#!/bin/sh
# Coupling guard for the retired echo-drop-race workaround (v0.40.0).
#
# BACKGROUND. Until spt-core 0.68.0 the echo-commune host wrote the SAME path as the agent's own
# commune drop, with no arbitration, so a marker-bearing recharge commune written as a turn's LAST
# act could be overwritten unread by an echo landing in that window. The brief's answer was a TIMING
# rule: take one more tool call after writing the commune. 0.68.0 routes the echo straight to the
# durable tiers and never files, so the workaround is gone.
#
# WHY THIS IS A COUPLING TEST AND NOT A WORDING PIN. Pinning the brief's text would stay green if
# someone later lowered `min_spt_core_version` — and that is the combination that actually hurts: a
# brief with no workaround, running on a core that still has the race, loses recharge wakes SILENTLY.
# So the assertion is the IMPLICATION, in the direction that fails safe:
#
#     the brief no longer teaches the timing rule  =>  min_spt_core_version >= 0.68.0
#
# Either half may move as long as they move together. Restoring the workaround to the brief is legal
# (the floor may then be anything); raising the floor is legal. Only the unsafe pairing is refused.
# [unit->REQ-ECHO-DROP-RACE-RETIRED]
set -u
ROOT=$(CDPATH= cd "$(dirname "$0")/.." && pwd)
cd "$ROOT" || exit 2
rc=0
ok()   { printf 'ok   %s\n' "$1"; }
fail() { printf 'FAIL: %s\n' "$1"; rc=1; }

MANIFEST="adapter/claude-spt.toml"
BRIEF="adapter/strings/briefs/live-ops.md"
FLOOR_REQUIRED="0.68.0"

for f in "$MANIFEST" "$BRIEF"; do
  [ -f "$f" ] || { fail "missing file: $f"; echo "rc=$rc"; exit $rc; }
done

# --- the floor, as an ordered comparison rather than a string match -------------------------------
# A literal "0.68.0" equality would go red the day the floor legitimately rises to 0.69.0, and a test
# that goes red for a correct change is a test people learn to edit rather than read.
floor=$(sed -n 's/^min_spt_core_version *= *"\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
[ -n "$floor" ] || { fail "could not read min_spt_core_version from $MANIFEST"; echo "rc=$rc"; exit $rc; }

# Returns 0 when $1 >= $2, comparing dotted numeric components.
ver_ge() {
  a1=${1%%.*}; a_r=${1#*.}; a2=${a_r%%.*}; a3=${a_r#*.}
  b1=${2%%.*}; b_r=${2#*.}; b2=${b_r%%.*}; b3=${b_r#*.}
  [ "$a1" -gt "$b1" ] && return 0
  [ "$a1" -lt "$b1" ] && return 1
  [ "$a2" -gt "$b2" ] && return 0
  [ "$a2" -lt "$b2" ] && return 1
  [ "$a3" -ge "$b3" ]
}

# --- does the brief still teach the timing workaround? --------------------------------------------
# Match the PRESCRIPTIVE forms only. A bare "last act" is the wrong predicate and was caught being
# wrong on this test's first run: the corrected brief says the commune may be written "your turn's
# very last act", which a naive grep reads as the workaround still being present — the instrument
# reporting the exact opposite of the truth. What identifies the rule is an instruction to spend an
# additional tool call, or a prohibition on writing the commune last.
if grep -qiE "one more tool call|extra tool call|not write it as your turn" "$BRIEF"; then
  taught=yes
else
  taught=no
fi

if [ "$taught" = yes ]; then
  ok "brief still teaches the timing workaround — floor is unconstrained by this rule (floor=$floor)"
else
  if ver_ge "$floor" "$FLOOR_REQUIRED"; then
    ok "workaround retired AND floor >= $FLOOR_REQUIRED (floor=$floor)"
  else
    fail "UNSAFE PAIRING: $BRIEF no longer teaches the recharge timing workaround, but min_spt_core_version=$floor is below $FLOOR_REQUIRED. On such a core the echo host still writes the agent's drop path, so a recharge commune written as a turn's last act can be overwritten unread and the wake never fires — silently. Either raise the floor or restore the workaround."
  fi
fi

# --- the header's consumer must NOT have been retired with the workaround -------------------------
# Core deliberately KEPT the `Source: echo-commune` provenance header, because claude-spt keys its
# authorship refusal on it. The echo still publishes COMMUNE frames, so arming
# off one would still be arming off a body the agent never wrote. Retiring the race must not have
# taken this guard down with it.
if grep -rq "Source: echo-commune" tools/claude-spt/src/hook.rs; then
  ok "authorship refusal still keys on the Source: echo-commune header"
else
  fail "the Source: echo-commune authorship guard is gone from hook.rs — REQ-COMMUNE-ECHO-NOT-AUTHORED depends on it, and core kept the header for exactly this consumer"
fi

# --- and the brief must not have kept the two statements 0.68.0 made false ------------------------
# These are the FALSE-ALARM half of the correction: an agent told that an echo frame means its delta
# was lost will rewrite good communes forever.
if grep -qiE "the echo won|proves nothing either way|whichever write lands last" "$BRIEF"; then
  fail "$BRIEF still carries a statement that spt-core 0.68.0 made false (an echo frame meaning the delta was lost, or the drop's disappearance proving nothing) — these drive needless commune rewrites"
else
  ok "brief carries no statement invalidated by the single-writer drop path"
fi

echo "rc=$rc"
exit $rc