package provision

import (
	"fmt"
	"go/ast"
	"go/parser"
	"go/token"
	"go/types"
	"io/fs"
	"os"
	"path/filepath"
	"sort"
	"strings"
	"sync"
	"testing"

	"golang.org/x/tools/go/packages"
)

type inputFamily struct {
	Owner                                     string
	Hostile, Rename, Erasure, Retry, Positive string
}

// Mixed declarations retain every protected effect: their family is the sorted
// product of these named A-G families, never the first matching owner alone.
// Empty witness slots are explicit acceptance gaps and fail coverage.
var inputFamilies = map[string]inputFamily{
	"A":  {"A", "TestPlan14HostileOwnership", "TestPlan14RenameKeepsDescriptor", "TestPlan14RemoveCapability", "TestPlan14DescendRetriesEveryAncestorSync", "TestPlan14AuthorityFilePrivateAncestors"},
	"B":  {"B", "TestPlan14ForgedHealthyCannotAdmit", "TestPlan14ForgedHealthyCannotAdmit", "TestPlan14HealthyErasureRequiresProof", "TestPlan14HealthyDuplicateRetryDurability", "TestPlan14ForgedHealthyCannotAdmit"},
	"B2": {"B", "TestPlan14ForgedHealthyCannotBind", "TestPlan14ForgedHealthyCannotBind", "TestPlan14HealthyErasureRequiresProof", "TestPlan14HealthyDuplicateRetryDurability", "TestPlan14ForgedHealthyCannotAdmit"},
	"B3": {"B", "TestPlan14ProofBindingProvenance", "TestPlan14ProofBindingProvenance", "TestPlan14ProofBindingProvenance", "TestPlan14HealthyDuplicateRetryDurability", "TestPlan14AdoptionCanonicalReadiness"},
	"B4": {"B", "TestPlan14ForgedHealthyCannotAdmit", "TestPlan14ForgedHealthyCannotAdmit", "TestPlan14HealthyErasureRequiresProof", "TestPlan14HealthyDuplicateRetryDurability", "TestPlan14HealthyDuplicateRetryDurability"},
	"C":  {"C", "TestPlan14RootFences", "TestPlan14RootFences", "TestPlan14RootFences", "TestPlan14InventoryProcessCrash", "TestPlan14HeldRevalidatesCanonicalBindingUnderGuard"},
	"D":  {"D", "TestPlan14ExecutionHostileCensusRootRunner", "TestPlan14ExecutionServingRequiresRootSettlement", "TestPlan14ExecutionUpdateExclusion", "TestPlan14ExecutionRecoveryAfterProcessCrash", "TestPlan14ExecutionProductionSettlement"},
	"E1": {"E", "TestPlan14RootHistoryProductionPass", "TestPlan14RootHistoryLegacyTampering", "TestPlan14RootHistoryLegacyTampering", "TestPlan14HistoryRetirementProcessCrash", "TestPlan14RootHistoryProductionPass"},
	"E2": {"E", "TestPlan14GenerationPrivateJournalRootRunner", "TestPlan14GenerationPayloadPhysicalRootRunner", "TestPlan14GenerationDeletionCannotUnpin", "TestPlan14GenerationCompletenessDurability", "TestPlan14GenerationInstalledUnitRootRunner"},
	"E3": {"E", "TestPlan14SwapFailureHostileRootRunner", "TestPlan14SwapFailureSurvivesLegacyTampering", "TestPlan14SwapFailureSurvivesLegacyTampering", "TestPlan14SwapFailureHostileRootRunner", "TestPlan14SwapFailureVerifiedRetry"},
	"F":  {"F", "TestPlan14RootFloorCrashOrderingRootRunner", "TestPlan14FloorRiseWithoutPlatformUpdateRootRunner", "TestPlan14RootFloorPublicDenySurvivesPrivateLoss", "TestPlan14RootFloorSyscallCrashOrdering", "TestPlan14RootFloorBootSelectors"},
	"G":  {"G", "TestPlan14RootMigrationHistoricEvidence", "TestPlan14RootMigrationHistoricRootRunner", "TestPlan14RootMigrationHistoricRootRunner", "TestPlan14RootMigrationCrashResume", "TestPlan14RootMigrationBootstrapRootRunner"},
}

func inputFamilyFor(e classifiedRootRead) ([]string, error) {
	var names []string
	seen := map[string]bool{}
	for _, owner := range strings.Split(e.Task, ",") {
		if owner == "J1" || owner == "J2" || owner == "J3" || owner == "J4" || owner == "E4" {
			continue
		}
		family, ok := inputFamilies[owner]
		if !ok {
			return nil, fmt.Errorf("unknown family %q", owner)
		}
		if len(family.Owner) != 1 || family.Owner[0] < 'A' || family.Owner[0] > 'G' {
			return nil, fmt.Errorf("family %s has no A-G owner", owner)
		}
		if !seen[owner] {
			names = append(names, owner)
			seen[owner] = true
		}
	}
	if len(names) == 0 {
		return nil, fmt.Errorf("no A-G family")
	}
	sort.Strings(names)
	return names, nil
}

func inputInventory(t *testing.T) rootReadInventory {
	t.Helper()
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}, Coverage: map[string]string{}}
	// Use the very same ordered overlay list as the legacy-seal test.
	f, err := parser.ParseFile(token.NewFileSet(), "plan14_p3_census_test.go", nil, 0)
	if err != nil {
		t.Fatal(err)
	}
	var paths []string
	ast.Inspect(f, func(n ast.Node) bool {
		if s, ok := n.(*ast.BasicLit); ok && s.Kind == token.STRING {
			name := strings.Trim(s.Value, "\"")
			if strings.HasPrefix(name, "plan14-root-reads") && strings.HasSuffix(name, ".tsv") && !strings.Contains(name, "/") {
				paths = append(paths, name)
			}
		}
		return true
	})
	seen := map[string]bool{}
	for _, name := range paths {
		if seen[name] {
			continue
		}
		seen[name] = true
		if err := loadRootReadInventory(filepath.Join("testdata", name), &inv, len(seen) > 1); err != nil {
			t.Fatal(err)
		}
	}
	if len(seen) < 21 {
		t.Fatal("missing production overlays")
	}
	return inv
}

func inputTests(root string) (map[string]bool, error) {
	out := map[string]bool{}
	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
		if err != nil {
			return err
		}
		if d.IsDir() && path != root && (strings.HasPrefix(d.Name(), ".") || d.Name() == "testdata") {
			return filepath.SkipDir
		}
		if d.IsDir() || !strings.HasSuffix(path, "_test.go") {
			return nil
		}
		f, err := parser.ParseFile(token.NewFileSet(), path, nil, 0)
		if err != nil {
			return err
		}
		for _, d := range f.Decls {
			if fn, ok := d.(*ast.FuncDecl); ok && fn.Recv == nil && strings.HasPrefix(fn.Name.Name, "Test") && fn.Type.Params.NumFields() == 1 {
				out[fn.Name.Name] = true
			}
		}
		return nil
	})
	return out, err
}

// This is a conservative, typed production call/reference graph. Function values
// count as possible calls; interface dispatch includes only implementing methods.
// Type/var declarations use references (not imaginary calls). Tests never enter
// the graph. Every accepted row records its reachable immediate predecessor.
func inputCallers(root string) (map[string]string, error) {
	// Each platform's load type-checks the whole module (most of this
	// test's time), and the three are independent, so they run side by
	// side. The merge below still takes them in this fixed order, so a key
	// reached on several platforms records the same caller as before.
	platforms := []string{"linux", "darwin", "windows"}
	loaded := make([]map[string]string, len(platforms))
	errs := make([]error, len(platforms))
	var wg sync.WaitGroup
	for i, platform := range platforms {
		wg.Go(func() { loaded[i], errs[i] = inputPlatformCallers(root, platform) })
	}
	wg.Wait()
	out := map[string]string{}
	for i, platform := range platforms {
		callers, err := loaded[i], errs[i]
		if err != nil {
			return nil, err
		}
		for key, caller := range callers {
			if out[key] == "" {
				out[key] = platform + ":" + caller
			}
		}
	}
	return out, nil
}
func inputPlatformCallers(root, platform string) (map[string]string, error) {
	cfg := &packages.Config{Dir: root, Mode: packages.NeedName | packages.NeedFiles | packages.NeedCompiledGoFiles | packages.NeedSyntax | packages.NeedTypes | packages.NeedTypesInfo | packages.NeedImports, Env: append(os.Environ(), "GOOS="+platform, "GOARCH=amd64", "CGO_ENABLED=0")}
	pkgs, err := packages.Load(cfg, "./...")
	if err != nil {
		return nil, err
	}
	if packages.PrintErrors(pkgs) > 0 {
		return nil, fmt.Errorf("production package loading failed")
	}
	type decl struct {
		key  string
		node ast.Node
		pkg  *packages.Package
	}
	var decls []decl
	objects := map[types.Object]string{}
	methods := map[string][]*types.Func{}
	graph := map[string]map[string]bool{}
	add := func(a, b string) {
		if a == "" || b == "" || a == b {
			return
		}
		if graph[a] == nil {
			graph[a] = map[string]bool{}
		}
		graph[a][b] = true
	}
	for _, p := range pkgs {
		for _, f := range p.Syntax {
			file, _ := filepath.Rel(root, p.Fset.Position(f.Pos()).Filename)
			file = filepath.ToSlash(file)
			grouped := map[token.Token]int{}
			for _, d := range f.Decls {
				name := ""
				var defs []types.Object
				switch d := d.(type) {
				case *ast.FuncDecl:
					name = d.Name.Name
					if obj, ok := p.TypesInfo.Defs[d.Name].(*types.Func); ok {
						defs = append(defs, obj)
						sig := obj.Type().(*types.Signature)
						if sig.Recv() != nil {
							r := sig.Recv().Type()
							if ptr, ok := r.(*types.Pointer); ok {
								r = ptr.Elem()
							}
							if n, ok := r.(*types.Named); ok {
								name = n.Obj().Name() + "." + name
							}
							methods[obj.Name()] = append(methods[obj.Name()], obj)
						}
					}
				case *ast.GenDecl:
					if d.Tok == token.IMPORT {
						continue
					}
					if d.Lparen.IsValid() {
						grouped[d.Tok]++
						name = fmt.Sprintf("%s#%d", d.Tok, grouped[d.Tok])
					} else {
						switch s := d.Specs[0].(type) {
						case *ast.TypeSpec:
							name = "type " + s.Name.Name
						case *ast.ValueSpec:
							name = d.Tok.String() + " " + s.Names[0].Name
						}
					}
					ast.Inspect(d, func(n ast.Node) bool {
						if id, ok := n.(*ast.Ident); ok {
							if obj := p.TypesInfo.Defs[id]; obj != nil {
								defs = append(defs, obj)
							}
						}
						return true
					})
				}
				if name == "" {
					continue
				}
				key := file + ":" + name
				decls = append(decls, decl{key, d, p})
				for _, obj := range defs {
					objects[obj] = key
				}
			}
		}
	}
	for _, d := range decls {
		ast.Inspect(d.node, func(n ast.Node) bool {
			if call, ok := n.(*ast.CallExpr); ok && len(call.Args) == 2 {
				if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
					obj := d.pkg.TypesInfo.Uses[sel.Sel]
					if obj != nil && obj.Pkg() != nil && obj.Pkg().Path() == "encoding/json" && obj.Name() == "Unmarshal" {
						for _, method := range inputJSONMethods(d.pkg.TypesInfo.TypeOf(call.Args[1]), map[types.Type]bool{}) {
							add(d.key, objects[method])
						}
					}
				}
			}
			if id, ok := n.(*ast.Ident); ok {
				add(d.key, objects[d.pkg.TypesInfo.Uses[id]])
			}
			if s, ok := n.(*ast.SelectorExpr); ok {
				if sel := d.pkg.TypesInfo.Selections[s]; sel != nil {
					if iface, ok := sel.Recv().Underlying().(*types.Interface); ok {
						if method, ok := sel.Obj().(*types.Func); ok {
							for _, candidate := range methods[method.Name()] {
								sig := candidate.Type().(*types.Signature)
								if types.Implements(sig.Recv().Type(), iface) || types.Implements(types.NewPointer(sig.Recv().Type()), iface) {
									add(d.key, objects[candidate])
								}
							}
						}
					}
				}
			}
			return true
		})
		// The embedded unit is an input to the reachable installer declaration.
		if gd, ok := d.node.(*ast.GenDecl); ok && gd.Doc != nil {
			for _, c := range gd.Doc.List {
				if strings.HasPrefix(c.Text, "//go:embed ") {
					for _, pattern := range strings.Fields(strings.TrimPrefix(c.Text, "//go:embed ")) {
						matches, _ := filepath.Glob(filepath.Join(root, filepath.Dir(strings.Split(d.key, ":")[0]), pattern))
						for _, path := range matches {
							rel, _ := filepath.Rel(root, path)
							add(d.key, filepath.ToSlash(rel)+":external")
						}
					}
				}
			}
		}
	}
	// The console is a separate shipped executable. Its floor admission and
	// control-store writers were explicitly classified as authority; they do
	// not become unreachable because they are outside the carlos binary.
	reached := map[string]string{"main.go:main": "root CLI entrypoint", "cmd/console/main.go:main": "console service entrypoint"}
	queue := []string{"main.go:main", "cmd/console/main.go:main"}
	for len(queue) > 0 {
		from := queue[0]
		queue = queue[1:]
		var next []string
		for to := range graph[from] {
			next = append(next, to)
		}
		sort.Strings(next)
		for _, to := range next {
			if _, ok := reached[to]; !ok {
				reached[to] = from
				queue = append(queue, to)
			}
		}
	}
	return reached, nil
}

// encoding/json invokes these typed callbacks through reflection, outside the
// repository call graph. Follow only types passed to actual Unmarshal calls.
func inputJSONMethods(typ types.Type, seen map[types.Type]bool) []types.Object {
	if typ == nil || seen[typ] {
		return nil
	}
	seen[typ] = true
	var out []types.Object
	for _, receiver := range []types.Type{typ, types.NewPointer(typ)} {
		methods := types.NewMethodSet(receiver)
		for i := 0; i < methods.Len(); i++ {
			m := methods.At(i).Obj()
			if m.Name() == "UnmarshalJSON" {
				out = append(out, m)
			}
		}
	}
	switch t := typ.(type) {
	case *types.Named:
		out = append(out, inputJSONMethods(t.Underlying(), seen)...)
	case *types.Alias:
		out = append(out, inputJSONMethods(types.Unalias(t), seen)...)
	case *types.Pointer:
		out = append(out, inputJSONMethods(t.Elem(), seen)...)
	case *types.Slice:
		out = append(out, inputJSONMethods(t.Elem(), seen)...)
	case *types.Array:
		out = append(out, inputJSONMethods(t.Elem(), seen)...)
	case *types.Map:
		out = append(out, inputJSONMethods(t.Elem(), seen)...)
	case *types.Struct:
		for i := 0; i < t.NumFields(); i++ {
			out = append(out, inputJSONMethods(t.Field(i).Type(), seen)...)
		}
	}
	return out
}

type inputExemption struct {
	Ruling  string
	Pending string
}

var inputExemptions = map[string]inputExemption{
	"internal/host/claimservingpark_other.go:newServingParkFS":                               {Ruling: "activation-scope-2026-10-16; run12: non-Linux refusal-only seed backend; production constructor refuses before allocation"},
	"internal/host/claimservingpark_other.go:servingParkFS.Capture":                          {Ruling: "activation-scope-2026-10-16; run12: non-Linux refusal-only seed backend; production constructor refuses before allocation"},
	"internal/host/claimservingpark_other.go:servingParkFS.CheckParked":                      {Ruling: "activation-scope-2026-10-16; run12: non-Linux refusal-only seed backend; production constructor refuses before allocation"},
	"internal/host/claimservingpark_other.go:servingParkFS.Delete":                           {Ruling: "activation-scope-2026-10-16; run12: non-Linux refusal-only seed backend; production constructor refuses before allocation"},
	"internal/host/claimservingpark_other.go:servingParkFS.Move":                             {Ruling: "activation-scope-2026-10-16; run12: non-Linux refusal-only seed backend; production constructor refuses before allocation"},
	"internal/host/claimservingpark_other.go:servingParkFS.Prepare":                          {Ruling: "activation-scope-2026-10-16; run12: non-Linux refusal-only seed backend; production constructor refuses before allocation"},
	"internal/host/claimservingreboot_prepare_linux.go:servingParkRoot.prepareServingReboot": {Ruling: "activation-scope-2026-10-16; run12: frozen standalone preparation entrypoint; production recovery uses prepareOrCommitServingReboot"},
	"internal/hostbox/servingpark_transport.go:ServingParkClient.ReplayUncertain":            {Ruling: "activation-scope-2026-10-16; run12: frozen explicit readback/replay entrypoint; enabled requests use journalSend"},
	"internal/host/rootmovesfloor.go:rootMovesFloors.reconstruct":                            {Ruling: "P3-R4.6"},
	"internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizeReconstruction":  {Ruling: "P3-R4.6"},
	"internal/host/rootmovesfloor_authorization.go:rootMovesFloors.authorizedReconstruction": {Ruling: "P3-R4.6"},
	"internal/hostclaim/relocation.go:StartRelocation":                                       {Ruling: "R-E2a"},
	"internal/hostrelocate/participant.go:Participant.Sweep":                                 {Ruling: "R-E2a"},
	"internal/hostrelocate/worker.go:Worker.Start":                                           {Ruling: "R-E2a"},
	// This inventory stops at activation-tools, so seed's row outlives the
	// deleted function; the roster-binding overlay removes it from the full
	// census and declares servingPriorBinding at the same class.
	"internal/host/claimservinghandover.go:servingPriorRevision": {Ruling: "census-ruling-roster-binding: deleted, renamed servingPriorBinding (equality on the box binding), which takes over all its callers"},
}

// Update this checkpoint status when merging E's completion report. The 4a
// exemption must be removed before either Part 2 or Part 3 lands.
var inputTrackEComplete = map[string]bool{"4a": false}

func checkInputExemptions(inv rootReadInventory, callers map[string]string, exemptions map[string]inputExemption, completed map[string]bool) []string {
	var failures []string
	for key, ex := range exemptions {
		e, exists := inv.Entries[key]
		if !exists || e.Class != "authority" || inv.Removed[key] != "" {
			failures = append(failures, key+": exemption has no authority declaration")
		}
		if ex.Ruling == "" {
			failures = append(failures, key+": exemption has no ruling")
		}
		if callers[key] != "" {
			failures = append(failures, key+": exempt unit now has a production caller; remove exemption and supply coverage")
		}
		if ex.Pending != "" && completed[ex.Pending] {
			failures = append(failures, key+": temporary exemption survived completed track E item "+ex.Pending)
		}
	}
	return failures
}

func inputActivationEnabled(e classifiedRootRead) bool {
	if inputExemptions[e.File+":"+e.Unit].Ruling != "" {
		return true
	}
	for _, prefix := range []string{
		"internal/hostrelocate/", "internal/hostclaim/relocat",
		"internal/host/relocation", "internal/activator/worker",
	} {
		if strings.HasPrefix(e.File, prefix) {
			return false
		}
	}
	for _, owner := range strings.Split(e.Task, ",") {
		if owner != "E4" && owner != "J1" && owner != "J2" && owner != "J3" && owner != "J4" {
			return true
		}
	}
	return false
}

func checkInputRow(e classifiedRootRead, callers map[string]string, tests map[string]bool) []string {
	if e.Class != "authority" || !inputActivationEnabled(e) {
		return nil
	}
	key := e.File + ":" + e.Unit
	families, err := inputFamilyFor(e)
	if err != nil {
		return []string{key + ": " + err.Error()}
	}
	var failures []string
	if callers[key] == "" && inputExemptions[key].Ruling == "" {
		failures = append(failures, key+": no production caller reachable from root entrypoint")
	}
	for _, name := range families {
		f := inputFamilies[name]
		for slot, test := range []string{f.Hostile, f.Rename, f.Erasure, f.Retry, f.Positive} {
			if test == "" || !tests[test] {
				failures = append(failures, "family "+name+" missing "+[]string{"hostile", "rename", "erasure", "retry", "positive"}[slot]+" fixture "+test)
			}
		}
	}
	return failures
}

func TestPlan14RootInputInventoryCoverage(t *testing.T) {
	// Reads the source tree and read-only package maps only, and spends
	// most of its time type-checking the module, so it runs in parallel
	// rather than holding up the package's serial tests.
	t.Parallel()
	root := censusRoot(t)
	inv := inputInventory(t)
	tests, err := inputTests(root)
	if err != nil {
		t.Fatal(err)
	}
	callers, err := inputCallers(root)
	if err != nil {
		t.Fatal(err)
	}
	failures := checkInputExemptions(inv, callers, inputExemptions, inputTrackEComplete)
	var report []string
	for key, e := range inv.Entries {
		if inv.Removed[key] != "" {
			continue
		}
		failures = append(failures, checkInputRow(e, callers, tests)...)
		if e.Class == "authority" {
			family, familyErr := inputFamilyFor(e)
			if familyErr != nil {
				family = []string{e.Task}
			}
			mode := "enabled"
			if !inputActivationEnabled(e) {
				mode = "report-only"
			}
			report = append(report, fmt.Sprintf("%s\t%s\t%s\t%s\t%s\t%s", mode, e.File, e.Unit, strings.Join(family, "+"), callers[e.File+":"+e.Unit], e.Basis))
		}
	}
	sort.Strings(report)
	for _, row := range report {
		t.Log("J4\t" + row)
	}
	path := os.Getenv("PLAN14_J4_REPORT")
	if path == "" {
		path = filepath.Join(t.TempDir(), "plan14-root-input-report.tsv")
	}
	if err := os.WriteFile(path, []byte("scope\tfile\tunit\tfamily\tcaller\tbasis\n"+strings.Join(report, "\n")+"\n"), 0600); err != nil {
		t.Fatal(err)
	}
	t.Logf("J4 report: %s", path)
	sort.Strings(failures)
	last := ""
	for _, failure := range failures {
		if failure != last {
			t.Error(failure)
			last = failure
		}
	}
	t.Logf("authority coverage: %d reachable declarations; %d failures", len(callers), len(failures))
}

func TestPlan14RootInputInventoryCoverageMutations(t *testing.T) {
	e := classifiedRootRead{rootReadEntry: rootReadEntry{File: "root.go", Unit: "effect"}, Class: "authority", Task: "A,J4"}
	callers := map[string]string{"root.go:effect": "main.go:main"}
	tests := map[string]bool{}
	for _, f := range inputFamilies {
		for _, name := range []string{f.Hostile, f.Rename, f.Erasure, f.Retry, f.Positive} {
			tests[name] = true
		}
	}
	if errors := checkInputRow(e, callers, tests); len(errors) != 0 {
		t.Fatal(errors)
	}
	delete(tests, inputFamilies["A"].Positive)
	if len(checkInputRow(e, callers, tests)) == 0 {
		t.Fatal("removed fixture accepted")
	}
	tests[inputFamilies["A"].Positive] = true
	e.Task = "unknown"
	if len(checkInputRow(e, callers, tests)) == 0 {
		t.Fatal("unknown family accepted")
	}
	e.Task = "A"
	delete(callers, "root.go:effect")
	if len(checkInputRow(e, callers, tests)) == 0 {
		t.Fatal("orphan accepted")
	}
	e.Class = "legacy"
	if len(checkInputRow(e, callers, tests)) != 0 {
		t.Fatal("legacy entered J4")
	}
}

func TestPlan14RootInputExemptions(t *testing.T) {
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{}}
	for key := range inputExemptions {
		inv.Entries[key] = classifiedRootRead{Class: "authority"}
	}
	tests := map[string]bool{}
	for _, name := range []string{inputFamilies["A"].Hostile, inputFamilies["A"].Rename, inputFamilies["A"].Erasure, inputFamilies["A"].Retry, inputFamilies["A"].Positive} {
		tests[name] = true
	}
	for key := range inputExemptions {
		parts := strings.SplitN(key, ":", 2)
		row := classifiedRootRead{rootReadEntry: rootReadEntry{File: parts[0], Unit: parts[1]}, Class: "authority", Task: "A"}
		if errs := checkInputRow(row, nil, tests); len(errs) != 0 {
			t.Fatal("callerless exemption refused", errs)
		}
		if len(checkInputRow(row, nil, nil)) == 0 {
			t.Fatal("exemption waived family fixtures")
		}
	}
	callers := map[string]string{}
	if errs := checkInputExemptions(inv, callers, inputExemptions, nil); len(errs) != 0 {
		t.Fatal(errs)
	}
	for key := range inputExemptions {
		t.Run(key, func(t *testing.T) {
			callers[key] = "main.go:main"
			if len(checkInputExemptions(inv, callers, inputExemptions, nil)) == 0 {
				t.Fatal("production wiring escaped exemption guard")
			}
			delete(callers, key)
			e := inv.Entries[key]
			delete(inv.Entries, key)
			if len(checkInputExemptions(inv, callers, inputExemptions, nil)) == 0 {
				t.Fatal("stale exemption accepted")
			}
			inv.Entries[key] = e
		})
	}
	pending := map[string]inputExemption{"internal/host/claimunit_binding_source.go:readClaimUnitShapes": {Ruling: "pending track E item 4a", Pending: "4a"}}
	if len(checkInputExemptions(inv, callers, pending, map[string]bool{"4a": true})) == 0 {
		t.Fatal("completed E4a accepted temporary exemption")
	}
	if len(checkInputExemptions(inv, callers, map[string]inputExemption{"unknown": {}}, nil)) == 0 {
		t.Fatal("unruled exemption accepted")
	}
}

func TestPlan14RootInputExemptionGraphMutation(t *testing.T) {
	root := t.TempDir()
	write := func(name, body string) {
		t.Helper()
		path := filepath.Join(root, name)
		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(path, []byte(body), 0600); err != nil {
			t.Fatal(err)
		}
	}
	write("go.mod", "module fixture/root\n\ngo 1.24\n")
	write("main.go", "package main\nfunc main(){}\n")
	write("internal/hostclaim/relocation.go", "package hostclaim\nfunc StartRelocation(){}\n")
	key := "internal/hostclaim/relocation.go:StartRelocation"
	inv := rootReadInventory{Entries: map[string]classifiedRootRead{key: {Class: "authority"}}}
	exemptions := map[string]inputExemption{key: inputExemptions[key]}
	callers, err := inputCallers(root)
	if err != nil {
		t.Fatal(err)
	}
	if errs := checkInputExemptions(inv, callers, exemptions, nil); len(errs) != 0 {
		t.Fatal(errs)
	}
	write("main.go", "package main\nimport \"fixture/root/internal/hostclaim\"\nfunc main(){hostclaim.StartRelocation()}\n")
	callers, err = inputCallers(root)
	if err != nil {
		t.Fatal(err)
	}
	if callers[key] == "" || len(checkInputExemptions(inv, callers, exemptions, nil)) == 0 {
		t.Fatal("production relocation wiring escaped the exemption")
	}
}

func TestPlan14ActivationInventoryScope(t *testing.T) {
	e := classifiedRootRead{rootReadEntry: rootReadEntry{File: "root.go", Unit: "effect"}, Class: "authority", Task: "E4,J4"}
	if inputActivationEnabled(e) || len(checkInputRow(e, nil, nil)) != 0 {
		t.Fatal("dropped E4 slots enforced")
	}
	for _, owner := range []string{"A", "B", "B2", "B3", "B4", "C", "D", "E1", "E2", "E3", "F", "G"} {
		e.Task = owner + ",E4,J4"
		if !inputActivationEnabled(e) || len(checkInputRow(e, nil, nil)) == 0 {
			t.Fatal("enabled mixed family waived", owner)
		}
		f := inputFamilies[owner]
		for _, absent := range []string{f.Hostile, f.Rename, f.Erasure, f.Retry, f.Positive} {
			tests := map[string]bool{}
			for _, name := range []string{f.Hostile, f.Rename, f.Erasure, f.Retry, f.Positive} {
				tests[name] = true
			}
			delete(tests, absent)
			if len(checkInputRow(e, map[string]string{"root.go:effect": "main.go:main"}, tests)) == 0 {
				t.Fatal("missing enabled fixture accepted", owner, absent)
			}
		}
	}
	e.File, e.Unit, e.Task = "internal/hostrelocate/worker.go", "Worker.disabled", "unknown"
	if inputActivationEnabled(e) || len(checkInputRow(e, nil, nil)) != 0 {
		t.Fatal("frozen family enforced")
	}
	e.Unit, e.Task = "Worker.Start", "C,D"
	if !inputActivationEnabled(e) || len(checkInputRow(e, nil, nil)) == 0 {
		t.Fatal("exemption escaped scope")
	}
}