@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/tests/test_cli/test_state_cli.py

@@ -1,2467 +0,0 @@
-"""CLI tests for Phase 36 state command surface and state-dsn wiring."""
-
-from __future__ import annotations
-
-import json
-import os
-import sys
-import types
-from pathlib import Path
-from types import SimpleNamespace
-
-import click
-import pytest
-import vds_audit_orchestrator.cli_impl as _cli_impl_module
-from typer.testing import CliRunner
-from vds_audit_orchestrator import cli, extract_cmds, parse_cmds, workflow_cmds
-from vds_audit_orchestrator.config import reset_config
-from vds_audit_orchestrator.models.registry import ProjectMaterial, ProjectRegistry
-from vds_cli_common.env import load_shared_env as _load_shared_env
-
-
-class _NullConfluenceClient:
-    """Minimal stub — prevents real HTTP calls in isolation-level tests."""
-
-    def __init__(self, *args, **kwargs):
-        pass
-
-    @classmethod
-    def for_registry_discovery(cls, *args, **kwargs):
-        return cls()
-
-    @classmethod
-    def for_extract_docs(cls, *args, **kwargs):
-        return cls()
-
-    @classmethod
-    def from_project_page(cls, *args, **kwargs):
-        return cls()
-
-
-def _install_fake_state_module(monkeypatch, **functions):
-    module = types.ModuleType("vds_audit_orchestrator.state")
-    for name, fn in functions.items():
-        setattr(module, name, fn)
-    monkeypatch.setitem(sys.modules, "vds_audit_orchestrator.state", module)
-
-
-@pytest.fixture(autouse=True)
-def _isolate_state_dsn_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    reset_config()
-    cli._cli_state.clear()
-    monkeypatch.setattr(
-        cli,
-        "apply_runtime_profile",
-        lambda *args, **kwargs: SimpleNamespace(
-            profile_name="test",
-            source="test",
-            profile_path=Path("/tmp/test-profile.yaml"),
-            applied_env_keys=[],
-        ),
-    )
-    monkeypatch.setattr(cli, "load_shared_env", lambda *args, **kwargs: {})
-    monkeypatch.setattr("vds_audit_orchestrator.config.load_shared_env", lambda *args, **kwargs: {})
-    monkeypatch.setattr("vds_audit_orchestrator.config.DEFAULT_CONFIG_FILE", Path("/tmp/nonexistent-audit-test.yaml"))
-    # cli_impl imports apply_runtime_profile directly
-    # (`from vds_audit_orchestrator.runtime_profiles import apply_runtime_profile`,
-    # line 61) and the main callback at line 9619 uses that local binding.
-    # Patching cli.apply_runtime_profile alone leaves the real function running;
-    # the real function reads ~/.vds/config/profiles.yaml, applies the "test"
-    # profile, and writes VDS_AUDIT_STATE_DSN into os.environ *after*
-    # monkeypatch.setenv but *before* Typer resolves the subcommand's state_dsn
-    # parameter, causing isolation tests to receive the live DSN.
-    monkeypatch.setattr(
-        _cli_impl_module,
-        "apply_runtime_profile",
-        lambda *args, **kwargs: SimpleNamespace(
-            profile_name="test",
-            source="test",
-            profile_path=Path("/tmp/test-profile.yaml"),
-            applied_env_keys=[],
-        ),
-    )
-    # AuditConfig.load() does a local `from vds_audit_orchestrator.runtime_profiles import
-    # apply_runtime_profile` inside the function body — that local import re-reads the
-    # module attribute at call time, bypassing our _cli_impl_module patch above.
-    # Patch the source module attribute directly so every call site gets the stub.
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.runtime_profiles.apply_runtime_profile",
-        lambda *args, **kwargs: SimpleNamespace(
-            profile_name="test",
-            source="test",
-            profile_path=Path("/tmp/test-profile.yaml"),
-            applied_env_keys=[],
-        ),
-    )
-    monkeypatch.delenv("VDS_AUDIT_STATE_DSN", raising=False)  # absent: load_shared_env can write it
-    monkeypatch.delenv("VDS_AUDIT_PROFILE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_ACTIVE_PROFILE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_DSPY_PROTOCOL", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_DSPY_MODEL", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_LLM_PROTOCOL", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_LLM__MODEL_STANDARD", raising=False)
-    monkeypatch.setenv("VDS_AUDIT_BOOTSTRAP_HOME", "false")
-
-    # Guarantee state_dsn resolves to None when not supplied via CLI.
-    # ~/.vds/.env may leave VDS_AUDIT_STATE_DSN in os.environ from earlier
-    # pytest setup, causing Typer to pick it up at param-resolution time and
-    # bypass the "state-dsn required" guard these tests verify.  Patching
-    # _resolve_state_dsn directly covers every call site regardless of whether
-    # state_dsn is already non-None when _require_*_state_dsn is entered.
-    def _null_resolve_state_dsn(state_dsn: str | None, *, required: bool) -> str | None:
-        raw = (state_dsn or "").strip()
-        if raw and raw.lower() != "env":
-            return raw  # explicit CLI arg — pass through unchanged
-        # No explicit CLI arg: honour tests that restore the real load_shared_env
-        # (e.g. test_state_init_uses_vds_env_file_override, which sets VDS_ENV_FILE
-        # and restores cli.load_shared_env to the real function so it can read from
-        # a temp env file).  In isolation tests cli.load_shared_env is the no-op
-        # lambda from this fixture, so the call is safe and free of side effects.
-        _cli_impl_module.load_shared_env()
-        env_val = (os.getenv("VDS_AUDIT_STATE_DSN") or "").strip()
-        if env_val:
-            return env_val
-        if required:
-            import typer as _typer
-
-            raise _typer.BadParameter(
-                "--state-dsn is required (or set VDS_AUDIT_STATE_DSN).",
-            )
-        return None
-
-    monkeypatch.setattr(_cli_impl_module, "_resolve_state_dsn", _null_resolve_state_dsn)
-    monkeypatch.setattr(_cli_impl_module, "_resolve_state_dsn_from_env", lambda: None)
-    # Prevent accidental real HTTP calls to Confluence from tests that reach
-    # the ConfluenceCliClient instantiation path before the state-dsn guard
-    # (defense-in-depth; eliminates 120 s socket timeouts).
-    monkeypatch.setattr(cli, "ConfluenceCliClient", _NullConfluenceClient)
-    yield
-    cli._cli_state.clear()
-    reset_config()
-
-
-def test_state_group_requires_state_dsn() -> None:
-    runner = CliRunner()
-    result = runner.invoke(cli.app, ["state", "init"])
-
-    assert result.exit_code == 1
-    assert "state-dsn" in result.output.lower()
-
-
-def test_parse_registry_requires_state_dsn() -> None:
-    runner = CliRunner()
-    result = runner.invoke(cli.app, ["parse-registry", "--registry-page", "88716667"])
-    assert result.exit_code == 2
-    assert "state-dsn" in result.output.lower()
-
-
-def test_extract_docs_requires_state_dsn(tmp_path: Path) -> None:
-    runner = CliRunner()
-    result = runner.invoke(
-        cli.app,
-        [
-            "extract-docs",
-            "--project-page",
-            "p-1",
-            "--output-dir",
-            str(tmp_path / "evidence"),
-        ],
-    )
-    assert result.exit_code == 2
-    assert "state-dsn" in result.output.lower()
-
-
-def test_state_project_ready_repo_entries_accept_sync_status_and_readiness() -> None:
-    project_payload = {
-        "bitbucket": [
-            {
-                "repo_slug": "repo-a",
-                "local_code_path": "/tmp/repo-a",
-                "sync_status": "not_modified",
-            },
-            {
-                "repo_slug": "repo-b",
-                "local_code_path": "/tmp/repo-b",
-                "readiness": "ready",
-            },
-            {
-                "repo_slug": "repo-c",
-                "local_code_path": "/tmp/repo-c",
-                "sync_status": "failed",
-            },
-            {
-                "repo_slug": "repo-d",
-                "local_code_path": "/tmp/repo-d",
-                "readiness": "ready",
-                "analysis_excluded": True,
-            },
-        ]
-    }
-
-    ready_entries = workflow_cmds._state_project_ready_repo_entries(project_payload)
-    ready_slugs = {entry.get("repo_slug") for entry in ready_entries}
-    assert ready_slugs == {"repo-a", "repo-b"}
-
-
-def test_validate_project_state_readiness_accepts_repo_ready_marker() -> None:
-    project_payload = {
-        "documents": [{"title": "BRD"}],
-        "sync_metadata": {"artifacts": [{"resource_type": "confluence_page"}]},
-        "bitbucket": [
-            {
-                "repo_slug": "repo-a",
-                "local_code_path": "/tmp/repo-a",
-                "readiness": "ready",
-            }
-        ],
-    }
-
-    ready_entries = workflow_cmds._validate_project_state_readiness_for_workflow(
-        project_payload,
-        command="workflow",
-        project_storage_key="par",
-    )
-    assert len(ready_entries) == 1
-
-
-def test_validate_project_state_readiness_accepts_repo_storage_key_when_path_differs(tmp_path: Path) -> None:
-    project_payload = {
-        "documents": [{"title": "BRD"}],
-        "sync_metadata": {"artifacts": [{"resource_type": "confluence_page"}]},
-        "bitbucket": [
-            {
-                "repo_slug": "campaign-policy-service.git",
-                "repo_storage_key": "cpm-campaign-policy-service",
-                "local_code_path": str(tmp_path / "cached-path-a"),
-                "readiness": "ready",
-            },
-            {
-                "repo_slug": "campaign-reporting-service.git",
-                "repo_storage_key": "cpm-campaign-reporting-service",
-                "local_code_path": str(tmp_path / "cached-path-b"),
-                "readiness": "ready",
-            },
-        ],
-    }
-
-    selected_repo_path = tmp_path / "campaign-policy-service"
-    selected_repo_path.mkdir(parents=True)
-
-    ready_entries = workflow_cmds._validate_project_state_readiness_for_workflow(
-        project_payload,
-        command="workflow",
-        project_storage_key="88718940",
-        selected_repo_path=selected_repo_path,
-        selected_repo_storage_key="cpm-campaign-policy-service",
-    )
-    assert len(ready_entries) == 2
-
-
-def test_validate_project_state_readiness_rejects_analysis_excluded_selected_repo(tmp_path: Path) -> None:
-    selected_repo_path = tmp_path / "repo-a"
-    selected_repo_path.mkdir(parents=True)
-    project_payload = {
-        "documents": [{"title": "BRD"}],
-        "sync_metadata": {"artifacts": [{"resource_type": "confluence_page"}]},
-        "bitbucket": [
-            {
-                "repo_slug": "repo-a",
-                "repo_storage_key": "par:repo-a",
-                "local_code_path": str(selected_repo_path),
-                "readiness": "ready",
-                "analysis_excluded": True,
-                "analysis_exclusion_reason": "deprecated repo",
-            }
-        ],
-    }
-
-    with pytest.raises(Exception, match="analysis_excluded=true"):
-        workflow_cmds._validate_project_state_readiness_for_workflow(
-            project_payload,
-            command="workflow",
-            project_storage_key="par",
-            selected_repo_path=selected_repo_path,
-            selected_repo_storage_key="par:repo-a",
-        )
-
-
-def test_validate_project_state_readiness_rejects_single_repo_mismatch_and_logs_warning(
-    tmp_path: Path, monkeypatch
-) -> None:
-    project_payload = {
-        "documents": [{"title": "BRD"}],
-        "sync_metadata": {"artifacts": [{"resource_type": "confluence_page"}]},
-        "bitbucket": [
-            {
-                "repo_slug": "repo-a",
-                "repo_storage_key": "par:repo-a",
-                "repo_key": "repo-a",
-                "local_code_path": str(tmp_path / "repo-a"),
-                "readiness": "ready",
-            }
-        ],
-    }
-    selected_repo_path = tmp_path / "repo-b"
-    selected_repo_path.mkdir(parents=True)
-
-    warning_events: list[tuple[str, dict[str, object]]] = []
-
-    class _FakeLogger:
-        @staticmethod
-        def warning(event: str, **kwargs: object) -> None:
-            warning_events.append((event, kwargs))
-
-    monkeypatch.setattr(workflow_cmds, "logger", _FakeLogger())
-
-    with pytest.raises(Exception, match="no sync-ready repository matching"):
-        workflow_cmds._validate_project_state_readiness_for_workflow(
-            project_payload,
-            command="workflow",
-            project_storage_key="par",
-            selected_repo_path=selected_repo_path,
-            selected_repo_storage_key="par:repo-b",
-        )
-
-    assert len(warning_events) == 1
-    event, payload = warning_events[0]
-    assert event == "workflow_readiness_selected_repo_not_ready"
-    assert payload.get("project_storage_key") == "par"
-    assert payload.get("selected_repo_storage_key") == "par:repo-b"
-
-
-# ---------------------------------------------------------------------------
-# FR-148: Confluence offline/degraded mode tests
-# ---------------------------------------------------------------------------
-
-
-def test_is_confluence_offline_mode_false_by_default(monkeypatch: pytest.MonkeyPatch) -> None:
-    """FR-148: Offline mode is disabled when no env vars are set."""
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK", raising=False)
-    assert workflow_cmds._is_confluence_offline_mode() is False
-
-
-def test_is_confluence_offline_mode_enabled_by_vds_audit_offline_mode(monkeypatch: pytest.MonkeyPatch) -> None:
-    """FR-148: VDS_AUDIT_OFFLINE_MODE=1 activates offline mode."""
-    monkeypatch.setenv("VDS_AUDIT_OFFLINE_MODE", "1")
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK", raising=False)
-    assert workflow_cmds._is_confluence_offline_mode() is True
-
-
-def test_is_confluence_offline_mode_enabled_by_skip_confluence_sync_check(monkeypatch: pytest.MonkeyPatch) -> None:
-    """FR-148: VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK=true activates offline mode."""
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.setenv("VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK", "true")
-    assert workflow_cmds._is_confluence_offline_mode() is True
-
-
-def test_is_confluence_offline_mode_truthy_values(monkeypatch: pytest.MonkeyPatch) -> None:
-    """FR-148: All truthy string values are accepted for offline mode env vars."""
-    for value in ("1", "true", "yes", "on"):
-        monkeypatch.setenv("VDS_AUDIT_OFFLINE_MODE", value)
-        assert workflow_cmds._is_confluence_offline_mode() is True, f"Expected truthy for value={value!r}"
-
-
-def test_is_confluence_offline_mode_false_for_empty_and_zero(monkeypatch: pytest.MonkeyPatch) -> None:
-    """FR-148: Falsy values keep offline mode disabled."""
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK", raising=False)
-    for value in ("0", "false", "no", "off", ""):
-        monkeypatch.setenv("VDS_AUDIT_OFFLINE_MODE", value)
-        assert workflow_cmds._is_confluence_offline_mode() is False, f"Expected falsy for value={value!r}"
-
-
-def test_validate_project_state_readiness_bypasses_confluence_check_in_offline_mode(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """FR-148: Confluence sync artifact check is bypassed when offline mode is active."""
-    # Project has docs but NO Confluence sync artifacts — would fail normally.
-    project_payload = {
-        "documents": [{"title": "BRD"}],
-        "sync_metadata": {"artifacts": []},  # no confluence_page/attachment
-        "bitbucket": [
-            {
-                "repo_slug": "repo-a",
-                "local_code_path": "/tmp/repo-a",
-                "readiness": "ready",
-            }
-        ],
-    }
-    warning_events: list[tuple[str, dict]] = []
-
-    class _FakeLogger:
-        @staticmethod
-        def warning(event: str, **kwargs: object) -> None:
-            warning_events.append((event, dict(kwargs)))
-
-    monkeypatch.setattr(workflow_cmds, "logger", _FakeLogger())
-    monkeypatch.setenv("VDS_AUDIT_OFFLINE_MODE", "1")
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK", raising=False)
-
-    # Should NOT raise — confluence sync artifact gate is bypassed.
-    ready_entries = workflow_cmds._validate_project_state_readiness_for_workflow(
-        project_payload,
-        command="workflow-project",
-        project_storage_key="88730001",
-    )
-    assert len(ready_entries) == 1
-
-    # Should emit the offline bypass warning.
-    bypass_events = [e for e, _ in warning_events if e == "confluence_sync_artifacts_check_bypassed"]
-    assert len(bypass_events) == 1, f"Expected bypass warning, got: {warning_events}"
-
-
-def test_validate_project_state_readiness_raises_confluence_check_when_not_offline(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """FR-148: Confluence sync artifact check still raises when offline mode is inactive."""
-    project_payload = {
-        "documents": [{"title": "BRD"}],
-        "sync_metadata": {"artifacts": []},  # no confluence artifacts
-        "bitbucket": [
-            {
-                "repo_slug": "repo-a",
-                "local_code_path": "/tmp/repo-a",
-                "readiness": "ready",
-            }
-        ],
-    }
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK", raising=False)
-
-    with pytest.raises(Exception, match="sync_metadata.artifacts must include Confluence resource types"):
-        workflow_cmds._validate_project_state_readiness_for_workflow(
-            project_payload,
-            command="workflow-project",
-            project_storage_key="88730001",
-        )
-
-
-def test_validate_project_state_readiness_bypass_via_skip_confluence_sync_check_env(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """FR-148: VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK also bypasses the confluence artifact gate."""
-    project_payload = {
-        "documents": [{"title": "BRD"}],
-        "sync_metadata": {"artifacts": []},
-        "bitbucket": [
-            {
-                "repo_slug": "repo-a",
-                "local_code_path": "/tmp/repo-a",
-                "readiness": "ready",
-            }
-        ],
-    }
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.setenv("VDS_AUDIT_SKIP_CONFLUENCE_SYNC_CHECK", "1")
-
-    ready_entries = workflow_cmds._validate_project_state_readiness_for_workflow(
-        project_payload,
-        command="workflow",
-        project_storage_key="test-project",
-    )
-    assert len(ready_entries) == 1
-
-
-# ---------------------------------------------------------------------------
-# FR-148 / FR-162: startup Confluence connectivity and auto-offline tests
-# ---------------------------------------------------------------------------
-
-
-def _reachable_connectivity_payload() -> dict[str, object]:
-    return {
-        "endpoints": [
-            {
-                "server": "internal",
-                "url": "http://confluence.digital.vn/",
-                "reachable": False,
-                "detail": "unreachable: timeout",
-                "auth": "basic",
-                "latency_ms": 30000,
-                "error": "timeout",
-            },
-            {
-                "server": "external",
-                "url": "http://10.254.136.35:8090/",
-                "reachable": True,
-                "detail": "reachable (HTTP 401)",
-                "auth": "basic",
-                "latency_ms": 220,
-                "error": None,
-            },
-        ],
-        "any_reachable": True,
-        "internal_reachable": False,
-        "probe_timeout_seconds": 30,
-    }
-
-
-def _unreachable_connectivity_payload() -> dict[str, object]:
-    return {
-        "endpoints": [
-            {
-                "server": "internal",
-                "url": "http://confluence.digital.vn/",
-                "reachable": False,
-                "detail": "unreachable: connection refused",
-                "auth": "basic",
-                "latency_ms": 30000,
-                "error": "connection refused",
-            },
-            {
-                "server": "external",
-                "url": "http://10.254.136.35:8090/",
-                "reachable": False,
-                "detail": "unreachable: timed out",
-                "auth": "basic",
-                "latency_ms": 30000,
-                "error": "timed out",
-            },
-        ],
-        "any_reachable": False,
-        "internal_reachable": False,
-        "probe_timeout_seconds": 30,
-    }
-
-
-def test_auto_activate_offline_mode_does_nothing_when_any_endpoint_is_reachable(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """FR-162: One reachable endpoint must prevent false auto-offline activation."""
-    import vds_audit_orchestrator.workflow_cmds as _wc
-
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CHECKLIST_READINESS_PREFLIGHT", raising=False)
-    monkeypatch.setattr(
-        _wc, "collect_confluence_connectivity_payload", lambda timeout_seconds=30: _reachable_connectivity_payload()
-    )
-
-    activated, diagnostics = _wc._auto_activate_offline_mode()
-    assert activated is False
-    assert diagnostics["reachable"] is True
-    assert diagnostics["decision_basis"] == "endpoint_set"
-    assert diagnostics["any_reachable"] is True
-    assert diagnostics["reachable_endpoints"] == ["external"]
-    assert os.environ.get("VDS_AUDIT_OFFLINE_MODE") is None
-
-
-def test_auto_activate_offline_mode_sets_env_vars_when_all_endpoints_unreachable(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """FR-162: Auto-offline should activate only when all configured endpoints fail."""
-    import vds_audit_orchestrator.workflow_cmds as _wc
-
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CHECKLIST_READINESS_PREFLIGHT", raising=False)
-    monkeypatch.setattr(
-        _wc, "collect_confluence_connectivity_payload", lambda timeout_seconds=30: _unreachable_connectivity_payload()
-    )
-
-    warning_events: list[str] = []
-
-    class _FakeLogger:
-        @staticmethod
-        def warning(event: str, **_kwargs: object) -> None:
-            warning_events.append(event)
-
-        @staticmethod
-        def debug(event: str, **kwargs: object) -> None:
-            pass
-
-        @staticmethod
-        def error(event: str, **_kwargs: object) -> None:
-            warning_events.append(event)
-
-    monkeypatch.setattr(_wc, "logger", _FakeLogger())
-
-    activated, diagnostics = _wc._auto_activate_offline_mode()
-    assert activated is True
-    assert diagnostics["reachable"] is False
-    assert diagnostics["probe_timeout_seconds"] == 30
-    assert diagnostics["decision_basis"] == "endpoint_set"
-    assert diagnostics["endpoint_count"] == 2
-    assert os.environ.get("VDS_AUDIT_OFFLINE_MODE") == "1"
-    assert os.environ.get("VDS_AUDIT_SKIP_CHECKLIST_READINESS_PREFLIGHT") == "1"
-    assert "confluence_unreachable_auto_offline_mode_enabled" in warning_events
-
-
-def test_auto_activate_offline_mode_aborts_when_require_confluence_and_all_endpoints_fail(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """FR-162: --require-confluence aborts only on true endpoint-set connectivity failure."""
-    import vds_audit_orchestrator.workflow_cmds as _wc
-
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.setattr(
-        _wc, "collect_confluence_connectivity_payload", lambda timeout_seconds=30: _unreachable_connectivity_payload()
-    )
-
-    error_events: list[str] = []
-
-    class _FakeLogger:
-        @staticmethod
-        def error(event: str, **_kwargs: object) -> None:
-            error_events.append(event)
-
-        @staticmethod
-        def debug(event: str, **kwargs: object) -> None:
-            pass
-
-        @staticmethod
-        def warning(event: str, **kwargs: object) -> None:
-            pass
-
-    monkeypatch.setattr(_wc, "logger", _FakeLogger())
-
-    with pytest.raises((SystemExit, click.exceptions.Exit)):
-        _wc._auto_activate_offline_mode(require_confluence=True)
-
-    assert "confluence_unreachable_require_confluence_abort" in error_events
-
-
-def _auth_only_connectivity_payload() -> dict[str, object]:
-    """All endpoints respond with 401/403 — auth failure counts as reachable."""
-    return {
-        "endpoints": [
-            {
-                "server": "internal",
-                "url": "http://confluence.digital.vn/",
-                "reachable": True,
-                "detail": "reachable (auth error: 401 Unauthorized)",
-                "auth": "basic",
-                "latency_ms": 150,
-                "error": None,
-            },
-            {
-                "server": "external",
-                "url": "http://10.254.136.35:8090/",
-                "reachable": True,
-                "detail": "reachable (auth error: 403 Forbidden)",
-                "auth": "basic",
-                "latency_ms": 200,
-                "error": None,
-            },
-        ],
-        "any_reachable": True,
-        "internal_reachable": True,
-        "probe_timeout_seconds": 30,
-    }
-
-
-def test_auto_activate_offline_mode_treats_auth_failures_as_reachable(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """FR-162 / TSK-162.12: Auth responses (401/403) must count as reachable connectivity."""
-    import vds_audit_orchestrator.workflow_cmds as _wc
-
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CHECKLIST_READINESS_PREFLIGHT", raising=False)
-    monkeypatch.setattr(
-        _wc,
-        "collect_confluence_connectivity_payload",
-        lambda timeout_seconds=30: _auth_only_connectivity_payload(),
-    )
-
-    activated, diagnostics = _wc._auto_activate_offline_mode()
-    assert activated is False
-    assert diagnostics["reachable"] is True
-    assert diagnostics["any_reachable"] is True
-    assert diagnostics["internal_reachable"] is True
-    assert "internal" in diagnostics["reachable_endpoints"]
-    assert "external" in diagnostics["reachable_endpoints"]
-    assert os.environ.get("VDS_AUDIT_OFFLINE_MODE") is None
-
-
-def _external_only_connectivity_payload() -> dict[str, object]:
-    """Internal down, external reachable — checklist reads default to internal."""
-    return {
-        "endpoints": [
-            {
-                "server": "internal",
-                "url": "http://confluence.digital.vn/",
-                "reachable": False,
-                "detail": "unreachable: connection refused",
-                "auth": "basic",
-                "latency_ms": 30000,
-                "error": "connection refused",
-            },
-            {
-                "server": "external",
-                "url": "http://10.254.136.35:8090/",
-                "reachable": True,
-                "detail": "reachable (HTTP 200)",
-                "auth": "basic",
-                "latency_ms": 220,
-                "error": None,
-            },
-        ],
-        "any_reachable": True,
-        "internal_reachable": False,
-        "probe_timeout_seconds": 30,
-    }
-
-
-def test_auto_activate_offline_mode_online_but_internal_down_exposes_degradation(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """FR-162 / TSK-162.17: When only external is reachable, startup stays online
-    but diagnostics expose internal_reachable=False so callers know checklist reads
-    (which default to internal via for_checklist_reads) may need VDS_AUDIT_CHECKLIST_READ_SERVER override."""
-    import vds_audit_orchestrator.workflow_cmds as _wc
-
-    monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_SKIP_CHECKLIST_READINESS_PREFLIGHT", raising=False)
-    monkeypatch.setattr(
-        _wc,
-        "collect_confluence_connectivity_payload",
-        lambda timeout_seconds=30: _external_only_connectivity_payload(),
-    )
-
-    activated, diagnostics = _wc._auto_activate_offline_mode()
-    # Startup must NOT go offline — external is reachable
-    assert activated is False
-    assert diagnostics["reachable"] is True
-    assert diagnostics["any_reachable"] is True
-    # But internal_reachable=False signals degradation for checklist reads
-    assert diagnostics["internal_reachable"] is False
-    assert diagnostics["reachable_endpoints"] == ["external"]
-    assert os.environ.get("VDS_AUDIT_OFFLINE_MODE") is None
-
-
-def test_confluence_cli_client_marks_degraded_on_transport_error() -> None:
-    """FR-148: ConfluenceCliClient._degraded is False by default."""
-    # We can't instantiate ConfluenceCliClient without a real settings file,
-    # so we test the logic by checking that _degraded starts False and
-    # mark_degraded() sets it to True.
-
-    from vds_audit_orchestrator.clients.confluence_cli_client import ConfluenceCliClient
-
-    client = object.__new__(ConfluenceCliClient)
-    client._degraded = False  # type: ignore[attr-defined]
-
-    assert client.is_degraded is False  # type: ignore[attr-defined]
-
-    client.mark_degraded(reason="test_reason")  # type: ignore[attr-defined]
-    assert client.is_degraded is True  # type: ignore[attr-defined]
-
-
-def test_confluence_cli_client_mark_degraded_idempotent() -> None:
-    """FR-148: Calling mark_degraded() twice does not change state beyond the first call."""
-    from vds_audit_orchestrator.clients.confluence_cli_client import ConfluenceCliClient
-
-    client = object.__new__(ConfluenceCliClient)
-    client._degraded = False  # type: ignore[attr-defined]
-
-    warning_count = {"n": 0}
-
-    class _FakeLogger:
-        @staticmethod
-        def warning(_event: str, **_kwargs: object) -> None:
-            warning_count["n"] += 1
-
-    import vds_audit_orchestrator.clients.confluence_cli_client as _ccm
-
-    original_logger = _ccm.logger
-    _ccm.logger = _FakeLogger()  # type: ignore[assignment]
-    try:
-        client.mark_degraded(reason="first")  # type: ignore[attr-defined]
-        client.mark_degraded(reason="second")  # type: ignore[attr-defined]
-    finally:
-        _ccm.logger = original_logger
-
-    assert client.is_degraded is True  # type: ignore[attr-defined]
-    assert warning_count["n"] == 1, "mark_degraded should only log once (idempotent)"
-
-
-def test_confluence_cli_client_is_transport_error_detects_timeout() -> None:
-    """FR-148: _is_transport_error identifies timeout errors as transport-level failures."""
-    from vds_audit_orchestrator.clients.confluence_cli_client import ConfluenceCliClient
-
-    assert ConfluenceCliClient._is_transport_error(TimeoutError("read timeout after 30s"))
-    assert ConfluenceCliClient._is_transport_error(ConnectionError("connection refused"))
-    assert ConfluenceCliClient._is_transport_error(OSError("network unreachable"))
-
-
-def test_confluence_cli_client_is_transport_error_ignores_auth_errors() -> None:
-    """FR-148: _is_transport_error does NOT flag 401/403 as transport errors."""
-    from vds_audit_orchestrator.clients.confluence_cli_client import ConfluenceCliClient
-
-    assert not ConfluenceCliClient._is_transport_error(PermissionError("401 Unauthorized"))
-    assert not ConfluenceCliClient._is_transport_error(ValueError("404 Not Found"))
-
-
-def test_state_init_uses_env_state_dsn(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_init(**kwargs):
-        captured.update(kwargs)
-        return {"ok": True}
-
-    _install_fake_state_module(monkeypatch, init=_fake_init)
-    monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "sqlite:///tmp/state.db")
-
-    result = runner.invoke(cli.app, ["--json-only", "state", "init"])
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "ok"
-    assert payload["operation"] == "init"
-    assert captured["state_dsn"] == "sqlite:///tmp/state.db"
-
-
-def test_state_init_uses_vds_env_file_override(monkeypatch, tmp_path: Path) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-    env_file = tmp_path / "portable.env"
-    env_file.write_text("VDS_AUDIT_STATE_DSN=postgresql://from-env-file/state\n", encoding="utf-8")
-
-    def _fake_init(**kwargs):
-        captured.update(kwargs)
-        return {"ok": True}
-
-    _install_fake_state_module(monkeypatch, init=_fake_init)
-    monkeypatch.setenv("VDS_ENV_FILE", str(env_file))
-    # DEFAULT_ENV_PATHS in vds_platform_core.env is frozen at import time (once per
-    # process).  Patching the binding in vds_cli_common.env ensures _collect_shared_env_values
-    # reads the temp env file rather than the real ~/.vds/.env.
-    monkeypatch.setattr("vds_cli_common.env.DEFAULT_ENV_PATHS", (env_file,))
-    monkeypatch.setattr(cli, "load_shared_env", _load_shared_env)
-
-    result = runner.invoke(cli.app, ["--json-only", "state", "init"])
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "ok"
-    assert captured["state_dsn"] == "postgresql://from-env-file/state"
-
-
-def test_state_init_explicit_state_dsn_beats_env_and_vds_env_file(monkeypatch, tmp_path: Path) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-    env_file = tmp_path / "portable.env"
-    env_file.write_text("VDS_AUDIT_STATE_DSN=postgresql://from-env-file/state\n", encoding="utf-8")
-
-    def _fake_init(**kwargs):
-        captured.update(kwargs)
-        return {"ok": True}
-
-    _install_fake_state_module(monkeypatch, init=_fake_init)
-    monkeypatch.setenv("VDS_ENV_FILE", str(env_file))
-    monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://from-shell/state")
-    monkeypatch.setattr(cli, "load_shared_env", _load_shared_env)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "init",
-            "--state-dsn",
-            "postgresql://from-cli/state",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "ok"
-    assert captured["state_dsn"] == "postgresql://from-cli/state"
-
-
-def test_resolve_state_dsn_treats_env_sentinel_as_environment_lookup(monkeypatch) -> None:
-    monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://from-shell/state")
-
-    assert cli._resolve_state_dsn("env", required=True) == "postgresql://from-shell/state"
-
-
-def test_state_set_repo_analysis_wires_exclusion_flags(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_set_repo_analysis_exclusion(**kwargs):
-        captured.update(kwargs)
-        return {
-            "project_storage_key": "88718940",
-            "repo_storage_key": "cpm:campaign-sdk-service",
-            "analysis_excluded": kwargs["analysis_excluded"],
-            "analysis_exclusion_reason": kwargs.get("analysis_exclusion_reason"),
-        }
-
-    _install_fake_state_module(monkeypatch, set_repo_analysis_exclusion=_fake_set_repo_analysis_exclusion)
-    monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "sqlite:///tmp/state.db")
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "set-repo-analysis",
-            "--project",
-            "88718940",
-            "--repo",
-            "cpm:campaign-sdk-service",
-            "--exclude",
-            "--reason",
-            "unsupported branch",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "ok"
-    assert payload["operation"] == "set_repo_analysis_exclusion"
-    assert captured["analysis_excluded"] is True
-    assert captured["analysis_exclusion_reason"] == "unsupported branch"
-
-
-def test_state_init_does_not_use_langgraph_postgres_env(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_init(**kwargs):
-        captured.update(kwargs)
-        return {"ok": True}
-
-    _install_fake_state_module(monkeypatch, init=_fake_init)
-    monkeypatch.setenv("VDS_AUDIT_LANGGRAPH__POSTGRES_DSN", "postgresql://fallback:5432/state")
-
-    result = runner.invoke(cli.app, ["--json-only", "state", "init"])
-
-    assert result.exit_code != 0
-    assert captured == {}
-    assert "VDS_AUDIT_STATE_DSN" in result.stdout
-
-
-def test_state_export_wires_output_argument(monkeypatch, tmp_path) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-    export_path = tmp_path / "state-export.json"
-
-    def _fake_export(state_dsn: str, output: Path | None = None):
-        captured["state_dsn"] = state_dsn
-        captured["output"] = output
-        return {"written": str(output)}
-
-    _install_fake_state_module(monkeypatch, export=_fake_export)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "export",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--output",
-            str(export_path),
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    assert captured["state_dsn"] == "postgresql://user:pass@localhost/db"
-    assert captured["output"] == export_path
-
-
-def test_state_list_runs_wires_filters(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    class _FakeStore:
-        def __init__(self, dsn: str) -> None:
-            captured["dsn"] = dsn
-
-        def list_runs(self, **kwargs):
-            captured.update(kwargs)
-            return [
-                {
-                    "run_id": "run-1",
-                    "run_type": "workflow",
-                    "payload": {
-                        "workflow_status": "completed",
-                        "audit_outcome": "partial",
-                        "runtime_profile": "zai-anthropic",
-                        "requested_profiles": ["zai-anthropic"],
-                        "resolved_profiles": ["zai-anthropic", "alibaba-openai"],
-                        "configured_profiles": ["zai-anthropic", "alibaba-openai", "codex-chatgpt"],
-                        "profile_selection_mode": "explicit",
-                    },
-                }
-            ]
-
-        def close(self) -> None:
-            return None
-
-    monkeypatch.setattr("vds_audit_orchestrator.state_cmds.PostgresStateStore", _FakeStore)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "list-runs",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project-storage-key",
-            "merchant-profile-service",
-            "--run-type",
-            "workflow",
-            "--limit",
-            "5",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "list_runs"
-    assert captured["dsn"] == "postgresql://user:pass@localhost/db"
-    assert captured["project_key"] == "merchant-profile-service"
-    assert captured["run_type"] == "workflow"
-    assert captured["limit"] == 5
-    result_row = payload["result"][0]
-    assert result_row["status_projection"]["lifecycle_status"] == "completed"
-    assert result_row["status_projection"]["audit_outcome"] == "partial"
-    assert result_row["profile_projection"]["effective_runtime_profile"] == "zai-anthropic"
-    assert result_row["profile_projection"]["requested_profiles"] == ["zai-anthropic"]
-    assert result_row["profile_projection"]["resolved_profiles"] == ["zai-anthropic", "alibaba-openai"]
-    assert result_row["profile_projection"]["configured_profiles"] == [
-        "zai-anthropic",
-        "alibaba-openai",
-        "codex-chatgpt",
-    ]
-    assert result_row["profile_projection"]["profile_selection_mode"] == "explicit"
-
-
-def test_state_show_run_with_events(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    class _FakeStore:
-        def __init__(self, dsn: str) -> None:
-            captured["dsn"] = dsn
-
-        def show_run(self, *, run_id: str):
-            captured["run_id"] = run_id
-            return {
-                "run_id": "run-42",
-                "payload": {
-                    "kind": "workflow_run",
-                    "retrieval_snapshot_key": "merchant-profile-service:repo-one:snap-001",
-                    "workflow_status": "completed",
-                    "audit_outcome": "findings",
-                    "runtime_profile": "zai-anthropic",
-                    "requested_profiles": ["zai-anthropic"],
-                    "resolved_profiles": ["zai-anthropic", "alibaba-openai"],
-                    "configured_profiles": ["zai-anthropic", "alibaba-openai", "codex-chatgpt"],
-                    "profile_selection_mode": "explicit",
-                },
-            }
-
-        def list_run_events(self, *, run_id: str, limit=None):
-            captured["events_run_id"] = run_id
-            captured["events_limit"] = limit
-            return [{"event_type": "analysis_completed"}]
-
-        def close(self) -> None:
-            return None
-
-    monkeypatch.setattr("vds_audit_orchestrator.state_cmds.PostgresStateStore", _FakeStore)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "show-run",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--run-id",
-            "run-42",
-            "--include-events",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "show_run"
-    assert payload["result"]["run"]["payload"]["retrieval_snapshot_key"] == "merchant-profile-service:repo-one:snap-001"
-    assert payload["result"]["run"]["status_projection"]["lifecycle_status"] == "completed"
-    assert payload["result"]["run"]["status_projection"]["audit_outcome"] == "findings"
-    assert payload["result"]["run"]["profile_projection"]["effective_runtime_profile"] == "zai-anthropic"
-    assert payload["result"]["run"]["profile_projection"]["requested_profiles"] == ["zai-anthropic"]
-    assert captured["run_id"] == "run-42"
-    assert captured["events_run_id"] == "run-42"
-    assert captured["events_limit"] is None
-
-
-def test_state_list_snapshots_wires_project_storage_key(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_list_snapshots(**kwargs):
-        captured.update(kwargs)
-        return [{"snapshot_key": "merchant-profile-service:hash"}]
-
-    _install_fake_state_module(monkeypatch, list_snapshots=_fake_list_snapshots)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "list-snapshots",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project-storage-key",
-            "merchant-profile-service",
-            "--limit",
-            "9",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "list_snapshots"
-    assert captured["project_storage_key"] == "merchant-profile-service"
-    assert captured["limit"] == 9
-
-
-def test_state_resolve_run_input_wires_selectors(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_resolve_run_input(**kwargs):
-        captured.update(kwargs)
-        return {"project": {"project_storage_key": "merchant-profile-service"}}
-
-    _install_fake_state_module(monkeypatch, resolve_run_input=_fake_resolve_run_input)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "resolve-run-input",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project",
-            "merchant-profile-service",
-            "--repo",
-            "repo-one",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "resolve_run_input"
-    assert captured["project"] == "merchant-profile-service"
-    assert captured["repo"] == "repo-one"
-
-
-def test_state_workflow_params_wires_selectors(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_resolve_workflow_run_parameters(**kwargs):
-        captured.update(kwargs)
-        return {
-            "project_storage_key": "merchant-profile-service",
-            "available": True,
-            "latest_run_parameters": {"retrieval_mode": "hybrid"},
-        }
-
-    _install_fake_state_module(monkeypatch, resolve_workflow_run_parameters=_fake_resolve_workflow_run_parameters)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "workflow-params",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project",
-            "merchant-profile-service",
-            "--repo",
-            "repo-one",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "resolve_workflow_run_parameters"
-    assert captured["project"] == "merchant-profile-service"
-    assert captured["repo"] == "repo-one"
-
-
-def test_state_readiness_wires_selectors(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_readiness(**kwargs):
-        captured.update(kwargs)
-        return {"summary": {"ready": True}}
-
-    _install_fake_state_module(monkeypatch, readiness=_fake_readiness)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "readiness",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project",
-            "merchant-profile-service",
-            "--repo",
-            "repo-one",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "readiness"
-    assert captured["project"] == "merchant-profile-service"
-    assert captured["repo"] == "repo-one"
-
-
-def test_state_list_links_wires_selectors(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_list_links(**kwargs):
-        captured.update(kwargs)
-        return {"project_links": [], "repo_links": []}
-
-    _install_fake_state_module(monkeypatch, list_links=_fake_list_links)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "list-links",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project",
-            "merchant-profile-service",
-            "--repo",
-            "repo-one",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "list_links"
-    assert captured["project"] == "merchant-profile-service"
-    assert captured["repo"] == "repo-one"
-
-
-def test_state_compact_wires_retention_and_dry_run(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_compact(**kwargs):
-        captured.update(kwargs)
-        return {"candidate_count": 5, "deleted_count": 0, "dry_run": True}
-
-    _install_fake_state_module(monkeypatch, compact=_fake_compact)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "compact",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--retention-days",
-            "45",
-            "--dry-run",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "compact"
-    assert captured["retention_days"] == 45
-    assert captured["dry_run"] is True
-
-
-def test_state_reconcile_runs_wires_threshold_statuses_and_dry_run(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_reconcile_runs(**kwargs):
-        captured.update(kwargs)
-        return {"candidate_count": 2, "updated_count": 0, "dry_run": True}
-
-    _install_fake_state_module(monkeypatch, reconcile_runs=_fake_reconcile_runs)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "reconcile-runs",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--stale-after-minutes",
-            "180",
-            "--status",
-            "running",
-            "--status",
-            "pending",
-            "--dry-run",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "reconcile_runs"
-    assert captured["stale_after_minutes"] == 180
-    assert captured["target_statuses"] == ["running", "pending"]
-    assert captured["dry_run"] is True
-
-
-def test_state_index_health_wires_bootstrap_and_index_type(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_vector_index_health(**kwargs):
-        captured.update(kwargs)
-        return {"lexical_only": False}
-
-    _install_fake_state_module(monkeypatch, vector_index_health=_fake_vector_index_health)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "index-health",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--bootstrap",
-            "--index-type",
-            "ivfflat",
-            "--dimensions",
-            "768",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "vector_index_health"
-    assert captured["bootstrap"] is True
-    assert captured["index_type"] == "ivfflat"
-    assert captured["dimensions"] == 768
-
-
-def test_state_index_health_defaults_dimensions_from_config(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_vector_index_health(**kwargs):
-        captured.update(kwargs)
-        return {"lexical_only": False}
-
-    _install_fake_state_module(monkeypatch, vector_index_health=_fake_vector_index_health)
-    monkeypatch.setattr(cli, "get_config", lambda: SimpleNamespace(embedding=SimpleNamespace(dimensions=1024)))
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "index-health",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--bootstrap",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "vector_index_health"
-    assert captured["bootstrap"] is True
-    assert captured["index_type"] == "hnsw"
-    assert captured["dimensions"] == 1024
-
-
-def test_state_list_retrieval_snapshots_wires_filters(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_list_retrieval_snapshots(**kwargs):
-        captured.update(kwargs)
-        return [{"snapshot_key": "merchant-profile-service:snap-1"}]
-
-    _install_fake_state_module(monkeypatch, list_retrieval_snapshots=_fake_list_retrieval_snapshots)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "list-retrieval-snapshots",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project-storage-key",
-            "merchant-profile-service",
-            "--repo-storage-key",
-            "merchant-profile-service:repo-one",
-            "--limit",
-            "11",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "list_retrieval_snapshots"
-    assert captured["project_key"] == "merchant-profile-service"
-    assert captured["repo_key"] == "merchant-profile-service:repo-one"
-    assert captured["limit"] == 11
-
-
-def test_state_query_projects_wires_filters(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_query_projects(**kwargs):
-        captured.update(kwargs)
-        return [{"project_storage_key": "merchant-profile-service", "repo_count": 2}]
-
-    _install_fake_state_module(monkeypatch, query_projects=_fake_query_projects)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "query-projects",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--department",
-            "banking",
-            "--limit",
-            "7",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "query_projects"
-    assert captured["department"] == "banking"
-    assert captured["limit"] == 7
-
-
-def test_state_query_departments_wires_filters(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_query_departments(**kwargs):
-        captured.update(kwargs)
-        return [{"department": "banking", "project_count": 3}]
-
-    _install_fake_state_module(monkeypatch, query_departments=_fake_query_departments)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "query-departments",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--department",
-            "banking",
-            "--limit",
-            "5",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "query_departments"
-    assert captured["department"] == "banking"
-    assert captured["limit"] == 5
-
-
-def test_state_query_repos_wires_selectors(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_query_repos(**kwargs):
-        captured.update(kwargs)
-        return [{"repo_storage_key": "merchant-profile-service:repo-one"}]
-
-    _install_fake_state_module(monkeypatch, query_repos=_fake_query_repos)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "query-repos",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project",
-            "merchant-profile-service",
-            "--repo",
-            "repo-one",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "query_repos"
-    assert captured["project"] == "merchant-profile-service"
-    assert captured["repo"] == "repo-one"
-
-
-def test_state_query_runs_wires_selectors(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_query_runs(**kwargs):
-        captured.update(kwargs)
-        return [{"run_id": "run-1", "run_type": "workflow", "payload": {"workflow_status": "completed"}}]
-
-    _install_fake_state_module(monkeypatch, query_runs=_fake_query_runs)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "query-runs",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project",
-            "merchant-profile-service",
-            "--repo",
-            "repo-one",
-            "--run-type",
-            "workflow",
-            "--status",
-            "completed",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "query_runs"
-    assert payload["selectors"]["project"] == "merchant-profile-service"
-    assert captured["project"] == "merchant-profile-service"
-    assert captured["repo"] == "repo-one"
-    assert captured["run_type"] == "workflow"
-    assert captured["status"] == "completed"
-
-
-def test_state_query_summary_wires_selectors(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    def _fake_query_summary(**kwargs):
-        captured.update(kwargs)
-        return {"project": {"project_storage_key": "merchant-profile-service"}}
-
-    _install_fake_state_module(monkeypatch, query_summary=_fake_query_summary)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "query-summary",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project",
-            "merchant-profile-service",
-            "--repo",
-            "repo-one",
-            "--no-completeness",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "query_summary"
-    assert captured["project"] == "merchant-profile-service"
-    assert captured["repo"] == "repo-one"
-    assert captured["include_completeness"] is False
-
-
-def test_state_refresh_retrieval_snapshot_wires_embedding_overrides(monkeypatch, tmp_path: Path) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-    chunks_path = tmp_path / "chunks.jsonl"
-    chunks_path.write_text(
-        json.dumps({"chunk_id": "c-1", "content_hash": "h-1", "content_text": "hello"}) + "\n",
-        encoding="utf-8",
-    )
-
-    def _fake_refresh_retrieval_snapshot(**kwargs):
-        captured.update(kwargs)
-        return {"snapshot_key": kwargs.get("snapshot_key")}
-
-    _install_fake_state_module(monkeypatch, refresh_retrieval_snapshot=_fake_refresh_retrieval_snapshot)
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "state",
-            "refresh-retrieval-snapshot",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--project-storage-key",
-            "merchant-profile-service",
-            "--snapshot-key",
-            "merchant-profile-service:snap-1",
-            "--chunks-path",
-            str(chunks_path),
-            "--repo-storage-key",
-            "merchant-profile-service:repo-one",
-            "--model",
-            "nomic-embed-text",
-            "--batch-size",
-            "7",
-            "--timeout-seconds",
-            "45",
-            "--embedding-base-url",
-            "http://localhost:11434",
-            "--index-type",
-            "ivfflat",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "refresh_retrieval_snapshot"
-    assert captured["project_key"] == "merchant-profile-service"
-    assert captured["repo_key"] == "merchant-profile-service:repo-one"
-    assert captured["snapshot_key"] == "merchant-profile-service:snap-1"
-    assert captured["chunks_path"] == chunks_path
-    assert captured["model"] == "nomic-embed-text"
-    assert captured["batch_size"] == 7
-    assert captured["timeout_seconds"] == 45.0
-    assert captured["embedding_base_url"] == "http://localhost:11434"
-    assert captured["index_type"] == "ivfflat"
-
-
-def test_embedding_check_succeeds_with_expected_dimensions(monkeypatch) -> None:
-    runner = CliRunner()
-
-    monkeypatch.setattr(cli, "_fetch_ollama_local_models", lambda **_kwargs: ["bge-m3:latest"])
-    monkeypatch.setattr(
-        cli,
-        "_probe_embedding_dimensions",
-        lambda **_kwargs: {
-            "backend": "ollama_api_embed",
-            "response_model": "bge-m3:latest",
-            "model_digest": "digest-a",
-            "expected_dimensions": 1024,
-            "actual_dimensions": 1024,
-        },
-    )
-    monkeypatch.setattr(
-        cli,
-        "_collect_pgvector_readiness",
-        lambda **_kwargs: {
-            "ready": True,
-            "errors": [],
-            "diagnostics": {
-                "extension_available": True,
-                "extension_version": "0.8.1",
-                "extension_version_ok": True,
-                "vector_column_ready": True,
-                "hnsw_index_ready": True,
-                "ivfflat_index_ready": False,
-                "lexical_only": False,
-            },
-        },
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "embedding-check",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--model",
-            "bge-m3",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["operation"] == "embedding_check"
-    assert payload["status"] == "ok"
-    assert payload["checks"]["ollama_reachable"] is True
-    assert payload["checks"]["model_available"] is True
-    assert payload["checks"]["embedding_dimensions_ok"] is True
-    assert payload["checks"]["pgvector_ready"] is True
-    assert payload["resolved_model"] == "bge-m3:latest"
-
-
-def test_embedding_check_applies_bge_fallback_order_when_requested(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-
-    monkeypatch.setattr(cli, "_fetch_ollama_local_models", lambda **_kwargs: ["nomic-embed-text:latest"])
-
-    def _fake_probe_embedding_dimensions(**kwargs):
-        captured.update(kwargs)
-        return {
-            "backend": "ollama_api_embed",
-            "response_model": "nomic-embed-text:latest",
-            "model_digest": "digest-b",
-            "expected_dimensions": 768,
-            "actual_dimensions": 768,
-        }
-
-    monkeypatch.setattr(cli, "_probe_embedding_dimensions", _fake_probe_embedding_dimensions)
-    monkeypatch.setattr(
-        cli,
-        "_collect_pgvector_readiness",
-        lambda **_kwargs: {
-            "ready": True,
-            "errors": [],
-            "diagnostics": {
-                "extension_available": True,
-                "extension_version": "0.8.1",
-                "extension_version_ok": True,
-                "vector_column_ready": True,
-                "hnsw_index_ready": True,
-                "ivfflat_index_ready": False,
-                "lexical_only": False,
-            },
-        },
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "embedding-check",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--model",
-            "bge-m3",
-            "--allow-fallback",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "ok"
-    assert payload["resolved_model"] == "nomic-embed-text:latest"
-    assert payload["fallback_used"] is True
-    assert captured["model"] == "nomic-embed-text:latest"
-
-
-def test_embedding_check_fails_when_pgvector_readiness_fails(monkeypatch) -> None:
-    runner = CliRunner()
-
-    monkeypatch.setattr(cli, "_fetch_ollama_local_models", lambda **_kwargs: ["bge-m3:latest"])
-    monkeypatch.setattr(
-        cli,
-        "_probe_embedding_dimensions",
-        lambda **_kwargs: {
-            "backend": "ollama_api_embed",
-            "response_model": "bge-m3:latest",
-            "model_digest": "digest-a",
-            "expected_dimensions": 1024,
-            "actual_dimensions": 1024,
-        },
-    )
-    monkeypatch.setattr(
-        cli,
-        "_collect_pgvector_readiness",
-        lambda **_kwargs: {
-            "ready": False,
-            "errors": ["pgvector extension version must be >= 0.8.1 (found: 0.8.0)"],
-            "diagnostics": {
-                "extension_available": True,
-                "extension_version": "0.8.0",
-                "extension_version_ok": False,
-                "vector_column_ready": True,
-                "hnsw_index_ready": True,
-                "ivfflat_index_ready": False,
-                "lexical_only": False,
-            },
-        },
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "embedding-check",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-            "--model",
-            "bge-m3",
-        ],
-    )
-
-    assert result.exit_code == 1, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "error"
-    assert payload["checks"]["pgvector_ready"] is False
-    assert any("0.8.1" in err for err in payload["errors"])
-
-
-def test_typed_run_persistence_fail_fast(monkeypatch) -> None:
-    def _get_run(**_kwargs):
-        return {"run_id": "run-1"}
-
-    def _update_run(**_kwargs):
-        return {"run_id": "run-1"}
-
-    def _append_run_event(**_kwargs):
-        raise RuntimeError("db unavailable")
-
-    _install_fake_state_module(
-        monkeypatch,
-        get_run=_get_run,
-        create_run=lambda **kwargs: kwargs,
-        update_run=_update_run,
-        append_run_event=_append_run_event,
-    )
-
-    with pytest.raises(RuntimeError) as exc_info:
-        cli._persist_typed_run_terminal(
-            state_dsn="postgresql://user:pass@localhost/db",
-            run_id="run-1",
-            project_key="merchant-profile-service",
-            repo_key="merchant-profile-service:repo-one",
-            run_type="workflow",
-            terminal_status="completed",
-            event_type="analysis_completed",
-            payload={"kind": "workflow_run"},
-        )
-
-    message = str(exc_info.value)
-    assert "Typed run persistence failed" in message
-    assert "run_id='run-1'" in message
-    assert "analysis_completed" in message
-
-
-def test_typed_run_start_timeout_is_non_fatal(monkeypatch) -> None:
-    _install_fake_state_module(
-        monkeypatch,
-        get_run=lambda **_kwargs: {"run_id": "run-1"},
-        create_run=lambda **kwargs: kwargs,
-        update_run=lambda **kwargs: kwargs,
-        append_run_event=lambda **kwargs: kwargs,
-    )
-
-    monkeypatch.setattr(cli, "_noncritical_state_api_timeout_seconds", lambda: 0.01)
-
-    def _timeout_invoke(**_kwargs):
-        raise TimeoutError("state timeout")
-
-    monkeypatch.setattr(cli, "_invoke_state_api_with_timeout", _timeout_invoke)
-
-    cli._persist_typed_run_start(
-        state_dsn="postgresql://user:pass@localhost/db",
-        run_id="run-1",
-        project_key="merchant-profile-service",
-        repo_key="merchant-profile-service:repo-one",
-        run_type="workflow",
-        event_type="run_started",
-        payload={"kind": "workflow_invocation"},
-    )
-
-
-def test_load_manifest_payload_from_state_uses_timeout_guard(monkeypatch) -> None:
-    _install_fake_state_module(
-        monkeypatch,
-        load_manifest_payload=lambda **_kwargs: {"projects": []},
-    )
-    monkeypatch.setattr(cli, "_noncritical_state_api_timeout_seconds", lambda: 0.25)
-
-    captured: dict[str, object] = {}
-
-    def _capture_timeout(*_args, **kwargs):
-        captured["timeout_seconds"] = kwargs.get("timeout_seconds")
-        return {"projects": []}
-
-    monkeypatch.setattr(cli, "_invoke_state_api_with_timeout", _capture_timeout)
-
-    payload = cli._load_manifest_payload_from_state("postgresql://user:pass@localhost/db")
-
-    assert payload == {"projects": []}
-    assert captured["timeout_seconds"] == 0.25
-
-
-def test_typed_run_terminal_uses_scoped_run_id_when_run_type_collides(monkeypatch) -> None:
-    calls: dict[str, list[str]] = {
-        "get_run": [],
-        "create_run": [],
-        "update_run": [],
-        "append_run_event": [],
-    }
-
-    def _get_run(**kwargs):
-        run_id = str(kwargs["run_id"])
-        calls["get_run"].append(run_id)
-        if run_id == "thread-123":
-            return {"run_id": "thread-123", "run_type": "workflow"}
-        return None
-
-    def _create_run(**kwargs):
-        calls["create_run"].append(str(kwargs["run_id"]))
-        return kwargs
-
-    def _update_run(**kwargs):
-        calls["update_run"].append(str(kwargs["run_id"]))
-        return kwargs
-
-    def _append_run_event(**kwargs):
-        calls["append_run_event"].append(str(kwargs["run_id"]))
-        return kwargs
-
-    _install_fake_state_module(
-        monkeypatch,
-        get_run=_get_run,
-        create_run=_create_run,
-        update_run=_update_run,
-        append_run_event=_append_run_event,
-    )
-
-    cli._persist_typed_run_terminal(
-        state_dsn="postgresql://user:pass@localhost/db",
-        run_id="thread-123",
-        project_key="par",
-        repo_key="par:repo",
-        run_type="upload_results",
-        terminal_status="completed",
-        event_type="publish_completed",
-        payload={"kind": "upload_results"},
-    )
-
-    assert calls["get_run"] == ["thread-123", "thread-123:upload_results"]
-    assert calls["create_run"] == ["thread-123:upload_results"]
-    assert calls["update_run"] == ["thread-123:upload_results"]
-    assert calls["append_run_event"] == ["thread-123:upload_results"]
-
-
-def test_cache_stats_uses_state_api(monkeypatch) -> None:
-    runner = CliRunner()
-
-    def _fake_cache_stats(state_dsn: str):
-        return {"total_artifacts": 3, "status_counts": {"ready": 2, "claimed": 1}, "not_modified_count_total": 4}
-
-    _install_fake_state_module(monkeypatch, cache_stats=_fake_cache_stats)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "cache",
-            "stats",
-            "--state-dsn",
-            "postgresql://user:pass@localhost/db",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "ok"
-    assert payload["operation"] == "cache_stats"
-    assert payload["result"]["total_artifacts"] == 3
-
-
-def test_state_dsn_option_appears_in_phase36_command_help() -> None:
-    runner = CliRunner()
-    commands = ["parse-registry", "extract-docs", "workflow", "upload-results", "list-materials", "analyze"]
-    for command in commands:
-        result = runner.invoke(cli.app, [command, "--help"])
-        assert result.exit_code == 0, f"{command} help failed"
-        assert "--state-dsn" in result.output
-
-    result = runner.invoke(cli.app, ["cache", "stats", "--help"])
-    assert result.exit_code == 0
-    assert "--state-dsn" in result.output
-
-
-def test_parse_registry_persists_discovery_with_state_dsn(monkeypatch) -> None:
-    runner = CliRunner()
-    captured: dict[str, object] = {}
-    project = ProjectMaterial(
-        project_name="Insurance Core",
-        project_name_en=None,
-        page_id="101",
-        page_url="https://example.local/pages/1",
-        documents=[],
-        confluence_links=["https://example.local/pages/2"],
-        bitbucket_links=["https://bitbucket.local/projects/INS/repos/core"],
-        department="Payment",
-        department_page_id="200",
-        department_storage_key="200",
-        root_page_id="88716667",
-    )
-    registry = ProjectRegistry(
-        registry_url="/pages/viewpage.action?pageId=88716667",
-        registry_page_id="88716667",
-        projects=[project],
-    )
-
-    class _FakeConfluenceClient:
-        @classmethod
-        def for_registry_discovery(cls, *args, **kwargs):
-            return cls()
-
-    class _FakeParser:
-        def __init__(self, *args, **kwargs):
-            pass
-
-        async def parse_registry(self, _registry_id: str) -> ProjectRegistry:
-            return registry
-
-    async def _fake_resolve_page_id(_client, _identifier: str) -> str:
-        return "88716667"
-
-    def _record_discovery(**kwargs):
-        captured.update(kwargs)
-        return {"ok": True}
-
-    _install_fake_state_module(monkeypatch, record_discovery=_record_discovery)
-    monkeypatch.setattr(cli, "ConfluenceCliClient", _FakeConfluenceClient)
-    monkeypatch.setattr(parse_cmds, "RegistryPageParser", _FakeParser)
-    monkeypatch.setattr(cli, "_resolve_confluence_page_id", _fake_resolve_page_id)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "parse-registry",
-            "--registry-page",
-            "88716667",
-            "--state-dsn",
-            "sqlite:///tmp/state.db",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = captured["payload"]
-    assert isinstance(payload, dict)
-    assert payload["kind"] == "registry_discovery"
-    assert payload["project_count"] == 1
-    assert payload["departments"][0]["department"] == "Payment"
-    assert payload["departments"][0]["department_storage_key"] == "200"
-    assert payload["departments"][0]["department_page_id"] == "200"
-    assert payload["departments"][0]["project_count"] == 1
-    assert payload["departments"][0]["projects"][0]["project_storage_key"] == "101"
-    assert payload["projects"][0]["page_id"] == "101"
-    assert payload["projects"][0]["project_storage_key"] == "101"
-    assert payload["projects"][0]["confluence_links"] == ["https://example.local/pages/2"]
-    assert payload["projects"][0]["bitbucket_links"] == ["https://bitbucket.local/projects/INS/repos/core"]
-    assert "checklist_page_id" not in payload
-    assert "checklist_title" not in payload
-    assert "checklist_page_url" not in payload
-
-
-def test_parse_registry_state_persist_is_best_effort(monkeypatch) -> None:
-    runner = CliRunner()
-    registry = ProjectRegistry(
-        registry_url="/pages/viewpage.action?pageId=88716667",
-        registry_page_id="88716667",
-        projects=[],
-    )
-
-    class _FakeConfluenceClient:
-        @classmethod
-        def for_registry_discovery(cls, *args, **kwargs):
-            return cls()
-
-    class _FakeParser:
-        def __init__(self, *args, **kwargs):
-            pass
-
-        async def parse_registry(self, _registry_id: str) -> ProjectRegistry:
-            return registry
-
-    async def _fake_resolve_page_id(_client, _identifier: str) -> str:
-        return "88716667"
-
-    def _broken_record_discovery(**kwargs):
-        raise RuntimeError("state unavailable")
-
-    _install_fake_state_module(monkeypatch, record_discovery=_broken_record_discovery)
-    monkeypatch.setattr(cli, "ConfluenceCliClient", _FakeConfluenceClient)
-    monkeypatch.setattr(parse_cmds, "RegistryPageParser", _FakeParser)
-    monkeypatch.setattr(cli, "_resolve_confluence_page_id", _fake_resolve_page_id)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "parse-registry",
-            "--registry-page",
-            "88716667",
-            "--state-dsn",
-            "sqlite:///tmp/state.db",
-        ],
-    )
-
-    assert result.exit_code == 1, result.stdout
-    payload = json.loads(result.stdout)
-    assert "error" in payload
-    assert "state unavailable" in payload["error"].lower()
-
-
-def test_extract_docs_persists_artifacts_with_state_dsn(monkeypatch, tmp_path) -> None:
-    runner = CliRunner()
-    output_dir = tmp_path / "evidence"
-    captured: dict[str, object] = {}
-
-    project = ProjectMaterial(
-        project_name="Insurance Core",
-        project_name_en=None,
-        page_id="101",
-        page_url="https://example.local/pages/1",
-        bitbucket_links=[],
-        confluence_links=[],
-    )
-
-    class _FakeConfluenceClient:
-        def __init__(self, *args, **kwargs):
-            pass
-
-        async def crawl_tree(self, root_ref: str, output_dir: Path, **kwargs) -> dict[str, object]:
-            return {"page": {"page_id": root_ref}, "child_pages": [], "attachments": []}
-
-    class _FakeParser:
-        def __init__(self, *args, **kwargs):
-            pass
-
-        async def parse_project_page(self, _page_id: str, _label: str) -> ProjectMaterial | None:
-            return project
-
-    class _FakeDownloader:
-        def __init__(self, *args, **kwargs):
-            pass
-
-        async def download_page(self, page_id: str, output_root: Path, **kwargs):
-            page_path = output_root / f"{page_id}.md"
-            page_path.parent.mkdir(parents=True, exist_ok=True)
-            page_path.write_text("ok", encoding="utf-8")
-            return {"page_id": page_id, "markdown_path": str(page_path), "status": "found"}
-
-    class _FakeBitbucketDownloader:
-        def __init__(self, *args, **kwargs):
-            pass
-
-    async def _fake_resolve_page_id(_client, _identifier: str) -> str:
-        return "101"
-
-    def _record_artifacts(**kwargs):
-        captured.update(kwargs)
-        return {"ok": True}
-
-    _install_fake_state_module(
-        monkeypatch,
-        record_artifacts=_record_artifacts,
-        vector_index_health=lambda **_kw: {"status": "ok", "tables": []},
-        load_manifest_payload=lambda **_kw: {},
-    )
-    monkeypatch.setattr(extract_cmds, "ConfluenceCliClient", _FakeConfluenceClient)
-    monkeypatch.setattr(extract_cmds, "RegistryPageParser", _FakeParser)
-    monkeypatch.setattr(extract_cmds, "MaterialDownloader", _FakeDownloader)
-    monkeypatch.setattr(extract_cmds, "BitbucketMaterialDownloader", _FakeBitbucketDownloader)
-    monkeypatch.setattr(extract_cmds, "_resolve_confluence_page_id", _fake_resolve_page_id)
-
-    # Patch state functions on extract_cmds to prevent real Postgres connections
-    _ecmds = extract_cmds
-
-    monkeypatch.setattr(_ecmds, "_load_manifest_payload_from_state", lambda _dsn: {})
-    monkeypatch.setattr(
-        _ecmds,
-        "_preflight_extract_docs_retrieval_refresh",
-        lambda **_kw: {
-            "vector_readiness": {"ready": False, "diagnostics": {"lexical_only": True}},
-            "project_readiness": {},
-        },
-    )
-    monkeypatch.setattr(_ecmds, "_refresh_state_retrieval_snapshot", lambda **_kw: {"status": "ok"})
-
-    def _fake_record(*, state_dsn, payload, state_api=None):
-        captured.update({"payload": payload})
-        return {"ok": True}
-
-    monkeypatch.setattr(_ecmds, "_record_state_artifacts", _fake_record)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "extract-docs",
-            "--project-page",
-            "101",
-            "--output-dir",
-            str(output_dir),
-            "--recursive-depth",
-            "0",
-            "--no-include-attachments",
-            "--no-include-bitbucket",
-            "--state-dsn",
-            "sqlite:///tmp/state.db",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = captured["payload"]
-    assert isinstance(payload, dict)
-    assert payload["kind"] == "project_artifacts"
-    assert len(payload["projects"]) == 1
-    assert payload["projects"][0]["project_storage_key"] == "101"
-    assert payload["projects"][0]["fetch_policy"] == "if-changed"
-    sync_metadata = payload["projects"][0]["sync_metadata"]
-    assert isinstance(sync_metadata, dict)
-    assert sync_metadata["fetch_policy"] == "if-changed"
-    assert sync_metadata["artifact_count"] >= 1
-    assert sync_metadata["artifacts"][0]["resource_type"] == "confluence_page"
-
-
-def test_analyze_wires_state_dependencies_without_signature_fallback(monkeypatch, tmp_path) -> None:
-    runner = CliRunner()
-    evidence_dir = tmp_path / "evidence"
-    evidence_dir.mkdir(parents=True, exist_ok=True)
-    captured: dict[str, object] = {}
-
-    engine_module = types.ModuleType("vds_audit_orchestrator.engine.ad_hoc_analyzer")
-
-    class _FakeConfig:
-        def __init__(self, **kwargs):
-            self.kwargs = kwargs
-
-    class _FakeResult:
-        status = "PASS"
-        score = 100.0
-        evidence_anchors: list[dict[str, object]] = []
-
-        def model_dump(self, mode: str = "json") -> dict[str, object]:
-            return {
-                "requirement": "must validate signatures",
-                "status": "PASS",
-                "score": 100.0,
-                "evidence_anchors": [],
-            }
-
-    class _FakeAnalyzer:
-        def __init__(
-            self,
-            *,
-            evidence_dir: Path,
-            repo_path: Path | None,
-            config: _FakeConfig,
-            state_dsn: str,
-            state_manifest_loader,
-        ) -> None:
-            captured["evidence_dir"] = evidence_dir
-            captured["state_dsn"] = state_dsn
-            captured["state_manifest_loader"] = state_manifest_loader
-
-        async def analyze(self, requirement: str) -> _FakeResult:
-            captured["requirement"] = requirement
-            return _FakeResult()
-
-    engine_module.AdHocAnalysisConfig = _FakeConfig
-    engine_module.AdHocAnalyzer = _FakeAnalyzer
-    monkeypatch.setitem(sys.modules, "vds_audit_orchestrator.engine.ad_hoc_analyzer", engine_module)
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.cli._load_manifest_payload_from_state",
-        lambda _dsn: {
-            "projects": [
-                {
-                    "project_name": "test-project",
-                    "project_name_en": "Test Project",
-                    "page_id": "12345",
-                    "page_url": "https://confluence.example.local/pages/viewpage.action?pageId=12345",
-                    "project_storage_key": "12345",
-                    "documents": [],
-                    "bitbucket_links": [],
-                }
-            ]
-        },
-    )
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.cli._preflight_analyze_retrieval_snapshot",
-        lambda **_kwargs: None,
-    )
-
-    from vds_audit_orchestrator.evidence.corpus import EvidenceCorpus, EvidenceDocument
-
-    class _FakeManifestLoader:
-        def __init__(self, *_args, **_kwargs) -> None:
-            pass
-
-        def load(self) -> EvidenceCorpus:
-            return EvidenceCorpus(
-                documents=[
-                    EvidenceDocument(
-                        title="Security",
-                        content="Signature validation requirements",
-                        source_path="docs/test-project/security.md",
-                        doc_type="SRS",
-                        project_name="test-project",
-                        source_url="https://confluence.example.local/pages/viewpage.action?pageId=12345",
-                    )
-                ],
-            )
-
-        def load_runtime_corpus(self, **_kwargs) -> EvidenceCorpus:
-            return self.load()
-
-    monkeypatch.setattr("vds_audit_orchestrator.evidence.loader.EvidenceManifestLoader", _FakeManifestLoader)
-
-    bootstrap_module = types.ModuleType("vds_audit_orchestrator.evidence.bootstrap")
-    bootstrap_module.load_registry_manifest = lambda **kwargs: cli.ProjectRegistry(
-        registry_url="/pages/viewpage.action?pageId=1",
-        registry_page_id="1",
-        projects=[],
-    )
-    monkeypatch.setitem(sys.modules, "vds_audit_orchestrator.evidence.bootstrap", bootstrap_module)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "analyze",
-            "--requirement",
-            "must validate signatures",
-            "--state-dsn",
-            "sqlite:///tmp/state.db",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "PASS"
-    assert captured["state_dsn"] == "sqlite:///tmp/state.db"
-    assert captured["state_manifest_loader"] is cli._load_manifest_payload_from_state
-
-
-def test_analyze_prefers_bitbucket_repo_storage_key_for_repo_identity(monkeypatch, tmp_path) -> None:
-    runner = CliRunner()
-    evidence_dir = tmp_path / "evidence"
-    evidence_dir.mkdir(parents=True, exist_ok=True)
-    repo_root = tmp_path / "merchant-profile-service"
-    repo_root.mkdir(parents=True, exist_ok=True)
-    captured: dict[str, object] = {}
-
-    engine_module = types.ModuleType("vds_audit_orchestrator.engine.ad_hoc_analyzer")
-
-    class _FakeConfig:
-        def __init__(self, **kwargs):
-            self.kwargs = kwargs
-
-    class _FakeResult:
-        status = "PASS"
-        score = 100.0
-        evidence_anchors: list[dict[str, object]] = []
-
-        def model_dump(self, mode: str = "json") -> dict[str, object]:
-            return {
-                "requirement": "must validate signatures",
-                "status": "PASS",
-                "score": 100.0,
-                "evidence_anchors": [],
-            }
-
-    class _FakeAnalyzer:
-        def __init__(
-            self,
-            *,
-            evidence_dir: Path,
-            repo_path: Path | None,
-            config: _FakeConfig,
-            state_dsn: str,
-            state_manifest_loader,
-        ) -> None:
-            captured["evidence_dir"] = evidence_dir
-            captured["repo_path"] = repo_path
-            captured["config_kwargs"] = dict(config.kwargs)
-            captured["state_dsn"] = state_dsn
-            captured["state_manifest_loader"] = state_manifest_loader
-
-        async def analyze(self, requirement: str) -> _FakeResult:
-            captured["requirement"] = requirement
-            return _FakeResult()
-
-    engine_module.AdHocAnalysisConfig = _FakeConfig
-    engine_module.AdHocAnalyzer = _FakeAnalyzer
-    monkeypatch.setitem(sys.modules, "vds_audit_orchestrator.engine.ad_hoc_analyzer", engine_module)
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.cli._load_manifest_payload_from_state",
-        lambda _dsn: {
-            "projects": [
-                {
-                    "project_name": "test-project",
-                    "project_name_en": "Test Project",
-                    "page_id": "12345",
-                    "page_url": "https://confluence.example.local/pages/viewpage.action?pageId=12345",
-                    "project_storage_key": "12345",
-                    "documents": [],
-                    "bitbucket": [
-                        {
-                            "repo_slug": "merchant-profile-service",
-                            "repo_storage_key": "test-project:merchant-profile-service",
-                            "local_code_path": str(repo_root),
-                            "readiness": "ready",
-                            "status": "updated",
-                        }
-                    ],
-                }
-            ]
-        },
-    )
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.cli._preflight_analyze_retrieval_snapshot",
-        lambda **_kwargs: None,
-    )
-
-    from vds_audit_orchestrator.evidence.corpus import EvidenceCorpus, EvidenceDocument
-
-    class _FakeManifestLoader:
-        def __init__(self, *_args, **_kwargs) -> None:
-            pass
-
-        def load(self) -> EvidenceCorpus:
-            return EvidenceCorpus(
-                documents=[
-                    EvidenceDocument(
-                        title="Security",
-                        content="Signature validation requirements",
-                        source_path="docs/test-project/security.md",
-                        doc_type="SRS",
-                        project_name="test-project",
-                        source_url="https://confluence.example.local/pages/viewpage.action?pageId=12345",
-                    )
-                ],
-            )
-
-        def load_runtime_corpus(self, **_kwargs) -> EvidenceCorpus:
-            return self.load()
-
-    monkeypatch.setattr("vds_audit_orchestrator.evidence.loader.EvidenceManifestLoader", _FakeManifestLoader)
-
-    bootstrap_module = types.ModuleType("vds_audit_orchestrator.evidence.bootstrap")
-    bootstrap_module.load_registry_manifest = lambda **kwargs: cli.ProjectRegistry(
-        registry_url="/pages/viewpage.action?pageId=1",
-        registry_page_id="1",
-        projects=[],
-    )
-    monkeypatch.setitem(sys.modules, "vds_audit_orchestrator.evidence.bootstrap", bootstrap_module)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "analyze",
-            "--requirement",
-            "must validate signatures",
-            "--repo-path",
-            str(repo_root),
-            "--state-dsn",
-            "sqlite:///tmp/state.db",
-        ],
-    )
-
-    assert result.exit_code == 0, result.stdout
-    payload = json.loads(result.stdout)
-    assert payload["status"] == "PASS"
-    assert captured["repo_path"] == repo_root
-    assert captured["state_dsn"] == "sqlite:///tmp/state.db"
-    assert captured["state_manifest_loader"] is cli._load_manifest_payload_from_state
-    config_kwargs = captured["config_kwargs"]
-    assert isinstance(config_kwargs, dict)
-    assert config_kwargs.get("repo_storage_key") == "test-project-merchant-profile-service"