@phase2 @correction @checkpoint @rollback
Feature: Correction checkpoint rollback wiring
  As an operator
  I want corrections to roll back filesystem state via workspace checkpoints
  So that reverted decisions leave no stale artifacts on disk

  # ───────────────────────────────────────────────────────────
  # Workspace snapshot creation
  # ───────────────────────────────────────────────────────────

  Scenario: Workspace snapshot created before decision execution
    Given ccr a checkpoint service
    When ccr I create a workspace snapshot for plan "01ARZ3NDEKTSV4RRFFQ69G5FAV" decision "01DEC1S10N0000000000000000" with sandbox_ref "abc123"
    Then ccr the snapshot should be created with type "pre_decision"
    And ccr the snapshot should be aligned to decision "01DEC1S10N0000000000000000"
    And ccr the snapshot metadata should indicate diff-based storage

  Scenario: Workspace snapshot stores diff manifest in metadata
    Given ccr a checkpoint service
    When ccr I create a workspace snapshot for plan "01ARZ3NDEKTSV4RRFFQ69G5FAV" decision "01DEC1S10N0000000000000000" with sandbox_ref "abc123"
    Then ccr the snapshot metadata extra should contain "diff_based" as true
    And ccr the snapshot metadata extra should contain a "diff_hash"

  # ───────────────────────────────────────────────────────────
  # CorrectionService.revert_decisions() wiring
  # ───────────────────────────────────────────────────────────

  Scenario: revert_decisions invokes checkpoint rollback
    Given ccr a correction service with checkpoint support
    When ccr I call revert_decisions for plan "01PL4N000000000000000000" targeting decision "01DEC0000000000000000000"
    Then ccr the correction result should have status "applied"
    And ccr the correction result should have reverted decisions

  Scenario: revert_decisions without checkpoint service still succeeds
    Given ccr a correction service without checkpoint support
    When ccr I call revert_decisions for plan "01PL4N000000000000000000" targeting decision "01DEC0000000000000000000"
    Then ccr the correction result should have status "applied"
    And ccr the correction result checkpoint_restored should be false

  # ───────────────────────────────────────────────────────────
  # Physical artifact archival
  # ───────────────────────────────────────────────────────────

  Scenario: Artifacts physically moved to archive directory
    Given ccr a temporary sandbox directory with artifact files
    And ccr a checkpoint service
    When ccr I archive artifacts from the sandbox
    Then ccr the artifacts should exist in the archive directory
    And ccr the artifacts should not exist in their original locations

  Scenario: Archive tolerates missing artifact files
    Given ccr a temporary sandbox directory without artifact files
    And ccr a checkpoint service
    When ccr I archive artifacts from the sandbox
    Then ccr no errors should be raised
    And ccr the archived count should be 0

  # ───────────────────────────────────────────────────────────
  # Selective rollback
  # ───────────────────────────────────────────────────────────

  Scenario: Selective rollback to a specific checkpoint
    Given ccr a checkpoint service with sandbox for plan "01ARZ3NDEKTSV4RRFFQ69G5FAV"
    And ccr checkpoints "cp1" and "cp2" exist for plan "01ARZ3NDEKTSV4RRFFQ69G5FAV"
    When ccr I selectively rollback to checkpoint "cp1"
    Then ccr the rollback should succeed

  Scenario: Selective rollback is atomic on failure
    Given ccr a checkpoint service with sandbox for plan "01ARZ3NDEKTSV4RRFFQ69G5FAV"
    When ccr I attempt selective rollback to a nonexistent checkpoint
    Then ccr the sandbox should remain at the original HEAD

  # ───────────────────────────────────────────────────────────
  # Diff-based storage
  # ───────────────────────────────────────────────────────────

  Scenario: Diff-based checkpoint stores only changed file paths
    Given ccr a checkpoint service with sandbox for plan "01ARZ3NDEKTSV4RRFFQ69G5FAV"
    And ccr an initial checkpoint exists for plan "01ARZ3NDEKTSV4RRFFQ69G5FAV"
    And ccr a file is modified and committed in the sandbox
    When ccr I create a workspace snapshot capturing the diff
    Then ccr the snapshot diff_paths should include the modified file

  # ───────────────────────────────────────────────────────────
  # Atomic rollback
  # ───────────────────────────────────────────────────────────

  Scenario: Atomic rollback fully restores on success
    Given ccr a checkpoint service with sandbox for plan "01ARZ3NDEKTSV4RRFFQ69G5FAV"
    And ccr a checkpoint is created from sandbox HEAD
    And ccr a file is modified and committed in the sandbox
    When ccr I perform selective rollback to the checkpoint
    Then ccr the modified file should be reverted to its original state

  # ───────────────────────────────────────────────────────────
  # DI container wiring
  # ───────────────────────────────────────────────────────────

  Scenario: DI container wires checkpoint_service into CorrectionService
    Given ccr a fresh DI container
    When ccr I resolve the correction_service from the container
    Then ccr the correction_service should have a non-None checkpoint_service

  # ───────────────────────────────────────────────────────────
  # CLI rollback --to-checkpoint
  # ───────────────────────────────────────────────────────────

  Scenario: plan rollback --to-checkpoint option accepted
    Given ccr a CLI runner
    When ccr I invoke plan rollback with --to-checkpoint option
    Then ccr the command should recognize the --to-checkpoint flag