"""P13 okf/guard version-guard — a TEST-TIME tripwire on the two Door A pins, + the install half.

Door A depends on ``llm-ingestion-okf``'s PUBLIC surface (27 names across five modules, imported by
``ingest.py``/``ingest_mcp.py``) and, through it, on ``llm-ingestion-guard``'s ``okf`` adapter.
Neither is pinned by a version RANGE in ``pyproject.toml`` — both are git tag pins — so the tag IS
the pin and EQUALITY is the right predicate here, not a floor: there is no declared range for a
newer release to sit inside, so any movement is a decision, never maintenance. That is the one shape
difference from ``test_maf_version_guard``, whose ``pyproject`` really does declare
``>=1.18.0,<2``.

A grep on ``pyproject.toml`` alone would be blind to an environment that drifted from the lock (a
stale ``.venv``, a shadowing tool install), and a version assert alone would be blind to a lock that
drifted from the declared pin. This guard is both halves.

**Why the pins are still 0.3.2 / 0.3.4 after P13 measured 0.8.5 / 1.4.0.** The lift was built and
run in a worktree on 2026-09-12 and it is NOT green: okf 0.8.5 emits the V1 provenance stamp
``generated: { by: process:okf-ingest, at: <ingested_at> }`` where 0.3.2 emitted ``generated: true``.
Eight tests go red on that ONE line, and — the finding that decides it — ``okf.
_carries_complete_ingest_stamp`` returns ``False`` for the new form while the whole suite stays
green on that seam, so the ``write_concept_file`` forgery refusal would land DISARMED. The refusal
messages below name that, because a pin whose reason lives only in prose is a pin the next session
lifts without re-measuring. Full numbers: ``docs/2026-09-12-p13-okf-pin-r761.md``.
"""

from __future__ import annotations

import importlib.metadata
from pathlib import Path

import pytest

_OKF_DIST = "llm-ingestion-okf"
_GUARD_DIST = "llm-ingestion-guard"

#: The measured-green pins. ONE place each; the ``pyproject`` asserts DERIVE their expected strings
#: from these (the kø-(p) rule) — two literals for one fact drift, and a drifted pin is a guard that
#: stops guarding without a local diff.
_OKF_PINNED = "0.3.2"
_GUARD_PINNED = "0.3.4"

_OKF_LIFT_COST = (
    "P13 measured the lift to 0.8.5 in a worktree: 27/27 imported names still resolve, both demo "
    "goldens stay byte-identical and ruff/mypy pass, but the emitted stamp moves from "
    "'generated: true' to the V1 flow mapping 'generated: { by: ..., at: ... }'. Eight tests go "
    "red on that one line (four examples/ingest-golden-* byte goldens over seven concept files, "
    "plus four 'generated == \"true\"' asserts), and okf._carries_complete_ingest_stamp reads the "
    "new form as NOT a stamp — so write_concept_file's forgery refusal would ship disarmed with "
    "the suite green. Close that first; see docs/2026-09-12-p13-okf-pin-r761.md."
)

_GUARD_LIFT_COST = (
    "The guard's 1.0.0 freeze covers the exported SURFACE only: severities, thresholds and the "
    "dispositions they produce are explicitly calibration and move within 1.x. "
    "ingest._ACCEPTED_DISPOSITION reads 'warn' as the lowest tier a clean concept scores — "
    "re-measure it before lifting. Note also that okf >=0.8.5 pins this library itself via "
    "[tool.uv.sources] tag = 'v1.4.0', so a consumer cannot choose a lower 1.x, and must spell its "
    "own pin with tag= rather than rev= or uv refuses the resolution as conflicting URLs."
)


def assert_pinned_okf_version(version_str: str) -> None:
    """Raise ``ValueError`` unless ``version_str`` is the pinned okf tag, naming the measured cost
    of the lift. Pure string compare — no import side effects, so a version can be passed directly
    (the RED-proof) without touching the real install."""
    if version_str != _OKF_PINNED:
        raise ValueError(
            f"{_OKF_DIST} {version_str} is not the pinned {_OKF_PINNED}. {_OKF_LIFT_COST}"
        )


def assert_pinned_guard_version(version_str: str) -> None:
    """Raise ``ValueError`` unless ``version_str`` is the pinned guard tag, naming the premise the
    surface freeze does NOT cover."""
    if version_str != _GUARD_PINNED:
        raise ValueError(
            f"{_GUARD_DIST} {version_str} is not the pinned {_GUARD_PINNED}. {_GUARD_LIFT_COST}"
        )


def test_installed_okf_version_is_the_pinned_one() -> None:
    """The control for both refusal arms below: the REAL installed distribution passes, read from
    ``importlib.metadata`` — what is in the environment, not what the lock says should be."""
    assert_pinned_okf_version(importlib.metadata.version(_OKF_DIST))


def test_installed_guard_version_is_the_pinned_one() -> None:
    """Same control, for the guard."""
    assert_pinned_guard_version(importlib.metadata.version(_GUARD_DIST))


def test_okf_guard_trips_on_the_measured_lift_and_on_its_neighbours() -> None:
    """``0.8.5`` is the release P13 actually measured; ``0.4.0`` is where the guard first became a
    hard runtime dependency of okf; ``0.8.4`` and ``0.9.0`` bracket the measured one, so a
    neighbouring tag cannot slip in under a range this pin does not have."""
    for other in ("0.4.0", "0.7.0", "0.8.4", "0.8.5", "0.9.0", "1.0.0"):
        with pytest.raises(ValueError, match="write_concept_file"):
            assert_pinned_okf_version(other)


def test_guard_version_guard_trips_on_the_lift_okf_would_force() -> None:
    """``1.4.0`` is the tag okf 0.8.5 forces (it pins this library itself); ``1.2.0`` is the lowest
    1.x satisfying okf's declared ``>=1.2,<2.0`` and is NOT choosable for that reason; ``2.0.0`` is
    where the surface freeze ends."""
    for other in ("0.3.3", "1.2.0", "1.4.0", "2.0.0"):
        with pytest.raises(ValueError, match="calibration"):
            assert_pinned_guard_version(other)


def test_pyproject_pins_both_tags() -> None:
    """The install-time half. The expected strings are DERIVED from the pins above so the two halves
    cannot drift apart."""
    pyproject = (Path(__file__).resolve().parents[1] / "pyproject.toml").read_text(encoding="utf-8")
    assert f'llm-ingestion-okf.git", rev = "v{_OKF_PINNED}" }}' in pyproject
    assert f'llm-ingestion-pipeline-security.git", rev = "v{_GUARD_PINNED}" }}' in pyproject