#!/usr/bin/env bash
# B5 (ruled 2026-08-29, orch-01-adopted): pr-merge --base-line — the
# documented intra-line exception. Arms:
#   1. Base neither main nor next, no flag: policy refusal (rc 1), queue
#      guard NOT invoked, hint names the exception.
#   2. Base neither main nor next, matching --base-line: authorized; the
#      queue guard IS invoked with the same args (rc from the stub proves
#      gates still run) and the audit line is emitted.
#   3. Mismatched --base-line (different branch than the PR base): refusal
#      rc 1 with the mismatch named; queue guard NOT invoked.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-merge-baseline}"
FIXTURE_DIR="$WORK_DIR/tools/git"
CALL_LOG="$WORK_DIR/queue-call.log"
OUT_LOG="$WORK_DIR/out.log"

rm -rf "$WORK_DIR"
mkdir -p "$FIXTURE_DIR"
cp "$SCRIPT_DIR/pr-merge.sh" "$FIXTURE_DIR/pr-merge.sh"
cp "$SCRIPT_DIR/detect-platform.sh" "$FIXTURE_DIR/detect-platform.sh"

cat > "$FIXTURE_DIR/pr-metadata.sh" <<'SH'
#!/usr/bin/env bash
printf '%s\n' '{"baseRefName":"mosaic-cli-p0","baseRepository":"mosaicstack/stack","headRefName":"mosaic-cli-p2-socket-res","headRefOid":"0123456789abcdef0123456789abcdef01234567","headRepository":"mosaicstack/stack"}'
SH

cat > "$FIXTURE_DIR/ci-queue-wait.sh" <<'SH'
#!/usr/bin/env bash
printf '%s\n' "$*" > "${MOSAIC_QUEUE_CALL_LOG:?}"
exit 42
SH
chmod +x "$FIXTURE_DIR"/*.sh

run_case() { # run_case <extra-args...>
    : > "$CALL_LOG"
    set +e
    (
        cd "$WORK_DIR"
        export MOSAIC_QUEUE_CALL_LOG="$CALL_LOG"
        "$FIXTURE_DIR/pr-merge.sh" -n 123 "$@"
    ) >"$OUT_LOG" 2>&1
    rc=$?
    set -e
}

# 1. No flag: policy refusal, no gate invocation.
run_case
[[ "$rc" -eq 1 ]] || { echo "FAIL arm1: rc=$rc want 1" >&2; cat "$OUT_LOG" >&2; exit 1; }
[[ ! -s "$CALL_LOG" ]] || { echo "FAIL arm1: queue guard ran without authorization" >&2; exit 1; }
grep -q "only for PRs targeting" "$OUT_LOG" || { echo "FAIL arm1: policy message missing" >&2; exit 1; }
grep -q -- "--base-line 'mosaic-cli-p0'" "$OUT_LOG" || { echo "FAIL arm1: hint missing" >&2; exit 1; }

# 2. Matching flag: authorized, audit line emitted, gates RUN (stub rc 42).
run_case --base-line mosaic-cli-p0
[[ "$rc" -eq 42 ]] || { echo "FAIL arm2: rc=$rc want 42 (gate stub rc must propagate)" >&2; cat "$OUT_LOG" >&2; exit 1; }
[[ -s "$CALL_LOG" ]] || { echo "FAIL arm2: queue guard NOT invoked despite authorization" >&2; exit 1; }
grep -q -- '-B mosaic-cli-p2-socket-res' "$CALL_LOG" || { echo "FAIL arm2: guard args wrong" >&2; cat "$CALL_LOG" >&2; exit 1; }
grep -q "base-line exception" "$OUT_LOG" || { echo "FAIL arm2: audit line missing" >&2; exit 1; }

# 3. Mismatched flag: refusal, mismatch named, no gate invocation.
run_case --base-line some-other-line
[[ "$rc" -eq 1 ]] || { echo "FAIL arm3: rc=$rc want 1" >&2; cat "$OUT_LOG" >&2; exit 1; }
[[ ! -s "$CALL_LOG" ]] || { echo "FAIL arm3: queue guard ran on a refused merge" >&2; exit 1; }
grep -q "does not match the PR base" "$OUT_LOG" || { echo "FAIL arm3: mismatch message missing" >&2; exit 1; }

echo "pr-merge --base-line exception regression passed (B5)"