#!/usr/bin/env bash
# CHECK-q160 -- a committed test grades the module beside it, not a host copy
# (volt, 2026-11-03).
#
# The defect: `wizard-work/beam/test_tarjan_articulation.py` landed at bb8aec7
# with `sys.path.insert(0, '/root/.hermes/wizard-outputs/beam')`. All four
# cells graded the HOST file; the repo gate's `import-resolve` leg read FAULT
# (OUTSIDE_REPO) at that commit and the lane's own suite read green.
#
# Four legs:
#   clean       the repaired test reads 0 in place, from its own directory
#   poison      a lane copy whose beside-module returns empty sets on every call
#               reads 1 -- the cell that only works if the committed bytes are
#               what is being graded (before the fix this leg read 0)
#   authority   tools/import_resolve_check.py grades the WORKTREE at 0 faults
#   regression  the same authority at bb8aec7 -- the commit that landed the
#               defect -- still reads 1 and names the file, so this guard is
#               green because the tree is repaired, not because the checker
#               stopped seeing the shape
#
# Exit codes: 0 all legs passed, 1 a fault, 2 could not grade.
set -u
set -o pipefail

cd "$(dirname "${BASH_SOURCE[0]}")" || exit 2
ROOT="$(pwd)"
LANE="$ROOT/wizard-work/beam"
TEST="$LANE/test_tarjan_articulation.py"
POISON="$ROOT/wizard-work/volt/q160-import-binding/poison_tarjan.py"
AUTH="$ROOT/tools/import_resolve_check.py"
PY="${PYTHON:-python3}"
WORK="$(mktemp -d "${TMPDIR:-/tmp}/check-q160.XXXXXX")" || exit 2
trap 'rm -rf "$WORK"' EXIT

for f in "$TEST" "$POISON" "$AUTH" "$LANE/tarjan_articulation.py"; do
    if [ ! -f "$f" ]; then
        printf 'CANNOT GRADE: missing %s\n' "$f"
        exit 2
    fi
done

# Two legs grade a REVISION (the authority in worktree mode and at bb8aec7), so
# a .git-less export cannot answer them. That is rc 2 -- "could not grade" --
# not a fault, which is the repo's tools/ contract.
if ! git -C "$ROOT" rev-parse --show-toplevel >/dev/null 2>&1; then
    printf 'CANNOT GRADE: %s is not a git work tree\n' "$ROOT"
    exit 2
fi

passed=0
failed=0
row() { printf '  %-11s %s\n' "$1" "$2"; }
verdict() { if [ "$2" -eq 0 ]; then passed=$((passed + 1)); else failed=$((failed + 1)); fi; row "$1" "$3"; }

# --- leg 1: the repaired test, in place --------------------------------------
out="$(cd "$LANE" && "$PY" test_tarjan_articulation.py 2>&1)"; lrc=$?
last="$(printf '%s' "$out" | tail -1)"
verdict clean "$lrc" "rc=$lrc  ${last:-<no output>}"

# --- leg 2: the poisoned lane copy -------------------------------------------
cp -a "$LANE" "$WORK/beam" >/dev/null 2>&1 || { printf 'CANNOT GRADE: copy failed\n'; exit 2; }
cp "$POISON" "$WORK/beam/tarjan_articulation.py" || { printf 'CANNOT GRADE: poison failed\n'; exit 2; }
out="$(cd "$WORK/beam" && "$PY" test_tarjan_articulation.py 2>&1)"; prc=$?
last="$(printf '%s' "$out" | grep -E 'AssertionError|Error' | tail -1)"
verdict poison "$([ "$prc" -eq 1 ] && echo 0 || echo 1)" \
    "rc=$prc (want 1)  ${last:-<no error line>}"

# --- leg 3: the authority on the worktree ------------------------------------
out="$("$PY" "$AUTH" --repo "$ROOT" 2>&1)"; arc=$?
last="$(printf '%s' "$out" | tail -1)"
verdict authority "$arc" "rc=$arc  $last"

# --- leg 4: the authority at the commit that landed the defect --------------
out="$("$PY" "$AUTH" --repo "$ROOT" --rev bb8aec7 2>&1)"; rrc=$?
last="$(printf '%s' "$out" | grep -E '^(FAULT|FAIL)' | tail -1)"
verdict regression "$([ "$rrc" -eq 1 ] && echo 0 || echo 1)" \
    "rc=$rrc (want 1)  ${last:-<no fault line>}"

if [ "$failed" -eq 0 ]; then
    echo "q160: $passed leg(s), 0 fault(s), rc 0"
    exit 0
fi
echo "q160: $passed passed, $failed fault(s), rc 1"
exit 1