// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {AskSwarmRegistry} from "src/AskSwarmRegistry.sol";
import {IIntake, OracleAttestation} from "src/IIntake.sol";

contract ReviewToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// Mirrors the live Intake v2 `complete`: writer-only, once per id, and on status 0 the args are
/// forwarded to the registered selector without being checked against the request id.
contract ReviewIntake {
    struct Req {
        address payer;
        address target;
        bytes4 selector;
        bytes4 onFailure;
        bool completed;
    }

    address public immutable writer;
    address public immutable asset;
    uint256 public nonce;
    mapping(bytes32 => Req) public reqs;

    constructor(address writer_, address asset_) {
        writer = writer_;
        asset = asset_;
    }

    function priceOf(bytes32, address) external pure returns (uint256) {
        return 0.5 ether;
    }

    function requestWithFailure(
        bytes32,
        bytes calldata,
        IIntake.Callback calldata cb,
        bytes4 onFailure,
        address token,
        uint256 amount
    ) external payable returns (bytes32 id) {
        id = keccak256(abi.encode(block.chainid, address(this), ++nonce));
        reqs[id] = Req(msg.sender, cb.target, cb.selector, onFailure, false);
        require(ReviewToken(token).transferFrom(msg.sender, address(0xBEEF), amount));
    }

    function complete(bytes32 id, uint8 status, bytes calldata args) external returns (bool delivered) {
        require(msg.sender == writer, "writer");
        Req storage r = reqs[id];
        require(r.payer != address(0) && !r.completed, "bad");
        r.completed = true;
        bytes4 sel = status == 0 ? r.selector : r.onFailure;
        if (status != 0) {
            require(bytes32(args[0:32]) == id && uint256(bytes32(args[32:64])) == status, "args");
        }
        (delivered,) = r.target.call{gas: 200_000}(abi.encodePacked(sel, args));
    }
}

contract ProofSettledOverwriteTest is Test {
    uint256 constant KEY = 0xA11CE;
    ReviewToken token;
    ReviewIntake intake;
    AskSwarmRegistry reg;
    address writer = makeAddr("writer");
    address alice = makeAddr("alice");

    function setUp() public {
        vm.chainId(1);
        vm.warp(1_800_000_000);
        token = new ReviewToken();
        intake = new ReviewIntake(writer, address(token));
        reg = new AskSwarmRegistry(address(intake), address(token), vm.addr(KEY));
        token.mint(alice, 100 ether);
        vm.prank(alice);
        token.approve(address(reg), type(uint256).max);
    }

    function _ask() internal returns (bytes32 id) {
        vm.prank(alice);
        id = reg.ask("{}");
    }

    function _att(bytes32 id, bytes memory answer, bytes32 q) internal view returns (OracleAttestation memory a) {
        a = OracleAttestation({
            requestId: id,
            chainId: 1,
            questionHash: q,
            answerType: 2,
            answer: answer,
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(3)),
            panelJobId: bytes32(uint256(4)),
            panelSize: 15,
            quorum: 11,
            agreed: 11,
            issuedAt: uint64(block.timestamp),
            expiresAt: uint64(block.timestamp + 1 days)
        });
    }

    function _sign(OracleAttestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, reg.digest(a));
        return abi.encodePacked(r, s, v);
    }

    /// A settled ask is rewritten by the status-0 completion of a different, still open ask whose
    /// args name the settled id. The live Intake binds args to the request id only on status 1/2.
    function test_settledAskIsNotRewrittenByAnotherRequestsCompletion() public {
        bytes32 q = keccak256("q");
        bytes32 first = _ask();
        OracleAttestation memory a = _att(first, "CHF", q);
        bytes memory sa = _sign(a);
        vm.prank(writer);
        assertTrue(intake.complete(first, 0, abi.encode(first, a, sa)));
        assertEq(reg.latestFor(q), first);

        bytes32 second = _ask();
        OracleAttestation memory b = _att(first, "EUR", q);
        bytes memory sb = _sign(b);
        vm.prank(writer);
        intake.complete(second, 0, abi.encode(first, b, sb));

        (AskSwarmRegistry.Ask memory k, AskSwarmRegistry.Answer memory ans) = reg.get(first);
        assertEq(ans.answer, bytes("CHF"), "settled answer was rewritten");
        assertEq(uint8(k.status), uint8(AskSwarmRegistry.Status.Answered));
    }

    /// The same path turns an indexed, verified answer into an unverified one that latestFor still
    /// points at, so answerOf(q, 0, 0) returns an unverified record.
    function test_indexedAnswerCannotBecomeUnverifiedInPlace() public {
        bytes32 q = keccak256("q");
        bytes32 first = _ask();
        OracleAttestation memory a = _att(first, "CHF", q);
        bytes memory sa = _sign(a);
        vm.prank(writer);
        assertTrue(intake.complete(first, 0, abi.encode(first, a, sa)));

        bytes32 second = _ask();
        OracleAttestation memory b = _att(first, "EUR", q);
        vm.prank(writer);
        intake.complete(second, 0, abi.encode(first, b, new bytes(65)));

        (bytes32 id, AskSwarmRegistry.Answer memory held) = reg.answerOf(q, 0, 0);
        assertEq(id, first);
        assertTrue(held.verified, "answerOf returns an unverified record");
        assertTrue(reg.isCurrent(q));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {AskSwarmRegistry} from "src/AskSwarmRegistry.sol";
import {IIntake, OracleAttestation} from "src/IIntake.sol";

contract ReviewToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// Mirrors the live Intake v2 `complete`: writer-only, once per id, and on status 0 the args are
/// forwarded to the registered selector without being checked against the request id.
contract ReviewIntake {
    struct Req {
        address payer;
        address target;
        bytes4 selector;
        bytes4 onFailure;
        bool completed;
    }

    address public immutable writer;
    address public immutable asset;
    uint256 public nonce;
    mapping(bytes32 => Req) public reqs;

    constructor(address writer_, address asset_) {
        writer = writer_;
        asset = asset_;
    }

    function priceOf(bytes32, address) external pure returns (uint256) {
        return 0.5 ether;
    }

    function requestWithFailure(
        bytes32,
        bytes calldata,
        IIntake.Callback calldata cb,
        bytes4 onFailure,
        address token,
        uint256 amount
    ) external payable returns (bytes32 id) {
        id = keccak256(abi.encode(block.chainid, address(this), ++nonce));
        reqs[id] = Req(msg.sender, cb.target, cb.selector, onFailure, false);
        require(ReviewToken(token).transferFrom(msg.sender, address(0xBEEF), amount));
    }

    function complete(bytes32 id, uint8 status, bytes calldata args) external returns (bool delivered) {
        require(msg.sender == writer, "writer");
        Req storage r = reqs[id];
        require(r.payer != address(0) && !r.completed, "bad");
        r.completed = true;
        bytes4 sel = status == 0 ? r.selector : r.onFailure;
        if (status != 0) {
            require(bytes32(args[0:32]) == id && uint256(bytes32(args[32:64])) == status, "args");
        }
        (delivered,) = r.target.call{gas: 200_000}(abi.encodePacked(sel, args));
    }
}

contract ProofFutureIssuedAtTest is Test {
    uint256 constant KEY = 0xA11CE;
    ReviewToken token;
    ReviewIntake intake;
    AskSwarmRegistry reg;
    address writer = makeAddr("writer");
    address alice = makeAddr("alice");

    function setUp() public {
        vm.chainId(1);
        vm.warp(1_800_000_000);
        token = new ReviewToken();
        intake = new ReviewIntake(writer, address(token));
        reg = new AskSwarmRegistry(address(intake), address(token), vm.addr(KEY));
        token.mint(alice, 100 ether);
        vm.prank(alice);
        token.approve(address(reg), type(uint256).max);
    }

    function _ask() internal returns (bytes32 id) {
        vm.prank(alice);
        id = reg.ask("{}");
    }

    function _att(bytes32 id, bytes memory answer, bytes32 q) internal view returns (OracleAttestation memory a) {
        a = OracleAttestation({
            requestId: id,
            chainId: 1,
            questionHash: q,
            answerType: 2,
            answer: answer,
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(3)),
            panelJobId: bytes32(uint256(4)),
            panelSize: 15,
            quorum: 11,
            agreed: 11,
            issuedAt: uint64(block.timestamp),
            expiresAt: uint64(block.timestamp + 1 days)
        });
    }

    function _sign(OracleAttestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, reg.digest(a));
        return abi.encodePacked(r, s, v);
    }

    /// An attestation whose issuedAt is a year ahead of the chain clock is verified and indexed.
    /// The protocol's OracleAttestationConsumer refuses issuedAt beyond block.timestamp + 5 minutes.
    function test_futureIssuedAtIsNotVerified() public {
        bytes32 id = _ask();
        OracleAttestation memory a = _att(id, "CHF", keccak256("q2"));
        a.issuedAt = uint64(block.timestamp + 365 days);
        a.expiresAt = uint64(block.timestamp + 366 days);
        bytes memory sig = _sign(a);
        vm.prank(writer);
        assertTrue(intake.complete(id, 0, abi.encode(id, a, sig)));
        (, AskSwarmRegistry.Answer memory ans) = reg.get(id);
        assertFalse(ans.verified, "future-issued attestation accepted as verified");
        assertEq(reg.latestFor(keccak256("q2")), bytes32(0), "future-issued attestation indexed");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {AskSwarmRegistry} from "src/AskSwarmRegistry.sol";
import {IIntake, OracleAttestation} from "src/IIntake.sol";

contract ReviewToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// Mirrors the live Intake v2 `complete`: writer-only, once per id, and on status 0 the args are
/// forwarded to the registered selector without being checked against the request id.
contract ReviewIntake {
    struct Req {
        address payer;
        address target;
        bytes4 selector;
        bytes4 onFailure;
        bool completed;
    }

    address public immutable writer;
    address public immutable asset;
    uint256 public nonce;
    mapping(bytes32 => Req) public reqs;

    constructor(address writer_, address asset_) {
        writer = writer_;
        asset = asset_;
    }

    function priceOf(bytes32, address) external pure returns (uint256) {
        return 0.5 ether;
    }

    function requestWithFailure(
        bytes32,
        bytes calldata,
        IIntake.Callback calldata cb,
        bytes4 onFailure,
        address token,
        uint256 amount
    ) external payable returns (bytes32 id) {
        id = keccak256(abi.encode(block.chainid, address(this), ++nonce));
        reqs[id] = Req(msg.sender, cb.target, cb.selector, onFailure, false);
        require(ReviewToken(token).transferFrom(msg.sender, address(0xBEEF), amount));
    }

    function complete(bytes32 id, uint8 status, bytes calldata args) external returns (bool delivered) {
        require(msg.sender == writer, "writer");
        Req storage r = reqs[id];
        require(r.payer != address(0) && !r.completed, "bad");
        r.completed = true;
        bytes4 sel = status == 0 ? r.selector : r.onFailure;
        if (status != 0) {
            require(bytes32(args[0:32]) == id && uint256(bytes32(args[32:64])) == status, "args");
        }
        (delivered,) = r.target.call{gas: 200_000}(abi.encodePacked(sel, args));
    }
}

contract ProofUnansweredHashTest is Test {
    uint256 constant KEY = 0xA11CE;
    ReviewToken token;
    ReviewIntake intake;
    AskSwarmRegistry reg;
    address writer = makeAddr("writer");
    address alice = makeAddr("alice");

    function setUp() public {
        vm.chainId(1);
        vm.warp(1_800_000_000);
        token = new ReviewToken();
        intake = new ReviewIntake(writer, address(token));
        reg = new AskSwarmRegistry(address(intake), address(token), vm.addr(KEY));
        token.mint(alice, 100 ether);
        vm.prank(alice);
        token.approve(address(reg), type(uint256).max);
    }

    function _ask() internal returns (bytes32 id) {
        vm.prank(alice);
        id = reg.ask("{}");
    }

    function _att(bytes32 id, bytes memory answer, bytes32 q) internal view returns (OracleAttestation memory a) {
        a = OracleAttestation({
            requestId: id,
            chainId: 1,
            questionHash: q,
            answerType: 2,
            answer: answer,
            figure: 0,
            fromBlock: 1,
            toBlock: 2,
            blockHash: bytes32(uint256(3)),
            panelJobId: bytes32(uint256(4)),
            panelSize: 15,
            quorum: 11,
            agreed: 11,
            issuedAt: uint64(block.timestamp),
            expiresAt: uint64(block.timestamp + 1 days)
        });
    }

    function _sign(OracleAttestation memory a) internal view returns (bytes memory) {
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, reg.digest(a));
        return abi.encodePacked(r, s, v);
    }

    /// A request that was never answered reads back with answerHash == keccak256("").
    function test_unansweredRequestReportsZeroAnswerHash() public {
        bytes32 id = _ask();
        (AskSwarmRegistry.Ask memory k, AskSwarmRegistry.Answer memory ans) = reg.get(id);
        assertEq(uint8(k.status), uint8(AskSwarmRegistry.Status.Pending));
        assertEq(ans.answerHash, bytes32(0), "pending ask reports a non-zero answerHash");

        bytes32 id2 = _ask();
        vm.prank(writer);
        intake.complete(id2, 1, abi.encode(id2, uint8(1), bytes32("body_invalid"), uint16(0), uint16(0), bytes("")));
        (, AskSwarmRegistry.Answer memory ans2) = reg.get(id2);
        assertEq(ans2.answerHash, bytes32(0), "refused ask reports a non-zero answerHash");

        (, AskSwarmRegistry.Answer memory ans3) = reg.get(keccak256("never asked"));
        assertEq(ans3.answerHash, bytes32(0), "unknown id reports a non-zero answerHash");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {AskSwarmRegistry} from "src/AskSwarmRegistry.sol";
import {IIntake, OracleAttestation} from "src/IIntake.sol";

contract GapToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// Minimal Intake v2 model: pulls exactly the price, hands out keccak ids, and `complete` calls the
/// registered callback once with a 200k stipend, as the live contract does for status 0.
contract GapIntake {
    struct Req {
        address target;
        bytes4 selector;
        bool completed;
    }

    address public immutable asset;
    address public immutable writer;
    uint256 public nonce;
    mapping(bytes32 => Req) public reqs;

    constructor(address asset_, address writer_) {
        asset = asset_;
        writer = writer_;
    }

    function priceOf(bytes32, address token) external view returns (uint256) {
        return token == asset ? 0.5 ether : 0;
    }

    function requestWithFailure(bytes32, bytes calldata, IIntake.Callback calldata cb, bytes4, address, uint256 amount)
        external
        payable
        returns (bytes32 id)
    {
        require(GapToken(asset).transferFrom(msg.sender, address(this), amount));
        id = keccak256(abi.encode(block.chainid, address(this), ++nonce));
        reqs[id] = Req(cb.target, cb.selector, false);
    }

    function complete(bytes32 id, bytes calldata args) external returns (bool delivered) {
        require(msg.sender == writer);
        Req storage r = reqs[id];
        require(!r.completed);
        r.completed = true;
        (delivered,) = r.target.call{gas: 200_000}(abi.encodePacked(r.selector, args));
    }
}

contract IndexExpiryGapTest is Test {
    uint256 constant KEY = 0xA11CE;
    uint64 constant START = 1_800_000_000;
    bytes32 constant Q = keccak256("same absolute-window question");

    GapToken token;
    GapIntake intake;
    AskSwarmRegistry registry;
    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address writer = makeAddr("writer");

    function setUp() public {
        vm.chainId(1);
        vm.warp(START);
        token = new GapToken();
        intake = new GapIntake(address(token), writer);
        registry = new AskSwarmRegistry(address(intake), address(token), vm.addr(KEY));
        token.mint(alice, 10 ether);
        token.mint(bob, 10 ether);
        vm.prank(alice);
        token.approve(address(registry), type(uint256).max);
        vm.prank(bob);
        token.approve(address(registry), type(uint256).max);
    }

    function _deliver(address asker, bytes memory answer, uint16 panel, uint16 agreed, uint64 expiresAt)
        internal
        returns (bytes32 id)
    {
        vm.prank(asker);
        id = registry.ask(bytes("{}"));
        OracleAttestation memory a = OracleAttestation({
            requestId: keccak256(abi.encode("uuid", id)),
            chainId: 1,
            questionHash: Q,
            answerType: 2,
            answer: answer,
            figure: 0,
            fromBlock: 100,
            toBlock: 200,
            blockHash: keccak256("b"),
            panelJobId: keccak256(abi.encode("job", id)),
            panelSize: panel,
            quorum: agreed,
            agreed: agreed,
            issuedAt: uint64(block.timestamp),
            expiresAt: expiresAt
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, registry.digest(a));
        vm.prank(writer);
        assertTrue(intake.complete(id, abi.encode(id, a, abi.encodePacked(r, s, v))), "not delivered");
    }

    /// A strong answer valid for one hour is indexed. A verified majority answer valid for 30 days
    /// arrives while it is current and is refused as weaker. After the hour, the index still points
    /// at the expired answer: `isCurrent` is false and the filtered read returns nothing, although a
    /// verified, unexpired majority answer for the same question is in storage.
    function test_indexGoesDarkWhileAVerifiedUnexpiredAnswerExists() public {
        bytes32 strongShort = _deliver(alice, "yes", 30, 25, START + 1 hours);
        bytes32 weakerLong = _deliver(bob, "yes", 10, 8, START + 30 days);
        assertEq(registry.latestFor(Q), strongShort);

        vm.warp(START + 1 hours + 1);
        (, AskSwarmRegistry.Answer memory b) = registry.get(weakerLong);
        assertTrue(b.verified && block.timestamp <= b.expiresAt, "bob's answer is verified and current");

        // Expected: the question has a current answer (bob's). Actual: the index is dark.
        assertTrue(registry.isCurrent(Q), "isCurrent is false although a current verified answer exists");
        (bytes32 id,) = registry.answerOf(Q, 0, 0);
        assertEq(id, weakerLong, "filtered answerOf returns nothing although bob's answer is current");
    }

    /// Mirror image: an equal-strength answer with a 60 s validity evicts one valid for 30 days;
    /// 61 s later the index is dark while the evicted answer is still current for 30 days.
    function test_equalStrengthShortExpiryEvictsLongLivedAnswer() public {
        bytes32 longLived = _deliver(alice, "yes", 15, 11, START + 30 days);
        bytes32 shortLived = _deliver(bob, "yes", 15, 11, START + 60);
        assertEq(registry.latestFor(Q), shortLived);

        vm.warp(START + 61);
        (, AskSwarmRegistry.Answer memory a) = registry.get(longLived);
        assertTrue(a.verified && block.timestamp <= a.expiresAt, "alice's answer is verified and current");
        assertTrue(registry.isCurrent(Q), "index is dark although alice's answer is current for 30 days");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {AskSwarmRegistry} from "src/AskSwarmRegistry.sol";
import {IIntake, OracleAttestation} from "src/IIntake.sol";

contract ProofToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// Minimal Intake v2: takes the exact price and calls the registered callback once at 200k gas.
contract ProofIntake {
    struct Request {
        address target;
        bytes4 selector;
        bool completed;
    }

    address public immutable token;
    uint256 public nonce;
    mapping(bytes32 => Request) public requests;

    constructor(address token_) {
        token = token_;
    }

    function priceOf(bytes32, address) external pure returns (uint256) {
        return 0.5 ether;
    }

    function requestWithFailure(bytes32, bytes calldata, IIntake.Callback calldata cb, bytes4, address, uint256 amount)
        external
        payable
        returns (bytes32 id)
    {
        id = keccak256(abi.encode(address(this), ++nonce));
        requests[id] = Request(cb.target, cb.selector, false);
        ProofToken(token).transferFrom(msg.sender, address(0xFEE), amount);
    }

    function complete(bytes32 id, bytes calldata args) external returns (bool delivered) {
        Request storage r = requests[id];
        require(!r.completed);
        r.completed = true;
        (delivered,) = r.target.call{gas: 200_000}(abi.encodePacked(r.selector, args));
    }
}

/// Finding: an equal-strength answer that expires sooner displaces a held answer that is still
/// current, so once the newcomer expires the question reads "not current" although a verified,
/// unexpired answer of the same strength exists. Expected: the index keeps serving a current answer.
contract IndexDisplacementProof is Test {
    uint256 internal constant KEY = 0xA11CE;
    bytes32 internal constant QUESTION = keccak256("absolute-window question");
    ProofToken internal token;
    ProofIntake internal intake;
    AskSwarmRegistry internal registry;
    address internal asker = address(0xA5);

    function setUp() public {
        vm.warp(1_800_000_000);
        token = new ProofToken();
        intake = new ProofIntake(address(token));
        registry = new AskSwarmRegistry(address(intake), address(token), vm.addr(KEY));
        token.mint(asker, 10 ether);
        vm.prank(asker);
        token.approve(address(registry), type(uint256).max);
    }

    function _answer(uint64 validFor) internal returns (bytes32 id) {
        vm.prank(asker);
        id = registry.ask("{}");
        OracleAttestation memory a = OracleAttestation({
            requestId: keccak256(abi.encode(id)),
            chainId: 1,
            questionHash: QUESTION,
            answerType: 0,
            answer: abi.encode(true),
            figure: 0,
            fromBlock: 100,
            toBlock: 200,
            blockHash: bytes32(uint256(1)),
            panelJobId: keccak256(abi.encode("job", id)),
            panelSize: 15,
            quorum: 11,
            agreed: 11,
            issuedAt: uint64(block.timestamp),
            expiresAt: uint64(block.timestamp) + validFor
        });
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, registry.digest(a));
        assertTrue(intake.complete(id, abi.encode(id, a, abi.encodePacked(r, s, v))));
    }

    function test_shortLivedEqualAnswerMustNotEvictCurrentAnswer() public {
        bytes32 longLived = _answer(30 days);
        assertTrue(registry.isCurrent(QUESTION));
        _answer(60); // same question, same panel strength, validForSeconds = 60, one paid ask
        vm.warp(block.timestamp + 61);

        (, AskSwarmRegistry.Answer memory held) = registry.get(longLived);
        assertTrue(held.verified && block.timestamp <= held.expiresAt, "a current verified answer exists");
        assertTrue(registry.isCurrent(QUESTION), "index dropped a current answer for a shorter-lived one");
        (bytes32 served,) = registry.answerOf(QUESTION, 15, 11);
        assertEq(served, longLived, "filtered read serves nothing for 30 days");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {AskSwarmRegistry} from "src/AskSwarmRegistry.sol";
import {IIntake, OracleAttestation} from "src/IIntake.sol";

contract ProofToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// Intake v2 as the registry uses it: pulls the price, records the callback, and calls it once
/// from its own address with a 200k stipend.
contract ProofIntake {
    struct Req {
        address target;
        bytes4 selector;
        bool completed;
    }

    ProofToken public immutable token;
    uint256 public nonce;
    mapping(bytes32 => Req) public reqs;

    constructor(ProofToken token_) {
        token = token_;
    }

    function priceOf(bytes32, address) external pure returns (uint256) {
        return 0.5 ether;
    }

    function requestWithFailure(bytes32, bytes calldata, IIntake.Callback calldata cb, bytes4, address, uint256 amount)
        external
        returns (bytes32 id)
    {
        token.transferFrom(msg.sender, address(this), amount);
        id = keccak256(abi.encode(++nonce));
        reqs[id] = Req(cb.target, cb.selector, false);
    }

    function requests(bytes32 id) external view returns (address, address, bytes4, bool) {
        Req storage r = reqs[id];
        return (address(this), r.target, r.selector, r.completed);
    }

    function deliver(bytes32 id, bytes calldata args) external returns (bool ok) {
        Req storage r = reqs[id];
        r.completed = true;
        (ok,) = r.target.call{gas: 200_000}(abi.encodePacked(r.selector, args));
    }
}

/// Once the held answer expires, `reindex` (or the next delivery) lets any eligible answer take the
/// index, and the `issuedAt`/`expiresAt` legs of `_mayDisplace` then stop a stronger answer already
/// on record from ever taking it back: a 2-of-3 panel issued a few seconds later holds the index
/// for its whole validity while a verified 25-of-30 answer to the same question stays dark.
contract WeakFallbackBlocksStrongerTest is Test {
    uint256 internal constant KEY = 0xA11CE;
    bytes32 internal constant Q = keccak256("absolute-window question");
    uint64 internal constant T = 1_800_000_000;

    ProofToken internal token;
    ProofIntake internal intake;
    AskSwarmRegistry internal registry;

    function setUp() public {
        vm.chainId(1);
        vm.warp(T);
        token = new ProofToken();
        intake = new ProofIntake(token);
        registry = new AskSwarmRegistry(address(intake), address(token), vm.addr(KEY));
        token.mint(address(this), 100 ether);
        token.approve(address(registry), type(uint256).max);
    }

    function test_strongerValidAnswerRegainsTheIndexFromAWeakerFallback() public {
        // H: 40 of 50, valid one hour. Indexed.
        bytes32 held = _answer(50, 40, T, T + 1 hours);
        assertEq(registry.latestFor(Q), held);
        // X: 25 of 30, valid 30 days, issued 10 s later. Smaller panel: not indexed while H is current.
        vm.warp(T + 10);
        bytes32 strong = _answer(30, 25, T + 10, T + 30 days);
        // Y: 2 of 3, valid 30 days, issued 10 s after X. Not indexed while H is current.
        vm.warp(T + 20);
        bytes32 weak = _answer(3, 2, T + 20, T + 30 days);
        assertEq(registry.latestFor(Q), held);

        // H expires. Anyone points the index at the weakest answer first, then anyone tries the strong one.
        vm.warp(T + 1 hours + 1);
        vm.prank(makeAddr("anyone"));
        try registry.reindex(weak) {} catch {}
        try registry.reindex(strong) {} catch {}

        // Expected: the verified 25-of-30 answer, valid as long as the 2-of-3 one, holds the index.
        // Actual: reindex(strong) reverts NotEligible (strong.issuedAt < weak.issuedAt) and the
        // index holds the 2-of-3 answer for 30 days.
        assertEq(registry.latestFor(Q), strong, "a 2-of-3 fallback blocks a verified 25-of-30 answer");
        (bytes32 id,) = registry.answerOf(Q, 30, 25);
        assertEq(id, strong, "filtered readers see no answer although one is on record");
    }

    function _answer(uint16 panel, uint16 agreed, uint64 issuedAt, uint64 expiresAt) internal returns (bytes32 id) {
        id = registry.ask("{}");
        OracleAttestation memory a;
        a.requestId = keccak256(abi.encode("uuid", id));
        a.chainId = 1;
        a.questionHash = Q;
        a.answerType = 0;
        a.answer = abi.encode(true);
        a.panelSize = panel;
        a.quorum = agreed;
        a.agreed = agreed;
        a.issuedAt = issuedAt;
        a.expiresAt = expiresAt;
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, registry.digest(a));
        assertTrue(intake.deliver(id, abi.encode(id, a, abi.encodePacked(r, s, v))));
        (AskSwarmRegistry.Ask memory k,) = registry.get(id);
        assertEq(uint8(k.status), uint8(AskSwarmRegistry.Status.Answered));
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {AskSwarmRegistry} from "src/AskSwarmRegistry.sol";
import {IIntake, OracleAttestation} from "src/IIntake.sol";

contract ProofToken {
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function transferFrom(address from, address to, uint256 amount) external returns (bool) {
        allowance[from][msg.sender] -= amount;
        balanceOf[from] -= amount;
        balanceOf[to] += amount;
        return true;
    }
}

/// Intake v2 as the registry uses it: pulls the price, records the callback, and calls it once
/// from its own address with a 200k stipend.
contract ProofIntake {
    struct Req {
        address target;
        bytes4 selector;
        bool completed;
    }

    ProofToken public immutable token;
    uint256 public nonce;
    mapping(bytes32 => Req) public reqs;

    constructor(ProofToken token_) {
        token = token_;
    }

    function priceOf(bytes32, address) external pure returns (uint256) {
        return 0.5 ether;
    }

    function requestWithFailure(bytes32, bytes calldata, IIntake.Callback calldata cb, bytes4, address, uint256 amount)
        external
        returns (bytes32 id)
    {
        token.transferFrom(msg.sender, address(this), amount);
        id = keccak256(abi.encode(++nonce));
        reqs[id] = Req(cb.target, cb.selector, false);
    }

    function requests(bytes32 id) external view returns (address, address, bytes4, bool) {
        Req storage r = reqs[id];
        return (address(this), r.target, r.selector, r.completed);
    }

    function deliver(bytes32 id, bytes calldata args) external returns (bool ok) {
        Req storage r = reqs[id];
        r.completed = true;
        (ok,) = r.target.call{gas: 200_000}(abi.encodePacked(r.selector, args));
    }
}

/// Once the held answer expires, `reindex` (or the next delivery) lets any eligible answer take the
/// index, and the `issuedAt`/`expiresAt` legs of `_mayDisplace` then stop a stronger answer already
/// on record from ever taking it back: a 2-of-3 panel issued a few seconds later holds the index
/// for its whole validity while a verified 25-of-30 answer to the same question stays dark.
contract WeakFallbackBlocksStrongerTest is Test {
    uint256 internal constant KEY = 0xA11CE;
    bytes32 internal constant Q = keccak256("absolute-window question");
    uint64 internal constant T = 1_800_000_000;

    ProofToken internal token;
    ProofIntake internal intake;
    AskSwarmRegistry internal registry;

    function setUp() public {
        vm.chainId(1);
        vm.warp(T);
        token = new ProofToken();
        intake = new ProofIntake(token);
        registry = new AskSwarmRegistry(address(intake), address(token), vm.addr(KEY));
        token.mint(address(this), 100 ether);
        token.approve(address(registry), type(uint256).max);
    }

    function test_strongerValidAnswerRegainsTheIndexFromAWeakerFallback() public {
        // H: 40 of 50, valid one hour. Indexed.
        bytes32 held = _answer(50, 40, T, T + 1 hours);
        assertEq(registry.latestFor(Q), held);
        // X: 25 of 30, valid 30 days, issued 10 s later. Smaller panel: not indexed while H is current.
        vm.warp(T + 10);
        bytes32 strong = _answer(30, 25, T + 10, T + 30 days);
        // Y: 2 of 3, valid 30 days, issued 10 s after X. Not indexed while H is current.
        vm.warp(T + 20);
        bytes32 weak = _answer(3, 2, T + 20, T + 30 days);
        assertEq(registry.latestFor(Q), held);

        // H expires. Anyone points the index at the weakest answer first, then anyone tries the strong one.
        vm.warp(T + 1 hours + 1);
        vm.prank(makeAddr("anyone"));
        try registry.reindex(weak) {} catch {}
        try registry.reindex(strong) {} catch {}

        // Expected: the verified 25-of-30 answer, valid as long as the 2-of-3 one, holds the index.
        // Actual: reindex(strong) reverts NotEligible (strong.issuedAt < weak.issuedAt) and the
        // index holds the 2-of-3 answer for 30 days.
        assertEq(registry.latestFor(Q), strong, "a 2-of-3 fallback blocks a verified 25-of-30 answer");
        (bytes32 id,) = registry.answerOf(Q, 30, 25);
        assertEq(id, strong, "filtered readers see no answer although one is on record");
    }

    function _answer(uint16 panel, uint16 agreed, uint64 issuedAt, uint64 expiresAt) internal returns (bytes32 id) {
        id = registry.ask("{}");
        OracleAttestation memory a;
        a.requestId = keccak256(abi.encode("uuid", id));
        a.chainId = 1;
        a.questionHash = Q;
        a.answerType = 0;
        a.answer = abi.encode(true);
        a.panelSize = panel;
        a.quorum = agreed;
        a.agreed = agreed;
        a.issuedAt = issuedAt;
        a.expiresAt = expiresAt;
        (uint8 v, bytes32 r, bytes32 s) = vm.sign(KEY, registry.digest(a));
        assertTrue(intake.deliver(id, abi.encode(id, a, abi.encodePacked(r, s, v))));
        (AskSwarmRegistry.Ask memory k,) = registry.get(id);
        assertEq(uint8(k.status), uint8(AskSwarmRegistry.Status.Answered));
    }
}