#Requires -Version 7.0
param([Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-f]{40}$')][string]$SourceCommit)
Set-StrictMode -Version Latest
$ErrorActionPreference='Stop'
$workspace='C:/Users/User/Documents/Git/ARCADIA-Studio/.local/scenario-spacing-ytr83r-20260913'
$root='C:/Users/User/Documents/Git/ARCADIA-Studio'
if(Test-Path -LiteralPath (Join-Path $PSScriptRoot 'finalization.json')){throw 'Already finalized; preserve this gate.'}
foreach($name in @('enumeration.json','expected-inputs.json','external-inputs.json','inputs-complete-before.json','toolchain-versions.json','list.log','list-receipt.json')){
 if(Test-Path -LiteralPath (Join-Path $PSScriptRoot $name)){throw ('Prior capture or run exists: '+$name)}
}
function Hash-Input([string]$Path){(Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()}
function Save-Record([string]$Name,$Record){$Record|ConvertTo-Json -Depth 16|Set-Content -LiteralPath (Join-Path $PSScriptRoot $Name) -Encoding utf8}
Push-Location -LiteralPath $workspace
try {
 $head=git rev-parse HEAD
 if($LASTEXITCODE -ne 0 -or $head -cne $SourceCommit){throw 'Source is not at the reviewed pin.'}
 $status=@(git status --porcelain)
 if($LASTEXITCODE -ne 0 -or $status.Count){throw 'Source must be committed and clean.'}
 $instruction=Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'instruction-update-template.json')|ConvertFrom-Json
 $changes=@(git diff --name-only $instruction.previous_source $SourceCommit)
 if($LASTEXITCODE -ne 0 -or $changes.Count -ne 1 -or $changes[0] -cne 'AGENTS.md'){throw 'Expected only the fetched user instruction update.'}
 $instructionBlob=git rev-parse 'HEAD:AGENTS.md'
 if($LASTEXITCODE -ne 0 -or $instructionBlob -cne $instruction.instruction_git_blob -or (Get-Item -LiteralPath 'AGENTS.md').Length -ne $instruction.instruction_bytes -or (Hash-Input 'AGENTS.md') -cne $instruction.instruction_sha256){throw 'Fetched user instructions do not match the reviewed bytes.'}
 $serverChanges=@(git diff --name-only 37be41092beb1c940f345072df1e017ce45fe2fc $SourceCommit -- crates/oa-core crates/oa-server Cargo.toml Cargo.lock rust-toolchain.toml)
 if($LASTEXITCODE -ne 0 -or $serverChanges.Count){throw 'Core/server provenance changed; parent must revise gate scope.'}
} finally {Pop-Location}
foreach($name in @('run.ps1','capture.ps1','enumerate-inputs.ps1','diagnostic.ps1')){
 $path=Join-Path $PSScriptRoot $name
 $text=[IO.File]::ReadAllText($path)
 if(-not $text.Contains('PENDING_REVIEWED_SOURCE_PIN')){throw 'Template was already modified; inspect before retry.'}
 [IO.File]::WriteAllText($path,$text.Replace('PENDING_REVIEWED_SOURCE_PIN',$SourceCommit),[Text.UTF8Encoding]::new($false))
}
$selection=Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'expected-tests.json')|ConvertFrom-Json
if(@($selection.tests).Count -ne 288 -or @($selection.tests|Sort-Object -Unique).Count -ne 288 -or @($selection.desktop_tests).Count -ne 1082 -or @($selection.desktop_tests|Sort-Object -Unique).Count -ne 1082){throw 'Expected membership changed; parent must review selection.'}
if(@($selection.tests|Where-Object {$_ -cnotin $selection.desktop_tests}).Count){throw 'Focused test absent from expected desktop listing.'}
$selection.source_commit=$SourceCommit
Save-Record 'expected-tests.json' $selection
& (Join-Path $PSScriptRoot 'enumerate-inputs.ps1')
$enumeration=Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'enumeration.json')|ConvertFrom-Json
$inputs=@(foreach($relative in $enumeration.gitPaths){$path=Join-Path $workspace $relative;$item=Get-Item -LiteralPath $path;[ordered]@{path=$relative;bytes=$item.Length;sha256=(Hash-Input $path)}})
$previousCapture=$instruction.previous_capture
if((Get-Item -LiteralPath $previousCapture.path).Length -ne $previousCapture.bytes -or (Hash-Input $previousCapture.path) -cne $previousCapture.sha256){throw 'Preserve the bound previous preparation capture.'}
$previous=Get-Content -Raw -LiteralPath $previousCapture.path|ConvertFrom-Json
if($previous.base -cne $instruction.previous_source -or $previous.count -ne 610 -or $inputs.Count -ne 610){throw 'Instruction-only update changed input count.'}
$remaining=@{}
foreach($file in $previous.files){if($remaining.ContainsKey($file.path)){throw 'Duplicate previous input'};$remaining[$file.path]=$file}
foreach($file in $inputs){if(-not $remaining.ContainsKey($file.path)){throw ('New compiled input: '+$file.path)};$old=$remaining[$file.path];if($file.bytes -ne $old.bytes -or $file.sha256 -cne $old.sha256){throw ('Instruction-only update changed compiled input: '+$file.path)};$remaining.Remove($file.path)}
if($remaining.Count){throw 'A previously captured compiled input is missing.'}
$instruction|Add-Member -NotePropertyName source_commit -NotePropertyValue $SourceCommit
$instruction|Add-Member -NotePropertyName compiled_inputs_equal -NotePropertyValue $true
$instruction.status='Verified fetched instruction-only commit and all610 compiled input bytes equal prior07e preparation. No Cargo executed.'
Save-Record 'instruction-update-provenance.json' $instruction
Save-Record 'expected-inputs.json' ([ordered]@{base=$SourceCommit;workspace=$workspace;count=$inputs.Count;files=$inputs})
$external=Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'external-input-template.json')|ConvertFrom-Json
$externalFiles=@(foreach($file in $external.files){$present=Test-Path -LiteralPath $file.path;if($present){$item=Get-Item -LiteralPath $file.path;[ordered]@{path=$file.path;present=$true;bytes=$item.Length;sha256=(Hash-Input $file.path)}}else{[ordered]@{path=$file.path;present=$false}}})
Save-Record 'external-inputs.json' ([ordered]@{base=$SourceCommit;status='Fresh external environment/config snapshot; not version-controlled inputs';files=$externalFiles})
$server=Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'server-provenance-template.json')|ConvertFrom-Json
$server.source=$SourceCommit
Save-Record 'server-provenance.json' $server
Save-Record 'cache-policy.json' ([ordered]@{base=$SourceCommit;retainExistingTarget=$true;cleanRequested=$false;target=(Join-Path $root 'target');scope='Combined spacing worktree rebuild. Retain shared target/cache and jobs1/incremental0; no clearance is performed by this recipe. Parent owns any separately authorized package clearance. Exact source and executable binding are required.'})
$previous=Join-Path $root '.local/scenario-workspace-gates-attempt3-20260913'
$receipt=Get-Content -Raw -LiteralPath (Join-Path $previous 'all-receipt.json')|ConvertFrom-Json
$files=@('list.log','list-receipt.json','focused.log','focused-receipt.json','all.log','all-receipt.json','inputs-complete-before.json','inputs-complete-all-after.json','expected-tests.json')
$bindings=@(foreach($name in $files){$path=Join-Path $previous $name;$item=Get-Item -LiteralPath $path;[ordered]@{path=$path;bytes=$item.Length;sha256=(Hash-Input $path)}})
Save-Record 'prior-failure-provenance.json' ([ordered]@{source=$SourceCommit;previousSource=$receipt.base;scope='Closed cb5 list1045 and focused224 passed; full1040 passed,2 failed,3 ignored. Full failed; strict/build not run. Prior gate is immutable and does not establish combined candidate acceptance.';bindings=$bindings;cargoExitCode=$receipt.cargoExitCode;inputsUnchanged=$receipt.inputsUnchanged;result=$receipt.testResultSummaries;failed=@($receipt.executedTests|Where-Object result -eq 'FAILED')})
& (Join-Path $PSScriptRoot 'capture.ps1') -Stage before
& (Join-Path $PSScriptRoot 'validate-scripts.ps1')
& (Join-Path $PSScriptRoot 'verify-parser.ps1')
Save-Record 'finalization.json' ([ordered]@{base=$SourceCommit;capturedUtc=[DateTime]::UtcNow.ToString('o');sourceCount=$inputs.Count;focusedCount=288;desktopExpectedCount=1082;cleanPerformed=$false;cargoExecuted=$false;sourceBeforeSha256=(Hash-Input (Join-Path $PSScriptRoot 'inputs-complete-before.json'));selectionSha256=(Hash-Input (Join-Path $PSScriptRoot 'expected-tests.json'));parserSha256=(Hash-Input (Join-Path $PSScriptRoot 'parser-verification.json'));status='Prepared only; parent dispatches list, focused, all, clippy, build sequentially'})
Write-Output ('Finalized source-only gate for '+$SourceCommit+' with '+$inputs.Count+' inputs; no Cargo or clean executed.')