tix-tracker 0.12.0

//! WP08 acceptance tests: the cross-surface verification target (mission
//! `per-issue-time-tracking-01M3C9A4`, subtasks T039–T042).
//!
//! WP01–WP07 each proved its own half of the feature (`time_entry`,
//! `time_history`, `time_aggregate`, `time_cli`, `tui_state`, `mcp`,
//! `time_portable`). What this file proves is the claim none of them could make
//! alone: that the **four surfaces agree**, that a mutation's audit is one event,
//! that a refusal writes nothing, that an absent value is never a zero, and that a
//! total over 10,000 entries is a linear pass with no file I/O — each with a
//! **positive control**, so a test that cannot fail is impossible to miss.
//!
//! # The discipline
//!
//! * The CLI and the MCP server are driven through the **compiled binary**, so the
//!   bytes compared are the bytes a user gets. The MCP text channel is, by the
//!   server's own contract, the CLI's stdout verbatim — so the parity assertions are
//!   string equality, not two hand-built expectations that could agree by accident.
//! * The TUI is driven through `App::handle_key` and rendered into a
//!   `ratatui::backend::TestBackend` (no live terminal), and its data seam
//!   (`StatsTimeState`) is compared to the shared calculation the CLI prints.
//! * The portable document is read through the binary (`tix export --target time`)
//!   and through the library's own reader (`PortableTimeDocument::from_json`), which
//!   is the one round-trip half the binary does not expose.
//! * The in-process `TimeSnapshot` is the shared calculation every surface calls; it
//!   is the fourth opinion in every parity assertion.
//!
//! # Positive controls
//!
//! Every negative or no-write claim is paired with an assertion that **fails if the
//! property were already broken**: the "a refusal writes nothing" cases assert that
//! the same command *without* the refusal cause **does** move the tree; the
//! absence-vs-zero cases assert that the recorded zero and the two absences are
//! pairwise different; the guard tests assert the counters move when the input grows.
//!
//! TTY-free, network-free and clock-free: every project is a `TempDir`, and no case
//! reads an environment variable, a locale or the current time.
//!
//! Requirement ids in the test names: C-001…C-008, FR-001…FR-005, NFR-001…NFR-003.

use std::collections::BTreeMap;
use std::fs;
use std::io::{BufRead, BufReader, Write};
use std::path::{Path, PathBuf};
use std::process::{Child, ChildStdin, Command, Stdio};
use std::sync::mpsc;
use std::thread::JoinHandle;
use std::time::{Duration, Instant};

use crossterm::event::{KeyCode, KeyEvent, KeyModifiers};
use serde_json::{Value, json};
use tempfile::TempDir;

use tix::app::{App, Mode, StatsTab, StatsTimeState};
use tix::config::Config;
use tix::model::{HistoryEventKind, Issue};
use tix::storage::Store;
use tix::time_tracking::aggregate::{TimeSnapshot, TimeTotal, TimeTotalState};
use tix::time_tracking::entry::TimeEntry;
use tix::time_tracking::filters::TimeFilter;
use tix::time_tracking::portable::PortableTimeDocument;
use tix::time_tracking::service::entry_id_in;

fn tix() -> String {
    env!("CARGO_BIN_EXE_tix").to_string()
}

// ---------------------------------------------------------------------------
// Fixtures
// ---------------------------------------------------------------------------

/// A project with a real `tix.toml` and an `issues/` directory.
fn project() -> (TempDir, PathBuf) {
    let tmp = TempDir::new().unwrap();
    let dir = tmp.path().join("issues");
    fs::create_dir_all(&dir).unwrap();
    fs::write(
        tmp.path().join("tix.toml"),
        format!(
            "issues_dir = {issues:?}\n\
             [kanban.default]\ncolumns = [\"todo\", \"in progress\", \"done\"]\n\
             done_column = \"done\"\n[layout]\nmove_on_change = false\n",
            issues = dir.to_string_lossy(),
        ),
    )
    .unwrap();
    (tmp, dir)
}

/// The project's configuration, loaded from the file `project()` wrote.
fn config(tmp: &TempDir) -> Config {
    Config::load_with_warning(&tmp.path().join("tix.toml"), |_| {}).expect("the config loads")
}

/// The markdown of one issue file, by hand.
///
/// Written as bytes rather than assembled from the writer, so the fixture is what a
/// hand-edited file can be — a missing duration, an undated entry, a recorded zero
/// and a History block with a deletion and a correction all appear here.
fn issue_markdown(number: u32, assignee: &str, entries: &str, history: &str) -> String {
    format!(
        "---\nnumber: {number}\ntitle: \"Issue {number}\"\nstatus: \"todo\"\n\
         labels: []\npriority: \"medium\"\nassignee: {assignee:?}\n\
         estimate: \"3d\"\ncreated: \"2026-01-01\"\nupdated: \"2026-01-01\"\n{entries}---\n\n\
         {history}Body prose that must survive.\n"
    )
}

fn issue_filename(number: u32) -> String {
    format!("2026-01-01-issue-{number}.md")
}

fn write_issue_with_history(dir: &Path, number: u32, assignee: &str, entries: &str, history: &str) {
    fs::write(
        dir.join(issue_filename(number)),
        issue_markdown(number, assignee, entries, history),
    )
    .unwrap();
}

fn write_issue(dir: &Path, number: u32, assignee: &str, entries: &str) {
    write_issue_with_history(dir, number, assignee, entries, "");
}

/// One `time_entries:` list item, with the date omitted when the entry carries none.
fn entry_line(
    id: &str,
    minutes: Option<i64>,
    date: Option<&str>,
    author: &str,
    note: &str,
) -> String {
    let mut out = format!("- id: {id}\n");
    if let Some(minutes) = minutes {
        out.push_str(&format!("  duration_minutes: {minutes}\n"));
    }
    if let Some(date) = date {
        out.push_str(&format!("  date: {date:?}\n"));
    }
    out.push_str(&format!("  author: {author:?}\n"));
    if !note.is_empty() {
        out.push_str(&format!("  note: {note:?}\n"));
    }
    out
}

fn entries(items: &[String]) -> String {
    format!("time_entries:\n{}", items.concat())
}

/// The two History events this mission's audit is judged on: one correction (a
/// prior value kept) and one deletion (a prior value kept, with its actor).
const AUDIT_HISTORY: &str = "## History\n\n\
    - 2026-03-10T08:00:00Z \u{2014} ada \u{2014} time_entry_updated \u{2014} \
    entry e-a1; updated 60m on 2026-03-01 by ada -> 90m on 2026-03-01 by ada; reason: recount\n\
    - 2026-03-11T09:30:00Z \u{2014} bob \u{2014} time_entry_deleted \u{2014} \
    entry e-old; deleted 45m on 2026-02-01 by ada; reason: duplicate\n\n";

/// The fixture every parity case reads.
///
/// * `#1` — three entries: a valid dated 90, an **undated** 30, a **recorded zero** —
///   plus a correction and a deletion in History (the audit cases).
/// * `#2` — one **malformed** entry (no duration at all), an author and nothing else.
/// * `#3` — no entries: the scope that answers `nothing`.
/// * `#4` — exactly one entry of **zero** minutes: the scope that answers a recorded
///   `0` rather than an absence.
fn fixture() -> (TempDir, PathBuf) {
    let (tmp, dir) = project();
    write_issue_with_history(
        &dir,
        1,
        "@ada",
        &entries(&[
            entry_line("e-a1", Some(90), Some("2026-03-01"), "ada", "shipped"),
            entry_line("e-a2", Some(30), None, "ada", ""),
            entry_line("e-a0", Some(0), Some("2026-03-02"), "ada", ""),
        ]),
        AUDIT_HISTORY,
    );
    write_issue(
        &dir,
        2,
        "@bob",
        &entries(&[entry_line("e-b1", None, None, "bob", "")]),
    );
    write_issue(&dir, 3, "@ada", "");
    write_issue(
        &dir,
        4,
        "@ada",
        &entries(&[entry_line("e-d1", Some(0), Some("2026-03-03"), "ada", "")]),
    );
    (tmp, dir)
}

/// The shared calculation over the project's active issues — the fourth opinion in
/// every parity assertion, built exactly as `tix time total` builds it.
fn snapshot(tmp: &TempDir) -> (Config, TimeSnapshot) {
    let config = config(tmp);
    let store = Store::open(&config).expect("the store opens");
    let issues = store.list().expect("the issues are read");
    (config, TimeSnapshot::of(&issues))
}

// ---------------------------------------------------------------------------
// CLI / process helpers
// ---------------------------------------------------------------------------

fn run(dir: &Path, args: &[&str]) -> (i32, String, String) {
    let out = Command::new(tix())
        .current_dir(dir)
        .args(args)
        .output()
        .expect("the binary runs");
    (
        out.status.code().unwrap_or(-1),
        String::from_utf8(out.stdout).unwrap(),
        String::from_utf8(out.stderr).unwrap(),
    )
}

fn ok(dir: &Path, args: &[&str]) -> String {
    let (code, stdout, stderr) = run(dir, args);
    assert_eq!(
        code, 0,
        "tix {args:?} exited {code}\nstdout:\n{stdout}\nstderr:\n{stderr}"
    );
    stdout
}

fn refused(dir: &Path, args: &[&str]) -> (i32, String, String) {
    let (code, stdout, stderr) = run(dir, args);
    assert_ne!(code, 0, "tix {args:?} unexpectedly succeeded:\n{stdout}");
    (code, stdout, stderr)
}

/// Every file under `dir`, by relative path, as raw bytes.
fn tree(dir: &Path) -> BTreeMap<String, Vec<u8>> {
    let mut out = BTreeMap::new();
    let mut stack = vec![dir.to_path_buf()];
    while let Some(current) = stack.pop() {
        let Ok(read) = fs::read_dir(&current) else {
            continue;
        };
        for entry in read.flatten() {
            let path = entry.path();
            if path.is_dir() {
                stack.push(path);
            } else {
                let name = path
                    .strip_prefix(dir)
                    .unwrap()
                    .to_string_lossy()
                    .to_string();
                out.insert(name, fs::read(&path).unwrap());
            }
        }
    }
    out
}

/// One `key: value` scope block, as the CLI prints it.
fn block(stdout: &str) -> BTreeMap<String, String> {
    stdout
        .lines()
        .filter_map(|line| line.split_once(": "))
        .map(|(key, value)| (key.to_string(), value.to_string()))
        .collect()
}

/// The CLI's absent marker `-` as `None`, and a recorded `0` as `Some(0)`.
fn opt_i128(raw: &str) -> Option<i128> {
    if raw.trim() == "-" {
        None
    } else {
        Some(raw.trim().parse().expect("a numeric total"))
    }
}

/// The five fields every surface must agree on.
type Fields = (String, Option<i128>, usize, usize, usize);

fn shared_fields(total: &TimeTotal) -> Fields {
    (
        total.state().as_str().to_string(),
        total.total_minutes,
        total.entry_count,
        total.malformed_count,
        total.undated_count,
    )
}

/// The same five fields, read out of a CLI scope block.
fn cli_fields(stdout: &str) -> Fields {
    let fields = block(stdout);
    (
        fields["state"].clone(),
        opt_i128(&fields["total_minutes"]),
        fields["entry_count"].parse().unwrap(),
        fields["malformed_count"].parse().unwrap(),
        fields["undated_count"].parse().unwrap(),
    )
}

/// The same five fields, read out of a portable document's total.
fn portable_fields(document: &PortableTimeDocument) -> Fields {
    (
        document.total.state.clone(),
        document.total.total_minutes,
        document.total.entry_count,
        document.total.malformed_count,
        document.total.undated_count,
    )
}

/// The same five fields, read out of that entry snapshot's aggregate.
fn value_result(result: &Value) -> &Value {
    result.get("result").unwrap_or(result)
}

/// The structured payload of a successful MCP tool call.
fn structured(result: &Value) -> &Value {
    &value_result(result)["structuredContent"]
}

/// The text channel of a successful MCP tool call.
fn text(result: &Value) -> &str {
    value_result(result)["content"][0]["text"]
        .as_str()
        .expect("the tool answered with a text channel")
}

// ---------------------------------------------------------------------------
// MCP session harness
// ---------------------------------------------------------------------------

/// A real `tix mcp` server over stdio, driven by JSON-RPC.
struct Mcp {
    child: Child,
    stdin: Option<ChildStdin>,
    rx: mpsc::Receiver<String>,
    reader: Option<JoinHandle<()>>,
    id: u32,
}

impl Mcp {
    fn start(repo: &Path) -> Self {
        let mut child = Command::new(tix())
            .arg("mcp")
            .current_dir(repo)
            .stdin(Stdio::piped())
            .stdout(Stdio::piped())
            .stderr(Stdio::null())
            .spawn()
            .expect("spawn tix mcp");
        let stdin = child.stdin.take().expect("stdin piped");
        let stdout = child.stdout.take().expect("stdout piped");
        let (tx, rx) = mpsc::channel();
        let reader = std::thread::spawn(move || {
            for line in BufReader::new(stdout).lines() {
                match line {
                    Ok(line) => {
                        if tx.send(line).is_err() {
                            break;
                        }
                    }
                    Err(_) => break,
                }
            }
        });
        let mut session = Self {
            child,
            stdin: Some(stdin),
            rx,
            reader: Some(reader),
            id: 1,
        };
        session.handshake();
        session
    }

    fn send(&mut self, message: Value) {
        let stdin = self.stdin.as_mut().expect("stdin open");
        writeln!(stdin, "{message}").unwrap();
        stdin.flush().unwrap();
    }

    fn next_id(&mut self) -> u32 {
        let id = self.id;
        self.id += 1;
        id
    }

    fn handshake(&mut self) {
        let id = self.next_id();
        self.send(json!({
            "jsonrpc": "2.0",
            "id": id,
            "method": "initialize",
            "params": {"protocolVersion": "2025-06-18", "capabilities": {}}
        }));
        let _ = self.recv();
        self.send(json!({"jsonrpc": "2.0", "method": "notifications/initialized"}));
    }

    fn recv(&self) -> Value {
        let line = self
            .rx
            .recv_timeout(Duration::from_secs(10))
            .expect("the server answers within 10 s");
        serde_json::from_str(&line).unwrap_or_else(|error| panic!("invalid JSON: {error}\n{line}"))
    }

    /// Call one tool and return the JSON-RPC response.
    fn call(&mut self, name: &str, args: &Value) -> Value {
        let id = self.next_id();
        self.send(json!({
            "jsonrpc": "2.0",
            "id": id,
            "method": "tools/call",
            "params": {"name": name, "arguments": args}
        }));
        self.recv()
    }
}

impl Drop for Mcp {
    fn drop(&mut self) {
        let _ = self.child.kill();
        drop(self.stdin.take());
        if let Some(reader) = self.reader.take() {
            let _ = reader.join();
        }
        let _ = self.child.wait();
    }
}

// ---------------------------------------------------------------------------
// TUI helpers
// ---------------------------------------------------------------------------

fn press(code: KeyCode) -> KeyEvent {
    KeyEvent::new(code, KeyModifiers::NONE)
}

/// Render `app` into a `TestBackend` and return every row as text.
fn render_rows(app: &App, width: u16, height: u16) -> Vec<String> {
    use ratatui::Terminal;
    use ratatui::backend::TestBackend;
    let backend = TestBackend::new(width, height);
    let mut terminal = Terminal::new(backend).unwrap();
    terminal
        .draw(|f| tix::app::render(app, f, f.area()))
        .unwrap();
    let buffer = terminal.backend().buffer();
    (0..buffer.area.height)
        .map(|y| {
            (0..buffer.area.width)
                .map(|x| buffer[(x, y)].symbol())
                .collect()
        })
        .collect()
}

/// Open the `F7` Stats page and switch to its Time tab.
fn open_time_tab(app: &mut App) {
    let _ = app.handle_key(press(KeyCode::F(7))).unwrap();
    assert_eq!(app.mode, Mode::Stats, "F7 opens the Stats page");
    let _ = app.handle_key(press(KeyCode::Tab)).unwrap();
    assert_eq!(app.stats_tab, StatsTab::Time, "Tab switches tabs");
}

// ---------------------------------------------------------------------------
// History helpers
// ---------------------------------------------------------------------------

fn parsed(dir: &Path, number: u32) -> Issue {
    let text = fs::read_to_string(dir.join(issue_filename(number)))
        .unwrap_or_else(|error| panic!("issue #{number} reads: {error}"));
    Issue::parse(&text).unwrap_or_else(|error| panic!("issue #{number} parses: {error}"))
}

fn time_events(issue: &Issue) -> Vec<(HistoryEventKind, String)> {
    issue
        .history
        .events()
        .into_iter()
        .filter(|event| {
            matches!(
                event.kind,
                HistoryEventKind::TimeEntryCreated
                    | HistoryEventKind::TimeEntryUpdated
                    | HistoryEventKind::TimeEntryDeleted
            )
        })
        .map(|event| (event.kind, event.detail.clone()))
        .collect()
}

/// The `## History` bullet lines of a file's text, in file order.
fn history_lines(text: &str) -> Vec<String> {
    text.lines()
        .skip_while(|line| line.trim() != "## History")
        .filter(|line| line.starts_with("- "))
        .map(str::to_string)
        .collect()
}

// ===========================================================================
// T039 — the entry model, the mutations, and the one-event audit
// ===========================================================================

/// C-002: the value model refuses each bad field by name, and a good entry has no
/// problems. The refusal half is the negative; the valid entry is its control.
#[test]
fn c002_the_entry_model_refuses_each_bad_field_by_name() {
    let negative = TimeEntry::new("e-1", -5, None, "ada", None).unwrap_err();
    assert_eq!(negative[0].kind(), "invalid_duration");
    assert_eq!(negative[0].field(), "duration_minutes");

    let date = TimeEntry::new("e-1", 5, Some("not-a-date".into()), "ada", None).unwrap_err();
    assert_eq!(date[0].kind(), "invalid_date");
    assert_eq!(date[0].field(), "date");

    let author = TimeEntry::new("e-1", 5, None, "   ", None).unwrap_err();
    assert_eq!(author[0].kind(), "missing_author");
    assert_eq!(author[0].field(), "author");

    let id = TimeEntry::new("  ", 5, None, "ada", None).unwrap_err();
    assert_eq!(id[0].kind(), "malformed_entry");
    assert_eq!(id[0].field(), "id");

    // C-005: a missing duration is never read as zero minutes.
    let malformed = TimeEntry {
        id: "e-1".into(),
        duration_minutes: None,
        date: None,
        author: "ada".into(),
        note: None,
        extensions: Default::default(),
    };
    assert_eq!(malformed.minutes(), None);
    assert_eq!(malformed.problems()[0].kind(), "invalid_duration");

    // Positive control: a well-formed entry has no problem at all, so the refusals
    // above are the validator's verdict rather than its default.
    let valid = TimeEntry::new(
        "e-1",
        90,
        Some("2026-03-01".into()),
        "ada",
        Some("shipped".into()),
    )
    .expect("a valid entry is accepted");
    assert!(valid.is_valid());
    assert_eq!(valid.minutes(), Some(90));
}

/// NFR-002 / FR-001: a create, an edit and a delete each append exactly one
/// attributable event, and nothing else about the issue changes (C-008).
#[test]
fn nfr002_c008_each_mutation_appends_exactly_one_attributable_event() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();
    let before = parsed(dir, 1);

    // Create.
    let added = ok(
        dir,
        &[
            "time",
            "add",
            "1",
            "--minutes",
            "15",
            "--author",
            "ada",
            "--note",
            "review",
        ],
    );
    let created_id = added.split_whitespace().nth(1).unwrap().to_string();
    let after_create = parsed(dir, 1);
    assert_eq!(
        time_events(&after_create).len(),
        time_events(&before).len() + 1
    );
    let (kind, detail) = time_events(&after_create)
        .into_iter()
        .find(|(kind, _)| *kind == HistoryEventKind::TimeEntryCreated)
        .expect("one create event");
    assert_eq!(kind, HistoryEventKind::TimeEntryCreated);
    assert_eq!(entry_id_in(&detail), Some(created_id.as_str()));
    assert!(detail.contains("15m"), "{detail}");

    // Edit: the prior value stays readable (C-004).
    ok(
        dir,
        &[
            "time",
            "edit",
            "1",
            "--entry",
            &created_id,
            "--minutes",
            "20",
            "--reason",
            "recount",
        ],
    );
    let after_edit = parsed(dir, 1);
    assert_eq!(
        time_events(&after_edit).len(),
        time_events(&after_create).len() + 1
    );
    let updates: Vec<String> = time_events(&after_edit)
        .into_iter()
        .filter(|(kind, _)| *kind == HistoryEventKind::TimeEntryUpdated)
        .map(|(_, detail)| detail)
        .collect();
    let edit_detail = updates
        .iter()
        .find(|detail| entry_id_in(detail) == Some(created_id.as_str()))
        .unwrap_or_else(|| panic!("the correction names the entry: {updates:#?}"));
    // The correction keeps both values — the created 15 and the corrected 20 — so the
    // prior value is auditable (C-004).
    assert!(
        edit_detail.contains("15m") && edit_detail.contains("20m") && edit_detail.contains(" -> "),
        "{edit_detail}"
    );
    assert_eq!(entry_id_in(edit_detail), Some(created_id.as_str()));

    // Delete: the prior value survives in History.
    ok(
        dir,
        &[
            "time",
            "delete",
            "1",
            "--entry",
            &created_id,
            "--reason",
            "wrong issue",
            "--confirm",
        ],
    );
    let after_delete = parsed(dir, 1);
    assert_eq!(
        time_events(&after_delete).len(),
        time_events(&after_edit).len() + 1
    );
    let deleted = time_events(&after_delete)
        .into_iter()
        .filter(|(kind, _)| *kind == HistoryEventKind::TimeEntryDeleted)
        .map(|(_, detail)| detail)
        .find(|detail| entry_id_in(detail) == Some(created_id.as_str()))
        .unwrap_or_else(|| panic!("the deletion names the entry {created_id}"));
    assert!(deleted.contains("20m"), "{deleted}");
    assert!(
        !after_delete
            .time_entries
            .iter()
            .any(|entry| entry.id == created_id)
    );

    // C-008: the fields no time operation may change are exactly as they were.
    let final_issue = parsed(dir, 1);
    assert_eq!(final_issue.status, before.status);
    assert_eq!(final_issue.assignee, before.assignee);
    assert_eq!(final_issue.estimate, before.estimate);
    assert_eq!(final_issue.body, before.body);
}

/// C-003 / C-004: a refusal writes **nothing** — the whole tree is byte-identical.
///
/// The positive control is the same command *without* the refusal cause, which does
/// move the tree: the comparison is sensitive, so the no-write assertion is a real
/// claim about the refusal and not about `tree()` being blind.
#[test]
fn c003_a_refused_mutation_leaves_the_tree_byte_identical() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();

    let refusals: &[(&[&str], &str)] = &[
        // An unconfirmed delete (the CLI's own refusal, before any read).
        (
            &["time", "delete", "1", "--entry", "e-a1", "--reason", "why"],
            "needs --confirm",
        ),
        // An edit with a blank reason.
        (
            &[
                "time",
                "edit",
                "1",
                "--entry",
                "e-a1",
                "--minutes",
                "5",
                "--reason",
                " ",
            ],
            "missing_reason",
        ),
        // An edit naming an entry that does not exist.
        (
            &[
                "time",
                "edit",
                "1",
                "--entry",
                "e-nope",
                "--minutes",
                "5",
                "--reason",
                "why",
            ],
            "unknown_entry",
        ),
        // A negative duration: the shared validator refuses it.
        (
            &["time", "add", "1", "--minutes=-5", "--author", "ada"],
            "invalid_duration",
        ),
        // A blank author: an entry without attribution is not auditable.
        (
            &["time", "add", "1", "--minutes", "5", "--author", " "],
            "missing_author",
        ),
    ];

    for (args, expected) in refusals {
        let before = tree(dir);
        let (code, stdout, stderr) = refused(dir, args);
        assert_ne!(code, 0, "tix {args:?}");
        assert!(
            stderr.contains(expected),
            "tix {args:?} names the condition `{expected}`: {stderr}"
        );
        assert!(
            stderr.contains("error["),
            "a refusal is rendered as a diagnostic: {stderr}"
        );
        assert!(!stdout.contains("total_minutes"), "no half-total: {stdout}");
        assert_eq!(
            tree(dir),
            before,
            "tix {args:?} wrote nothing, but the tree moved"
        );
    }

    // Positive control: the delete the first case refused *with* `--confirm` does
    // move the tree, so `tree()` can see a write.
    let before = tree(dir);
    ok(
        dir,
        &[
            "time",
            "delete",
            "1",
            "--entry",
            "e-a1",
            "--reason",
            "why",
            "--confirm",
        ],
    );
    assert_ne!(
        tree(dir),
        before,
        "the accepted delete must change the tree"
    );
}

/// C-003: an edit that asks for exactly what is already there is a no-op — no event,
/// no write. The control is that a real edit does write.
#[test]
fn c003_a_no_op_edit_appends_no_event_and_writes_nothing() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();
    let before = tree(dir);
    let events_before = time_events(&parsed(dir, 1)).len();

    let stdout = ok(
        dir,
        &[
            "time",
            "edit",
            "1",
            "--entry",
            "e-a1",
            "--minutes",
            "90",
            "--reason",
            "no change",
        ],
    );
    assert!(stdout.starts_with("Unchanged"), "{stdout}");
    assert_eq!(tree(dir), before, "a no-op edit writes nothing");
    assert_eq!(time_events(&parsed(dir, 1)).len(), events_before);

    // Positive control: a value that *does* change appends one event and writes.
    let changed = ok(
        dir,
        &[
            "time",
            "edit",
            "1",
            "--entry",
            "e-a1",
            "--minutes",
            "91",
            "--reason",
            "recount",
        ],
    );
    assert!(changed.starts_with("Updated"), "{changed}");
    assert_ne!(tree(dir), before);
    assert_eq!(time_events(&parsed(dir, 1)).len(), events_before + 1);
}

// ===========================================================================
// T040 — aggregation, filters, and the malformed-resilience rule
// ===========================================================================

/// C-005 / FR-003: `nothing`, `unknown` and a recorded `0` are three different
/// answers — the control is that they are pairwise different, so a surface that
/// printed `0` for both absences could not pass this test.
#[test]
fn c005_nothing_unknown_and_a_recorded_zero_are_three_distinct_answers() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();

    let nothing = ok(dir, &["time", "total", "--issue", "3"]);
    let unknown = ok(dir, &["time", "total", "--issue", "2"]);
    let zero = ok(dir, &["time", "total", "--issue", "4"]);

    assert_eq!(block(&nothing)["state"], "nothing");
    assert_eq!(block(&nothing)["total_minutes"], "-");
    assert_eq!(block(&unknown)["state"], "unknown");
    assert_eq!(block(&unknown)["total_minutes"], "-");
    assert_eq!(block(&zero)["state"], "recorded");
    assert_eq!(block(&zero)["total_minutes"], "0");

    // The three states are pairwise different strings, and the three totals are not
    // all the same value: a recorded zero is `Some(0)`, an absence is `None`.
    let states = [
        block(&nothing)["state"].clone(),
        block(&unknown)["state"].clone(),
        block(&zero)["state"].clone(),
    ];
    assert_ne!(states[0], states[1]);
    assert_ne!(states[1], states[2]);
    assert_ne!(states[0], states[2]);
    assert_eq!(opt_i128(&block(&zero)["total_minutes"]), Some(0));
    assert_eq!(opt_i128(&block(&nothing)["total_minutes"]), None);
    assert_eq!(opt_i128(&block(&unknown)["total_minutes"]), None);

    // The shared calculation says the same three things.
    let (_config, snapshot) = snapshot(&_tmp);
    assert_eq!(
        snapshot.total(&TimeFilter::new().for_issue(3)).state(),
        TimeTotalState::Nothing
    );
    assert_eq!(
        snapshot.total(&TimeFilter::new().for_issue(2)).state(),
        TimeTotalState::Unknown
    );
    assert_eq!(
        snapshot
            .total(&TimeFilter::new().for_issue(4))
            .total_minutes,
        Some(0)
    );
}

/// C-005: a malformed entry is diagnosed without blocking an unrelated read.
///
/// The malformed entry lives on `#2`; a total scoped to `#1` succeeds with no
/// finding at all (the control that the diagnostic is about `#2`, not about the
/// scope), and the unfiltered total carries exactly one finding naming `#2`.
#[test]
fn c005_a_malformed_entry_blocks_no_unrelated_read() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();

    let unrelated = ok(dir, &["time", "total", "--issue", "1"]);
    assert_eq!(block(&unrelated)["state"], "recorded");
    assert_eq!(block(&unrelated)["malformed_count"], "0");

    let (code, all_stdout, all_stderr) = run(dir, &["time", "total"]);
    assert_eq!(code, 0, "the read still succeeds: {all_stderr}");
    assert_eq!(block(&all_stdout)["malformed_count"], "1");
    assert_eq!(block(&all_stdout)["state"], "recorded");
    assert!(
        all_stderr.contains("invalid_duration") && all_stderr.contains("duration_minutes"),
        "the finding names the field: {all_stderr}"
    );
    assert!(
        all_stderr.contains("#2"),
        "the finding names the issue: {all_stderr}"
    );

    // Control: the scope that *is* the malformed entry answers `unknown`, never `0`.
    let malformed = ok(dir, &["time", "total", "--issue", "2"]);
    assert_eq!(block(&malformed)["state"], "unknown");
    assert_eq!(block(&malformed)["total_minutes"], "-");
}

/// FR-005 / C-004: the audit view is readable, and a further mutation appends to
/// History without rewriting the events already there.
#[test]
fn fr005_c004_the_audit_is_readable_and_history_is_append_only() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();

    let history = ok(dir, &["time", "history", "1"]);
    assert_eq!(block(&history)["current"], "3");
    assert_eq!(block(&history)["deleted_count"], "1");
    assert_eq!(block(&history)["corrected_count"], "1");
    assert!(
        history.contains("e-old"),
        "the deleted id is retained: {history}"
    );
    assert!(
        history.contains("bob"),
        "the deleting actor is retained: {history}"
    );

    // Append-only: a further mutation leaves every prior History line intact.
    let file = dir.join(issue_filename(1));
    let before_lines = history_lines(&fs::read_to_string(&file).unwrap());
    ok(
        dir,
        &[
            "time",
            "edit",
            "1",
            "--entry",
            "e-a2",
            "--minutes",
            "45",
            "--reason",
            "recount",
        ],
    );
    let after_lines = history_lines(&fs::read_to_string(&file).unwrap());
    assert_eq!(after_lines.len(), before_lines.len() + 1);
    assert_eq!(after_lines[..before_lines.len()], before_lines[..]);

    // The deleted prior value is still there, and the correction the fixture wrote
    // still names both of its values.
    let after = ok(dir, &["time", "history", "1"]);
    assert!(after.contains("e-old"), "{after}");
    assert_eq!(block(&after)["corrected_count"], "2");
}

/// FR-003: the filters and the breakdown are the shared calculation's, and every
/// entry the scope selects appears in exactly one group.
#[test]
fn fr003_the_breakdowns_partition_the_selection() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();

    let by_issue = ok(dir, &["time", "total", "--by", "issue"]);
    let blocks = by_issue
        .split("\n\n")
        .map(block)
        .collect::<Vec<BTreeMap<String, String>>>();
    // One block for the scope and one per issue #1..#4.
    assert_eq!(blocks.len(), 5, "{by_issue}");
    assert_eq!(blocks[0]["group"], "all");
    let counted: usize = blocks[1..]
        .iter()
        .map(|group| group["entry_count"].parse::<usize>().unwrap())
        .sum();
    let malformed: usize = blocks[1..]
        .iter()
        .map(|group| group["malformed_count"].parse::<usize>().unwrap())
        .sum();
    assert_eq!(counted, blocks[0]["entry_count"].parse::<usize>().unwrap());
    assert_eq!(
        malformed,
        blocks[0]["malformed_count"].parse::<usize>().unwrap()
    );

    // A bounded period counts the entries it can place and reports the undated one
    // as unplaceable rather than dropping it (C-005).
    let period = ok(
        dir,
        &[
            "time",
            "total",
            "--from",
            "2026-03-01",
            "--to",
            "2026-03-31",
        ],
    );
    assert_eq!(block(&period)["undated_count"], "1");
    assert_eq!(block(&period)["state"], "recorded");
    assert!(
        period.lines().count() > 0 && block(&period)["total_minutes"] != "-",
        "{period}"
    );
}

// ===========================================================================
// T041 — cross-surface parity (NFR-003, FR-004, C-006)
// ===========================================================================

/// NFR-003 / FR-004 / C-006: the CLI's stdout and MCP's text channel are the same
/// bytes for the same request, on every read verb.
#[test]
fn nfr003_fr004_the_cli_and_mcp_text_channels_are_byte_identical() {
    let (tmp, dir) = fixture();
    let dir = dir.as_path();
    let mut mcp = Mcp::start(tmp.path());

    let cases: &[(&[&str], &str, Value)] = &[
        (&["time", "show", "1"], "time_show", json!({"issue": "1"})),
        (
            &["time", "history", "1"],
            "time_history",
            json!({"issue": "1"}),
        ),
        (&["time", "total"], "time_total", json!({})),
        (
            &["time", "total", "--issue", "2"],
            "time_total",
            json!({"issue": "2"}),
        ),
        (
            &["time", "total", "--issue", "4"],
            "time_total",
            json!({"issue": "4"}),
        ),
        (
            &["time", "total", "--assignee", "bob"],
            "time_total",
            json!({"assignee": "bob"}),
        ),
        (
            &[
                "time",
                "total",
                "--from",
                "2026-03-01",
                "--to",
                "2026-03-31",
            ],
            "time_total",
            json!({"from": "2026-03-01", "to": "2026-03-31"}),
        ),
        (
            &["time", "total", "--audit"],
            "time_total",
            json!({"audit": true}),
        ),
    ];

    for (args, tool, tool_args) in cases {
        let stdout = ok(dir, args);
        let response = mcp.call(tool, tool_args);
        assert_eq!(
            text(&response),
            stdout.as_str(),
            "MCP `{tool}` and `tix {args:?}` must be the same bytes"
        );
    }
}

/// NFR-003 / FR-002 / FR-003: one scope's total is the same five fields on the four
/// surfaces — CLI, MCP structure, the shared calculation, the portable document and
/// the TUI's Time tab.
#[test]
fn nfr003_fr002_fr003_the_shared_calculation_is_one_number_on_every_surface() {
    let (tmp, dir) = fixture();
    let dir = dir.as_path();
    let (config, snapshot) = snapshot(&tmp);
    let mut mcp = Mcp::start(tmp.path());

    let scopes: &[(&[&str], Value, TimeFilter)] = &[
        (&["time", "total"], json!({}), TimeFilter::new()),
        (
            &["time", "total", "--issue", "1"],
            json!({"issue": "1"}),
            TimeFilter::new().for_issue(1),
        ),
        (
            &["time", "total", "--issue", "2"],
            json!({"issue": "2"}),
            TimeFilter::new().for_issue(2),
        ),
        (
            &["time", "total", "--issue", "3"],
            json!({"issue": "3"}),
            TimeFilter::new().for_issue(3),
        ),
        (
            &["time", "total", "--issue", "4"],
            json!({"issue": "4"}),
            TimeFilter::new().for_issue(4),
        ),
        (
            &["time", "total", "--assignee", "ada"],
            json!({"assignee": "ada"}),
            TimeFilter::new().for_assignee("ada"),
        ),
        (
            &[
                "time",
                "total",
                "--from",
                "2026-03-01",
                "--to",
                "2026-03-31",
            ],
            json!({"from": "2026-03-01", "to": "2026-03-31"}),
            TimeFilter::new().between("2026-03-01", "2026-03-31"),
        ),
    ];

    for (args, tool_args, filter) in scopes {
        let stdout = ok(dir, args);
        let fields = cli_fields(&stdout);

        // The shared calculation (the in-process fourth opinion).
        let shared = shared_fields(&snapshot.total(filter));
        assert_eq!(fields, shared, "CLI vs the shared snapshot for {args:?}");

        // The MCP structure — the same DTO, typed.
        let response = mcp.call("time_total", tool_args);
        let payload = structured(&response);
        assert_eq!(payload["state"], json!(shared.0), "MCP state for {args:?}");
        match shared.1 {
            None => assert!(
                payload["total_minutes"].is_null(),
                "MCP total is null for {args:?}: {payload}"
            ),
            Some(minutes) => assert_eq!(
                payload["total_minutes"].as_i64(),
                Some(i64::try_from(minutes).unwrap()),
                "MCP total for {args:?}"
            ),
        }
        assert_eq!(
            usize::try_from(payload["entry_count"].as_u64().unwrap()).unwrap(),
            shared.2,
            "MCP entry_count for {args:?}"
        );

        // The portable document.
        let document = PortableTimeDocument::build(&config, &snapshot, filter)
            .expect("a valid scope builds a document");
        assert_eq!(portable_fields(&document), shared, "portable for {args:?}");

        // The TUI tab's own data seam.
        let mut state = StatsTimeState::new(snapshot.clone());
        state.filter = filter.clone();
        assert_eq!(
            shared_fields(&state.total()),
            shared,
            "the TUI tab's total for {args:?}"
        );
    }
}

/// FR-004 / C-006: the entries themselves agree across the surfaces, and an absent
/// value is the same absent marker everywhere (never a zero).
#[test]
fn fr004_c006_the_entries_and_their_absent_values_agree() {
    let (tmp, dir) = fixture();
    let dir = dir.as_path();
    let (config, snapshot) = snapshot(&tmp);
    let mut mcp = Mcp::start(tmp.path());

    let stdout = ok(dir, &["time", "show", "1"]);
    let response = mcp.call("time_show", &json!({"issue": "1"}));
    assert_eq!(text(&response), stdout.as_str());

    // #1's undated entry prints an absent date as `-` on both surfaces, and the
    // recorded zero prints `0` — the control that `-` is absence, not the only mark.
    assert!(
        stdout.contains("e-a1\t90\t2026-03-01\tada\tshipped"),
        "{stdout}"
    );
    assert!(stdout.contains("e-a2\t30\t-\tada\t-"), "{stdout}");
    assert!(stdout.contains("e-a0\t0\t2026-03-02\tada\t-"), "{stdout}");

    // The malformed entry's duration is absent on every surface, never zero.
    let malformed = ok(dir, &["time", "show", "2"]);
    assert!(malformed.contains("e-b1\t-\t-\tbob\t-"), "{malformed}");
    let response = mcp.call("time_show", &json!({"issue": "2"}));
    assert_eq!(text(&response), malformed.as_str());
    let entry = &structured(&response)["entries"][0];
    assert_eq!(entry["duration_minutes"], Value::Null);
    assert_eq!(entry["id"], json!("e-b1"));

    // The portable document carries the same absent value as `null`/`None`.
    let document = PortableTimeDocument::build(&config, &snapshot, &TimeFilter::new().for_issue(2))
        .expect("a valid scope");
    let entry = &document.issues[0].entries[0];
    assert_eq!(entry.id, "e-b1");
    assert_eq!(entry.duration_minutes, None);
    assert_eq!(entry.minutes, None);
    assert!(!entry.valid);
}

/// NFR-003 / FR-005: the audit counts agree across the CLI, MCP and the portable
/// document, and a deletion never rewrites the History it came from.
#[test]
fn nfr003_fr005_the_audit_agrees_and_a_deletion_never_rewrites_history() {
    let (tmp, dir) = fixture();
    let dir = dir.as_path();
    let (config, snapshot) = snapshot(&tmp);
    let mut mcp = Mcp::start(tmp.path());

    let stdout = ok(dir, &["time", "history", "1"]);
    let response = mcp.call("time_history", &json!({"issue": "1"}));
    assert_eq!(text(&response), stdout.as_str());

    let audit = snapshot.audit(&TimeFilter::new().for_issue(1));
    assert_eq!(audit.deleted_count, 1);
    assert_eq!(audit.corrected_count, 1);
    assert_eq!(
        block(&stdout)["deleted_count"],
        audit.deleted_count.to_string()
    );
    assert_eq!(
        block(&stdout)["corrected_count"],
        audit.corrected_count.to_string()
    );
    assert_eq!(structured(&response)["deleted_count"], json!(1));

    let document = PortableTimeDocument::build(&config, &snapshot, &TimeFilter::new().for_issue(1))
        .expect("a valid scope");
    assert_eq!(document.audit.deleted_count, audit.deleted_count);
    assert_eq!(document.audit.corrected_count, audit.corrected_count);
    let row = &document.issues[0];
    assert_eq!(row.deletions.len(), 1);
    assert_eq!(row.deletions[0].entry_id.as_deref(), Some("e-old"));
    assert_eq!(row.deletions[0].deleted_by.as_deref(), Some("bob"));

    // The TUI's audit view reads the same calculation.
    let state = StatsTimeState::new(snapshot.clone());
    let view = state.audit_view();
    assert_eq!(view.deleted_count, audit.deleted_count);
    assert_eq!(view.corrected_count, audit.corrected_count);

    // A deletion is a real write: the entry leaves the projection, the prior value
    // stays in History, and every line already there is untouched.
    let file = dir.join(issue_filename(1));
    let before_lines = history_lines(&fs::read_to_string(&file).unwrap());
    ok(
        dir,
        &[
            "time",
            "delete",
            "1",
            "--entry",
            "e-a2",
            "--reason",
            "duplicate",
            "--confirm",
        ],
    );
    let after_lines = history_lines(&fs::read_to_string(&file).unwrap());
    assert_eq!(after_lines.len(), before_lines.len() + 1);
    assert_eq!(after_lines[..before_lines.len()], before_lines[..]);
    let issue = parsed(dir, 1);
    assert!(!issue.time_entries.iter().any(|entry| entry.id == "e-a2"));
    assert!(time_events(&issue).iter().any(|(kind, detail)| *kind
        == HistoryEventKind::TimeEntryDeleted
        && detail.contains("30m")));
}

/// FR-002 / C-006 / C-008: the TUI's Time tab renders the shared numbers, and
/// rendering writes nothing.
#[test]
fn fr002_c006_the_tui_time_tab_renders_the_shared_numbers() {
    let (tmp, dir) = fixture();
    let config = config(&tmp);
    let mut app = App::new(&config).expect("the app opens");
    open_time_tab(&mut app);

    let (_config, snapshot) = snapshot(&tmp);
    let shared = shared_fields(&snapshot.total(&TimeFilter::new()));
    assert_eq!(shared.0, "recorded");
    assert_eq!(shared.1, Some(120));
    assert_eq!(shared.2, 4);
    assert_eq!(shared.3, 1);

    let before = tree(&dir);
    let rows = render_rows(&app, 200, 50).join("\n");
    assert!(rows.contains("total_minutes: 120"), "{rows}");
    assert!(rows.contains("state: recorded"), "{rows}");
    assert!(rows.contains("e-a1"), "the entry rows are drawn: {rows}");
    assert_eq!(tree(&dir), before, "rendering the tab writes nothing");

    // The tab's own data seam agrees with the shared calculation, and its empty
    // scope for `nothing` is explicit rather than a blank screen.
    let mut state = StatsTimeState::new(snapshot.clone());
    state.filter = TimeFilter::new().for_issue(3);
    assert_eq!(state.total().state(), TimeTotalState::Nothing);
    let mut app = App::new(&config).unwrap();
    open_time_tab(&mut app);
    if let Some(state) = app.stats_time.as_mut() {
        state.filter = TimeFilter::new().for_issue(3);
    }
    let rows = render_rows(&app, 200, 50).join("\n");
    assert!(rows.contains("state: nothing"), "{rows}");
    assert!(rows.contains("total_minutes: -"), "{rows}");
}

/// C-007 / FR-004: the portable document round-trips through the library's own
/// reader, and its numbers are the CLI's numbers.
#[test]
fn c007_fr004_the_portable_document_round_trips() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();

    let raw = ok(dir, &["export", "--target", "time"]);
    let written: Value = serde_json::from_str(&raw).expect("one JSON document");
    let read_back =
        PortableTimeDocument::from_json(&raw).expect("this build re-reads what it wrote");

    // The document's total is the CLI's own total, field for field.
    let plain = ok(dir, &["time", "total"]);
    assert_eq!(read_back.total.state, block(&plain)["state"]);
    assert_eq!(
        read_back.total.total_minutes,
        opt_i128(&block(&plain)["total_minutes"])
    );
    assert_eq!(
        read_back.total.entry_count.to_string(),
        block(&plain)["entry_count"]
    );

    // The format marker and the per-entry values survive the write.
    assert_eq!(written["format"], json!("tix-time"));
    assert_eq!(written["version"], json!(1));
    let alpha = read_back
        .issues
        .iter()
        .find(|issue| issue.number == 1)
        .expect("issue #1 is a row");
    let ids: Vec<&str> = alpha
        .entries
        .iter()
        .map(|entry| entry.id.as_str())
        .collect();
    // Display order, data-model §6: dated entries oldest first, undated last.
    assert_eq!(ids, vec!["e-a1", "e-a0", "e-a2"]);

    // Round trip: re-serializing what was read yields the same bytes (canonical JSON),
    // so a document that did not change gains no diff.
    let again = PortableTimeDocument::from_json(&read_back.to_json_pretty().unwrap()).unwrap();
    assert_eq!(again.to_json().unwrap(), read_back.to_json().unwrap());
}

// ===========================================================================
// T042 — NFR-001, measured structurally
// ===========================================================================

/// One in-memory issue carrying `count` entries, as markdown.
///
/// Built in memory and parsed in memory: NFR-001 is a claim about the **calculation**
/// excluding file I/O, so nothing here writes or reads a file.
fn memory_issue(number: u32, count: usize) -> String {
    let mut items = String::new();
    for index in 0..count {
        items.push_str(&format!(
            "- id: e-{number}-{index}\n  duration_minutes: 7\n  author: \"ada\"\n"
        ));
    }
    format!(
        "---\nnumber: {number}\ntitle: \"Issue {number}\"\nstatus: \"todo\"\nlabels: []\n\
         priority: \"medium\"\ncreated: \"2026-01-01\"\nupdated: \"2026-01-01\"\n\
         time_entries:\n{items}---\n\nBody.\n"
    )
}

/// NFR-001: a total over 10,000 entries is a linear pass, with a doubling control.
///
/// The suite's wall-clock budgets are load-sensitive, so the elapsed time is
/// **printed and never asserted**. What is asserted is the work done: the snapshot's
/// own counters (how many entries it indexed, how many the total counted) hold the
/// whole input, and doubling the input doubles them. A test that only slept and
/// printed could not fail; this one fails if the aggregation drops, dedups or
/// short-circuits entries, which is the property NFR-001 is a budget for.
#[test]
fn nfr001_totals_over_ten_thousand_entries_are_structural_and_linear() {
    fn run(issue_count: u32, per_issue: usize) -> (TimeSnapshot, TimeTotal, Duration) {
        let issues: Vec<Issue> = (1..=issue_count)
            .map(|number| {
                Issue::parse(&memory_issue(number, per_issue)).expect("the in-memory issue parses")
            })
            .collect();
        let snapshot = TimeSnapshot::of(&issues);
        let started = Instant::now();
        let total = snapshot.total(&TimeFilter::new());
        (snapshot, total, started.elapsed())
    }

    let (small, small_total, small_elapsed) = run(200, 50);
    assert_eq!(
        small.entries().len(),
        10_000,
        "the snapshot indexed every entry"
    );
    assert_eq!(
        small_total.entry_count, 10_000,
        "the total counted every entry"
    );
    assert_eq!(small_total.total_minutes, Some(70_000));
    assert_eq!(small_total.malformed_count, 0);
    println!(
        "NFR-001: 10,000 entries aggregated in {small_elapsed:?} (excluded: file I/O; not asserted)"
    );

    // The doubling control: twice the entries is twice the work and twice the sum —
    // the counters move with the input, so they are evidence about it.
    let (large, large_total, large_elapsed) = run(400, 50);
    assert_eq!(large.entries().len(), 20_000);
    assert_eq!(large_total.entry_count, small_total.entry_count * 2);
    assert_eq!(
        large_total.total_minutes,
        small_total.total_minutes.map(|minutes| minutes * 2)
    );
    println!(
        "NFR-001: 20,000 entries aggregated in {large_elapsed:?} (doubling control; not asserted)"
    );
}

// ===========================================================================
// C-001 / C-008 — reads write nothing, and no operation changes issue semantics
// ===========================================================================

/// C-001 / C-008: every read verb and the portable export write nothing, and a
/// mutation touches the one issue it names and no other.
#[test]
fn c001_c008_reads_write_nothing_and_a_mutation_touches_one_issue() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();
    let before = tree(dir);

    for args in [
        &["time", "show", "1"][..],
        &["time", "history", "1"][..],
        &["time", "total"][..],
        &["time", "total", "--by", "issue"][..],
        &["time", "total", "--by", "assignee"][..],
        &["time", "total", "--by", "date"][..],
        &["time", "total", "--audit"][..],
        &["export", "--target", "time"][..],
    ] {
        let _ = ok(dir, args);
        assert_eq!(tree(dir), before, "`tix {args:?}` wrote something");
    }
    // Positive control: a mutation *does* move the tree, so the assertion above is
    // sensitive to a write.
    ok(
        dir,
        &["time", "add", "2", "--minutes", "10", "--author", "bob"],
    );
    assert_ne!(tree(dir), before, "a mutation must change the tree");

    // ...and it changed only issue #2: #1, #3 and #4 are byte-identical.
    let after = tree(dir);
    for number in [1, 3, 4] {
        let file = issue_filename(number);
        assert_eq!(after[&file], before[&file], "issue #{number} is untouched");
    }
    assert_ne!(after[&issue_filename(2)], before[&issue_filename(2)]);
}

/// C-001: an invalid scope is a refusal, not a `-` total, and it writes nothing.
#[test]
fn c001_an_invalid_scope_is_refused_and_writes_nothing() {
    let (_tmp, dir) = fixture();
    let dir = dir.as_path();
    let before = tree(dir);

    let (code, stdout, stderr) = refused(dir, &["time", "total", "--from", "not-a-date"]);
    assert_ne!(code, 0);
    assert!(stderr.contains("invalid_date"), "{stderr}");
    assert!(stderr.contains("help:"), "{stderr}");
    assert!(!stdout.contains("total_minutes"), "{stdout}");
    assert_eq!(tree(dir), before);
}