}}]"#
    );
    let imported = h.import("gitlab", &remote);
    assert!(
        imported.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&imported.stderr)
    );

    let stdout = format!(
        "{}{}",
        String::from_utf8_lossy(&out.stdout),
        String::from_utf8_lossy(&imported.stdout)
    );
    let stderr = format!(
        "{}{}",
        String::from_utf8_lossy(&out.stderr),
        String::from_utf8_lossy(&imported.stderr)
    );
    assert!(
        stdout.contains("<token>"),
        "the remote-reported name must have been redacted, not omitted: {stdout}"
    );
    assert!(
        !stdout.contains(&secret) && !stderr.contains(&secret),
        "a diagnostic built from remote output leaked the token:\n  out: {stdout}\n  err: {stderr}"
    );
    // Reading a name is not reading an id: the ghost project is still diagnosed.
    assert!(
        stdout.contains("p-ghost") && stdout.contains("registry does not declare"),
        "the unknown project is reported by id: {stdout}"
    );
}

// -----------------------------------------------------------------------
// WP08 (mission epics-work-items-01M3BYW4) — epic references across a
// sync round trip
// -----------------------------------------------------------------------

/// Declare epics in `tix.toml`, in the `[epics.<id>]` registry shape WP01 landed.
///
/// Written by hand for the same reason [`declare_projects`] is: this work package
/// owns `tests/sync.rs` and not the epic CLI surface, and the config file is the
/// canonical input either way.
fn declare_epics(h: &Harness, epics: &[(&str, &str)]) {
    let toml_path = h.dir().join("tix.toml");
    let mut contents = fs::read_to_string(&toml_path).unwrap();
    for (id, name) in epics {
        contents.push_str(&format!("\n[epics.\"{id}\"]\nname = \"{name}\"\n"));
    }
    fs::write(&toml_path, contents).unwrap();
}

/// Write an issue file by hand, with the epic references under test.
///
/// Mirrors [`write_project_issue`], and is written rather than created through a
/// command for the same reason: the file is the canonical input either way, and the
/// assertions read it back from disk.
fn write_epic_issue(
    h: &Harness,
    number: u32,
    filename: &str,
    title: &str,
    gitlab_id: Option<&str>,
    epics: &[&str],
    updated: &str,
) {
    let issues = h.dir().join("docs").join("issues");
    fs::create_dir_all(&issues).unwrap();
    let mut text = format!(
        "---\nnumber: {number}\ntitle: \"{title}\"\nstatus: \"todo\"\nlabels: []\npriority: \"medium\"\n"
    );
    if let Some(id) = gitlab_id {
        text.push_str(&format!("gitlab_id: \"{id}\"\n"));
    }
    if !epics.is_empty() {
        text.push_str("epics:\n");
        for epic in epics {
            text.push_str(&format!("- {epic}\n"));
        }
    }
    text.push_str(&format!(
        "created: \"2026-01-01\"\nupdated: \"{updated}\"\n---\n\nBody.\n"
    ));
    fs::write(issues.join(filename), text).unwrap();
}

/// The epic references of issue `number`, **in the order the file carries them**
/// — the property a round trip must not disturb (NFR-002).
fn epics_of(h: &Harness, number: u32) -> Vec<String> {
    let text = issue_text(h, number);
    let mut lines = text.lines();
    while let Some(line) = lines.next() {
        if line.trim_end() == "epics:" {
            let mut ids = Vec::new();
            for entry in lines.by_ref() {
                match entry.strip_prefix("- ") {
                    Some(id) => ids.push(id.trim().to_string()),
                    None => break,
                }
            }
            return ids;
        }
    }
    Vec::new()
}

/// How many `epic_referenced` events the issue's History carries.
///
/// Counted from the file, because "a no-op appends no History entry" is a claim
/// about the appended log and not about the returned outcome.
fn reference_events(h: &Harness, number: u32) -> usize {
    issue_text(h, number)
        .lines()
        .filter(|line| line.contains("epic_referenced"))
        .count()
}

/// An epic reference the remote cannot hold still produces a diagnostic naming the
/// field, and it survives a full export → import round trip (C-007, acceptance
/// scenario 3).
#[test]
fn t039_an_unrepresentable_epic_reference_survives_the_round_trip_and_is_named() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_epics(
        &h,
        &[("e-platform", "Platform hardening"), ("e-docs", "Docs")],
    );
    write_epic_issue(
        &h,
        1,
        "2026-01-01-in-two-epics.md",
        "In two epics",
        None,
        &["e-platform", "e-docs"],
        "2026-01-01",
    );

    // The dry run reports the same diagnostics a real run would, before anything is
    // created remotely.
    let dry = h.export("gitlab", &["--dry-run"], None);
    assert!(
        !dry.status.success(),
        "the dry run previews a partial live export: {}",
        String::from_utf8_lossy(&dry.stderr)
    );
    let dry_report = String::from_utf8_lossy(&dry.stderr).to_string();
    for needle in [
        "gitlab: epics",
        "cannot represent",
        "#1",
        "e-platform",
        "e-docs",
    ] {
        assert!(
            dry_report.contains(needle),
            "`{needle}` missing from the dry-run report: {dry_report}"
        );
    }

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "unsupported epic references make the export partial: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    let report = String::from_utf8_lossy(&out.stderr).to_string();

    // **Nothing was sent for a reference.** The recorded argv is the evidence: no
    // local epic id may reach a command line.
    let record = h.record_contents();
    assert!(
        !record.contains("e-platform") && !record.contains("e-docs"),
        "no local epic id may reach the command line:\n{record}"
    );
    for needle in [
        "gitlab: epics",
        "cannot represent",
        "#1",
        "e-platform",
        "e-docs",
    ] {
        assert!(report.contains(needle), "`{needle}` missing from: {report}");
    }
    // The local list is untouched by the export, read back from the file.
    assert_eq!(epics_of(&h, 1), ["e-platform", "e-docs"]);

    // The remote could not have received them, so the import reports none — and the
    // references are still there afterwards.
    let remote = r#"[{"iid":100,"title":"In two epics","description":"Body.","labels":[],
        "state":"opened","updated_at":"2099-01-01T00:00:00Z"}]"#;
    let imported = h.import("gitlab", remote);
    assert!(
        imported.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&imported.stderr)
    );
    assert_eq!(
        epics_of(&h, 1),
        ["e-platform", "e-docs"],
        "a reference the remote cannot hold survives the whole round trip"
    );
}

/// An imported payload's references are applied through the epic service, keeping
/// every reference and the local order (C-003, NFR-002 — the intake's named risk).
///
/// This is the representable direction: the payload reports the epic ids and the
/// import matches them by id, one History entry per accepted reference. The payload
/// lists them in a **different order**, which is what makes this an order test rather
/// than a set test.
#[test]
fn t039_an_imported_payload_lands_its_epic_references_through_the_service() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_epics(&h, &[("e-1", "One"), ("e-2", "Two"), ("e-3", "Three")]);
    write_epic_issue(
        &h,
        1,
        "2026-01-01-tracked.md",
        "Tracked",
        Some("100"),
        &["e-1"],
        "2026-01-01",
    );
    assert_eq!(epics_of(&h, 1), ["e-1"]);

    // Absent `updated_at` keeps the issue's own fields, so the only thing this import
    // can change is the reference list — exactly the case that proves the epic pass
    // does not ride on the overwrite branch.
    let remote = r#"[{"iid":100,"title":"Tracked","description":"Body.","labels":[],
        "state":"opened","updated_at":null,"epics":["e-3","e-1","e-2"]}]"#;
    let imported = h.import("gitlab", remote);
    assert!(
        imported.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&imported.stderr)
    );
    let report = String::from_utf8_lossy(&imported.stdout).to_string();
    assert!(
        report.contains("kept gitlab issue 100"),
        "the issue's own fields must be kept, or this test is about a different \
         branch: {report}"
    );
    assert_eq!(
        epics_of(&h, 1),
        ["e-1", "e-3", "e-2"],
        "the already-present reference keeps its place, and the two new ones are \
         appended in the order the payload presented them — the local list is never \
         reordered"
    );
    assert_eq!(
        reference_events(&h, 1),
        2,
        "one History entry per newly accepted reference: {report}"
    );
}

/// An issue in three epics keeps all three, in order, after a round trip, and a
/// second import of the same payload is a true no-op (T039 steps 2, 3, 5).
#[test]
fn t039_a_second_export_and_a_second_import_are_true_no_ops() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_epics(&h, &[("e-1", "One"), ("e-2", "Two"), ("e-3", "Three")]);
    write_epic_issue(
        &h,
        1,
        "2026-01-01-triple.md",
        "Three epics",
        Some("100"),
        &["e-1", "e-2", "e-3"],
        "2026-01-01",
    );

    let remote = r#"[{"iid":100,"title":"Three epics","description":"Body.","labels":[],
        "state":"opened","updated_at":null,"epics":["e-3","e-1","e-2"]}]"#;
    let first = h.import("gitlab", remote);
    assert!(first.status.success());
    assert_eq!(
        epics_of(&h, 1),
        ["e-1", "e-2", "e-3"],
        "every reference is kept, in the local order"
    );
    assert_eq!(
        reference_events(&h, 1),
        0,
        "all three were already referenced, so the import was a no-op"
    );
    let after_first = issue_text(&h, 1);

    let second = h.import("gitlab", remote);
    assert!(second.status.success());
    assert_eq!(
        issue_text(&h, 1),
        after_first,
        "a second identical import must change no byte of the file — no duplicate, no \
         reorder, no History entry"
    );
    assert!(
        !String::from_utf8_lossy(&second.stdout).contains("referenced gitlab"),
        "an already-present reference is not reported as work"
    );

    // Two exports: the first records the remote id, the second is a no-op on disk.
    let first_export = h.export("gitlab", &[], None);
    assert!(
        !first_export.status.success(),
        "the first export reports unsupported epic references"
    );
    let after_export = issue_text(&h, 1);
    let again = h.export("gitlab", &[], None);
    assert!(
        !again.status.success(),
        "the second export remains partial for the same unsupported references"
    );
    assert_eq!(
        issue_text(&h, 1),
        after_export,
        "re-exporting an unchanged snapshot must not change a byte"
    );
    assert_eq!(epics_of(&h, 1), ["e-1", "e-2", "e-3"]);
}

/// Matching is on the epic **id**, never on the name (C-003).
///
/// The fixture makes the two answers disagree: the remote calls epic `e-1`
/// *"Remotely renamed"*, which is the local **name of a different epic** (`e-2`). A
/// name-based merge would reference `e-2` as well — or instead.
#[test]
fn t039_a_remote_epic_rename_matches_on_the_id_and_never_on_the_name() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_epics(
        &h,
        &[("e-1", "Platform hardening"), ("e-2", "Remotely renamed")],
    );
    write_epic_issue(
        &h,
        1,
        "2026-01-01-renamed.md",
        "Renamed remotely",
        Some("100"),
        &["e-1"],
        "2026-01-01",
    );
    let toml_before = fs::read_to_string(h.dir().join("tix.toml")).unwrap();

    let remote = r#"[{"iid":100,"title":"Renamed remotely","description":"Body.","labels":[],
        "state":"opened","updated_at":null,
        "epics":[{"id":"e-1","name":"Remotely renamed"}]}]"#;
    let out = h.import("gitlab", remote);
    assert!(
        out.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );

    assert_eq!(
        epics_of(&h, 1),
        ["e-1"],
        "the remote renamed an epic and the reference is still the *same* one"
    );
    assert_eq!(
        reference_events(&h, 1),
        0,
        "an already-present reference is a no-op even when the remote renames it"
    );
    assert_eq!(
        fs::read_to_string(h.dir().join("tix.toml")).unwrap(),
        toml_before,
        "the local registry's display labels are not the remote's to rewrite"
    );

    // A payload that identifies the epic only by a *name* the local registry uses is
    // refused: a name cannot be matched on, so nothing is referenced and the refusal
    // names the field.
    let by_name = r#"[{"iid":100,"title":"Renamed remotely","description":"Body.","labels":[],
        "state":"opened","updated_at":null,
        "epics":[{"name":"Platform hardening"}]}]"#;
    let out = h.import("gitlab", by_name);
    assert!(out.status.success());
    let report = String::from_utf8_lossy(&out.stdout).to_string();
    assert!(
        report.contains("gitlab: epics") && report.contains("no id"),
        "a name is not an identity, and the diagnostic says so: {report}"
    );
    assert_eq!(
        epics_of(&h, 1),
        ["e-1"],
        "and no reference was invented from a name"
    );
}

/// A remote epic the local registry does not declare is **diagnosed, never
/// written** — once per issue and reference, with no dangling reference, no registry
/// write, and a stable end state (T039 step 4, C-007).
///
/// The payload is deliberately ordered with the *already tracked* issue last: the
/// reference pass must not depend on the order the remote listed its issues in.
#[test]
fn t039_a_remote_epic_the_registry_does_not_know_creates_no_dangling_reference() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_epics(&h, &[("e-1", "One")]);
    write_epic_issue(
        &h,
        1,
        "2026-01-01-tracked.md",
        "Tracked",
        Some("10"),
        &[],
        "2026-01-01",
    );
    let toml_before = fs::read_to_string(h.dir().join("tix.toml")).unwrap();

    let remote = r#"[{"iid":11,"title":"Created one","description":"","labels":[],
        "state":"opened","updated_at":null,"epics":["e-1","e-ghost"]},
        {"iid":12,"title":"Created two","description":"","labels":[],
        "state":"opened","updated_at":null,"epics":["e-1","e-ghost"]},
        {"iid":10,"title":"Tracked","description":"","labels":[],
        "state":"opened","updated_at":null,"epics":["e-1","e-ghost"]}]"#;
    let out = h.import("gitlab", remote);
    assert!(
        out.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    let report = String::from_utf8_lossy(&out.stdout).to_string();

    // One diagnostic per (issue, epic) — three, not six, and not one per pass.
    assert_eq!(
        report.matches("registry does not declare").count(),
        3,
        "one diagnostic per unknown reference, not a storm: {report}"
    );
    for needle in ["gitlab: epics", "e-ghost", "cannot represent"] {
        assert!(report.contains(needle), "`{needle}` missing from: {report}");
    }
    // The known reference landed on all three issues, including the tracked one
    // listed last, and the unknown one on none of them.
    let all = find_issue_texts(&h).join("\n");
    assert!(
        !all.contains("e-ghost"),
        "an unknown epic must not be written into any issue file as a dangling \
         reference:\n{all}"
    );
    for number in [1, 2, 3] {
        assert_eq!(
            epics_of(&h, number),
            ["e-1"],
            "issue #{number} keeps exactly the reference the registry can resolve"
        );
    }
    // The registry was not written, so no partial registry can exist.
    assert_eq!(
        fs::read_to_string(h.dir().join("tix.toml")).unwrap(),
        toml_before,
        "a sync never writes the epic registry"
    );

    // The end state is stable: a second import reports the same three diagnostics and
    // changes nothing.
    let before = find_issue_texts(&h).join("\n");
    let second = h.import("gitlab", remote);
    assert!(second.status.success());
    let second_report = String::from_utf8_lossy(&second.stdout).to_string();
    assert_eq!(
        second_report.matches("registry does not declare").count(),
        3,
        "still one per reference: {second_report}"
    );
    assert_eq!(
        find_issue_texts(&h).join("\n"),
        before,
        "the end state is stable"
    );
}

/// Both adapters present the **same** epic seam, and neither sends a verb for it
/// (T038 steps 3 and 6, T040 step 6).
///
/// The compile-time half is the trait: `set_epics` is required, so an adapter that
/// forgot it would not build. The half asserted here is that both adapters answer the
/// **same** call identically — and that the empty set spawns nothing.
#[test]
fn t040_both_adapters_present_the_same_epic_seam_and_send_no_verb() {
    use tix::sync::glab::GitLabAdapter;
    use tix::sync::linear::LinearAdapter;
    use tix::sync::{ProcessRunner, Tool, TrackerAdapter};

    // `ProcessRunner` is deliberate: it spawns a real process, so a reference list
    // that caused a spawn would fail loudly here — no `glab` or `linear-cli` is on
    // this test's `PATH`. The empty set must return before any spawn, on both tools.
    let mut gitlab = GitLabAdapter::new(ProcessRunner, None, None, "acme/tix".into());
    let mut linear = LinearAdapter::new(ProcessRunner, None, "Eng".into());
    let seams: [(Tool, &mut dyn TrackerAdapter); 2] =
        [(Tool::GitLab, &mut gitlab), (Tool::Linear, &mut linear)];
    for (tool, adapter) in seams {
        assert_eq!(adapter.tool(), tool);
        adapter
            .set_epics("100", &[])
            .unwrap_or_else(|e| panic!("{tool}: the empty epic seam must be a no-op: {e}"));
    }

    // And through the compiled CLI for both targets: no local epic id reaches a
    // command line, and the report names the tool's own field and reason.
    for (target, setup, field, reason, epic) in [
        (
            "gitlab",
            Harness::init_with_gitlab as fn(&Harness),
            "gitlab: epics",
            "epic_iid",
            "e-1",
        ),
        (
            "linear",
            Harness::init_with_linear as fn(&Harness),
            "linear: epics",
            "no epic level",
            "e-1",
        ),
    ] {
        let h = Harness::new();
        setup(&h);
        declare_epics(&h, &[(epic, "One")]);
        write_epic_issue(
            &h,
            1,
            "2026-01-01-one.md",
            "One epic",
            None,
            &[epic],
            "2026-01-01",
        );
        let out = h.export(target, &[], None);
        assert!(
            !out.status.success(),
            "{target} export should report a partial mirror: {}",
            String::from_utf8_lossy(&out.stderr)
        );
        let record = h.record_contents();
        assert!(
            !record.contains(epic),
            "{target}: no local epic id may be sent:\n{record}"
        );
        let report = String::from_utf8_lossy(&out.stderr).to_string();
        assert!(
            report.contains(field) && report.contains(reason),
            "{target}: the diagnostic names the field and the per-tool reason: {report}"
        );
    }
}

/// A diagnostic built from remote output carries no credential material (T038 step
/// 6).
///
/// The payload's epic **name** is set to the configured token's value, because that
/// name is the one piece of remote text this seam quotes back in a diagnostic. A
/// message that echoed it unscrubbed would put the credential in the report.
#[test]
fn t040_an_epic_diagnostic_carries_no_credential_material() {
    let h = Harness::new();
    h.init_with_gitlab();
    declare_epics(&h, &[("e-1", "One")]);
    write_epic_issue(
        &h,
        1,
        "2026-01-01-cred.md",
        "Credential test",
        Some("100"),
        &["e-1"],
        "2026-01-01",
    );
    let secret = fs::read_to_string(h.dir().join("tix.toml"))
        .unwrap()
        .lines()
        .find_map(|line| line.strip_prefix("token = \""))
        .map(|value| value.trim_end_matches('"').to_string())
        .expect("the fixture configures a token");

    let out = h.export("gitlab", &[], None);
    assert!(
        !out.status.success(),
        "unsupported epic references make the export partial"
    );
    let remote = format!(
        r#"[{{"iid":100,"title":"Credential test","description":"Body.","labels":[],
            "state":"opened","updated_at":null,
            "epics":[{{"id":"e-ghost","name":"{secret}"}},{{"name":"{secret}"}}]}}]"#
    );
    let imported = h.import("gitlab", &remote);
    assert!(
        imported.status.success(),
        "import failed: {}",
        String::from_utf8_lossy(&imported.stderr)
    );

    let stdout = format!(
        "{}{}",
        String::from_utf8_lossy(&out.stdout),
        String::from_utf8_lossy(&imported.stdout)
    );
    let stderr = format!(
        "{}{}",
        String::from_utf8_lossy(&out.stderr),
        String::from_utf8_lossy(&imported.stderr)
    );
    assert!(
        stdout.contains("<token>"),
        "the remote-reported name must have been redacted, not omitted: {stdout}"
    );
    assert!(
        !stdout.contains(&secret) && !stderr.contains(&secret),
        "a diagnostic built from remote output leaked the token:\n  out: {stdout}\n  err: {stderr}"
    );
    // Reading a name is not reading an id: the ghost epic is still diagnosed.
    assert!(
        stdout.contains("e-ghost") && stdout.contains("registry does not declare"),
        "the unknown epic is reported by id: {stdout}"
    );
}