#!/usr/bin/env bash
# Phase 11 fail-closed gate (jobs, scheduler, realtime, push and search:
# JOBS-01, CLI-04, CLI-06, RT-01, RT-02, RT-03, SRCH-01).
#
# Every stage exits non-zero on a failing command, a go test run that fails,
# skips, matches zero tests or prints "no tests to run", a named test that
# did not pass, a hygiene violation or an evidence gap. The only accepted
# skips are the two broadcast goldens that Phase 12 turns into assertions,
# and they must skip with their pending text. --self-test proves the
# detector, each hygiene rule and the removal harness fail closed.
#
# --removal is the anchor-exact mutation harness behind the RC rows of
# 11-SECURITY-REVIEW.md: it removes one protection at a time, requires its
# named test to fail on an assertion, and restores the file byte for byte.
# It edits tracked source while it runs, so it is not part of --all.
#
# Allow-list: KNOWN_APP_FAILURES names accepted fonoteka.go failures as
# "package:Test" with a reason; it is empty.
set -euo pipefail

ROOT="${PHASE11_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
APP="${PHASE11_APP:-$(cd "$ROOT/../fonoteka.go" && pwd)}"
PHASE_DIR="$ROOT/.planning/phases/11-jobs-realtime-and-search-infrastructure"
REVIEW="$PHASE_DIR/11-SECURITY-REVIEW.md"
VALIDATION="$PHASE_DIR/11-VALIDATION.md"
APP_PLUGINS=(./plugins/golem15/fonoteka/... ./plugins/golem15/user/...)
KNOWN_APP_FAILURES=""
# The broadcast goldens recorded from PHP but asserted only in Phase 12.
GOLDEN_SKIPS="TestBroadcastGoldens/created TestBroadcastGoldens/updated"
GOLDEN_SKIP_TEXT="pending: Phase 12"
RIVER_VERSION="v0.47.0"

usage() {
	cat >&2 <<'EOF'
usage:
  check-phase11.sh --self-test
  check-phase11.sh --hygiene
  check-phase11.sh --go
  check-phase11.sh --postgres
  check-phase11.sh --named
  check-phase11.sh --evidence
  check-phase11.sh --removal
  check-phase11.sh --all
EOF
	exit 2
}

# phase11_detect reads go test -json. Exit 1 fail, 2 skip, 3 zero tests or
# "no tests to run", 4 non-JSON, 5 a required test did not pass, 6 an
# allow-listed failure now passes, 7 an expected skip did not skip with its
# pending text. PHASE11_REQUIRE lists tests that must pass; PHASE11_ALLOW
# lists accepted "package:Test" failures; PHASE11_EXPECT_SKIP lists tests
# that must skip with PHASE11_SKIP_TEXT in their output.
phase11_detect() {
	python3 - "$1" <<'PY'
import json, os, sys
path = sys.argv[1]
allow = set(os.environ.get("PHASE11_ALLOW", "").split())
require = set(os.environ.get("PHASE11_REQUIRE", "").split())
expect_skip = set(os.environ.get("PHASE11_EXPECT_SKIP", "").split())
skip_text = os.environ.get("PHASE11_SKIP_TEXT", "")
passed, skipped = set(), set()
output = {}
failed_tests, failed_pkgs = {}, []
build_failed = False
with open(path, encoding="utf-8", errors="replace") as fh:
    for raw in fh:
        line = raw.strip()
        if not line.startswith("{"):
            continue
        try:
            ev = json.loads(line)
        except json.JSONDecodeError:
            print("refuse: non-json test output", file=sys.stderr)
            sys.exit(4)
        action = ev.get("Action")
        test = ev.get("Test") or ""
        pkg = ev.get("Package") or ""
        if action == "build-fail":
            build_failed = True
        if action == "output":
            text = ev.get("Output") or ""
            if "no tests to run" in text:
                print(f"refuse: no tests to run in {pkg}", file=sys.stderr)
                sys.exit(3)
            if test:
                output.setdefault(test, []).append(text)
        if action == "skip" and test:
            if test not in expect_skip:
                print(f"refuse: skipped {pkg} {test}", file=sys.stderr)
                sys.exit(2)
            skipped.add(test)
        if action == "fail":
            if ev.get("FailedBuild"):
                build_failed = True
            if test:
                failed_tests.setdefault(pkg, []).append(test)
            else:
                failed_pkgs.append(pkg)
        if action == "pass" and test:
            passed.add(test)
            if f"{pkg}:{test}" in allow:
                print(f"refuse: allow-listed failure {pkg} {test} now passes; remove it from the gate", file=sys.stderr)
                sys.exit(6)
if build_failed:
    print("refuse: build failed", file=sys.stderr)
    sys.exit(1)
accepted = []
for pkg, tests in failed_tests.items():
    for test in tests:
        top = test.split("/", 1)[0]
        if f"{pkg}:{top}" in allow:
            accepted.append(f"{pkg} {test}")
            continue
        print(f"refuse: failed {pkg} {test}", file=sys.stderr)
        sys.exit(1)
for pkg in failed_pkgs:
    if not failed_tests.get(pkg):
        print(f"refuse: failed {pkg or 'unknown package'}", file=sys.stderr)
        sys.exit(1)
for item in sorted(set(accepted)):
    print(f"known failure (KNOWN_APP_FAILURES): {item}", file=sys.stderr)
for name in sorted(expect_skip):
    if name in passed:
        print(f"refuse: expected skip {name} now passes; move it out of the pending list", file=sys.stderr)
        sys.exit(7)
    if name not in skipped:
        print(f"refuse: expected skip {name} did not run", file=sys.stderr)
        sys.exit(7)
    if skip_text and not any(skip_text in o for o in output.get(name, [])):
        print(f"refuse: {name} skipped without {skip_text!r}", file=sys.stderr)
        sys.exit(7)
missing = sorted(name for name in require if name not in passed)
if missing:
    print("refuse: required tests did not pass: " + ", ".join(missing), file=sys.stderr)
    sys.exit(5)
if not passed:
    print("refuse: zero tests", file=sys.stderr)
    sys.exit(3)
PY
}

# phase11_go DIR ARGS... runs go test -json -count=1 ARGS through the
# detector. The go test exit status is trusted only when no failure was
# allow-listed.
phase11_go() {
	local dir="$1"
	shift
	local log err
	log="$(mktemp)"
	err="$(mktemp)"
	set +e
	(cd "$dir" && go test -json -count=1 "$@") >"$log" 2>"$err"
	local rc=$?
	set -e
	local dc=0
	phase11_detect "$log" || dc=$?
	if [[ "$dc" -ne 0 || ("$rc" -ne 0 && -z "${PHASE11_ALLOW:-}") ]]; then
		cat "$err" >&2 || true
		tail -n 40 "$log" >&2 || true
		rm -f "$log" "$err"
		echo "refuse: go test $* in $dir (test=$rc detect=$dc)" >&2
		exit 1
	fi
	rm -f "$log" "$err"
}

# phase11_tests DIR PKG TEST... requires every named test to run and pass.
phase11_tests() {
	local dir="$1" pkg="$2"
	shift 2
	local names="$*"
	local regex="^($(tr ' ' '|' <<<"$names"))\$"
	PHASE11_REQUIRE="$names" phase11_go "$dir" "$pkg" -run "$regex"
}

expect_detect() {
	local name="$1" want="$2" payload="$3"
	local log dc=0
	log="$(mktemp)"
	printf '%s\n' "$payload" >"$log"
	phase11_detect "$log" 2>/dev/null || dc=$?
	rm -f "$log"
	if [[ "$dc" -ne "$want" ]]; then
		echo "refuse: self-test $name: detector exit $dc, want $want" >&2
		exit 1
	fi
}

# The hygiene_11 refusal reasons; the self-test checks each plant is refused
# for its own reason only.
REASON_APPNAME="application name in a Phase 11 framework file"
REASON_CLIENT="excluded client library in the module graph"
REASON_CRON="direct cron dependency in go.mod"
REASON_RIVER="River is not pinned at $RIVER_VERSION"
REASON_README="Phase 11 module without a README or a root README row"

APPNAME_RE='pl[yý]tarium|fonoteka|albumy|kolekcj|winyl|p[lł]yt[aęy]'
# The Centrifugo and Typesense Go clients and Web Push libraries (D-12,
# D-15, D-19: all hand-rolled on net/http and stdlib crypto).
CLIENT_RE='^github\.com/centrifugal/(gocent|centrifuge-go)|^github\.com/typesense/typesense-go|webpush|web-push'
CRON_RE='cron'
PHASE11_MODULES=(conga lighthouse flare beachcomber)

# phase11_files TREE: the Phase 11 framework files the application-name
# rule reads (tracked files when TREE is a git work tree).
phase11_files() {
	local tree="$1" m
	if git -C "$tree" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
		(cd "$tree" && git ls-files -- modules/conga modules/lighthouse modules/flare modules/beachcomber 'modules/tide/centrifugo*.go')
		return
	fi
	(
		cd "$tree"
		for m in "${PHASE11_MODULES[@]}"; do
			[[ -d "modules/$m" ]] && find "modules/$m" -type f
		done
		find modules/tide -maxdepth 1 -type f -name 'centrifugo*.go' 2>/dev/null
	) | sort
}

# hygiene_11 TREE MODLIST GOMOD...: the Phase 11 hygiene rules. MODLIST is
# `go list -m all` of both repositories; GOMOD are the go.mod files whose
# direct requirements are checked. Each rule returns on its first violation.
hygiene_11() {
	local tree="$1" modlist="$2"
	shift 2
	local hits file m
	# Framework modules never name the application (CLAUDE.md).
	while IFS= read -r file; do
		[[ -n "$file" ]] || continue
		hits="$(grep -niE "$APPNAME_RE" "$tree/$file" | head -n1 || true)"
		if [[ -n "$hits" ]]; then
			echo "refuse: hygiene: $REASON_APPNAME: $file: $hits" >&2
			return 1
		fi
	done < <(phase11_files "$tree")
	# No Centrifugo, Typesense or Web Push client library (T-11-SC).
	hits="$(grep -iE "$CLIENT_RE" "$modlist" | head -n1 || true)"
	if [[ -n "$hits" ]]; then
		echo "refuse: hygiene: $REASON_CLIENT: $hits" >&2
		return 1
	fi
	# No direct cron dependency: Daily/Every cover the cadences (11-02).
	for file in "$@"; do
		hits="$(awk '/^require[[:space:]]*\(/{inblock=1; next} inblock && /^\)/{inblock=0; next} (inblock || /^require[[:space:]]/) && !/\/\/[[:space:]]*indirect/' "$file" | grep -iE "$CRON_RE" | head -n1 || true)"
		if [[ -n "$hits" ]]; then
			echo "refuse: hygiene: $REASON_CRON: $file: $hits" >&2
			return 1
		fi
	done
	# River stays pinned at the audited version.
	hits="$(grep -E '^github\.com/riverqueue/river ' "$modlist" | sort -u || true)"
	if [[ -z "$hits" ]] || grep -vqE "^github\.com/riverqueue/river $RIVER_VERSION\$" <<<"$hits"; then
		echo "refuse: hygiene: $REASON_RIVER: ${hits:-<absent>}" >&2
		return 1
	fi
	# Every new module ships a README and a root modules-table row.
	for m in "${PHASE11_MODULES[@]}"; do
		if [[ ! -f "$tree/modules/$m/README.md" ]] || ! grep -qF "| [$m](modules/$m/README.md) |" "$tree/README.md"; then
			echo "refuse: hygiene: $REASON_README: $m" >&2
			return 1
		fi
	done
	return 0
}

module_list() {
	local out="$1"
	(cd "$ROOT" && go list -m all) >"$out"
	(cd "$APP" && go list -m all) >>"$out"
}

run_hygiene() {
	local modlist
	modlist="$(mktemp)"
	module_list "$modlist"
	local gomods=("$ROOT/go.mod" "$APP/go.mod")
	local f
	for f in "$APP"/plugins/*/*/go.mod; do
		[[ -f "$f" ]] && gomods+=("$f")
	done
	if ! hygiene_11 "$ROOT" "$modlist" "${gomods[@]}"; then
		rm -f "$modlist"
		exit 1
	fi
	rm -f "$modlist"
	echo "phase11 hygiene passed"
}

# removal_checks TABLE_MODE: the RC table, run by removal_harness.
# Fields: id, threat, repo (root|app|script), file, anchor, replacement,
# package, test regex. Anchors must occur exactly once.
removal_table() {
	cat <<'EOF'
[
 ["RC-01", "T-11-01", "root", "modules/lighthouse/centrifugo/handlers.go",
  "if cfg.ProxySecret == \"\" || subtle.ConstantTimeCompare([]byte(cfg.ProxySecret), []byte(provided)) != 1 {",
  "if subtle.ConstantTimeCompare([]byte(cfg.ProxySecret), []byte(provided)) == 2 {", "./modules/lighthouse/centrifugo", "^TestProxy$"],
 ["RC-02", "T-11-02", "root", "modules/lighthouse/channel.go",
  "if strings.HasPrefix(channel, presencePrefix+presencePrefix) {",
  "if false {", "./modules/lighthouse", "^TestParseChannel$"],
 ["RC-03", "T-11-02", "root", "modules/lighthouse/channel.go",
  "if len(parts) > 3 {",
  "if false {", "./modules/lighthouse", "^TestParseChannel$"],
 ["RC-04", "T-11-02", "app", "plugins/golem15/fonoteka/classes/ws/collection_authorizer.go",
  "\t\tWhere(\"golem15_fonoteka_collections.kind = ?\", \"collection\").\n",
  "", "./plugins/golem15/fonoteka", "^TestWsAuthorizer$"],
 ["RC-05", "T-11-05", "root", "modules/lighthouse/broadcast.go",
  "cb.Create().After(\"gorm:after_create\").Before(commitCallback).Register(",
  "cb.Create().After(\"gorm:after_create\").Register(", "./modules/lighthouse", "^TestBroadcastTx$"],
 ["RC-06", "T-11-05", "app", "plugins/golem15/fonoteka/realtime.go",
  "if c.Kind != \"collection\" {",
  "if false {", "./plugins/golem15/fonoteka", "^TestAlbumBroadcastBinding$"],
 ["RC-07", "T-11-07", "app", "plugins/golem15/fonoteka/models/album_search.go",
  "if a == nil || a.CollectionID == 0 {",
  "if a == nil {", "./plugins/golem15/fonoteka", "^TestAlbumSearchable$"],
 ["RC-08", "T-11-09", "root", "modules/conga/scheduler.go",
  "if !ok || entry.Command != a.Command || !slices.Equal(entry.Args, a.Args) {",
  "if !ok {", "./modules/conga", "^TestScheduledEntryMismatchSkipped$"],
 ["RC-09", "T-11-12", "root", "modules/conga/conga.go",
  "res, err := client.InsertTx(ctx, sqlTx, args, opts)",
  "_ = sqlTx\n\t\tres, err := client.Insert(ctx, args, opts)", "./modules/conga", "^TestDispatchTransactional$"],
 ["RC-10", "T-11-19", "root", "modules/lighthouse/route.go",
  "if len(s.UserAuth) == 0 {",
  "if false {", "./modules/lighthouse", "^TestMountSurfaces$"],
 ["RC-11", "T-11-22", "root", "modules/flare/flare.go",
  "if !HostAllowed(host, p.cfg.AllowedHosts) {",
  "if false {", "./modules/flare", "^(TestSendAllowlist|TestSendRefusesDisallowedEndpoint)$"],
 ["RC-12", "T-11-28", "app", "parity/check_corpus.go",
  "if strings.Contains(text, v) {\n\t\t\t\thits = append(hits, rel+\": centrifugo test value\")",
  "if false && strings.Contains(text, v) {\n\t\t\t\thits = append(hits, rel+\": centrifugo test value\")", "./parity", "^TestUniqueAndSecretScan$"],
 ["RC-13", "T-11-SC", "script", "scripts/check-phase11.sh",
  "hits=\"$(grep -iE \"$CLIENT_RE\" \"$modlist\" | head -n1 || true)\"",
  "hits=\"\"", "", "--self-test"]
]
EOF
}

# removal_harness TABLE_FILE: for each row, save the file, apply the
# anchor-exact mutation, run the named test (or, for the gate script, its
# --self-test on a mutated copy) and require it to fail on an assertion,
# then restore the file and require cmp to match the saved copy.
removal_harness() {
	python3 - "$1" "$ROOT" "$APP" <<'PY'
import json, os, shutil, subprocess, sys, tempfile
table = json.load(open(sys.argv[1]))
root, app = sys.argv[2], sys.argv[3]
only = set(os.environ.get("PHASE11_RC", "").split())
failures = 0
for rc, threat, repo, rel, anchor, repl, pkg, run in table:
    if only and rc not in only:
        continue
    base = {"root": root, "app": app, "script": root}[repo]
    path = os.path.join(base, rel)
    original = open(path, "rb").read()
    text = original.decode()
    n = text.count(anchor)
    if n != 1:
        print(f"refuse: {rc} {threat}: anchor occurs {n} times in {rel}", file=sys.stderr)
        sys.exit(1)
    mutated = text.replace(anchor, repl, 1)
    scratch = tempfile.mkdtemp(prefix="phase11-rc-")
    saved = os.path.join(scratch, "saved")
    shutil.copyfile(path, saved)
    try:
        if repo == "script":
            copy = os.path.join(scratch, os.path.basename(rel))
            open(copy, "w").write(mutated)
            env = dict(os.environ, PHASE11_ROOT=root, PHASE11_APP=app)
            proc = subprocess.run(["bash", copy, run], cwd=root, env=env, capture_output=True, text=True, timeout=600)
            out = proc.stdout + proc.stderr
            ok = proc.returncode != 0 and "refuse:" in out
            evidence = next((l for l in out.splitlines() if l.startswith("refuse:")), "")
        else:
            with open(path, "w") as fh:
                fh.write(mutated)
            proc = subprocess.run(["go", "test", pkg, "-run", run, "-count=1"], cwd=base, capture_output=True, text=True, timeout=900)
            out = proc.stdout + proc.stderr
            build = "[build failed]" in out or "[setup failed]" in out
            ok = proc.returncode != 0 and "--- FAIL" in out and not build
            fails = [l.strip() for l in out.splitlines() if l.strip().startswith("--- FAIL")]
            names = [l.split()[2] for l in fails if len(l.split()) > 2]
            evidence = ", ".join(names[:5]) + (f" (+{len(names) - 5} more)" if len(names) > 5 else "") if names else ("build failed" if build else "no failure")
    finally:
        with open(path, "wb") as fh:
            fh.write(original)
    same = subprocess.run(["cmp", "-s", saved, path]).returncode == 0
    shutil.rmtree(scratch, ignore_errors=True)
    if not same:
        print(f"refuse: {rc}: {rel} was not restored byte for byte", file=sys.stderr)
        sys.exit(1)
    status = "fails as required" if ok else "SURVIVED"
    print(f"{rc} {threat} {rel}: {status}: {evidence}")
    if not ok:
        failures += 1
if failures:
    print(f"refuse: {failures} removal check(s) survived", file=sys.stderr)
    sys.exit(1)
PY
}

run_removal() {
	local table
	table="$(mktemp)"
	removal_table >"$table"
	if ! removal_harness "$table"; then
		rm -f "$table"
		exit 1
	fi
	rm -f "$table"
	echo "phase11 removal passed"
}

run_self_test() {
	bash -n "${BASH_SOURCE[0]}"
	expect_detect pass 0 '{"Action":"pass","Package":"p","Test":"TestSuppression"}'
	expect_detect fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
{"Action":"fail","Package":"p","Test":"TestProxy"}'
	expect_detect skip 2 '{"Action":"skip","Package":"p","Test":"TestSyncGates"}'
	expect_detect zero 3 '{"Action":"pass","Package":"git.golem15.com/golem15/summercms/modules/conga"}'
	expect_detect no-tests-to-run 3 '{"Action":"pass","Package":"p","Test":"TestA"}
{"Action":"output","Package":"q","Output":"testing: warning: no tests to run\n"}'
	expect_detect nonjson 4 '{"Action":"pass",'
	expect_detect build 1 '{"Action":"build-fail","ImportPath":"p"}
{"Action":"pass","Package":"q","Test":"TestA"}'
	expect_detect build-flag 1 '{"Action":"pass","Package":"q","Test":"TestA"}
{"Action":"fail","Package":"p","FailedBuild":"p"}'
	expect_detect package 1 '{"Action":"pass","Package":"p","Test":"TestA"}
{"Action":"fail","Package":"p"}'
	PHASE11_REQUIRE="TestProxy TestWsAuthorizer" expect_detect required 5 \
		'{"Action":"pass","Package":"p","Test":"TestProxy"}'
	PHASE11_ALLOW="p:TestKnown" expect_detect allowed 0 '{"Action":"pass","Package":"p","Test":"TestA"}
{"Action":"fail","Package":"p","Test":"TestKnown"}
{"Action":"fail","Package":"p"}'
	PHASE11_ALLOW="p:TestKnown" expect_detect allowed-other 1 '{"Action":"fail","Package":"p","Test":"TestKnown"}
{"Action":"fail","Package":"p","Test":"TestOther"}'
	PHASE11_ALLOW="p:TestKnown" expect_detect allowed-now-passes 6 '{"Action":"pass","Package":"p","Test":"TestKnown"}'
	local golden='{"Action":"output","Package":"p","Test":"TestBroadcastGoldens/created","Output":"    pending: Phase 12 asserts the album subtree\n"}
{"Action":"skip","Package":"p","Test":"TestBroadcastGoldens/created"}
{"Action":"pass","Package":"p","Test":"TestBroadcastGoldens"}'
	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect expected-skip 0 "$golden"
	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect expected-skip-wrong-text 7 \
		'{"Action":"skip","Package":"p","Test":"TestBroadcastGoldens/created"}
{"Action":"pass","Package":"p","Test":"TestBroadcastGoldens"}'
	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect expected-skip-passes 7 \
		'{"Action":"pass","Package":"p","Test":"TestBroadcastGoldens/created"}'
	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect expected-skip-missing 7 \
		'{"Action":"pass","Package":"p","Test":"TestA"}'
	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect other-skip 2 \
		"$golden
{\"Action\":\"skip\",\"Package\":\"p\",\"Test\":\"TestBroadcastGoldens/deleted\"}"
	local flag
	for flag in --self-test --hygiene --go --postgres --named --evidence --removal --all; do
		grep -q -- "^$flag)" "${BASH_SOURCE[0]}" || {
			echo "refuse: missing mode $flag" >&2
			exit 1
		}
	done

	# hygiene_11 passes on scratch copies, then refuses each plant for its
	# own reason and no other.
	local scratch
	scratch="$(mktemp -d)"
	trap 'rm -rf "$scratch"' RETURN
	mkdir -p "$scratch/tree/modules/tide"
	local m
	for m in "${PHASE11_MODULES[@]}"; do
		cp -R "$ROOT/modules/$m" "$scratch/tree/modules/$m"
	done
	cp "$ROOT"/modules/tide/centrifugo*.go "$scratch/tree/modules/tide/"
	cp "$ROOT/README.md" "$scratch/tree/README.md"
	cp "$ROOT/go.mod" "$scratch/go.mod"
	module_list "$scratch/modlist"
	cp "$scratch/modlist" "$scratch/modlist.clean"
	cp "$scratch/go.mod" "$scratch/go.mod.clean"
	cp "$scratch/tree/README.md" "$scratch/README.clean"
	(hygiene_11 "$scratch/tree" "$scratch/modlist" "$scratch/go.mod") >/dev/null 2>&1 || {
		echo "refuse: self-test hygiene_11 rejected the clean scratch copy" >&2
		exit 1
	}
	local plant want out reason
	for plant in appname-go appname-readme client-gocent client-typesense client-webpush cron river-version river-absent readme-file readme-row; do
		rm -f "$scratch/tree/modules/conga/zz_plant.go"
		cp "$scratch/modlist.clean" "$scratch/modlist"
		cp "$scratch/go.mod.clean" "$scratch/go.mod"
		cp "$scratch/README.clean" "$scratch/tree/README.md"
		cp "$ROOT/modules/lighthouse/README.md" "$scratch/tree/modules/lighthouse/README.md"
		cp "$ROOT/modules/flare/README.md" "$scratch/tree/modules/flare/README.md"
		case "$plant" in
		appname-go)
			printf 'package conga\n\n// Płytarium keeps its albums here.\n' >"$scratch/tree/modules/conga/zz_plant.go"
			want="$REASON_APPNAME"
			;;
		appname-readme)
			printf '\nThe fonoteka app uses this.\n' >>"$scratch/tree/modules/lighthouse/README.md"
			want="$REASON_APPNAME"
			;;
		client-gocent)
			printf 'github.com/centrifugal/gocent/v3 v3.3.0\n' >>"$scratch/modlist"
			want="$REASON_CLIENT"
			;;
		client-typesense)
			printf 'github.com/typesense/typesense-go/v3 v3.2.0\n' >>"$scratch/modlist"
			want="$REASON_CLIENT"
			;;
		client-webpush)
			printf 'github.com/SherClockHolmes/webpush-go v1.4.0\n' >>"$scratch/modlist"
			want="$REASON_CLIENT"
			;;
		cron)
			printf '\nrequire github.com/robfig/cron/v3 v3.0.1\n' >>"$scratch/go.mod"
			want="$REASON_CRON"
			;;
		river-version)
			sed -i 's|^github.com/riverqueue/river v0.47.0$|github.com/riverqueue/river v0.46.0|' "$scratch/modlist"
			want="$REASON_RIVER"
			;;
		river-absent)
			sed -i '/^github.com\/riverqueue\/river /d' "$scratch/modlist"
			want="$REASON_RIVER"
			;;
		readme-file)
			rm -f "$scratch/tree/modules/flare/README.md"
			want="$REASON_README"
			;;
		readme-row)
			sed -i '/^| \[beachcomber\](modules\/beachcomber\/README.md) |/d' "$scratch/tree/README.md"
			want="$REASON_README"
			;;
		esac
		if out="$( (hygiene_11 "$scratch/tree" "$scratch/modlist" "$scratch/go.mod") 2>&1)"; then
			echo "refuse: self-test hygiene_11 accepted a planted $plant" >&2
			exit 1
		fi
		if ! grep -qF "$want" <<<"$out"; then
			echo "refuse: self-test hygiene_11 rejected the $plant plant without naming its rule: $out" >&2
			exit 1
		fi
		for reason in "$REASON_APPNAME" "$REASON_CLIENT" "$REASON_CRON" "$REASON_RIVER" "$REASON_README"; do
			if [[ "$reason" != "$want" ]] && grep -qF "$reason" <<<"$out"; then
				echo "refuse: self-test hygiene_11 rejected the $plant plant for another rule: $out" >&2
				exit 1
			fi
		done
	done
	# Look-alikes are accepted: English words near the application names,
	# an indirect cron requirement and the pinned River line.
	rm -f "$scratch/tree/modules/conga/zz_plant.go"
	cp "$ROOT/modules/lighthouse/README.md" "$scratch/tree/modules/lighthouse/README.md"
	cp "$ROOT/modules/flare/README.md" "$scratch/tree/modules/flare/README.md"
	cp "$scratch/modlist.clean" "$scratch/modlist"
	cp "$scratch/README.clean" "$scratch/tree/README.md"
	cp "$scratch/go.mod.clean" "$scratch/go.mod"
	printf 'package conga\n\n// A display tariff for the acme collection of vinyl albums and playlists.\n' >"$scratch/tree/modules/conga/zz_plant.go"
	printf '\nrequire github.com/robfig/cron/v3 v3.0.1 // indirect\n' >>"$scratch/go.mod"
	printf 'github.com/acme/webhooks v1.0.0\n' >>"$scratch/modlist"
	(hygiene_11 "$scratch/tree" "$scratch/modlist" "$scratch/go.mod") >/dev/null 2>&1 || {
		echo "refuse: self-test hygiene_11 rejected a clean look-alike" >&2
		exit 1
	}

	# The removal harness refuses an anchor that is not unique, restores
	# the file byte for byte, and reports a mutation whose test passes.
	local fake="$scratch/fake"
	mkdir -p "$fake/modules/acme"
	printf 'module example.test/acme\n\ngo 1.27\n' >"$fake/go.mod"
	printf 'package acme\n\nfunc Guard(n int) bool {\n\tif n > 3 {\n\t\treturn false\n\t}\n\treturn true\n}\n' >"$fake/modules/acme/acme.go"
	printf 'package acme\n\nimport "testing"\n\nfunc TestGuard(t *testing.T) {\n\tif Guard(4) {\n\t\tt.Fatal("guard removed")\n\t}\n}\n\nfunc TestOther(t *testing.T) {}\n' >"$fake/modules/acme/acme_test.go"
	cp "$fake/modules/acme/acme.go" "$scratch/acme.go.saved"
	local table="$scratch/table.json"
	printf '[["RC-T1","T-X","root","modules/acme/acme.go","if n > 3 {","if false {","./modules/acme","^TestGuard$"]]' >"$table"
	out="$(removal_harness_in "$fake" "$table" 2>&1)" || {
		echo "refuse: self-test removal harness did not catch a guarded mutation: $out" >&2
		exit 1
	}
	grep -q "RC-T1 T-X modules/acme/acme.go: fails as required" <<<"$out" || {
		echo "refuse: self-test removal harness output: $out" >&2
		exit 1
	}
	cmp -s "$fake/modules/acme/acme.go" "$scratch/acme.go.saved" || {
		echo "refuse: self-test removal harness did not restore the file" >&2
		exit 1
	}
	printf '[["RC-T2","T-X","root","modules/acme/acme.go","if n > 3 {","if false {","./modules/acme","^TestOther$"]]' >"$table"
	if out="$(removal_harness_in "$fake" "$table" 2>&1)"; then
		echo "refuse: self-test removal harness accepted a mutation whose test passes: $out" >&2
		exit 1
	fi
	grep -q "RC-T2 T-X modules/acme/acme.go: SURVIVED" <<<"$out" || {
		echo "refuse: self-test removal harness refused a surviving mutation for the wrong reason: $out" >&2
		exit 1
	}
	printf '[["RC-T3","T-X","root","modules/acme/acme.go","return","x","./modules/acme","^TestGuard$"]]' >"$table"
	if out="$(removal_harness_in "$fake" "$table" 2>&1)"; then
		echo "refuse: self-test removal harness accepted a non-unique anchor" >&2
		exit 1
	fi
	grep -q "anchor occurs 2 times" <<<"$out" || {
		echo "refuse: self-test removal harness refused a non-unique anchor for the wrong reason: $out" >&2
		exit 1
	}
	cmp -s "$fake/modules/acme/acme.go" "$scratch/acme.go.saved" || {
		echo "refuse: self-test removal harness left a mutation behind" >&2
		exit 1
	}
	echo "phase11 self-test passed"
}

# removal_harness_in ROOT TABLE runs the harness against another root.
removal_harness_in() {
	local root="$1" table="$2"
	(
		ROOT="$root"
		APP="$root"
		export GOWORK=off GOFLAGS=-mod=mod
		removal_harness "$table"
	)
}

run_go() {
	(cd "$ROOT" && go vet ./...)
	phase11_go "$ROOT" ./...
	phase11_go "$ROOT" -race ./modules/lighthouse/... ./modules/beachcomber/... ./modules/flare
	PHASE11_REQUIRE="TestListenPickupLatency" phase11_go "$ROOT" ./modules/conga -run '^TestListenPickupLatency$' -count=3
	echo "phase11 go passed"
}

run_postgres() {
	(cd "$APP" && go vet ./... "${APP_PLUGINS[@]}")
	PHASE11_ALLOW="$KNOWN_APP_FAILURES" PHASE11_EXPECT_SKIP="$GOLDEN_SKIPS" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" \
		phase11_go "$APP" ./... "${APP_PLUGINS[@]}"
	echo "phase11 postgres passed"
}

# run_named runs every test named in 11-VALIDATION.md (and the plan's
# per-requirement tests) by exact name, per package.
run_named() {
	phase11_tests "$ROOT" ./modules/conga TestListenPickupLatency TestDispatchTransactional \
		TestOutcomeComplete TestOutcomeFailFinalAttemptOnly TestOutcomePanicBecomesError TestOutcomeSkipIsCompleteWithMetadata \
		TestCancelQueuedNeverRuns TestCancelRunningCancelsCtx TestStopJobFromWorker TestManagerPHPSemantics \
		TestQueueClear TestQueueWork TestScheduleNext TestScheduleEntries TestScheduleRunsCommand TestScheduleRunOnce \
		TestScheduledEntryMismatchSkipped TestScheduleUniqueByPeriod TestScheduleRunForeground TestScheduleValidation \
		TestScheduleOrdering TestScheduleMissingCatalog TestScheduleLogWriter TestScheduleDueAt
	phase11_tests "$ROOT" ./modules/bonfire TestCall TestCallEdges
	phase11_tests "$ROOT" ./modules/lagoon TestOnDatabaseAfterActivate TestQueueMigrationsUpDown TestTransactionAfterCommit
	phase11_tests "$ROOT" ./modules/lighthouse TestBroadcastTx TestSuppression TestBulkEmitsOnce TestBroadcastEdges \
		TestBroadcastSwallowedReadFailure TestMountSurfaces TestChannelIDMatchesPHP TestParseChannel TestRegistry
	phase11_tests "$ROOT" ./modules/lighthouse/centrifugo TestTokenClaims TestTokenHandler TestClientRequests TestProxy TestHealthCommand
	phase11_tests "$ROOT" ./modules/beachcomber TestSyncGates TestSyncAfterCommit TestSyncDeleteAndSoftDelete TestSyncFailuresNonFatal
	phase11_tests "$ROOT" ./modules/beachcomber/typesense TestEngineWire TestSyncEngineRegistration
	phase11_tests "$ROOT" ./modules/flare TestRFC8291AppendixA TestVAPIDHeader TestSendAllowlist TestSendStatuses
	phase11_tests "$ROOT" ./modules/tide TestCentrifugoRecorder TestNormalizePublications TestDiffPublications
	phase11_tests "$APP" ./plugins/golem15/fonoteka TestWsAuthorizer TestAlbumBroadcastBinding TestAlbumSearchable \
		TestFonotekaScheduleSkipsUnregisteredPrune TestRealtimeSubscribeProxy TestAlbumBroadcastSmoke TestAlbumSearchSmoke
	PHASE11_REQUIRE="TestBroadcastGoldens TestBroadcastGoldens/deleted TestBroadcastGoldens/bulk" \
		PHASE11_EXPECT_SKIP="$GOLDEN_SKIPS" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" \
		phase11_go "$APP" ./parity -run '^TestBroadcastGoldens$'
	echo "phase11 named passed"
}

run_evidence() {
	[[ -f "$REVIEW" && -f "$VALIDATION" ]] || {
		echo "refuse: security review or validation file is missing" >&2
		exit 1
	}
	python3 - "$REVIEW" "$VALIDATION" "$PHASE_DIR" <<'PY'
import glob, os, re, sys
review = open(sys.argv[1]).read()
validation = open(sys.argv[2]).read()
declared = {}
for plan in sorted(glob.glob(os.path.join(sys.argv[3], "11-0*-PLAN.md"))):
    for line in open(plan):
        m = re.match(r"^\| (T-11-(?:\d\d|SC)) \|", line)
        if m:
            cells = [c.strip().lower() for c in line.strip().strip("|").split("|")]
            declared.setdefault(m.group(1), cells)
if "T-11-SC" not in declared:
    print("refuse: no plan declares T-11-SC", file=sys.stderr)
    sys.exit(1)
lines = review.splitlines()
removal = [l for l in lines if re.match(r"^\| RC-\d+ \| T-11-", l)]
for tid, cells in sorted(declared.items()):
    rows = [l for l in lines if l.startswith("| " + tid + " |")]
    if len(rows) != 1:
        print(f"refuse: review has {len(rows)} threat rows for {tid}, want 1", file=sys.stderr)
        sys.exit(1)
    row = [c.strip().lower() for c in rows[0].strip().strip("|").split("|")]
    severity, disposition = cells[3], cells[4]
    if severity not in row or disposition not in row:
        print(f"refuse: review row {tid} does not copy severity {severity!r} and disposition {disposition!r}", file=sys.stderr)
        sys.exit(1)
    if severity == "high" and disposition == "mitigate":
        if not re.search(r"Test[A-Z][A-Za-z0-9]+|check-phase11\.sh", rows[0]):
            print(f"refuse: high threat {tid} names no failing-when-broken test or gate stage", file=sys.stderr)
            sys.exit(1)
        if not any(re.match(r"^\| RC-\d+ \| " + re.escape(tid) + r" \|", l) for l in removal):
            print(f"refuse: high threat {tid} has no removal check row", file=sys.stderr)
            sys.exit(1)
if not re.search(r"^nyquist_compliant: true$", validation, re.M):
    print("refuse: validation is not nyquist_compliant", file=sys.stderr)
    sys.exit(1)
if not re.search(r"^status: validated$", validation, re.M):
    print("refuse: validation status is not validated", file=sys.stderr)
    sys.exit(1)
for line in validation.splitlines():
    if line.startswith("|") and ("pending" in line.lower() or "| TBD |" in line):
        print("refuse: validation row still pending: " + line, file=sys.stderr)
        sys.exit(1)
for req in ["JOBS-01", "CLI-04", "CLI-06", "RT-01", "RT-02", "RT-03", "SRCH-01"]:
    if req not in validation:
        print(f"refuse: validation does not name {req}", file=sys.stderr)
        sys.exit(1)
print("phase11 evidence passed")
PY
}

case "${1:-}" in
--self-test) run_self_test ;;
--hygiene) run_hygiene ;;
--go) run_go ;;
--postgres) run_postgres ;;
--named) run_named ;;
--evidence) run_evidence ;;
--removal) run_removal ;;
--all)
	run_self_test
	run_hygiene
	run_go
	run_postgres
	run_named
	run_evidence
	echo "phase11 all passed"
	;;
*) usage ;;
esac