settings_test.go

package config

import (
	"os"
	"path/filepath"
	"regexp"
	"slices"
	"strings"
	"testing"

	"github.com/Agent-Field/codeaf/internal/automation"
	"github.com/Agent-Field/codeaf/internal/cell/celltest"
	"github.com/Agent-Field/codeaf/internal/pool/poolcfg"
	"github.com/Agent-Field/codeaf/internal/taxonomy"
)

func registry(t *testing.T, dir string) *Settings {
	t.Helper()
	return NewSettings(SettingsOptions{
		ProfileDir: dir,
		ModelValue: func(slot string) string { return slot + "/model" },
		SetModel:   func(string, string) error { return nil },
		SplitPct:   func() int { return 0 },
	})
}

func TestSlackApplicationRowShowsOnlyThePersonsAnswer(t *testing.T) {
	dir := t.TempDir()
	t.Setenv("SLACK_OAUTH_CLIENT", "")
	row, found := registry(t, dir).Row(KeySlackOAuthClient)
	if !found {
		t.Fatal("the Slack application row is not registered")
	}
	if row.Label != "slack app id" || row.Env != "SLACK_OAUTH_CLIENT" || row.EmptyLabel != "not set" {
		t.Errorf("Slack row = %+v", row)
	}
	if got := row.Value(); got != "not set" {
		t.Errorf("an unanswered row shows %q, want not set", got)
	}
	if got := SlackOAuthClientAt(dir); got != defaultSlackOAuthClient {
		t.Errorf("shipped application = %q", got)
	}
	if err := row.Apply("an-internal-application"); err != nil {
		t.Fatalf("Apply: %v", err)
	}
	if got := SlackOAuthClientAt(dir); got != "an-internal-application" {
		t.Errorf("persisted application = %q", got)
	}
	t.Setenv("SLACK_OAUTH_CLIENT", "an-environment-application")
	if got := SlackOAuthClientAt(dir); got != "an-environment-application" {
		t.Errorf("environment application = %q", got)
	}
}

// The pool key row: the trusted word a fetched index is checked under. Empty
// is the ordinary answer and reads as the key the binary carries; a stored
// word is the one the install trusts, and the pin outranks it.
func TestThePoolKeyRowReadsBuiltInAndFollowsItsStoredWordAndItsPin(t *testing.T) {
	dir := t.TempDir()
	t.Setenv("CODEAF_MODEL_POOL_PUBLIC_KEY", "")
	t.Setenv("CODEAF_MODEL_POOL", "")
	rows := registry(t, dir)
	row, ok := rows.Row(KeyModelPoolPublicKey)
	if !ok {
		t.Fatal("the pool key is not registered")
	}
	if row.Category != CategoryModels || row.Kind != SettingText || row.Label != "pool key" {
		t.Fatalf("pool key row = %+v", row)
	}
	if row.Value() != "built in" {
		t.Fatalf("an unset key row reads %q, want built in", row.Value())
	}
	if got := ModelPoolAt(dir); got.PublicKey != "" || got.Source.PublicKey != "default" {
		t.Fatalf("an untouched profile resolved %+v", got)
	}

	if err := row.Apply("A-base64-word="); err != nil {
		t.Fatal(err)
	}
	reread, _ := registry(t, dir).Row(KeyModelPoolPublicKey)
	if reread.Value() != "A-base64-word=" {
		t.Fatalf("the reread row lost the persisted word: %q", reread.Value())
	}
	if got := ModelPoolAt(dir); got.PublicKey != "A-base64-word=" || got.Source.PublicKey != "setting" {
		t.Fatalf("the stored key did not take: %+v", got)
	}

	t.Setenv("CODEAF_MODEL_POOL_PUBLIC_KEY", "a-pinned-key")
	pinned, _ := registry(t, dir).Row(KeyModelPoolPublicKey)
	if name, isPinned := pinned.PinnedBy(); !isPinned || name != "CODEAF_MODEL_POOL_PUBLIC_KEY" {
		t.Fatalf("the key row did not report its pin: %q %v", name, isPinned)
	}
	if got := ModelPoolAt(dir); got.PublicKey != "a-pinned-key" || got.Source.PublicKey != "env" {
		t.Fatalf("the pin lost: %+v", got)
	}
	if err := pinned.Apply("another"); err == nil || !strings.Contains(err.Error(), "CODEAF_MODEL_POOL_PUBLIC_KEY") {
		t.Fatalf("a pinned key row accepted an edit: %v", err)
	}
}

// The registry is the completeness gate: a user-tunable environment pin added
// anywhere in the tree has to arrive as a row here, or land on the explicit
// operator-plumbing allowlist. Until then this test fails the build.
func TestRegistryCoversEveryUserFacingEnvironmentPin(t *testing.T) {
	registered := map[string]bool{}
	for _, row := range registry(t, t.TempDir()).Rows() {
		if row.Env != "" {
			registered[row.Env] = true
		}
		if row.EnvDefault != "" {
			registered[row.EnvDefault] = true
		}
	}
	for _, name := range OperatorEnvPins {
		registered[name] = true
	}

	pattern := regexp.MustCompile(`CODEAF_[A-Z0-9_]+`)
	root := repositoryRoot(t)
	seen := map[string]string{}
	err := filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
		if err != nil {
			return err
		}
		if entry.IsDir() {
			// .claude holds other branches' worktrees; their pins register
			// in their own settings.go, and reading them here fails this
			// branch for a variable it cannot see.
			if entry.Name() == ".git" || entry.Name() == ".claude" {
				return filepath.SkipDir
			}
			return nil
		}
		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
			return nil
		}
		raw, err := os.ReadFile(path)
		if err != nil {
			return err
		}
		for _, name := range pattern.FindAllString(string(raw), -1) {
			if _, ok := seen[name]; !ok {
				seen[name] = path
			}
		}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
	if len(seen) < 10 {
		t.Fatalf("the environment scan found only %d pins; it is not reading the tree", len(seen))
	}
	for name, path := range seen {
		if strings.HasPrefix(name, "CODEAF_TEST_") || registered[name] {
			continue
		}
		t.Fatalf("%s (%s) is neither a settings row nor operator plumbing — register it in settings.go",
			name, path)
	}
}

func repositoryRoot(t *testing.T) string {
	t.Helper()
	dir, err := filepath.Abs(".")
	if err != nil {
		t.Fatal(err)
	}
	for {
		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
			return dir
		}
		parent := filepath.Dir(dir)
		if parent == dir {
			t.Fatal("no go.mod above the config package")
		}
		dir = parent
	}
}

func TestRegistryGroupsEveryCategoryAndEveryModelSlot(t *testing.T) {
	rows := registry(t, t.TempDir())
	groups := rows.Groups()
	if len(groups) != len(SettingCategories) {
		t.Fatalf("groups = %d, want %d", len(groups), len(SettingCategories))
	}
	for index, group := range groups {
		if group.Title != SettingCategories[index] {
			t.Fatalf("group %d = %q, want %q", index, group.Title, SettingCategories[index])
		}
		if len(group.Rows) == 0 {
			t.Fatalf("category %q is empty", group.Title)
		}
	}
	for _, slot := range ModelSlots() {
		row, ok := rows.Row(ModelSettingKey(slot.Slot))
		if !ok || row.Kind != SettingModel || row.Slot != slot.Slot {
			t.Fatalf("model slot %q is missing from the registry", slot.Slot)
		}
		if !slot.Held {
			// A role nothing holds a client for reads as what it follows —
			// never as the engine's answer for a word it does not know.
			if row.Value() != "follows "+slot.Follows {
				t.Fatalf("unheld role %q reads %q", slot.Slot, row.Value())
			}
			continue
		}
		if slot.Role == "" {
			// A CAPABILITY SLOT IS READ OUT OF THE PROFILE, not out of a
			// running engine (docs/MULTIMODAL.md Decision 5): its value is a
			// choice written down here, and an untouched profile has written
			// nothing, which reads as the word the resolver will act on.
			if row.Value() != "automatic" {
				t.Fatalf("capability slot %q reads %q in an untouched profile", slot.Slot, row.Value())
			}
			continue
		}
		if row.Value() != slot.Slot+"/model" {
			t.Fatalf("model row %q reads %q", slot.Slot, row.Value())
		}
	}
	seen := map[string]bool{}
	for _, row := range rows.Rows() {
		if seen[row.Key] {
			t.Fatalf("duplicate settings key %q", row.Key)
		}
		seen[row.Key] = true
		if row.Label == "" || row.Category == "" || row.Hint == "" {
			t.Fatalf("row %q is missing plain language: %+v", row.Key, row)
		}
	}
}

func TestSettingsResolveEnvironmentThenFileThenDefault(t *testing.T) {
	dir := t.TempDir()
	for _, name := range []string{
		"CODEAF_DAILY_BUDGET", "CODEAF_DOC_ENGINE", "CODEAF_VISION_MODEL",
	} {
		t.Setenv(name, "")
	}

	rows := registry(t, dir)
	defaults := map[string]string{
		KeyDailyBudget:    formatDollars(DefaultDailyBudgetUSD),
		KeyDocumentEngine: "auto",
		KeyVisionModel:    "automatic",
	}
	for key, want := range defaults {
		row, ok := rows.Row(key)
		if !ok {
			t.Fatalf("%s is not registered", key)
		}
		if got := row.Value(); got != want {
			t.Fatalf("%s default = %q, want %q", key, got, want)
		}
	}

	changes := map[string]string{
		KeyDailyBudget:    "35.50",
		KeyDocumentEngine: "local",
		KeyVisionModel:    "seer/vision",
	}
	for key, raw := range changes {
		row, _ := rows.Row(key)
		if err := row.Apply(raw); err != nil {
			t.Fatalf("apply %s=%q: %v", key, raw, err)
		}
	}
	reread := registry(t, dir)
	persisted := map[string]string{
		KeyDailyBudget:    "$35.5",
		KeyDocumentEngine: "local",
		KeyVisionModel:    "seer/vision",
	}
	for key, want := range persisted {
		row, _ := reread.Row(key)
		if got := row.Value(); got != want {
			t.Fatalf("%s persisted = %q, want %q", key, got, want)
		}
	}

	// One file, one writer: the budget rail and the new rows share it, and an
	// unrelated key already in the object survives every write.
	if err := WriteDailyBudgetUSD(dir, 12); err != nil {
		t.Fatal(err)
	}
	if got, err := DailyBudgetUSDAt(dir); err != nil || got != 12 {
		t.Fatalf("daily budget = %v err=%v", got, err)
	}
	if got, _ := reread.Row(KeyDocumentEngine); got.Value() != "local" {
		t.Fatalf("a budget write erased the document engine: %q", got.Value())
	}

	t.Setenv("CODEAF_DOC_ENGINE", "ocr")
	t.Setenv("CODEAF_VISION_MODEL", "pinned/vision")
	pinned := registry(t, dir)
	for key, want := range map[string]string{
		KeyDocumentEngine: "ocr", KeyVisionModel: "pinned/vision",
	} {
		row, _ := pinned.Row(key)
		if got := row.Value(); got != want {
			t.Fatalf("%s under the environment = %q, want %q", key, got, want)
		}
		name, isPinned := row.PinnedBy()
		if !isPinned || name == "" {
			t.Fatalf("%s did not report its environment pin", key)
		}
		if err := row.Apply("auto"); err == nil || !strings.Contains(err.Error(), name) {
			t.Fatalf("%s accepted an edit while pinned: %v", key, err)
		}
	}
}

// The persisted layer is what Load reads on the next launch; the sheet writing
// a value has to be the same thing the process reads back.
func TestLoadReadsPersistedSettings(t *testing.T) {
	dir := t.TempDir()
	rows := registry(t, dir)
	for key, raw := range map[string]string{
		KeyDailyBudget:    "6",
		KeyDocumentEngine: "free",
		KeyVisionModel:    "seer/vision",
	} {
		row, _ := rows.Row(key)
		if err := row.Apply(raw); err != nil {
			t.Fatalf("apply %s: %v", key, err)
		}
	}
	t.Setenv("OPENROUTER_API_KEY", "test-key")
	t.Setenv("CODEAF_BASE_URL", "http://127.0.0.1:1")
	t.Setenv("CODEAF_PROFILE_DIR", dir)
	for _, name := range []string{
		"CODEAF_DAILY_BUDGET", "CODEAF_DOC_ENGINE", "CODEAF_VISION_MODEL",
	} {
		t.Setenv(name, "")
	}
	loaded, err := Load()
	if err != nil {
		t.Fatal(err)
	}
	if loaded.DailyBudgetUSD != 6 || loaded.DocumentEngine != "free" ||
		loaded.VisionModel != "seer/vision" {
		t.Fatalf("persisted settings did not reach Load: %+v", loaded)
	}

	// The environment still wins over everything written here.
	t.Setenv("CODEAF_DOC_ENGINE", "ocr")
	t.Setenv("CODEAF_DAILY_BUDGET", "2")
	loaded, err = Load()
	if err != nil {
		t.Fatal(err)
	}
	if loaded.DocumentEngine != "ocr" || loaded.DailyBudgetUSD != 2 {
		t.Fatalf("environment lost to the persisted file: %+v", loaded)
	}
}

func TestSettingEditorsRefuseNonsenseInPlainLanguage(t *testing.T) {
	rows := registry(t, t.TempDir())
	for key, raw := range map[string]string{
		KeyDailyBudget:    "twenty dollars",
		KeyTaskParallel:   "many",
		KeyDocumentEngine: "tesseract",
	} {
		row, ok := rows.Row(key)
		if !ok {
			t.Fatalf("%s is not registered", key)
		}
		err := row.Apply(raw)
		if err == nil {
			t.Fatalf("%s accepted %q", key, raw)
		}
		if message := err.Error(); message == "" || strings.Contains(message, "strconv") {
			t.Fatalf("%s error is not plain language: %v", key, err)
		}
	}
}

// THE ATTRIBUTION ROW defaults on, turns signing off when requested, and obeys
// the shell pin.
func TestTheAttributionRowDefaultsOnAndTurnsSigningOff(t *testing.T) {
	dir := t.TempDir()
	t.Setenv("CODEAF_ATTRIBUTION", "")
	rows := registry(t, dir)
	row, ok := rows.Row(KeyAttribution)
	if !ok {
		t.Fatalf("%s is not registered", KeyAttribution)
	}
	if KeyAttribution != "attribution" || row.Label != "attribution" ||
		row.Env != "CODEAF_ATTRIBUTION" || row.Category != CategoryInterface || row.Kind != SettingBool {
		t.Fatalf("the attribution row = %+v", row)
	}
	if want := "On, codeaf signs the commits, pull requests, issues and comments it writes; off, it adds no marks."; row.Hint != want || AttributionHint != want {
		t.Fatalf("hint = %q, want %q", row.Hint, want)
	}
	if !PreferenceKey(KeyAttribution) {
		t.Fatal("attribution is not a preference key")
	}
	if row.SelfService() {
		t.Fatal("attribution must not be self-service")
	}
	if row.Value() != "on" || !AttributionAt(dir) {
		t.Fatalf("attribution is not on by default: %q", row.Value())
	}
	if err := row.Apply("off"); err != nil {
		t.Fatal(err)
	}
	if AttributionAt(dir) {
		t.Fatal("off still leaves attribution enabled")
	}
	if reread, _ := registry(t, dir).Row(KeyAttribution); reread.Value() != "off" {
		t.Fatalf("the reread row lost the persisted choice: %q", reread.Value())
	}
	if err := row.Apply("on"); err != nil {
		t.Fatal(err)
	}
	if !AttributionAt(dir) {
		t.Fatal("on did not turn attribution back on")
	}
	if err := row.Apply("off"); err != nil {
		t.Fatal(err)
	}

	t.Setenv("CODEAF_ATTRIBUTION", "on")
	if !AttributionAt(dir) {
		t.Fatal("the environment lost to the persisted file")
	}
	pinned, _ := registry(t, dir).Row(KeyAttribution)
	if name, isPinned := pinned.PinnedBy(); !isPinned || name != "CODEAF_ATTRIBUTION" {
		t.Fatalf("the attribution row did not report its pin: %q", name)
	}
	t.Setenv("CODEAF_ATTRIBUTION", "off")
	if AttributionAt(dir) {
		t.Fatal("CODEAF_ATTRIBUTION=off did not turn attribution off")
	}
	t.Setenv("CODEAF_ATTRIBUTION", "sure")
	if !AttributionAt(dir) {
		t.Fatal("a malformed pin did not fall back to the default")
	}
}

// THE MODEL'S NAME IN THE `Assisted-by` LINE is on until someone says
// otherwise, off leaves the line bare, and the shell still wins.
func TestTheModelNameRowDefaultsOnAndTurnsOnlyTheNameOff(t *testing.T) {
	dir := t.TempDir()
	t.Setenv("CODEAF_ATTRIBUTION_MODEL", "")
	rows := registry(t, dir)
	row, ok := rows.Row(KeyAttributionModel)
	if !ok {
		t.Fatalf("%s is not registered", KeyAttributionModel)
	}
	if KeyAttributionModel != "attribution.model" || row.Env != "CODEAF_ATTRIBUTION_MODEL" ||
		row.Category != CategoryInterface || row.Kind != SettingBool {
		t.Fatalf("the model-name row = %+v", row)
	}
	if want := "On, commits say `Assisted-by: CodeAF (<model>)`; off, `Assisted-by: CodeAF`."; row.Hint != want {
		t.Fatalf("hint = %q, want %q", row.Hint, want)
	}
	const model = "deepseek/deepseek-v4-flash"
	if row.Value() != "on" || AssistedByModelAt(dir, model) != model {
		t.Fatalf("the model's name is not on by default: %q", row.Value())
	}
	if err := row.Apply("off"); err != nil {
		t.Fatal(err)
	}
	if got := AssistedByModelAt(dir, model); got != "" {
		t.Fatalf("off still hands the line a model: %q", got)
	}
	if reread, _ := registry(t, dir).Row(KeyAttributionModel); reread.Value() != "off" {
		t.Fatalf("the reread row lost the persisted choice: %q", reread.Value())
	}

	t.Setenv("CODEAF_ATTRIBUTION_MODEL", "on")
	if AssistedByModelAt(dir, model) != model {
		t.Fatal("the environment lost to the persisted file")
	}
	pinned, _ := registry(t, dir).Row(KeyAttributionModel)
	if name, isPinned := pinned.PinnedBy(); !isPinned || name != "CODEAF_ATTRIBUTION_MODEL" {
		t.Fatalf("the model-name row did not report its pin: %q", name)
	}
	t.Setenv("CODEAF_ATTRIBUTION_MODEL", "sure")
	if !AttributionModelAt(dir) {
		t.Fatal("a malformed pin did not fall back to the default")
	}
}

func TestSplitPercentClampsAndSavesThroughTheRegistry(t *testing.T) {
	saved := 0
	rows := NewSettings(SettingsOptions{
		ProfileDir:   t.TempDir(),
		SplitPct:     func() int { return saved },
		SaveSplitPct: func(pct int) { saved = pct },
	})
	row, ok := rows.Row(KeySplitPct)
	if !ok {
		t.Fatal("the divider is not registered")
	}
	if got := row.Value(); got != formatPercent(DefaultSplitPct) {
		t.Fatalf("unset divider reads %q", got)
	}
	if err := row.Apply("60"); err != nil || saved != 60 {
		t.Fatalf("apply 60 saved=%d err=%v", saved, err)
	}
	if err := row.Apply("95"); err == nil {
		t.Fatal("the divider accepted a share outside its band")
	}
}

// And the other half of that row: a caller with no divider to move does not get
// a divider row. It used to get one that read a plausible percentage, took a
// new one and answered "chat width is unavailable here" — a control whose only
// behaviour was to refuse, which is the shape this codebase leaves OFF rather
// than shipping broken. The v3 chat is that caller: its roster is a fixed
// column, not a share of the frame.
func TestTheDividerRowIsAbsentWithoutSomewhereToSaveIt(t *testing.T) {
	rows := NewSettings(SettingsOptions{
		ProfileDir: t.TempDir(),
		// The read seam alone, which is what a surface that can only DRAW a
		// divider would hand over.
		SplitPct: func() int { return 60 },
	})
	if _, ok := rows.Row(KeySplitPct); ok {
		t.Fatal("a surface that cannot save the divider was still given the row")
	}
	for _, row := range rows.Rows() {
		if row.Key == KeySplitPct {
			t.Fatal("the divider reached the sheet through Rows()")
		}
	}

	// With the seam it is back, and it is back WHERE IT WAS: at the head of the
	// interface group, ahead of the task-column row it has always sat above.
	full := NewSettings(SettingsOptions{
		ProfileDir:   t.TempDir(),
		SplitPct:     func() int { return 60 },
		SaveSplitPct: func(int) {},
	})
	divider, taskcol := -1, -1
	for index, row := range full.Rows() {
		switch row.Key {
		case KeySplitPct:
			divider = index
		case KeyTaskColumn:
			taskcol = index
		}
	}
	if divider < 0 {
		t.Fatal("a surface that CAN save the divider was not given the row")
	}
	if divider > taskcol {
		t.Fatalf("the divider moved: it is row %d and the task column is row %d", divider, taskcol)
	}
}

// ── the web-search rows ─────────────────────────────────────────────────────

// The provider row is a choice with a working default: a person who has never
// opened the sheet searches, and a value nobody can parse still searches.
func TestSearchProviderDefaultsToAutoAndRefusesAPlugItDoesNotKnow(t *testing.T) {
	dir := t.TempDir()
	rows := registry(t, dir)
	row, ok := rows.Row(KeySearchProvider)
	if !ok {
		t.Fatal("the search provider is not registered")
	}
	if row.Category != CategoryModels || row.Kind != SettingChoice || row.Label != "searching" {
		t.Fatalf("search provider row = %+v", row)
	}
	if row.Value() != SearchProviderAuto || SearchProviderAt(dir) != SearchProviderAuto {
		t.Fatalf("the search provider does not default to auto: %q", row.Value())
	}
	if _, pinned := row.PinnedBy(); pinned {
		t.Fatal("the provider row is pinned by an environment variable; it is a preference, not a secret")
	}

	if err := row.Apply("exa"); err != nil {
		t.Fatal(err)
	}
	if SearchProviderAt(dir) != "exa" {
		t.Fatalf("the pin did not persist: %q", SearchProviderAt(dir))
	}
	reread, _ := registry(t, dir).Row(KeySearchProvider)
	if reread.Value() != "exa" {
		t.Fatalf("the reread row lost the persisted pin: %q", reread.Value())
	}
	if err := reread.Apply("kagi"); err == nil {
		t.Fatal("the row accepted a plug this build does not have")
	}
	if SearchProviderAt(dir) != "exa" {
		t.Fatalf("a refused edit still moved the row: %q", SearchProviderAt(dir))
	}

	// A value written by hand — an older build's plug, a typo — reads as auto
	// rather than as an error. Search must not be takeable away by a stale row.
	if err := writeProfileValue(dir, KeySearchProvider, "yahoo!"); err != nil {
		t.Fatal(err)
	}
	if SearchProviderAt(dir) != SearchProviderAuto {
		t.Fatalf("a stale pin did not fall back to auto: %q", SearchProviderAt(dir))
	}
}

// V3 and V5: the public rows feed one options mapping, and the provider choices
// follow the deliberate built-in order rather than registry init order.
func TestSearchRowsMapToOptionsAndProvidersHaveOneOrder(t *testing.T) {
	for _, env := range []string{"EXA_API_KEY", "FIRECRAWL_API_KEY", "JINA_API_KEY"} {
		t.Setenv(env, "")
	}
	if got, want := strings.Join(SearchProviders, ","), "auto,firecrawl,duckduckgo,exa,jina-search"; got != want {
		t.Fatalf("SearchProviders = %q, want %q", got, want)
	}

	dir := t.TempDir()
	rows := registry(t, dir)
	for key, value := range map[string]string{
		KeySearchProvider: "exa",
		KeyExaKey:         "exa-sheet",
		KeyFirecrawlKey:   "firecrawl-sheet",
		KeyJinaKey:        "jina-sheet",
	} {
		row, ok := rows.Row(key)
		if !ok {
			t.Fatalf("row %q is absent", key)
		}
		if err := row.Apply(value); err != nil {
			t.Fatalf("Apply(%s): %v", key, err)
		}
	}
	opts := SearchOptionsAt(dir)
	if opts.Provider != "exa" || opts.ExaKey != "exa-sheet" || opts.FirecrawlKey != "firecrawl-sheet" || opts.JinaKey != "jina-sheet" {
		t.Fatalf("SearchOptionsAt = %+v", opts)
	}

	auto := t.TempDir()
	if got := SearchOptionsAt(auto).Provider; got != "" {
		t.Fatalf("an untouched auto row became pin %q", got)
	}
}

// V2, V4, and V6: the searching row explains the live next-call state, quotes
// the pinned-key failure exactly, and no search row still promises a session
// restart.
func TestSearchHintsDescribeTheNextCall(t *testing.T) {
	for _, env := range []string{"EXA_API_KEY", "FIRECRAWL_API_KEY", "JINA_API_KEY"} {
		t.Setenv(env, "")
	}
	dir := t.TempDir()
	rows := registry(t, dir)
	if got, want := SearchProviderHintAt(dir), "now firecrawl, keyless — set search.exaKey or search.firecrawlKey to raise it"; got != want {
		t.Fatalf("auto hint = %q, want %q", got, want)
	}

	provider, _ := rows.Row(KeySearchProvider)
	if err := provider.Apply("exa"); err != nil {
		t.Fatal(err)
	}
	if got, want := SearchProviderHintAt(dir), "exa is pinned but search.exaKey is not set — every search answers \"Search failed (exa): no API key\". Choose auto, or set the key."; got != want {
		t.Fatalf("missing-key hint = %q, want %q", got, want)
	}
	exa, _ := rows.Row(KeyExaKey)
	if err := exa.Apply("exa-sheet"); err != nil {
		t.Fatal(err)
	}
	if got, want := SearchProviderHintAt(dir), "exa, with your key"; got != want {
		t.Fatalf("keyed hint = %q, want %q", got, want)
	}

	for _, key := range []string{KeySearchProvider, KeyExaKey, KeyFirecrawlKey, KeyJinaKey} {
		row, _ := rows.Row(key)
		if strings.Contains(strings.ToLower(row.Hint), "next session") || !strings.Contains(strings.ToLower(row.Hint), "next search") {
			t.Errorf("%s hint does not describe the next search: %q", key, row.Hint)
		}
	}
}

// V3: All search credentials are optional, masked when they read, and pinned by the
// vendors' own environment variables.
func TestTheSearchKeysAreOptionalMaskedAndEnvironmentPinned(t *testing.T) {
	for _, credential := range []struct {
		key   string
		env   string
		label string
		read  func(string) string
	}{
		{KeyExaKey, "EXA_API_KEY", "exa key", ExaKeyAt},
		{KeyFirecrawlKey, "FIRECRAWL_API_KEY", "firecrawl key", FirecrawlKeyAt},
		{KeyJinaKey, "JINA_API_KEY", "jina key", JinaKeyAt},
	} {
		t.Run(credential.key, func(t *testing.T) {
			dir := t.TempDir()
			t.Setenv(credential.env, "")
			rows := registry(t, dir)
			row, ok := rows.Row(credential.key)
			if !ok {
				t.Fatalf("%s is not registered", credential.label)
			}
			if row.Category != CategoryModels || row.Kind != SettingText || !row.Secret {
				t.Fatalf("%s row = %+v, want a secret text row", credential.label, row)
			}
			if row.Label != credential.label {
				t.Fatalf("row label = %q, want %q", row.Label, credential.label)
			}

			// Unset is a working configuration and reads as one: the empty
			// label, never a row of bullets standing in for nothing.
			if row.Value() != "not set" || credential.read(dir) != "" {
				t.Fatalf("an unset key reads %q", row.Value())
			}

			if err := row.Apply("secret-key-abcdefgh1234"); err != nil {
				t.Fatal(err)
			}
			if got := credential.read(dir); got != "secret-key-abcdefgh1234" {
				t.Fatalf("the key did not persist whole: %q", got)
			}
			reread, _ := registry(t, dir).Row(credential.key)
			masked := reread.Value()
			if strings.Contains(masked, "secret-key") {
				t.Fatalf("the row rendered the key: %q", masked)
			}
			if !strings.HasSuffix(masked, "1234") || !strings.HasPrefix(masked, "••••") {
				t.Fatalf("the row did not mask to bullets plus a tail: %q", masked)
			}

			// The edit that must not destroy anything: open the row, save what
			// it displayed, keep the key.
			if err := reread.Apply(masked); err != nil {
				t.Fatal(err)
			}
			if got := credential.read(dir); got != "secret-key-abcdefgh1234" {
				t.Fatalf("saving the mask overwrote the key: %q", got)
			}

			// Clearing is still possible, and is the only thing that clears.
			if err := reread.Apply(""); err != nil {
				t.Fatal(err)
			}
			if got := credential.read(dir); got != "" {
				t.Fatalf("an emptied row kept the key: %q", got)
			}

			// The vendor's variable wins, is named, and holds the row.
			t.Setenv(credential.env, "from-the-shell-wxyz")
			if got := credential.read(dir); got != "from-the-shell-wxyz" {
				t.Fatalf("the environment did not win: %q", got)
			}
			pinned, _ := registry(t, dir).Row(credential.key)
			name, isPinned := pinned.PinnedBy()
			if !isPinned || name != credential.env {
				t.Fatalf("%s did not report its pin: %q", credential.label, name)
			}
			if value := pinned.Value(); !strings.HasSuffix(value, "wxyz") || strings.Contains(value, "from-the-shell") {
				t.Fatalf("the pinned row rendered unmasked: %q", value)
			}
			if err := pinned.Apply("another-key"); err == nil || !strings.Contains(err.Error(), name) {
				t.Fatalf("a pinned key accepted an edit: %v", err)
			}
		})
	}
}

// The mask shows enough to tell two keys apart and never enough to use, and it
// never reports a length.
func TestMaskCredentialHidesTheKeyAndItsLength(t *testing.T) {
	short := maskCredential("sk-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
	long := maskCredential("sk-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccc")
	if len([]rune(short)) != len([]rune(long)) {
		t.Fatalf("the mask leaks the key's length: %q vs %q", short, long)
	}
	if short == long {
		t.Fatalf("two different keys mask identically: %q", short)
	}
	if maskCredential("") != "" {
		t.Fatalf("an unset value masked to %q, want nothing", maskCredential(""))
	}
	// Too short to be a key: show none of it rather than most of it.
	if got := maskCredential("abc"); strings.Contains(got, "abc") {
		t.Fatalf("a short value was rendered: %q", got)
	}
}

// The three throttle rows read their defaults, take a person's answer, and hand
// it back to the accessor the session door calls — which is the whole of what a
// settings row has to do.
// THE TWO ROWS THAT ARE NOT CREW SEATS SHIP POINTED AT A MODEL, and the two
// answers a person can give one are different from each other: never touching
// it is this build's own choice, emptying it on purpose is "follow the
// conversation". The crew's three seats ship with NO model: unpinned, a seat is
// routed, and a profile with no provider connected has nothing to route to.
func TestEveryTierShipsWithAModelAndCanStillBeCleared(t *testing.T) {
	dir := t.TempDir()
	row := mustRow(t, registry(t, dir), KeyTierReflexModel)

	if got := TierModelAt(dir, ModelTierReflex); got != DefaultReflexModel {
		t.Fatalf("an untouched profile resolves the reflex tier to %q, want %q", got, DefaultReflexModel)
	}
	if got := row.Value(); got != DefaultReflexModel {
		t.Fatalf("the reflex row reads %q in an untouched profile, want %q", got, DefaultReflexModel)
	}
	if got := TierModelAt(dir, ModelTierLow); got != DefaultLowModel {
		t.Fatalf("the low tier resolves %q in an untouched profile, want %q", got, DefaultLowModel)
	}
	for _, tier := range []string{ModelTierWorker, ModelTierHigh, ModelTierMastermind} {
		if seat := TierSeatAt(dir, tier); seat.Source != SeatRouted {
			t.Fatalf("the %s tier reads %+v in an untouched profile, want a routed seat", tier, seat)
		}
	}

	if err := row.Apply("vendor/tiny"); err != nil {
		t.Fatal(err)
	}
	if got := TierModelAt(dir, ModelTierReflex); got != "vendor/tiny" {
		t.Fatalf("the reflex tier resolves %q after a person wrote vendor/tiny", got)
	}
	if got := mustRow(t, registry(t, dir), KeyTierReflexModel).Value(); got != "vendor/tiny" {
		t.Fatalf("the reflex row reads %q on the next launch", got)
	}

	// Cleared is an ANSWER: the row goes back to its empty label and the tier
	// falls to internal/roles' floor, the model the person is talking to.
	if err := row.Apply(""); err != nil {
		t.Fatalf("clearing the reflex row: %v", err)
	}
	if got := TierModelAt(dir, ModelTierReflex); got != "" {
		t.Fatalf("a cleared reflex row resolves %q, want nothing", got)
	}
	if got := mustRow(t, registry(t, dir), KeyTierReflexModel).Value(); got != "follows the conversation" {
		t.Fatalf("a cleared reflex row reads %q, want its empty label", got)
	}
}

// C27.7 exercises this behaviour without an opt-in switch.
func TestTheTaskThrottleRowsRoundTrip(t *testing.T) {
	celltest.Available(t)
	dir := t.TempDir()
	rows := registry(t, dir)

	// NO LIMIT IS THE DEFAULT, and the row says it in words rather than in a
	// zero: "0 tasks at once" reads like a switch that is off.
	parallel, ok := rows.Row(KeyTaskParallel)
	if !ok {
		t.Fatal("the parallel row is not registered")
	}
	if got := parallel.Value(); got != "no limit" {
		t.Fatalf("unset task.parallel reads %q, want its empty label", got)
	}
	if TaskParallelAt(dir) != DefaultTaskParallel {
		t.Fatalf("unset task.parallel resolves %d, want %d", TaskParallelAt(dir), DefaultTaskParallel)
	}
	if err := parallel.Apply("3"); err != nil {
		t.Fatal(err)
	}
	if got := TaskParallelAt(dir); got != 3 {
		t.Fatalf("task.parallel resolves %d after a person wrote 3", got)
	}
	if got := mustRow(t, registry(t, dir), KeyTaskParallel).Value(); got != "3" {
		t.Fatalf("task.parallel reads %q after a person wrote 3", got)
	}
	// And clearing it is asking for the empty label back, not a parse error.
	if err := parallel.Apply(""); err != nil {
		t.Fatalf("clearing task.parallel: %v", err)
	}
	if TaskParallelAt(dir) != 0 {
		t.Fatalf("a cleared task.parallel resolves %d, want no limit", TaskParallelAt(dir))
	}

	// The load row is a figure and not a count: 1.5 must survive being written.
	load := mustRow(t, rows, KeyTaskMaxLoad)
	if got := load.Value(); got != "1.5" {
		t.Fatalf("unset task.max_load reads %q, want 1.5", got)
	}
	if err := load.Apply("2.25"); err != nil {
		t.Fatal(err)
	}
	if got := TaskMaxLoadAt(dir); got != 2.25 {
		t.Fatalf("task.max_load resolves %v after a person wrote 2.25", got)
	}
	if err := load.Apply("busy"); err == nil {
		t.Fatal("task.max_load accepted a word")
	}
	if err := load.Apply("0"); err != nil || TaskMaxLoadAt(dir) != 0 {
		t.Fatalf("turning the load check off: %v, %v", err, TaskMaxLoadAt(dir))
	}

	// The cell budget takes a fraction of a GB, and shows it back the same way.
	budget := mustRow(t, rows, KeyCellBudget)
	if got := budget.Value(); got != "20" {
		t.Fatalf("unset cell.budget_gb reads %q, want 20", got)
	}
	if err := budget.Apply("0.5"); err != nil || CellBudgetGBAt(dir) != 0.5 {
		t.Fatalf("cell.budget_gb after 0.5: %v, %v", err, CellBudgetGBAt(dir))
	}
	if err := budget.Apply("lots"); err == nil {
		t.Fatal("cell.budget_gb accepted a word")
	}

	memory := mustRow(t, rows, KeyTaskMinFreeMB)
	if got := memory.Value(); got != "1536" {
		t.Fatalf("unset task.min_free_mb reads %q", got)
	}
	if err := memory.Apply("512"); err != nil {
		t.Fatal(err)
	}
	if got := TaskMinFreeMBAt(dir); got != 512 {
		t.Fatalf("task.min_free_mb resolves %d after a person wrote 512", got)
	}
	if err := memory.Apply("-1"); err == nil {
		t.Fatal("task.min_free_mb accepted a negative floor")
	}
}

func mustRow(t *testing.T, rows *Settings, key string) Setting {
	t.Helper()
	row, ok := rows.Row(key)
	if !ok {
		t.Fatalf("%s is not registered", key)
	}
	return row
}

// ── auto update ─────────────────────────────────────────────────────────────

// THE AUTO UPDATE ROW IS FILED WITH WHAT THE MACHINE DOES ON ITS OWN, rather
// than with how the surface draws itself. It used to be filed under the
// interface group and drawn on the Display tab, which is about appearance and
// typing; a person keeping an installation current looks where the machine's
// own work is kept.
func TestTheAutoUpdateRowIsFiledWithThePracticeRows(t *testing.T) {
	registry := NewSettings(SettingsOptions{ProfileDir: t.TempDir()})
	row, ok := registry.Row(KeyUpdateAuto)
	if !ok {
		t.Fatal("the registry has no auto update row")
	}
	if row.Category != CategoryPractice {
		t.Fatalf("auto update is filed under %q, want %q", row.Category, CategoryPractice)
	}
	// THE FIRST SENTENCE SAYS WHAT THE ROW DOES, and the rest says what off
	// means: manual installation, while the one launch check still runs.
	for _, want := range []string{
		"keeps a released codeaf current: a newer stable release installs as codeaf opens",
		"Dev, staging, rc and source builds are never updated on their own.",
		"Off, installation is manual",
		"still checks once",
	} {
		if !strings.Contains(row.Hint, want) {
			t.Fatalf("the hint does not say %q: %s", want, row.Hint)
		}
	}
}

// ── the retired task-start word ─────────────────────────────────────────────

// retiredTaskStartWord is the spelling a profile written before the ONE ROAD
// wave may still be holding. It is a literal here, and deliberately: the whole
// mechanism is that this word exists nowhere in internal/config's own code, so a
// constant offered back to the package would be the thing these tests exist to
// prove is gone.
const retiredTaskStartWord = "adaptive"

// ONE ROAD. `task.start` used to have an answer that opened a planned graph
// before anybody started, and it is gone: a chat turn takes one road for
// ordinary work now, and the two words left both start ONE worker — the
// difference between them is only whether the brief is read for width first.
func TestTaskStartOffersOnlyTheTwoSurvivingWords(t *testing.T) {
	if got := strings.Join(TaskStartModes, ","); got != "sized,single" {
		t.Fatalf("the modes are %q, want the two surviving words with the default first", got)
	}
	row, ok := registry(t, t.TempDir()).Row(KeyTaskStart)
	if !ok {
		t.Fatal("the sheet has no starting-a-task row")
	}
	if strings.Join(row.Choices, ",") != strings.Join(TaskStartModes, ",") {
		t.Fatalf("the row offers %v, which is not the list every other reader takes", row.Choices)
	}
	// AND THE HINT DOES NOT DESCRIBE A ROAD NOBODY CAN TAKE. The hint is the
	// whole of what a person reads before answering, so a sentence about
	// planning the pieces up front would be the sheet advertising a word the
	// row itself refuses.
	if strings.Contains(row.Hint, retiredTaskStartWord) {
		t.Errorf("the hint still describes the retired word: %s", row.Hint)
	}
	// A WRITE OF IT IS REFUSED, in the words the row accepts in, and the refusal
	// does not name it either.
	err := row.Apply(retiredTaskStartWord)
	if err == nil {
		t.Fatal("the row accepted the retired word")
	}
	if strings.Contains(err.Error(), retiredTaskStartWord) {
		t.Errorf("the refusal offers the retired word back: %v", err)
	}
}

// A PREFERENCE SET MONTHS AGO MAY NOT BECOME AN ERROR. Somebody who chose the
// planned road once has a config.json still holding the word; the retirement is
// paid for by the resolver, which reads a word this build does not know as no
// answer at all — so the profile loads clean, the row reads `sized`, and nobody
// is told anything about a decision they made and forgot.
func TestAProfileStillHoldingTheRetiredWordReadsAsSized(t *testing.T) {
	dir := t.TempDir()
	if err := writeProfileValue(dir, KeyTaskStart, retiredTaskStartWord); err != nil {
		t.Fatalf("could not write the old profile: %v", err)
	}
	if got := TaskStartAt(dir); got != TaskStartSized {
		t.Fatalf("the old profile resolves to %q, want %q", got, TaskStartSized)
	}
	row, ok := registry(t, dir).Row(KeyTaskStart)
	if !ok {
		t.Fatal("the sheet has no starting-a-task row")
	}
	// AND THE SHEET SAYS THE SAME THING THE RESOLVER DOES. A row that read back
	// the retired word over a session that is running the default would be the
	// settings sheet lying in the one place somebody went to check.
	if got := row.Value(); got != TaskStartSized {
		t.Fatalf("the row reads %q over a session running %q", got, TaskStartSized)
	}
}

// THE ROW HAS TO BE ABLE TO SAY "NOBODY ANSWERED". The settings sheet asks what
// is in force and is owed the shipped row; the adapter asks whether a person
// CHOSE, and the difference is what lets a client handed nothing fall to the row
// this process installed while a written word still wins (internal/provider's
// velocity.go).
func TestTheRoutingRowReadsAsAChoiceAndAsAnAnswer(t *testing.T) {
	dir := t.TempDir()
	if got := RoutingAt(dir); got != DefaultRouting {
		t.Fatalf("an unwritten row is in force as %q, want %q", got, DefaultRouting)
	}
	if got := RoutingChoiceAt(dir); got != "" {
		t.Fatalf("an unwritten row reads as the choice %q, want nobody having chosen", got)
	}
	if err := writeProfileValue(dir, KeyRouting, RoutingPrice); err != nil {
		t.Fatalf("write: %v", err)
	}
	if got := RoutingChoiceAt(dir); got != RoutingPrice {
		t.Fatalf("the written row reads as %q, want %q", got, RoutingPrice)
	}
	if got := RoutingAt(dir); got != RoutingPrice {
		t.Fatalf("the written row is in force as %q, want %q", got, RoutingPrice)
	}
	// A word this build does not know is nobody's choice either, and the sheet
	// still reads the default rather than an error.
	if err := writeProfileValue(dir, KeyRouting, "sideways"); err != nil {
		t.Fatalf("write: %v", err)
	}
	if got := RoutingChoiceAt(dir); got != "" {
		t.Fatalf("a word this build does not know read as the choice %q", got)
	}
	if got := RoutingAt(dir); got != DefaultRouting {
		t.Fatalf("a word this build does not know is in force as %q, want %q", got, DefaultRouting)
	}
}

// ── THE SPEND RAILS ─────────────────────────────────────────────────────────
//
// Two facts about every money row, pinned together because they are one
// decision: the shipped number is LARGE — a rail nobody chose must be a
// backstop against a runaway and never the thing that interrupts ordinary work
// — and the row says out loud what zero means, because "$0" on a ceiling reads
// as the opposite of what the code does with it.

// TestSpendRailsShipLargeEnoughNotToHinder is the guard on the raise itself. It
// is written as floors and not as equalities on purpose: raising a rail further
// is always allowed, and only a quiet DROP back towards the figures that made
// codeaf stop mid-errand ($20 a day, a $3 consent gate, a 15-cent standing
// firing) is the regression worth a failing build.
func TestSpendRailsShipLargeEnoughNotToHinder(t *testing.T) {
	floors := []struct {
		what  string
		value float64
		floor float64
	}{
		{"the daily rail", DefaultDailyBudgetUSD, 500},
		{"the plan consent gate", DefaultPlanConsentUSD, 100},
		{"the lifted-tier cap", taxonomy.DefaultTierCapUSD, 25},
		{"an automation's per-run rail", automation.DefaultUSD, 5},
	}
	for _, floor := range floors {
		if floor.value < floor.floor {
			t.Fatalf("%s ships at $%v, under the $%v this build promises",
				floor.what, floor.value, floor.floor)
		}
	}
	// The session ceiling is the one rail that ships OFF rather than large, and
	// that is the same promise said the other way: a default here would box in
	// every sitting at a number nobody chose.
	if DefaultSpendRailUSD != 0 {
		t.Fatalf("the session ceiling ships at $%v, want it off", DefaultSpendRailUSD)
	}
}

// TestEveryMoneyRowReadsItsNewDefaultAndSaysWhatZeroMeans walks the three rows
// a person actually turns. For each it checks the shipped reading against the
// constant that owns it — one source of truth, so a raise that forgot the row
// fails here — and then writes 0 and reads the row back.
//
// THE WORD MOVED FROM THE RECEIPT TO THE VALUE and this test moved with it. A
// row at zero used to read `$0` with `no limit` beside it, which is the emptiness
// law asking a person to read two things to learn one; it now reads `no limit`
// itself, through [Setting.EmptyLabel] — the mechanism every other kind of row
// already uses for its off state — and `$0` appears nowhere at all.
func TestEveryMoneyRowReadsItsNewDefaultAndSaysWhatZeroMeans(t *testing.T) {
	for _, name := range []string{
		"CODEAF_DAILY_BUDGET", "CODEAF_PLAN_CONSENT",
	} {
		t.Setenv(name, "")
	}
	rails := []struct {
		key      string
		shipped  float64
		zeroSays string
	}{
		{KeyDailyBudget, DefaultDailyBudgetUSD, noLimitWord},
		{KeyPlanConsent, DefaultPlanConsentUSD, "never asks"},
		{KeySpendRail, DefaultSpendRailUSD, noLimitWord},
	}
	for _, rail := range rails {
		dir := t.TempDir()
		rows := registry(t, dir)
		row, ok := rows.Row(rail.key)
		if !ok {
			t.Fatalf("%s is not registered", rail.key)
		}
		want := formatDollars(rail.shipped)
		if rail.shipped == 0 {
			// A rail that SHIPS at zero ships with no limit, and reads the word
			// for it rather than a figure nobody set.
			want = rail.zeroSays
		}
		if got := row.Value(); got != want {
			t.Fatalf("%s ships reading %q, want %q — the row and the constant have drifted",
				rail.key, got, want)
		}
		if err := row.Apply("0"); err != nil {
			t.Fatalf("%s could not be set to 0: %v", rail.key, err)
		}
		reread, ok := registry(t, dir).Row(rail.key)
		if !ok {
			t.Fatalf("%s went missing after a write", rail.key)
		}
		if reread.Value() != rail.zeroSays {
			t.Fatalf("%s reads %q after being set to 0, want %q", rail.key, reread.Value(), rail.zeroSays)
		}
		if strings.Contains(reread.Value(), "$0") {
			t.Fatalf("%s draws a bare zero: %q", rail.key, reread.Value())
		}
		// AND EVERY WORD A PERSON MIGHT TYPE FOR IT LANDS THE SAME THING.
		for _, word := range []string{"none", "no", "off", "unlimited", "∞", "0"} {
			if err := mustRow(t, registry(t, dir), rail.key).Apply(word); err != nil {
				t.Fatalf("%s refused %q: %v", rail.key, word, err)
			}
			if got := mustRow(t, registry(t, dir), rail.key).Value(); got != rail.zeroSays {
				t.Fatalf("%s reads %q after %q, want %q", rail.key, got, word, rail.zeroSays)
			}
		}
		// And a rail that is ON says nothing extra: the receipt is for the
		// state a number cannot express, never a second copy of the value.
		if err := reread.Apply("12.50"); err != nil {
			t.Fatalf("%s could not be set back: %v", rail.key, err)
		}
		if got := mustRow(t, registry(t, dir), rail.key).Receipt(); got != "" {
			t.Fatalf("%s at $12.50 grew a receipt with no seam behind it: %q", rail.key, got)
		}
	}
}

// TestTheDailyRailReceiptIsTheDaysOwnFigure. The receipt is a LIVE FACT beside
// the value and never a second copy of it: the word for zero is the value now
// ([Setting.EmptyLabel]), which leaves this column free to say the one thing a
// person came to the row to read — what the day has actually cost.
func TestTheDailyRailReceiptIsTheDaysOwnFigure(t *testing.T) {
	t.Setenv("CODEAF_DAILY_BUDGET", "")
	dir := t.TempDir()
	rows := NewSettings(SettingsOptions{
		ProfileDir:    dir,
		ModelValue:    func(slot string) string { return slot + "/model" },
		SetModel:      func(string, string) error { return nil },
		SplitPct:      func() int { return 0 },
		SpentTodayUSD: func() (float64, bool) { return 4.25, true },
	})
	if got := mustRow(t, rows, KeyDailyBudget).Receipt(); got != "$4.25 today" {
		t.Fatalf("the shipped rail's receipt = %q", got)
	}
	if err := mustRow(t, rows, KeyDailyBudget).Apply("0"); err != nil {
		t.Fatal(err)
	}
	rows = NewSettings(SettingsOptions{
		ProfileDir:    dir,
		ModelValue:    func(slot string) string { return slot + "/model" },
		SetModel:      func(string, string) error { return nil },
		SplitPct:      func() int { return 0 },
		SpentTodayUSD: func() (float64, bool) { return 4.25, true },
	})
	if got := mustRow(t, rows, KeyDailyBudget).Receipt(); got != "$4.25 today" {
		t.Fatalf("a removed rail's receipt = %q", got)
	}
	if got := mustRow(t, rows, KeyDailyBudget).Value(); got != NoLimitWord {
		t.Fatalf("a removed rail reads %q, want %q", got, NoLimitWord)
	}
}

// TestTheConversationCeilingCarriesWhatThisOneHasSpent is the other receipt: the
// row that bounds THIS conversation says what this conversation has spent
// against it, and says nothing at all through a door that has no conversation
// behind it.
func TestTheConversationCeilingCarriesWhatThisOneHasSpent(t *testing.T) {
	dir := t.TempDir()
	rows := NewSettings(SettingsOptions{ProfileDir: dir,
		SpentThisSessionUSD: func() (float64, bool) { return 0.41, true }})
	if got := mustRow(t, rows, KeySpendRail).Receipt(); got != "this one $0.41" {
		t.Fatalf("the ceiling's receipt = %q", got)
	}
	blind := NewSettings(SettingsOptions{ProfileDir: dir})
	if got := mustRow(t, blind, KeySpendRail).Receipt(); got != "" {
		t.Fatalf("a door with no conversation behind it invented a receipt: %q", got)
	}
	quiet := NewSettings(SettingsOptions{ProfileDir: dir,
		SpentThisSessionUSD: func() (float64, bool) { return 0, true }})
	if got := mustRow(t, quiet, KeySpendRail).Receipt(); got != "" {
		t.Fatalf("a conversation that has spent nothing said %q", got)
	}
}

// TestTheThreeCategoriesSpendingLeftBehind. `spending` had grown to hold what
// may be spent, what may be run without asking, and how tasks are run — and a
// person looking for the first read about the third. The split is the registry's
// own, so every surface over it gets the same three sections.
func TestTheThreeCategoriesSpendingLeftBehind(t *testing.T) {
	rows := registry(t, t.TempDir())
	want := map[string]string{
		KeyDailyBudget:      CategorySpending,
		KeyPlanConsent:      CategorySpending,
		KeySpendRail:        CategorySpending,
		KeyToolApprovalMode: CategorySafety,
		KeyGuardian:         CategorySafety,
		KeyConsentTimeout:   CategorySafety,
		KeyTaskSettle:       CategorySafety,
		KeyTaskAutoApprove:  CategorySafety,
		KeyTaskStart:        CategoryTasks,
		KeyTaskAudit:        CategoryTasks,
		KeyTaskParallel:     CategoryTasks,
		KeyTaskModel:        CategoryTasks,
	}
	for key, category := range want {
		if got := mustRow(t, rows, key).Category; got != category {
			t.Errorf("%s is filed under %q, want %q", key, got, category)
		}
	}
	// AND NOTHING THAT IS NOT MONEY IS LEFT ON SPENDING.
	for _, row := range rows.Rows() {
		if row.Category == CategorySpending && row.Kind != SettingDollars {
			t.Errorf("%s is on the spending category and is not a dollar figure", row.Key)
		}
	}
}

// TestZeroMeansNoLimitEverywhereARailIsEnforced is the other half of the
// promise, checked where the number is READ rather than where it is shown: a
// row that says "no limit" over machinery that still stops the work would be
// the worst of the three possible states.
func TestZeroMeansNoLimitEverywhereARailIsEnforced(t *testing.T) {
	t.Setenv("CODEAF_DAILY_BUDGET", "0")
	dir := t.TempDir()
	if rail, err := DailyBudgetUSDAt(dir); err != nil || rail != 0 {
		t.Fatalf("the daily rail refused 0: %v %v", rail, err)
	}
	t.Setenv("CODEAF_PLAN_CONSENT", "0")
	if gate, err := PlanConsentUSDAt(dir); err != nil || gate != 0 {
		t.Fatalf("the consent gate refused 0: %v %v", gate, err)
	}
	t.Setenv("CODEAF_RESPONSE_LIFT_CAP", "0")
	if cap := ResponseLiftCapAt(dir); cap != 0 {
		t.Fatalf("the lifted-tier cap refused 0: %v", cap)
	}
	// A persisted 0 must survive a restart on every one of them, which is the
	// bug this shape exists for: a reader that tested the NUMBER before it
	// tested whether a value was written at all would hand back the default
	// and quietly put a ceiling back over somebody who removed one.
	for _, name := range []string{"CODEAF_DAILY_BUDGET", "CODEAF_PLAN_CONSENT", "CODEAF_RESPONSE_LIFT_CAP"} {
		t.Setenv(name, "")
	}
	for _, key := range []string{KeyDailyBudget, KeyPlanConsent, KeySpendRail, KeyResponseLiftCap} {
		if err := writeProfileValue(dir, key, 0.0); err != nil {
			t.Fatalf("write %s: %v", key, err)
		}
	}
	if rail, err := DailyBudgetUSDAt(dir); err != nil || rail != 0 {
		t.Fatalf("a persisted daily 0 read back as %v (%v)", rail, err)
	}
	if gate, err := PlanConsentUSDAt(dir); err != nil || gate != 0 {
		t.Fatalf("a persisted consent 0 read back as %v (%v)", gate, err)
	}
	if rail := SpendRailUSDAt(dir); rail != 0 {
		t.Fatalf("a persisted session 0 read back as %v", rail)
	}
	if cap := ResponseLiftCapAt(dir); cap != 0 {
		t.Fatalf("a persisted lift cap of 0 read back as %v", cap)
	}
}

// V1: A fresh profile gets the fifteen-second proposal window, while explicit
// five-second and no-clock values survive persistence unchanged.
func TestTaskCountdownDefaultAndPersistedValues(t *testing.T) {
	dir := t.TempDir()
	if got := TaskAutoApproveAt(dir); got != 15 {
		t.Fatalf("fresh task countdown = %d, want 15", got)
	}
	if err := writeProfileValue(dir, KeyTaskAutoApprove, 5); err != nil {
		t.Fatalf("persist 5: %v", err)
	}
	if got := TaskAutoApproveAt(dir); got != 5 {
		t.Fatalf("persisted task countdown = %d, want 5", got)
	}
	if err := writeProfileValue(dir, KeyTaskAutoApprove, 0); err != nil {
		t.Fatalf("persist 0: %v", err)
	}
	if got := TaskAutoApproveAt(dir); got != 0 {
		t.Fatalf("persisted no-clock value = %d, want 0", got)
	}
}

// THE PROMPT PROFILE IS A ROW NOW, and this is the round trip: three words, a
// default that decides nothing, a persisted choice that survives a reread, and
// a pin that holds the row read-only for one launch.
//
// The last case is the one worth writing down. Every other pinned row in this
// sheet reads a word it does not recognise as its own default; this one falls
// through to the person's choice instead, because the engine already rules that
// an unrecognised pin is not a pin (internal/session's promptprofile.go), and a
// sheet that answered differently would put two laws on one variable.
func TestThePromptProfileRowRoundTripsAndItsPinWinsForOneLaunch(t *testing.T) {
	dir := t.TempDir()
	t.Setenv(EnvPromptProfile, "")
	row, ok := registry(t, dir).Row(KeyPromptProfile)
	if !ok {
		t.Fatal("the prompt profile is not registered")
	}
	if row.Category != CategoryModels || row.Kind != SettingChoice || row.Label != "prompt profile" {
		t.Fatalf("the prompt profile row = %+v", row)
	}
	if want := []string{PromptProfileAuto, PromptProfileLean, PromptProfileFull}; !slices.Equal(row.Choices, want) {
		t.Fatalf("the row offers %v, want %v", row.Choices, want)
	}
	if row.Value() != PromptProfileAuto || PromptProfileAt(dir) != PromptProfileAuto {
		t.Fatalf("the prompt profile does not default to auto: %q", row.Value())
	}
	if err := row.Apply("nearly"); err == nil {
		t.Fatal("the row took a word that is not one of its three")
	}

	if err := row.Apply("lean"); err != nil {
		t.Fatal(err)
	}
	if got := PromptProfileAt(dir); got != PromptProfileLean {
		t.Fatalf("lean did not persist: %q", got)
	}
	reread, _ := registry(t, dir).Row(KeyPromptProfile)
	if reread.Value() != PromptProfileLean {
		t.Fatalf("the reread row lost the persisted choice: %q", reread.Value())
	}

	t.Setenv(EnvPromptProfile, "full")
	if got := PromptProfileAt(dir); got != PromptProfileFull {
		t.Fatalf("the pin lost to the persisted row: %q", got)
	}
	pinned, _ := registry(t, dir).Row(KeyPromptProfile)
	name, isPinned := pinned.PinnedBy()
	if !isPinned || name != EnvPromptProfile {
		t.Fatalf("the prompt profile row did not report its pin: %q", name)
	}
	if err := pinned.Apply("lean"); err == nil || !strings.Contains(err.Error(), name) {
		t.Fatalf("a pinned prompt profile accepted an edit: %v", err)
	}

	// AND A WORD THE LIST DOES NOT HAVE IS NOT AN ANSWER, so the row the person
	// chose still stands rather than being cancelled by a typo in their shell.
	t.Setenv(EnvPromptProfile, "leaner")
	if got := PromptProfileAt(dir); got != PromptProfileLean {
		t.Fatalf("a mistyped pin overrode the persisted row: %q", got)
	}
}

// The Model Pool row: the stored word the pool resolver takes, the pin beside
// it, and the resolver's own reading of both. The three choices are the same
// three words poolcfg.Resolve accepts from the environment, so a row and a
// shell spell one thing — and the resolver in this package is the one place
// the process environment is read for the pool.
func TestTheModelPoolRowDefaultsToOffAndFollowsItsStoredWordAndItsPin(t *testing.T) {
	dir := t.TempDir()
	t.Setenv("CODEAF_MODEL_POOL", "")
	t.Setenv("CI", "")
	// The telemetry off switch quiets the pool to `read` (ModelPoolResolved),
	// so a shell that exports it would make this untouched profile read as a
	// touched one. The test is about the row, not the shell it runs in.
	t.Setenv("CODEAF_TELEMETRY", "")
	t.Setenv("DO_NOT_TRACK", "")
	rows := registry(t, dir)
	row, ok := rows.Row(KeyModelPool)
	if !ok {
		t.Fatal("the model pool is not registered")
	}
	if row.Category != CategoryModels || row.Kind != SettingChoice || row.Label != "model pool" {
		t.Fatalf("model pool row = %+v", row)
	}
	if row.Value() != "off" {
		t.Fatalf("the pool does not default to off: %q", row.Value())
	}
	if got := ModelPoolAt(dir); got.Mode != poolcfg.Off || got.Source.Mode != "default" {
		t.Fatalf("an untouched profile resolved %+v", got)
	}

	if err := row.Apply("read"); err != nil {
		t.Fatal(err)
	}
	reread, _ := registry(t, dir).Row(KeyModelPool)
	if reread.Value() != "read" {
		t.Fatalf("the reread row lost the persisted choice: %q", reread.Value())
	}
	if got := ModelPoolAt(dir); got.Mode != poolcfg.Read || got.Source.Mode != "setting" {
		t.Fatalf("the stored word did not take: %+v", got)
	}
	if err := reread.Apply("maybe"); err == nil || !strings.Contains(err.Error(), "on, read, off") {
		t.Fatalf("the row accepted a word it does not take: %v", err)
	}
	if ModelPoolAt(dir).Mode != poolcfg.Read {
		t.Fatal("a refused edit still moved the row")
	}

	// The pin outranks the stored word, the row reports it, and a pinned row
	// refuses to be edited the way every other pinned row refuses.
	t.Setenv("CODEAF_MODEL_POOL", "off")
	pinned, _ := registry(t, dir).Row(KeyModelPool)
	if name, isPinned := pinned.PinnedBy(); !isPinned || name != "CODEAF_MODEL_POOL" {
		t.Fatalf("the pool row did not report its pin: %q %v", name, isPinned)
	}
	if got := ModelPoolAt(dir); got.Mode != poolcfg.Off || got.Source.Mode != "env" {
		t.Fatalf("the pin lost: %+v", got)
	}
	if err := pinned.Apply("on"); err == nil || !strings.Contains(err.Error(), "CODEAF_MODEL_POOL") {
		t.Fatalf("a pinned pool row accepted an edit: %v", err)
	}

	// A word nobody set the row to on purpose — an older build's word, a
	// hand-typed typo — reads as the default rather than as an error, the way
	// [SearchProviderAt] reads "yahoo!" as auto.
	t.Setenv("CODEAF_MODEL_POOL", "")
	if err := writeProfileValue(dir, KeyModelPool, "maybe"); err != nil {
		t.Fatal(err)
	}
	if got := ModelPoolAt(dir); got.Mode != poolcfg.Off {
		t.Fatalf("a stale word did not fall back to off: %+v", got)
	}
}

// Saved choices must outlast changes to the shipped approval default.
func TestToolApprovalDefaultIsYoloWithoutReplacingSavedChoices(t *testing.T) {
	if got := ToolApprovalModeAt(t.TempDir()); got != "allow" {
		t.Fatalf("fresh profile = %q, want allow", got)
	}
	for _, mode := range []string{"prompt", "allow", "deny", "invalid"} {
		t.Run(mode, func(t *testing.T) {
			dir := profileWith(t, map[string]any{KeyToolApprovalMode: mode})
			want := mode
			if mode == "invalid" {
				want = "prompt"
			}
			if got := ToolApprovalModeAt(dir); got != want {
				t.Fatalf("saved %q resolved to %q, want %q", mode, got, want)
			}
		})
	}
}

func TestHeadlessApprovalHonorsExplicitSettingsAndRejectsMalformedValues(t *testing.T) {
	for _, value := range []any{"allow", "deny", "prompt", "nonsense", true, 42} {
		profile := profileWith(t, map[string]any{KeyToolApprovalMode: value})
		want := "prompt"
		if value == "allow" || value == "deny" {
			want = value.(string)
		}
		got, err := HeadlessToolApprovalModeAt(t.TempDir(), profile)
		if err != nil || got != want {
			t.Fatalf("saved %v: %s %v, want %s", value, got, err, want)
		}
		if ToolApprovalModeAt(profile) != want {
			t.Fatalf("interactive malformed fallback changed for %v", value)
		}
	}
}

// THE TASK MODEL ROW SAYS WHAT PICKS A TASK'S MODEL. Blank, a task's worker is
// the crew's — a pin, or the model picked for that task — never the model the
// conversation is on, so the row does not say it follows the conversation.
func TestTheTaskModelRowSaysTheCrewPicksWhenBlank(t *testing.T) {
	dir := t.TempDir()
	row := mustRow(t, registry(t, dir), KeyTaskModel)
	if got := row.Value(); got != "the crew's worker" {
		t.Fatalf("a blank task model row reads %q", got)
	}
	if !strings.Contains(row.Hint, "/crew") || strings.Contains(row.Hint, "the model you are talking to when") {
		t.Fatalf("the task model row's hint: %q", row.Hint)
	}
}