termivar_scanner/

reporting.rs

//! Deterministic, bounded rendering for validated [`termivar_core::RunReport`] values.

pub mod comparison;

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
use crate::control_reference_mapping::{
    ControlReferenceMappingAudit, CONTROL_REFERENCE_MAPPING_AUDIT_SCHEMA,
    CONTROL_REFERENCE_MAPPING_CATALOGUE_ID, CONTROL_REFERENCE_MAPPING_CATALOGUE_REVISION,
    CONTROL_REFERENCE_MAPPING_POLICY_ID,
};
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
use crate::recon_ct_provider::{
    MAX_CERT_SPOTTER_ELAPSED, MAX_CERT_SPOTTER_IN_FLIGHT_REQUESTS, MAX_CERT_SPOTTER_RESPONSE_PAGES,
    MAX_CERT_SPOTTER_RESPONSE_PAGE_BYTES, MAX_CERT_SPOTTER_RETAINED_NAMES,
    MAX_CERT_SPOTTER_TOTAL_RESPONSE_BYTES,
};
#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
use crate::recon_snapshot::{
    ReconSnapshot, ReconnaissanceRecordValue, MAX_RECONNAISSANCE_SNAPSHOT_PREPARED_INDEX_BYTES,
    MAX_RECONNAISSANCE_SNAPSHOT_RECORDS, MAX_RECONNAISSANCE_SNAPSHOT_SOURCES,
    MAX_RECONNAISSANCE_SNAPSHOT_SOURCE_ASSOCIATIONS,
};

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
use crate::jwt_policy_review::{
    JwtClockAssurance, JwtExternalOperationStatus, JwtLocalSignatureStatus, JwtParseRejection,
    JwtParsingStatus, JwtPolicyReviewAudit, JwtPolicyStatus, JwtPolicyViolation,
    JwtTargetAcceptanceStatus, JWT_POLICY_REVIEW_AUDIT_SCHEMA, JWT_POLICY_REVIEW_POLICY_ID,
    MAX_CLOCK_SKEW_SECONDS, MAX_REQUIRED_CLAIMS,
};
#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
use crate::jwt_target_acceptance::{
    JwtTargetAcceptanceActivity, JwtTargetAcceptanceAudit, JwtTargetAcceptanceCommitStatus,
    JwtTargetAcceptanceConclusion, JwtTargetAcceptanceDimension, JwtTargetAcceptanceDispatchStatus,
    JwtTargetAcceptanceIncompleteReason, JwtTargetAcceptanceLegRole, JwtTargetAcceptanceLegStage,
    JwtTargetAcceptanceMarkerStatus, JwtTargetAcceptanceMethod,
    JwtTargetAcceptanceNotEligibleReason, JwtTargetAcceptanceResponseStatus,
    JWT_TARGET_ACCEPTANCE_AUDIT_SCHEMA, JWT_TARGET_ACCEPTANCE_POLICY_ID,
    MAX_JWT_TARGET_ACCEPTANCE_ACTIVE_REQUESTS, MAX_JWT_TARGET_ACCEPTANCE_REQUESTS,
    MAX_JWT_TARGET_ACCEPTANCE_RESPONSE_BYTES, MAX_JWT_TARGET_ACCEPTANCE_TOTAL_RESPONSE_BYTES,
};
#[cfg(all(feature = "scanning", feature = "rest-review"))]
use crate::rest_review::RestDocumentedResponseClass;
#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
use crate::template_evaluation_review::{
    TemplateEvaluationReviewAudit, TemplateEvaluationReviewOutcome,
    TEMPLATE_EVALUATION_ENGINE_IDENTITY, TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED,
    TEMPLATE_EVALUATION_REVIEW_AUDIT_SCHEMA, TEMPLATE_EVALUATION_REVIEW_CAPABILITY_ID,
    TEMPLATE_EVALUATION_REVIEW_CATEGORY, TEMPLATE_EVALUATION_REVIEW_CLAIM_LIMITS,
    TEMPLATE_EVALUATION_REVIEW_FAMILY_ID, TEMPLATE_EVALUATION_REVIEW_POLICY_ID,
    TEMPLATE_EVALUATION_REVIEW_REMEDIATION_ID, TEMPLATE_EVALUATION_REVIEW_REMEDIATION_SUMMARY,
    TEMPLATE_EVALUATION_REVIEW_SUMMARY, TEMPLATE_EVALUATION_REVIEW_TITLE,
};

// Mirrors the closed projection emitted by
// `assessment_review_projection::TEMPLATE_EVALUATION_REVIEW`. Keeping these
// values in the writer contract makes a producer change fail closed instead of
// silently changing the saved-report meaning.
#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
const TEMPLATE_EVALUATION_REVIEW_CONFIDENCE_PPM: u32 = 1_000_000;
#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
const TEMPLATE_EVALUATION_REVIEW_CONTROL_EVIDENCE_COUNT: usize = 6;
#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
const TEMPLATE_EVALUATION_REVIEW_CANDIDATE_EVIDENCE_COUNT: usize = 6;
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
use crate::web_runtime::WebAssessmentReconCtProviderAudit;
#[cfg(all(
    feature = "scanning",
    feature = "websocket-review",
    feature = "supplied-session-review"
))]
use crate::web_runtime::WEBSOCKET_SUPPLIED_SESSION_AUDIT_SCHEMA;
#[cfg(feature = "scanning")]
use crate::web_runtime::{
    AssessmentBasis, AssessmentRunReport, AssessmentRunReportError, ScanProfileV1,
    WebAssessmentRunReport,
};
#[cfg(all(feature = "scanning", feature = "openapi-review"))]
use crate::web_runtime::{OpenApiRuntimeOutcome, OPENAPI_REVIEW_CAPABILITY_ID};
#[cfg(all(feature = "scanning", feature = "rest-review"))]
use crate::web_runtime::{
    RestObservedMediaClass, RestRuntimeOutcome, MAX_REST_REVIEW_ACTIVE_VERIFICATIONS,
    MAX_REST_REVIEW_REQUESTS, REST_REVIEW_CAPABILITY_ID,
};
#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
use crate::web_runtime::{
    WebAssessmentSecretExposureAudit, MAX_SECRET_EXPOSURE_BODY_BYTES,
    MAX_SECRET_EXPOSURE_OCCURRENCES, MAX_SECRET_EXPOSURE_RESPONSES,
    MAX_SECRET_EXPOSURE_RETAINED_OBSERVATIONS, MAX_SECRET_EXPOSURE_TOTAL_BODY_BYTES,
    SECRET_EXPOSURE_AUDIT_SCHEMA, SECRET_EXPOSURE_CATALOGUE_ID, SECRET_EXPOSURE_CATALOGUE_REVISION,
    SECRET_EXPOSURE_POLICY_ID, SECRET_EXPOSURE_REPRESENTATION,
};
#[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
use crate::web_runtime::{
    WebAssessmentTlsNegotiationReviewAudit, TLS_NEGOTIATION_REVIEW_AUDIT_SCHEMA,
    TLS_NEGOTIATION_REVIEW_CAPABILITY_ID, TLS_NEGOTIATION_REVIEW_POLICY_ID,
};
#[cfg(all(feature = "scanning", feature = "tls-observation"))]
use crate::web_runtime::{
    WebAssessmentTlsObservationAudit, HARD_MAX_WEB_ASSESSMENT_TOTAL_REQUESTS,
    TLS_OBSERVATION_AUDIT_SCHEMA, TLS_OBSERVATION_BACKEND_LIMIT, TLS_OBSERVATION_CLOCK_ASSURANCE,
    TLS_OBSERVATION_POLICY_ID, TLS_OBSERVATION_REVOCATION_STATUS, TLS_OBSERVATION_SOURCE_SCOPE,
    TLS_OBSERVATION_VALIDATION_SCOPE,
};
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
use crate::xml_external_entity_review::{
    XmlExternalEntityMaximumDisposition, XmlExternalEntityOperationStatus,
    XmlExternalEntityReviewAudit, XmlExternalEntityReviewOutcome,
    MAX_XML_EXTERNAL_ENTITY_DOCUMENT_BYTES, MAX_XML_EXTERNAL_ENTITY_PROVIDER_REQUESTS,
    MAX_XML_EXTERNAL_ENTITY_TARGET_RESPONSE_BYTES, XML_EXTERNAL_ENTITY_ACTIVE_VERIFICATIONS,
    XML_EXTERNAL_ENTITY_REVIEW_CONTROL_MODEL, XML_EXTERNAL_ENTITY_REVIEW_MEDIA_TYPE,
    XML_EXTERNAL_ENTITY_REVIEW_METHOD, XML_EXTERNAL_ENTITY_TARGET_REQUESTS,
};
#[cfg(all(feature = "scanning", feature = "authorization-review"))]
use crate::{
    authorization_review::{
        AuthorizationReviewOutcome, HARD_MAX_AUTHORIZATION_REVIEW_IGNORED_PATHS,
        HARD_MAX_AUTHORIZATION_REVIEW_SELECTED_PATHS,
    },
    web_runtime::{MAX_AUTHORIZATION_REVIEW_REQUESTS, RESOURCE_AUTHORIZATION_REVIEW_CAPABILITY_ID},
};
#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
use crate::{
    supplied_session_review::{
        SuppliedSessionCredentialAcquisition, SuppliedSessionCredentialMechanism,
        MAX_SUPPLIED_SESSION_COOKIES, MAX_SUPPLIED_SESSION_TOTAL_RESPONSE_BYTES,
    },
    web_runtime::{
        SuppliedSessionAuditOutcome, SuppliedSessionBodyState, SuppliedSessionCoverage,
        SuppliedSessionHealthCheckpointPhase, SuppliedSessionHealthOracleKind,
        SuppliedSessionHealthOutcome, SuppliedSessionLoginFormOutcome,
        SuppliedSessionLoginSubmitOutcome, SuppliedSessionPredicateOutcome,
        SuppliedSessionPrincipalAssurance, SuppliedSessionResourceOutcome,
        WebAssessmentSuppliedSessionAudit, WebAssessmentSuppliedSessionCheckpointAudit,
        MAX_SUPPLIED_SESSION_CHECKPOINTS, MAX_SUPPLIED_SESSION_REQUESTS,
        MAX_SUPPLIED_SESSION_RESOURCES, SUPPLIED_SESSION_AUDIT_SCHEMA,
        SUPPLIED_SESSION_CAPABILITY_ID, SUPPLIED_SESSION_COOKIE_AUDIT_SCHEMA,
        SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA,
        SUPPLIED_SESSION_OAUTH_AUTHORIZATION_AUDIT_SCHEMA,
        SUPPLIED_SESSION_OAUTH_CODE_AUDIT_SCHEMA, SUPPLIED_SESSION_OAUTH_REFRESH_AUDIT_SCHEMA,
        SUPPLIED_SESSION_RENEWAL_AUDIT_SCHEMA,
    },
};
#[cfg(all(feature = "scanning", feature = "websocket-review"))]
use crate::{
    web_runtime::{
        WebAssessmentWebSocketReviewAudit, HARD_MAX_WEB_ASSESSMENT_TOTAL_RESPONSE_BYTES,
        MAX_WEBSOCKET_REVIEW_APPLICATION_BYTES_PER_DIRECTION, MAX_WEBSOCKET_REVIEW_CONNECTIONS,
        WEBSOCKET_REVIEW_AUDIT_SCHEMA, WEBSOCKET_REVIEW_CAPABILITY_ID,
    },
    websocket_review::{
        MAX_WEBSOCKET_REVIEW_CONTROL_FRAMES, MAX_WEBSOCKET_REVIEW_MESSAGES,
        MAX_WEBSOCKET_REVIEW_WALL_TIME_MS,
    },
};
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
use crate::{
    web_runtime::{
        WebAssessmentWordPressAudit, WordPressAssetFingerprintExecution,
        WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID, WORDPRESS_REVIEW_CAPABILITY_ID,
    },
    wordpress_review::{
        WordPressActivationState, WordPressAdvisoryCatalogSchema, WordPressApplicability,
        WordPressAssetFingerprintAggregateState, WordPressAssetFingerprintRelation,
        WordPressAssetFingerprintReleaseState, WordPressAssetFingerprintUnknownReason,
        WordPressCatalogStatus, WordPressComparisonProfile, WordPressComponentEvidenceClass,
        WordPressComponentKind, WordPressEvidenceConfidence, WordPressEvidenceSource,
        WordPressExecutionStatus, WordPressExternalApplicability,
        WordPressExternalComparisonPolicy, WordPressExternalRangeReason,
        WordPressExternalRangeRelation, WordPressExternalVersionEvidenceStatus,
        WordPressExternalVersionRelation, WordPressExternalVersionRelationReason,
        WordPressHostingOs, WordPressInventoryCategoryStatus, WordPressInventoryEntryStatus,
        WordPressInventoryLimitationReason, WordPressLocalInputClass, WordPressMultisiteState,
        WordPressPatchState, WordPressPrerequisite, WordPressPrerequisiteOutcome,
        WordPressVersionRelation, WordPressVersionResolution, WordPressVersionResolutionReason,
        WordfenceV3CvssRating, WordfenceV3IdentityMapping, WordfenceV3RangeValue,
        MAX_WORDFENCE_V3_SOFTWARE_PER_RECORD, MAX_WORDPRESS_ADVISORY_RECORDS,
        MAX_WORDPRESS_ASSET_FINGERPRINT_ASSET_BYTES, MAX_WORDPRESS_ASSET_FINGERPRINT_CATALOG_BYTES,
        MAX_WORDPRESS_ASSET_FINGERPRINT_CATALOG_COMPONENTS,
        MAX_WORDPRESS_ASSET_FINGERPRINT_CATALOG_FILES, MAX_WORDPRESS_ASSET_FINGERPRINT_PATH_BYTES,
        MAX_WORDPRESS_ASSET_FINGERPRINT_RELEASES_PER_COMPONENT,
        MAX_WORDPRESS_ASSET_FINGERPRINT_RESOURCES_PER_COMPONENT,
        MAX_WORDPRESS_ASSET_FINGERPRINT_RETAINED_BYTES,
        MAX_WORDPRESS_EXTERNAL_IDENTITY_LIMITATION_PROJECTIONS, MAX_WORDPRESS_RESULT_COMPONENTS,
        MAX_WORDPRESS_RESULT_VERSION_EVIDENCE, MAX_WORDPRESS_SAVED_INVENTORY_BYTES,
        MAX_WORDPRESS_SIGNALS, WORDFENCE_V3_IDENTITY_MAPPING_POLICY, WORDFENCE_V3_MAPPING_REVISION,
        WORDFENCE_V3_MAPPING_REVISION_V2, WORDFENCE_V3_RESOURCE_POLICY_V1,
        WORDFENCE_V3_RESOURCE_POLICY_V2, WORDFENCE_V3_RESOURCE_POLICY_V3,
        WORDPRESS_ADVISORY_CATALOG_SCHEMA, WORDPRESS_ADVISORY_CATALOG_SCHEMA_V2,
        WORDPRESS_ASSET_FINGERPRINT_CATALOG_SCHEMA,
        WORDPRESS_ASSET_FINGERPRINT_REPRESENTATION_PROFILE,
    },
};
use serde::Serialize;
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
use sha2::{Digest, Sha256};
use std::{error::Error, fmt, io};
use termivar_core::{
    OutcomeStatus, ResourceAccounting, ResourceAccountingMode, RunOutcomeRecord, RunReport,
    RunStatus, RunStepStatus, RunStopCode, SecuritySeverity,
};

/// Stable schema name for rendered run documents.
pub const REPORT_DOCUMENT_SCHEMA: &str = "venom-rendered-run/v1";
/// Stable schema name for the additive, redacted assessment document.
#[cfg(feature = "scanning")]
pub const ASSESSMENT_REPORT_DOCUMENT_SCHEMA: &str = "venom-rendered-assessment/v1";
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_AUDIT_SCHEMA: &str =
    "security.xml-external-entity-review-audit/v1";
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_ALGORITHM: &str =
    "security.xml-external-entity-resolution-review/v1";
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_CAPABILITY_ID: &str =
    "xml.external-entity.repeated-outbound-interaction@1";
/// Maximum UTF-8 bytes returned by one render operation.
pub const MAX_RENDERED_REPORT_BYTES: usize = 16 * 1_024 * 1_024;
#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
const RECON_SNAPSHOT_IMPORT_AUDIT_SCHEMA: &str = "security.recon-snapshot-import-audit/v1";
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
const RECON_CERTSPOTTER_AUDIT_SCHEMA: &str = "security.recon-certspotter-audit/v1";
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
const RECON_CERTSPOTTER_POLICY_ID: &str = "termivar.recon-certspotter-provider/v1";
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
const RECON_CERTSPOTTER_PROVIDER: &str = "cert_spotter";
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
const RECON_CERTSPOTTER_ISSUANCE_REFERENCE_PREFIX: &str = "certspotter-issuance-sha256:";
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
const MAX_RECON_CERTSPOTTER_ISSUANCE_ID_BYTES: usize = 128;
#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
const RECON_CERTSPOTTER_CLAIM_LIMITS: [&str; 5] = [
    "hypotheses_only",
    "scan_authority_not_granted",
    "ownership_not_established",
    "currentness_not_established",
    "source_authentication_not_established",
];

const REPORT_FORMATS: [ReportFormat; 4] = [
    ReportFormat::Json,
    ReportFormat::Csv,
    ReportFormat::Html,
    ReportFormat::Markdown,
];

/// Supported deterministic report encodings.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
#[non_exhaustive]
pub enum ReportFormat {
    /// Compact UTF-8 JSON.
    Json,
    /// UTF-8 comma-separated records.
    Csv,
    /// Self-contained UTF-8 HTML.
    Html,
    /// UTF-8 Markdown.
    Markdown,
}

impl ReportFormat {
    /// Returns the stable format token.
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::Json => "json",
            Self::Csv => "csv",
            Self::Html => "html",
            Self::Markdown => "markdown",
        }
    }

    /// Returns the stable media type.
    pub const fn media_type(self) -> &'static str {
        match self {
            Self::Json => "application/json",
            Self::Csv => "text/csv; charset=utf-8",
            Self::Html => "text/html; charset=utf-8",
            Self::Markdown => "text/markdown; charset=utf-8",
        }
    }

    /// Returns the conventional extension without a leading period.
    pub const fn extension(self) -> &'static str {
        match self {
            Self::Json => "json",
            Self::Csv => "csv",
            Self::Html => "html",
            Self::Markdown => "md",
        }
    }
}

/// Fail-closed rendering errors.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub enum ReportError {
    /// Escaped output would exceed the public byte ceiling.
    OutputLimitExceeded {
        /// Configured maximum returned size.
        limit: usize,
    },
    /// A deterministic projection could not be serialized.
    Serialization,
}

impl fmt::Display for ReportError {
    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::OutputLimitExceeded { .. } => {
                formatter.write_str("rendered report exceeds the output byte limit")
            },
            Self::Serialization => formatter.write_str("rendered report serialization failed"),
        }
    }
}

impl Error for ReportError {}

/// Stateless renderer for supported encodings.
#[derive(Debug, Default, Clone, Copy)]
pub struct ReportGenerator;

impl ReportGenerator {
    /// Renders one report, returning no partial document on failure.
    pub fn generate(report: &RunReport, format: ReportFormat) -> Result<String, ReportError> {
        let document = ReportDocument::from_report(report)?;
        render_with_limit(&document, format, MAX_RENDERED_REPORT_BYTES)
    }

    /// Consumes one completed runtime-owned web assessment into its typed
    /// product envelope. The generic run envelope is minted internally from
    /// the runtime's clock and metered accounting; callers cannot supply or
    /// replace it.
    #[cfg(feature = "scanning")]
    pub fn compose_assessment(
        report: WebAssessmentRunReport,
        profile: ScanProfileV1,
    ) -> Result<AssessmentRunReport, AssessmentRunReportError> {
        #[cfg(feature = "jwt-target-acceptance-review")]
        if report.jwt_target_acceptance_audit().is_some() {
            return Err(AssessmentRunReportError::JwtPolicyReviewAuditMismatch);
        }
        report.into_assessment_report(profile)
    }

    /// Composes the ordinary completed assessment and then attaches one
    /// independently evaluated transport-free local JWT audit. No runtime or
    /// network authority is created by this reporting bridge.
    #[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
    pub fn compose_assessment_with_jwt_policy_review(
        report: WebAssessmentRunReport,
        profile: ScanProfileV1,
        audit: Option<JwtPolicyReviewAudit>,
    ) -> Result<AssessmentRunReport, AssessmentRunReportError> {
        report
            .into_assessment_report(profile)?
            .with_jwt_policy_review_audit(audit)
    }

    /// Attaches the explicitly selected, transport-free control-reference
    /// projection after the ordinary assessment has completed. The mapper can
    /// neither create assessment items nor change their claim authority.
    #[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
    pub fn attach_control_reference_mapping(
        report: AssessmentRunReport,
    ) -> Result<AssessmentRunReport, AssessmentRunReportError> {
        report.with_control_reference_mapping()
    }

    /// Attaches one explicitly supplied, already validated local
    /// reconnaissance snapshot after the ordinary assessment has completed.
    /// Imported hypotheses do not become subjects, assessment items, or
    /// transport authority.
    #[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
    pub fn attach_recon_snapshot(
        report: AssessmentRunReport,
        audit: ReconSnapshot,
    ) -> Result<AssessmentRunReport, AssessmentRunReportError> {
        report.with_recon_snapshot(audit)
    }

    /// Renders one completed typed assessment through the existing bounded,
    /// context-safe report encoders. This is an additive document surface and
    /// never changes the [`REPORT_DOCUMENT_SCHEMA`] compatibility contract.
    #[cfg(feature = "scanning")]
    pub fn generate_assessment(
        report: &AssessmentRunReport,
        format: ReportFormat,
    ) -> Result<String, ReportError> {
        let document = AssessmentDocument::from_report(report)?;
        render_assessment_with_limit(&document, format, MAX_RENDERED_REPORT_BYTES)
    }

    /// Returns all formats in stable negotiation order.
    pub const fn available_formats() -> &'static [ReportFormat] {
        &REPORT_FORMATS
    }
}

fn render_with_limit(
    document: &ReportDocument<'_>,
    format: ReportFormat,
    limit: usize,
) -> Result<String, ReportError> {
    match format {
        ReportFormat::Json => render_json(document, limit),
        ReportFormat::Csv => render_csv(document, limit),
        ReportFormat::Html => render_html(document, limit),
        ReportFormat::Markdown => render_markdown(document, limit),
    }
}

fn render_json(document: &ReportDocument<'_>, limit: usize) -> Result<String, ReportError> {
    render_serializable_json(document, limit)
}

fn render_serializable_json(
    document: &impl Serialize,
    limit: usize,
) -> Result<String, ReportError> {
    let mut raw = RawJsonWriter::new(limit);
    if serde_json::to_writer(&mut raw, document).is_err() {
        return if raw.exceeded {
            Err(ReportError::OutputLimitExceeded { limit })
        } else {
            Err(ReportError::Serialization)
        };
    }
    let raw = std::str::from_utf8(&raw.bytes).map_err(|_| ReportError::Serialization)?;
    let mut output = RenderBuffer::new(limit);
    for character in raw.chars() {
        if character.is_control() || is_bidi_control(character) {
            write_json_codepoint(&mut output, character)?;
        } else {
            output.push_char(character)?;
        }
    }
    Ok(output.finish())
}

struct RawJsonWriter {
    bytes: Vec<u8>,
    limit: usize,
    exceeded: bool,
}

impl RawJsonWriter {
    fn new(limit: usize) -> Self {
        Self {
            bytes: Vec::new(),
            limit,
            exceeded: false,
        }
    }
}

impl io::Write for RawJsonWriter {
    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
        let Some(next_len) = self.bytes.len().checked_add(bytes.len()) else {
            self.exceeded = true;
            return Err(io::Error::other("raw JSON limit reached"));
        };
        if next_len > self.limit {
            self.exceeded = true;
            return Err(io::Error::other("raw JSON limit reached"));
        }
        self.bytes
            .try_reserve(bytes.len())
            .map_err(|_| io::Error::other("raw JSON allocation failed"))?;
        self.bytes.extend_from_slice(bytes);
        Ok(bytes.len())
    }

    fn flush(&mut self) -> io::Result<()> {
        Ok(())
    }
}

fn write_json_codepoint(output: &mut RenderBuffer, character: char) -> Result<(), ReportError> {
    let codepoint = u32::from(character);
    if codepoint <= u32::from(u16::MAX) {
        return output.push_fmt(format_args!("\\u{codepoint:04X}"));
    }
    let supplementary = codepoint - 0x1_0000;
    let high = 0xD800 + (supplementary >> 10);
    let low = 0xDC00 + (supplementary & 0x3FF);
    output.push_fmt(format_args!("\\u{high:04X}\\u{low:04X}"))
}

struct RenderBuffer {
    value: String,
    limit: usize,
}

impl RenderBuffer {
    fn new(limit: usize) -> Self {
        Self {
            value: String::new(),
            limit,
        }
    }

    fn push_str(&mut self, value: &str) -> Result<(), ReportError> {
        let Some(next_len) = self.value.len().checked_add(value.len()) else {
            return Err(ReportError::OutputLimitExceeded { limit: self.limit });
        };
        if next_len > self.limit {
            return Err(ReportError::OutputLimitExceeded { limit: self.limit });
        }
        self.value.push_str(value);
        Ok(())
    }

    fn push_char(&mut self, value: char) -> Result<(), ReportError> {
        let next_len = self
            .value
            .len()
            .checked_add(value.len_utf8())
            .ok_or(ReportError::OutputLimitExceeded { limit: self.limit })?;
        if next_len > self.limit {
            return Err(ReportError::OutputLimitExceeded { limit: self.limit });
        }
        self.value.push(value);
        Ok(())
    }

    fn push_fmt(&mut self, arguments: fmt::Arguments<'_>) -> Result<(), ReportError> {
        fmt::write(self, arguments)
            .map_err(|_| ReportError::OutputLimitExceeded { limit: self.limit })
    }

    fn finish(self) -> String {
        self.value
    }
}

impl fmt::Write for RenderBuffer {
    fn write_str(&mut self, value: &str) -> fmt::Result {
        self.push_str(value).map_err(|_| fmt::Error)
    }

    fn write_char(&mut self, value: char) -> fmt::Result {
        self.push_char(value).map_err(|_| fmt::Error)
    }
}

const CSV_HEADERS: [&str; 14] = [
    "record_type",
    "name",
    "value",
    "status_or_disposition",
    "kind",
    "action_id",
    "severity",
    "confidence_ppm",
    "evidence_count",
    "limit",
    "consumed",
    "remaining",
    "duration_ms",
    "redacted_summary",
];

fn render_csv(document: &ReportDocument<'_>, limit: usize) -> Result<String, ReportError> {
    let mut output = RenderBuffer::new(limit);
    write_csv_row(&mut output, CSV_HEADERS)?;
    for (name, value) in [
        ("schema", document.schema),
        ("source_schema", document.source_schema),
        ("status", document.status),
        ("stop_code", document.stop_code),
        ("target", document.target),
        ("authorized_origin", document.authorized_origin),
        ("started_at", document.started_at.as_str()),
        ("completed_at", document.completed_at.as_str()),
    ] {
        write_csv_row(
            &mut output,
            [
                "document", name, value, "", "", "", "", "", "", "", "", "", "", "",
            ],
        )?;
    }
    for (name, dimension) in document.accounting.dimensions() {
        write_csv_row(
            &mut output,
            [
                "accounting",
                name,
                dimension.mode,
                "",
                "",
                "",
                "",
                "",
                "",
                dimension.limit.as_deref().unwrap_or(""),
                dimension.consumed.as_deref().unwrap_or(""),
                dimension.remaining.as_deref().unwrap_or(""),
                "",
                "",
            ],
        )?;
    }
    for step in &document.steps {
        let ordinal = step.ordinal.to_string();
        write_csv_row(
            &mut output,
            [
                "step",
                &ordinal,
                "",
                step.status,
                "",
                step.action_id,
                "",
                "",
                "",
                "",
                "",
                "",
                &step.duration_ms,
                "",
            ],
        )?;
    }
    for (index, outcome) in document.outcomes.iter().enumerate() {
        let index = (index + 1).to_string();
        let confidence_ppm = outcome.confidence_ppm.to_string();
        let evidence_count = outcome.evidence_count.to_string();
        write_csv_row(
            &mut output,
            [
                "outcome",
                &index,
                "",
                outcome.disposition,
                outcome.kind,
                outcome.action_id,
                outcome.severity,
                &confidence_ppm,
                &evidence_count,
                "",
                "",
                "",
                "",
                outcome.redacted_summary,
            ],
        )?;
    }
    Ok(output.finish())
}

fn write_csv_row(
    output: &mut RenderBuffer,
    cells: [&str; CSV_HEADERS.len()],
) -> Result<(), ReportError> {
    for (index, cell) in cells.into_iter().enumerate() {
        if index != 0 {
            output.push_char(',')?;
        }
        write_csv_cell(output, cell)?;
    }
    output.push_char('\n')
}

fn write_csv_cell(output: &mut RenderBuffer, value: &str) -> Result<(), ReportError> {
    output.push_char('"')?;
    if starts_csv_formula_after_whitespace(value) {
        output.push_char('\'')?;
    }
    for character in value.chars() {
        match character {
            '"' => output.push_str("\"\"")?,
            '\'' => output.push_str("\\u{0027}")?,
            '\\' => output.push_str("\\\\")?,
            character if character.is_control() || is_bidi_control(character) => {
                write_visible_codepoint(output, character)?;
            },
            character => output.push_char(character)?,
        }
    }
    output.push_char('"')
}

fn starts_csv_formula_after_whitespace(value: &str) -> bool {
    matches!(
        value.chars().find(|character| !character.is_whitespace()),
        Some('=' | '+' | '-' | '@')
    )
}

fn render_html(document: &ReportDocument<'_>, limit: usize) -> Result<String, ReportError> {
    let mut output = RenderBuffer::new(limit);
    output.push_str(
        "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">\
<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'none'; style-src 'unsafe-inline'; img-src 'none'; base-uri 'none'; form-action 'none'\">\
<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\
<title>Termivar run report</title><style>\
:root{color-scheme:light dark}body{font:14px/1.5 system-ui,sans-serif;margin:2rem;max-width:90rem}\
h1,h2{line-height:1.2}.lifecycle{border:3px solid currentColor;padding:.8rem;font-size:1.1rem}.meta{display:grid;grid-template-columns:max-content 1fr;gap:.3rem 1rem}\
table{border-collapse:collapse;width:100%;margin-block:1rem 2rem}th,td{border:1px solid currentColor;padding:.35rem;text-align:left;vertical-align:top}\
code{overflow-wrap:anywhere}.empty{font-style:italic}</style></head><body><main>\
<h1>Termivar run report</h1>",
    )?;
    if document.status == "complete" {
        output
            .push_str("<p class=\"lifecycle\"><strong>Lifecycle status:</strong> completed.</p>")?;
    } else {
        output.push_str(
            "<aside class=\"lifecycle\"><strong>Lifecycle notice:</strong> Run did not complete. Status <code>",
        )?;
        write_html_text(&mut output, document.status)?;
        output.push_str("</code>; stop code <code>")?;
        write_html_text(&mut output, document.stop_code)?;
        output.push_str("</code>.</aside>")?;
    }
    output.push_str("<dl class=\"meta\">")?;
    for (label, value) in document.metadata() {
        output.push_str("<dt>")?;
        write_html_text(&mut output, label)?;
        output.push_str("</dt><dd><code>")?;
        write_html_text(&mut output, value)?;
        output.push_str("</code></dd>")?;
    }
    output.push_str(
        "</dl><section><h2>Resource accounting</h2><table><thead><tr>\
<th>Dimension</th><th>Mode</th><th>Limit</th><th>Consumed</th><th>Remaining</th>\
</tr></thead><tbody>",
    )?;
    for (name, dimension) in document.accounting.dimensions() {
        output.push_str("<tr><td><code>")?;
        write_html_text(&mut output, name)?;
        output.push_str("</code></td><td><code>")?;
        write_html_text(&mut output, dimension.mode)?;
        output.push_str("</code></td>")?;
        write_html_optional_decimal(&mut output, dimension.limit.as_deref())?;
        write_html_optional_decimal(&mut output, dimension.consumed.as_deref())?;
        write_html_optional_decimal(&mut output, dimension.remaining.as_deref())?;
        output.push_str("</tr>")?;
    }
    output.push_str("</tbody></table></section><section><h2>Steps</h2>")?;
    if document.steps.is_empty() {
        output.push_str("<p class=\"empty\">No step records.</p>")?;
    } else {
        output.push_str(
            "<table><thead><tr><th>Ordinal</th><th>Action</th><th>Status</th><th>Duration (ms)</th>\
</tr></thead><tbody>",
        )?;
        for step in &document.steps {
            output.push_fmt(format_args!("<tr><td>{}</td><td><code>", step.ordinal))?;
            write_html_text(&mut output, step.action_id)?;
            output.push_str("</code></td><td><code>")?;
            write_html_text(&mut output, step.status)?;
            output.push_fmt(format_args!(
                "</code></td><td>{}</td></tr>",
                step.duration_ms
            ))?;
        }
        output.push_str("</tbody></table>")?;
    }
    output.push_str("</section><section><h2>Outcomes</h2>")?;
    if document.outcomes.is_empty() {
        output.push_str("<p class=\"empty\">No outcome records.</p>")?;
    } else {
        output.push_str(
            "<table><thead><tr><th>Kind</th><th>Action</th><th>Severity</th>\
<th>Disposition</th><th>Confidence (ppm)</th><th>Evidence count</th><th>Redacted summary</th>\
</tr></thead><tbody>",
        )?;
        for outcome in &document.outcomes {
            output.push_str("<tr><td><code>")?;
            write_html_text(&mut output, outcome.kind)?;
            output.push_str("</code></td><td><code>")?;
            write_html_text(&mut output, outcome.action_id)?;
            output.push_str("</code></td><td><code>")?;
            write_html_text(&mut output, outcome.severity)?;
            output.push_str("</code></td><td><code>")?;
            write_html_text(&mut output, outcome.disposition)?;
            output.push_fmt(format_args!(
                "</code></td><td>{}</td><td>{}</td><td><code>",
                outcome.confidence_ppm, outcome.evidence_count
            ))?;
            write_html_text(&mut output, outcome.redacted_summary)?;
            output.push_str("</code></td></tr>")?;
        }
        output.push_str("</tbody></table>")?;
    }
    output.push_str("</section></main></body></html>")?;
    Ok(output.finish())
}

fn write_html_optional_decimal(
    output: &mut RenderBuffer,
    value: Option<&str>,
) -> Result<(), ReportError> {
    match value {
        Some(value) => {
            output.push_str("<td>")?;
            write_html_text(output, value)?;
            output.push_str("</td>")
        },
        None => output.push_str("<td><span class=\"empty\">not reported</span></td>"),
    }
}

fn write_html_text(output: &mut RenderBuffer, value: &str) -> Result<(), ReportError> {
    for character in value.chars() {
        match character {
            '&' => output.push_str("&amp;")?,
            '<' => output.push_str("&lt;")?,
            '>' => output.push_str("&gt;")?,
            '"' => output.push_str("&quot;")?,
            '\'' => output.push_str("&#39;")?,
            '\\' => output.push_str("\\\\")?,
            character if character.is_control() || is_bidi_control(character) => {
                write_visible_codepoint(output, character)?;
            },
            character => output.push_char(character)?,
        }
    }
    Ok(())
}

fn render_markdown(document: &ReportDocument<'_>, limit: usize) -> Result<String, ReportError> {
    let mut output = RenderBuffer::new(limit);
    output.push_str("# Termivar run report\n\n")?;
    if document.status != "complete" {
        output.push_str("> **Lifecycle notice:** This run did not complete. Status ")?;
        write_markdown_code_span(&mut output, document.status)?;
        output.push_str("; stop code ")?;
        write_markdown_code_span(&mut output, document.stop_code)?;
        output.push_str(".\n\n")?;
    }
    for (label, value) in document.metadata() {
        output.push_fmt(format_args!("- {label}: "))?;
        write_markdown_code_span(&mut output, value)?;
        output.push_char('\n')?;
    }

    output.push_str("\n## Resource accounting\n\n")?;
    for (name, dimension) in document.accounting.dimensions() {
        output.push_str("- Dimension ")?;
        write_markdown_code_span(&mut output, name)?;
        output.push_str(": mode ")?;
        write_markdown_code_span(&mut output, dimension.mode)?;
        output.push_str(", limit ")?;
        write_markdown_optional_decimal(&mut output, dimension.limit.as_deref())?;
        output.push_str(", consumed ")?;
        write_markdown_optional_decimal(&mut output, dimension.consumed.as_deref())?;
        output.push_str(", remaining ")?;
        write_markdown_optional_decimal(&mut output, dimension.remaining.as_deref())?;
        output.push_char('\n')?;
    }

    output.push_str("\n## Steps\n\n")?;
    if document.steps.is_empty() {
        output.push_str("No step records.\n")?;
    } else {
        for step in &document.steps {
            output.push_fmt(format_args!("### Step {}\n\n- Action: ", step.ordinal))?;
            write_markdown_code_span(&mut output, step.action_id)?;
            output.push_str("\n- Status: ")?;
            write_markdown_code_span(&mut output, step.status)?;
            output.push_fmt(format_args!("\n- Duration (ms): {}\n\n", step.duration_ms))?;
        }
    }

    output.push_str("## Outcomes\n\n")?;
    if document.outcomes.is_empty() {
        output.push_str("No outcome records.\n")?;
    } else {
        for (index, outcome) in document.outcomes.iter().enumerate() {
            output.push_fmt(format_args!("### Outcome {}\n\n- Kind: ", index + 1))?;
            write_markdown_code_span(&mut output, outcome.kind)?;
            output.push_str("\n- Action: ")?;
            write_markdown_code_span(&mut output, outcome.action_id)?;
            output.push_str("\n- Severity: ")?;
            write_markdown_code_span(&mut output, outcome.severity)?;
            output.push_str("\n- Disposition: ")?;
            write_markdown_code_span(&mut output, outcome.disposition)?;
            output.push_fmt(format_args!(
                "\n- Confidence (ppm): {}\n- Evidence count: {}\n- Redacted summary: ",
                outcome.confidence_ppm, outcome.evidence_count
            ))?;
            write_markdown_code_span(&mut output, outcome.redacted_summary)?;
            output.push_str("\n\n")?;
        }
    }
    Ok(output.finish())
}

fn write_markdown_optional_decimal(
    output: &mut RenderBuffer,
    value: Option<&str>,
) -> Result<(), ReportError> {
    match value {
        Some(value) => write_markdown_code_span(output, value),
        None => output.push_str("`not reported`"),
    }
}

fn write_markdown_code_span(output: &mut RenderBuffer, value: &str) -> Result<(), ReportError> {
    let visible = if value.is_empty() {
        String::from("\\u{EMPTY}")
    } else {
        visible_text(value)
    };
    let fence_length = longest_backtick_run(&visible) + 1;
    for _ in 0..fence_length {
        output.push_char('`')?;
    }
    let all_spaces = visible.chars().all(|character| character == ' ');
    let needs_padding = !all_spaces
        && (visible.starts_with('`')
            || visible.starts_with(' ')
            || visible.ends_with('`')
            || visible.ends_with(' '));
    if needs_padding {
        output.push_char(' ')?;
    }
    output.push_str(&visible)?;
    if needs_padding {
        output.push_char(' ')?;
    }
    for _ in 0..fence_length {
        output.push_char('`')?;
    }
    Ok(())
}

fn longest_backtick_run(value: &str) -> usize {
    let mut current = 0;
    let mut longest = 0;
    for character in value.chars() {
        if character == '`' {
            current += 1;
            longest = longest.max(current);
        } else {
            current = 0;
        }
    }
    longest
}

fn visible_text(value: &str) -> String {
    let mut visible = String::with_capacity(value.len());
    for character in value.chars() {
        if character == '\\' {
            visible.push_str("\\\\");
        } else if character.is_control() || is_bidi_control(character) {
            push_visible_codepoint(&mut visible, character);
        } else {
            visible.push(character);
        }
    }
    visible
}

fn push_visible_codepoint(output: &mut String, character: char) {
    const HEX: &[u8; 16] = b"0123456789ABCDEF";
    let codepoint = u32::from(character);
    output.push_str("\\u{");
    for shift in [12, 8, 4, 0] {
        let index = ((codepoint >> shift) & 0xF) as usize;
        output.push(char::from(HEX[index]));
    }
    output.push('}');
}

#[cfg(feature = "scanning")]
fn render_assessment_with_limit(
    document: &AssessmentDocument<'_>,
    format: ReportFormat,
    limit: usize,
) -> Result<String, ReportError> {
    document.validate()?;
    match format {
        ReportFormat::Json => render_serializable_json(document, limit),
        ReportFormat::Csv => render_assessment_csv(document, limit),
        ReportFormat::Html => render_assessment_html(document, limit),
        ReportFormat::Markdown => render_assessment_markdown(document, limit),
    }
}

#[cfg(feature = "scanning")]
const ASSESSMENT_CSV_HEADERS: [&str; 30] = [
    "record_type",
    "document_schema",
    "source_schema",
    "run_schema",
    "profile_schema",
    "profile",
    "status",
    "subject_count",
    "item_count",
    "item_schema",
    "capability_id",
    "subject_reference",
    "title",
    "disposition",
    "claim_basis",
    "severity",
    "confidence_ppm",
    "fingerprint",
    "evidence_count",
    "redacted_summary",
    "category",
    "cwe",
    "remediation_id",
    "remediation_summary",
    "evidence_references",
    "control_evidence_references",
    "candidate_evidence_references",
    "case_reference",
    "outcome_reference",
    "verification_stage",
];

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
const SECRET_EXPOSURE_CONTEXT: &str = "anonymous-ordinary-get";

#[cfg(feature = "scanning")]
fn render_assessment_csv(
    document: &AssessmentDocument<'_>,
    limit: usize,
) -> Result<String, ReportError> {
    let mut output = RenderBuffer::new(limit);
    write_assessment_csv_row(&mut output, ASSESSMENT_CSV_HEADERS)?;
    let subject_count = document.subject_count.to_string();
    let item_count = document.item_count.to_string();
    write_assessment_csv_row(
        &mut output,
        [
            "document",
            document.schema,
            document.source_schema,
            document.run_schema,
            document.profile_schema,
            document.profile,
            document.status,
            &subject_count,
            &item_count,
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
            "",
        ],
    )?;
    #[cfg(feature = "supplied-session-review")]
    if let Some(audit) = &document.supplied_session {
        let committed_count = audit.committed_resource_count.to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "supplied_session_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.outcome,
                "",
                "",
                "",
                audit.capability_id,
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                &committed_count,
                &summary,
                "supplied-session",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "authorization-review")]
    if let Some(audit) = &document.authorization_review {
        let request_count = audit.request_count.to_string();
        let summary = format!(
            "policy_id={};selected_path_count={};ignored_path_count={};primary_stable={};peer_stable={};cross_resources_equivalent={};item_projected={}",
            audit.policy_id,
            audit.selected_path_count,
            audit.ignored_path_count,
            optional_bool_token(audit.primary_stable),
            optional_bool_token(audit.peer_stable),
            optional_bool_token(audit.cross_resources_equivalent),
            audit.item_projected,
        );
        write_assessment_csv_row(
            &mut output,
            [
                "authorization_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.outcome,
                "",
                "",
                "",
                audit.capability_id,
                "",
                "",
                if audit.item_projected {
                    "needs_review"
                } else {
                    ""
                },
                if audit.item_projected {
                    "differential"
                } else {
                    ""
                },
                "",
                "",
                "",
                &request_count,
                &summary,
                "authorization-review",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "websocket-review")]
    if let Some(audit) = &document.websocket_review {
        let message_count = audit.coverage.expected_response_count.to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "websocket_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.coverage.terminal,
                "",
                "",
                "",
                audit.capability_id,
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                &message_count,
                &summary,
                "websocket-review",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "xml-external-entity-review")]
    if let Some(audit) = &document.xml_external_entity_review {
        let evidence_count = document
            .items
            .iter()
            .find(|item| item.capability_id == XML_EXTERNAL_ENTITY_REVIEW_CAPABILITY_ID)
            .map_or(0, |item| item.evidence_count)
            .to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "xml_external_entity_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.outcome,
                "",
                "",
                "",
                XML_EXTERNAL_ENTITY_REVIEW_CAPABILITY_ID,
                "",
                "",
                if audit.item_projected {
                    "needs_review"
                } else {
                    ""
                },
                if audit.item_projected {
                    "differential"
                } else {
                    ""
                },
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "xml-external-entity-review",
                if audit.item_projected { "CWE-611" } else { "" },
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "template-evaluation-review")]
    if let Some(audit) = &document.template_evaluation_review {
        let evidence_count = document
            .items
            .iter()
            .find(|item| item.capability_id == TEMPLATE_EVALUATION_REVIEW_CAPABILITY_ID)
            .map_or(0, |item| item.evidence_count)
            .to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "template_evaluation_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.outcome,
                "",
                "",
                "",
                TEMPLATE_EVALUATION_REVIEW_CAPABILITY_ID,
                "",
                "",
                if audit.coverage.projected_item_count == 1 {
                    "needs_review"
                } else {
                    ""
                },
                if audit.coverage.projected_item_count == 1 {
                    "differential"
                } else {
                    ""
                },
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "template-evaluation-review",
                if audit.coverage.projected_item_count == 1 {
                    "CWE-1336"
                } else {
                    ""
                },
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "openapi-review")]
    if let Some(audit) = &document.openapi_review {
        let request_count = audit.request_count.to_string();
        let summary = audit.summary();
        write_assessment_csv_row(
            &mut output,
            [
                "openapi_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.outcome,
                "",
                "",
                "",
                audit.capability_id,
                "",
                "",
                if audit.item_projected {
                    "informational"
                } else {
                    ""
                },
                if audit.item_projected {
                    "observation"
                } else {
                    ""
                },
                "",
                "",
                "",
                &request_count,
                &summary,
                "api-surface",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "rest-review")]
    if let Some(audit) = &document.rest_review {
        let request_count = audit.request_count.to_string();
        let summary = audit.summary();
        write_assessment_csv_row(
            &mut output,
            [
                "rest_readonly_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.outcome,
                "",
                "",
                "",
                audit.capability_id,
                "",
                "",
                if audit.item_projected {
                    "informational"
                } else {
                    ""
                },
                if audit.item_projected {
                    "observation"
                } else {
                    ""
                },
                "",
                "",
                "",
                &request_count,
                &summary,
                "api-surface",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "secret-exposure-review")]
    if let Some(audit) = &document.secret_exposure_review {
        let evidence_count = audit.observation_count.to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "secret_exposure_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                "selected",
                "",
                "",
                "",
                "",
                "",
                "",
                "informational",
                "observation",
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "passive-secret-exposure",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "tls-observation")]
    if let Some(audit) = &document.tls_observation {
        let evidence_count = audit.leaf_observation_count.to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "tls_observation_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                "selected",
                "",
                "",
                "",
                "",
                "",
                "",
                "informational",
                "observation",
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "existing-connection-tls-observation",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "tls-negotiation-review")]
    if let Some(audit) = &document.tls_negotiation_review {
        let evidence_count = audit.coverage.completed_handshake_count.to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "tls_negotiation_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.coverage.terminal,
                "",
                "",
                "",
                TLS_NEGOTIATION_REVIEW_CAPABILITY_ID,
                "",
                "",
                "informational",
                "observation",
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "active-tls-negotiation-review",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "jwt-policy-review")]
    if let Some(audit) = &document.jwt_policy_review {
        let summary = audit.wire_json()?;
        #[cfg(feature = "jwt-target-acceptance-review")]
        let collection_method = if audit.target_acceptance.is_some() {
            "local-jwt-policy-and-bounded-target-review"
        } else {
            "local-jwt-policy-review"
        };
        #[cfg(feature = "jwt-target-acceptance-review")]
        let evidence_count = audit
            .target_acceptance
            .as_ref()
            .map_or(0, |target| target.accounting.committed_response_count)
            .to_string();
        #[cfg(not(feature = "jwt-target-acceptance-review"))]
        let collection_method = "local-jwt-policy-review";
        #[cfg(not(feature = "jwt-target-acceptance-review"))]
        let evidence_count = "0".to_owned();
        write_assessment_csv_row(
            &mut output,
            [
                "jwt_policy_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                "selected",
                "",
                "",
                "",
                "",
                "",
                "",
                "informational",
                "observation",
                "",
                "",
                "",
                &evidence_count,
                &summary,
                collection_method,
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "control-reference-mapping")]
    if let Some(audit) = &document.control_reference_mapping {
        let evidence_count = audit.coverage.reference_link_count.to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "control_reference_mapping_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                "selected",
                "",
                "",
                "",
                "",
                "",
                "",
                "informational",
                "observation",
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "offline-control-reference-mapping",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "recon-snapshot-import")]
    if let Some(audit) = &document.recon_snapshot_import {
        let evidence_count = audit.accounting.record_count.to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "recon_snapshot_import_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                "selected",
                "",
                "",
                "",
                "",
                "",
                "",
                "informational",
                "observation",
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "offline-reconnaissance-snapshot-import",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "recon-ct-provider")]
    if let Some(audit) = &document.recon_certspotter {
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "recon_certspotter_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.coverage.completeness,
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                &summary,
                "bounded-certspotter-provider-query",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(audit) = &document.wordpress_review {
        let evidence_count = audit.evidence_reference_count.to_string();
        let summary = audit.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "wordpress_review_audit",
                audit.schema,
                "",
                "",
                "",
                "",
                audit.catalog_status,
                "",
                "",
                "",
                audit.capability_id,
                "",
                "",
                if audit.item_projected {
                    "informational"
                } else {
                    ""
                },
                if audit.item_projected {
                    "observation"
                } else {
                    ""
                },
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "wordpress-review",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(discovery) = &document.wordpress_discovery {
        let evidence_count = discovery
            .sources
            .iter()
            .map(|source| source.evidence_reference_count)
            .chain(
                discovery
                    .supplied_session_pages
                    .iter()
                    .flat_map(|pages| pages.pages.iter())
                    .map(|page| page.evidence_reference_count),
            )
            .sum::<usize>()
            .to_string();
        let summary = discovery.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "wordpress_discovery_audit",
                discovery.schema,
                "",
                "",
                "",
                "",
                "selected",
                "",
                "",
                "",
                discovery.capability_id,
                "",
                "",
                "informational",
                "observation",
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "wordpress-discovery",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(fingerprints) = &document.wordpress_asset_fingerprints {
        let evidence_count = fingerprints.evidence_reference_count().to_string();
        let summary = fingerprints.wire_json()?;
        write_assessment_csv_row(
            &mut output,
            [
                "wordpress_asset_fingerprint_audit",
                fingerprints.schema,
                "",
                "",
                "",
                "",
                "selected",
                "",
                "",
                "",
                fingerprints.capability_id,
                "",
                "",
                "informational",
                "observation",
                "",
                "",
                "",
                &evidence_count,
                &summary,
                "wordpress-asset-fingerprint",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
            ],
        )?;
    }
    for item in &document.items {
        let confidence_ppm = item.confidence_ppm.to_string();
        let evidence_count = item.evidence_count.to_string();
        let evidence_references = item.evidence_references.join(";");
        let control_evidence_references = item.control_evidence_references.join(";");
        let candidate_evidence_references = item.candidate_evidence_references.join(";");
        write_assessment_csv_row(
            &mut output,
            [
                "item",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                "",
                item.schema,
                item.capability_id,
                &item.subject_reference,
                item.title,
                item.disposition,
                item.claim_basis,
                item.severity.unwrap_or(""),
                &confidence_ppm,
                item.fingerprint,
                &evidence_count,
                item.redacted_summary,
                item.category,
                item.cwe.unwrap_or(""),
                item.remediation.id,
                item.remediation.summary,
                &evidence_references,
                &control_evidence_references,
                &candidate_evidence_references,
                item.case_reference.as_deref().unwrap_or(""),
                item.outcome_reference.as_deref().unwrap_or(""),
                item.verification_stage.unwrap_or(""),
            ],
        )?;
    }
    Ok(output.finish())
}

#[cfg(feature = "scanning")]
fn write_assessment_csv_row(
    output: &mut RenderBuffer,
    cells: [&str; ASSESSMENT_CSV_HEADERS.len()],
) -> Result<(), ReportError> {
    for (index, cell) in cells.into_iter().enumerate() {
        if index != 0 {
            output.push_char(',')?;
        }
        write_csv_cell(output, cell)?;
    }
    output.push_char('\n')
}

#[cfg(feature = "scanning")]
const ACTIONABLE_ITEM_DISPOSITION_ORDER: [&str; 3] = ["confirmed", "needs_review", "informational"];

#[cfg(feature = "scanning")]
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
struct AssessmentDecisionOverview {
    informational: usize,
    needs_review: usize,
    confirmed: usize,
}

#[cfg(feature = "scanning")]
impl AssessmentDecisionOverview {
    fn from_document(document: &AssessmentDocument<'_>) -> Result<Self, ReportError> {
        let mut overview = Self {
            informational: 0,
            needs_review: 0,
            confirmed: 0,
        };
        for item in &document.items {
            let count = match item.disposition {
                "informational" => &mut overview.informational,
                "needs_review" => &mut overview.needs_review,
                "confirmed" => &mut overview.confirmed,
                _ => return Err(ReportError::Serialization),
            };
            *count = count.checked_add(1).ok_or(ReportError::Serialization)?;
        }
        let total = overview
            .informational
            .checked_add(overview.needs_review)
            .and_then(|value| value.checked_add(overview.confirmed))
            .ok_or(ReportError::Serialization)?;
        if total != document.items.len()
            || u64::try_from(total).map_err(|_| ReportError::Serialization)? != document.item_count
        {
            return Err(ReportError::Serialization);
        }
        Ok(overview)
    }

    const fn priority_statement(self) -> &'static str {
        if self.confirmed != 0 {
            "Presentation starts with verifier-bound confirmed items, then unresolved differentials and observations. This is evidence-assurance order, not severity, impact, or remediation priority."
        } else if self.needs_review != 0 {
            "Presentation starts with unresolved differentials, then observations; no verifier-bound confirmed item was projected. This is evidence-assurance order, not severity, impact, or remediation priority."
        } else if self.informational != 0 {
            "Presentation contains bounded observations only; no review candidate or verifier-bound confirmed item was projected. This is not a severity, impact, or remediation priority."
        } else {
            "No assessment item was projected. This does not establish that the application is secure or that coverage was exhaustive."
        }
    }
}

#[cfg(feature = "scanning")]
fn assessment_item_interpretation(
    item: &AssessmentItemDocument<'_>,
) -> Result<&'static str, ReportError> {
    match (item.disposition, item.claim_basis) {
        ("informational", "observation") => Ok(
            "Informational: bounded observation evidence was committed; no differential or verifier transition was established.",
        ),
        ("needs_review", "differential") => Ok(
            "Needs review: a typed evidence relationship was committed; human interpretation is required and no verifier transition was established.",
        ),
        ("confirmed", "verifier_transition") => Ok(
            "Confirmed is limited to the cited verifier case and outcome; the label does not widen assessment scope or establish broader impact.",
        ),
        _ => Err(ReportError::Serialization),
    }
}

#[cfg(feature = "scanning")]
fn assessment_item_unestablished(
    item: &AssessmentItemDocument<'_>,
) -> Result<&'static str, ReportError> {
    match item.disposition {
        "informational" => Ok(
            "This observation alone does not establish a vulnerability, exploitability, impact, or remediation.",
        ),
        "needs_review" => Ok(
            "This review candidate is not a confirmed vulnerability; exploitability, impact, and remediation were not established.",
        ),
        "confirmed" => Ok(
            "Confirmation applies only to the cited verifier transition; broader impact, root cause, and remediation remain unestablished unless separately evidenced.",
        ),
        _ => Err(ReportError::Serialization),
    }
}

#[cfg(feature = "scanning")]
fn assessment_item_verification_guidance(
    item: &AssessmentItemDocument<'_>,
) -> Result<&'static str, ReportError> {
    match item.disposition {
        "informational" => Ok(
            "Review the cited evidence and capability-owned recommendation. Do not perform active confirmation unless the exact target, context, action, and current authorization are established separately.",
        ),
        "needs_review" => Ok(
            "Establish the exact target and principal/application context from authorized records. Reproduce the control and candidate relationship only under separate current authorization; if that context cannot be established, do not rerun it.",
        ),
        "confirmed" => Ok(
            "Confirmation is bound to the cited case and outcome. After a change, rerun only if the exact target, context, case, and separate current authorization are established; report integrity alone does not verify remediation.",
        ),
        _ => Err(ReportError::Serialization),
    }
}

#[cfg(feature = "scanning")]
fn assessment_item_collection_context(_document: &AssessmentDocument<'_>) -> &'static str {
    #[cfg(feature = "supplied-session-review")]
    if _document.supplied_session.is_some() {
        return "The run includes a supplied-session audit, but this item is not assigned to a principal by the current report contract. Consult the technical audit appendix for operator-declared context, health checkpoints, and coverage.";
    }
    "No supplied-session audit is present. The current report contract does not assign a separate principal to this item."
}

#[cfg(feature = "scanning")]
fn write_html_actionable_text_field(
    output: &mut RenderBuffer,
    label: &'static str,
    value: &str,
) -> Result<(), ReportError> {
    output.push_str("<dt>")?;
    write_html_text(output, label)?;
    output.push_str("</dt><dd>")?;
    write_html_text(output, value)?;
    output.push_str("</dd>")
}

#[cfg(feature = "scanning")]
fn write_html_actionable_code_field(
    output: &mut RenderBuffer,
    label: &'static str,
    value: &str,
) -> Result<(), ReportError> {
    output.push_str("<dt>")?;
    write_html_text(output, label)?;
    output.push_str("</dt><dd><code>")?;
    write_html_text(output, value)?;
    output.push_str("</code></dd>")
}

#[cfg(feature = "scanning")]
fn write_assessment_decision_overview_html(
    output: &mut RenderBuffer,
    document: &AssessmentDocument<'_>,
) -> Result<(), ReportError> {
    let overview = AssessmentDecisionOverview::from_document(document)?;
    output.push_str(
        "<section id=\"decision-overview\"><h2>Decision overview</h2>\
<p>These counts describe typed assessment items, not a count of confirmed vulnerabilities. Unassigned or unknown severity is not low or zero severity.</p>\
<div class=\"decision-grid\">",
    )?;
    for (label, count) in [
        ("Verifier-bound confirmed items", overview.confirmed),
        ("Needs-review candidates", overview.needs_review),
        ("Informational observations", overview.informational),
    ] {
        output.push_str("<div class=\"decision-card\"><strong>")?;
        output.push_fmt(format_args!("{count}"))?;
        output.push_str("</strong><span>")?;
        write_html_text(output, label)?;
        output.push_str("</span></div>")?;
    }
    output.push_str("</div><p><strong>Next decision:</strong> ")?;
    write_html_text(output, overview.priority_statement())?;
    output.push_str("</p></section>")
}

#[cfg(feature = "scanning")]
fn write_assessment_actionable_items_html(
    output: &mut RenderBuffer,
    document: &AssessmentDocument<'_>,
) -> Result<(), ReportError> {
    output.push_str("<section id=\"actionable-items\"><h2>Actionable items</h2>")?;
    if document.items.is_empty() {
        output.push_str(
            "<p class=\"empty\">No assessment items were projected. This is not evidence that the application is secure or that assessment coverage was complete.</p></section>",
        )?;
        return Ok(());
    }
    let collection_context = assessment_item_collection_context(document);
    let mut index = 0usize;
    for disposition in ACTIONABLE_ITEM_DISPOSITION_ORDER {
        for item in document
            .items
            .iter()
            .filter(|item| item.disposition == disposition)
        {
            index = index.checked_add(1).ok_or(ReportError::Serialization)?;
            output.push_fmt(format_args!(
                "<article class=\"item\"><h3>Actionable item {index}: "
            ))?;
            write_html_text(output, item.title)?;
            output.push_str("</h3><p class=\"disposition\"><span>Disposition: </span><code>")?;
            write_html_text(output, item.disposition)?;
            output.push_str("</code></p><dl>")?;
            write_html_actionable_text_field(output, "What was observed", item.redacted_summary)?;
            write_html_actionable_code_field(
                output,
                "Opaque assessment subject reference (not proof of affectedness or location)",
                &item.subject_reference,
            )?;
            write_html_actionable_code_field(
                output,
                "Assessment target kind (resource location withheld)",
                item.presentation_target,
            )?;
            write_html_actionable_text_field(
                output,
                "Collection and principal context",
                collection_context,
            )?;
            write_html_actionable_text_field(
                output,
                "Interpretation",
                assessment_item_interpretation(item)?,
            )?;
            write_html_actionable_text_field(
                output,
                "What was not established",
                assessment_item_unestablished(item)?,
            )?;
            write_html_actionable_text_field(
                output,
                "Recommended action (not a verified fix)",
                item.remediation.summary,
            )?;
            write_html_actionable_text_field(
                output,
                "Safe verification guidance",
                assessment_item_verification_guidance(item)?,
            )?;
            output.push_str("<dt>Severity</dt><dd>")?;
            write_html_optional_assessment_text(output, item.severity, "not assigned")?;
            if item.severity.is_none() {
                output.push_str(" <span>(unassigned does not mean low or zero)</span>")?;
            }
            output.push_str("</dd><dt>Confidence</dt><dd><code>")?;
            output.push_fmt(format_args!("{} ppm", item.confidence_ppm))?;
            output.push_str(
                "</code> <span>(evidence-specific; not CVSS, impact, or exploit probability)</span></dd>",
            )?;
            write_html_actionable_code_field(output, "Claim basis", item.claim_basis)?;
            write_html_actionable_code_field(output, "Item schema", item.schema)?;
            write_html_actionable_code_field(output, "Capability", item.capability_id)?;
            write_html_actionable_code_field(output, "Category", item.category)?;
            output.push_str("<dt>CWE</dt><dd>")?;
            write_html_optional_assessment_text(output, item.cwe, "not applicable")?;
            output.push_str("</dd>")?;
            write_html_actionable_code_field(output, "Item fingerprint", item.fingerprint)?;
            write_html_actionable_code_field(
                output,
                "Evidence reference count",
                &item.evidence_count.to_string(),
            )?;
            write_html_actionable_code_field(output, "Recommendation ID", item.remediation.id)?;
            write_html_actionable_code_field(
                output,
                "Direct evidence references",
                &assessment_reference_list(&item.evidence_references),
            )?;
            write_html_actionable_code_field(
                output,
                "Control evidence references",
                &assessment_reference_list(&item.control_evidence_references),
            )?;
            write_html_actionable_code_field(
                output,
                "Candidate evidence references",
                &assessment_reference_list(&item.candidate_evidence_references),
            )?;
            write_html_actionable_code_field(
                output,
                "Verifier case reference",
                item.case_reference.as_deref().unwrap_or("not applicable"),
            )?;
            write_html_actionable_code_field(
                output,
                "Verifier outcome reference",
                item.outcome_reference
                    .as_deref()
                    .unwrap_or("not applicable"),
            )?;
            write_html_actionable_code_field(
                output,
                "Verification stage",
                item.verification_stage.unwrap_or("not applicable"),
            )?;
            output.push_str("</dl></article>")?;
        }
    }
    if index != document.items.len() {
        return Err(ReportError::Serialization);
    }
    output.push_str("</section>")
}

#[cfg(feature = "scanning")]
fn render_assessment_html(
    document: &AssessmentDocument<'_>,
    limit: usize,
) -> Result<String, ReportError> {
    let mut output = RenderBuffer::new(limit);
    output.push_str(
        "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">\
<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'none'; style-src 'unsafe-inline'; img-src 'none'; base-uri 'none'; form-action 'none'\">\
<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\
<title>Termivar assessment report</title><style>\
:root{color-scheme:light dark}body{font:14px/1.5 system-ui,sans-serif;margin:2rem;max-width:90rem}\
h1,h2,h3{line-height:1.2}.meta{display:grid;grid-template-columns:max-content 1fr;gap:.3rem 1rem}\
.item,.wp-detail{border:1px solid currentColor;padding:1rem;margin-block:1rem}.item dl,.wp-detail dl{display:grid;grid-template-columns:max-content 1fr;gap:.3rem 1rem}\
.disposition{border:2px solid currentColor;display:inline-block;font-weight:700;padding:.15rem .4rem}\
.decision-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(12rem,1fr));gap:.75rem;margin-block:1rem}\
.decision-card{border:1px solid currentColor;padding:.75rem}.decision-card strong{display:block;font-size:1.4rem}\
.wp-summary{display:grid;grid-template-columns:repeat(auto-fit,minmax(10rem,1fr));gap:.75rem;margin-block:1rem}\
.wp-card{border:1px solid currentColor;padding:.75rem}.wp-card strong{display:block;font-size:1.4rem}\
.wp-note{border-inline-start:.3rem solid currentColor;padding:.5rem .75rem}.wp-detail summary{cursor:pointer;font-weight:700}\
code,pre{overflow-wrap:anywhere}pre{white-space:pre-wrap}.empty{font-style:italic}@media print{.wp-detail>*{display:block!important}}</style></head><body><main>\
<h1>Termivar assessment report</h1><p><strong>Lifecycle status:</strong> completed typed assessment.</p>",
    )?;
    write_assessment_decision_overview_html(&mut output, document)?;
    write_assessment_actionable_items_html(&mut output, document)?;
    output.push_str(
        "<div id=\"technical-audit-appendix\"><h2>Technical audit appendix</h2>\
<p>Available report metadata and selected capability/source audit details follow, including their local accounting when present. These records preserve stated context and limitations; report integrity does not establish target truth or remediation.</p>\
<h3>Report metadata</h3><dl class=\"meta\">",
    )?;
    for (label, value) in document.metadata() {
        output.push_str("<dt>")?;
        write_html_text(&mut output, label)?;
        output.push_str("</dt><dd><code>")?;
        write_html_text(&mut output, &value)?;
        output.push_str("</code></dd>")?;
    }
    output.push_str("</dl>")?;
    #[cfg(feature = "supplied-session-review")]
    if let Some(audit) = &document.supplied_session {
        output
            .push_str("<section><h2>Supplied session assessment audit</h2><dl class=\"meta\">")?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Health checkpoints</h3><ol>")?;
        for checkpoint in &audit.checkpoints {
            output.push_str("<li><code>")?;
            write_html_text(
                &mut output,
                &checkpoint
                    .human_summary(audit.schema == SUPPLIED_SESSION_OAUTH_REFRESH_AUDIT_SCHEMA),
            )?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ol>")?;
        if let Some(health) = audit
            .oauth_refresh
            .as_ref()
            .and_then(|refresh| refresh.health())
        {
            output.push_str("<h3>OAuth renewal health checkpoint</h3><ol><li><code>")?;
            let health = AssessmentSuppliedSessionCheckpointDocument::from_checkpoint(health, true);
            write_html_text(&mut output, &health.human_summary(true))?;
            output.push_str("</code></li></ol>")?;
        }
        output.push_str("<h3>Protected resources</h3><ol>")?;
        for resource in &audit.resources {
            let status = resource
                .status
                .map_or_else(|| "not_available".to_owned(), |status| status.to_string());
            let evidence_reference = resource
                .evidence_reference
                .as_deref()
                .unwrap_or("not_available");
            output.push_str("<li><code>")?;
            write_html_text(
                &mut output,
                &format!(
                    "sequence={};resource_reference={};evidence_reference={};outcome={};status={};response_bytes={};epoch={}",
                    resource.sequence,
                    resource.resource_reference,
                    evidence_reference,
                    resource.outcome,
                    status,
                    resource.response_bytes,
                    resource.epoch,
                ),
            )?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ol></section>")?;
    }
    #[cfg(feature = "authorization-review")]
    if let Some(audit) = &document.authorization_review {
        output
            .push_str("<section><h2>Resource authorization review audit</h2><dl class=\"meta\">")?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl></section>")?;
    }
    #[cfg(feature = "websocket-review")]
    if let Some(audit) = &document.websocket_review {
        output.push_str("<section><h2>WebSocket protocol review audit</h2>")?;
        if audit.has_supplied_session_context() {
            output.push_str(
                "<p class=\"wp-note\">This audit separates bounded protocol-exchange completion from supplied-session health qualification. Healthy startup and terminal checkpoints qualify only the declared observation context; they do not establish continuous authentication, authenticated identity, authorization, vulnerability, impact, or remediation. It retains no credential, payload, raw URL, path, query, subprotocol token, body-derived mismatch reference, or backend error. Physical continuation-frame counts are unavailable. Transport bytes are raw socket bytes including the HTTP Upgrade and WebSocket framing; for WSS they are encrypted TLS records, not application bytes.</p><dl class=\"meta\">",
            )?;
        } else {
            output.push_str(
                "<p class=\"wp-note\">This audit describes one bounded, anonymous, operator-configured HTTP/1 Upgrade exchange. It is not a finding and provides no remediation inference. It retains no payload, raw URL, path, query, subprotocol token, body-derived mismatch reference, or backend error. Physical continuation-frame counts are unavailable. Transport bytes are raw socket bytes including the HTTP Upgrade and WebSocket framing; for WSS they are encrypted TLS records, not application bytes.</p><dl class=\"meta\">",
            )?;
        }
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Configured exchange audit</h3><ol>")?;
        for message in &audit.messages {
            output.push_str("<li><code>")?;
            write_html_text(
                &mut output,
                &format!(
                    "message_reference={};expected_response_reference={};outbound_length={};inbound_length={};status={}",
                    message.message_reference,
                    message.expected_response_reference,
                    message.outbound_length,
                    message
                        .inbound_length
                        .map_or_else(|| "not_available".to_owned(), |length| length.to_string()),
                    message.status,
                ),
            )?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ol><h3>Interpretation limits</h3><ul>")?;
        for limit in &audit.claim_limits {
            output.push_str("<li><code>")?;
            write_html_text(&mut output, limit)?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul></section>")?;
    }
    #[cfg(feature = "xml-external-entity-review")]
    if let Some(audit) = &document.xml_external_entity_review {
        output.push_str(
            "<section><h2>Controlled XML external-entity review audit</h2>\
<p class=\"wp-note\">This audit records a bounded callback-control review without retaining endpoint URLs or paths, provider origins, callback values, XML bodies, system literals, tokens, response bodies, or raw errors. Repeated candidate and replay interactions remain review-level evidence: they do not confirm XXE, identify a parser, prove file read, data exfiltration, internal-network access, semantic effect, or impact.</p><dl class=\"meta\">",
        )?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Claim limits</h3><ul>")?;
        for limit in &audit.claim_limits {
            output.push_str("<li><code>")?;
            write_html_text(&mut output, limit)?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul></section>")?;
    }
    #[cfg(feature = "template-evaluation-review")]
    if let Some(audit) = &document.template_evaluation_review {
        output.push_str(
            "<section><h2>Template-evaluation review audit</h2>\
<p class=\"wp-note\">This audit records bounded, benign primary/replay differential semantics without retaining expressions, query values, URLs, response bodies, template-engine errors, or raw transport errors. Candidate-specific evaluation does not establish a template-engine identity, operating-system execution, file access, outbound interaction, vulnerability confirmation, or impact.</p><dl class=\"meta\">",
        )?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Claim limits</h3><ul>")?;
        for limit in &audit.claim_limits {
            output.push_str("<li><code>")?;
            write_html_text(&mut output, limit)?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul></section>")?;
    }
    #[cfg(feature = "openapi-review")]
    if let Some(audit) = &document.openapi_review {
        output.push_str("<section><h2>OpenAPI review audit</h2><dl class=\"meta\">")?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl></section>")?;
    }
    #[cfg(feature = "rest-review")]
    if let Some(audit) = &document.rest_review {
        output.push_str("<section><h2>REST read-only review audit</h2><dl class=\"meta\">")?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl></section>")?;
    }
    #[cfg(feature = "secret-exposure-review")]
    if let Some(audit) = &document.secret_exposure_review {
        output.push_str(
            "<section><h2>Passive response secret-exposure review audit</h2>\
<p class=\"wp-note\">Detector observations are redacted response-content classifications. They do not establish source authenticity, secret validity, provider acceptance, exploitability, or impact.</p><dl class=\"meta\">",
        )?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Response outcomes</h3><ul>")?;
        for outcome in &audit.outcomes {
            output.push_str("<li><code>")?;
            write_html_text(
                &mut output,
                &format!("outcome={};count={}", outcome.outcome, outcome.count),
            )?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul><h3>Redacted observations</h3><ul>")?;
        for observation in &audit.observations {
            output.push_str("<li><code>")?;
            write_html_text(
                &mut output,
                &format!(
                    "detector_class={};capability_id={};occurrence_count={};evidence_reference={}",
                    observation.detector_class,
                    observation.capability_id,
                    observation.occurrence_count,
                    observation.evidence_references[0],
                ),
            )?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul></section>")?;
    }
    #[cfg(feature = "tls-observation")]
    if let Some(audit) = &document.tls_observation {
        output.push_str(
            "<section><h2>Existing-connection TLS observation audit</h2>\
<p class=\"wp-note\">This passive view describes leaf certificates exposed by successful existing HTTPS responses under the assessment's exact-origin authority. It does not attribute a certificate to a request purpose or principal. Validity status is relative to the reported local system-clock instant, whose accuracy was not independently verified. One successful connection does not enumerate server protocol or cipher support. Negotiated protocol, ALPN, cipher suite, full chain, connection reuse, session resumption, and handshake kind are unavailable from the current backend; revocation was not checked.</p><dl class=\"meta\">",
        )?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Leaf certificate observations</h3><ul>")?;
        for observation in &audit.observations {
            output.push_str("<li><code>")?;
            write_html_text(
                &mut output,
                &format!(
                    "sha256={};byte_length={};not_before={};not_after={};observed_at={};dns_sans={};ip_sans={};other_sans={};san_count_truncated={};time_status={};response_occurrences={};standard_transport_validation_succeeded={}",
                    observation.leaf_certificate_sha256,
                    observation.leaf_certificate_byte_length,
                    observation.not_before_epoch_seconds,
                    observation.not_after_epoch_seconds,
                    observation.observed_at_epoch_seconds,
                    observation.dns_san_count,
                    observation.ip_san_count,
                    observation.other_san_count,
                    observation.san_count_truncated,
                    observation.certificate_time_status,
                    observation.response_occurrence_count,
                    observation.standard_transport_validation_succeeded,
                ),
            )?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul><p class=\"wp-note\">Certificate names and DER bytes are not retained in this report. A digest identifies observed bytes; it is not source authentication. Active negotiation, chain enumeration, revocation retrieval, exploit execution, and impact validation were not performed.</p></section>")?;
    }
    #[cfg(feature = "tls-negotiation-review")]
    if let Some(audit) = &document.tls_negotiation_review {
        output.push_str(
            "<section><h2>Active TLS negotiation review audit</h2>\
<p class=\"wp-note\">This explicitly selected, finite matrix opened at most two sequential credential-free TLS connections to the exact authorized HTTPS host, SNI, and port. It sent no HTTP or application data. Negotiation establishes compatibility only for a successful offered profile; failure does not establish server non-support, and the three legacy rows were not tested because the client backend does not implement them.</p><dl class=\"meta\">",
        )?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Fixed negotiation matrix</h3><ul>")?;
        for cell in &audit.capability_observations {
            output.push_str("<li><code>")?;
            write_html_text(
                &mut output,
                &format!(
                    "cell={};offer={};backend={};dispatch={};outcome={};support={};transport_validation={};negotiated_protocol={};negotiated_cipher_suite={};ingress_tls_bytes={};egress_tls_bytes={}",
                    cell.cell_id,
                    cell.offered_protocol,
                    cell.client_backend,
                    cell.dispatch_status,
                    cell.outcome,
                    cell.support,
                    cell.transport_validation,
                    cell.negotiated_protocol.unwrap_or("none"),
                    cell.negotiated_cipher_suite.unwrap_or("none"),
                    cell.accounted_ingress_tls_bytes,
                    cell.observed_egress_tls_bytes,
                ),
            )?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul><h3>Claim limits</h3><ul>")?;
        for limit in &audit.claim_limits {
            output.push_str("<li><code>")?;
            write_html_text(&mut output, limit)?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul><p class=\"wp-note\">The configured trust validation is not source authentication. Revocation, certificate-transparency, AIA, CRL, and OCSP retrieval, vulnerability confirmation, exploit execution, impact validation, and remediation verification were not performed.</p></section>")?;
    }
    #[cfg(feature = "jwt-policy-review")]
    if let Some(audit) = &document.jwt_policy_review {
        #[cfg(feature = "jwt-target-acceptance-review")]
        if audit.target_acceptance.is_some() {
            output.push_str("<section><h2>JWT policy and target-control review audit</h2><p class=\"wp-note\">Parsing, local policy consistency, local signature verification, and bounded target behavior are separate states. This value-free audit retains no token, claim value, key material, selected marker name, or raw resource URL. Target controls remain review-level and establish neither a general authentication bypass nor authorization impact.</p>")?;
        } else {
            output.push_str("<section><h2>Local JWT policy review audit</h2><p class=\"wp-note\">Parsing, local policy consistency, signature verification against the explicitly supplied local public key, and target acceptance are separate states. This value-free audit retains no token, claim value, or key material. It performed no target request, remote-key retrieval, or token forwarding; target acceptance and source authentication are not established.</p>")?;
        }
        #[cfg(not(feature = "jwt-target-acceptance-review"))]
        output.push_str("<section><h2>Local JWT policy review audit</h2><p class=\"wp-note\">Parsing, local policy consistency, signature verification against the explicitly supplied local public key, and target acceptance are separate states. This value-free audit retains no token, claim value, or key material. It performed no target request, remote-key retrieval, or token forwarding; target acceptance and source authentication are not established.</p>")?;
        output.push_str("<dl class=\"meta\">")?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Value-free policy violations</h3><ul>")?;
        if audit.policy_violations.is_empty() {
            output.push_str("<li><code>none</code></li>")?;
        }
        for violation in &audit.policy_violations {
            output.push_str("<li><code>")?;
            let row = violation.ordinal.map_or_else(
                || format!("kind={}", violation.kind),
                |ordinal| format!("kind={};ordinal={ordinal}", violation.kind),
            );
            write_html_text(&mut output, &row)?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul>")?;
        #[cfg(feature = "jwt-target-acceptance-review")]
        if let Some(target) = &audit.target_acceptance {
            output.push_str("<h3>Target acceptance controls</h3><ul>")?;
            if target.legs.is_empty() {
                output.push_str("<li><code>no target leg dispatched</code></li>")?;
            }
            for leg in &target.legs {
                output.push_str("<li><code>")?;
                write_html_text(
                    &mut output,
                    &format!(
                        "role={};stage={};activity={};dispatch={};commit={};response={};marker={};retained_bytes={};accounted_transport_bytes={}",
                        leg.role,
                        leg.stage,
                        leg.activity,
                        leg.dispatch_status,
                        leg.commit_status,
                        leg.response_status,
                        leg.marker_status,
                        leg.retained_response_bytes,
                        leg.accounted_transport_response_bytes,
                    ),
                )?;
                output.push_str("</code></li>")?;
            }
            output.push_str("</ul><p class=\"wp-note\">")?;
            write_html_text(&mut output, &target.interpretation_limits.join(" "))?;
            output.push_str("</p>")?;
        }
        output.push_str("</section>")?;
    }
    #[cfg(feature = "control-reference-mapping")]
    if let Some(audit) = &document.control_reference_mapping {
        output.push_str(
            "<section><h2>Versioned control-reference mapping audit</h2>\
<p class=\"wp-note\">This deterministic offline mapping relates eligible assessment evidence to a finite, versioned reference catalogue. It does not assess a control, determine compliance or legal noncompliance, certify an organization, authenticate a source, or turn the absence of a finding into evidence that a control is fulfilled.</p><dl class=\"meta\">",
        )?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Reference sources</h3><ul>")?;
        for source in &audit.sources {
            output.push_str("<li><code>")?;
            write_html_text(
                &mut output,
                &format!(
                    "source_id={};framework_id={};edition={};revision_or_amendment={};authority_kind={};mapping_availability={};rights_basis={};source_verified_at={};source_url={}",
                    source.source_id,
                    source.framework_id,
                    source.edition,
                    source.revision_or_amendment.unwrap_or("not_applicable"),
                    source.authority_kind,
                    source.mapping_availability,
                    source.rights_basis,
                    source.source_verified_at,
                    source.source_url,
                ),
            )?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul><h3>Evidence-to-reference relationships</h3><ul>")?;
        if audit.relationships.is_empty() {
            output.push_str("<li><code>no exact mapping in the selected catalogue</code></li>")?;
        }
        for relationship in &audit.relationships {
            let cwe = relationship.cwe.as_deref().unwrap_or("not_available");
            for reference in &relationship.references {
                output.push_str("<li><code>")?;
                write_html_text(
                    &mut output,
                    &format!(
                        "item_fingerprint={};capability_id={};cwe={};item_basis={};rule_id={};source_id={};edition={};control_reference={};control_title={};mapping_basis={};applicability={};applicability_condition={};assurance={};rationale={}",
                        relationship.item_fingerprint,
                        relationship.capability_id,
                        cwe,
                        relationship.item_basis,
                        reference.rule_id,
                        reference.source_id,
                        reference.edition,
                        reference.control_reference,
                        reference.control_title.unwrap_or("not_available"),
                        reference.mapping_basis,
                        reference.applicability,
                        reference.applicability_condition,
                        reference.assurance,
                        reference.original_mapping_rationale,
                    ),
                )?;
                output.push_str("</code></li>")?;
            }
        }
        output.push_str("</ul><p class=\"wp-note\">Framework identifiers and short titles are source-qualified references. Rights-deferred sources are bibliographic context only, and KVKK material is relevant technical context rather than legal advice or a compliance conclusion. No target or provider request was performed for this mapping.</p></section>")?;
    }
    #[cfg(feature = "recon-snapshot-import")]
    if let Some(audit) = &document.recon_snapshot_import {
        output.push_str("<section><h2>Offline reconnaissance snapshot import</h2><p class=\"wp-note\">Imported names, addresses, product hints, and reputation labels are source-qualified hypotheses only. The input digest identifies supplied bytes; it does not authenticate a source, establish asset ownership, authorize scanning, prove current reachability, or create a finding.</p><dl class=\"meta\">")?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Declared sources</h3><ul>")?;
        for source in &audit.sources {
            output.push_str("<li><code>")?;
            write_html_text(&mut output, &source.presentation())?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul><h3>Source-qualified hypotheses</h3><ul>")?;
        for record in &audit.records {
            output.push_str("<li><code>")?;
            write_html_text(&mut output, &record.presentation())?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul><p class=\"wp-note\">This import performed no target request, provider request, archive processing, or decompression. It did not add assessment subjects or items.</p></section>")?;
    }
    #[cfg(feature = "recon-ct-provider")]
    if let Some(audit) = &document.recon_certspotter {
        output.push_str("<section><h2>Cert Spotter reconnaissance provider audit</h2><p class=\"wp-note\">Returned certificate-transparency names are source-qualified hypotheses only. They are not findings and do not establish scan authority, source authentication, ownership, or currentness.</p><dl class=\"meta\">")?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl><h3>Source-qualified hypotheses</h3><ul>")?;
        if audit.hypotheses.is_empty() {
            output.push_str("<li><code>none retained</code></li>")?;
        }
        for hypothesis in &audit.hypotheses {
            output.push_str("<li><code>")?;
            write_html_text(&mut output, &hypothesis.presentation())?;
            output.push_str("</code></li>")?;
        }
        output.push_str("</ul><p class=\"wp-note\">The fixed claim limits apply to the collection and every displayed hypothesis. Provider transport and bounded collection do not authenticate the provider as an asset owner or authorize contact with any returned name.</p></section>")?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(audit) = &document.wordpress_review {
        output.push_str("<section><h2>WordPress evidence review audit</h2><dl class=\"meta\">")?;
        for (label, value) in audit.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl>")?;
        write_wordpress_presentation(&mut WordPressPresentationEmitter::Html(&mut output), audit)?;
        write_html_wordpress_external_attribution(&mut output, audit)?;
        output.push_str("</section>")?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(fingerprints) = &document.wordpress_asset_fingerprints {
        output.push_str(
            "<section><h2>WordPress observed asset fingerprint candidates</h2><dl class=\"meta\">",
        )?;
        for (label, value) in fingerprints.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl>")?;
        write_wordpress_asset_fingerprint_presentation(
            &mut WordPressPresentationEmitter::Html(&mut output),
            fingerprints,
        )?;
        output.push_str("</section>")?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(discovery) = &document.wordpress_discovery {
        output.push_str(
            "<section><h2>WordPress public metadata discovery audit</h2><dl class=\"meta\">",
        )?;
        for (label, value) in discovery.metadata() {
            output.push_str("<dt>")?;
            write_html_text(&mut output, label)?;
            output.push_str("</dt><dd><code>")?;
            write_html_text(&mut output, &value)?;
            output.push_str("</code></dd>")?;
        }
        output.push_str("</dl>")?;
        write_wordpress_discovery_presentation(
            &mut WordPressPresentationEmitter::Html(&mut output),
            discovery,
        )?;
        output.push_str("</section>")?;
    }
    output.push_str("</div></main></body></html>")?;
    Ok(output.finish())
}

#[cfg(feature = "scanning")]
fn write_html_optional_assessment_text(
    output: &mut RenderBuffer,
    value: Option<&str>,
    absent: &'static str,
) -> Result<(), ReportError> {
    match value {
        Some(value) => {
            output.push_str("<code>")?;
            write_html_text(output, value)?;
            output.push_str("</code>")
        },
        None => {
            output.push_str("<span class=\"empty\">")?;
            write_html_text(output, absent)?;
            output.push_str("</span>")
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Clone, Copy)]
enum WordPressPresentationInline<'a> {
    Literal(&'static str),
    Code(&'a str),
    Count(usize),
    Bytes(u64),
    Bool(bool),
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
enum WordPressPresentationEmitter<'a> {
    Html(&'a mut RenderBuffer),
    Markdown(&'a mut RenderBuffer),
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_presentation(
    emitter: &mut WordPressPresentationEmitter<'_>,
    audit: &AssessmentWordPressAuditDocument,
) -> Result<(), ReportError> {
    let counts = audit.presentation_counts();
    emitter.note(
        "Interpretation boundary: review candidates are source-data comparisons, not confirmed vulnerabilities. Processing completion does not establish exhaustive coverage, exploitability, impact, or remediation.",
    )?;
    emitter.overview(&[
        ("Components", audit.component_count),
        ("Review candidates", counts.review_candidates),
        ("Evaluation limitations", counts.limitations),
        ("Contradicted on supplied facts", counts.contradicted),
        ("Evaluations with source guidance", counts.source_guidance),
    ])?;

    emitter.heading("Source and coverage")?;
    emitter.begin_fields()?;
    wordpress_code_field(emitter, "Catalogue status", audit.catalog_status)?;
    if let Some(catalog) = &audit.catalog {
        wordpress_code_field(emitter, "Catalogue identity", &catalog.id)?;
        wordpress_code_field(emitter, "Catalogue revision", &catalog.revision)?;
        wordpress_code_field(
            emitter,
            "Source-declared retrieval date",
            &catalog.retrieved_on,
        )?;
        if let Some(schema) = audit.catalog_schema {
            wordpress_code_field(emitter, "Catalogue schema", schema)?;
        }
    }
    if let Some(inventory) = &audit.inventory_import {
        wordpress_code_field(emitter, "Core inventory", inventory.coverage.core)?;
        wordpress_code_field(emitter, "Plugin inventory", inventory.coverage.plugins)?;
        wordpress_code_field(emitter, "Theme inventory", inventory.coverage.themes)?;
        wordpress_count_field(
            emitter,
            "Imported inventory components",
            inventory.component_count,
        )?;
        wordpress_count_field(
            emitter,
            "Inventory limitations",
            inventory.limitations.len(),
        )?;
    } else {
        wordpress_code_field(emitter, "Saved inventory coverage", "not supplied")?;
    }
    if let Some(external) = &audit.external_review {
        wordpress_code_field(
            emitter,
            "Advisory source namespace",
            external.source_namespace,
        )?;
        wordpress_code_field(emitter, "Advisory source format", external.source_format)?;
        wordpress_code_field(emitter, "Normalization mapping", external.mapping_revision)?;
        if let Some(policy) = external.identity_mapping_policy {
            wordpress_code_field(emitter, "Identity mapping policy", policy)?;
            wordpress_optional_code_field(
                emitter,
                "Source identity assurance",
                external.identity_source_assurance,
            )?;
        }
        if let Some(policy) = external.resource_policy {
            wordpress_code_field(emitter, "External resource policy", policy)?;
        }
        wordpress_code_field(emitter, "Comparison policy", external.comparison_policy)?;
        if let Some(profile) = external.comparison_profile {
            wordpress_code_field(emitter, "Comparison profile", profile)?;
            wordpress_optional_code_field(emitter, "Policy selection", external.policy_selection)?;
            wordpress_optional_code_field(
                emitter,
                "Source comparison semantics assurance",
                external.source_semantics_assurance,
            )?;
        }
        wordpress_bytes_field(emitter, "Input bytes", external.input.byte_length)?;
        wordpress_code_field(emitter, "Input byte digest", &external.input.sha256)?;
        wordpress_code_field(
            emitter,
            "Input semantic digest",
            &external.input.semantic_sha256,
        )?;
        if let Some(bytes) = external.input.accounted_retained_bytes {
            wordpress_count_field(emitter, "Accounted retained import bytes", bytes)?;
        }
        for (label, count) in [
            ("Parsed source records", external.counts.parsed_records),
            (
                "Software associations",
                external.counts.software_associations,
            ),
            (
                "Relevant associations",
                external.counts.selected_associations,
            ),
            (
                "Evaluable associations",
                external.counts.evaluable_associations,
            ),
        ] {
            wordpress_count_field(emitter, label, count)?;
        }
        for (label, count) in [
            (
                "Exact source identity associations",
                external.counts.exact_identity_associations,
            ),
            (
                "Case-fold candidate associations",
                external.counts.candidate_identity_associations,
            ),
            (
                "Case-fold ambiguous associations",
                external.counts.ambiguous_identity_associations,
            ),
            (
                "Unresolved source identity associations",
                external.counts.unresolved_identity_associations,
            ),
            (
                "Detailed unresolved identity rows shown",
                external.counts.projected_identity_limitations,
            ),
            (
                "Unresolved identity rows not expanded",
                external.counts.unprojected_identity_limitations,
            ),
        ] {
            if let Some(count) = count {
                wordpress_count_field(emitter, label, count)?;
            }
        }
        if external.comparison_profile.is_none() {
            wordpress_count_field(
                emitter,
                "Unsupported relevant associations",
                external.counts.unsupported_associations,
            )?;
        }
        wordpress_count_field(
            emitter,
            if external.identity_mapping_policy.is_some() {
                "Mapped associations not selected for supplied components"
            } else {
                "Irrelevant associations excluded"
            },
            external
                .counts
                .mapped_unselected_associations
                .unwrap_or(external.counts.excluded_associations),
        )?;
        for (label, count) in [
            (
                "Within-range associations",
                external.counts.within_associations,
            ),
            (
                "Outside-range associations",
                external.counts.outside_associations,
            ),
            (
                "Indeterminate associations",
                external.counts.indeterminate_associations,
            ),
            ("Selected source ranges", external.counts.selected_ranges),
            ("Evaluated ranges", external.counts.evaluated_ranges),
            ("Containing ranges", external.counts.containing_ranges),
            ("Noncontaining ranges", external.counts.noncontaining_ranges),
            ("Unsupported ranges", external.counts.unsupported_ranges),
            ("Invalid ranges", external.counts.invalid_ranges),
            ("Ranges not evaluated", external.counts.not_evaluated_ranges),
            (
                "Qualified partial-range matches",
                external.counts.partial_range_coverage_associations,
            ),
        ] {
            if let Some(count) = count {
                wordpress_count_field(emitter, label, count)?;
            }
        }
    }
    emitter.end_fields()?;

    if let Some(inventory) = &audit.inventory_import {
        emitter.heading("Saved inventory provenance and limitations")?;
        for input in &inventory.inputs {
            emitter.begin_record()?;
            emitter.inline(WordPressPresentationInline::Code(input.class))?;
            emitter.end_record_title()?;
            wordpress_count_field(emitter, "Exact-read bytes", input.byte_length)?;
            wordpress_code_field(emitter, "SHA-256", &input.sha256)?;
            emitter.end_record()?;
        }
        if inventory.limitations.is_empty() {
            emitter.empty("No typed inventory-row limitations were recorded.")?;
        } else {
            for limitation in &inventory.limitations {
                emitter.begin_record()?;
                emitter.inline(WordPressPresentationInline::Literal(
                    "Unsupported inventory row: ",
                ))?;
                emitter.inline(WordPressPresentationInline::Code(&limitation.declared_name))?;
                emitter.end_record_title()?;
                wordpress_code_field(emitter, "Status", limitation.status)?;
                wordpress_code_field(emitter, "Reason", limitation.reason)?;
                wordpress_optional_code_field(
                    emitter,
                    "Declared version",
                    limitation.version.as_deref(),
                )?;
                emitter.end_record()?;
            }
        }
    }

    emitter.heading("Component evidence")?;
    if audit.components.is_empty() {
        emitter.empty("No component evidence was retained.")?;
    } else {
        for component in &audit.components {
            write_wordpress_component(emitter, component)?;
        }
    }

    emitter.heading("Execution boundary")?;
    emitter.paragraph(
        "The WordPress review interprets retained and operator-supplied data only; it does not execute an exploit or validate impact.",
    )?;
    emitter.begin_fields()?;
    wordpress_code_field(emitter, "Exploit execution", "not_performed")?;
    wordpress_code_field(emitter, "Impact validation", "not_performed")?;
    emitter.end_fields()?;

    write_wordpress_evaluation_group(
        emitter,
        audit,
        WordPressPresentationGroup::ReviewCandidate,
        "Review candidates",
        "These records match only on the supplied declarations and still require operator review.",
    )?;
    write_wordpress_evaluation_group(
        emitter,
        audit,
        WordPressPresentationGroup::Contradicted,
        "Contradicted on supplied facts",
        "These declared-data evaluations did not match; they do not establish that the installation is safe.",
    )?;
    write_wordpress_evaluation_group(
        emitter,
        audit,
        WordPressPresentationGroup::Limitation,
        "Evaluation limitations",
        "Missing, conflicting, unsupported, or source-semantics-limited data prevented a stronger evaluation.",
    )?;

    emitter.heading("Source-declared remediation information")?;
    emitter.note(
        "Source-declared fixed versions, patched versions, and remediation remain attached to each evaluation above. They are not an automatic update, a verified fix, or a minimum safe version across every maintained branch. A false source patched flag means only that the association did not declare a fix; it does not establish permanent unpatchability.",
    )?;
    emitter.begin_fields()?;
    wordpress_count_field(
        emitter,
        "Evaluations with source guidance",
        counts.source_guidance,
    )?;
    emitter.end_fields()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_discovery_presentation(
    emitter: &mut WordPressPresentationEmitter<'_>,
    discovery: &AssessmentWordPressDiscoveryAuditDocument,
) -> Result<(), ReportError> {
    emitter.note(
        "Discovery boundary: these anonymous exact-origin metadata responses are associated with one selected application and a bounded deployment layout. Exact means that the source was bound to one supported role under observed or operator-declared inputs; it does not authenticate installation ownership, prove vulnerability applicability, or perform exploitation or impact validation.",
    )?;
    emitter.overview(&[
        ("Admitted seeds", usize::from(discovery.seed_count)),
        (
            "Selected candidates",
            usize::from(discovery.candidate_count),
        ),
        (
            "Attempted requests",
            usize::from(discovery.attempted_request_count),
        ),
        (
            "Completed responses",
            usize::from(discovery.completed_response_count),
        ),
        (
            "Committed responses",
            usize::from(discovery.committed_response_count),
        ),
    ])?;
    emitter.heading("Selected application and deployment layout")?;
    emitter.paragraph(
        "Application, role, and resource references are opaque location identities in this report. They do not contain literal deployment paths, but they are not a secrecy guarantee, signature, or proof of deployment control. Ambiguous and unresolved roles are retained as coverage limits rather than guessed locations.",
    )?;
    emitter.begin_fields()?;
    wordpress_code_field(
        emitter,
        "Selected application reference",
        &discovery.layout.application_reference,
    )?;
    if let Some(declaration) = &discovery.layout.declaration {
        wordpress_code_field(emitter, "Layout declaration schema", declaration.schema)?;
        wordpress_bytes_field(
            emitter,
            "Layout declaration exact-read bytes",
            declaration.byte_length,
        )?;
        wordpress_code_field(emitter, "Layout declaration SHA-256", &declaration.sha256)?;
    } else {
        wordpress_code_field(emitter, "Operator layout declaration", "not supplied")?;
    }
    wordpress_count_field(
        emitter,
        "Skipped foreign-origin advertisements",
        usize::from(discovery.layout.skipped_foreign_origin_count),
    )?;
    wordpress_count_field(
        emitter,
        "Skipped sibling-application advertisements",
        usize::from(discovery.layout.skipped_sibling_application_count),
    )?;
    wordpress_count_field(
        emitter,
        "Conflicting layout associations",
        usize::from(discovery.layout.conflicting_association_count),
    )?;
    emitter.end_fields()?;
    for role in &discovery.layout.roles {
        emitter.begin_record()?;
        emitter.inline(WordPressPresentationInline::Code(role.role))?;
        emitter.inline(WordPressPresentationInline::Literal(" — "))?;
        emitter.inline(WordPressPresentationInline::Code(role.status))?;
        emitter.end_record_title()?;
        wordpress_code_field(emitter, "Layout role", role.role)?;
        wordpress_code_field(emitter, "Resolution status", role.status)?;
        wordpress_code_field(emitter, "Resolution basis", role.basis)?;
        wordpress_optional_code_field(emitter, "Role reference", role.reference.as_deref())?;
        wordpress_count_field(
            emitter,
            "Distinct location candidates",
            usize::from(role.candidate_count),
        )?;
        emitter.end_record()?;
    }
    if let Some(pages) = &discovery.page_collection {
        emitter.heading("Page-scoped collection")?;
        emitter.paragraph(
            "The page scope is a bounded first-hop sample under the entry-selected application and layout. Reused responses were already charged by the parent assessment; newly transferred page bytes and metadata requests are reported separately. A missing page response or rejected association is a coverage limit, not evidence that a component is absent.",
        )?;
        emitter.begin_fields()?;
        wordpress_code_field(emitter, "Selected page mode", pages.mode)?;
        wordpress_code_field(
            emitter,
            "Opaque entry page reference",
            &pages.entry_page_reference,
        )?;
        wordpress_count_field(
            emitter,
            "Eligible page candidates",
            usize::from(pages.candidate_count),
        )?;
        wordpress_count_field(
            emitter,
            "Selected non-entry pages",
            usize::from(pages.selected_count),
        )?;
        wordpress_count_field(
            emitter,
            "Omitted page candidates",
            usize::from(pages.omitted_candidate_count),
        )?;
        wordpress_count_field(
            emitter,
            "Reused page responses",
            usize::from(pages.reused_response_count),
        )?;
        wordpress_count_field(
            emitter,
            "Fetched page responses",
            usize::from(pages.fetched_response_count),
        )?;
        wordpress_count_field(
            emitter,
            "Pages not observed",
            usize::from(pages.not_observed_count),
        )?;
        wordpress_count_field(
            emitter,
            "Rejected page responses",
            usize::from(pages.rejected_response_count),
        )?;
        wordpress_count_field(
            emitter,
            "Accepted page associations",
            usize::from(pages.accepted_association_count),
        )?;
        wordpress_count_field(
            emitter,
            "Rejected page associations",
            usize::from(pages.rejected_association_count),
        )?;
        wordpress_count_field(
            emitter,
            "Page request attempts",
            usize::from(pages.attempted_request_count),
        )?;
        emitter.begin_field("Interpreted page bytes")?;
        emitter.inline(WordPressPresentationInline::Bytes(
            pages.interpreted_response_bytes,
        ))?;
        emitter.end_field()?;
        emitter.begin_field("Newly transferred page bytes")?;
        emitter.inline(WordPressPresentationInline::Bytes(pages.response_bytes))?;
        emitter.end_field()?;
        emitter.end_fields()?;
        for page in &pages.pages {
            emitter.begin_record()?;
            emitter.inline(WordPressPresentationInline::Code(&page.page_reference))?;
            emitter.inline(WordPressPresentationInline::Literal(" — "))?;
            emitter.inline(WordPressPresentationInline::Code(page.outcome))?;
            emitter.end_record_title()?;
            wordpress_code_field(emitter, "Acquisition class", page.acquisition)?;
            wordpress_code_field(emitter, "Application association", page.association)?;
            wordpress_code_field(emitter, "Interpretation outcome", page.outcome)?;
            wordpress_code_field(
                emitter,
                "Opaque source page reference",
                &page.page_reference,
            )?;
            wordpress_count_field(
                emitter,
                "Evidence reference count",
                page.evidence_reference_count,
            )?;
            emitter.begin_field("Interpreted response bytes")?;
            emitter.inline(WordPressPresentationInline::Bytes(
                page.interpreted_response_bytes,
            ))?;
            emitter.end_field()?;
            emitter.begin_field("Newly transferred response bytes")?;
            emitter.inline(WordPressPresentationInline::Bytes(page.response_bytes))?;
            emitter.end_field()?;
            emitter.end_record()?;
        }
    }
    if let Some(pages) = &discovery.supplied_session_pages {
        emitter.heading("Supplied-session page interpretation")?;
        emitter.paragraph(
            "Only health-qualified, committed responses from the explicitly supplied session can support these page relationships. WordPress metadata retrieval remains anonymous; the references below do not authenticate the principal or application, and V1 does not nominate authenticated page assets for fingerprinting.",
        )?;
        emitter.begin_fields()?;
        wordpress_code_field(emitter, "Interpretation mode", pages.mode)?;
        wordpress_code_field(emitter, "Session policy reference", &pages.policy_reference)?;
        wordpress_code_field(
            emitter,
            "Session application reference",
            &pages.application_reference,
        )?;
        wordpress_code_field(
            emitter,
            "Operator-declared principal reference",
            &pages.principal_reference,
        )?;
        wordpress_code_field(emitter, "Credential mechanism", pages.credential_mechanism)?;
        wordpress_count_field(emitter, "Session epoch", usize::from(pages.session_epoch))?;
        wordpress_count_field(
            emitter,
            "Selected session resources",
            usize::from(pages.selected_count),
        )?;
        wordpress_count_field(
            emitter,
            "Committed session resources",
            usize::from(pages.committed_count),
        )?;
        wordpress_count_field(
            emitter,
            "Accepted application associations",
            usize::from(pages.accepted_association_count),
        )?;
        wordpress_count_field(
            emitter,
            "Rejected application associations",
            usize::from(pages.rejected_association_count),
        )?;
        wordpress_count_field(
            emitter,
            "Associations not established",
            usize::from(pages.not_established_association_count),
        )?;
        wordpress_count_field(
            emitter,
            "Resources not evaluated",
            usize::from(pages.not_evaluated_count),
        )?;
        emitter.begin_field("Interpreted session response bytes")?;
        emitter.inline(WordPressPresentationInline::Bytes(
            pages.interpreted_response_bytes,
        ))?;
        emitter.end_field()?;
        emitter.end_fields()?;
        for page in &pages.pages {
            emitter.begin_record()?;
            emitter.inline(WordPressPresentationInline::Code(&page.page_reference))?;
            emitter.inline(WordPressPresentationInline::Literal(" — "))?;
            emitter.inline(WordPressPresentationInline::Code(page.outcome))?;
            emitter.end_record_title()?;
            wordpress_code_field(emitter, "Acquisition class", page.acquisition)?;
            wordpress_code_field(emitter, "Application association", page.association)?;
            wordpress_code_field(emitter, "Interpretation outcome", page.outcome)?;
            wordpress_code_field(
                emitter,
                "Opaque supplied-session resource reference",
                &page.resource_reference,
            )?;
            wordpress_optional_code_field(
                emitter,
                "Opaque committed resource evidence reference",
                page.resource_evidence_reference.as_deref(),
            )?;
            wordpress_code_field(
                emitter,
                "Authenticated-page fingerprint evaluation",
                page.fingerprint_evaluation,
            )?;
            wordpress_count_field(
                emitter,
                "Evidence reference count",
                page.evidence_reference_count,
            )?;
            emitter.begin_field("Interpreted response bytes")?;
            emitter.inline(WordPressPresentationInline::Bytes(
                page.interpreted_response_bytes,
            ))?;
            emitter.end_field()?;
            emitter.end_record()?;
        }
    }
    emitter.heading("Discovered metadata sources")?;
    if discovery.sources.is_empty() {
        emitter
            .empty("No eligible metadata source was selected from the committed root response.")?;
        return Ok(());
    }
    for source in &discovery.sources {
        emitter.begin_record()?;
        emitter.inline(WordPressPresentationInline::Code(source.kind))?;
        if let Some(component) = &source.component {
            emitter.inline(WordPressPresentationInline::Literal(" — "))?;
            emitter.inline(WordPressPresentationInline::Code(component.kind))?;
            emitter.inline(WordPressPresentationInline::Literal(":"))?;
            emitter.inline(WordPressPresentationInline::Code(&component.slug))?;
        }
        emitter.inline(WordPressPresentationInline::Literal(" — "))?;
        emitter.inline(WordPressPresentationInline::Code(source.outcome))?;
        emitter.end_record_title()?;
        wordpress_code_field(emitter, "Source class", source.kind)?;
        wordpress_code_field(emitter, "Application association", source.association)?;
        wordpress_code_field(
            emitter,
            "Opaque resource reference",
            &source.resource_reference,
        )?;
        wordpress_optional_code_field(
            emitter,
            "Opaque role reference",
            source.role_reference.as_deref(),
        )?;
        wordpress_code_field(emitter, "Collection outcome", source.outcome)?;
        wordpress_count_field(
            emitter,
            "Parent-theme depth",
            usize::from(source.parent_depth),
        )?;
        wordpress_count_field(
            emitter,
            "Evidence reference count",
            source.evidence_reference_count,
        )?;
        write_wordpress_values(
            emitter,
            "Opaque source page references",
            source.source_page_references.iter().map(String::as_str),
            "not recorded by this audit version",
        )?;
        if let Some(references) = &source.source_supplied_session_page_references {
            wordpress_count_field(
                emitter,
                "Supplied-session source page reference count",
                references.len(),
            )?;
        }
        write_wordpress_values(
            emitter,
            "Opaque supplied-session source page references",
            source
                .source_supplied_session_page_references
                .iter()
                .flat_map(|references| references.iter())
                .map(String::as_str),
            "not recorded by this audit version or no supplied-session source",
        )?;
        emitter.begin_field("Response bytes")?;
        emitter.inline(WordPressPresentationInline::Bytes(source.response_bytes))?;
        emitter.end_field()?;
        write_wordpress_values(
            emitter,
            "REST namespaces (protocol support only)",
            source.namespaces.iter().map(String::as_str),
            "none retained",
        )?;
        if let Some(theme) = &source.theme {
            wordpress_optional_code_field(emitter, "Theme display name", theme.name.as_deref())?;
            wordpress_optional_code_field(
                emitter,
                "Artifact-declared theme version",
                theme.version.as_deref(),
            )?;
            wordpress_optional_code_field(
                emitter,
                "Declared parent theme slug",
                theme.template.as_deref(),
            )?;
            wordpress_optional_code_field(
                emitter,
                "Requires WordPress",
                theme.requires_wordpress.as_deref(),
            )?;
            wordpress_optional_code_field(
                emitter,
                "Requires PHP (compatibility declaration)",
                theme.requires_php.as_deref(),
            )?;
            wordpress_optional_code_field(
                emitter,
                "Tested up to (compatibility declaration)",
                theme.tested_up_to.as_deref(),
            )?;
        }
        if let Some(plugin) = &source.plugin {
            wordpress_optional_code_field(emitter, "Plugin display name", plugin.name.as_deref())?;
            wordpress_optional_code_field(
                emitter,
                "Distribution release hint (not installed version)",
                plugin.stable_tag.as_deref(),
            )?;
            wordpress_optional_code_field(
                emitter,
                "Requires WordPress",
                plugin.requires_wordpress.as_deref(),
            )?;
            wordpress_optional_code_field(
                emitter,
                "Requires PHP (compatibility declaration)",
                plugin.requires_php.as_deref(),
            )?;
            wordpress_optional_code_field(
                emitter,
                "Tested up to (compatibility declaration)",
                plugin.tested_up_to.as_deref(),
            )?;
        }
        emitter.end_record()?;
    }
    Ok(())
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_asset_fingerprint_presentation(
    emitter: &mut WordPressPresentationEmitter<'_>,
    audit: &AssessmentWordPressAssetFingerprintAuditDocument,
) -> Result<(), ReportError> {
    emitter.note(
        "Fingerprint boundary: exact complete-byte observations are compared only with this finite supplied catalogue. Candidate releases are conditional catalogue results, not installed-version evidence, publisher authentication, whole-package verification, vulnerability confirmation, or exhaustive release coverage.",
    )?;
    emitter.overview(&[
        (
            "Observed asset candidates",
            usize::try_from(audit.candidate_count).unwrap_or(usize::MAX),
        ),
        ("Selected resources", audit.selected_resource_count),
        ("Omitted resources", audit.omitted_resource_count),
        ("Compared components", audit.component_count),
    ])?;

    emitter.heading("Finite reference catalogue")?;
    emitter.begin_fields()?;
    wordpress_code_field(emitter, "Catalogue ID", &audit.catalogue.id)?;
    wordpress_code_field(emitter, "Catalogue revision", &audit.catalogue.revision)?;
    wordpress_code_field(
        emitter,
        "Catalogue source namespace",
        &audit.catalogue.source_namespace,
    )?;
    wordpress_bytes_field(
        emitter,
        "Catalogue exact-read bytes",
        audit.catalogue.byte_length,
    )?;
    wordpress_code_field(emitter, "Catalogue byte SHA-256", &audit.catalogue.sha256)?;
    wordpress_code_field(
        emitter,
        "Catalogue semantic SHA-256",
        &audit.catalogue.semantic_sha256,
    )?;
    wordpress_count_field(
        emitter,
        "Accounted prepared-index bytes",
        audit.catalogue.retained_bytes,
    )?;
    wordpress_count_field(
        emitter,
        "Listed components",
        audit.catalogue.component_count,
    )?;
    wordpress_count_field(emitter, "Listed releases", audit.catalogue.release_count)?;
    wordpress_count_field(
        emitter,
        "Listed reference files",
        audit.catalogue.file_count,
    )?;
    wordpress_code_field(
        emitter,
        "Catalogue provenance reference",
        &audit.catalogue.provenance.reference,
    )?;
    wordpress_code_field(
        emitter,
        "Catalogue provenance revision",
        &audit.catalogue.provenance.revision,
    )?;
    wordpress_code_field(emitter, "Reference scope", audit.finite_reference_scope)?;
    wordpress_code_field(
        emitter,
        "Same-release assumption",
        audit.same_release_assumption,
    )?;
    wordpress_code_field(
        emitter,
        "Installed-version assurance",
        audit.installed_version_assurance,
    )?;
    wordpress_code_field(emitter, "Source authenticity", audit.source_authenticity)?;
    emitter.end_fields()?;

    emitter.heading("Catalogue notices")?;
    if audit.catalogue.provenance.notices.is_empty() {
        emitter.empty("No catalogue notice was supplied.")?;
    } else {
        for notice in &audit.catalogue.provenance.notices {
            emitter.begin_record()?;
            emitter.inline(WordPressPresentationInline::Code(&notice.id))?;
            emitter.inline(WordPressPresentationInline::Literal(" — "))?;
            emitter.inline(WordPressPresentationInline::Code(&notice.party))?;
            emitter.end_record_title()?;
            wordpress_code_field(emitter, "Party", &notice.party)?;
            wordpress_code_field(emitter, "Notice", &notice.notice)?;
            wordpress_code_field(emitter, "License", &notice.license)?;
            wordpress_code_field(
                emitter,
                "Inert license reference",
                &notice.license_reference,
            )?;
            emitter.end_record()?;
        }
    }

    emitter.heading("Observed resource collection")?;
    emitter.paragraph(
        "Resource and page references are bounded opaque identifiers. SHA-256 values cover eligible complete identity-coded content bytes and are not signatures. Query strings and raw resource bodies are not retained here.",
    )?;
    if audit.resources.is_empty() {
        emitter.empty("No resource was selected for byte comparison.")?;
    } else {
        for resource in &audit.resources {
            emitter.begin_record()?;
            emitter.inline(WordPressPresentationInline::Code(resource.component.kind))?;
            emitter.inline(WordPressPresentationInline::Literal(":"))?;
            emitter.inline(WordPressPresentationInline::Code(&resource.component.slug))?;
            emitter.inline(WordPressPresentationInline::Literal(" — "))?;
            emitter.inline(WordPressPresentationInline::Code(&resource.relative_path))?;
            emitter.inline(WordPressPresentationInline::Literal(" — "))?;
            emitter.inline(WordPressPresentationInline::Code(resource.outcome))?;
            emitter.end_record_title()?;
            wordpress_code_field(emitter, "Component kind", resource.component.kind)?;
            wordpress_code_field(emitter, "Component slug", &resource.component.slug)?;
            wordpress_code_field(emitter, "Component-relative path", &resource.relative_path)?;
            wordpress_code_field(
                emitter,
                "Opaque resource reference",
                &resource.resource_reference,
            )?;
            write_wordpress_values(
                emitter,
                "Opaque source page references",
                resource.source_page_references.iter().map(String::as_str),
                "none retained",
            )?;
            wordpress_count_field(
                emitter,
                "Observed URL variants",
                resource.observed_variant_count,
            )?;
            wordpress_code_field(emitter, "Acquisition class", resource.acquisition)?;
            wordpress_code_field(emitter, "Collection outcome", resource.outcome)?;
            wordpress_bool_field(emitter, "Request attempted", resource.request_attempted)?;
            wordpress_bytes_field(
                emitter,
                "Interpreted complete-body bytes",
                resource.interpreted_response_bytes,
            )?;
            wordpress_bytes_field(
                emitter,
                "Newly transferred response bytes",
                resource.response_bytes,
            )?;
            if let Some(observation) = &resource.observation {
                wordpress_bytes_field(emitter, "Observed byte length", observation.byte_length)?;
                wordpress_code_field(emitter, "Observed byte SHA-256", &observation.sha256)?;
            } else {
                wordpress_code_field(emitter, "Complete-byte fingerprint", "unavailable")?;
            }
            wordpress_count_field(
                emitter,
                "Evidence reference count",
                resource.evidence_reference_count,
            )?;
            emitter.end_record()?;
        }
    }

    emitter.heading("Catalogue-scoped release candidates")?;
    if audit.components.is_empty() {
        emitter.empty("No component had a selected resource comparison.")?;
    } else {
        for component in &audit.components {
            emitter.begin_record()?;
            emitter.inline(WordPressPresentationInline::Code(component.identity.kind))?;
            emitter.inline(WordPressPresentationInline::Literal(":"))?;
            emitter.inline(WordPressPresentationInline::Code(&component.identity.slug))?;
            emitter.inline(WordPressPresentationInline::Literal(" — "))?;
            emitter.inline(WordPressPresentationInline::Code(component.state))?;
            emitter.end_record_title()?;
            wordpress_code_field(emitter, "Aggregate state", component.state)?;
            wordpress_bool_field(
                emitter,
                "Component represented in catalogue",
                component.catalogue_component_listed,
            )?;
            wordpress_bool_field(
                emitter,
                "Listed release matrix complete",
                component.listed_matrix_complete,
            )?;
            wordpress_count_field(
                emitter,
                "Informative resource paths",
                component.informative_resource_count,
            )?;
            write_wordpress_values(
                emitter,
                "Compatible listed release IDs",
                component.compatible_release_ids.iter().map(String::as_str),
                "none",
            )?;
            write_wordpress_values(
                emitter,
                "Undetermined listed release IDs",
                component
                    .undetermined_release_ids
                    .iter()
                    .map(String::as_str),
                "none",
            )?;
            write_wordpress_values(
                emitter,
                "Inconsistent listed release IDs",
                component
                    .inconsistent_release_ids
                    .iter()
                    .map(String::as_str),
                "none",
            )?;
            if component.resources.is_empty() {
                wordpress_code_field(emitter, "Resource comparison matrix", "empty")?;
            } else {
                emitter.begin_list_field("Resource comparison matrix")?;
                for resource in &component.resources {
                    emitter.begin_list_item()?;
                    emitter.inline(WordPressPresentationInline::Code(&resource.relative_path))?;
                    emitter.inline(WordPressPresentationInline::Literal(" — observations "))?;
                    emitter.inline(WordPressPresentationInline::Count(
                        resource.distinct_observation_count,
                    ))?;
                    emitter.inline(WordPressPresentationInline::Literal("; informative "))?;
                    emitter.inline(WordPressPresentationInline::Bool(resource.informative))?;
                    for relation in &resource.release_relations {
                        emitter.inline(WordPressPresentationInline::Literal("; "))?;
                        emitter.inline(WordPressPresentationInline::Code(&relation.release_id))?;
                        emitter.inline(WordPressPresentationInline::Literal("="))?;
                        emitter.inline(WordPressPresentationInline::Code(relation.relation))?;
                        if let Some(reason) = relation.unknown_reason {
                            emitter.inline(WordPressPresentationInline::Literal(" ("))?;
                            emitter.inline(WordPressPresentationInline::Code(reason))?;
                            emitter.inline(WordPressPresentationInline::Literal(")"))?;
                        }
                    }
                    emitter.end_list_item()?;
                }
                emitter.end_list_field()?;
            }
            if component.releases.is_empty() {
                wordpress_code_field(emitter, "Listed releases", "none")?;
            } else {
                emitter.begin_list_field("Listed release sources and states")?;
                for release in &component.releases {
                    emitter.begin_list_item()?;
                    emitter.inline(WordPressPresentationInline::Code(&release.release_id))?;
                    emitter.inline(WordPressPresentationInline::Literal(" version "))?;
                    emitter.inline(WordPressPresentationInline::Code(&release.version))?;
                    if let Some(build) = &release.build_variant {
                        emitter.inline(WordPressPresentationInline::Literal(" build "))?;
                        emitter.inline(WordPressPresentationInline::Code(build))?;
                    }
                    emitter.inline(WordPressPresentationInline::Literal(" — "))?;
                    emitter.inline(WordPressPresentationInline::Code(release.state))?;
                    emitter.inline(WordPressPresentationInline::Literal("; source "))?;
                    emitter.inline(WordPressPresentationInline::Code(&release.source.reference))?;
                    emitter.inline(WordPressPresentationInline::Literal(" @ "))?;
                    emitter.inline(WordPressPresentationInline::Code(&release.source.revision))?;
                    emitter.end_list_item()?;
                }
                emitter.end_list_field()?;
            }
            emitter.end_record()?;
        }
    }

    emitter.heading("Interpretation boundary")?;
    emitter.paragraph(
        "Even one complete listed matrix can identify only a conditional candidate among represented releases. Unlisted releases, custom or cached copies, mixed artifacts, and reused bytes remain possible; existing WordPress installed-version and advisory inputs are not changed by this audit.",
    )
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_component(
    emitter: &mut WordPressPresentationEmitter<'_>,
    component: &WordPressComponentDocument,
) -> Result<(), ReportError> {
    emitter.begin_record()?;
    emitter.inline(WordPressPresentationInline::Code(component.identity.kind))?;
    emitter.inline(WordPressPresentationInline::Literal(":"))?;
    emitter.inline(WordPressPresentationInline::Code(&component.identity.slug))?;
    emitter.inline(WordPressPresentationInline::Literal(" — "))?;
    emitter.inline(WordPressPresentationInline::Code(component.evidence_class))?;
    emitter.end_record_title()?;
    wordpress_code_field(emitter, "Evidence class", component.evidence_class)?;
    wordpress_optional_code_field(emitter, "Activation", component.activation)?;
    wordpress_optional_code_field(emitter, "Inventory status", component.inventory_status)?;
    write_wordpress_values(
        emitter,
        "Identity sources",
        component.identity_sources.iter().copied(),
        "none recorded",
    )?;
    write_wordpress_values(
        emitter,
        "Confidence classes",
        component.confidence_classes.iter().copied(),
        "none recorded",
    )?;
    if component.versions.is_empty() {
        wordpress_code_field(emitter, "Version evidence", "missing")?;
    } else {
        emitter.begin_list_field("Version evidence")?;
        for version in &component.versions {
            emitter.begin_list_item()?;
            emitter.inline(WordPressPresentationInline::Code(&version.value))?;
            emitter.inline(WordPressPresentationInline::Literal(" from "))?;
            emitter.inline(WordPressPresentationInline::Code(version.source))?;
            emitter.inline(WordPressPresentationInline::Literal(" with "))?;
            emitter.inline(WordPressPresentationInline::Code(version.confidence))?;
            emitter.end_list_item()?;
        }
        emitter.end_list_field()?;
    }
    emitter.end_record()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_evaluation_group(
    emitter: &mut WordPressPresentationEmitter<'_>,
    audit: &AssessmentWordPressAuditDocument,
    group: WordPressPresentationGroup,
    title: &'static str,
    explanation: &'static str,
) -> Result<(), ReportError> {
    emitter.heading(title)?;
    emitter.paragraph(explanation)?;
    let mut rendered = 0_usize;
    for advisory in &audit.advisories {
        if wordpress_advisory_group(advisory) == group {
            write_wordpress_advisory(emitter, advisory)?;
            rendered += 1;
        }
    }
    if let Some(external) = &audit.external_review {
        for evaluation in &external.evaluations {
            if wordpress_external_advisory_group(evaluation) == group {
                write_wordpress_external_evaluation(emitter, external, evaluation)?;
                rendered += 1;
            }
        }
        if group == WordPressPresentationGroup::Limitation {
            if let Some(limitations) = &external.identity_limitations {
                for limitation in limitations {
                    write_wordpress_external_identity_limitation(emitter, limitation)?;
                    rendered += 1;
                }
            }
            if external
                .counts
                .unprojected_identity_limitations
                .is_some_and(|count| count > 0)
            {
                emitter.paragraph(
                    "The unresolved identity total covers the complete imported snapshot. This section expands only a deterministic bounded detail projection; rows not expanded here were not evaluated or classified as unaffected.",
                )?;
            }
        }
    }
    if rendered == 0 {
        emitter.empty("No records in this group.")?;
    }
    Ok(())
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_advisory(
    emitter: &mut WordPressPresentationEmitter<'_>,
    advisory: &WordPressAdvisoryDocument,
) -> Result<(), ReportError> {
    emitter.begin_record()?;
    emitter.inline(WordPressPresentationInline::Code(&advisory.id))?;
    emitter.inline(WordPressPresentationInline::Literal(" — "))?;
    emitter.inline(WordPressPresentationInline::Code(advisory.component.kind))?;
    emitter.inline(WordPressPresentationInline::Literal(":"))?;
    emitter.inline(WordPressPresentationInline::Code(&advisory.component.slug))?;
    emitter.inline(WordPressPresentationInline::Literal(" — "))?;
    emitter.inline(WordPressPresentationInline::Code(advisory.applicability))?;
    emitter.end_record_title()?;
    wordpress_code_field(emitter, "Applicability", advisory.applicability)?;
    wordpress_code_field(emitter, "Version relation", advisory.version_relation)?;
    wordpress_code_field(
        emitter,
        "Comparison profile",
        advisory
            .comparison_profile
            .unwrap_or("numeric-dotted/v1 (implicit catalogue contract)"),
    )?;
    wordpress_code_field(
        emitter,
        "Version resolution",
        advisory
            .version_resolution
            .unwrap_or("not recorded by audit schema"),
    )?;
    wordpress_code_field(
        emitter,
        "Version-resolution reason",
        advisory
            .version_resolution_reason
            .unwrap_or("not recorded by audit schema"),
    )?;
    wordpress_code_field(emitter, "Component evidence", advisory.component_evidence)?;
    wordpress_code_field(emitter, "Source reference", &advisory.source.reference)?;
    wordpress_code_field(emitter, "Source revision", &advisory.source.revision)?;
    wordpress_code_field(
        emitter,
        "Source-declared retrieval date",
        &advisory.source.retrieved_on,
    )?;
    wordpress_code_field(emitter, "Source usage basis", &advisory.source.usage_basis)?;
    wordpress_optional_code_field(emitter, "CVE", advisory.cve.as_deref())?;
    wordpress_code_field(emitter, "Source summary", &advisory.summary)?;
    if advisory.affected_ranges.is_empty() {
        wordpress_code_field(emitter, "Affected ranges", "none declared")?;
    } else {
        emitter.begin_list_field("Affected ranges")?;
        for range in &advisory.affected_ranges {
            emitter.begin_list_item()?;
            emitter.inline(WordPressPresentationInline::Literal("lower "))?;
            write_wordpress_endpoint(emitter, range.lower.as_ref())?;
            emitter.inline(WordPressPresentationInline::Literal("; upper "))?;
            write_wordpress_endpoint(emitter, range.upper.as_ref())?;
            emitter.end_list_item()?;
        }
        emitter.end_list_field()?;
    }
    write_wordpress_values(
        emitter,
        "Source-declared fixed versions",
        advisory.fixed_versions.iter().map(String::as_str),
        "none declared",
    )?;
    if advisory.prerequisites.is_empty() {
        wordpress_code_field(emitter, "Prerequisites", "none declared")?;
    } else {
        emitter.begin_list_field("Prerequisites")?;
        for prerequisite in &advisory.prerequisites {
            emitter.begin_list_item()?;
            emitter.inline(WordPressPresentationInline::Code(prerequisite.kind))?;
            emitter.inline(WordPressPresentationInline::Literal(" expected "))?;
            emitter.inline(WordPressPresentationInline::Code(&prerequisite.expected))?;
            emitter.inline(WordPressPresentationInline::Literal(": "))?;
            emitter.inline(WordPressPresentationInline::Code(prerequisite.outcome))?;
            if let Some(patch_id) = &prerequisite.patch_id {
                emitter.inline(WordPressPresentationInline::Literal("; patch "))?;
                emitter.inline(WordPressPresentationInline::Code(patch_id))?;
            }
            emitter.end_list_item()?;
        }
        emitter.end_list_field()?;
    }
    wordpress_optional_code_field(
        emitter,
        "Source-declared remediation",
        advisory.remediation.as_deref(),
    )?;
    emitter.end_record()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_endpoint(
    emitter: &mut WordPressPresentationEmitter<'_>,
    endpoint: Option<&WordPressVersionEndpointDocument>,
) -> Result<(), ReportError> {
    if let Some(endpoint) = endpoint {
        emitter.inline(WordPressPresentationInline::Code(&endpoint.declared))?;
        emitter.inline(WordPressPresentationInline::Literal(
            if endpoint.inclusive {
                " (inclusive)"
            } else {
                " (exclusive)"
            },
        ))
    } else {
        emitter.inline(WordPressPresentationInline::Code("unbounded/unknown"))
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_external_evaluation(
    emitter: &mut WordPressPresentationEmitter<'_>,
    external: &WordPressExternalReviewDocument,
    evaluation: &WordPressExternalEvaluationDocument,
) -> Result<(), ReportError> {
    emitter.begin_record()?;
    emitter.inline(WordPressPresentationInline::Code(
        &evaluation.key.upstream_id,
    ))?;
    emitter.inline(WordPressPresentationInline::Literal(" — "))?;
    emitter.inline(WordPressPresentationInline::Code(
        evaluation.key.component.kind,
    ))?;
    emitter.inline(WordPressPresentationInline::Literal(":"))?;
    emitter.inline(WordPressPresentationInline::Code(
        &evaluation.key.component.slug,
    ))?;
    emitter.inline(WordPressPresentationInline::Literal(" — "))?;
    emitter.inline(WordPressPresentationInline::Code(evaluation.applicability))?;
    emitter.end_record_title()?;
    wordpress_code_field(
        emitter,
        "Source namespace",
        &evaluation.key.source_namespace,
    )?;
    if let Some(source_component) = &evaluation.key.source_component {
        emitter.begin_field("Raw source component identity")?;
        emitter.inline(WordPressPresentationInline::Code(source_component.kind))?;
        emitter.inline(WordPressPresentationInline::Literal(":"))?;
        emitter.inline(WordPressPresentationInline::Code(&source_component.slug))?;
        emitter.end_field()?;
        wordpress_optional_code_field(emitter, "Identity mapping", evaluation.identity_mapping)?;
        if let Some(count) = evaluation.identity_collision_raw_count {
            wordpress_count_field(emitter, "Colliding raw source identities", count)?;
        }
    }
    wordpress_code_field(emitter, "Source title", &evaluation.title)?;
    wordpress_code_field(emitter, "Source component name", &evaluation.display_name)?;
    wordpress_bool_field(
        emitter,
        "Source informational classification",
        evaluation.informational,
    )?;
    wordpress_code_field(emitter, "Source description", &evaluation.description)?;
    wordpress_code_field(emitter, "Comparison policy", external.comparison_policy)?;
    if let Some(profile) = external.comparison_profile {
        wordpress_code_field(emitter, "Comparison profile", profile)?;
        wordpress_optional_code_field(emitter, "Policy selection", external.policy_selection)?;
        wordpress_optional_code_field(
            emitter,
            "Source comparison semantics assurance",
            external.source_semantics_assurance,
        )?;
    }
    wordpress_code_field(emitter, "Applicability", evaluation.applicability)?;
    wordpress_code_field(emitter, "Version relation", evaluation.version_relation)?;
    if external.comparison_profile.is_some() {
        wordpress_optional_code_field(
            emitter,
            "Version-relation reason",
            evaluation.version_relation_reason,
        )?;
    }
    wordpress_code_field(
        emitter,
        "Version evidence resolution",
        evaluation.version_evidence_resolution.status,
    )?;
    emitter.begin_field("Version evidence rows / distinct spellings")?;
    emitter.inline(WordPressPresentationInline::Count(
        evaluation.version_evidence_resolution.evidence_row_count,
    ))?;
    emitter.inline(WordPressPresentationInline::Literal(" / "))?;
    emitter.inline(WordPressPresentationInline::Count(
        evaluation
            .version_evidence_resolution
            .distinct_spelling_count,
    ))?;
    emitter.end_field()?;
    if external.comparison_profile.is_some() {
        wordpress_optional_code_field(
            emitter,
            "Semantic version resolution",
            evaluation.version_evidence_resolution.semantic_status,
        )?;
        wordpress_optional_code_field(
            emitter,
            "Semantic resolution reason",
            evaluation.version_evidence_resolution.semantic_reason,
        )?;
    }
    wordpress_code_field(emitter, "Component evidence", evaluation.component_evidence)?;
    wordpress_optional_code_field(emitter, "CVE", evaluation.cve.as_deref())?;
    wordpress_optional_code_field(
        emitter,
        "Source CVE reference",
        evaluation.cve_link.as_deref(),
    )?;
    if let Some(cwe) = &evaluation.cwe {
        emitter.begin_field("Source CWE metadata")?;
        emitter.inline(WordPressPresentationInline::Literal("CWE-"))?;
        emitter.inline(WordPressPresentationInline::Bytes(u64::from(cwe.id)))?;
        emitter.inline(WordPressPresentationInline::Literal(" / "))?;
        emitter.inline(WordPressPresentationInline::Code(&cwe.name))?;
        emitter.end_field()?;
        wordpress_code_field(emitter, "Source CWE description", &cwe.description)?;
    } else {
        wordpress_code_field(emitter, "Source CWE metadata", "not declared")?;
    }
    if let Some(cvss) = &evaluation.cvss {
        emitter.begin_field("Source-declared CVSS metadata")?;
        emitter.inline(WordPressPresentationInline::Code(&cvss.score))?;
        emitter.inline(WordPressPresentationInline::Literal(" / "))?;
        emitter.inline(WordPressPresentationInline::Code(cvss.rating))?;
        emitter.inline(WordPressPresentationInline::Literal(" / "))?;
        emitter.inline(WordPressPresentationInline::Code(&cvss.vector))?;
        emitter.end_field()?;
    } else {
        wordpress_code_field(emitter, "Source-declared CVSS metadata", "not declared")?;
    }
    wordpress_optional_code_field(
        emitter,
        "Source published date",
        evaluation.source_dates.published.as_deref(),
    )?;
    wordpress_optional_code_field(
        emitter,
        "Source updated date",
        evaluation.source_dates.updated.as_deref(),
    )?;
    write_wordpress_values(
        emitter,
        "Source bibliography",
        evaluation.references.iter().map(String::as_str),
        "none declared",
    )?;
    write_wordpress_values(
        emitter,
        "Source researchers",
        evaluation.researchers.iter().map(String::as_str),
        "none declared",
    )?;
    write_wordpress_values(
        emitter,
        "Source notice identifiers",
        evaluation.notice_ids.iter().map(String::as_str),
        "none declared",
    )?;
    if evaluation.affected_ranges.is_empty() {
        wordpress_code_field(emitter, "Source-declared affected ranges", "none declared")?;
    } else {
        emitter.begin_list_field("Source-declared affected ranges")?;
        for (index, range) in evaluation.affected_ranges.iter().enumerate() {
            emitter.begin_list_item()?;
            emitter.inline(WordPressPresentationInline::Code(&range.label))?;
            emitter.inline(WordPressPresentationInline::Literal(": "))?;
            emitter.inline(WordPressPresentationInline::Code(range.from_kind))?;
            emitter.inline(WordPressPresentationInline::Literal(" "))?;
            emitter.inline(WordPressPresentationInline::Code(&range.from_version))?;
            emitter.inline(WordPressPresentationInline::Literal(
                if range.from_inclusive {
                    " inclusive to "
                } else {
                    " exclusive to "
                },
            ))?;
            emitter.inline(WordPressPresentationInline::Code(range.to_kind))?;
            emitter.inline(WordPressPresentationInline::Literal(" "))?;
            emitter.inline(WordPressPresentationInline::Code(&range.to_version))?;
            emitter.inline(WordPressPresentationInline::Literal(
                if range.to_inclusive {
                    " inclusive"
                } else {
                    " exclusive"
                },
            ))?;
            if let Some(interpreted) = evaluation
                .range_evaluations
                .as_ref()
                .and_then(|ranges| ranges.get(index))
            {
                emitter.inline(WordPressPresentationInline::Literal("; Termivar relation "))?;
                emitter.inline(WordPressPresentationInline::Code(interpreted.relation))?;
                emitter.inline(WordPressPresentationInline::Literal(" ("))?;
                emitter.inline(WordPressPresentationInline::Code(interpreted.reason))?;
                emitter.inline(WordPressPresentationInline::Literal(")"))?;
            }
            emitter.end_list_item()?;
        }
        emitter.end_list_field()?;
    }
    wordpress_bool_field(emitter, "Source patched flag", evaluation.source_patched)?;
    write_wordpress_values(
        emitter,
        "Source-declared patched versions",
        evaluation
            .source_patched_versions
            .iter()
            .map(String::as_str),
        "none declared",
    )?;
    wordpress_code_field(
        emitter,
        "Source-declared remediation",
        &evaluation.source_remediation,
    )?;
    emitter.end_record()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_external_identity_limitation(
    emitter: &mut WordPressPresentationEmitter<'_>,
    limitation: &WordPressExternalIdentityLimitationDocument,
) -> Result<(), ReportError> {
    emitter.begin_record()?;
    emitter.inline(WordPressPresentationInline::Code(
        &limitation.key.upstream_id,
    ))?;
    emitter.inline(WordPressPresentationInline::Literal(" — "))?;
    emitter.inline(WordPressPresentationInline::Code(
        limitation.key.source_component.kind,
    ))?;
    emitter.inline(WordPressPresentationInline::Literal(":"))?;
    emitter.inline(WordPressPresentationInline::Code(
        &limitation.key.source_component.slug,
    ))?;
    emitter.inline(WordPressPresentationInline::Literal(" — "))?;
    emitter.inline(WordPressPresentationInline::Code(limitation.applicability))?;
    emitter.end_record_title()?;
    wordpress_code_field(emitter, "Source namespace", limitation.key.source_namespace)?;
    wordpress_code_field(
        emitter,
        "Raw source component identity",
        &format!(
            "{}:{}",
            limitation.key.source_component.kind, limitation.key.source_component.slug
        ),
    )?;
    wordpress_code_field(
        emitter,
        "Identity resolution",
        limitation.identity_resolution,
    )?;
    wordpress_code_field(emitter, "Source title", &limitation.title)?;
    wordpress_code_field(emitter, "Source component name", &limitation.display_name)?;
    wordpress_code_field(emitter, "Applicability", limitation.applicability)?;
    wordpress_code_field(emitter, "Version relation", limitation.version_relation)?;
    wordpress_code_field(
        emitter,
        "Version-relation reason",
        limitation.version_relation_reason,
    )?;
    write_wordpress_values(
        emitter,
        "Source bibliography",
        limitation.references.iter().map(String::as_str),
        "none declared",
    )?;
    write_wordpress_values(
        emitter,
        "Source notice identifiers",
        limitation.notice_ids.iter().map(String::as_str),
        "none declared",
    )?;
    if limitation.affected_ranges.is_empty() {
        wordpress_code_field(emitter, "Source-declared affected ranges", "none declared")?;
    } else {
        emitter.begin_list_field("Source-declared affected ranges")?;
        for (range, interpretation) in limitation
            .affected_ranges
            .iter()
            .zip(&limitation.range_evaluations)
        {
            emitter.begin_list_item()?;
            emitter.inline(WordPressPresentationInline::Code(&range.label))?;
            emitter.inline(WordPressPresentationInline::Literal(": "))?;
            emitter.inline(WordPressPresentationInline::Code(range.from_kind))?;
            emitter.inline(WordPressPresentationInline::Literal(" "))?;
            emitter.inline(WordPressPresentationInline::Code(&range.from_version))?;
            emitter.inline(WordPressPresentationInline::Literal(
                if range.from_inclusive {
                    " inclusive to "
                } else {
                    " exclusive to "
                },
            ))?;
            emitter.inline(WordPressPresentationInline::Code(range.to_kind))?;
            emitter.inline(WordPressPresentationInline::Literal(" "))?;
            emitter.inline(WordPressPresentationInline::Code(&range.to_version))?;
            emitter.inline(WordPressPresentationInline::Literal(
                if range.to_inclusive {
                    " inclusive"
                } else {
                    " exclusive"
                },
            ))?;
            emitter.inline(WordPressPresentationInline::Literal("; Termivar relation "))?;
            emitter.inline(WordPressPresentationInline::Code(interpretation.relation))?;
            emitter.inline(WordPressPresentationInline::Literal(" ("))?;
            emitter.inline(WordPressPresentationInline::Code(interpretation.reason))?;
            emitter.inline(WordPressPresentationInline::Literal(")"))?;
            emitter.end_list_item()?;
        }
        emitter.end_list_field()?;
    }
    wordpress_bool_field(emitter, "Source patched flag", limitation.source_patched)?;
    write_wordpress_values(
        emitter,
        "Source-declared patched versions",
        limitation
            .source_patched_versions
            .iter()
            .map(String::as_str),
        "none declared",
    )?;
    wordpress_code_field(
        emitter,
        "Source-declared remediation",
        &limitation.source_remediation,
    )?;
    emitter.end_record()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_code_field(
    emitter: &mut WordPressPresentationEmitter<'_>,
    label: &'static str,
    value: &str,
) -> Result<(), ReportError> {
    emitter.begin_field(label)?;
    emitter.inline(WordPressPresentationInline::Code(value))?;
    emitter.end_field()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_optional_code_field(
    emitter: &mut WordPressPresentationEmitter<'_>,
    label: &'static str,
    value: Option<&str>,
) -> Result<(), ReportError> {
    wordpress_code_field(emitter, label, value.unwrap_or("not declared"))
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_count_field(
    emitter: &mut WordPressPresentationEmitter<'_>,
    label: &'static str,
    value: usize,
) -> Result<(), ReportError> {
    emitter.begin_field(label)?;
    emitter.inline(WordPressPresentationInline::Count(value))?;
    emitter.end_field()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_bytes_field(
    emitter: &mut WordPressPresentationEmitter<'_>,
    label: &'static str,
    value: u64,
) -> Result<(), ReportError> {
    emitter.begin_field(label)?;
    emitter.inline(WordPressPresentationInline::Bytes(value))?;
    emitter.end_field()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_bool_field(
    emitter: &mut WordPressPresentationEmitter<'_>,
    label: &'static str,
    value: bool,
) -> Result<(), ReportError> {
    emitter.begin_field(label)?;
    emitter.inline(WordPressPresentationInline::Bool(value))?;
    emitter.end_field()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_wordpress_values<'a, I>(
    emitter: &mut WordPressPresentationEmitter<'_>,
    label: &'static str,
    values: I,
    empty: &'static str,
) -> Result<(), ReportError>
where
    I: IntoIterator<Item = &'a str>,
{
    let mut values = values.into_iter();
    let Some(first) = values.next() else {
        return wordpress_code_field(emitter, label, empty);
    };
    emitter.begin_list_field(label)?;
    emitter.begin_list_item()?;
    emitter.inline(WordPressPresentationInline::Code(first))?;
    emitter.end_list_item()?;
    for value in values {
        emitter.begin_list_item()?;
        emitter.inline(WordPressPresentationInline::Code(value))?;
        emitter.end_list_item()?;
    }
    emitter.end_list_field()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressPresentationEmitter<'_> {
    fn inline(&mut self, value: WordPressPresentationInline<'_>) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => match value {
                WordPressPresentationInline::Literal(value) => output.push_str(value),
                WordPressPresentationInline::Code(value) => {
                    output.push_str("<code>")?;
                    write_html_text(output, value)?;
                    output.push_str("</code>")
                },
                WordPressPresentationInline::Count(value) => {
                    output.push_fmt(format_args!("{value}"))
                },
                WordPressPresentationInline::Bytes(value) => {
                    output.push_fmt(format_args!("{value}"))
                },
                WordPressPresentationInline::Bool(value) => {
                    output.push_str(if value { "true" } else { "false" })
                },
            },
            Self::Markdown(output) => match value {
                WordPressPresentationInline::Literal(value) => output.push_str(value),
                WordPressPresentationInline::Code(value) => write_markdown_code_span(output, value),
                WordPressPresentationInline::Count(value) => {
                    output.push_fmt(format_args!("{value}"))
                },
                WordPressPresentationInline::Bytes(value) => {
                    output.push_fmt(format_args!("{value}"))
                },
                WordPressPresentationInline::Bool(value) => {
                    output.push_str(if value { "true" } else { "false" })
                },
            },
        }
    }

    fn heading(&mut self, title: &'static str) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => {
                output.push_str("<h3>")?;
                write_html_text(output, title)?;
                output.push_str("</h3>")
            },
            Self::Markdown(output) => {
                output.push_str("\n#### ")?;
                output.push_str(title)?;
                output.push_str("\n\n")
            },
        }
    }

    fn paragraph(&mut self, text: &'static str) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => {
                output.push_str("<p>")?;
                write_html_text(output, text)?;
                output.push_str("</p>")
            },
            Self::Markdown(output) => {
                output.push_str(text)?;
                output.push_str("\n\n")
            },
        }
    }

    fn note(&mut self, text: &'static str) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => {
                output.push_str("<p class=\"wp-note\">")?;
                write_html_text(output, text)?;
                output.push_str("</p>")
            },
            Self::Markdown(output) => {
                output.push_str("\n> ")?;
                output.push_str(text)?;
                output.push_str("\n\n")
            },
        }
    }

    fn overview(&mut self, cards: &[(&'static str, usize)]) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => {
                output.push_str("<div class=\"wp-summary\">")?;
                for (label, count) in cards {
                    output.push_str("<div class=\"wp-card\"><strong>")?;
                    output.push_fmt(format_args!("{count}"))?;
                    output.push_str("</strong><span>")?;
                    write_html_text(output, label)?;
                    output.push_str("</span></div>")?;
                }
                output.push_str("</div>")
            },
            Self::Markdown(output) => {
                output.push_str("### Overview\n\n")?;
                for (label, count) in cards {
                    output.push_fmt(format_args!("- {label}: `{count}`\n"))?;
                }
                output.push_char('\n')
            },
        }
    }

    fn begin_fields(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("<dl class=\"meta\">"),
            Self::Markdown(_) => Ok(()),
        }
    }

    fn end_fields(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("</dl>"),
            Self::Markdown(output) => output.push_char('\n'),
        }
    }

    fn begin_field(&mut self, label: &'static str) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => {
                output.push_str("<dt>")?;
                write_html_text(output, label)?;
                output.push_str("</dt><dd>")
            },
            Self::Markdown(output) => output.push_fmt(format_args!("- {label}: ")),
        }
    }

    fn end_field(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("</dd>"),
            Self::Markdown(output) => output.push_char('\n'),
        }
    }

    fn begin_list_field(&mut self, label: &'static str) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => {
                output.push_str("<dt>")?;
                write_html_text(output, label)?;
                output.push_str("</dt><dd><ul>")
            },
            Self::Markdown(output) => output.push_fmt(format_args!("- {label}:\n")),
        }
    }

    fn begin_list_item(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("<li>"),
            Self::Markdown(output) => output.push_str("  - "),
        }
    }

    fn end_list_item(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("</li>"),
            Self::Markdown(output) => output.push_char('\n'),
        }
    }

    fn end_list_field(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("</ul></dd>"),
            Self::Markdown(_) => Ok(()),
        }
    }

    fn begin_record(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("<details class=\"wp-detail\" open><summary>"),
            Self::Markdown(output) => output.push_str("#### "),
        }
    }

    fn end_record_title(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("</summary><dl>"),
            Self::Markdown(output) => output.push_str("\n\n"),
        }
    }

    fn end_record(&mut self) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => output.push_str("</dl></details>"),
            Self::Markdown(output) => output.push_char('\n'),
        }
    }

    fn empty(&mut self, text: &'static str) -> Result<(), ReportError> {
        match self {
            Self::Html(output) => {
                output.push_str("<p class=\"empty\">")?;
                write_html_text(output, text)?;
                output.push_str("</p>")
            },
            Self::Markdown(output) => {
                output.push_str(text)?;
                output.push_char('\n')
            },
        }
    }
}
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_html_wordpress_external_attribution(
    output: &mut RenderBuffer,
    audit: &AssessmentWordPressAuditDocument,
) -> Result<(), ReportError> {
    let Some(external) = &audit.external_review else {
        return Ok(());
    };
    output.push_str("<h3>External source attribution</h3><ul>")?;
    for evaluation in &external.evaluations {
        let Some(reference) = &evaluation.record_reference else {
            continue;
        };
        output.push_str("<li><code>")?;
        write_html_text(output, &evaluation.key.upstream_id)?;
        output.push_str("</code> <a rel=\"noreferrer noopener\" href=\"")?;
        write_html_text(output, reference)?;
        output.push_str("\">Selected source reference</a></li>")?;
    }
    output.push_str("</ul><h3>Rights notices</h3><ul>")?;
    for notice in &external.notices {
        output.push_str("<li><strong>Party:</strong> <code>")?;
        write_html_text(output, &notice.party)?;
        output.push_str("</code><br><strong>Message:</strong> <code>")?;
        write_html_text(output, &notice.message)?;
        output.push_str("</code><br><strong>Notice:</strong> <code>")?;
        write_html_text(output, &notice.notice)?;
        output.push_str("</code><br><strong>License:</strong> <code>")?;
        write_html_text(output, &notice.license)?;
        output.push_str("</code>")?;
        if is_strict_https_reference(&notice.license_url) {
            output.push_str(" <a rel=\"noreferrer noopener\" href=\"")?;
            write_html_text(output, &notice.license_url)?;
            output.push_str("\">License terms</a>")?;
        } else {
            output.push_str("<br><strong>License URL:</strong> <code>")?;
            write_html_text(output, &notice.license_url)?;
            output.push_str("</code>")?;
        }
        output.push_str("</li>")?;
    }
    output.push_str("</ul>")
}

#[cfg(feature = "scanning")]
fn write_markdown_actionable_code_field(
    output: &mut RenderBuffer,
    label: &'static str,
    value: &str,
) -> Result<(), ReportError> {
    output.push_fmt(format_args!("- {label}: "))?;
    write_markdown_code_span(output, value)?;
    output.push_char('\n')
}

#[cfg(feature = "scanning")]
fn write_markdown_actionable_text_field(
    output: &mut RenderBuffer,
    label: &'static str,
    value: &str,
) -> Result<(), ReportError> {
    output.push_fmt(format_args!("- {label}: "))?;
    write_markdown_code_span(output, value)?;
    output.push_char('\n')
}

#[cfg(feature = "scanning")]
fn write_assessment_decision_overview_markdown(
    output: &mut RenderBuffer,
    document: &AssessmentDocument<'_>,
) -> Result<(), ReportError> {
    let overview = AssessmentDecisionOverview::from_document(document)?;
    output.push_str(
        "\n## Decision overview\n\nThese counts describe typed assessment items, not a count of confirmed vulnerabilities. Unassigned or unknown severity is not low or zero severity.\n\n",
    )?;
    output.push_fmt(format_args!(
        "- Verifier-bound confirmed items: `{}`\n- Needs-review candidates: `{}`\n- Informational observations: `{}`\n\n",
        overview.confirmed, overview.needs_review, overview.informational
    ))?;
    output.push_str("**Next decision:** ")?;
    output.push_str(overview.priority_statement())?;
    output.push_char('\n')
}

#[cfg(feature = "scanning")]
fn write_assessment_actionable_items_markdown(
    output: &mut RenderBuffer,
    document: &AssessmentDocument<'_>,
) -> Result<(), ReportError> {
    output.push_str("\n## Actionable items\n\n")?;
    if document.items.is_empty() {
        output.push_str(
            "No assessment items were projected. This is not evidence that the application is secure or that assessment coverage was complete.\n",
        )?;
        return Ok(());
    }
    let collection_context = assessment_item_collection_context(document);
    let mut index = 0usize;
    for disposition in ACTIONABLE_ITEM_DISPOSITION_ORDER {
        for item in document
            .items
            .iter()
            .filter(|item| item.disposition == disposition)
        {
            index = index.checked_add(1).ok_or(ReportError::Serialization)?;
            output.push_fmt(format_args!("### Actionable item {index}: "))?;
            write_markdown_code_span(output, item.title)?;
            output.push_str("\n\n")?;
            write_markdown_actionable_code_field(output, "Disposition", item.disposition)?;
            write_markdown_actionable_text_field(
                output,
                "What was observed",
                item.redacted_summary,
            )?;
            write_markdown_actionable_code_field(
                output,
                "Opaque assessment subject reference (not proof of affectedness or location)",
                &item.subject_reference,
            )?;
            write_markdown_actionable_code_field(
                output,
                "Assessment target kind (resource location withheld)",
                item.presentation_target,
            )?;
            write_markdown_actionable_text_field(
                output,
                "Collection and principal context",
                collection_context,
            )?;
            write_markdown_actionable_text_field(
                output,
                "Interpretation",
                assessment_item_interpretation(item)?,
            )?;
            write_markdown_actionable_text_field(
                output,
                "What was not established",
                assessment_item_unestablished(item)?,
            )?;
            write_markdown_actionable_text_field(
                output,
                "Recommended action (not a verified fix)",
                item.remediation.summary,
            )?;
            write_markdown_actionable_text_field(
                output,
                "Safe verification guidance",
                assessment_item_verification_guidance(item)?,
            )?;
            write_markdown_actionable_code_field(
                output,
                "Severity",
                item.severity.unwrap_or("not assigned"),
            )?;
            if item.severity.is_none() {
                output.push_str("  Unassigned severity does not mean low or zero.\n")?;
            }
            write_markdown_actionable_code_field(
                output,
                "Confidence",
                &format!("{} ppm", item.confidence_ppm),
            )?;
            output.push_str(
                "  Confidence is evidence-specific; it is not CVSS, impact, or exploit probability.\n",
            )?;
            write_markdown_actionable_code_field(output, "Claim basis", item.claim_basis)?;
            write_markdown_actionable_code_field(output, "Item schema", item.schema)?;
            write_markdown_actionable_code_field(output, "Capability", item.capability_id)?;
            write_markdown_actionable_code_field(output, "Category", item.category)?;
            write_markdown_actionable_code_field(
                output,
                "CWE",
                item.cwe.unwrap_or("not applicable"),
            )?;
            write_markdown_actionable_code_field(output, "Item fingerprint", item.fingerprint)?;
            write_markdown_actionable_code_field(
                output,
                "Evidence reference count",
                &item.evidence_count.to_string(),
            )?;
            write_markdown_actionable_code_field(output, "Recommendation ID", item.remediation.id)?;
            write_markdown_actionable_code_field(
                output,
                "Direct evidence references",
                &assessment_reference_list(&item.evidence_references),
            )?;
            write_markdown_actionable_code_field(
                output,
                "Control evidence references",
                &assessment_reference_list(&item.control_evidence_references),
            )?;
            write_markdown_actionable_code_field(
                output,
                "Candidate evidence references",
                &assessment_reference_list(&item.candidate_evidence_references),
            )?;
            write_markdown_actionable_code_field(
                output,
                "Verifier case reference",
                item.case_reference.as_deref().unwrap_or("not applicable"),
            )?;
            write_markdown_actionable_code_field(
                output,
                "Verifier outcome reference",
                item.outcome_reference
                    .as_deref()
                    .unwrap_or("not applicable"),
            )?;
            write_markdown_actionable_code_field(
                output,
                "Verification stage",
                item.verification_stage.unwrap_or("not applicable"),
            )?;
            output.push_char('\n')?;
        }
    }
    if index != document.items.len() {
        return Err(ReportError::Serialization);
    }
    Ok(())
}

#[cfg(feature = "scanning")]
fn render_assessment_markdown(
    document: &AssessmentDocument<'_>,
    limit: usize,
) -> Result<String, ReportError> {
    let mut output = RenderBuffer::new(limit);
    output.push_str("# Termivar assessment report\n\n")?;
    write_assessment_decision_overview_markdown(&mut output, document)?;
    write_assessment_actionable_items_markdown(&mut output, document)?;
    output.push_str(
        "\n## Technical audit appendix\n\nAvailable report metadata and selected capability/source audit details follow, including their local accounting when present. These records preserve stated context and limitations; report integrity does not establish target truth or remediation.\n\n### Report metadata\n\n",
    )?;
    for (label, value) in document.metadata() {
        output.push_fmt(format_args!("- {label}: "))?;
        write_markdown_code_span(&mut output, &value)?;
        output.push_char('\n')?;
    }
    #[cfg(feature = "supplied-session-review")]
    if let Some(audit) = &document.supplied_session {
        output.push_str("\n### Supplied session assessment audit\n\n")?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Health checkpoints\n\n")?;
        for checkpoint in &audit.checkpoints {
            output.push_str("- ")?;
            write_markdown_code_span(
                &mut output,
                &checkpoint
                    .human_summary(audit.schema == SUPPLIED_SESSION_OAUTH_REFRESH_AUDIT_SCHEMA),
            )?;
            output.push_char('\n')?;
        }
        if let Some(health) = audit
            .oauth_refresh
            .as_ref()
            .and_then(|refresh| refresh.health())
        {
            output.push_str("\n#### OAuth renewal health checkpoint\n\n- ")?;
            let health = AssessmentSuppliedSessionCheckpointDocument::from_checkpoint(health, true);
            write_markdown_code_span(&mut output, &health.human_summary(true))?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Protected resources\n\n")?;
        for resource in &audit.resources {
            let status = resource
                .status
                .map_or_else(|| "not_available".to_owned(), |status| status.to_string());
            let evidence_reference = resource
                .evidence_reference
                .as_deref()
                .unwrap_or("not_available");
            output.push_str("- ")?;
            write_markdown_code_span(
                &mut output,
                &format!(
                    "sequence={};resource_reference={};evidence_reference={};outcome={};status={};response_bytes={};epoch={}",
                    resource.sequence,
                    resource.resource_reference,
                    evidence_reference,
                    resource.outcome,
                    status,
                    resource.response_bytes,
                    resource.epoch,
                ),
            )?;
            output.push_char('\n')?;
        }
    }
    #[cfg(feature = "authorization-review")]
    if let Some(audit) = &document.authorization_review {
        output.push_str("\n### Resource authorization review audit\n\n")?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
    }
    #[cfg(feature = "websocket-review")]
    if let Some(audit) = &document.websocket_review {
        output.push_str("\n### WebSocket protocol review audit\n\n")?;
        if audit.has_supplied_session_context() {
            output.push_str(
                "This audit separates bounded protocol-exchange completion from supplied-session health qualification. Healthy startup and terminal checkpoints qualify only the declared observation context; they do not establish continuous authentication, authenticated identity, authorization, vulnerability, impact, or remediation. It retains no credential, payload, raw URL, path, query, subprotocol token, body-derived mismatch reference, or backend error. Physical continuation-frame counts are unavailable. Transport bytes are raw socket bytes including the HTTP Upgrade and WebSocket framing; for WSS they are encrypted TLS records, not application bytes.\n\n",
            )?;
        } else {
            output.push_str(
                "This audit describes one bounded, anonymous, operator-configured HTTP/1 Upgrade exchange. It is not a finding and provides no remediation inference. It retains no payload, raw URL, path, query, subprotocol token, body-derived mismatch reference, or backend error. Physical continuation-frame counts are unavailable. Transport bytes are raw socket bytes including the HTTP Upgrade and WebSocket framing; for WSS they are encrypted TLS records, not application bytes.\n\n",
            )?;
        }
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Configured exchange audit\n\n")?;
        for message in &audit.messages {
            output.push_str("- ")?;
            write_markdown_code_span(
                &mut output,
                &format!(
                    "message_reference={};expected_response_reference={};outbound_length={};inbound_length={};status={}",
                    message.message_reference,
                    message.expected_response_reference,
                    message.outbound_length,
                    message
                        .inbound_length
                        .map_or_else(|| "not_available".to_owned(), |length| length.to_string()),
                    message.status,
                ),
            )?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Interpretation limits\n\n")?;
        for limit in &audit.claim_limits {
            output.push_str("- ")?;
            write_markdown_code_span(&mut output, limit)?;
            output.push_char('\n')?;
        }
    }
    #[cfg(feature = "xml-external-entity-review")]
    if let Some(audit) = &document.xml_external_entity_review {
        output.push_str(
            "\n### Controlled XML external-entity review audit\n\nThis audit records a bounded callback-control review without retaining endpoint URLs or paths, provider origins, callback values, XML bodies, system literals, tokens, response bodies, or raw errors. Repeated candidate and replay interactions remain review-level evidence: they do not confirm XXE, identify a parser, prove file read, data exfiltration, internal-network access, semantic effect, or impact.\n\n",
        )?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Claim limits\n\n")?;
        for limit in &audit.claim_limits {
            output.push_str("- ")?;
            write_markdown_code_span(&mut output, limit)?;
            output.push_char('\n')?;
        }
    }
    #[cfg(feature = "template-evaluation-review")]
    if let Some(audit) = &document.template_evaluation_review {
        output.push_str(
            "\n### Template-evaluation review audit\n\nThis audit records bounded, benign primary/replay differential semantics without retaining expressions, query values, URLs, response bodies, template-engine errors, or raw transport errors. Candidate-specific evaluation does not establish a template-engine identity, operating-system execution, file access, outbound interaction, vulnerability confirmation, or impact.\n\n",
        )?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Claim limits\n\n")?;
        for limit in &audit.claim_limits {
            output.push_str("- ")?;
            write_markdown_code_span(&mut output, limit)?;
            output.push_char('\n')?;
        }
    }
    #[cfg(feature = "openapi-review")]
    if let Some(audit) = &document.openapi_review {
        output.push_str("\n### OpenAPI review audit\n\n")?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
    }
    #[cfg(feature = "rest-review")]
    if let Some(audit) = &document.rest_review {
        output.push_str("\n### REST read-only review audit\n\n")?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
    }
    #[cfg(feature = "secret-exposure-review")]
    if let Some(audit) = &document.secret_exposure_review {
        output.push_str(
            "\n### Passive response secret-exposure review audit\n\nDetector observations are redacted response-content classifications. They do not establish source authenticity, secret validity, provider acceptance, exploitability, or impact.\n\n",
        )?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Response outcomes\n\n")?;
        for outcome in &audit.outcomes {
            output.push_str("- ")?;
            write_markdown_code_span(
                &mut output,
                &format!("outcome={};count={}", outcome.outcome, outcome.count),
            )?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Redacted observations\n\n")?;
        for observation in &audit.observations {
            output.push_str("- ")?;
            write_markdown_code_span(
                &mut output,
                &format!(
                    "detector_class={};capability_id={};occurrence_count={};evidence_reference={}",
                    observation.detector_class,
                    observation.capability_id,
                    observation.occurrence_count,
                    observation.evidence_references[0],
                ),
            )?;
            output.push_char('\n')?;
        }
    }
    #[cfg(feature = "tls-observation")]
    if let Some(audit) = &document.tls_observation {
        output.push_str(
            "\n### Existing-connection TLS observation audit\n\nThis passive view describes leaf certificates exposed by successful existing HTTPS responses under the assessment's exact-origin authority. It does not attribute a certificate to a request purpose or principal. Validity status is relative to the reported local system-clock instant, whose accuracy was not independently verified. One successful connection does not enumerate server protocol or cipher support. Negotiated protocol, ALPN, cipher suite, full chain, connection reuse, session resumption, and handshake kind are unavailable from the current backend; revocation was not checked.\n\n",
        )?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Leaf certificate observations\n\n")?;
        for observation in &audit.observations {
            output.push_str("- ")?;
            write_markdown_code_span(
                &mut output,
                &format!(
                    "sha256={};byte_length={};not_before={};not_after={};observed_at={};dns_sans={};ip_sans={};other_sans={};san_count_truncated={};time_status={};response_occurrences={};standard_transport_validation_succeeded={}",
                    observation.leaf_certificate_sha256,
                    observation.leaf_certificate_byte_length,
                    observation.not_before_epoch_seconds,
                    observation.not_after_epoch_seconds,
                    observation.observed_at_epoch_seconds,
                    observation.dns_san_count,
                    observation.ip_san_count,
                    observation.other_san_count,
                    observation.san_count_truncated,
                    observation.certificate_time_status,
                    observation.response_occurrence_count,
                    observation.standard_transport_validation_succeeded,
                ),
            )?;
            output.push_char('\n')?;
        }
        output.push_str("\nCertificate names and DER bytes are not retained in this report. A digest identifies observed bytes; it is not source authentication. Active negotiation, chain enumeration, revocation retrieval, exploit execution, and impact validation were not performed.\n")?;
    }
    #[cfg(feature = "tls-negotiation-review")]
    if let Some(audit) = &document.tls_negotiation_review {
        output.push_str(
            "\n### Active TLS negotiation review audit\n\nThis explicitly selected, finite matrix opened at most two sequential credential-free TLS connections to the exact authorized HTTPS host, SNI, and port. It sent no HTTP or application data. Negotiation establishes compatibility only for a successful offered profile; failure does not establish server non-support, and the three legacy rows were not tested because the client backend does not implement them.\n\n",
        )?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Fixed negotiation matrix\n\n")?;
        for cell in &audit.capability_observations {
            output.push_str("- ")?;
            write_markdown_code_span(
                &mut output,
                &format!(
                    "cell={};offer={};backend={};dispatch={};outcome={};support={};transport_validation={};negotiated_protocol={};negotiated_cipher_suite={};ingress_tls_bytes={};egress_tls_bytes={}",
                    cell.cell_id,
                    cell.offered_protocol,
                    cell.client_backend,
                    cell.dispatch_status,
                    cell.outcome,
                    cell.support,
                    cell.transport_validation,
                    cell.negotiated_protocol.unwrap_or("none"),
                    cell.negotiated_cipher_suite.unwrap_or("none"),
                    cell.accounted_ingress_tls_bytes,
                    cell.observed_egress_tls_bytes,
                ),
            )?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Claim limits\n\n")?;
        for limit in &audit.claim_limits {
            output.push_str("- ")?;
            write_markdown_code_span(&mut output, limit)?;
            output.push_char('\n')?;
        }
        output.push_str("\nThe configured trust validation is not source authentication. Revocation, certificate-transparency, AIA, CRL, and OCSP retrieval, vulnerability confirmation, exploit execution, impact validation, and remediation verification were not performed.\n")?;
    }
    #[cfg(feature = "jwt-policy-review")]
    if let Some(audit) = &document.jwt_policy_review {
        #[cfg(feature = "jwt-target-acceptance-review")]
        if audit.target_acceptance.is_some() {
            output.push_str("\n### JWT policy and target-control review audit\n\nParsing, local policy consistency, local signature verification, and bounded target behavior are separate states. This value-free audit retains no token, claim value, key material, selected marker name, or raw resource URL. Target controls remain review-level and establish neither a general authentication bypass nor authorization impact.\n\n")?;
        } else {
            output.push_str("\n### Local JWT policy review audit\n\nParsing, local policy consistency, signature verification against the explicitly supplied local public key, and target acceptance are separate states. This value-free audit retains no token, claim value, or key material. It performed no target request, remote-key retrieval, or token forwarding; target acceptance and source authentication are not established.\n\n")?;
        }
        #[cfg(not(feature = "jwt-target-acceptance-review"))]
        output.push_str("\n### Local JWT policy review audit\n\nParsing, local policy consistency, signature verification against the explicitly supplied local public key, and target acceptance are separate states. This value-free audit retains no token, claim value, or key material. It performed no target request, remote-key retrieval, or token forwarding; target acceptance and source authentication are not established.\n\n")?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Value-free policy violations\n\n")?;
        if audit.policy_violations.is_empty() {
            output.push_str("- `none`\n")?;
        }
        for violation in &audit.policy_violations {
            output.push_str("- ")?;
            let row = violation.ordinal.map_or_else(
                || format!("kind={}", violation.kind),
                |ordinal| format!("kind={};ordinal={ordinal}", violation.kind),
            );
            write_markdown_code_span(&mut output, &row)?;
            output.push_char('\n')?;
        }
        #[cfg(feature = "jwt-target-acceptance-review")]
        if let Some(target) = &audit.target_acceptance {
            output.push_str("\n#### Target acceptance controls\n\n")?;
            if target.legs.is_empty() {
                output.push_str("- `no target leg dispatched`\n")?;
            }
            for leg in &target.legs {
                output.push_str("- ")?;
                write_markdown_code_span(
                    &mut output,
                    &format!(
                        "role={};stage={};activity={};dispatch={};commit={};response={};marker={};retained_bytes={};accounted_transport_bytes={}",
                        leg.role,
                        leg.stage,
                        leg.activity,
                        leg.dispatch_status,
                        leg.commit_status,
                        leg.response_status,
                        leg.marker_status,
                        leg.retained_response_bytes,
                        leg.accounted_transport_response_bytes,
                    ),
                )?;
                output.push_char('\n')?;
            }
            output.push_char('\n')?;
            for limitation in target.interpretation_limits {
                output.push_str("- ")?;
                output.push_str(limitation)?;
                output.push_char('\n')?;
            }
        }
    }
    #[cfg(feature = "control-reference-mapping")]
    if let Some(audit) = &document.control_reference_mapping {
        output.push_str(
            "\n### Versioned control-reference mapping audit\n\nThis deterministic offline mapping relates eligible assessment evidence to a finite, versioned reference catalogue. It does not assess a control, determine compliance or legal noncompliance, certify an organization, authenticate a source, or turn the absence of a finding into evidence that a control is fulfilled.\n\n",
        )?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Reference sources\n\n")?;
        for source in &audit.sources {
            output.push_str("- ")?;
            write_markdown_code_span(
                &mut output,
                &format!(
                    "source_id={};framework_id={};edition={};revision_or_amendment={};authority_kind={};mapping_availability={};rights_basis={};source_verified_at={};source_url={}",
                    source.source_id,
                    source.framework_id,
                    source.edition,
                    source.revision_or_amendment.unwrap_or("not_applicable"),
                    source.authority_kind,
                    source.mapping_availability,
                    source.rights_basis,
                    source.source_verified_at,
                    source.source_url,
                ),
            )?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Evidence-to-reference relationships\n\n")?;
        if audit.relationships.is_empty() {
            output.push_str("- `no exact mapping in the selected catalogue`\n")?;
        }
        for relationship in &audit.relationships {
            let cwe = relationship.cwe.as_deref().unwrap_or("not_available");
            for reference in &relationship.references {
                output.push_str("- ")?;
                write_markdown_code_span(
                    &mut output,
                    &format!(
                        "item_fingerprint={};capability_id={};cwe={};item_basis={};rule_id={};source_id={};edition={};control_reference={};control_title={};mapping_basis={};applicability={};applicability_condition={};assurance={};rationale={}",
                        relationship.item_fingerprint,
                        relationship.capability_id,
                        cwe,
                        relationship.item_basis,
                        reference.rule_id,
                        reference.source_id,
                        reference.edition,
                        reference.control_reference,
                        reference.control_title.unwrap_or("not_available"),
                        reference.mapping_basis,
                        reference.applicability,
                        reference.applicability_condition,
                        reference.assurance,
                        reference.original_mapping_rationale,
                    ),
                )?;
                output.push_char('\n')?;
            }
        }
        output.push_str("\nFramework identifiers and short titles are source-qualified references. Rights-deferred sources are bibliographic context only, and KVKK material is relevant technical context rather than legal advice or a compliance conclusion. No target or provider request was performed for this mapping.\n")?;
    }
    #[cfg(feature = "recon-snapshot-import")]
    if let Some(audit) = &document.recon_snapshot_import {
        output.push_str("\n### Offline reconnaissance snapshot import\n\nImported names, addresses, product hints, and reputation labels are source-qualified hypotheses only. The input digest identifies supplied bytes; it does not authenticate a source, establish asset ownership, authorize scanning, prove current reachability, or create a finding.\n\n")?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Declared sources\n\n")?;
        for source in &audit.sources {
            output.push_str("- ")?;
            write_markdown_code_span(&mut output, &source.presentation())?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Source-qualified hypotheses\n\n")?;
        for record in &audit.records {
            output.push_str("- ")?;
            write_markdown_code_span(&mut output, &record.presentation())?;
            output.push_char('\n')?;
        }
        output.push_str("\nThis import performed no target request, provider request, archive processing, or decompression. It did not add assessment subjects or items.\n")?;
    }
    #[cfg(feature = "recon-ct-provider")]
    if let Some(audit) = &document.recon_certspotter {
        output.push_str("\n### Cert Spotter reconnaissance provider audit\n\nReturned certificate-transparency names are source-qualified hypotheses only. They are not findings and do not establish scan authority, source authentication, ownership, or currentness.\n\n")?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        output.push_str("\n#### Source-qualified hypotheses\n\n")?;
        if audit.hypotheses.is_empty() {
            output.push_str("- `none retained`\n")?;
        }
        for hypothesis in &audit.hypotheses {
            output.push_str("- ")?;
            write_markdown_code_span(&mut output, &hypothesis.presentation())?;
            output.push_char('\n')?;
        }
        output.push_str("\nThe fixed claim limits apply to the collection and every displayed hypothesis. Provider transport and bounded collection do not authenticate the provider as an asset owner or authorize contact with any returned name.\n")?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(audit) = &document.wordpress_review {
        output.push_str("\n### WordPress evidence review audit\n\n")?;
        for (label, value) in audit.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        write_wordpress_presentation(
            &mut WordPressPresentationEmitter::Markdown(&mut output),
            audit,
        )?;
        write_markdown_wordpress_external_attribution(&mut output, audit)?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(fingerprints) = &document.wordpress_asset_fingerprints {
        output.push_str("\n### WordPress observed asset fingerprint candidates\n\n")?;
        for (label, value) in fingerprints.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        write_wordpress_asset_fingerprint_presentation(
            &mut WordPressPresentationEmitter::Markdown(&mut output),
            fingerprints,
        )?;
    }
    #[cfg(feature = "wordpress-review")]
    if let Some(discovery) = &document.wordpress_discovery {
        output.push_str("\n### WordPress public metadata discovery audit\n\n")?;
        for (label, value) in discovery.metadata() {
            output.push_fmt(format_args!("- {label}: "))?;
            write_markdown_code_span(&mut output, &value)?;
            output.push_char('\n')?;
        }
        write_wordpress_discovery_presentation(
            &mut WordPressPresentationEmitter::Markdown(&mut output),
            discovery,
        )?;
    }
    Ok(output.finish())
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn write_markdown_wordpress_external_attribution(
    output: &mut RenderBuffer,
    audit: &AssessmentWordPressAuditDocument,
) -> Result<(), ReportError> {
    let Some(external) = &audit.external_review else {
        return Ok(());
    };
    output.push_str("\n#### External source attribution\n\n")?;
    for evaluation in &external.evaluations {
        let Some(reference) = &evaluation.record_reference else {
            continue;
        };
        output.push_str("- Record ")?;
        write_markdown_code_span(output, &evaluation.key.upstream_id)?;
        output.push_str(": [Selected source reference](<")?;
        output.push_str(reference)?;
        output.push_str(">)\n")?;
    }
    output.push_str("\n##### Rights notices\n\n")?;
    for notice in &external.notices {
        output.push_str("- Party: ")?;
        write_markdown_code_span(output, &notice.party)?;
        output.push_str("; message: ")?;
        write_markdown_code_span(output, &notice.message)?;
        output.push_str("; notice: ")?;
        write_markdown_code_span(output, &notice.notice)?;
        output.push_str("; license: ")?;
        write_markdown_code_span(output, &notice.license)?;
        if is_strict_https_reference(&notice.license_url) {
            output.push_str("; [License terms](<")?;
            output.push_str(&notice.license_url)?;
            output.push_str(">)")?;
        } else {
            output.push_str("; license URL: ")?;
            write_markdown_code_span(output, &notice.license_url)?;
        }
        output.push_char('\n')?;
    }
    Ok(())
}

#[cfg(feature = "scanning")]
#[derive(Serialize)]
struct AssessmentDocument<'a> {
    schema: &'static str,
    source_schema: &'a str,
    run_schema: &'a str,
    profile_schema: &'a str,
    profile: &'a str,
    status: &'static str,
    subject_count: u64,
    item_count: u64,
    #[cfg(feature = "supplied-session-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    supplied_session: Option<AssessmentSuppliedSessionAuditDocument>,
    #[cfg(feature = "authorization-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    authorization_review: Option<AssessmentAuthorizationAuditDocument>,
    #[cfg(feature = "websocket-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    websocket_review: Option<AssessmentWebSocketReviewAuditDocument>,
    #[cfg(feature = "xml-external-entity-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    xml_external_entity_review: Option<AssessmentXmlExternalEntityReviewAuditDocument>,
    #[cfg(feature = "template-evaluation-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    template_evaluation_review: Option<AssessmentTemplateEvaluationReviewAuditDocument>,
    #[cfg(feature = "openapi-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    openapi_review: Option<AssessmentOpenApiAuditDocument>,
    #[cfg(feature = "rest-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    rest_review: Option<AssessmentRestAuditDocument>,
    #[cfg(feature = "secret-exposure-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    secret_exposure_review: Option<AssessmentSecretExposureAuditDocument>,
    #[cfg(feature = "tls-observation")]
    #[serde(skip_serializing_if = "Option::is_none")]
    tls_observation: Option<AssessmentTlsObservationAuditDocument>,
    #[cfg(feature = "tls-negotiation-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    tls_negotiation_review: Option<AssessmentTlsNegotiationReviewAuditDocument>,
    #[cfg(feature = "jwt-policy-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    jwt_policy_review: Option<AssessmentJwtPolicyReviewAuditDocument>,
    #[cfg(feature = "control-reference-mapping")]
    #[serde(skip_serializing_if = "Option::is_none")]
    control_reference_mapping: Option<AssessmentControlReferenceMappingAuditDocument>,
    #[cfg(feature = "recon-snapshot-import")]
    #[serde(skip_serializing_if = "Option::is_none")]
    recon_snapshot_import: Option<AssessmentReconSnapshotImportAuditDocument>,
    #[cfg(feature = "recon-ct-provider")]
    #[serde(skip_serializing_if = "Option::is_none")]
    recon_certspotter: Option<AssessmentReconCertSpotterAuditDocument>,
    #[cfg(feature = "wordpress-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    wordpress_review: Option<AssessmentWordPressAuditDocument>,
    #[cfg(feature = "wordpress-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    wordpress_discovery: Option<AssessmentWordPressDiscoveryAuditDocument>,
    #[cfg(feature = "wordpress-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    wordpress_asset_fingerprints: Option<AssessmentWordPressAssetFingerprintAuditDocument>,
    items: Vec<AssessmentItemDocument<'a>>,
}

#[cfg(feature = "scanning")]
impl<'a> AssessmentDocument<'a> {
    fn from_report(report: &'a AssessmentRunReport) -> Result<Self, ReportError> {
        let items = report
            .items()
            .iter()
            .map(AssessmentItemDocument::from_item)
            .collect::<Result<Vec<_>, _>>()?;
        #[cfg(feature = "wordpress-review")]
        let wordpress_discovery_evidence_references = report
            .wordpress_review_audit()
            .and_then(WebAssessmentWordPressAudit::discovery)
            .into_iter()
            .flat_map(|discovery| {
                discovery
                    .page_scope()
                    .into_iter()
                    .flat_map(|pages| pages.pages())
                    .flat_map(|page| page.evidence_ids())
                    .chain(
                        discovery
                            .supplied_session_pages()
                            .into_iter()
                            .flat_map(|pages| pages.pages())
                            .flat_map(|page| page.evidence_ids()),
                    )
                    .chain(
                        discovery
                            .sources()
                            .iter()
                            .flat_map(|source| source.evidence_ids()),
                    )
            })
            .map(|evidence_id| {
                report
                    .evidence_reference_for(evidence_id)
                    .map(|reference| reference.to_string())
                    .ok_or(ReportError::Serialization)
            })
            .collect::<Result<Vec<_>, _>>()?;
        #[cfg(feature = "wordpress-review")]
        let fingerprint_evidence_references = report
            .wordpress_review_audit()
            .and_then(WebAssessmentWordPressAudit::asset_fingerprints)
            .into_iter()
            .flat_map(WordPressAssetFingerprintExecution::resources)
            .flat_map(|resource| resource.evidence_ids())
            .map(|evidence_id| {
                report
                    .evidence_reference_for(evidence_id)
                    .map(|reference| reference.to_string())
                    .ok_or(ReportError::Serialization)
            })
            .collect::<Result<Vec<_>, _>>()?;
        #[cfg(feature = "wordpress-review")]
        let wordpress_discovery = {
            match report.wordpress_review_audit() {
                Some(audit) => AssessmentWordPressDiscoveryAuditDocument::from_wordpress_audit(
                    audit,
                    &wordpress_discovery_evidence_references,
                )?,
                None => None,
            }
        };
        #[cfg(feature = "wordpress-review")]
        let wordpress_asset_fingerprints = report
            .wordpress_review_audit()
            .and_then(WebAssessmentWordPressAudit::asset_fingerprints)
            .map(|execution| {
                AssessmentWordPressAssetFingerprintAuditDocument::from_execution(
                    execution,
                    &fingerprint_evidence_references,
                )
            })
            .transpose()?;
        #[cfg(feature = "tls-observation")]
        let tls_observation = report
            .tls_observation_audit()
            .map(|audit| {
                let assessment_request_count = report
                    .run_report()
                    .accounting()
                    .requests()
                    .consumed()
                    .ok_or(ReportError::Serialization)?;
                AssessmentTlsObservationAuditDocument::from_audit(audit, assessment_request_count)
            })
            .transpose()?;
        Ok(Self {
            schema: ASSESSMENT_REPORT_DOCUMENT_SCHEMA,
            source_schema: report.schema(),
            run_schema: report.run_report().schema(),
            profile_schema: report.profile().schema(),
            profile: report.profile().profile().id(),
            status: run_status_token(report.run_report().status()),
            subject_count: u64::try_from(report.subject_count())
                .map_err(|_| ReportError::Serialization)?,
            item_count: u64::try_from(report.item_count())
                .map_err(|_| ReportError::Serialization)?,
            #[cfg(feature = "supplied-session-review")]
            supplied_session: report
                .supplied_session_audit()
                .map(AssessmentSuppliedSessionAuditDocument::from_audit)
                .transpose()?,
            #[cfg(feature = "authorization-review")]
            authorization_review: report
                .authorization_review_audit()
                .map(AssessmentAuthorizationAuditDocument::from_audit),
            #[cfg(feature = "websocket-review")]
            websocket_review: report
                .websocket_review_audit()
                .map(AssessmentWebSocketReviewAuditDocument::from_audit)
                .transpose()?,
            #[cfg(feature = "xml-external-entity-review")]
            xml_external_entity_review: report
                .xml_external_entity_review_audit()
                .map(AssessmentXmlExternalEntityReviewAuditDocument::from_audit)
                .transpose()?,
            #[cfg(feature = "template-evaluation-review")]
            template_evaluation_review: report
                .template_evaluation_review_audit()
                .map(AssessmentTemplateEvaluationReviewAuditDocument::from_audit)
                .transpose()?,
            #[cfg(feature = "openapi-review")]
            openapi_review: report
                .openapi_review_audit()
                .map(AssessmentOpenApiAuditDocument::from_audit),
            #[cfg(feature = "rest-review")]
            rest_review: report
                .rest_review_audit()
                .map(AssessmentRestAuditDocument::from_audit),
            #[cfg(feature = "secret-exposure-review")]
            secret_exposure_review: report
                .secret_exposure_review_audit()
                .map(|audit| AssessmentSecretExposureAuditDocument::from_audit(report, audit))
                .transpose()?,
            #[cfg(feature = "tls-observation")]
            tls_observation,
            #[cfg(feature = "tls-negotiation-review")]
            tls_negotiation_review: report
                .tls_negotiation_review_audit()
                .map(AssessmentTlsNegotiationReviewAuditDocument::from_audit)
                .transpose()?,
            #[cfg(feature = "jwt-policy-review")]
            jwt_policy_review: match report.jwt_policy_review_audit() {
                Some(audit) => {
                    #[cfg(feature = "jwt-target-acceptance-review")]
                    let document = AssessmentJwtPolicyReviewAuditDocument::from_audits(
                        audit,
                        report.jwt_target_acceptance_audit(),
                    )?;
                    #[cfg(not(feature = "jwt-target-acceptance-review"))]
                    let document = AssessmentJwtPolicyReviewAuditDocument::from_audits(audit)?;
                    Some(document)
                },
                None => {
                    #[cfg(feature = "jwt-target-acceptance-review")]
                    if report.jwt_target_acceptance_audit().is_some() {
                        return Err(ReportError::Serialization);
                    }
                    None
                },
            },
            #[cfg(feature = "control-reference-mapping")]
            control_reference_mapping: report
                .control_reference_mapping_audit()
                .map(AssessmentControlReferenceMappingAuditDocument::from_audit)
                .transpose()?,
            #[cfg(feature = "recon-snapshot-import")]
            recon_snapshot_import: report
                .recon_snapshot_audit()
                .map(AssessmentReconSnapshotImportAuditDocument::from_audit)
                .transpose()?,
            #[cfg(feature = "recon-ct-provider")]
            recon_certspotter: report
                .recon_ct_provider_audit()
                .map(AssessmentReconCertSpotterAuditDocument::from_audit)
                .transpose()?,
            #[cfg(feature = "wordpress-review")]
            wordpress_review: report
                .wordpress_review_audit()
                .map(AssessmentWordPressAuditDocument::from_audit),
            #[cfg(feature = "wordpress-review")]
            wordpress_discovery,
            #[cfg(feature = "wordpress-review")]
            wordpress_asset_fingerprints,
            items,
        })
    }

    fn metadata(&self) -> [(&'static str, String); 8] {
        [
            ("Schema", self.schema.to_owned()),
            ("Source schema", self.source_schema.to_owned()),
            ("Run schema", self.run_schema.to_owned()),
            ("Profile schema", self.profile_schema.to_owned()),
            ("Profile", self.profile.to_owned()),
            ("Status", self.status.to_owned()),
            ("Subject count", self.subject_count.to_string()),
            ("Item count", self.item_count.to_string()),
        ]
    }

    fn validate(&self) -> Result<(), ReportError> {
        if self.schema != ASSESSMENT_REPORT_DOCUMENT_SCHEMA
            || self.item_count
                != u64::try_from(self.items.len()).map_err(|_| ReportError::Serialization)?
        {
            return Err(ReportError::Serialization);
        }
        #[cfg(feature = "supplied-session-review")]
        if let Some(audit) = &self.supplied_session {
            audit.validate(&self.items)?;
        } else if self
            .items
            .iter()
            .any(|item| item.capability_id == SUPPLIED_SESSION_CAPABILITY_ID)
        {
            return Err(ReportError::Serialization);
        }
        #[cfg(feature = "authorization-review")]
        if let Some(audit) = &self.authorization_review {
            audit.validate(&self.items)?;
        }
        #[cfg(feature = "websocket-review")]
        if let Some(audit) = &self.websocket_review {
            audit.validate(&self.items)?;
            #[cfg(feature = "supplied-session-review")]
            if let Some(context) = &audit.supplied_session_context {
                context.validate_against_supplied_session(
                    self.supplied_session
                        .as_ref()
                        .ok_or(ReportError::Serialization)?,
                )?;
            }
        } else if self
            .items
            .iter()
            .any(|item| item.capability_id == WEBSOCKET_REVIEW_CAPABILITY_ID)
        {
            return Err(ReportError::Serialization);
        }
        #[cfg(feature = "xml-external-entity-review")]
        if let Some(audit) = &self.xml_external_entity_review {
            audit.validate(&self.items)?;
        } else if self
            .items
            .iter()
            .any(|item| item.capability_id == XML_EXTERNAL_ENTITY_REVIEW_CAPABILITY_ID)
        {
            return Err(ReportError::Serialization);
        }
        #[cfg(feature = "template-evaluation-review")]
        if let Some(audit) = &self.template_evaluation_review {
            audit.validate(&self.items)?;
        } else if self
            .items
            .iter()
            .any(|item| item.capability_id == TEMPLATE_EVALUATION_REVIEW_CAPABILITY_ID)
        {
            return Err(ReportError::Serialization);
        }
        #[cfg(feature = "openapi-review")]
        if let Some(audit) = &self.openapi_review {
            audit.validate(&self.items)?;
        }
        #[cfg(feature = "rest-review")]
        if let Some(audit) = &self.rest_review {
            #[cfg(feature = "secret-exposure-review")]
            let response_privacy = self.secret_exposure_review.is_some();
            #[cfg(not(feature = "secret-exposure-review"))]
            let response_privacy = false;
            audit.validate_for_response_privacy(&self.items, response_privacy)?;
        } else if self
            .items
            .iter()
            .any(|item| item.capability_id == REST_REVIEW_CAPABILITY_ID)
        {
            return Err(ReportError::Serialization);
        }
        #[cfg(feature = "secret-exposure-review")]
        if let Some(audit) = &self.secret_exposure_review {
            audit.validate(&self.items)?;
        } else if self
            .items
            .iter()
            .any(|item| secret_exposure_capability(item.capability_id).is_some())
        {
            return Err(ReportError::Serialization);
        }
        #[cfg(feature = "tls-observation")]
        if let Some(audit) = &self.tls_observation {
            audit.validate()?;
        }
        #[cfg(feature = "tls-negotiation-review")]
        if let Some(audit) = &self.tls_negotiation_review {
            audit.validate()?;
        }
        #[cfg(feature = "jwt-policy-review")]
        if let Some(audit) = &self.jwt_policy_review {
            audit.validate()?;
        }
        #[cfg(feature = "control-reference-mapping")]
        if let Some(audit) = &self.control_reference_mapping {
            audit.validate(&self.items)?;
        }
        #[cfg(feature = "recon-snapshot-import")]
        if let Some(audit) = &self.recon_snapshot_import {
            audit.validate()?;
        }
        #[cfg(feature = "recon-ct-provider")]
        if let Some(audit) = &self.recon_certspotter {
            audit.validate()?;
        }
        #[cfg(feature = "wordpress-review")]
        if let Some(audit) = &self.wordpress_review {
            audit.validate(&self.items)?;
        } else if self
            .items
            .iter()
            .any(|item| item.capability_id == WORDPRESS_REVIEW_CAPABILITY_ID)
        {
            return Err(ReportError::Serialization);
        }
        #[cfg(feature = "wordpress-review")]
        let discovery_items = self
            .items
            .iter()
            .filter(|item| item.capability_id == WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID)
            .collect::<Vec<_>>();
        #[cfg(feature = "wordpress-review")]
        match (
            &self.wordpress_review,
            &self.wordpress_discovery,
            &self.wordpress_asset_fingerprints,
        ) {
            (Some(review), Some(discovery), fingerprints) => {
                discovery.validate()?;
                #[cfg(feature = "supplied-session-review")]
                if let Some(session_pages) = &discovery.supplied_session_pages {
                    session_pages.validate_against_supplied_session(
                        self.supplied_session
                            .as_ref()
                            .ok_or(ReportError::Serialization)?,
                    )?;
                }
                #[cfg(not(feature = "supplied-session-review"))]
                if discovery.supplied_session_pages.is_some() {
                    return Err(ReportError::Serialization);
                }
                if let Some(fingerprints) = fingerprints {
                    fingerprints.validate(review, discovery)?;
                }
                let page_attempted_request_count = discovery
                    .page_collection
                    .as_ref()
                    .map_or(0, |pages| pages.attempted_request_count);
                let page_committed_response_count = discovery
                    .page_collection
                    .as_ref()
                    .map_or(0, |pages| pages.committed_response_count);
                let total_attempted_request_count = discovery
                    .attempted_request_count
                    .checked_add(page_attempted_request_count)
                    .and_then(|count| {
                        fingerprints.as_ref().map_or(Some(count), |audit| {
                            count.checked_add(audit.attempted_request_count)
                        })
                    });
                let page_response_bytes = discovery
                    .page_collection
                    .as_ref()
                    .map_or(0, |pages| pages.response_bytes);
                let total_wordpress_response_bytes = discovery
                    .response_bytes
                    .checked_add(page_response_bytes)
                    .and_then(|bytes| {
                        fingerprints
                            .as_ref()
                            .map_or(Some(bytes), |audit| bytes.checked_add(audit.response_bytes))
                    });
                let total_committed_response_count = discovery
                    .committed_response_count
                    .checked_add(page_committed_response_count)
                    .and_then(|count| {
                        discovery
                            .supplied_session_pages
                            .as_ref()
                            .map_or(Some(count), |pages| {
                                u8::try_from(
                                    pages
                                        .pages
                                        .iter()
                                        .map(|page| page.evidence_reference_count)
                                        .sum::<usize>(),
                                )
                                .ok()
                                .and_then(|session_pages| count.checked_add(session_pages))
                            })
                    })
                    .and_then(|count| {
                        fingerprints.as_ref().map_or(Some(count), |audit| {
                            u8::try_from(audit.evidence_reference_count())
                                .ok()
                                .and_then(|fingerprints| count.checked_add(fingerprints))
                        })
                    });
                let expected_schema = if fingerprints.is_some() {
                    "security.wordpress-review-audit/v8"
                } else {
                    "security.wordpress-review-audit/v7"
                };
                let expected_evidence_references = discovery
                    .page_collection
                    .iter()
                    .flat_map(|pages| pages.pages.iter())
                    .flat_map(|page| page.evidence_references.iter())
                    .chain(
                        discovery
                            .supplied_session_pages
                            .iter()
                            .flat_map(|pages| pages.pages.iter())
                            .flat_map(|page| page.evidence_references.iter()),
                    )
                    .chain(
                        discovery
                            .sources
                            .iter()
                            .flat_map(|source| source.evidence_references.iter()),
                    )
                    .chain(
                        fingerprints
                            .iter()
                            .flat_map(|audit| audit.resources.iter())
                            .flat_map(|resource| resource.evidence_references.iter()),
                    )
                    .cloned()
                    .collect::<std::collections::BTreeSet<_>>();
                if review.schema != expected_schema
                    || total_attempted_request_count != Some(review.additional_request_count)
                    || ((discovery.page_collection.is_some() || fingerprints.is_some())
                        && total_wordpress_response_bytes.is_none_or(|bytes| {
                            bytes > MAX_WORDPRESS_DISCOVERY_AUDIT_RESPONSE_BYTES
                        }))
                    || !wordpress_discovery_matches_review(review, discovery)
                    || (discovery_items.len() == 1)
                        != total_committed_response_count.is_some_and(|count| count > 0)
                    || discovery_items.first().is_some_and(|item| {
                        item.evidence_count
                            != u64::from(total_committed_response_count.unwrap_or(u8::MAX))
                            || item
                                .evidence_references
                                .iter()
                                .cloned()
                                .collect::<std::collections::BTreeSet<_>>()
                                != expected_evidence_references
                    })
                {
                    return Err(ReportError::Serialization);
                }
            },
            (Some(review), None, _)
                if matches!(
                    review.schema,
                    "security.wordpress-review-audit/v7" | "security.wordpress-review-audit/v8"
                ) =>
            {
                return Err(ReportError::Serialization);
            },
            (None, Some(_), _) | (None, _, Some(_)) => return Err(ReportError::Serialization),
            _ if !discovery_items.is_empty() => return Err(ReportError::Serialization),
            _ => {},
        }
        for item in &self.items {
            item.validate()?;
        }
        Ok(())
    }
}

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
const SECRET_EXPOSURE_CAPABILITIES: [(&str, &str); 4] = [
    (
        "pem_private_key_block",
        "exposure.response-private-key-material@1",
    ),
    (
        "aws_access_key_pair",
        "exposure.response-aws-access-key-pair@1",
    ),
    (
        "stripe_live_secret",
        "exposure.response-stripe-live-secret@1",
    ),
    (
        "authorization_bearer_assignment",
        "exposure.response-bearer-authorization@1",
    ),
];

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
const SECRET_EXPOSURE_OUTCOMES: [&str; 12] = [
    "evaluated",
    "method_not_get",
    "status_not_200",
    "incomplete_body",
    "request_context_ineligible",
    "content_coded",
    "content_length_inconsistent",
    "unsupported_media_type",
    "invalid_utf8",
    "response_byte_limit_exceeded",
    "total_byte_limit_exceeded",
    "detector_limit_exceeded",
];

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
fn secret_exposure_capability(capability_id: &str) -> Option<&'static str> {
    SECRET_EXPOSURE_CAPABILITIES
        .iter()
        .find_map(|(class, expected)| (*expected == capability_id).then_some(*class))
}

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
fn secret_exposure_capability_for_class(detector_class: &str) -> Option<&'static str> {
    SECRET_EXPOSURE_CAPABILITIES
        .iter()
        .find_map(|(expected, capability)| (*expected == detector_class).then_some(*capability))
}

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
#[derive(Serialize)]
struct AssessmentSecretExposureAuditDocument {
    schema: &'static str,
    policy: &'static str,
    catalogue_id: &'static str,
    catalogue_revision: &'static str,
    representation: &'static str,
    context: &'static str,
    selected: bool,
    additional_request_count: u64,
    response_count: u64,
    evaluated_response_count: u64,
    not_evaluated_response_count: u64,
    body_derived_projection_suppressed_response_count: u64,
    interpreted_byte_count: u64,
    per_response_byte_limit: u64,
    total_byte_limit: u64,
    observation_count: u64,
    omitted_observation_count: u64,
    match_occurrence_count: u64,
    outcomes: Vec<AssessmentSecretExposureOutcomeDocument>,
    observations: Vec<AssessmentSecretExposureObservationDocument>,
    source_authentication: &'static str,
    secret_validity: &'static str,
    provider_validation: &'static str,
    exploit_execution: &'static str,
    impact_validation: &'static str,
    raw_values_retained: bool,
    public_secret_hashes_retained: bool,
}

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
#[derive(Serialize)]
struct AssessmentSecretExposureOutcomeDocument {
    outcome: &'static str,
    count: u64,
}

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
#[derive(Serialize)]
struct AssessmentSecretExposureObservationDocument {
    detector_class: &'static str,
    capability_id: &'static str,
    occurrence_count: u64,
    evidence_references: Vec<String>,
}

#[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
impl AssessmentSecretExposureAuditDocument {
    fn from_audit(
        report: &AssessmentRunReport,
        audit: &WebAssessmentSecretExposureAudit,
    ) -> Result<Self, ReportError> {
        let mut outcomes = audit
            .outcomes()
            .iter()
            .map(|outcome| {
                Ok(AssessmentSecretExposureOutcomeDocument {
                    outcome: outcome.outcome().as_str(),
                    count: u64::from(outcome.count()),
                })
            })
            .collect::<Result<Vec<_>, ReportError>>()?;
        outcomes.sort_by_key(|outcome| outcome.outcome);

        let mut observations = audit
            .observations()
            .iter()
            .map(|observation| {
                let detector_class = observation.detector_class();
                let evidence_references = observation
                    .evidence_ids()
                    .iter()
                    .map(|evidence_id| {
                        report
                            .evidence_reference_for(evidence_id)
                            .map(|reference| reference.to_string())
                            .ok_or(ReportError::Serialization)
                    })
                    .collect::<Result<Vec<_>, _>>()?;
                Ok(AssessmentSecretExposureObservationDocument {
                    detector_class: detector_class.as_str(),
                    capability_id: detector_class.capability_id(),
                    occurrence_count: u64::from(observation.occurrence_count()),
                    evidence_references,
                })
            })
            .collect::<Result<Vec<_>, ReportError>>()?;
        observations.sort_by(|left, right| {
            left.detector_class
                .cmp(right.detector_class)
                .then_with(|| left.evidence_references.cmp(&right.evidence_references))
        });

        Ok(Self {
            schema: SECRET_EXPOSURE_AUDIT_SCHEMA,
            policy: SECRET_EXPOSURE_POLICY_ID,
            catalogue_id: SECRET_EXPOSURE_CATALOGUE_ID,
            catalogue_revision: SECRET_EXPOSURE_CATALOGUE_REVISION,
            representation: SECRET_EXPOSURE_REPRESENTATION,
            context: SECRET_EXPOSURE_CONTEXT,
            selected: true,
            additional_request_count: 0,
            response_count: u64::from(audit.response_count()),
            evaluated_response_count: u64::from(audit.evaluated_response_count()),
            not_evaluated_response_count: u64::from(audit.not_evaluated_response_count()),
            body_derived_projection_suppressed_response_count: u64::from(
                audit.body_derived_projection_suppressed_response_count(),
            ),
            interpreted_byte_count: audit.interpreted_byte_count(),
            per_response_byte_limit: u64::try_from(MAX_SECRET_EXPOSURE_BODY_BYTES)
                .map_err(|_| ReportError::Serialization)?,
            total_byte_limit: MAX_SECRET_EXPOSURE_TOTAL_BODY_BYTES,
            observation_count: u64::try_from(observations.len())
                .map_err(|_| ReportError::Serialization)?,
            omitted_observation_count: u64::from(audit.omitted_observation_count()),
            match_occurrence_count: audit.match_occurrence_count(),
            outcomes,
            observations,
            source_authentication: "not_established",
            secret_validity: "not_tested",
            provider_validation: "not_performed",
            exploit_execution: "not_performed",
            impact_validation: "not_performed",
            raw_values_retained: false,
            public_secret_hashes_retained: false,
        })
    }

    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        let response_partition = self
            .evaluated_response_count
            .checked_add(self.not_evaluated_response_count);
        let maximum_interpreted_bytes = self
            .evaluated_response_count
            .checked_mul(self.per_response_byte_limit);
        let maximum_occurrences = self
            .evaluated_response_count
            .checked_mul(u64::from(MAX_SECRET_EXPOSURE_OCCURRENCES));
        let maximum_observations = self.evaluated_response_count.checked_mul(
            u64::try_from(SECRET_EXPOSURE_CAPABILITIES.len())
                .map_err(|_| ReportError::Serialization)?,
        );
        let retained_and_omitted_observations = self
            .observation_count
            .checked_add(self.omitted_observation_count);
        if self.schema != SECRET_EXPOSURE_AUDIT_SCHEMA
            || self.policy != SECRET_EXPOSURE_POLICY_ID
            || self.catalogue_id != SECRET_EXPOSURE_CATALOGUE_ID
            || self.catalogue_revision != SECRET_EXPOSURE_CATALOGUE_REVISION
            || self.representation != SECRET_EXPOSURE_REPRESENTATION
            || self.context != SECRET_EXPOSURE_CONTEXT
            || !self.selected
            || self.additional_request_count != 0
            || self.response_count
                > u64::try_from(MAX_SECRET_EXPOSURE_RESPONSES)
                    .map_err(|_| ReportError::Serialization)?
            || response_partition != Some(self.response_count)
            || self.body_derived_projection_suppressed_response_count != self.response_count
            || self.per_response_byte_limit
                != u64::try_from(MAX_SECRET_EXPOSURE_BODY_BYTES)
                    .map_err(|_| ReportError::Serialization)?
            || self.total_byte_limit != MAX_SECRET_EXPOSURE_TOTAL_BODY_BYTES
            || self.interpreted_byte_count > self.total_byte_limit
            || maximum_interpreted_bytes.is_none_or(|maximum| self.interpreted_byte_count > maximum)
            || self.observation_count
                != u64::try_from(self.observations.len()).map_err(|_| ReportError::Serialization)?
            || self.observations.len() > MAX_SECRET_EXPOSURE_RETAINED_OBSERVATIONS
            || (self.omitted_observation_count > 0
                && self.observations.len() != MAX_SECRET_EXPOSURE_RETAINED_OBSERVATIONS)
            || maximum_observations.is_none_or(|maximum| {
                retained_and_omitted_observations.is_none_or(|total| total > maximum)
            })
            || maximum_occurrences.is_none_or(|maximum| self.match_occurrence_count > maximum)
            || self.source_authentication != "not_established"
            || self.secret_validity != "not_tested"
            || self.provider_validation != "not_performed"
            || self.exploit_execution != "not_performed"
            || self.impact_validation != "not_performed"
            || self.raw_values_retained
            || self.public_secret_hashes_retained
        {
            return Err(ReportError::Serialization);
        }

        let mut outcome_names = std::collections::BTreeSet::new();
        let mut outcome_total = 0_u64;
        let mut evaluated_from_outcomes = 0_u64;
        for outcome in &self.outcomes {
            if !SECRET_EXPOSURE_OUTCOMES.contains(&outcome.outcome)
                || outcome.count == 0
                || !outcome_names.insert(outcome.outcome)
            {
                return Err(ReportError::Serialization);
            }
            outcome_total = outcome_total
                .checked_add(outcome.count)
                .ok_or(ReportError::Serialization)?;
            if outcome.outcome == "evaluated" {
                evaluated_from_outcomes = outcome.count;
            }
        }
        if outcome_total != self.response_count
            || evaluated_from_outcomes != self.evaluated_response_count
        {
            return Err(ReportError::Serialization);
        }

        let secret_items = items
            .iter()
            .filter(|item| secret_exposure_capability(item.capability_id).is_some())
            .collect::<Vec<_>>();
        if secret_items.len() != self.observations.len() {
            return Err(ReportError::Serialization);
        }
        let mut unique_observations = std::collections::BTreeSet::new();
        let mut unique_observation_evidence_references = std::collections::BTreeSet::new();
        let mut matched_item_indexes = std::collections::BTreeSet::new();
        let mut retained_occurrences = 0_u64;
        for observation in &self.observations {
            if secret_exposure_capability_for_class(observation.detector_class)
                != Some(observation.capability_id)
                || observation.occurrence_count == 0
                || observation.occurrence_count > u64::from(MAX_SECRET_EXPOSURE_OCCURRENCES)
                || observation.evidence_references.len() != 1
                || !valid_opaque_assessment_reference(
                    &observation.evidence_references[0],
                    "evidence",
                )
                || !unique_observation_evidence_references
                    .insert(observation.evidence_references[0].as_str())
                || !unique_observations.insert((
                    observation.detector_class,
                    observation.capability_id,
                    observation.occurrence_count,
                    observation.evidence_references[0].as_str(),
                ))
            {
                return Err(ReportError::Serialization);
            }
            retained_occurrences = retained_occurrences
                .checked_add(observation.occurrence_count)
                .ok_or(ReportError::Serialization)?;
            let matching = secret_items
                .iter()
                .enumerate()
                .filter(|(_, item)| {
                    item.capability_id == observation.capability_id
                        && item.claim_basis == "observation"
                        && item.evidence_references == observation.evidence_references
                })
                .map(|(index, _)| index)
                .collect::<Vec<_>>();
            if matching.len() != 1 || !matched_item_indexes.insert(matching[0]) {
                return Err(ReportError::Serialization);
            }
        }
        let missing_occurrences = self
            .match_occurrence_count
            .checked_sub(retained_occurrences);
        let maximum_omitted_occurrences = self
            .omitted_observation_count
            .checked_mul(u64::from(MAX_SECRET_EXPOSURE_OCCURRENCES));
        if matched_item_indexes.len() != secret_items.len()
            || missing_occurrences
                .zip(maximum_omitted_occurrences)
                .is_none_or(|(missing, maximum)| {
                    missing < self.omitted_observation_count || missing > maximum
                })
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        vec![
            ("Audit schema", self.schema.to_owned()),
            ("Policy", self.policy.to_owned()),
            ("Detector catalogue", self.catalogue_id.to_owned()),
            ("Catalogue revision", self.catalogue_revision.to_owned()),
            ("Representation", self.representation.to_owned()),
            ("Collection context", self.context.to_owned()),
            ("Selected", self.selected.to_string()),
            (
                "Additional target requests",
                self.additional_request_count.to_string(),
            ),
            ("Responses considered", self.response_count.to_string()),
            (
                "Responses evaluated",
                self.evaluated_response_count.to_string(),
            ),
            (
                "Responses not evaluated",
                self.not_evaluated_response_count.to_string(),
            ),
            (
                "Responses with body-derived projections suppressed",
                self.body_derived_projection_suppressed_response_count
                    .to_string(),
            ),
            (
                "Interpreted response bytes",
                self.interpreted_byte_count.to_string(),
            ),
            (
                "Per-response byte limit",
                self.per_response_byte_limit.to_string(),
            ),
            ("Total byte limit", self.total_byte_limit.to_string()),
            ("Retained observations", self.observation_count.to_string()),
            (
                "Omitted observations",
                self.omitted_observation_count.to_string(),
            ),
            (
                "Matched occurrences",
                self.match_occurrence_count.to_string(),
            ),
            (
                "Source authentication",
                self.source_authentication.to_owned(),
            ),
            ("Secret validity", self.secret_validity.to_owned()),
            ("Provider validation", self.provider_validation.to_owned()),
            ("Exploit execution", self.exploit_execution.to_owned()),
            ("Impact validation", self.impact_validation.to_owned()),
            (
                "Raw matched values retained",
                self.raw_values_retained.to_string(),
            ),
            (
                "Public secret hashes retained",
                self.public_secret_hashes_retained.to_string(),
            ),
        ]
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_POLICY_CLOCK_ASSURANCE: &str = "local_system_clock_not_independently_verified";
#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_POLICY_EXTERNAL_NOT_PERFORMED: &str = "not_performed";
#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_POLICY_SOURCE_AUTHENTICATION: &str = "not_established";
#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_POLICY_ALGORITHM: &str = "es256";
#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_POLICY_REPRESENTATION: &str = "compact_jws";
#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_POLICY_LOCAL_KEY_SOURCE: &str = "explicit_operator_supplied_public_jwk";
#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_POLICY_KEY_SOURCE_ASSURANCE: &str = "operator_supplied_not_authenticated";
#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_POLICY_TOKEN_KEY_SELECTION: &str = "prohibited";
#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const MAX_JWT_POLICY_VIOLATIONS: usize = MAX_REQUIRED_CLAIMS + 5;
#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
const JWT_POLICY_REVIEW_AUDIT_SCHEMA_V2: &str = "security.jwt-policy-review-audit/v2";
#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
const JWT_TARGET_SOURCE_AUTHENTICATION: &str = "not_established";
#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
const JWT_TARGET_INTERPRETATION_LIMITS: [&str; 6] = [
    "A marker relationship applies only to the selected resource and request controls; it does not establish a general authentication bypass, authorization effect, exploitability, or impact.",
    "An invalid-signature control marker is reported only beside matched valid and anonymous controls; it is still review-level evidence, not a confirmed vulnerability.",
    "A public or token-agnostic marker suppresses invalid-signature-specific interpretation, while a rejected invalid control does not prove every token verifier is secure.",
    "Retained response bytes are bounded interpreted bytes; accounted transport response bytes include charged discarded overrun and may exceed a retention ceiling without expanding interpreted content.",
    "The operator policy, selected resource, local key, target, and source are not authenticated by this report.",
    "The random preparation reference links local and target evidence only within this report; it is not a token identity, cross-run identity, signature, or source authentication claim.",
];

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
#[derive(Serialize)]
struct AssessmentJwtPolicyReviewAuditDocument {
    schema: &'static str,
    policy: &'static str,
    selected: bool,
    parsing_status: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    parsing_rejection: Option<&'static str>,
    policy_status: &'static str,
    local_signature_status: &'static str,
    target_acceptance_status: &'static str,
    methodology: AssessmentJwtPolicyMethodologyDocument,
    external_activity: AssessmentJwtExternalActivityDocument,
    policy_violations: Vec<AssessmentJwtPolicyViolationDocument>,
    source_authentication: &'static str,
    #[cfg(feature = "jwt-target-acceptance-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    preparation_reference: Option<String>,
    #[cfg(feature = "jwt-target-acceptance-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    target_acceptance: Option<AssessmentJwtTargetAcceptanceAuditDocument>,
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
#[derive(Serialize)]
struct AssessmentJwtPolicyMethodologyDocument {
    algorithm: &'static str,
    representation: &'static str,
    local_key_source: &'static str,
    key_source_assurance: &'static str,
    token_carried_key_selection: &'static str,
    operator_policy_reference: String,
    operator_policy_revision: String,
    local_public_key_sha256: String,
    expected_type_selected: bool,
    expected_issuer_selected: bool,
    expected_audience_selected: bool,
    required_claim_count: u64,
    require_expiration: bool,
    allowed_clock_skew_seconds: u64,
    evaluation_time_unix_seconds: i64,
    clock_assurance: &'static str,
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
#[derive(Serialize)]
struct AssessmentJwtExternalActivityDocument {
    target_request_count: u64,
    remote_key_retrieval: &'static str,
    token_forwarding: &'static str,
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
#[derive(Serialize)]
struct AssessmentJwtPolicyViolationDocument {
    kind: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    ordinal: Option<u64>,
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
#[derive(Serialize)]
struct AssessmentJwtTargetAcceptanceAuditDocument {
    schema: &'static str,
    policy: &'static str,
    selected: bool,
    operator_policy_reference: String,
    operator_policy_revision: String,
    resource_reference: String,
    method: &'static str,
    preparation_reference: String,
    status: &'static str,
    accounting: AssessmentJwtTargetAcceptanceAccountingDocument,
    dimensions: AssessmentJwtTargetAcceptanceDimensionsDocument,
    conclusion: AssessmentJwtTargetAcceptanceConclusionDocument,
    legs: Vec<AssessmentJwtTargetAcceptanceLegDocument>,
    source_authentication: &'static str,
    interpretation_limits: [&'static str; 6],
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
#[derive(Serialize)]
struct AssessmentJwtTargetAcceptanceAccountingDocument {
    request_limit: u64,
    active_request_limit: u64,
    retained_response_byte_limit: u64,
    total_retained_response_byte_limit: u64,
    dispatched_request_count: u64,
    dispatched_passive_request_count: u64,
    dispatched_active_request_count: u64,
    committed_response_count: u64,
    retained_response_bytes: u64,
    accounted_transport_response_bytes: u64,
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
#[derive(Serialize)]
struct AssessmentJwtTargetAcceptanceDimensionsDocument {
    valid_marker: &'static str,
    anonymous_marker: &'static str,
    invalid_marker: &'static str,
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
#[derive(Serialize)]
struct AssessmentJwtTargetAcceptanceConclusionDocument {
    kind: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    incomplete_reason: Option<AssessmentJwtTargetAcceptanceIncompleteReasonDocument>,
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
#[derive(Serialize)]
struct AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
    kind: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    role: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    not_eligible_reason: Option<&'static str>,
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
#[derive(Serialize)]
struct AssessmentJwtTargetAcceptanceLegDocument {
    role: &'static str,
    stage: &'static str,
    activity: &'static str,
    dispatch_status: &'static str,
    commit_status: &'static str,
    response_status: &'static str,
    marker_status: &'static str,
    retained_response_bytes: u64,
    accounted_transport_response_bytes: u64,
    #[serde(skip_serializing_if = "Option::is_none")]
    evidence_reference: Option<String>,
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
impl AssessmentJwtPolicyReviewAuditDocument {
    fn from_audits(
        audit: &JwtPolicyReviewAudit,
        #[cfg(feature = "jwt-target-acceptance-review")] target_acceptance: Option<
            &JwtTargetAcceptanceAudit,
        >,
    ) -> Result<Self, ReportError> {
        let (parsing_status, parsing_rejection) = match audit.parsing_status() {
            JwtParsingStatus::Parsed => ("parsed", None),
            JwtParsingStatus::Rejected(reason) => ("rejected", Some(jwt_parse_rejection(reason))),
        };
        let methodology = audit.methodology();
        let external = audit.external_activity();
        let policy_violations = audit
            .policy_violations()
            .iter()
            .copied()
            .map(jwt_policy_violation)
            .collect::<Vec<_>>();
        #[cfg(feature = "jwt-target-acceptance-review")]
        let target_acceptance = target_acceptance
            .map(AssessmentJwtTargetAcceptanceAuditDocument::from_audit)
            .transpose()?;
        #[cfg(feature = "jwt-target-acceptance-review")]
        let preparation_reference = audit
            .target_preparation_binding()
            .map(|binding| binding.reference());
        let document = Self {
            #[cfg(not(feature = "jwt-target-acceptance-review"))]
            schema: audit.schema(),
            #[cfg(feature = "jwt-target-acceptance-review")]
            schema: if target_acceptance.is_some() {
                JWT_POLICY_REVIEW_AUDIT_SCHEMA_V2
            } else {
                audit.schema()
            },
            policy: audit.policy(),
            selected: audit.selected(),
            parsing_status,
            parsing_rejection,
            policy_status: match audit.policy_status() {
                JwtPolicyStatus::NotEvaluated => "not_evaluated",
                JwtPolicyStatus::Consistent => "consistent",
                JwtPolicyStatus::Inconsistent => "inconsistent",
            },
            local_signature_status: match audit.local_signature_status() {
                JwtLocalSignatureStatus::NotEvaluated => "not_evaluated",
                JwtLocalSignatureStatus::Verified => "verified",
                JwtLocalSignatureStatus::Invalid => "invalid",
            },
            #[cfg(not(feature = "jwt-target-acceptance-review"))]
            target_acceptance_status: match audit.target_acceptance_status() {
                JwtTargetAcceptanceStatus::NotPerformed => "not_performed",
            },
            #[cfg(feature = "jwt-target-acceptance-review")]
            target_acceptance_status: target_acceptance.as_ref().map_or_else(
                || match audit.target_acceptance_status() {
                    JwtTargetAcceptanceStatus::NotPerformed => "not_performed",
                },
                |target| target.status,
            ),
            methodology: AssessmentJwtPolicyMethodologyDocument {
                algorithm: JWT_POLICY_ALGORITHM,
                representation: JWT_POLICY_REPRESENTATION,
                local_key_source: JWT_POLICY_LOCAL_KEY_SOURCE,
                key_source_assurance: JWT_POLICY_KEY_SOURCE_ASSURANCE,
                token_carried_key_selection: JWT_POLICY_TOKEN_KEY_SELECTION,
                operator_policy_reference: methodology.operator_policy_reference().to_owned(),
                operator_policy_revision: methodology.operator_policy_revision().to_owned(),
                local_public_key_sha256: methodology.local_public_key_sha256().to_owned(),
                expected_type_selected: methodology.expected_type_selected(),
                expected_issuer_selected: methodology.expected_issuer_selected(),
                expected_audience_selected: methodology.expected_audience_selected(),
                required_claim_count: u64::from(methodology.required_claim_count()),
                require_expiration: methodology.require_expiration(),
                allowed_clock_skew_seconds: u64::from(methodology.allowed_clock_skew_seconds()),
                evaluation_time_unix_seconds: methodology.evaluation_time_unix_seconds(),
                clock_assurance: match methodology.clock_assurance() {
                    JwtClockAssurance::LocalSystemClockNotIndependentlyVerified => {
                        JWT_POLICY_CLOCK_ASSURANCE
                    },
                },
            },
            external_activity: AssessmentJwtExternalActivityDocument {
                #[cfg(not(feature = "jwt-target-acceptance-review"))]
                target_request_count: u64::from(external.target_request_count()),
                #[cfg(feature = "jwt-target-acceptance-review")]
                target_request_count: target_acceptance.as_ref().map_or_else(
                    || u64::from(external.target_request_count()),
                    |target| target.accounting.dispatched_request_count,
                ),
                remote_key_retrieval: match external.remote_key_retrieval() {
                    JwtExternalOperationStatus::NotPerformed => JWT_POLICY_EXTERNAL_NOT_PERFORMED,
                },
                #[cfg(not(feature = "jwt-target-acceptance-review"))]
                token_forwarding: match external.token_forwarding() {
                    JwtExternalOperationStatus::NotPerformed => JWT_POLICY_EXTERNAL_NOT_PERFORMED,
                },
                #[cfg(feature = "jwt-target-acceptance-review")]
                token_forwarding: target_acceptance.as_ref().map_or_else(
                    || match external.token_forwarding() {
                        JwtExternalOperationStatus::NotPerformed => {
                            JWT_POLICY_EXTERNAL_NOT_PERFORMED
                        },
                    },
                    |target| {
                        if target.legs.iter().any(|leg| {
                            leg.dispatch_status == "dispatched"
                                && leg.role != "anonymous_candidate"
                                && leg.role != "anonymous_replay"
                        }) {
                            "performed"
                        } else {
                            JWT_POLICY_EXTERNAL_NOT_PERFORMED
                        }
                    },
                ),
            },
            policy_violations,
            source_authentication: JWT_POLICY_SOURCE_AUTHENTICATION,
            #[cfg(feature = "jwt-target-acceptance-review")]
            preparation_reference,
            #[cfg(feature = "jwt-target-acceptance-review")]
            target_acceptance,
        };
        document.validate()?;
        Ok(document)
    }

    fn validate(&self) -> Result<(), ReportError> {
        #[cfg(feature = "jwt-target-acceptance-review")]
        let target_contract_valid = match (&self.target_acceptance, self.schema) {
            (None, JWT_POLICY_REVIEW_AUDIT_SCHEMA) => {
                self.preparation_reference.is_none()
                    && self.target_acceptance_status == "not_performed"
                    && self.external_activity.target_request_count == 0
                    && self.external_activity.token_forwarding == JWT_POLICY_EXTERNAL_NOT_PERFORMED
            },
            (Some(target), JWT_POLICY_REVIEW_AUDIT_SCHEMA_V2) => {
                target.validate().is_ok()
                    && self.preparation_reference.as_deref()
                        == Some(target.preparation_reference.as_str())
                    && self
                        .preparation_reference
                        .as_deref()
                        .is_some_and(valid_jwt_target_preparation_reference)
                    && self.target_local_state_is_consistent(target)
                    && self.target_acceptance_status == target.status
                    && self.external_activity.target_request_count
                        == target.accounting.dispatched_request_count
                    && self.external_activity.token_forwarding
                        == if target.legs.iter().any(|leg| {
                            leg.dispatch_status == "dispatched"
                                && leg.role != "anonymous_candidate"
                                && leg.role != "anonymous_replay"
                        }) {
                            "performed"
                        } else {
                            JWT_POLICY_EXTERNAL_NOT_PERFORMED
                        }
            },
            _ => false,
        };
        #[cfg(not(feature = "jwt-target-acceptance-review"))]
        let target_contract_valid = self.schema == JWT_POLICY_REVIEW_AUDIT_SCHEMA
            && self.target_acceptance_status == "not_performed"
            && self.external_activity.target_request_count == 0
            && self.external_activity.token_forwarding == JWT_POLICY_EXTERNAL_NOT_PERFORMED;

        if !target_contract_valid
            || self.policy != JWT_POLICY_REVIEW_POLICY_ID
            || !self.selected
            || !valid_jwt_policy_reference(&self.methodology.operator_policy_reference)
            || !valid_jwt_policy_reference(&self.methodology.operator_policy_revision)
            || !valid_jwt_public_key_sha256(&self.methodology.local_public_key_sha256)
            || self.methodology.algorithm != JWT_POLICY_ALGORITHM
            || self.methodology.representation != JWT_POLICY_REPRESENTATION
            || self.methodology.local_key_source != JWT_POLICY_LOCAL_KEY_SOURCE
            || self.methodology.key_source_assurance != JWT_POLICY_KEY_SOURCE_ASSURANCE
            || self.methodology.token_carried_key_selection != JWT_POLICY_TOKEN_KEY_SELECTION
            || !self.methodology.expected_type_selected
            || !self.methodology.expected_issuer_selected
            || !self.methodology.expected_audience_selected
            || self.methodology.required_claim_count
                > u64::try_from(MAX_REQUIRED_CLAIMS).map_err(|_| ReportError::Serialization)?
            || self.methodology.allowed_clock_skew_seconds > u64::from(MAX_CLOCK_SKEW_SECONDS)
            || self.methodology.clock_assurance != JWT_POLICY_CLOCK_ASSURANCE
            || self.external_activity.remote_key_retrieval != JWT_POLICY_EXTERNAL_NOT_PERFORMED
            || self.source_authentication != JWT_POLICY_SOURCE_AUTHENTICATION
            || self.policy_violations.len() > MAX_JWT_POLICY_VIOLATIONS
        {
            return Err(ReportError::Serialization);
        }
        let state_valid = match self.parsing_status {
            "rejected" => {
                self.parsing_rejection.is_some()
                    && self.policy_status == "not_evaluated"
                    && self.local_signature_status == "not_evaluated"
                    && self.policy_violations.is_empty()
            },
            "parsed" => {
                self.parsing_rejection.is_none()
                    && matches!(self.local_signature_status, "verified" | "invalid")
                    && match self.policy_status {
                        "consistent" => self.policy_violations.is_empty(),
                        "inconsistent" => !self.policy_violations.is_empty(),
                        _ => false,
                    }
            },
            _ => false,
        };
        if !state_valid {
            return Err(ReportError::Serialization);
        }
        if let Some(reason) = self.parsing_rejection {
            if !JWT_PARSE_REJECTION_TOKENS.contains(&reason) {
                return Err(ReportError::Serialization);
            }
        }
        let mut unique = std::collections::BTreeSet::new();
        let mut exclusive_categories = std::collections::BTreeSet::new();
        for violation in &self.policy_violations {
            let (valid, category) = match violation.kind {
                "missing_type" | "type_mismatch" => (
                    violation.ordinal.is_none() && self.methodology.expected_type_selected,
                    Some("type"),
                ),
                "missing_issuer" | "invalid_issuer_type" | "issuer_mismatch" => (
                    violation.ordinal.is_none() && self.methodology.expected_issuer_selected,
                    Some("issuer"),
                ),
                "missing_audience" | "invalid_audience_type" | "audience_mismatch" => (
                    violation.ordinal.is_none() && self.methodology.expected_audience_selected,
                    Some("audience"),
                ),
                "missing_required_claim" => (
                    violation
                        .ordinal
                        .is_some_and(|ordinal| ordinal < self.methodology.required_claim_count),
                    None,
                ),
                "missing_expiration" => (
                    violation.ordinal.is_none() && self.methodology.require_expiration,
                    Some("expiration"),
                ),
                "invalid_expiration" | "expired" => {
                    (violation.ordinal.is_none(), Some("expiration"))
                },
                "invalid_not_before" | "not_yet_valid" => {
                    (violation.ordinal.is_none(), Some("not_before"))
                },
                _ => (false, None),
            };
            if !valid
                || !unique.insert((violation.kind, violation.ordinal))
                || category.is_some_and(|category| !exclusive_categories.insert(category))
            {
                return Err(ReportError::Serialization);
            }
        }
        Ok(())
    }

    #[cfg(feature = "jwt-target-acceptance-review")]
    fn target_local_state_is_consistent(
        &self,
        target: &AssessmentJwtTargetAcceptanceAuditDocument,
    ) -> bool {
        let local_eligible = self.parsing_status == "parsed"
            && self.policy_status == "consistent"
            && self.local_signature_status == "verified";
        if !target.legs.is_empty() {
            return local_eligible;
        }
        let reason = target
            .conclusion
            .incomplete_reason
            .as_ref()
            .and_then(|reason| reason.not_eligible_reason);
        match reason {
            Some("local_parsing_not_established") => self.parsing_status == "rejected",
            Some("local_policy_not_established") => {
                self.parsing_status == "parsed" && self.policy_status == "inconsistent"
            },
            Some("local_signature_not_established") => {
                self.parsing_status == "parsed"
                    && self.policy_status == "consistent"
                    && self.local_signature_status == "invalid"
            },
            Some("runtime_authority_unavailable" | "request_budget_unavailable") => local_eligible,
            _ => false,
        }
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        let metadata = vec![
            ("Audit schema", self.schema.to_owned()),
            ("Policy", self.policy.to_owned()),
            ("Selected", self.selected.to_string()),
            ("Parsing status", self.parsing_status.to_owned()),
            ("Policy status", self.policy_status.to_owned()),
            (
                "Local signature status",
                self.local_signature_status.to_owned(),
            ),
            (
                "Target acceptance status",
                self.target_acceptance_status.to_owned(),
            ),
            (
                "Operator policy reference",
                self.methodology.operator_policy_reference.clone(),
            ),
            (
                "Operator policy revision",
                self.methodology.operator_policy_revision.clone(),
            ),
            (
                "Local public key SHA-256",
                self.methodology.local_public_key_sha256.clone(),
            ),
            ("Algorithm", self.methodology.algorithm.to_owned()),
            ("Representation", self.methodology.representation.to_owned()),
            (
                "Local key source",
                self.methodology.local_key_source.to_owned(),
            ),
            (
                "Key source assurance",
                self.methodology.key_source_assurance.to_owned(),
            ),
            (
                "Token-carried key selection",
                self.methodology.token_carried_key_selection.to_owned(),
            ),
            (
                "Required claim count",
                self.methodology.required_claim_count.to_string(),
            ),
            (
                "Allowed clock skew seconds",
                self.methodology.allowed_clock_skew_seconds.to_string(),
            ),
            (
                "Evaluation time (Unix seconds)",
                self.methodology.evaluation_time_unix_seconds.to_string(),
            ),
            (
                "Policy violation count",
                self.policy_violations.len().to_string(),
            ),
            (
                "Target request count",
                self.external_activity.target_request_count.to_string(),
            ),
            (
                "Source authentication",
                self.source_authentication.to_owned(),
            ),
        ];
        #[cfg(feature = "jwt-target-acceptance-review")]
        let metadata = {
            let mut metadata = metadata;
            if let Some(target) = &self.target_acceptance {
                metadata.extend([
                    (
                        "Target policy reference",
                        target.operator_policy_reference.clone(),
                    ),
                    (
                        "Target policy revision",
                        target.operator_policy_revision.clone(),
                    ),
                    (
                        "Target resource reference",
                        target.resource_reference.clone(),
                    ),
                    (
                        "Target dispatched requests",
                        target.accounting.dispatched_request_count.to_string(),
                    ),
                    (
                        "Target committed responses",
                        target.accounting.committed_response_count.to_string(),
                    ),
                    (
                        "Target retained response bytes",
                        target.accounting.retained_response_bytes.to_string(),
                    ),
                    (
                        "Target accounted transport response bytes",
                        target
                            .accounting
                            .accounted_transport_response_bytes
                            .to_string(),
                    ),
                    ("Target conclusion", target.conclusion.kind.to_owned()),
                ]);
                if let Some(reason) = &target.conclusion.incomplete_reason {
                    let value = match (reason.role, reason.not_eligible_reason) {
                        (Some(role), None) => {
                            format!("kind={};role={role}", reason.kind)
                        },
                        (None, Some(not_eligible_reason)) => format!(
                            "kind={};not_eligible_reason={not_eligible_reason}",
                            reason.kind
                        ),
                        (Some(role), Some(not_eligible_reason)) => format!(
                            "kind={};role={role};not_eligible_reason={not_eligible_reason}",
                            reason.kind
                        ),
                        (None, None) => format!("kind={}", reason.kind),
                    };
                    metadata.push(("Target incomplete reason", value));
                }
            }
            metadata
        };
        metadata
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
impl AssessmentJwtTargetAcceptanceAuditDocument {
    fn from_audit(audit: &JwtTargetAcceptanceAudit) -> Result<Self, ReportError> {
        let accounting = audit.accounting();
        let conclusion = jwt_target_conclusion_document(audit.conclusion());
        let status = if accounting.dispatched_request_count() == 0 {
            "not_performed"
        } else if matches!(
            audit.conclusion(),
            JwtTargetAcceptanceConclusion::Incomplete(_)
        ) {
            "partially_performed"
        } else {
            "completed"
        };
        let document = Self {
            schema: audit.schema(),
            policy: audit.policy(),
            selected: true,
            operator_policy_reference: audit.operator_policy_reference().to_owned(),
            operator_policy_revision: audit.operator_policy_revision().to_owned(),
            resource_reference: audit.resource_reference().to_owned(),
            method: match audit.method() {
                JwtTargetAcceptanceMethod::Get => "get",
            },
            preparation_reference: audit
                .preparation_binding()
                .ok_or(ReportError::Serialization)?
                .reference(),
            status,
            accounting: AssessmentJwtTargetAcceptanceAccountingDocument {
                request_limit: u64::from(MAX_JWT_TARGET_ACCEPTANCE_REQUESTS),
                active_request_limit: u64::from(MAX_JWT_TARGET_ACCEPTANCE_ACTIVE_REQUESTS),
                retained_response_byte_limit: MAX_JWT_TARGET_ACCEPTANCE_RESPONSE_BYTES,
                total_retained_response_byte_limit: MAX_JWT_TARGET_ACCEPTANCE_TOTAL_RESPONSE_BYTES,
                dispatched_request_count: u64::from(accounting.dispatched_request_count()),
                dispatched_passive_request_count: u64::from(
                    accounting.dispatched_passive_request_count(),
                ),
                dispatched_active_request_count: u64::from(
                    accounting.dispatched_active_request_count(),
                ),
                committed_response_count: u64::from(accounting.committed_response_count()),
                retained_response_bytes: accounting.retained_response_bytes(),
                accounted_transport_response_bytes: accounting.accounted_response_bytes(),
            },
            dimensions: AssessmentJwtTargetAcceptanceDimensionsDocument {
                valid_marker: jwt_target_dimension(audit.valid_marker()),
                anonymous_marker: jwt_target_dimension(audit.anonymous_marker()),
                invalid_marker: jwt_target_dimension(audit.invalid_marker()),
            },
            conclusion,
            legs: audit
                .legs()
                .iter()
                .map(|leg| AssessmentJwtTargetAcceptanceLegDocument {
                    role: jwt_target_role(leg.role()),
                    stage: jwt_target_stage(leg.role().stage()),
                    activity: jwt_target_activity(leg.role().activity()),
                    dispatch_status: match leg.dispatch_status() {
                        JwtTargetAcceptanceDispatchStatus::NotDispatched => "not_dispatched",
                        JwtTargetAcceptanceDispatchStatus::Dispatched => "dispatched",
                    },
                    commit_status: match leg.commit_status() {
                        JwtTargetAcceptanceCommitStatus::NotCommitted => "not_committed",
                        JwtTargetAcceptanceCommitStatus::Committed => "committed",
                    },
                    response_status: match leg.response_status() {
                        JwtTargetAcceptanceResponseStatus::NotClassified => "not_classified",
                        JwtTargetAcceptanceResponseStatus::CompleteAndClassified => {
                            "complete_and_classified"
                        },
                        JwtTargetAcceptanceResponseStatus::Incomplete => "incomplete",
                    },
                    marker_status: match leg.marker_status() {
                        JwtTargetAcceptanceMarkerStatus::Observed => "observed",
                        JwtTargetAcceptanceMarkerStatus::NotObserved => "not_observed",
                        JwtTargetAcceptanceMarkerStatus::NotEvaluated => "not_evaluated",
                    },
                    retained_response_bytes: leg.retained_response_bytes(),
                    accounted_transport_response_bytes: leg.accounted_response_bytes(),
                    evidence_reference: leg.evidence_reference().map(str::to_owned),
                })
                .collect(),
            source_authentication: JWT_TARGET_SOURCE_AUTHENTICATION,
            interpretation_limits: JWT_TARGET_INTERPRETATION_LIMITS,
        };
        document.validate()?;
        Ok(document)
    }

    fn validate(&self) -> Result<(), ReportError> {
        if self.schema != JWT_TARGET_ACCEPTANCE_AUDIT_SCHEMA
            || self.policy != JWT_TARGET_ACCEPTANCE_POLICY_ID
            || !self.selected
            || !valid_jwt_policy_reference(&self.operator_policy_reference)
            || !valid_jwt_policy_reference(&self.operator_policy_revision)
            || !valid_jwt_policy_reference(&self.resource_reference)
            || !valid_jwt_target_preparation_reference(&self.preparation_reference)
            || self.method != "get"
            || self.source_authentication != JWT_TARGET_SOURCE_AUTHENTICATION
            || self.interpretation_limits != JWT_TARGET_INTERPRETATION_LIMITS
            || self.accounting.request_limit != u64::from(MAX_JWT_TARGET_ACCEPTANCE_REQUESTS)
            || self.accounting.active_request_limit
                != u64::from(MAX_JWT_TARGET_ACCEPTANCE_ACTIVE_REQUESTS)
            || self.accounting.retained_response_byte_limit
                != MAX_JWT_TARGET_ACCEPTANCE_RESPONSE_BYTES
            || self.accounting.total_retained_response_byte_limit
                != MAX_JWT_TARGET_ACCEPTANCE_TOTAL_RESPONSE_BYTES
        {
            return Err(ReportError::Serialization);
        }

        let conclusion_incomplete = self.conclusion.kind == "incomplete";
        if conclusion_incomplete != self.conclusion.incomplete_reason.is_some()
            || !matches!(
                self.conclusion.kind,
                "invalid_signature_control_marker_observed_with_anonymous_control"
                    | "public_or_token_agnostic_marker_observed"
                    | "invalid_control_marker_not_observed"
                    | "unstable_inconclusive"
                    | "inconclusive"
                    | "incomplete"
            )
            || ![
                "observed_stable",
                "not_observed_stable",
                "unstable",
                "not_evaluated",
                "incomplete",
            ]
            .contains(&self.dimensions.valid_marker)
            || ![
                "observed_stable",
                "not_observed_stable",
                "unstable",
                "not_evaluated",
                "incomplete",
            ]
            .contains(&self.dimensions.anonymous_marker)
            || ![
                "observed_stable",
                "not_observed_stable",
                "unstable",
                "not_evaluated",
                "incomplete",
            ]
            .contains(&self.dimensions.invalid_marker)
        {
            return Err(ReportError::Serialization);
        }
        if let Some(reason) = &self.conclusion.incomplete_reason {
            let valid = match reason.kind {
                "not_eligible" => {
                    reason.role.is_none()
                        && matches!(
                            reason.not_eligible_reason,
                            Some(
                                "local_parsing_not_established"
                                    | "local_policy_not_established"
                                    | "local_signature_not_established"
                                    | "runtime_authority_unavailable"
                                    | "request_budget_unavailable"
                            )
                        )
                },
                "leg_not_dispatched"
                | "leg_not_committed"
                | "response_incomplete"
                | "response_not_classified" => {
                    reason.not_eligible_reason.is_none()
                        && reason.role.is_some_and(valid_jwt_target_role)
                },
                _ => false,
            };
            if !valid {
                return Err(ReportError::Serialization);
            }
        }

        if !(self.legs.is_empty()
            || self.legs.len() == usize::from(MAX_JWT_TARGET_ACCEPTANCE_REQUESTS))
        {
            return Err(ReportError::Serialization);
        }
        let mut dispatched = 0_u64;
        let mut passive = 0_u64;
        let mut active = 0_u64;
        let mut committed = 0_u64;
        let mut retained_bytes = 0_u64;
        let mut accounted_transport_bytes = 0_u64;
        let mut evidence_references = std::collections::BTreeSet::new();
        let mut dispatches = Vec::with_capacity(self.legs.len());
        let mut commits = Vec::with_capacity(self.legs.len());
        let mut responses = Vec::with_capacity(self.legs.len());
        let mut markers = Vec::with_capacity(self.legs.len());
        let mut retained_by_leg = Vec::with_capacity(self.legs.len());
        for (index, leg) in self.legs.iter().enumerate() {
            let expected_role = jwt_target_role(JwtTargetAcceptanceLegRole::ORDERED[index]);
            let expected_stage =
                jwt_target_stage(JwtTargetAcceptanceLegRole::ORDERED[index].stage());
            let expected_activity =
                jwt_target_activity(JwtTargetAcceptanceLegRole::ORDERED[index].activity());
            if leg.role != expected_role
                || leg.stage != expected_stage
                || leg.activity != expected_activity
                || leg.retained_response_bytes > MAX_JWT_TARGET_ACCEPTANCE_RESPONSE_BYTES
                || leg.accounted_transport_response_bytes < leg.retained_response_bytes
            {
                return Err(ReportError::Serialization);
            }
            let leg_valid = match (leg.dispatch_status, leg.commit_status) {
                ("not_dispatched", "not_committed") => {
                    leg.response_status == "not_classified"
                        && leg.marker_status == "not_evaluated"
                        && leg.retained_response_bytes == 0
                        && leg.accounted_transport_response_bytes == 0
                        && leg.evidence_reference.is_none()
                },
                ("dispatched", "not_committed") => {
                    leg.response_status != "complete_and_classified"
                        && leg.marker_status == "not_evaluated"
                        && leg.evidence_reference.is_none()
                },
                ("dispatched", "committed") => {
                    leg.evidence_reference
                        .as_deref()
                        .is_some_and(valid_jwt_target_evidence_reference)
                        && match leg.response_status {
                            "complete_and_classified" => {
                                matches!(leg.marker_status, "observed" | "not_observed")
                            },
                            "not_classified" | "incomplete" => leg.marker_status == "not_evaluated",
                            _ => false,
                        }
                },
                _ => false,
            };
            if !leg_valid {
                return Err(ReportError::Serialization);
            }
            if leg.dispatch_status == "dispatched" {
                dispatched += 1;
                if leg.activity == "active" {
                    active += 1;
                } else {
                    passive += 1;
                }
            }
            if leg.commit_status == "committed" {
                committed += 1;
            }
            retained_bytes = retained_bytes
                .checked_add(leg.retained_response_bytes)
                .ok_or(ReportError::Serialization)?;
            accounted_transport_bytes = accounted_transport_bytes
                .checked_add(leg.accounted_transport_response_bytes)
                .ok_or(ReportError::Serialization)?;
            if let Some(reference) = leg.evidence_reference.as_deref() {
                if !evidence_references.insert(reference) {
                    return Err(ReportError::Serialization);
                }
            }
            dispatches.push(leg.dispatch_status);
            commits.push(leg.commit_status);
            responses.push(leg.response_status);
            markers.push(leg.marker_status);
            retained_by_leg.push(leg.retained_response_bytes);
        }
        if self.accounting.dispatched_request_count != dispatched
            || self.accounting.dispatched_passive_request_count != passive
            || self.accounting.dispatched_active_request_count != active
            || self.accounting.committed_response_count != committed
            || self.accounting.retained_response_bytes != retained_bytes
            || self.accounting.accounted_transport_response_bytes != accounted_transport_bytes
            || dispatched > self.accounting.request_limit
            || active > self.accounting.active_request_limit
            || retained_bytes > self.accounting.total_retained_response_byte_limit
            || accounted_transport_bytes < retained_bytes
        {
            return Err(ReportError::Serialization);
        }
        if self.legs.len() == usize::from(MAX_JWT_TARGET_ACCEPTANCE_REQUESTS) {
            let passive_prerequisite_is_established =
                |valid_index: usize, anonymous_index: usize| {
                    commits[valid_index] == "committed"
                        && responses[valid_index] == "complete_and_classified"
                        && markers[valid_index] == "observed"
                        && commits[anonymous_index] == "committed"
                        && responses[anonymous_index] == "complete_and_classified"
                        && markers[anonymous_index] == "not_observed"
                };
            for (valid_index, anonymous_index, invalid_index) in [(0, 1, 2), (3, 4, 5)] {
                if dispatches[invalid_index] == "dispatched"
                    && !passive_prerequisite_is_established(valid_index, anonymous_index)
                {
                    return Err(ReportError::Serialization);
                }
            }

            let mut stopped = false;
            let mut sequential_retained_bytes = 0_u64;
            for index in 0..self.legs.len() {
                if stopped {
                    if dispatches[index] == "dispatched" {
                        return Err(ReportError::Serialization);
                    }
                    continue;
                }
                if dispatches[index] == "not_dispatched" {
                    let prerequisite_skip = match index {
                        2 => !passive_prerequisite_is_established(0, 1),
                        5 => !passive_prerequisite_is_established(3, 4),
                        _ => false,
                    };
                    if !prerequisite_skip {
                        stopped = true;
                    }
                    continue;
                }
                sequential_retained_bytes = sequential_retained_bytes
                    .checked_add(retained_by_leg[index])
                    .ok_or(ReportError::Serialization)?;
                if commits[index] != "committed"
                    || sequential_retained_bytes >= MAX_JWT_TARGET_ACCEPTANCE_TOTAL_RESPONSE_BYTES
                {
                    stopped = true;
                }
            }

            let pair_dimension = |candidate: usize, replay: usize| {
                if dispatches[candidate] == "not_dispatched"
                    && dispatches[replay] == "not_dispatched"
                {
                    "not_evaluated"
                } else if commits[candidate] != "committed"
                    || commits[replay] != "committed"
                    || responses[candidate] != "complete_and_classified"
                    || responses[replay] != "complete_and_classified"
                {
                    "incomplete"
                } else {
                    match (markers[candidate], markers[replay]) {
                        ("observed", "observed") => "observed_stable",
                        ("not_observed", "not_observed") => "not_observed_stable",
                        _ => "unstable",
                    }
                }
            };
            let expected_valid = pair_dimension(0, 3);
            let expected_anonymous = pair_dimension(1, 4);
            let expected_invalid = pair_dimension(2, 5);
            if self.dimensions.valid_marker != expected_valid
                || self.dimensions.anonymous_marker != expected_anonymous
                || self.dimensions.invalid_marker != expected_invalid
            {
                return Err(ReportError::Serialization);
            }
            let expected_conclusion =
                if [expected_valid, expected_anonymous, expected_invalid].contains(&"unstable") {
                    "unstable_inconclusive"
                } else if expected_anonymous == "observed_stable" {
                    "public_or_token_agnostic_marker_observed"
                } else if expected_valid == "observed_stable"
                    && expected_anonymous == "not_observed_stable"
                    && expected_invalid == "observed_stable"
                {
                    "invalid_signature_control_marker_observed_with_anonymous_control"
                } else if expected_valid == "observed_stable"
                    && expected_anonymous == "not_observed_stable"
                    && expected_invalid == "not_observed_stable"
                {
                    "invalid_control_marker_not_observed"
                } else if [expected_valid, expected_anonymous, expected_invalid]
                    .iter()
                    .any(|value| matches!(*value, "incomplete" | "not_evaluated"))
                {
                    "incomplete"
                } else {
                    "inconclusive"
                };
            if self.conclusion.kind != expected_conclusion {
                return Err(ReportError::Serialization);
            }
            if expected_conclusion == "incomplete" {
                let (kind, role) = self
                    .legs
                    .iter()
                    .find_map(|leg| {
                        if leg.dispatch_status == "not_dispatched" {
                            Some(("leg_not_dispatched", leg.role))
                        } else if leg.commit_status != "committed" {
                            Some(("leg_not_committed", leg.role))
                        } else {
                            match leg.response_status {
                                "incomplete" => Some(("response_incomplete", leg.role)),
                                "not_classified" => Some(("response_not_classified", leg.role)),
                                _ => None,
                            }
                        }
                    })
                    .ok_or(ReportError::Serialization)?;
                let reason = self
                    .conclusion
                    .incomplete_reason
                    .as_ref()
                    .ok_or(ReportError::Serialization)?;
                if reason.kind != kind
                    || reason.role != Some(role)
                    || reason.not_eligible_reason.is_some()
                {
                    return Err(ReportError::Serialization);
                }
            }
        }
        let expected_status = if dispatched == 0 {
            "not_performed"
        } else if conclusion_incomplete {
            "partially_performed"
        } else {
            "completed"
        };
        let empty_leg_contract_valid = !self.legs.is_empty()
            || self
                .conclusion
                .incomplete_reason
                .as_ref()
                .is_some_and(|reason| {
                    reason.kind == "not_eligible"
                        && reason.role.is_none()
                        && reason.not_eligible_reason.is_some()
                });
        if self.status != expected_status
            || !empty_leg_contract_valid
            || (self.legs.is_empty()
                && !(self.dimensions.valid_marker == "not_evaluated"
                    && self.dimensions.anonymous_marker == "not_evaluated"
                    && self.dimensions.invalid_marker == "not_evaluated"
                    && conclusion_incomplete))
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn jwt_target_role(role: JwtTargetAcceptanceLegRole) -> &'static str {
    match role {
        JwtTargetAcceptanceLegRole::ValidCandidate => "valid_candidate",
        JwtTargetAcceptanceLegRole::AnonymousCandidate => "anonymous_candidate",
        JwtTargetAcceptanceLegRole::InvalidCandidate => "invalid_candidate",
        JwtTargetAcceptanceLegRole::ValidReplay => "valid_replay",
        JwtTargetAcceptanceLegRole::AnonymousReplay => "anonymous_replay",
        JwtTargetAcceptanceLegRole::InvalidReplay => "invalid_replay",
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn valid_jwt_target_role(role: &str) -> bool {
    JwtTargetAcceptanceLegRole::ORDERED
        .iter()
        .copied()
        .map(jwt_target_role)
        .any(|expected| expected == role)
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn jwt_target_stage(stage: JwtTargetAcceptanceLegStage) -> &'static str {
    match stage {
        JwtTargetAcceptanceLegStage::Candidate => "candidate",
        JwtTargetAcceptanceLegStage::Replay => "replay",
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn jwt_target_activity(activity: JwtTargetAcceptanceActivity) -> &'static str {
    match activity {
        JwtTargetAcceptanceActivity::Passive => "passive",
        JwtTargetAcceptanceActivity::Active => "active",
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn jwt_target_dimension(dimension: JwtTargetAcceptanceDimension) -> &'static str {
    match dimension {
        JwtTargetAcceptanceDimension::ObservedStable => "observed_stable",
        JwtTargetAcceptanceDimension::NotObservedStable => "not_observed_stable",
        JwtTargetAcceptanceDimension::Unstable => "unstable",
        JwtTargetAcceptanceDimension::NotEvaluated => "not_evaluated",
        JwtTargetAcceptanceDimension::Incomplete => "incomplete",
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn jwt_target_conclusion_document(
    conclusion: JwtTargetAcceptanceConclusion,
) -> AssessmentJwtTargetAcceptanceConclusionDocument {
    let (kind, incomplete_reason) = match conclusion {
        JwtTargetAcceptanceConclusion::InvalidSignatureControlMarkerObservedWithAnonymousControl => (
            "invalid_signature_control_marker_observed_with_anonymous_control",
            None,
        ),
        JwtTargetAcceptanceConclusion::PublicOrTokenAgnosticMarkerObserved => {
            ("public_or_token_agnostic_marker_observed", None)
        },
        JwtTargetAcceptanceConclusion::InvalidControlMarkerNotObserved => {
            ("invalid_control_marker_not_observed", None)
        },
        JwtTargetAcceptanceConclusion::UnstableInconclusive => ("unstable_inconclusive", None),
        JwtTargetAcceptanceConclusion::Inconclusive => ("inconclusive", None),
        JwtTargetAcceptanceConclusion::Incomplete(reason) => (
            "incomplete",
            Some(jwt_target_incomplete_reason_document(reason)),
        ),
    };
    AssessmentJwtTargetAcceptanceConclusionDocument {
        kind,
        incomplete_reason,
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn jwt_target_incomplete_reason_document(
    reason: JwtTargetAcceptanceIncompleteReason,
) -> AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
    match reason {
        JwtTargetAcceptanceIncompleteReason::NotEligible(reason) => {
            AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
                kind: "not_eligible",
                role: None,
                not_eligible_reason: Some(match reason {
                    JwtTargetAcceptanceNotEligibleReason::LocalParsingNotEstablished => {
                        "local_parsing_not_established"
                    },
                    JwtTargetAcceptanceNotEligibleReason::LocalPolicyNotEstablished => {
                        "local_policy_not_established"
                    },
                    JwtTargetAcceptanceNotEligibleReason::LocalSignatureNotEstablished => {
                        "local_signature_not_established"
                    },
                    JwtTargetAcceptanceNotEligibleReason::RuntimeAuthorityUnavailable => {
                        "runtime_authority_unavailable"
                    },
                    JwtTargetAcceptanceNotEligibleReason::RequestBudgetUnavailable => {
                        "request_budget_unavailable"
                    },
                }),
            }
        },
        JwtTargetAcceptanceIncompleteReason::LegNotDispatched { role } => {
            jwt_target_role_incomplete_reason("leg_not_dispatched", role)
        },
        JwtTargetAcceptanceIncompleteReason::LegNotCommitted { role } => {
            jwt_target_role_incomplete_reason("leg_not_committed", role)
        },
        JwtTargetAcceptanceIncompleteReason::ResponseIncomplete { role } => {
            jwt_target_role_incomplete_reason("response_incomplete", role)
        },
        JwtTargetAcceptanceIncompleteReason::ResponseNotClassified { role } => {
            jwt_target_role_incomplete_reason("response_not_classified", role)
        },
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn jwt_target_role_incomplete_reason(
    kind: &'static str,
    role: JwtTargetAcceptanceLegRole,
) -> AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
    AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
        kind,
        role: Some(jwt_target_role(role)),
        not_eligible_reason: None,
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn valid_jwt_target_evidence_reference(value: &str) -> bool {
    value.strip_prefix("jwt-target-leg:").is_some_and(|digest| {
        digest.len() == 64
            && digest
                .bytes()
                .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
    })
}

#[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
fn valid_jwt_target_preparation_reference(value: &str) -> bool {
    value
        .strip_prefix("jwt-target-preparation:")
        .is_some_and(|binding| {
            binding.len() == 64
                && binding
                    .bytes()
                    .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
        })
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
const JWT_PARSE_REJECTION_TOKENS: [&str; 17] = [
    "encrypted_token_unsupported",
    "invalid_segment_count",
    "empty_segment",
    "invalid_base64_url",
    "decoded_segment_too_large",
    "malformed_json",
    "duplicate_json_key",
    "json_limit_exceeded",
    "malformed_protected_header",
    "unsecured_algorithm_unsupported",
    "algorithm_unsupported",
    "critical_header_unsupported",
    "unencoded_payload_unsupported",
    "compression_unsupported",
    "nested_token_unsupported",
    "key_metadata_unsupported",
    "invalid_signature_length",
];

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
fn jwt_parse_rejection(reason: JwtParseRejection) -> &'static str {
    match reason {
        JwtParseRejection::EncryptedTokenUnsupported => "encrypted_token_unsupported",
        JwtParseRejection::InvalidSegmentCount => "invalid_segment_count",
        JwtParseRejection::EmptySegment => "empty_segment",
        JwtParseRejection::InvalidBase64Url => "invalid_base64_url",
        JwtParseRejection::DecodedSegmentTooLarge => "decoded_segment_too_large",
        JwtParseRejection::MalformedJson => "malformed_json",
        JwtParseRejection::DuplicateJsonKey => "duplicate_json_key",
        JwtParseRejection::JsonLimitExceeded => "json_limit_exceeded",
        JwtParseRejection::MalformedProtectedHeader => "malformed_protected_header",
        JwtParseRejection::UnsecuredAlgorithmUnsupported => "unsecured_algorithm_unsupported",
        JwtParseRejection::AlgorithmUnsupported => "algorithm_unsupported",
        JwtParseRejection::CriticalHeaderUnsupported => "critical_header_unsupported",
        JwtParseRejection::UnencodedPayloadUnsupported => "unencoded_payload_unsupported",
        JwtParseRejection::CompressionUnsupported => "compression_unsupported",
        JwtParseRejection::NestedTokenUnsupported => "nested_token_unsupported",
        JwtParseRejection::KeyMetadataUnsupported => "key_metadata_unsupported",
        JwtParseRejection::InvalidSignatureLength => "invalid_signature_length",
    }
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
fn jwt_policy_violation(violation: JwtPolicyViolation) -> AssessmentJwtPolicyViolationDocument {
    let (kind, ordinal) = match violation {
        JwtPolicyViolation::MissingType => ("missing_type", None),
        JwtPolicyViolation::TypeMismatch => ("type_mismatch", None),
        JwtPolicyViolation::MissingIssuer => ("missing_issuer", None),
        JwtPolicyViolation::InvalidIssuerType => ("invalid_issuer_type", None),
        JwtPolicyViolation::IssuerMismatch => ("issuer_mismatch", None),
        JwtPolicyViolation::MissingAudience => ("missing_audience", None),
        JwtPolicyViolation::InvalidAudienceType => ("invalid_audience_type", None),
        JwtPolicyViolation::AudienceMismatch => ("audience_mismatch", None),
        JwtPolicyViolation::MissingRequiredClaim { ordinal } => {
            ("missing_required_claim", Some(u64::from(ordinal)))
        },
        JwtPolicyViolation::MissingExpiration => ("missing_expiration", None),
        JwtPolicyViolation::InvalidExpiration => ("invalid_expiration", None),
        JwtPolicyViolation::Expired => ("expired", None),
        JwtPolicyViolation::InvalidNotBefore => ("invalid_not_before", None),
        JwtPolicyViolation::NotYetValid => ("not_yet_valid", None),
    };
    AssessmentJwtPolicyViolationDocument { kind, ordinal }
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
fn valid_jwt_policy_reference(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= 64
        && value.bytes().enumerate().all(|(index, byte)| {
            byte.is_ascii_lowercase()
                || byte.is_ascii_digit()
                || (index > 0 && matches!(byte, b'-' | b'_' | b'.'))
        })
}

#[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
fn valid_jwt_public_key_sha256(value: &str) -> bool {
    value.strip_prefix("sha256:").is_some_and(|digest| {
        digest.len() == 64
            && digest
                .bytes()
                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
    })
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
#[derive(Serialize)]
struct AssessmentControlReferenceMappingAuditDocument {
    schema: &'static str,
    policy: &'static str,
    selected: bool,
    catalogue: AssessmentControlReferenceCatalogueDocument,
    sources: Vec<AssessmentControlReferenceSourceDocument>,
    coverage: AssessmentControlReferenceCoverageDocument,
    external_activity: AssessmentControlReferenceExternalActivityDocument,
    claim_limits: AssessmentControlReferenceClaimLimitsDocument,
    relationships: Vec<AssessmentControlReferenceRelationshipDocument>,
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
#[derive(Serialize)]
struct AssessmentControlReferenceCatalogueDocument {
    id: &'static str,
    revision: &'static str,
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
#[derive(Serialize)]
struct AssessmentControlReferenceSourceDocument {
    source_id: &'static str,
    framework_id: &'static str,
    edition: &'static str,
    revision_or_amendment: Option<&'static str>,
    authority_kind: &'static str,
    source_url: &'static str,
    source_verified_at: &'static str,
    mapping_availability: &'static str,
    rights_basis: &'static str,
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
#[derive(Serialize)]
struct AssessmentControlReferenceCoverageDocument {
    considered_item_count: u64,
    mapped_item_count: u64,
    unmapped_item_count: u64,
    relationship_count: u64,
    reference_link_count: u64,
    omitted_item_count: u64,
    omitted_reference_link_count: u64,
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
#[derive(Serialize)]
struct AssessmentControlReferenceExternalActivityDocument {
    target_request_count: u64,
    provider_request_count: u64,
    source_retrieval: &'static str,
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
#[derive(Serialize)]
struct AssessmentControlReferenceClaimLimitsDocument {
    control_assessment: &'static str,
    compliance: &'static str,
    certification: &'static str,
    legal_conclusion: &'static str,
    source_authentication: &'static str,
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
#[derive(Serialize)]
struct AssessmentControlReferenceRelationshipDocument {
    item_fingerprint: String,
    capability_id: String,
    cwe: Option<String>,
    item_basis: &'static str,
    references: Vec<AssessmentControlReferenceLinkDocument>,
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
#[derive(Serialize)]
struct AssessmentControlReferenceLinkDocument {
    rule_id: &'static str,
    source_id: &'static str,
    framework_id: &'static str,
    edition: &'static str,
    control_reference: &'static str,
    control_title: Option<&'static str>,
    mapping_basis: &'static str,
    applicability: &'static str,
    applicability_condition: &'static str,
    assurance: &'static str,
    original_mapping_rationale: &'static str,
}

#[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
impl AssessmentControlReferenceMappingAuditDocument {
    fn from_audit(audit: &ControlReferenceMappingAudit) -> Result<Self, ReportError> {
        let mut sources = audit
            .sources()
            .iter()
            .map(|source| AssessmentControlReferenceSourceDocument {
                source_id: source.source_id(),
                framework_id: source.framework_id(),
                edition: source.edition(),
                revision_or_amendment: source.revision_or_amendment(),
                authority_kind: source.authority_kind().as_str(),
                source_url: source.source_url(),
                source_verified_at: source.source_verified_at(),
                mapping_availability: source.mapping_availability().as_str(),
                rights_basis: source.rights_basis().as_str(),
            })
            .collect::<Vec<_>>();
        sources.sort_by(|left, right| left.source_id.cmp(right.source_id));

        let mut relationships = Vec::with_capacity(audit.relationships().len());
        for relationship in audit.relationships() {
            let mut references = Vec::with_capacity(relationship.references().len());
            for reference in relationship.references() {
                let source = sources
                    .iter()
                    .find(|source| source.source_id == reference.source_id())
                    .ok_or(ReportError::Serialization)?;
                if source.framework_id != reference.framework_id() {
                    return Err(ReportError::Serialization);
                }
                references.push(AssessmentControlReferenceLinkDocument {
                    rule_id: reference.rule_id(),
                    source_id: reference.source_id(),
                    framework_id: reference.framework_id(),
                    edition: source.edition,
                    control_reference: reference.control_reference(),
                    control_title: reference.control_title(),
                    mapping_basis: reference.mapping_basis().as_str(),
                    applicability: reference.applicability().as_str(),
                    applicability_condition: reference.applicability_condition(),
                    assurance: reference.assurance().as_str(),
                    original_mapping_rationale: reference.original_mapping_rationale(),
                });
            }
            references.sort_by(|left, right| {
                left.rule_id
                    .cmp(right.rule_id)
                    .then(left.source_id.cmp(right.source_id))
                    .then(left.edition.cmp(right.edition))
                    .then(left.control_reference.cmp(right.control_reference))
            });
            relationships.push(AssessmentControlReferenceRelationshipDocument {
                item_fingerprint: relationship.item_fingerprint().to_owned(),
                capability_id: relationship.capability_id().to_owned(),
                cwe: relationship.cwe().map(str::to_owned),
                item_basis: relationship.item_basis().as_str(),
                references,
            });
        }
        relationships.sort_by(|left, right| {
            left.item_fingerprint
                .cmp(&right.item_fingerprint)
                .then(left.capability_id.cmp(&right.capability_id))
        });
        let external = audit.external_activity();
        let claims = audit.claim_limits();
        Ok(Self {
            schema: audit.schema(),
            policy: audit.policy_id(),
            selected: audit.selected(),
            catalogue: AssessmentControlReferenceCatalogueDocument {
                id: audit.catalogue_id(),
                revision: audit.catalogue_revision(),
            },
            sources,
            coverage: AssessmentControlReferenceCoverageDocument {
                considered_item_count: u64::try_from(audit.considered_item_count())
                    .map_err(|_| ReportError::Serialization)?,
                mapped_item_count: u64::try_from(audit.mapped_item_count())
                    .map_err(|_| ReportError::Serialization)?,
                unmapped_item_count: u64::try_from(audit.unmapped_item_count())
                    .map_err(|_| ReportError::Serialization)?,
                relationship_count: u64::try_from(audit.relationship_count())
                    .map_err(|_| ReportError::Serialization)?,
                reference_link_count: u64::try_from(audit.reference_link_count())
                    .map_err(|_| ReportError::Serialization)?,
                omitted_item_count: u64::try_from(audit.omitted_item_count())
                    .map_err(|_| ReportError::Serialization)?,
                omitted_reference_link_count: u64::try_from(audit.omitted_reference_link_count())
                    .map_err(|_| ReportError::Serialization)?,
            },
            external_activity: AssessmentControlReferenceExternalActivityDocument {
                target_request_count: external.target_request_count(),
                provider_request_count: external.provider_request_count(),
                source_retrieval: external.source_retrieval().as_str(),
            },
            claim_limits: AssessmentControlReferenceClaimLimitsDocument {
                control_assessment: claims.control_assessment().as_str(),
                compliance: claims.compliance().as_str(),
                certification: claims.certification().as_str(),
                legal_conclusion: claims.legal_conclusion().as_str(),
                source_authentication: claims.source_authentication().as_str(),
            },
            relationships,
        })
    }

    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        let considered = u64::try_from(items.len()).map_err(|_| ReportError::Serialization)?;
        let partition = self
            .coverage
            .mapped_item_count
            .checked_add(self.coverage.unmapped_item_count)
            .and_then(|count| count.checked_add(self.coverage.omitted_item_count));
        let reference_count = self.relationships.iter().try_fold(0_u64, |sum, row| {
            u64::try_from(row.references.len())
                .ok()
                .and_then(|count| sum.checked_add(count))
        });
        let mut source_ids = std::collections::BTreeSet::new();
        let sources_valid = self.sources.len() == 5
            && self.sources.iter().all(|source| {
                source_ids.insert(source.source_id)
                    && !source.source_id.is_empty()
                    && !source.framework_id.is_empty()
                    && !source.edition.is_empty()
                    && is_strict_https_reference(source.source_url)
                    && source.source_verified_at == "2026-09-20"
                    && matches!(
                        source.mapping_availability,
                        "reviewed_identifiers_and_titles"
                            | "bibliographic_only_rights_deferred"
                            | "relevant_technical_context_only"
                    )
            });
        let mut mapped_fingerprints = std::collections::BTreeSet::new();
        let relationships_valid = self.relationships.iter().all(|relationship| {
            let source_item = items.iter().find(|item| {
                item.fingerprint == relationship.item_fingerprint
                    && item.capability_id == relationship.capability_id
                    && item.cwe == relationship.cwe.as_deref()
                    && item.claim_basis == relationship.item_basis
            });
            let mut references = std::collections::BTreeSet::new();
            source_item.is_some()
                && mapped_fingerprints.insert(relationship.item_fingerprint.as_str())
                && !relationship.references.is_empty()
                && relationship.references.len() <= 8
                && relationship.references.iter().all(|reference| {
                    self.sources.iter().any(|source| {
                        source.source_id == reference.source_id
                            && source.framework_id == reference.framework_id
                            && source.edition == reference.edition
                            && source.mapping_availability != "bibliographic_only_rights_deferred"
                    }) && references.insert((
                        reference.rule_id,
                        reference.source_id,
                        reference.edition,
                        reference.control_reference,
                    )) && !reference.rule_id.is_empty()
                        && !reference.control_reference.is_empty()
                        && !reference.applicability_condition.is_empty()
                        && !reference.original_mapping_rationale.is_empty()
                        && matches!(
                            reference.mapping_basis,
                            "exact_capability_cwe_and_assessment_basis"
                                | "exact_capability_and_assessment_basis"
                        )
                        && matches!(
                            reference.applicability,
                            "conditional_technical_context" | "applicability_unestablished"
                        )
                        && matches!(
                            reference.assurance,
                            "reviewed_primary_source_identifier" | "relevant_technical_context"
                        )
                })
        });
        if self.schema != CONTROL_REFERENCE_MAPPING_AUDIT_SCHEMA
            || self.policy != CONTROL_REFERENCE_MAPPING_POLICY_ID
            || !self.selected
            || self.catalogue.id != CONTROL_REFERENCE_MAPPING_CATALOGUE_ID
            || self.catalogue.revision != CONTROL_REFERENCE_MAPPING_CATALOGUE_REVISION
            || self.coverage.considered_item_count != considered
            || self.coverage.relationship_count
                != u64::try_from(self.relationships.len())
                    .map_err(|_| ReportError::Serialization)?
            || self.coverage.mapped_item_count != self.coverage.relationship_count
            || partition != Some(self.coverage.considered_item_count)
            || self.coverage.omitted_item_count != 0
            || self.coverage.omitted_reference_link_count != 0
            || reference_count != Some(self.coverage.reference_link_count)
            || self.coverage.reference_link_count > 16_384
            || !sources_valid
            || !relationships_valid
            || self.external_activity.target_request_count != 0
            || self.external_activity.provider_request_count != 0
            || self.external_activity.source_retrieval != "not_performed"
            || self.claim_limits.control_assessment != "not_performed"
            || self.claim_limits.compliance != "not_established"
            || self.claim_limits.certification != "not_established"
            || self.claim_limits.legal_conclusion != "not_established"
            || self.claim_limits.source_authentication != "not_established"
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> [(&'static str, String); 13] {
        [
            ("Audit schema", self.schema.to_owned()),
            ("Policy", self.policy.to_owned()),
            ("Catalogue", self.catalogue.id.to_owned()),
            ("Catalogue revision", self.catalogue.revision.to_owned()),
            ("Reviewed sources", self.sources.len().to_string()),
            (
                "Items considered",
                self.coverage.considered_item_count.to_string(),
            ),
            ("Items mapped", self.coverage.mapped_item_count.to_string()),
            (
                "Items without an exact mapping",
                self.coverage.unmapped_item_count.to_string(),
            ),
            (
                "Reference links",
                self.coverage.reference_link_count.to_string(),
            ),
            (
                "Additional target requests",
                self.external_activity.target_request_count.to_string(),
            ),
            (
                "Provider requests",
                self.external_activity.provider_request_count.to_string(),
            ),
            (
                "Compliance determination",
                self.claim_limits.compliance.to_owned(),
            ),
            (
                "Legal conclusion",
                self.claim_limits.legal_conclusion.to_owned(),
            ),
        ]
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
#[derive(Serialize)]
struct AssessmentReconCertSpotterAuditDocument {
    schema: &'static str,
    policy: &'static str,
    selected: bool,
    provider: AssessmentReconCertSpotterProviderDocument,
    methodology: AssessmentReconCertSpotterMethodologyDocument,
    coverage: AssessmentReconCertSpotterCoverageDocument,
    hypotheses: Vec<AssessmentReconCertSpotterHypothesisDocument>,
    claim_limits: [&'static str; 5],
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
#[derive(Serialize)]
struct AssessmentReconCertSpotterProviderDocument {
    name: &'static str,
    policy_schema: &'static str,
    policy_revision: String,
    query_domain: String,
    query_reference: String,
    execution_mode: &'static str,
    origin: String,
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
#[derive(Serialize)]
struct AssessmentReconCertSpotterMethodologyDocument {
    request_path: &'static str,
    pagination: &'static str,
    retries: &'static str,
    polling: &'static str,
    credentials: &'static str,
    maximum_pages: u64,
    maximum_response_page_bytes: u64,
    maximum_response_bytes: u64,
    maximum_elapsed_milliseconds: u64,
    maximum_in_flight_requests: u64,
    maximum_retained_names: u64,
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
#[derive(Serialize)]
struct AssessmentReconCertSpotterCoverageDocument {
    terminal: &'static str,
    completeness: &'static str,
    first_failure: Option<&'static str>,
    initial_after_reference: Option<String>,
    initial_after_byte_length: Option<u64>,
    last_cursor_reference: Option<String>,
    last_cursor_byte_length: Option<u64>,
    request_attempt_count: u64,
    request_admitted_count: u64,
    response_completed_count: u64,
    observed_response_bytes: u64,
    accepted_page_count: u64,
    accepted_response_bytes: u64,
    issuance_count: u64,
    retained_name_count: u64,
    foreign_name_count: u64,
    duplicate_name_count: u64,
    omitted_name_count: u64,
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
#[derive(Serialize)]
struct AssessmentReconCertSpotterHypothesisDocument {
    name: String,
    source: AssessmentReconCertSpotterHypothesisSourceDocument,
    claim_limits: [&'static str; 5],
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
#[derive(Serialize)]
struct AssessmentReconCertSpotterHypothesisSourceDocument {
    provider: &'static str,
    origin: String,
    first_issuance_reference: String,
    first_issuance_byte_length: u64,
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
impl AssessmentReconCertSpotterHypothesisDocument {
    fn presentation(&self) -> String {
        format!(
            "name={};source_provider={};source_origin={};first_issuance_reference={};first_issuance_byte_length={};claim_limits={}",
            self.name,
            self.source.provider,
            self.source.origin,
            self.source.first_issuance_reference,
            self.source.first_issuance_byte_length,
            self.claim_limits.join(","),
        )
    }
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
impl AssessmentReconCertSpotterAuditDocument {
    fn from_audit(audit: &WebAssessmentReconCtProviderAudit) -> Result<Self, ReportError> {
        if !audit.is_consistent() {
            return Err(ReportError::Serialization);
        }
        let result = audit.result();
        let collection = result.audit();
        if !result
            .claim_limits()
            .iter()
            .map(|limit| limit.as_str())
            .eq(RECON_CERTSPOTTER_CLAIM_LIMITS)
            || result.hypotheses().iter().any(|hypothesis| {
                !hypothesis
                    .claim_limits()
                    .iter()
                    .map(|limit| limit.as_str())
                    .eq(RECON_CERTSPOTTER_CLAIM_LIMITS)
            })
        {
            return Err(ReportError::Serialization);
        }
        let hypotheses = result
            .hypotheses()
            .iter()
            .map(|hypothesis| {
                let (first_issuance_reference, first_issuance_byte_length) =
                    recon_certspotter_issuance_reference(hypothesis.first_issuance_id())?;
                Ok(AssessmentReconCertSpotterHypothesisDocument {
                    name: hypothesis.name().to_owned(),
                    source: AssessmentReconCertSpotterHypothesisSourceDocument {
                        provider: RECON_CERTSPOTTER_PROVIDER,
                        origin: collection.provider_origin().to_owned(),
                        first_issuance_reference,
                        first_issuance_byte_length,
                    },
                    claim_limits: RECON_CERTSPOTTER_CLAIM_LIMITS,
                })
            })
            .collect::<Result<Vec<_>, ReportError>>()?;
        let (initial_after_reference, initial_after_byte_length) =
            recon_certspotter_optional_issuance_reference(collection.initial_after())?;
        let (last_cursor_reference, last_cursor_byte_length) =
            recon_certspotter_optional_issuance_reference(collection.last_cursor())?;
        let document = Self {
            schema: RECON_CERTSPOTTER_AUDIT_SCHEMA,
            policy: RECON_CERTSPOTTER_POLICY_ID,
            selected: true,
            provider: AssessmentReconCertSpotterProviderDocument {
                name: RECON_CERTSPOTTER_PROVIDER,
                policy_schema: collection.schema(),
                policy_revision: collection.policy_revision().to_owned(),
                query_domain: collection.query_domain().to_owned(),
                query_reference: collection.query_reference().to_owned(),
                execution_mode: collection.execution_mode().as_str(),
                origin: collection.provider_origin().to_owned(),
            },
            methodology: AssessmentReconCertSpotterMethodologyDocument {
                request_path: "/v1/issuances",
                pagination: "after_cursor",
                retries: "none",
                polling: "none",
                credentials: "none",
                maximum_pages: u64::try_from(collection.maximum_pages())
                    .map_err(|_| ReportError::Serialization)?,
                maximum_response_page_bytes: u64::try_from(MAX_CERT_SPOTTER_RESPONSE_PAGE_BYTES)
                    .map_err(|_| ReportError::Serialization)?,
                maximum_response_bytes: u64::try_from(collection.maximum_response_bytes())
                    .map_err(|_| ReportError::Serialization)?,
                maximum_elapsed_milliseconds: u64::try_from(
                    collection.maximum_elapsed().as_millis(),
                )
                .map_err(|_| ReportError::Serialization)?,
                maximum_in_flight_requests: u64::try_from(collection.maximum_in_flight_requests())
                    .map_err(|_| ReportError::Serialization)?,
                maximum_retained_names: u64::try_from(MAX_CERT_SPOTTER_RETAINED_NAMES)
                    .map_err(|_| ReportError::Serialization)?,
            },
            coverage: AssessmentReconCertSpotterCoverageDocument {
                terminal: collection.terminal().as_str(),
                completeness: collection.completeness().as_str(),
                first_failure: audit.first_failure().map(|failure| failure.as_str()),
                initial_after_reference,
                initial_after_byte_length,
                last_cursor_reference,
                last_cursor_byte_length,
                request_attempt_count: u64::try_from(audit.request_attempt_count())
                    .map_err(|_| ReportError::Serialization)?,
                request_admitted_count: u64::try_from(audit.request_admitted_count())
                    .map_err(|_| ReportError::Serialization)?,
                response_completed_count: u64::try_from(audit.response_completed_count())
                    .map_err(|_| ReportError::Serialization)?,
                observed_response_bytes: audit.observed_response_bytes(),
                accepted_page_count: u64::try_from(collection.page_count())
                    .map_err(|_| ReportError::Serialization)?,
                accepted_response_bytes: u64::try_from(collection.response_bytes())
                    .map_err(|_| ReportError::Serialization)?,
                issuance_count: u64::try_from(collection.issuance_count())
                    .map_err(|_| ReportError::Serialization)?,
                retained_name_count: u64::try_from(collection.retained_name_count())
                    .map_err(|_| ReportError::Serialization)?,
                foreign_name_count: u64::try_from(collection.foreign_name_count())
                    .map_err(|_| ReportError::Serialization)?,
                duplicate_name_count: u64::try_from(collection.duplicate_name_count())
                    .map_err(|_| ReportError::Serialization)?,
                omitted_name_count: u64::try_from(collection.omitted_name_count())
                    .map_err(|_| ReportError::Serialization)?,
            },
            hypotheses,
            claim_limits: RECON_CERTSPOTTER_CLAIM_LIMITS,
        };
        document.validate()?;
        Ok(document)
    }

    fn validate(&self) -> Result<(), ReportError> {
        const MAX_ISSUANCES: u64 = 8_192;
        const MAX_ISSUANCES_PER_PAGE: u64 = 4_096;
        const MAX_NAME_EVENTS: u64 = 65_536;

        let coverage = &self.coverage;
        let mut names = std::collections::BTreeSet::new();
        let mut identities = std::collections::BTreeSet::new();
        let hypotheses_are_valid = self.hypotheses.iter().all(|hypothesis| {
            names.insert(hypothesis.name.as_str())
                && identities.insert((
                    hypothesis.name.as_str(),
                    hypothesis.source.provider,
                    hypothesis.source.origin.as_str(),
                    hypothesis.source.first_issuance_reference.as_str(),
                    hypothesis.source.first_issuance_byte_length,
                ))
                && valid_recon_certspotter_name(&hypothesis.name, &self.provider.query_domain)
                && hypothesis.source.provider == self.provider.name
                && hypothesis.source.origin == self.provider.origin
                && valid_recon_certspotter_issuance_reference(
                    &hypothesis.source.first_issuance_reference,
                )
                && valid_recon_certspotter_issuance_byte_length(
                    hypothesis.source.first_issuance_byte_length,
                )
                && hypothesis.claim_limits == RECON_CERTSPOTTER_CLAIM_LIMITS
        });
        let retained_count =
            u64::try_from(self.hypotheses.len()).map_err(|_| ReportError::Serialization)?;
        let total_name_events = coverage
            .retained_name_count
            .checked_add(coverage.foreign_name_count)
            .and_then(|count| count.checked_add(coverage.duplicate_name_count))
            .and_then(|count| count.checked_add(coverage.omitted_name_count));
        let request_counts_are_valid = coverage.request_admitted_count
            <= coverage.request_attempt_count
            && coverage.request_attempt_count <= self.methodology.maximum_pages
            && coverage.response_completed_count <= coverage.request_admitted_count
            && coverage.accepted_page_count <= coverage.response_completed_count;
        let completed_collection_accounting_is_exact = coverage.request_attempt_count
            == coverage.accepted_page_count
            && coverage.request_admitted_count == coverage.accepted_page_count
            && coverage.response_completed_count == coverage.accepted_page_count
            && coverage.observed_response_bytes == coverage.accepted_response_bytes;
        let terminal_is_valid = match coverage.terminal {
            "provider_exhausted" => {
                coverage.completeness == "provider_exhausted_as_observed"
                    && coverage.first_failure.is_none()
                    && coverage.accepted_page_count > 0
                    && completed_collection_accounting_is_exact
            },
            "hypothesis_limit_reached" => {
                coverage.completeness == "bounded_partial"
                    && coverage.first_failure.is_none()
                    && coverage.retained_name_count == self.methodology.maximum_retained_names
                    && completed_collection_accounting_is_exact
            },
            "page_limit_reached" => {
                coverage.completeness == "bounded_partial"
                    && coverage.first_failure.is_none()
                    && coverage.accepted_page_count == self.methodology.maximum_pages
                    && completed_collection_accounting_is_exact
            },
            "deadline_reached" => {
                coverage.completeness == "unknown"
                    && coverage.first_failure == Some("deadline_reached")
                    && coverage.accepted_page_count < self.methodology.maximum_pages
            },
            "parent_authority_unavailable" => {
                coverage.completeness == "unknown"
                    && coverage.first_failure == Some("parent_authority_unavailable")
                    && coverage.accepted_page_count < self.methodology.maximum_pages
            },
            "cancelled" => {
                coverage.completeness == "unknown"
                    && coverage.first_failure == Some("cancelled")
                    && coverage.accepted_page_count < self.methodology.maximum_pages
            },
            "transport_failed" => {
                coverage.completeness == "unknown"
                    && coverage
                        .first_failure
                        .is_some_and(valid_recon_certspotter_transport_failure)
                    && coverage.accepted_page_count < self.methodology.maximum_pages
            },
            _ => false,
        };
        let issuance_capacity = coverage
            .accepted_page_count
            .checked_mul(MAX_ISSUANCES_PER_PAGE);
        let zero_issuance_accounting_is_empty = coverage.issuance_count != 0
            || (coverage.retained_name_count == 0
                && coverage.foreign_name_count == 0
                && coverage.duplicate_name_count == 0
                && coverage.omitted_name_count == 0);
        if self.schema != RECON_CERTSPOTTER_AUDIT_SCHEMA
            || self.policy != RECON_CERTSPOTTER_POLICY_ID
            || !self.selected
            || self.provider.name != RECON_CERTSPOTTER_PROVIDER
            || self.provider.policy_schema != "security.recon-certspotter-policy/v1"
            || !valid_recon_certspotter_opaque(&self.provider.policy_revision)
            || !valid_recon_certspotter_query_domain(&self.provider.query_domain)
            || !valid_recon_certspotter_opaque(&self.provider.query_reference)
            || !valid_recon_certspotter_origin(self.provider.execution_mode, &self.provider.origin)
            || self.methodology.request_path != "/v1/issuances"
            || self.methodology.pagination != "after_cursor"
            || self.methodology.retries != "none"
            || self.methodology.polling != "none"
            || self.methodology.credentials != "none"
            || self.methodology.maximum_pages != MAX_CERT_SPOTTER_RESPONSE_PAGES as u64
            || self.methodology.maximum_response_page_bytes
                != MAX_CERT_SPOTTER_RESPONSE_PAGE_BYTES as u64
            || self.methodology.maximum_response_bytes
                != MAX_CERT_SPOTTER_TOTAL_RESPONSE_BYTES as u64
            || self.methodology.maximum_elapsed_milliseconds
                != MAX_CERT_SPOTTER_ELAPSED.as_millis() as u64
            || self.methodology.maximum_in_flight_requests
                != MAX_CERT_SPOTTER_IN_FLIGHT_REQUESTS as u64
            || self.methodology.maximum_retained_names != MAX_CERT_SPOTTER_RETAINED_NAMES as u64
            || self.claim_limits != RECON_CERTSPOTTER_CLAIM_LIMITS
            || !hypotheses_are_valid
            || retained_count != coverage.retained_name_count
            || coverage.retained_name_count > self.methodology.maximum_retained_names
            || coverage.accepted_page_count > self.methodology.maximum_pages
            || coverage.accepted_response_bytes > self.methodology.maximum_response_bytes
            || coverage.accepted_response_bytes > coverage.observed_response_bytes
            || coverage.issuance_count > MAX_ISSUANCES
            || issuance_capacity.is_none_or(|capacity| coverage.issuance_count > capacity)
            || !zero_issuance_accounting_is_empty
            || total_name_events.is_none_or(|count| count > MAX_NAME_EVENTS)
            || !request_counts_are_valid
            || !terminal_is_valid
            || coverage.initial_after_reference.is_some()
            || coverage.initial_after_byte_length.is_some()
            || !valid_recon_certspotter_optional_issuance_reference(
                coverage.last_cursor_reference.as_deref(),
                coverage.last_cursor_byte_length,
            )
            || (coverage.issuance_count == 0) != coverage.last_cursor_reference.is_none()
            || (coverage.accepted_page_count == 0) != (coverage.accepted_response_bytes == 0)
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> [(&'static str, String); 19] {
        [
            ("Audit schema", self.schema.to_owned()),
            ("Policy", self.policy.to_owned()),
            ("Provider", self.provider.name.to_owned()),
            ("Provider origin", self.provider.origin.clone()),
            ("Execution mode", self.provider.execution_mode.to_owned()),
            ("Policy schema", self.provider.policy_schema.to_owned()),
            ("Policy revision", self.provider.policy_revision.clone()),
            ("Query domain", self.provider.query_domain.clone()),
            ("Query reference", self.provider.query_reference.clone()),
            ("Terminal", self.coverage.terminal.to_owned()),
            ("Completeness", self.coverage.completeness.to_owned()),
            (
                "First failure",
                self.coverage.first_failure.unwrap_or("none").to_owned(),
            ),
            (
                "Request attempts",
                self.coverage.request_attempt_count.to_string(),
            ),
            (
                "Requests admitted",
                self.coverage.request_admitted_count.to_string(),
            ),
            (
                "Responses completed",
                self.coverage.response_completed_count.to_string(),
            ),
            (
                "Observed response bytes",
                self.coverage.observed_response_bytes.to_string(),
            ),
            (
                "Accepted provider pages",
                self.coverage.accepted_page_count.to_string(),
            ),
            (
                "Retained hypotheses",
                self.coverage.retained_name_count.to_string(),
            ),
            ("Claim limits", self.claim_limits.join(",")),
        ]
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_opaque(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= 128
        && value.as_bytes()[0].is_ascii_alphanumeric()
        && value
            .bytes()
            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'+' | b'-'))
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_query_domain(value: &str) -> bool {
    value.contains('.')
        && !value.starts_with("*.")
        && value.parse::<std::net::IpAddr>().is_err()
        && valid_recon_certspotter_dns_name(value)
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_name(value: &str, query_domain: &str) -> bool {
    let bare = value.strip_prefix("*.").unwrap_or(value);
    valid_recon_certspotter_dns_name(bare)
        && bare.parse::<std::net::IpAddr>().is_err()
        && (bare == query_domain
            || bare
                .strip_suffix(query_domain)
                .is_some_and(|prefix| prefix.ends_with('.') && prefix.len() > 1))
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_dns_name(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= 253
        && value.is_ascii()
        && value == value.to_ascii_lowercase()
        && !value.starts_with('.')
        && !value.ends_with('.')
        && value.split('.').all(|label| {
            !label.is_empty()
                && label.len() <= 63
                && label.as_bytes()[0].is_ascii_alphanumeric()
                && label.as_bytes()[label.len() - 1].is_ascii_alphanumeric()
                && label
                    .bytes()
                    .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
        })
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_issuance_id(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= MAX_RECON_CERTSPOTTER_ISSUANCE_ID_BYTES
        && !value.chars().any(char::is_control)
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn recon_certspotter_issuance_reference(value: &str) -> Result<(String, u64), ReportError> {
    if !valid_recon_certspotter_issuance_id(value) {
        return Err(ReportError::Serialization);
    }
    let byte_length = u64::try_from(value.len()).map_err(|_| ReportError::Serialization)?;
    Ok((
        format!(
            "{RECON_CERTSPOTTER_ISSUANCE_REFERENCE_PREFIX}{:x}",
            Sha256::digest(value.as_bytes())
        ),
        byte_length,
    ))
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn recon_certspotter_optional_issuance_reference(
    value: Option<&str>,
) -> Result<(Option<String>, Option<u64>), ReportError> {
    value
        .map(recon_certspotter_issuance_reference)
        .transpose()
        .map(|parts| match parts {
            Some((reference, byte_length)) => (Some(reference), Some(byte_length)),
            None => (None, None),
        })
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_issuance_reference(value: &str) -> bool {
    value
        .strip_prefix(RECON_CERTSPOTTER_ISSUANCE_REFERENCE_PREFIX)
        .is_some_and(|digest| {
            digest.len() == 64
                && digest
                    .bytes()
                    .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
        })
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_issuance_byte_length(value: u64) -> bool {
    (1..=MAX_RECON_CERTSPOTTER_ISSUANCE_ID_BYTES as u64).contains(&value)
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_optional_issuance_reference(
    reference: Option<&str>,
    byte_length: Option<u64>,
) -> bool {
    match (reference, byte_length) {
        (Some(reference), Some(byte_length)) => {
            valid_recon_certspotter_issuance_reference(reference)
                && valid_recon_certspotter_issuance_byte_length(byte_length)
        },
        (None, None) => true,
        _ => false,
    }
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_origin(mode: &str, origin: &str) -> bool {
    if mode == "production" {
        return origin == "https://api.certspotter.com";
    }
    if mode != "owned_loopback_fixture" || origin.is_empty() || origin.len() > 256 {
        return false;
    }
    let Ok(parsed) = url::Url::parse(origin) else {
        return false;
    };
    parsed.scheme() == "http"
        && parsed.username().is_empty()
        && parsed.password().is_none()
        && parsed.port().is_some_and(|port| port > 0)
        && parsed.path() == "/"
        && parsed.query().is_none()
        && parsed.fragment().is_none()
        && parsed.host().is_some_and(|host| match host {
            url::Host::Ipv4(address) => address.is_loopback(),
            url::Host::Ipv6(address) => address.is_loopback(),
            url::Host::Domain(_) => false,
        })
        && parsed.origin().ascii_serialization() == origin
}

#[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
fn valid_recon_certspotter_transport_failure(value: &str) -> bool {
    matches!(
        value,
        "client_initialization"
            | "request_construction"
            | "transport_failed"
            | "redirect_refused"
            | "access_rejected"
            | "throttled"
            | "provider_not_found"
            | "server_failure"
            | "unexpected_status"
            | "unsupported_media"
            | "unsupported_content_coding"
            | "response_too_large"
            | "invalid_response"
    )
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
struct AssessmentReconSnapshotImportAuditDocument {
    schema: &'static str,
    policy: &'static str,
    selected: bool,
    input: AssessmentReconSnapshotInputDocument,
    snapshot: AssessmentReconSnapshotIdentityDocument,
    sources: Vec<AssessmentReconSnapshotSourceDocument>,
    records: Vec<AssessmentReconSnapshotRecordDocument>,
    accounting: AssessmentReconSnapshotAccountingDocument,
    external_activity: AssessmentReconSnapshotExternalActivityDocument,
    claim_limits: AssessmentReconSnapshotClaimLimitsDocument,
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
struct AssessmentReconSnapshotInputDocument {
    source_schema: &'static str,
    byte_length: u64,
    sha256: String,
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
struct AssessmentReconSnapshotIdentityDocument {
    id: String,
    revision: String,
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
struct AssessmentReconSnapshotSourceDocument {
    source_id: String,
    namespace: String,
    revision: String,
    provider_time: Option<String>,
    observed_time: String,
    collection_method: String,
    completeness: &'static str,
    origin: String,
    rights: AssessmentReconSnapshotRightsDocument,
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
struct AssessmentReconSnapshotRightsDocument {
    status: &'static str,
    attribution: Option<String>,
    notice: Option<String>,
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
#[serde(tag = "kind", rename_all = "snake_case")]
enum AssessmentReconSnapshotRecordDocument {
    CtName {
        record_id: String,
        source_ids: Vec<String>,
        name: String,
    },
    DnsHistory {
        record_id: String,
        source_ids: Vec<String>,
        name: String,
        address: String,
    },
    ServiceBannerProduct {
        record_id: String,
        source_ids: Vec<String>,
        host: String,
        port: u16,
        transport: &'static str,
        product: String,
        version: Option<String>,
    },
    ReputationLabel {
        record_id: String,
        source_ids: Vec<String>,
        subject: String,
        label: String,
    },
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
impl AssessmentReconSnapshotRecordDocument {
    fn record_id(&self) -> &str {
        match self {
            Self::CtName { record_id, .. }
            | Self::DnsHistory { record_id, .. }
            | Self::ServiceBannerProduct { record_id, .. }
            | Self::ReputationLabel { record_id, .. } => record_id,
        }
    }

    fn source_ids(&self) -> &[String] {
        match self {
            Self::CtName { source_ids, .. }
            | Self::DnsHistory { source_ids, .. }
            | Self::ServiceBannerProduct { source_ids, .. }
            | Self::ReputationLabel { source_ids, .. } => source_ids,
        }
    }

    fn kind(&self) -> &'static str {
        match self {
            Self::CtName { .. } => "ct_name",
            Self::DnsHistory { .. } => "dns_history",
            Self::ServiceBannerProduct { .. } => "service_banner_product",
            Self::ReputationLabel { .. } => "reputation_label",
        }
    }

    fn presentation(&self) -> String {
        match self {
            Self::CtName {
                record_id,
                source_ids,
                name,
            } => format!(
                "record_id={record_id};kind=ct_name;source_ids={};name={name}",
                source_ids.join(",")
            ),
            Self::DnsHistory {
                record_id,
                source_ids,
                name,
                address,
            } => format!(
                "record_id={record_id};kind=dns_history;source_ids={};name={name};address={address}",
                source_ids.join(",")
            ),
            Self::ServiceBannerProduct {
                record_id,
                source_ids,
                host,
                port,
                transport,
                product,
                version,
            } => format!(
                "record_id={record_id};kind=service_banner_product;source_ids={};host={host};port={port};transport={transport};product={product};version={}",
                source_ids.join(","),
                version.as_deref().unwrap_or("not_declared")
            ),
            Self::ReputationLabel {
                record_id,
                source_ids,
                subject,
                label,
            } => format!(
                "record_id={record_id};kind=reputation_label;source_ids={};subject={subject};label={label}",
                source_ids.join(",")
            ),
        }
    }
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
struct AssessmentReconSnapshotAccountingDocument {
    source_count: u64,
    record_count: u64,
    source_association_count: u64,
    prepared_index_bytes: u64,
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
struct AssessmentReconSnapshotExternalActivityDocument {
    target_request_count: u64,
    provider_request_count: u64,
    archive_processing: &'static str,
    decompression: &'static str,
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
#[derive(Serialize)]
struct AssessmentReconSnapshotClaimLimitsDocument {
    record_interpretation: &'static str,
    source_authentication: &'static str,
    asset_ownership: &'static str,
    current_reachability: &'static str,
    scan_authority: &'static str,
    vulnerability: &'static str,
    impact: &'static str,
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
impl AssessmentReconSnapshotSourceDocument {
    fn presentation(&self) -> String {
        format!(
            "source_id={};namespace={};revision={};provider_time={};observed_time={};collection_method={};completeness={};origin={};rights_status={};attribution={};notice={}",
            self.source_id,
            self.namespace,
            self.revision,
            self.provider_time.as_deref().unwrap_or("not_declared"),
            self.observed_time,
            self.collection_method,
            self.completeness,
            self.origin,
            self.rights.status,
            self.rights.attribution.as_deref().unwrap_or("not_declared"),
            self.rights.notice.as_deref().unwrap_or("not_declared"),
        )
    }
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
impl AssessmentReconSnapshotImportAuditDocument {
    fn from_audit(audit: &ReconSnapshot) -> Result<Self, ReportError> {
        let mut sources = audit
            .sources()
            .iter()
            .map(|source| AssessmentReconSnapshotSourceDocument {
                source_id: source.source_id().to_owned(),
                namespace: source.namespace().to_owned(),
                revision: source.revision().to_owned(),
                provider_time: source.provider_time().map(str::to_owned),
                observed_time: source.observed_time().to_owned(),
                collection_method: source.collection_method().to_owned(),
                completeness: source.completeness().as_str(),
                origin: source.origin().to_owned(),
                rights: AssessmentReconSnapshotRightsDocument {
                    status: source.rights().status().as_str(),
                    attribution: source.rights().attribution().map(str::to_owned),
                    notice: source.rights().notice().map(str::to_owned),
                },
            })
            .collect::<Vec<_>>();
        sources.sort_by(|left, right| left.source_id.cmp(&right.source_id));

        let mut records = audit
            .records()
            .iter()
            .map(|record| {
                let record_id = record.record_id().to_owned();
                let source_ids = record.source_ids().to_vec();
                match record.value() {
                    ReconnaissanceRecordValue::CtName(value) => {
                        AssessmentReconSnapshotRecordDocument::CtName {
                            record_id,
                            source_ids,
                            name: value.name().to_owned(),
                        }
                    },
                    ReconnaissanceRecordValue::DnsHistory(value) => {
                        AssessmentReconSnapshotRecordDocument::DnsHistory {
                            record_id,
                            source_ids,
                            name: value.name().to_owned(),
                            address: value.address().to_string(),
                        }
                    },
                    ReconnaissanceRecordValue::ServiceBannerProduct(value) => {
                        AssessmentReconSnapshotRecordDocument::ServiceBannerProduct {
                            record_id,
                            source_ids,
                            host: value.host().to_owned(),
                            port: value.port(),
                            transport: value.transport().as_str(),
                            product: value.product().to_owned(),
                            version: value.version().map(str::to_owned),
                        }
                    },
                    ReconnaissanceRecordValue::ReputationLabel(value) => {
                        AssessmentReconSnapshotRecordDocument::ReputationLabel {
                            record_id,
                            source_ids,
                            subject: value.subject().to_owned(),
                            label: value.label().to_owned(),
                        }
                    },
                }
            })
            .collect::<Vec<_>>();
        records.sort_by(|left, right| left.record_id().cmp(right.record_id()));
        let external = audit.external_activity();
        let document = Self {
            schema: RECON_SNAPSHOT_IMPORT_AUDIT_SCHEMA,
            policy: audit.policy(),
            selected: true,
            input: AssessmentReconSnapshotInputDocument {
                source_schema: audit.schema(),
                byte_length: audit.input().byte_length(),
                sha256: format!("sha256:{}", audit.input().sha256_hex()),
            },
            snapshot: AssessmentReconSnapshotIdentityDocument {
                id: audit.snapshot_id().to_owned(),
                revision: audit.snapshot_revision().to_owned(),
            },
            sources,
            records,
            accounting: AssessmentReconSnapshotAccountingDocument {
                source_count: u64::try_from(audit.source_count())
                    .map_err(|_| ReportError::Serialization)?,
                record_count: u64::try_from(audit.record_count())
                    .map_err(|_| ReportError::Serialization)?,
                source_association_count: u64::try_from(audit.source_association_count())
                    .map_err(|_| ReportError::Serialization)?,
                prepared_index_bytes: u64::try_from(audit.prepared_index_bytes())
                    .map_err(|_| ReportError::Serialization)?,
            },
            external_activity: AssessmentReconSnapshotExternalActivityDocument {
                target_request_count: u64::from(external.target_request_count()),
                provider_request_count: u64::from(external.provider_request_count()),
                archive_processing: external.archive_processing().as_str(),
                decompression: external.decompression().as_str(),
            },
            claim_limits: AssessmentReconSnapshotClaimLimitsDocument {
                record_interpretation: audit.claim_limit().as_str(),
                source_authentication: "not_established",
                asset_ownership: "not_established",
                current_reachability: "not_established",
                scan_authority: "not_granted",
                vulnerability: "not_established",
                impact: "not_established",
            },
        };
        document.validate()?;
        Ok(document)
    }

    fn validate(&self) -> Result<(), ReportError> {
        let source_count =
            u64::try_from(self.sources.len()).map_err(|_| ReportError::Serialization)?;
        let record_count =
            u64::try_from(self.records.len()).map_err(|_| ReportError::Serialization)?;
        let mut source_ids = std::collections::BTreeSet::new();
        let sources_valid = !self.sources.is_empty()
            && self.sources.len() <= MAX_RECONNAISSANCE_SNAPSHOT_SOURCES
            && self.sources.iter().all(|source| {
                source_ids.insert(source.source_id.as_str())
                    && valid_recon_report_text(&source.source_id, 128)
                    && valid_recon_report_text(&source.namespace, 128)
                    && valid_recon_report_text(&source.revision, 128)
                    && source
                        .provider_time
                        .as_deref()
                        .is_none_or(|value| valid_recon_report_text(value, 96))
                    && valid_recon_report_text(&source.observed_time, 96)
                    && valid_recon_report_text(&source.collection_method, 128)
                    && matches!(
                        source.completeness,
                        "complete_as_declared" | "partial_as_declared" | "unknown"
                    )
                    && valid_recon_report_text(&source.origin, 2_048)
                    && matches!(
                        source.rights.status,
                        "permitted_as_declared" | "restricted_as_declared" | "unknown"
                    )
                    && source
                        .rights
                        .attribution
                        .as_deref()
                        .is_none_or(|value| valid_recon_report_text(value, 4_096))
                    && source
                        .rights
                        .notice
                        .as_deref()
                        .is_none_or(|value| valid_recon_report_text(value, 4_096))
            });
        let mut record_ids = std::collections::BTreeSet::new();
        let mut association_count = 0_u64;
        let records_valid = self.records.len() <= MAX_RECONNAISSANCE_SNAPSHOT_RECORDS
            && self.records.iter().all(|record| {
                let references = record.source_ids();
                let mut unique_references = std::collections::BTreeSet::new();
                let count = u64::try_from(references.len()).ok();
                association_count = count
                    .and_then(|count| association_count.checked_add(count))
                    .unwrap_or(u64::MAX);
                record_ids.insert(record.record_id())
                    && valid_recon_report_text(record.record_id(), 128)
                    && !references.is_empty()
                    && references.iter().all(|source_id| {
                        unique_references.insert(source_id.as_str())
                            && source_ids.contains(source_id.as_str())
                    })
                    && matches!(
                        record.kind(),
                        "ct_name" | "dns_history" | "service_banner_product" | "reputation_label"
                    )
                    && record.presentation().len() <= 8_192
            });
        if self.schema != RECON_SNAPSHOT_IMPORT_AUDIT_SCHEMA
            || self.policy != "termivar.recon-snapshot-import/v1"
            || !self.selected
            || self.input.source_schema != "security.recon-snapshot/v1"
            || self.input.byte_length == 0
            || self.input.byte_length > 1_048_576
            || !valid_recon_report_sha256(&self.input.sha256)
            || !valid_recon_report_text(&self.snapshot.id, 128)
            || !valid_recon_report_text(&self.snapshot.revision, 128)
            || !sources_valid
            || !records_valid
            || association_count > MAX_RECONNAISSANCE_SNAPSHOT_SOURCE_ASSOCIATIONS as u64
            || self.accounting.source_count != source_count
            || self.accounting.record_count != record_count
            || self.accounting.source_association_count != association_count
            || self.accounting.prepared_index_bytes
                > MAX_RECONNAISSANCE_SNAPSHOT_PREPARED_INDEX_BYTES as u64
            || self.external_activity.target_request_count != 0
            || self.external_activity.provider_request_count != 0
            || self.external_activity.archive_processing != "not_performed"
            || self.external_activity.decompression != "not_performed"
            || self.claim_limits.record_interpretation != "source_qualified_hypotheses_only"
            || self.claim_limits.source_authentication != "not_established"
            || self.claim_limits.asset_ownership != "not_established"
            || self.claim_limits.current_reachability != "not_established"
            || self.claim_limits.scan_authority != "not_granted"
            || self.claim_limits.vulnerability != "not_established"
            || self.claim_limits.impact != "not_established"
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> [(&'static str, String); 13] {
        [
            ("Audit schema", self.schema.to_owned()),
            ("Policy", self.policy.to_owned()),
            ("Source schema", self.input.source_schema.to_owned()),
            ("Input bytes", self.input.byte_length.to_string()),
            ("Input SHA-256", self.input.sha256.clone()),
            ("Snapshot ID", self.snapshot.id.clone()),
            ("Snapshot revision", self.snapshot.revision.clone()),
            ("Declared sources", self.accounting.source_count.to_string()),
            (
                "Hypothesis records",
                self.accounting.record_count.to_string(),
            ),
            (
                "Source associations",
                self.accounting.source_association_count.to_string(),
            ),
            (
                "Prepared index bytes",
                self.accounting.prepared_index_bytes.to_string(),
            ),
            (
                "Additional target requests",
                self.external_activity.target_request_count.to_string(),
            ),
            (
                "Provider requests",
                self.external_activity.provider_request_count.to_string(),
            ),
        ]
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
fn valid_recon_report_text(value: &str, maximum_bytes: usize) -> bool {
    !value.is_empty() && value.len() <= maximum_bytes && !value.chars().any(char::is_control)
}

#[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
fn valid_recon_report_sha256(value: &str) -> bool {
    value.strip_prefix("sha256:").is_some_and(|digest| {
        digest.len() == 64
            && digest
                .bytes()
                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
    })
}

#[cfg(all(feature = "scanning", feature = "tls-observation"))]
#[derive(Serialize)]
struct AssessmentTlsObservationAuditDocument {
    schema: &'static str,
    policy: &'static str,
    selected: bool,
    additional_request_count: u64,
    assessment_request_count: u64,
    target_scheme: &'static str,
    observation_source_scope: &'static str,
    observation_clock_assurance: &'static str,
    successful_https_response_count: u64,
    plaintext_response_count: u64,
    tls_info_unavailable_count: u64,
    malformed_certificate_count: u64,
    certificate_limit_rejection_count: u64,
    unretained_leaf_response_count: u64,
    leaf_observation_count: u64,
    protocol: &'static str,
    cipher_suite: &'static str,
    alpn_protocol: &'static str,
    full_chain: &'static str,
    connection_reuse: &'static str,
    session_resumption: &'static str,
    handshake_kind: &'static str,
    revocation: &'static str,
    transport_validation_scope: &'static str,
    active_tls_matrix: &'static str,
    source_authentication: &'static str,
    observations: Vec<AssessmentTlsLeafObservationDocument>,
}

#[cfg(all(feature = "scanning", feature = "tls-observation"))]
#[derive(Serialize)]
struct AssessmentTlsLeafObservationDocument {
    leaf_certificate_sha256: String,
    leaf_certificate_byte_length: u64,
    not_before_epoch_seconds: i64,
    not_after_epoch_seconds: i64,
    observed_at_epoch_seconds: i64,
    dns_san_count: u64,
    ip_san_count: u64,
    other_san_count: u64,
    san_count_truncated: bool,
    certificate_time_status: &'static str,
    response_occurrence_count: u64,
    standard_transport_validation_succeeded: bool,
}

#[cfg(all(feature = "scanning", feature = "tls-observation"))]
impl AssessmentTlsObservationAuditDocument {
    fn from_audit(
        audit: &WebAssessmentTlsObservationAudit,
        assessment_request_count: u64,
    ) -> Result<Self, ReportError> {
        let mut observations = audit
            .leaf_observations()
            .iter()
            .map(|observation| AssessmentTlsLeafObservationDocument {
                leaf_certificate_sha256: observation.sha256().to_owned(),
                leaf_certificate_byte_length: observation.byte_length(),
                not_before_epoch_seconds: observation.not_before_epoch_seconds(),
                not_after_epoch_seconds: observation.not_after_epoch_seconds(),
                observed_at_epoch_seconds: observation.observed_at_epoch_seconds(),
                dns_san_count: u64::from(observation.dns_san_count()),
                ip_san_count: u64::from(observation.ip_san_count()),
                other_san_count: u64::from(observation.other_san_count()),
                san_count_truncated: observation.san_count_truncated(),
                certificate_time_status: observation.certificate_time_status().as_str(),
                response_occurrence_count: observation.response_occurrence_count(),
                standard_transport_validation_succeeded: observation
                    .standard_transport_validation_succeeded(),
            })
            .collect::<Vec<_>>();
        observations.sort_by(|left, right| {
            left.leaf_certificate_sha256
                .cmp(&right.leaf_certificate_sha256)
        });
        Ok(Self {
            schema: audit.schema(),
            policy: audit.policy(),
            selected: audit.selected(),
            additional_request_count: audit.additional_request_count(),
            assessment_request_count,
            target_scheme: audit.target_scheme().as_str(),
            observation_source_scope: audit.observation_source_scope(),
            observation_clock_assurance: audit.observation_clock_assurance(),
            successful_https_response_count: audit.successful_https_response_count(),
            plaintext_response_count: audit.plaintext_response_count(),
            tls_info_unavailable_count: audit.tls_info_unavailable_count(),
            malformed_certificate_count: audit.malformed_certificate_count(),
            certificate_limit_rejection_count: audit.certificate_limit_rejection_count(),
            unretained_leaf_response_count: audit.unretained_leaf_response_count(),
            leaf_observation_count: u64::try_from(observations.len())
                .map_err(|_| ReportError::Serialization)?,
            protocol: audit.protocol(),
            cipher_suite: audit.cipher_suite(),
            alpn_protocol: audit.alpn_protocol(),
            full_chain: audit.full_chain(),
            connection_reuse: audit.connection_reuse(),
            session_resumption: audit.session_resumption(),
            handshake_kind: audit.handshake_kind(),
            revocation: audit.revocation(),
            transport_validation_scope: audit.standard_transport_validation_scope(),
            active_tls_matrix: "not_performed",
            source_authentication: "not_established",
            observations,
        })
    }

    fn validate(&self) -> Result<(), ReportError> {
        let mut unique_digests = std::collections::BTreeSet::new();
        let retained_response_count = self.observations.iter().try_fold(0_u64, |sum, row| {
            let san_count = row
                .dns_san_count
                .checked_add(row.ip_san_count)
                .and_then(|count| count.checked_add(row.other_san_count));
            let time_consistent = match row.certificate_time_status {
                "valid_at_observation" => {
                    row.not_before_epoch_seconds <= row.observed_at_epoch_seconds
                        && row.observed_at_epoch_seconds <= row.not_after_epoch_seconds
                },
                "not_yet_valid_at_observation" => {
                    row.observed_at_epoch_seconds < row.not_before_epoch_seconds
                        && row.not_before_epoch_seconds <= row.not_after_epoch_seconds
                },
                "expired_at_observation" => {
                    row.not_before_epoch_seconds <= row.not_after_epoch_seconds
                        && row.not_after_epoch_seconds < row.observed_at_epoch_seconds
                },
                _ => false,
            };
            if row.leaf_certificate_sha256.len() != 64
                || !row
                    .leaf_certificate_sha256
                    .bytes()
                    .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
                || row.leaf_certificate_byte_length == 0
                || row.leaf_certificate_byte_length > 64 * 1024
                || row.response_occurrence_count == 0
                || san_count
                    .is_none_or(|count| count > 256 || (row.san_count_truncated && count != 256))
                || !time_consistent
                || !row.standard_transport_validation_succeeded
                || !unique_digests.insert(row.leaf_certificate_sha256.as_str())
            {
                return None;
            }
            sum.checked_add(row.response_occurrence_count)
        });
        let https_partition = self
            .tls_info_unavailable_count
            .checked_add(self.malformed_certificate_count)
            .and_then(|count| count.checked_add(self.certificate_limit_rejection_count))
            .and_then(|count| count.checked_add(self.unretained_leaf_response_count))
            .and_then(|count| {
                retained_response_count.and_then(|retained| count.checked_add(retained))
            });
        let observed_response_count = self
            .successful_https_response_count
            .checked_add(self.plaintext_response_count);
        if self.schema != TLS_OBSERVATION_AUDIT_SCHEMA
            || self.policy != TLS_OBSERVATION_POLICY_ID
            || !self.selected
            || self.additional_request_count != 0
            || self.assessment_request_count > u64::from(HARD_MAX_WEB_ASSESSMENT_TOTAL_REQUESTS)
            || observed_response_count.is_none_or(|count| count > self.assessment_request_count)
            || !matches!(self.target_scheme, "http" | "https")
            || self.observation_source_scope != TLS_OBSERVATION_SOURCE_SCOPE
            || self.observation_clock_assurance != TLS_OBSERVATION_CLOCK_ASSURANCE
            || self.leaf_observation_count
                != u64::try_from(self.observations.len()).map_err(|_| ReportError::Serialization)?
            || self.observations.len() > 16
            || self.successful_https_response_count > 10_000
            || self.plaintext_response_count > 10_000
            || https_partition != Some(self.successful_https_response_count)
            || (self.target_scheme == "https" && self.plaintext_response_count != 0)
            || (self.target_scheme == "http" && self.successful_https_response_count != 0)
            || self.protocol != TLS_OBSERVATION_BACKEND_LIMIT
            || self.cipher_suite != TLS_OBSERVATION_BACKEND_LIMIT
            || self.alpn_protocol != TLS_OBSERVATION_BACKEND_LIMIT
            || self.full_chain != TLS_OBSERVATION_BACKEND_LIMIT
            || self.connection_reuse != TLS_OBSERVATION_BACKEND_LIMIT
            || self.session_resumption != TLS_OBSERVATION_BACKEND_LIMIT
            || self.handshake_kind != TLS_OBSERVATION_BACKEND_LIMIT
            || self.revocation != TLS_OBSERVATION_REVOCATION_STATUS
            || self.transport_validation_scope != TLS_OBSERVATION_VALIDATION_SCOPE
            || self.active_tls_matrix != "not_performed"
            || self.source_authentication != "not_established"
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        vec![
            ("Audit schema", self.schema.to_owned()),
            ("Policy", self.policy.to_owned()),
            ("Selected", self.selected.to_string()),
            ("Target scheme", self.target_scheme.to_owned()),
            (
                "Observation source scope",
                self.observation_source_scope.to_owned(),
            ),
            (
                "Observation clock assurance",
                self.observation_clock_assurance.to_owned(),
            ),
            (
                "Additional target requests",
                self.additional_request_count.to_string(),
            ),
            (
                "Assessment requests",
                self.assessment_request_count.to_string(),
            ),
            (
                "Successful HTTPS responses",
                self.successful_https_response_count.to_string(),
            ),
            (
                "Plaintext responses",
                self.plaintext_response_count.to_string(),
            ),
            (
                "TLS information unavailable",
                self.tls_info_unavailable_count.to_string(),
            ),
            (
                "Malformed leaf certificates",
                self.malformed_certificate_count.to_string(),
            ),
            (
                "Certificate limit rejections",
                self.certificate_limit_rejection_count.to_string(),
            ),
            (
                "Unretained leaf responses",
                self.unretained_leaf_response_count.to_string(),
            ),
            (
                "Unique retained leaf certificates",
                self.leaf_observation_count.to_string(),
            ),
            ("Negotiated protocol", self.protocol.to_owned()),
            ("Negotiated cipher suite", self.cipher_suite.to_owned()),
            ("ALPN protocol", self.alpn_protocol.to_owned()),
            ("Full chain", self.full_chain.to_owned()),
            ("Connection reuse", self.connection_reuse.to_owned()),
            ("Session resumption", self.session_resumption.to_owned()),
            ("Handshake kind", self.handshake_kind.to_owned()),
            ("Revocation", self.revocation.to_owned()),
            (
                "Transport validation scope",
                self.transport_validation_scope.to_owned(),
            ),
            ("Active TLS matrix", self.active_tls_matrix.to_owned()),
            (
                "Source authentication",
                self.source_authentication.to_owned(),
            ),
        ]
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
const TLS_NEGOTIATION_REVIEW_CLAIM_LIMITS: [&str; 6] = [
    "finite_matrix_not_complete_server_capability_enumeration",
    "failed_handshake_does_not_establish_server_non_support",
    "configured_trust_validation_not_source_authentication",
    "revocation_and_transparency_retrieval_not_performed",
    "application_data_and_credentials_not_sent",
    "vulnerability_exploitability_impact_and_remediation_not_established",
];

#[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
#[derive(Serialize)]
struct AssessmentTlsNegotiationReviewAuditDocument {
    schema: &'static str,
    policy: &'static str,
    selected: bool,
    methodology: AssessmentTlsNegotiationMethodologyDocument,
    coverage: AssessmentTlsNegotiationCoverageDocument,
    capability_observations: Vec<AssessmentTlsNegotiationCellDocument>,
    claim_limits: [&'static str; 6],
}

#[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
#[derive(Serialize)]
struct AssessmentTlsNegotiationMethodologyDocument {
    target_binding: &'static str,
    address_selection: &'static str,
    execution_order: &'static str,
    maximum_in_flight_connections: u8,
    network_capable_cell_count: u8,
    matrix_cell_count: u8,
    retries: &'static str,
    redirects: &'static str,
    proxy: &'static str,
    application_data: &'static str,
    credentials: &'static str,
    client_certificate: &'static str,
    alpn: &'static str,
    session_resumption: &'static str,
    certificate_validation: &'static str,
}

#[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
#[derive(Serialize)]
struct AssessmentTlsNegotiationCoverageDocument {
    terminal: &'static str,
    connection_attempt_limit: u8,
    connection_in_flight_limit: u8,
    per_connection_ingress_byte_limit: u64,
    total_ingress_byte_limit: u64,
    per_connection_egress_byte_limit: u64,
    total_egress_byte_limit: u64,
    attempted_connection_count: u8,
    completed_handshake_count: u8,
    accounted_ingress_tls_bytes: u64,
    observed_egress_tls_bytes: u64,
    client_backend_unsupported_cell_count: u8,
}

#[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
#[derive(Serialize)]
struct AssessmentTlsNegotiationCellDocument {
    cell_id: &'static str,
    offered_protocol: &'static str,
    client_backend: &'static str,
    dispatch_status: &'static str,
    outcome: &'static str,
    support: &'static str,
    transport_validation: &'static str,
    negotiated_protocol: Option<&'static str>,
    negotiated_cipher_suite: Option<&'static str>,
    accounted_ingress_tls_bytes: u64,
    observed_egress_tls_bytes: u64,
}

#[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
impl AssessmentTlsNegotiationReviewAuditDocument {
    fn from_audit(audit: &WebAssessmentTlsNegotiationReviewAudit) -> Result<Self, ReportError> {
        if !audit.is_valid() {
            return Err(ReportError::Serialization);
        }
        let document = Self {
            schema: audit.schema(),
            policy: audit.policy(),
            selected: audit.selected(),
            methodology: AssessmentTlsNegotiationMethodologyDocument {
                target_binding: "selected_https_target_exact_host_sni_port",
                address_selection: "single_deterministic_address_under_selected_authority",
                execution_order: "tls13_then_tls12_then_backend_unsupported_rows",
                maximum_in_flight_connections: 1,
                network_capable_cell_count: 2,
                matrix_cell_count: 5,
                retries: "none",
                redirects: "none",
                proxy: "not_used",
                application_data: "not_sent",
                credentials: "not_sent",
                client_certificate: "not_sent",
                alpn: "not_offered",
                session_resumption: "disabled",
                certificate_validation: "standard_configured_trust",
            },
            coverage: AssessmentTlsNegotiationCoverageDocument {
                terminal: audit.terminal(),
                connection_attempt_limit: 2,
                connection_in_flight_limit: 1,
                per_connection_ingress_byte_limit: 128 * 1_024,
                total_ingress_byte_limit: 256 * 1_024,
                per_connection_egress_byte_limit: 64 * 1_024,
                total_egress_byte_limit: 128 * 1_024,
                attempted_connection_count: audit.attempted_connection_count(),
                completed_handshake_count: audit.completed_handshake_count(),
                accounted_ingress_tls_bytes: audit.accounted_ingress_tls_bytes(),
                observed_egress_tls_bytes: audit.observed_egress_tls_bytes(),
                client_backend_unsupported_cell_count: 3,
            },
            capability_observations: audit
                .cells()
                .iter()
                .map(|cell| AssessmentTlsNegotiationCellDocument {
                    cell_id: cell.id(),
                    offered_protocol: cell.offered_protocol(),
                    client_backend: cell.client_backend(),
                    dispatch_status: cell.dispatch_status(),
                    outcome: cell.outcome(),
                    support: cell.support(),
                    transport_validation: cell.transport_validation(),
                    negotiated_protocol: cell.negotiated_protocol(),
                    negotiated_cipher_suite: cell.negotiated_cipher_suite(),
                    accounted_ingress_tls_bytes: cell.accounted_ingress_tls_bytes(),
                    observed_egress_tls_bytes: cell.observed_egress_tls_bytes(),
                })
                .collect(),
            claim_limits: TLS_NEGOTIATION_REVIEW_CLAIM_LIMITS,
        };
        document.validate()?;
        Ok(document)
    }

    fn validate(&self) -> Result<(), ReportError> {
        const CELL_IDS: [&str; 5] = [
            "tls13_default_provider",
            "tls12_default_provider",
            "tls11_legacy_protocol",
            "tls10_legacy_protocol",
            "legacy_cipher_suites",
        ];
        const OFFERED_PROTOCOLS: [&str; 5] = [
            "tls1.3",
            "tls1.2",
            "tls1.1",
            "tls1.0",
            "legacy_cipher_suites",
        ];
        if self.schema != TLS_NEGOTIATION_REVIEW_AUDIT_SCHEMA
            || self.policy != TLS_NEGOTIATION_REVIEW_POLICY_ID
            || !self.selected
            || self.methodology.target_binding != "selected_https_target_exact_host_sni_port"
            || self.methodology.address_selection
                != "single_deterministic_address_under_selected_authority"
            || self.methodology.execution_order != "tls13_then_tls12_then_backend_unsupported_rows"
            || self.methodology.maximum_in_flight_connections != 1
            || self.methodology.network_capable_cell_count != 2
            || self.methodology.matrix_cell_count != 5
            || self.methodology.retries != "none"
            || self.methodology.redirects != "none"
            || self.methodology.proxy != "not_used"
            || self.methodology.application_data != "not_sent"
            || self.methodology.credentials != "not_sent"
            || self.methodology.client_certificate != "not_sent"
            || self.methodology.alpn != "not_offered"
            || self.methodology.session_resumption != "disabled"
            || self.methodology.certificate_validation != "standard_configured_trust"
            || self.coverage.connection_attempt_limit != 2
            || self.coverage.connection_in_flight_limit != 1
            || self.coverage.per_connection_ingress_byte_limit != 128 * 1_024
            || self.coverage.total_ingress_byte_limit != 256 * 1_024
            || self.coverage.per_connection_egress_byte_limit != 64 * 1_024
            || self.coverage.total_egress_byte_limit != 128 * 1_024
            || self.coverage.client_backend_unsupported_cell_count != 3
            || self.capability_observations.len() != 5
            || self.claim_limits != TLS_NEGOTIATION_REVIEW_CLAIM_LIMITS
        {
            return Err(ReportError::Serialization);
        }
        let mut attempted = 0_u8;
        let mut completed = 0_u8;
        let mut ingress = 0_u64;
        let mut egress = 0_u64;
        let mut terminal_stop_seen = false;
        let mut terminal_sequence_valid = true;
        for (index, cell) in self.capability_observations.iter().enumerate() {
            if cell.cell_id != CELL_IDS[index]
                || cell.offered_protocol != OFFERED_PROTOCOLS[index]
                || cell.client_backend != "rustls-ring"
                || cell.accounted_ingress_tls_bytes > 128 * 1_024
                || cell.observed_egress_tls_bytes > 64 * 1_024
            {
                return Err(ReportError::Serialization);
            }
            ingress = ingress
                .checked_add(cell.accounted_ingress_tls_bytes)
                .ok_or(ReportError::Serialization)?;
            egress = egress
                .checked_add(cell.observed_egress_tls_bytes)
                .ok_or(ReportError::Serialization)?;
            if index >= 2 {
                if cell.dispatch_status != "not_dispatched"
                    || cell.outcome != "client_backend_unsupported"
                    || cell.support != "not_tested_client_backend_unsupported"
                    || cell.transport_validation != "not_applicable"
                    || cell.negotiated_protocol.is_some()
                    || cell.negotiated_cipher_suite.is_some()
                    || cell.accounted_ingress_tls_bytes != 0
                    || cell.observed_egress_tls_bytes != 0
                {
                    return Err(ReportError::Serialization);
                }
                continue;
            }
            if cell.dispatch_status == "dispatched" {
                attempted = attempted.checked_add(1).ok_or(ReportError::Serialization)?;
                if matches!(
                    cell.outcome,
                    "client_backend_unsupported" | "parent_authority_unavailable" | "not_reached"
                ) {
                    return Err(ReportError::Serialization);
                }
            } else if cell.dispatch_status != "not_dispatched"
                || cell.accounted_ingress_tls_bytes != 0
                || cell.observed_egress_tls_bytes != 0
                || !matches!(
                    cell.outcome,
                    "parent_authority_unavailable"
                        | "budget_exhausted"
                        | "cancelled"
                        | "deadline_reached"
                        | "not_reached"
                )
            {
                return Err(ReportError::Serialization);
            }
            if index == 1
                && self.capability_observations[0].dispatch_status != "dispatched"
                && cell.dispatch_status == "dispatched"
            {
                return Err(ReportError::Serialization);
            }
            let stop_family = matches!(
                cell.outcome,
                "parent_authority_unavailable"
                    | "budget_exhausted"
                    | "cancelled"
                    | "deadline_reached"
            );
            match self.coverage.terminal {
                "completed" => terminal_sequence_valid &= !stop_family,
                "parent_authority_unavailable" => {},
                "budget_exhausted" | "cancelled" | "deadline_reached" => {
                    if terminal_stop_seen {
                        terminal_sequence_valid &= cell.dispatch_status == "not_dispatched"
                            && cell.outcome == "not_reached";
                    } else if stop_family {
                        let matches_terminal = cell.outcome == self.coverage.terminal
                            || (self.coverage.terminal == "deadline_reached"
                                && cell.outcome == "budget_exhausted");
                        terminal_sequence_valid &= matches_terminal;
                        terminal_stop_seen = matches_terminal;
                    } else if cell.outcome == "not_reached" {
                        terminal_sequence_valid = false;
                    }
                },
                _ => terminal_sequence_valid = false,
            }
            if cell.outcome == "negotiated" {
                completed = completed.checked_add(1).ok_or(ReportError::Serialization)?;
                let protocol_matches = cell.negotiated_protocol == Some(OFFERED_PROTOCOLS[index]);
                let cipher_matches = cell.negotiated_cipher_suite.is_some_and(|cipher| {
                    if index == 0 {
                        matches!(
                            cipher,
                            "tls13_aes_256_gcm_sha384"
                                | "tls13_aes_128_gcm_sha256"
                                | "tls13_chacha20_poly1305_sha256"
                        )
                    } else {
                        matches!(
                            cipher,
                            "tls12_ecdhe_ecdsa_aes_256_gcm_sha384"
                                | "tls12_ecdhe_ecdsa_aes_128_gcm_sha256"
                                | "tls12_ecdhe_ecdsa_chacha20_poly1305_sha256"
                                | "tls12_ecdhe_rsa_aes_256_gcm_sha384"
                                | "tls12_ecdhe_rsa_aes_128_gcm_sha256"
                                | "tls12_ecdhe_rsa_chacha20_poly1305_sha256"
                        )
                    }
                });
                if cell.dispatch_status != "dispatched"
                    || cell.support != "observed_supported"
                    || cell.transport_validation != "succeeded"
                    || !protocol_matches
                    || !cipher_matches
                    || cell.accounted_ingress_tls_bytes == 0
                    || cell.observed_egress_tls_bytes == 0
                {
                    return Err(ReportError::Serialization);
                }
            } else if !matches!(
                cell.outcome,
                "peer_alert_received"
                    | "certificate_validation_failed"
                    | "handshake_failed"
                    | "transport_failed"
                    | "parent_authority_unavailable"
                    | "budget_exhausted"
                    | "cancelled"
                    | "deadline_reached"
                    | "not_reached"
            ) || cell.support != "not_established"
                || cell.transport_validation != "not_established"
                || cell.negotiated_protocol.is_some()
                || cell.negotiated_cipher_suite.is_some()
            {
                return Err(ReportError::Serialization);
            }
        }
        let completed_terminal_is_consistent =
            self.coverage.terminal == "completed" && terminal_sequence_valid && attempted == 2;
        if attempted != self.coverage.attempted_connection_count
            || completed != self.coverage.completed_handshake_count
            || ingress != self.coverage.accounted_ingress_tls_bytes
            || egress != self.coverage.observed_egress_tls_bytes
            || ingress > self.coverage.total_ingress_byte_limit
            || egress > self.coverage.total_egress_byte_limit
            || !completed_terminal_is_consistent
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        vec![
            ("Audit schema", self.schema.to_owned()),
            ("Policy", self.policy.to_owned()),
            ("Terminal", self.coverage.terminal.to_owned()),
            (
                "Attempted connections",
                self.coverage.attempted_connection_count.to_string(),
            ),
            (
                "Completed handshakes",
                self.coverage.completed_handshake_count.to_string(),
            ),
            (
                "Accounted TLS ingress bytes",
                self.coverage.accounted_ingress_tls_bytes.to_string(),
            ),
            (
                "Observed TLS egress bytes",
                self.coverage.observed_egress_tls_bytes.to_string(),
            ),
            (
                "Client-backend-unsupported cells",
                self.coverage
                    .client_backend_unsupported_cell_count
                    .to_string(),
            ),
        ]
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "openapi-review"))]
#[derive(Serialize)]
struct AssessmentOpenApiAuditDocument {
    schema: &'static str,
    capability_id: &'static str,
    outcome: &'static str,
    candidate_source: crate::web_runtime::OpenApiCandidateSource,
    request_count: u8,
    active_verification_count: u8,
    version: Option<&'static str>,
    semantic_digest: Option<String>,
    path_count: u32,
    operation_count: u32,
    get_operation_count: u32,
    write_operation_count: u32,
    path_parameter_count: u32,
    query_parameter_count: u32,
    explicit_auth_operation_count: u32,
    anonymous_operation_count: u32,
    url_like_operation_count: u32,
    multipart_operation_count: u32,
    deprecated_operation_count: u32,
    replay_matched: bool,
    item_projected: bool,
}
#[cfg(all(feature = "scanning", feature = "openapi-review"))]
impl AssessmentOpenApiAuditDocument {
    fn from_audit(a: &crate::web_runtime::WebAssessmentOpenApiAudit) -> Self {
        Self {
            schema: "security.openapi-review-audit/v1",
            capability_id: OPENAPI_REVIEW_CAPABILITY_ID,
            outcome: openapi_outcome(a.outcome()),
            candidate_source: a.candidate_source(),
            request_count: a.request_count(),
            active_verification_count: a.active_verification_count(),
            version: a.version(),
            semantic_digest: a.semantic_digest().map(str::to_owned),
            path_count: a.path_count(),
            operation_count: a.operation_count(),
            get_operation_count: a.get_operation_count(),
            write_operation_count: a.write_operation_count(),
            path_parameter_count: a.path_parameter_count(),
            query_parameter_count: a.query_parameter_count(),
            explicit_auth_operation_count: a.explicit_auth_operation_count(),
            anonymous_operation_count: a.anonymous_operation_count(),
            url_like_operation_count: a.url_like_operation_count(),
            multipart_operation_count: a.multipart_operation_count(),
            deprecated_operation_count: a.deprecated_operation_count(),
            replay_matched: a.replay_matched(),
            item_projected: a.item_projected(),
        }
    }
    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        let count = items
            .iter()
            .filter(|i| i.capability_id == OPENAPI_REVIEW_CAPABILITY_ID)
            .count();
        if self.request_count > 2
            || self.active_verification_count > 1
            || count > 1
            || self.item_projected != (count == 1)
            || self.replay_matched != self.item_projected
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }
    fn summary(&self) -> String {
        format!("source={};version={};digest={};paths={};operations={};get={};write={};path_parameters={};query_parameters={};explicit_auth={};anonymous={};url_like={};multipart={};deprecated={};replay_matched={};item_projected={}",self.candidate_source.as_str(),self.version.unwrap_or("none"),self.semantic_digest.as_deref().unwrap_or("none"),self.path_count,self.operation_count,self.get_operation_count,self.write_operation_count,self.path_parameter_count,self.query_parameter_count,self.explicit_auth_operation_count,self.anonymous_operation_count,self.url_like_operation_count,self.multipart_operation_count,self.deprecated_operation_count,self.replay_matched,self.item_projected)
    }
    fn metadata(&self) -> Vec<(&'static str, String)> {
        vec![
            ("Audit schema", self.schema.into()),
            ("Capability", self.capability_id.into()),
            ("Outcome", self.outcome.into()),
            ("Request count", self.request_count.to_string()),
            (
                "Active verification count",
                self.active_verification_count.to_string(),
            ),
            ("Summary", self.summary()),
        ]
    }
}
#[cfg(all(feature = "scanning", feature = "openapi-review"))]
const fn openapi_outcome(o: OpenApiRuntimeOutcome) -> &'static str {
    match o {
        OpenApiRuntimeOutcome::NotEligible => "not_eligible",
        OpenApiRuntimeOutcome::DocumentObserved => "document_observed",
        OpenApiRuntimeOutcome::Swagger20MetadataOnly => "swagger_20_metadata_only",
        OpenApiRuntimeOutcome::UnsupportedVersion => "unsupported_version",
        OpenApiRuntimeOutcome::ReplayMismatch => "replay_mismatch",
        OpenApiRuntimeOutcome::UnsupportedMedia => "unsupported_media",
        OpenApiRuntimeOutcome::Malformed => "malformed",
        OpenApiRuntimeOutcome::LimitExceeded => "limit_exceeded",
        OpenApiRuntimeOutcome::TooLarge => "too_large",
        OpenApiRuntimeOutcome::RedirectObserved => "redirect_observed",
        OpenApiRuntimeOutcome::RateLimited => "rate_limited",
        OpenApiRuntimeOutcome::DefensiveInterference => "defensive_interference",
        OpenApiRuntimeOutcome::HttpError => "http_error",
        OpenApiRuntimeOutcome::Truncated => "truncated",
        OpenApiRuntimeOutcome::Incomplete => "incomplete",
        OpenApiRuntimeOutcome::BudgetExhausted => "budget_exhausted",
        OpenApiRuntimeOutcome::Cancelled => "cancelled",
    }
}

#[cfg(all(feature = "scanning", feature = "rest-review"))]
#[derive(Serialize)]
struct AssessmentRestAuditDocument {
    schema: &'static str,
    capability_id: &'static str,
    enabled: bool,
    method: &'static str,
    outcome: &'static str,
    request_count: u8,
    active_verification_count: u8,
    eligible_operation_count: u32,
    #[serde(skip_serializing_if = "Option::is_none")]
    selected_operation_identity: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    documented_response: Option<&'static str>,
    observed_media: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    status_class: Option<u8>,
    replay_stable: bool,
    item_projected: bool,
}

#[cfg(all(feature = "scanning", feature = "rest-review"))]
impl AssessmentRestAuditDocument {
    fn from_audit(audit: &crate::web_runtime::WebAssessmentRestAudit) -> Self {
        Self {
            schema: "security.rest-readonly-review-audit/v1",
            capability_id: REST_REVIEW_CAPABILITY_ID,
            enabled: true,
            method: "get",
            outcome: rest_outcome(audit.outcome()),
            request_count: audit.request_count(),
            active_verification_count: audit.active_verification_count(),
            eligible_operation_count: audit.eligible_operation_count(),
            selected_operation_identity: audit.selected_operation_identity().map(str::to_owned),
            documented_response: audit.documented_response().map(rest_documented_response),
            observed_media: rest_observed_media(audit.observed_media()),
            status_class: audit.status_class(),
            replay_stable: audit.replay_stable(),
            item_projected: audit.item_projected(),
        }
    }

    fn validate_for_response_privacy(
        &self,
        items: &[AssessmentItemDocument<'_>],
        response_privacy: bool,
    ) -> Result<(), ReportError> {
        let projected = items
            .iter()
            .filter(|item| item.capability_id == REST_REVIEW_CAPABILITY_ID)
            .count();
        let positive = self.outcome == "surface_observed";
        let selected_identity_is_valid = self
            .selected_operation_identity
            .as_deref()
            .is_none_or(|identity| identity.starts_with("openapi-operation-sha256:"));
        if self.schema != "security.rest-readonly-review-audit/v1"
            || self.capability_id != REST_REVIEW_CAPABILITY_ID
            || !self.enabled
            || self.method != "get"
            || usize::from(self.request_count) > MAX_REST_REVIEW_REQUESTS
            || usize::from(self.active_verification_count) > MAX_REST_REVIEW_ACTIVE_VERIFICATIONS
            || usize::from(self.active_verification_count)
                != usize::from(usize::from(self.request_count) == MAX_REST_REVIEW_REQUESTS)
            || projected > 1
            || self.item_projected != (projected == 1)
            || positive != self.item_projected
            || self.replay_stable != positive
            || !selected_identity_is_valid
            || (response_privacy && self.selected_operation_identity.is_some())
            || (positive
                && (usize::from(self.request_count) != MAX_REST_REVIEW_REQUESTS
                    || usize::from(self.active_verification_count)
                        != MAX_REST_REVIEW_ACTIVE_VERIFICATIONS
                    || self.eligible_operation_count == 0
                    || (self.selected_operation_identity.is_some() == response_privacy)))
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn summary(&self) -> String {
        format!(
            "enabled={};method={};eligible_operations={};selected_operation={};documented_response={};observed_media={};status_class={};replay_stable={};item_projected={}",
            self.enabled,
            self.method,
            self.eligible_operation_count,
            self.selected_operation_identity.as_deref().unwrap_or("none"),
            self.documented_response.unwrap_or("none"),
            self.observed_media,
            self.status_class
                .map_or_else(|| "none".to_owned(), |status| status.to_string()),
            self.replay_stable,
            self.item_projected,
        )
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        vec![
            ("Audit schema", self.schema.into()),
            ("Capability", self.capability_id.into()),
            ("Enabled", self.enabled.to_string()),
            ("Method", self.method.into()),
            ("Outcome", self.outcome.into()),
            ("Request count", self.request_count.to_string()),
            (
                "Active verification count",
                self.active_verification_count.to_string(),
            ),
            ("Summary", self.summary()),
        ]
    }
}

#[cfg(all(feature = "scanning", feature = "rest-review"))]
const fn rest_documented_response(response: RestDocumentedResponseClass) -> &'static str {
    match response {
        RestDocumentedResponseClass::JsonCompatible => "json_compatible",
        RestDocumentedResponseClass::Unknown => "unknown",
    }
}

#[cfg(all(feature = "scanning", feature = "rest-review"))]
const fn rest_observed_media(media: RestObservedMediaClass) -> &'static str {
    match media {
        RestObservedMediaClass::JsonCompatible => "json_compatible",
        RestObservedMediaClass::Text => "text",
        RestObservedMediaClass::Unsupported => "unsupported",
        RestObservedMediaClass::Unknown => "unknown",
    }
}

#[cfg(all(feature = "scanning", feature = "rest-review"))]
const fn rest_outcome(outcome: RestRuntimeOutcome) -> &'static str {
    match outcome {
        RestRuntimeOutcome::NotEligible => "not_eligible",
        RestRuntimeOutcome::SurfaceObserved => "surface_observed",
        RestRuntimeOutcome::ReplayMismatch => "replay_mismatch",
        RestRuntimeOutcome::CompleteNonJson => "complete_non_json",
        RestRuntimeOutcome::Redirect => "redirect",
        RestRuntimeOutcome::AuthenticationRequired => "authentication_required",
        RestRuntimeOutcome::Forbidden => "forbidden",
        RestRuntimeOutcome::NotFound => "not_found",
        RestRuntimeOutcome::RateLimited => "rate_limited",
        RestRuntimeOutcome::DefensiveInterference => "defensive_interference",
        RestRuntimeOutcome::ServerError => "server_error",
        RestRuntimeOutcome::UnsupportedMedia => "unsupported_media",
        RestRuntimeOutcome::Truncated => "truncated",
        RestRuntimeOutcome::Incomplete => "incomplete",
        RestRuntimeOutcome::Cancelled => "cancelled",
        RestRuntimeOutcome::BudgetExhausted => "budget_exhausted",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
#[derive(Serialize)]
struct AssessmentSuppliedSessionAuditDocument {
    schema: &'static str,
    capability_id: &'static str,
    policy_reference: String,
    application_reference: String,
    principal_reference: String,
    principal_alias: String,
    principal_assurance: &'static str,
    credential_mechanism: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    credential_acquisition: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    cookie_policy: Option<AssessmentSuppliedSessionCookiePolicyDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    cookie_lifecycle: Option<AssessmentSuppliedSessionCookieLifecycleDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    login: Option<AssessmentSuppliedSessionLoginDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    renewal: Option<AssessmentSuppliedSessionRenewalDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    oauth_code: Option<crate::web_runtime::SuppliedSessionOAuthCodeAudit>,
    #[serde(skip_serializing_if = "Option::is_none")]
    oauth_refresh: Option<Box<crate::web_runtime::SuppliedSessionOAuthRefreshAudit>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    oauth_authorization: Option<Box<crate::web_runtime::SuppliedSessionOAuthAuthorizationAudit>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    oauth_token_exchange: Option<Box<crate::web_runtime::SuppliedSessionOAuthInitiatedTokenAudit>>,
    health_oracle: AssessmentSuppliedSessionHealthOracleDocument,
    outcome: &'static str,
    coverage: &'static str,
    checkpoints: Vec<AssessmentSuppliedSessionCheckpointDocument>,
    resources: Vec<AssessmentSuppliedSessionResourceDocument>,
    selected_resource_count: u8,
    dispatched_resource_count: u8,
    committed_resource_count: u8,
    dispatched_request_count: u8,
    response_bytes: u64,
    response_byte_limit: u64,
    response_byte_limit_exceeded: bool,
    refresh_performed: bool,
    anonymous_fallback_performed: bool,
    continuous_authentication_established: bool,
    exploit_execution: &'static str,
    impact_validation: &'static str,
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
#[derive(Serialize)]
struct AssessmentSuppliedSessionCookiePolicyDocument {
    declared_count: u8,
    host_only_count: u8,
    domain_count: u8,
    secure_count: u8,
    http_only_count: u8,
    session_count: u8,
    persistent_count: u8,
    same_site_missing_count: u8,
    same_site_strict_count: u8,
    same_site_lax_count: u8,
    same_site_none_count: u8,
    update_policy: &'static str,
    browser_semantics: &'static str,
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
#[derive(Serialize)]
struct AssessmentSuppliedSessionCookieLifecycleDocument {
    initial_epoch: u8,
    final_epoch: u8,
    selected_update_response_count: u8,
    unselected_update_response_count: u8,
    update_classification_failure_count: u8,
    updates_applied: u8,
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
#[derive(Serialize)]
struct AssessmentSuppliedSessionLoginDocument {
    login_reference: String,
    max_attempts: u8,
    attempt_count: u8,
    page_dispatched: bool,
    page_status: Option<u16>,
    page_body_state: &'static str,
    form_outcome: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    form_error_code: Option<&'static str>,
    submit_dispatched: bool,
    submit_status: Option<u16>,
    submit_body_state: &'static str,
    submit_outcome: &'static str,
    acquired_cookie_count: u8,
    response_bytes: u64,
    initial_epoch: u8,
    final_epoch: u8,
    pre_session_cookie_applied: bool,
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
impl AssessmentSuppliedSessionLoginDocument {
    fn validate(
        &self,
        audit_outcome: &str,
        startup: Option<&AssessmentSuppliedSessionCheckpointDocument>,
    ) -> Result<(), ReportError> {
        let page_status_is_valid = self
            .page_status
            .is_none_or(|status| (100..=599).contains(&status));
        let submit_status_is_valid = self
            .submit_status
            .is_none_or(|status| (100..=599).contains(&status));
        let form_error_matches = matches!(
            (self.form_outcome, self.form_error_code),
            ("matched", None)
                | ("not_evaluated", None)
                | (
                    "ineligible_response",
                    Some(
                        "ineligible_response"
                            | "pre_session_cookie_unsupported"
                            | "inexact_final_target"
                    )
                )
                | ("missing", Some("missing_form" | "missing_csrf"))
                | ("ambiguous", Some("ambiguous_form" | "ambiguous_csrf"))
                | (
                    "invalid",
                    Some(
                        "invalid_form_contract"
                            | "invalid_csrf"
                            | "invalid_descriptor"
                            | "invalid_form_body"
                    )
                )
                | ("transport_failed", Some("transport_failed"))
                | ("runtime_limit", Some("runtime_limit"))
                | ("cancelled", Some("cancelled"))
        );
        let page_state_is_valid = match self.form_outcome {
            "matched" => {
                self.page_dispatched
                    && self.page_status == Some(200)
                    && self.page_body_state == "complete"
            },
            "ineligible_response" => {
                self.page_dispatched
                    && self.page_status.is_some()
                    && matches!(self.page_body_state, "complete" | "incomplete")
            },
            "missing" | "ambiguous" => {
                self.page_dispatched
                    && self.page_status == Some(200)
                    && self.page_body_state == "complete"
            },
            "invalid" if self.form_error_code == Some("invalid_descriptor") => {
                !self.page_dispatched
                    && self.page_status.is_none()
                    && self.page_body_state == "unavailable"
            },
            "invalid" => {
                self.page_dispatched
                    && self.page_status == Some(200)
                    && self.page_body_state == "complete"
            },
            "transport_failed" | "runtime_limit" | "cancelled" => {
                self.page_status.is_none() && self.page_body_state == "unavailable"
            },
            "not_evaluated" => {
                !self.page_dispatched
                    && self.page_status.is_none()
                    && self.page_body_state == "unavailable"
            },
            _ => false,
        };
        let submit_state_is_valid = match self.submit_outcome {
            "cookie_acquired" => {
                self.submit_dispatched
                    && self.attempt_count == 1
                    && self.submit_status == Some(200)
                    && self.submit_body_state == "complete"
                    && self.acquired_cookie_count > 0
            },
            "cookie_unavailable" => {
                self.submit_dispatched
                    && self.attempt_count == 1
                    && self.submit_status == Some(200)
                    && self.submit_body_state == "complete"
                    && self.acquired_cookie_count == 0
            },
            "http_error" => {
                self.submit_dispatched
                    && self.attempt_count == 1
                    && self
                        .submit_status
                        .is_some_and(|status| status != 200 && !(300..400).contains(&status))
                    && self.submit_body_state == "complete"
                    && self.acquired_cookie_count == 0
            },
            "redirect_refused" => {
                self.submit_dispatched
                    && self.attempt_count == 1
                    && self
                        .submit_status
                        .is_some_and(|status| (300..400).contains(&status))
                    && matches!(self.submit_body_state, "complete" | "incomplete")
                    && self.acquired_cookie_count == 0
            },
            "incomplete" => {
                self.submit_dispatched
                    && self.attempt_count == 1
                    && self
                        .submit_status
                        .is_some_and(|status| !(300..400).contains(&status))
                    && self.submit_body_state == "incomplete"
                    && self.acquired_cookie_count == 0
            },
            "transport_failed" | "runtime_limit" | "cancelled" => {
                self.attempt_count == u8::from(self.submit_dispatched)
                    && self.submit_status.is_none()
                    && self.submit_body_state == "unavailable"
                    && self.acquired_cookie_count == 0
            },
            "not_dispatched" => {
                !self.submit_dispatched
                    && self.attempt_count == 0
                    && self.submit_status.is_none()
                    && self.submit_body_state == "unavailable"
                    && self.acquired_cookie_count == 0
            },
            _ => false,
        };
        let startup_authenticated = startup.is_some_and(|checkpoint| {
            checkpoint.phase == "startup"
                && checkpoint.outcome == "healthy"
                && checkpoint.predicate == "matched"
        });
        let epoch_is_valid = self.initial_epoch == 0
            && match self.final_epoch {
                0 => true,
                1 => self.submit_outcome == "cookie_acquired" && startup_authenticated,
                _ => false,
            };
        let outcome_is_valid = match audit_outcome {
            "login_form_unavailable" => {
                self.final_epoch == 0
                    && self.submit_outcome == "not_dispatched"
                    && !matches!(self.form_outcome, "matched" | "not_evaluated")
            },
            "login_submit_unavailable" => {
                self.final_epoch == 0
                    && self.form_outcome == "matched"
                    && !matches!(
                        self.submit_outcome,
                        "cookie_acquired" | "cookie_unavailable"
                    )
            },
            "login_cookie_unavailable" => {
                self.final_epoch == 0
                    && self.form_outcome == "matched"
                    && self.submit_outcome == "cookie_unavailable"
            },
            "runtime_limit" => {
                self.form_outcome == "runtime_limit"
                    || self.submit_outcome == "runtime_limit"
                    || self.submit_outcome == "cookie_acquired"
            },
            "cancelled" => {
                self.form_outcome == "cancelled"
                    || self.submit_outcome == "cancelled"
                    || self.submit_outcome == "cookie_acquired"
            },
            _ => self.submit_outcome == "cookie_acquired",
        };
        if !valid_supplied_session_reference(
            &self.login_reference,
            "supplied-session-login-sha256:",
        ) || self.max_attempts != 1
            || self.attempt_count > self.max_attempts
            || !page_status_is_valid
            || !submit_status_is_valid
            || !matches!(
                self.page_body_state,
                "complete" | "incomplete" | "unavailable"
            )
            || !matches!(
                self.submit_body_state,
                "complete" | "incomplete" | "unavailable"
            )
            || !form_error_matches
            || !page_state_is_valid
            || (self.submit_dispatched && self.form_outcome != "matched")
            || !submit_state_is_valid
            || !epoch_is_valid
            || !outcome_is_valid
            || self.pre_session_cookie_applied
            || (!self.page_dispatched && !self.submit_dispatched && self.response_bytes != 0)
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
#[derive(Serialize)]
struct AssessmentSuppliedSessionHealthOracleDocument {
    kind: &'static str,
    field_reference: String,
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
#[derive(Serialize)]
struct AssessmentSuppliedSessionCheckpointDocument {
    sequence: u8,
    phase: &'static str,
    after_subject_count: u8,
    evidence_reference: Option<String>,
    outcome: &'static str,
    status: Option<u16>,
    body_state: &'static str,
    predicate: &'static str,
    response_bytes: u64,
    #[serde(skip_serializing_if = "Option::is_none")]
    epoch: Option<u8>,
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
#[derive(Serialize)]
struct AssessmentSuppliedSessionRenewalDocument {
    renewal_reference: String,
    after_resource_count: u8,
    attempt_count: u8,
    status: Option<u16>,
    body_state: &'static str,
    outcome: &'static str,
    response_bytes: u64,
    applied_cookie_count: u8,
    initial_epoch: u8,
    final_epoch: u8,
    #[serde(skip_serializing_if = "Option::is_none")]
    health: Option<AssessmentSuppliedSessionCheckpointDocument>,
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
impl AssessmentSuppliedSessionCheckpointDocument {
    fn human_summary(&self, include_epoch: bool) -> String {
        let status = self
            .status
            .map_or_else(|| "not_available".to_owned(), |value| value.to_string());
        let evidence = self
            .evidence_reference
            .as_deref()
            .unwrap_or("not_available");
        let summary = format!(
            "sequence={};phase={};after_subject_count={};evidence_reference={};outcome={};status={};body_state={};predicate={};response_bytes={}",
            self.sequence, self.phase, self.after_subject_count, evidence, self.outcome,
            status, self.body_state, self.predicate, self.response_bytes,
        );
        if let Some(epoch) = self.epoch.filter(|_| include_epoch) {
            format!("{summary};epoch={epoch}")
        } else {
            summary
        }
    }

    fn from_checkpoint(
        checkpoint: &WebAssessmentSuppliedSessionCheckpointAudit,
        renewal: bool,
    ) -> Self {
        Self {
            sequence: checkpoint.sequence(),
            phase: supplied_session_checkpoint_phase_token(checkpoint.phase()),
            after_subject_count: checkpoint.after_subject_count(),
            evidence_reference: checkpoint.evidence_reference().map(str::to_owned),
            outcome: supplied_session_health_outcome_token(checkpoint.outcome()),
            status: checkpoint.status(),
            body_state: supplied_session_body_state_token(checkpoint.body_state()),
            predicate: supplied_session_predicate_outcome_token(checkpoint.predicate()),
            response_bytes: checkpoint.response_bytes(),
            epoch: renewal.then_some(checkpoint.epoch()),
        }
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
#[derive(Serialize)]
struct AssessmentSuppliedSessionResourceDocument {
    sequence: u8,
    resource_reference: String,
    evidence_reference: Option<String>,
    outcome: &'static str,
    status: Option<u16>,
    response_bytes: u64,
    epoch: u8,
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
impl AssessmentSuppliedSessionAuditDocument {
    fn from_audit(audit: &WebAssessmentSuppliedSessionAudit) -> Result<Self, ReportError> {
        if audit.exploit_execution_performed() || audit.impact_validation_performed() {
            return Err(ReportError::Serialization);
        }
        if audit
            .oauth_refresh()
            .is_some_and(|refresh| !refresh.is_consistent())
        {
            return Err(ReportError::Serialization);
        }
        if audit
            .oauth_authorization()
            .is_some_and(|a| !a.is_consistent())
            || audit
                .oauth_token_exchange()
                .is_some_and(|a| !a.is_consistent())
        {
            return Err(ReportError::Serialization);
        }
        let document = Self {
            schema: audit.schema(),
            capability_id: audit.capability_id(),
            policy_reference: audit.policy_reference().to_owned(),
            application_reference: audit.application_reference().to_owned(),
            principal_reference: audit.principal_reference().to_owned(),
            principal_alias: audit.principal_alias().to_owned(),
            principal_assurance: supplied_session_principal_assurance_token(
                audit.principal_assurance(),
            ),
            credential_mechanism: supplied_session_credential_mechanism_token(
                audit.credential_mechanism(),
            ),
            credential_acquisition: matches!(
                audit.schema(),
                SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA
                    | SUPPLIED_SESSION_OAUTH_CODE_AUDIT_SCHEMA
                    | SUPPLIED_SESSION_OAUTH_REFRESH_AUDIT_SCHEMA
                    | SUPPLIED_SESSION_OAUTH_AUTHORIZATION_AUDIT_SCHEMA
            )
            .then(|| supplied_session_credential_acquisition_token(audit.credential_acquisition())),
            oauth_code: audit.oauth_code().cloned(),
            oauth_refresh: audit.oauth_refresh().cloned().map(Box::new),
            oauth_authorization: audit.oauth_authorization().cloned().map(Box::new),
            oauth_token_exchange: audit.oauth_token_exchange().cloned().map(Box::new),
            cookie_policy: audit.cookie_policy().map(|policy| {
                AssessmentSuppliedSessionCookiePolicyDocument {
                    declared_count: policy.declared_count(),
                    host_only_count: policy.host_only_count(),
                    domain_count: policy.domain_count(),
                    secure_count: policy.secure_count(),
                    http_only_count: policy.http_only_count(),
                    session_count: policy.session_count(),
                    persistent_count: policy.persistent_count(),
                    same_site_missing_count: policy.same_site_missing_count(),
                    same_site_strict_count: policy.same_site_strict_count(),
                    same_site_lax_count: policy.same_site_lax_count(),
                    same_site_none_count: policy.same_site_none_count(),
                    update_policy: policy.update_policy().as_str(),
                    browser_semantics: policy.browser_semantics(),
                }
            }),
            cookie_lifecycle: audit.cookie_lifecycle().map(|lifecycle| {
                AssessmentSuppliedSessionCookieLifecycleDocument {
                    initial_epoch: lifecycle.initial_epoch(),
                    final_epoch: lifecycle.final_epoch(),
                    selected_update_response_count: lifecycle.selected_update_response_count(),
                    unselected_update_response_count: lifecycle.unselected_update_response_count(),
                    update_classification_failure_count: lifecycle
                        .update_classification_failure_count(),
                    updates_applied: lifecycle.updates_applied(),
                }
            }),
            login: audit
                .login()
                .map(|login| AssessmentSuppliedSessionLoginDocument {
                    login_reference: login.login_reference().to_owned(),
                    max_attempts: login.max_attempts(),
                    attempt_count: login.attempt_count(),
                    page_dispatched: login.page_dispatched(),
                    page_status: login.page_status(),
                    page_body_state: supplied_session_body_state_token(login.page_body_state()),
                    form_outcome: supplied_session_login_form_outcome_token(login.form_outcome()),
                    form_error_code: login.form_error_code(),
                    submit_dispatched: login.submit_dispatched(),
                    submit_status: login.submit_status(),
                    submit_body_state: supplied_session_body_state_token(login.submit_body_state()),
                    submit_outcome: supplied_session_login_submit_outcome_token(
                        login.submit_outcome(),
                    ),
                    acquired_cookie_count: login.acquired_cookie_count(),
                    response_bytes: login.response_bytes(),
                    initial_epoch: login.initial_epoch(),
                    final_epoch: login.final_epoch(),
                    pre_session_cookie_applied: login.pre_session_cookie_applied(),
                }),
            renewal: audit
                .renewal()
                .map(|renewal| AssessmentSuppliedSessionRenewalDocument {
                    renewal_reference: renewal.renewal_reference().to_owned(),
                    after_resource_count: renewal.after_resource_count(),
                    attempt_count: renewal.attempt_count(),
                    status: renewal.status(),
                    body_state: supplied_session_body_state_token(renewal.body_state()),
                    outcome: supplied_session_login_submit_outcome_token(renewal.outcome()),
                    response_bytes: renewal.response_bytes(),
                    applied_cookie_count: renewal.applied_cookie_count(),
                    initial_epoch: renewal.initial_epoch(),
                    final_epoch: renewal.final_epoch(),
                    health: renewal.health().map(|health| {
                        AssessmentSuppliedSessionCheckpointDocument::from_checkpoint(health, true)
                    }),
                }),
            health_oracle: AssessmentSuppliedSessionHealthOracleDocument {
                kind: supplied_session_health_oracle_kind_token(audit.health_oracle().kind()),
                field_reference: audit.health_oracle().field_reference().to_owned(),
            },
            outcome: supplied_session_audit_outcome_token(audit.outcome()),
            coverage: supplied_session_coverage_token(audit.coverage()),
            checkpoints: audit
                .checkpoints()
                .iter()
                .map(|checkpoint| {
                    AssessmentSuppliedSessionCheckpointDocument::from_checkpoint(
                        checkpoint,
                        audit.renewal().is_some() || audit.oauth_refresh().is_some(),
                    )
                })
                .collect(),
            resources: audit
                .resources()
                .iter()
                .map(|resource| AssessmentSuppliedSessionResourceDocument {
                    sequence: resource.sequence(),
                    resource_reference: resource.resource_reference().to_owned(),
                    evidence_reference: resource.evidence_reference().map(str::to_owned),
                    outcome: supplied_session_resource_outcome_token(resource.outcome()),
                    status: resource.status(),
                    response_bytes: resource.response_bytes(),
                    epoch: resource.epoch(),
                })
                .collect(),
            selected_resource_count: audit.selected_resource_count(),
            dispatched_resource_count: audit.dispatched_resource_count(),
            committed_resource_count: audit.committed_resource_count(),
            dispatched_request_count: audit.dispatched_request_count(),
            response_bytes: audit.response_bytes(),
            response_byte_limit: audit.response_byte_limit(),
            response_byte_limit_exceeded: audit.response_byte_limit_exceeded(),
            refresh_performed: audit.refresh_performed(),
            anonymous_fallback_performed: audit.anonymous_fallback_performed(),
            continuous_authentication_established: audit.continuous_authentication_established(),
            exploit_execution: "not_performed",
            impact_validation: "not_performed",
        };
        document.validate(&[])?;
        Ok(document)
    }

    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        if self.schema == SUPPLIED_SESSION_OAUTH_AUTHORIZATION_AUDIT_SCHEMA {
            if items
                .iter()
                .any(|item| item.capability_id == SUPPLIED_SESSION_CAPABILITY_ID)
            {
                return Err(ReportError::Serialization);
            }
            let value = serde_json::to_value(self).map_err(|_| ReportError::Serialization)?;
            return comparison::validate_supplied_session_oauth_authorization(&value)
                .map(|_| ())
                .map_err(|_| ReportError::Serialization);
        }
        if self.schema == SUPPLIED_SESSION_OAUTH_REFRESH_AUDIT_SCHEMA {
            if items
                .iter()
                .any(|item| item.capability_id == SUPPLIED_SESSION_CAPABILITY_ID)
            {
                return Err(ReportError::Serialization);
            }
            let value = serde_json::to_value(self).map_err(|_| ReportError::Serialization)?;
            return comparison::validate_supplied_session_oauth_refresh(&value)
                .map(|_| ())
                .map_err(|_| ReportError::Serialization);
        }
        if self.schema == SUPPLIED_SESSION_OAUTH_CODE_AUDIT_SCHEMA {
            if items
                .iter()
                .any(|item| item.capability_id == SUPPLIED_SESSION_CAPABILITY_ID)
            {
                return Err(ReportError::Serialization);
            }
            let value = serde_json::to_value(self).map_err(|_| ReportError::Serialization)?;
            return comparison::validate_supplied_session_oauth_code(&value)
                .map(|_| ())
                .map_err(|_| ReportError::Serialization);
        }
        if self.schema == SUPPLIED_SESSION_RENEWAL_AUDIT_SCHEMA {
            if items
                .iter()
                .any(|item| item.capability_id == SUPPLIED_SESSION_CAPABILITY_ID)
            {
                return Err(ReportError::Serialization);
            }
            let value = serde_json::to_value(self).map_err(|_| ReportError::Serialization)?;
            return comparison::validate_supplied_session_renewal(&value)
                .map(|_| ())
                .map_err(|_| ReportError::Serialization);
        }
        if self.renewal.is_some()
            || self.oauth_code.is_some()
            || self.oauth_refresh.is_some()
            || self.oauth_authorization.is_some()
            || self.oauth_token_exchange.is_some()
            || self
                .checkpoints
                .iter()
                .any(|checkpoint| checkpoint.epoch.is_some())
        {
            return Err(ReportError::Serialization);
        }
        let resource_response_bytes = self
            .resources
            .iter()
            .map(|resource| resource.response_bytes)
            .try_fold(0_u64, u64::checked_add);
        let checkpoint_response_bytes = self
            .checkpoints
            .iter()
            .map(|checkpoint| checkpoint.response_bytes)
            .try_fold(0_u64, u64::checked_add);
        let dispatched_resources = self
            .resources
            .iter()
            .filter(|resource| resource.outcome != "not_dispatched")
            .count();
        let committed_resources = self
            .resources
            .iter()
            .filter(|resource| resource.outcome == "committed")
            .count();
        let unique_resource_references = self
            .resources
            .iter()
            .map(|resource| resource.resource_reference.as_str())
            .collect::<std::collections::BTreeSet<_>>();
        let checkpoint_evidence_reference_count = self
            .checkpoints
            .iter()
            .filter(|checkpoint| checkpoint.evidence_reference.is_some())
            .count();
        let unique_checkpoint_evidence_references = self
            .checkpoints
            .iter()
            .filter_map(|checkpoint| checkpoint.evidence_reference.as_deref())
            .collect::<std::collections::BTreeSet<_>>();
        let resource_evidence_reference_count = self
            .resources
            .iter()
            .filter(|resource| resource.evidence_reference.is_some())
            .count();
        let unique_resource_evidence_references = self
            .resources
            .iter()
            .filter_map(|resource| resource.evidence_reference.as_deref())
            .collect::<std::collections::BTreeSet<_>>();
        let response_bytes = checkpoint_response_bytes
            .zip(resource_response_bytes)
            .and_then(|(checkpoints, resources)| checkpoints.checked_add(resources))
            .and_then(|existing| {
                existing.checked_add(self.login.as_ref().map_or(0, |login| login.response_bytes))
            });
        let login_dispatched_requests = self.login.as_ref().map_or(0_usize, |login| {
            usize::from(login.page_dispatched) + usize::from(login.submit_dispatched)
        });
        let v3_epoch_transition_is_valid = match (self.schema, self.login.as_ref()) {
            (SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA, Some(login)) => {
                let startup_authenticated = self.checkpoints.first().is_some_and(|checkpoint| {
                    checkpoint.phase == "startup"
                        && checkpoint.outcome == "healthy"
                        && checkpoint.predicate == "matched"
                });
                login.final_epoch == 1
                    || !startup_authenticated
                    || (matches!(
                        self.outcome,
                        "credential_update_required" | "credential_update_unusable"
                    ) && self.checkpoints.len() == 1
                        && dispatched_resources == 0
                        && self
                            .resources
                            .iter()
                            .all(|resource| resource.outcome == "not_dispatched"))
            },
            (SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA, None) => false,
            _ => true,
        };
        let cookie_contract_is_valid = match (
            self.schema,
            self.credential_mechanism,
            self.credential_acquisition,
            self.cookie_policy.as_ref(),
            self.cookie_lifecycle.as_ref(),
            self.login.as_ref(),
        ) {
            (SUPPLIED_SESSION_AUDIT_SCHEMA, "authorization_header", None, None, None, None) => {
                !matches!(
                    self.outcome,
                    "credential_update_required"
                        | "credential_update_unusable"
                        | "login_form_unavailable"
                        | "login_submit_unavailable"
                        | "login_cookie_unavailable"
                )
            },
            (
                SUPPLIED_SESSION_COOKIE_AUDIT_SCHEMA,
                "cookie_jar",
                None,
                Some(policy),
                Some(lifecycle),
                None,
            ) => {
                let declared = usize::from(policy.declared_count);
                let dispatched_requests = usize::from(self.dispatched_request_count);
                (1..=MAX_SUPPLIED_SESSION_COOKIES).contains(&declared)
                    && usize::from(policy.host_only_count)
                        .checked_add(usize::from(policy.domain_count))
                        == Some(declared)
                    && usize::from(policy.secure_count) <= declared
                    && usize::from(policy.same_site_none_count) <= usize::from(policy.secure_count)
                    && usize::from(policy.http_only_count) <= declared
                    && usize::from(policy.session_count)
                        .checked_add(usize::from(policy.persistent_count))
                        == Some(declared)
                    && usize::from(policy.same_site_missing_count)
                        .checked_add(usize::from(policy.same_site_strict_count))
                        .and_then(|count| {
                            count.checked_add(usize::from(policy.same_site_lax_count))
                        })
                        .and_then(|count| {
                            count.checked_add(usize::from(policy.same_site_none_count))
                        })
                        == Some(declared)
                    && policy.update_policy == "stop_on_selected_cookie"
                    && policy.browser_semantics == "attributes_preserved_not_browser_csrf_emulation"
                    && lifecycle.initial_epoch == 1
                    && lifecycle.final_epoch == 1
                    && usize::from(lifecycle.selected_update_response_count) <= dispatched_requests
                    && usize::from(lifecycle.unselected_update_response_count)
                        .checked_add(usize::from(lifecycle.update_classification_failure_count))
                        .is_some_and(|count| count <= dispatched_requests)
                    && lifecycle.updates_applied == 0
                    && match self.outcome {
                        "credential_update_required" => {
                            lifecycle.selected_update_response_count == 1
                                && lifecycle.update_classification_failure_count == 0
                        },
                        "credential_update_unusable" => {
                            lifecycle.selected_update_response_count == 0
                                && lifecycle.update_classification_failure_count == 1
                        },
                        "login_form_unavailable"
                        | "login_submit_unavailable"
                        | "login_cookie_unavailable" => false,
                        _ => {
                            lifecycle.selected_update_response_count == 0
                                && lifecycle.update_classification_failure_count == 0
                        },
                    }
            },
            (
                SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA,
                "cookie_jar",
                Some("bounded_form_login"),
                Some(policy),
                Some(lifecycle),
                Some(login),
            ) => {
                let declared = usize::from(policy.declared_count);
                let dispatched_requests = usize::from(self.dispatched_request_count);
                let update_eligible_requests =
                    dispatched_requests.checked_sub(login_dispatched_requests);
                (1..=MAX_SUPPLIED_SESSION_COOKIES).contains(&declared)
                    && usize::from(policy.host_only_count) == declared
                    && policy.domain_count == 0
                    && (usize::from(policy.secure_count) == 0
                        || usize::from(policy.secure_count) == declared)
                    && usize::from(policy.http_only_count) == declared
                    && usize::from(policy.session_count) == declared
                    && policy.persistent_count == 0
                    && policy.same_site_missing_count == 0
                    && usize::from(policy.same_site_strict_count)
                        .checked_add(usize::from(policy.same_site_lax_count))
                        == Some(declared)
                    && policy.same_site_none_count == 0
                    && policy.update_policy == "stop_on_selected_cookie"
                    && policy.browser_semantics == "attributes_preserved_not_browser_csrf_emulation"
                    && lifecycle.initial_epoch == 0
                    && lifecycle.final_epoch == login.final_epoch
                    && update_eligible_requests.is_some_and(|eligible| {
                        usize::from(lifecycle.selected_update_response_count) <= eligible
                            && usize::from(lifecycle.unselected_update_response_count)
                                .checked_add(usize::from(
                                    lifecycle.update_classification_failure_count,
                                ))
                                .is_some_and(|count| count <= eligible)
                    })
                    && lifecycle.updates_applied == 0
                    && login
                        .validate(self.outcome, self.checkpoints.first())
                        .is_ok()
                    && (login.submit_outcome != "cookie_acquired"
                        || login.acquired_cookie_count == policy.declared_count)
                    && match self.outcome {
                        "credential_update_required" => {
                            lifecycle.selected_update_response_count == 1
                                && lifecycle.update_classification_failure_count == 0
                        },
                        "credential_update_unusable" => {
                            lifecycle.selected_update_response_count == 0
                                && lifecycle.update_classification_failure_count == 1
                        },
                        _ => {
                            lifecycle.selected_update_response_count == 0
                                && lifecycle.update_classification_failure_count == 0
                        },
                    }
            },
            _ => false,
        };
        if !cookie_contract_is_valid
            || !v3_epoch_transition_is_valid
            || self.capability_id != SUPPLIED_SESSION_CAPABILITY_ID
            || !valid_supplied_session_reference(
                &self.policy_reference,
                "supplied-session-policy-sha256:",
            )
            || !valid_supplied_session_reference(
                &self.application_reference,
                "supplied-session-application-sha256:",
            )
            || self.principal_reference != "supplied-session-principal-0001"
            || !valid_supplied_session_principal_alias(&self.principal_alias)
            || self.principal_assurance != "operator_declared"
            || self.health_oracle.kind != "json_boolean_true"
            || !valid_supplied_session_reference(
                &self.health_oracle.field_reference,
                "supplied-session-health-field-sha256:",
            )
            || self.resources.is_empty()
            || self.resources.len() > MAX_SUPPLIED_SESSION_RESOURCES
            || (self.schema == SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA
                && self.resources.len() > MAX_SUPPLIED_SESSION_RESOURCES.saturating_sub(1))
            || self.checkpoints.len() > MAX_SUPPLIED_SESSION_CHECKPOINTS
            || usize::from(self.selected_resource_count) != self.resources.len()
            || usize::from(self.dispatched_resource_count) != dispatched_resources
            || usize::from(self.committed_resource_count) != committed_resources
            || usize::from(self.dispatched_request_count)
                > usize::from(MAX_SUPPLIED_SESSION_REQUESTS)
            || self.response_byte_limit == 0
            || self.response_byte_limit > MAX_SUPPLIED_SESSION_TOTAL_RESPONSE_BYTES
            || self.response_byte_limit_exceeded != (self.response_bytes > self.response_byte_limit)
            || usize::from(self.dispatched_request_count)
                != self
                    .checkpoints
                    .len()
                    .saturating_add(dispatched_resources)
                    .saturating_add(login_dispatched_requests)
            || response_bytes != Some(self.response_bytes)
            || unique_resource_references.len() != self.resources.len()
            || unique_checkpoint_evidence_references.len() != checkpoint_evidence_reference_count
            || unique_resource_evidence_references.len() != resource_evidence_reference_count
            || self.refresh_performed
            || self.anonymous_fallback_performed
            || self.continuous_authentication_established
            || !matches!(
                self.outcome,
                "complete"
                    | "startup_unhealthy"
                    | "session_lost"
                    | "resource_unavailable"
                    | "runtime_limit"
                    | "cancelled"
                    | "credential_update_required"
                    | "credential_update_unusable"
                    | "login_form_unavailable"
                    | "login_submit_unavailable"
                    | "login_cookie_unavailable"
            )
            || !matches!(self.coverage, "complete" | "partial" | "none")
            || (self.coverage == "complete" && self.outcome != "complete")
            || (matches!(
                self.outcome,
                "credential_update_required"
                    | "credential_update_unusable"
                    | "login_form_unavailable"
                    | "login_submit_unavailable"
                    | "login_cookie_unavailable"
            ) && self.coverage == "complete")
            || self.exploit_execution != "not_performed"
            || self.impact_validation != "not_performed"
            || items
                .iter()
                .any(|item| item.capability_id == SUPPLIED_SESSION_CAPABILITY_ID)
        {
            return Err(ReportError::Serialization);
        }
        for (index, checkpoint) in self.checkpoints.iter().enumerate() {
            let expected_phase = if index == 0 {
                "startup"
            } else if index == usize::from(self.selected_resource_count) {
                "terminal"
            } else {
                "subject_boundary"
            };
            if usize::from(checkpoint.sequence) != index
                || usize::from(checkpoint.after_subject_count) != index
                || checkpoint.phase != expected_phase
                || checkpoint
                    .evidence_reference
                    .as_deref()
                    .is_some_and(|reference| {
                        !valid_supplied_session_reference(
                            reference,
                            "supplied-session-checkpoint-evidence-sha256:",
                        )
                    })
                || (checkpoint.outcome != "indeterminate"
                    && checkpoint.evidence_reference.is_none())
            {
                return Err(ReportError::Serialization);
            }
        }
        for (index, resource) in self.resources.iter().enumerate() {
            if usize::from(resource.sequence) != index
                || resource.epoch != 1
                || !valid_supplied_session_reference(
                    &resource.resource_reference,
                    "supplied-session-resource-sha256:",
                )
                || (matches!(resource.outcome, "committed" | "health_unqualified")
                    != resource
                        .evidence_reference
                        .as_deref()
                        .is_some_and(|reference| {
                            valid_supplied_session_reference(
                                reference,
                                "supplied-session-resource-evidence-sha256:",
                            )
                        }))
            {
                return Err(ReportError::Serialization);
            }
        }
        Ok(())
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        let mut metadata = vec![
            ("Audit schema", self.schema.to_owned()),
            ("Capability", self.capability_id.to_owned()),
            ("Policy reference", self.policy_reference.clone()),
            ("Application reference", self.application_reference.clone()),
            ("Principal reference", self.principal_reference.clone()),
            ("Principal alias", self.principal_alias.clone()),
            ("Principal assurance", self.principal_assurance.to_owned()),
            ("Credential mechanism", self.credential_mechanism.to_owned()),
            ("Health oracle", self.health_oracle.kind.to_owned()),
            (
                "Health field reference",
                self.health_oracle.field_reference.clone(),
            ),
            ("Outcome", self.outcome.to_owned()),
            ("Coverage", self.coverage.to_owned()),
            (
                "Selected resources",
                self.selected_resource_count.to_string(),
            ),
            (
                "Dispatched resources",
                self.dispatched_resource_count.to_string(),
            ),
            (
                "Committed resources",
                self.committed_resource_count.to_string(),
            ),
            (
                "Dispatched requests",
                self.dispatched_request_count.to_string(),
            ),
            ("Response bytes", self.response_bytes.to_string()),
            ("Response byte limit", self.response_byte_limit.to_string()),
            (
                "Response byte limit exceeded",
                self.response_byte_limit_exceeded.to_string(),
            ),
            ("Refresh performed", self.refresh_performed.to_string()),
            (
                "Anonymous fallback performed",
                self.anonymous_fallback_performed.to_string(),
            ),
            (
                "Continuous authentication established",
                self.continuous_authentication_established.to_string(),
            ),
            ("Exploit execution", self.exploit_execution.to_owned()),
            ("Impact validation", self.impact_validation.to_owned()),
        ];
        if let Some(acquisition) = self.credential_acquisition {
            metadata.push(("Credential acquisition", acquisition.to_owned()));
        }
        if let Some(authorization) = self.oauth_authorization.as_ref() {
            metadata.extend([
                ("OAuth authorization profile", "loopback-form-post-state/v1".to_owned()),
                ("OAuth authorization policy reference", authorization.authorization_policy_reference().to_owned()),
                ("OAuth callback outcome", format!("{:?}", authorization.outcome())),
                ("OAuth callback reception reservations (not outgoing HTTP)", authorization.reservation_count().to_string()),
                ("OAuth accepted loopback connections", authorization.accepted_connection_count().to_string()),
                ("OAuth committed state/issuer-qualified callbacks", authorization.callback_commit_count().to_string()),
                ("OAuth recorded state validation", authorization.state_validated().to_string()),
                ("OAuth recorded issuer validation", authorization.issuer_validated().to_string()),
                ("OAuth inbound framing and form bytes (charged to parent)", authorization.ingress_bytes().to_string()),
                ("OAuth authorization assurance", "Selected policy requires client-generated S256/state and exact issuer/single-use callback binding; only recorded validation and commit counts establish completed checks. These facts are not browser/sender authentication or remote PKCE enforcement. Authorization wait is bounded separately under the same immutable parent deadline. No OIDC nonce, identity or token signature validation.".to_owned()),
            ]);
        }
        if let Some(exchange) = self.oauth_token_exchange.as_ref() {
            metadata.extend([
                ("OAuth token exchange profile", "client-initiated-public-code-s256-bearer/v1".to_owned()),
                ("OAuth IdP reference", exchange.idp_reference().to_owned()),
                ("OAuth token exchange outcome", exchange.outcome().as_str().to_owned()),
                ("OAuth outgoing token attempts", exchange.request_attempt_count().to_string()),
                ("OAuth admitted token requests", exchange.request_admitted_count().to_string()),
                ("OAuth committed credentials", exchange.credential_commit_count().to_string()),
                ("OAuth token response bytes", exchange.response_bytes().to_string()),
                ("OAuth token meaning", "Opaque Bearer credential; protected health and resource coverage are qualified separately, not OIDC identity.".to_owned()),
            ]);
        }
        if let Some(code) = self.oauth_code.as_ref() {
            metadata.extend([
                ("OAuth code profile", "external-public-code-s256-bearer/v1".to_owned()),
                ("OAuth IdP reference", code.idp_reference().to_owned()),
                ("OAuth acquisition outcome", code.outcome().as_str().to_owned()),
                ("OAuth attempted dispatches", code.request_attempt_count().to_string()),
                ("OAuth admitted requests", code.request_admitted_count().to_string()),
                ("OAuth complete responses", code.response_completed_count().to_string()),
                ("OAuth committed credentials", code.credential_commit_count().to_string()),
                ("OAuth response bytes", code.response_bytes().to_string()),
                ("OAuth declared token lifetime seconds", code.declared_token_lifetime_seconds()
                    .map_or_else(|| "not_established".to_owned(), |seconds| seconds.to_string())),
                ("OAuth transaction assurance", "operator_declared_external_transaction; original S256 enforcement and front-channel CSRF not established".to_owned()),
                ("OAuth token meaning", "opaque Bearer credential, not OIDC identity; target health and coverage qualified separately".to_owned()),
                ("OAuth initiation / callback / state-nonce / OIDC / signature verification", "not_performed".to_owned()),
            ]);
        }
        if let Some(refresh) = self.oauth_refresh.as_ref() {
            metadata.extend([
                ("OAuth renewal profile", "scheduled-public-bearer-refresh/v1".to_owned()),
                ("OAuth renewal policy reference", refresh.refresh_policy_reference().to_owned()),
                ("OAuth renewal outcome", refresh.outcome().as_str().to_owned()),
                ("OAuth renewal attempted dispatches", refresh.request_attempt_count().to_string()),
                ("OAuth renewal admitted requests", refresh.request_admitted_count().to_string()),
                ("OAuth renewal complete responses", refresh.response_completed_count().to_string()),
                ("OAuth renewal committed credentials", refresh.credential_commit_count().to_string()),
                ("OAuth renewal response bytes", refresh.response_bytes().to_string()),
                ("OAuth renewal initial epoch", refresh.initial_epoch().to_string()),
                ("OAuth renewal final epoch", refresh.final_epoch().to_string()),
                ("OAuth replacement refresh token returned", refresh.replacement_refresh_token_received()
                    .map_or_else(|| "not_established".to_owned(), |value| value.to_string())),
                ("OAuth replacement value differs", refresh.replacement_value_differs()
                    .map_or_else(|| "not_established".to_owned(), |value| value.to_string())),
                ("Health observations (common plus renewal)",
                    (self.checkpoints.len() + usize::from(refresh.health().is_some())).to_string()),
                ("OAuth renewal assurance", "Returned value inequality is a local observation, not server revocation or replay-detection proof; no OIDC identity, signature, or front-channel verification is established.".to_owned()),
            ]);
        }
        if let Some(policy) = self.cookie_policy.as_ref() {
            metadata.extend([
                ("Declared cookies", policy.declared_count.to_string()),
                ("Host-only cookies", policy.host_only_count.to_string()),
                ("Domain cookies", policy.domain_count.to_string()),
                ("Secure cookies", policy.secure_count.to_string()),
                ("HttpOnly cookies", policy.http_only_count.to_string()),
                ("Session cookies", policy.session_count.to_string()),
                ("Persistent cookies", policy.persistent_count.to_string()),
                (
                    "SameSite missing cookies",
                    policy.same_site_missing_count.to_string(),
                ),
                (
                    "SameSite strict cookies",
                    policy.same_site_strict_count.to_string(),
                ),
                (
                    "SameSite lax cookies",
                    policy.same_site_lax_count.to_string(),
                ),
                (
                    "SameSite none cookies",
                    policy.same_site_none_count.to_string(),
                ),
                ("Cookie update policy", policy.update_policy.to_owned()),
                ("Browser semantics", policy.browser_semantics.to_owned()),
            ]);
        }
        if let Some(lifecycle) = self.cookie_lifecycle.as_ref() {
            metadata.extend([
                ("Initial session epoch", lifecycle.initial_epoch.to_string()),
                ("Final session epoch", lifecycle.final_epoch.to_string()),
                (
                    "Selected cookie-update responses",
                    lifecycle.selected_update_response_count.to_string(),
                ),
                (
                    "Unselected cookie-update responses",
                    lifecycle.unselected_update_response_count.to_string(),
                ),
                (
                    "Cookie-update classification failures",
                    lifecycle.update_classification_failure_count.to_string(),
                ),
                (
                    "Cookie updates applied",
                    lifecycle.updates_applied.to_string(),
                ),
            ]);
        }
        if let Some(renewal) = self.renewal.as_ref() {
            metadata.extend([
                ("Renewal reference", renewal.renewal_reference.clone()),
                (
                    "Renewal after resource count",
                    renewal.after_resource_count.to_string(),
                ),
                ("Renewal attempt count", renewal.attempt_count.to_string()),
                ("Renewal response bytes", renewal.response_bytes.to_string()),
                (
                    "Renewal applied cookie count",
                    renewal.applied_cookie_count.to_string(),
                ),
                ("Renewal initial epoch", renewal.initial_epoch.to_string()),
                ("Renewal final epoch", renewal.final_epoch.to_string()),
                (
                    "Renewal health",
                    renewal
                        .health
                        .as_ref()
                        .map_or("not_dispatched", |health| health.outcome)
                        .to_owned(),
                ),
            ]);
        }
        if let Some(login) = self.login.as_ref() {
            metadata.extend([
                ("Login reference", login.login_reference.clone()),
                ("Login attempt limit", login.max_attempts.to_string()),
                ("Login attempt count", login.attempt_count.to_string()),
                ("Login page dispatched", login.page_dispatched.to_string()),
                (
                    "Login page status",
                    login
                        .page_status
                        .map_or_else(|| "none".to_owned(), |value| value.to_string()),
                ),
                ("Login page body state", login.page_body_state.to_owned()),
                ("Login form outcome", login.form_outcome.to_owned()),
                (
                    "Login form error code",
                    login.form_error_code.unwrap_or("none").to_owned(),
                ),
                (
                    "Login submit dispatched",
                    login.submit_dispatched.to_string(),
                ),
                (
                    "Login submit status",
                    login
                        .submit_status
                        .map_or_else(|| "none".to_owned(), |value| value.to_string()),
                ),
                (
                    "Login submit body state",
                    login.submit_body_state.to_owned(),
                ),
                ("Login submit outcome", login.submit_outcome.to_owned()),
                (
                    "Acquired cookie count",
                    login.acquired_cookie_count.to_string(),
                ),
                ("Login response bytes", login.response_bytes.to_string()),
                ("Login initial epoch", login.initial_epoch.to_string()),
                ("Login final epoch", login.final_epoch.to_string()),
                (
                    "Pre-session cookie applied",
                    login.pre_session_cookie_applied.to_string(),
                ),
            ]);
        }
        metadata
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
fn valid_supplied_session_reference(value: &str, prefix: &str) -> bool {
    value.len() == prefix.len() + 64
        && value.starts_with(prefix)
        && value[prefix.len()..]
            .bytes()
            .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
fn valid_supplied_session_principal_alias(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= 128
        && value.bytes().all(|byte| {
            byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b':' | b'@' | b'-')
        })
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_principal_assurance_token(
    value: SuppliedSessionPrincipalAssurance,
) -> &'static str {
    match value {
        SuppliedSessionPrincipalAssurance::OperatorDeclared => "operator_declared",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_credential_mechanism_token(
    value: SuppliedSessionCredentialMechanism,
) -> &'static str {
    match value {
        SuppliedSessionCredentialMechanism::AuthorizationHeader => "authorization_header",
        SuppliedSessionCredentialMechanism::CookieJar => "cookie_jar",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_credential_acquisition_token(
    value: SuppliedSessionCredentialAcquisition,
) -> &'static str {
    value.as_str()
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_health_oracle_kind_token(
    value: SuppliedSessionHealthOracleKind,
) -> &'static str {
    match value {
        SuppliedSessionHealthOracleKind::JsonBooleanTrue => "json_boolean_true",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_audit_outcome_token(value: SuppliedSessionAuditOutcome) -> &'static str {
    match value {
        SuppliedSessionAuditOutcome::Complete => "complete",
        SuppliedSessionAuditOutcome::StartupUnhealthy => "startup_unhealthy",
        SuppliedSessionAuditOutcome::SessionLost => "session_lost",
        SuppliedSessionAuditOutcome::ResourceUnavailable => "resource_unavailable",
        SuppliedSessionAuditOutcome::RuntimeLimit => "runtime_limit",
        SuppliedSessionAuditOutcome::Cancelled => "cancelled",
        SuppliedSessionAuditOutcome::CredentialUpdateRequired => "credential_update_required",
        SuppliedSessionAuditOutcome::CredentialUpdateUnusable => "credential_update_unusable",
        SuppliedSessionAuditOutcome::LoginFormUnavailable => "login_form_unavailable",
        SuppliedSessionAuditOutcome::LoginSubmitUnavailable => "login_submit_unavailable",
        SuppliedSessionAuditOutcome::LoginCookieUnavailable => "login_cookie_unavailable",
        SuppliedSessionAuditOutcome::RenewalUnavailable => "renewal_unavailable",
        SuppliedSessionAuditOutcome::OAuthCodeExchangeUnavailable => {
            "oauth_code_exchange_unavailable"
        },
        SuppliedSessionAuditOutcome::OAuthRefreshUnavailable => "oauth_refresh_unavailable",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_login_form_outcome_token(
    value: SuppliedSessionLoginFormOutcome,
) -> &'static str {
    match value {
        SuppliedSessionLoginFormOutcome::Matched => "matched",
        SuppliedSessionLoginFormOutcome::IneligibleResponse => "ineligible_response",
        SuppliedSessionLoginFormOutcome::Missing => "missing",
        SuppliedSessionLoginFormOutcome::Ambiguous => "ambiguous",
        SuppliedSessionLoginFormOutcome::Invalid => "invalid",
        SuppliedSessionLoginFormOutcome::TransportFailed => "transport_failed",
        SuppliedSessionLoginFormOutcome::RuntimeLimit => "runtime_limit",
        SuppliedSessionLoginFormOutcome::Cancelled => "cancelled",
        SuppliedSessionLoginFormOutcome::NotEvaluated => "not_evaluated",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_login_submit_outcome_token(
    value: SuppliedSessionLoginSubmitOutcome,
) -> &'static str {
    match value {
        SuppliedSessionLoginSubmitOutcome::CookieAcquired => "cookie_acquired",
        SuppliedSessionLoginSubmitOutcome::CookieUnavailable => "cookie_unavailable",
        SuppliedSessionLoginSubmitOutcome::HttpError => "http_error",
        SuppliedSessionLoginSubmitOutcome::RedirectRefused => "redirect_refused",
        SuppliedSessionLoginSubmitOutcome::Incomplete => "incomplete",
        SuppliedSessionLoginSubmitOutcome::TransportFailed => "transport_failed",
        SuppliedSessionLoginSubmitOutcome::RuntimeLimit => "runtime_limit",
        SuppliedSessionLoginSubmitOutcome::Cancelled => "cancelled",
        SuppliedSessionLoginSubmitOutcome::NotDispatched => "not_dispatched",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_coverage_token(value: SuppliedSessionCoverage) -> &'static str {
    match value {
        SuppliedSessionCoverage::Complete => "complete",
        SuppliedSessionCoverage::Partial => "partial",
        SuppliedSessionCoverage::None => "none",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_checkpoint_phase_token(
    value: SuppliedSessionHealthCheckpointPhase,
) -> &'static str {
    match value {
        SuppliedSessionHealthCheckpointPhase::Startup => "startup",
        SuppliedSessionHealthCheckpointPhase::SubjectBoundary => "subject_boundary",
        SuppliedSessionHealthCheckpointPhase::Terminal => "terminal",
        SuppliedSessionHealthCheckpointPhase::Renewal => "renewal",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_health_outcome_token(
    value: SuppliedSessionHealthOutcome,
) -> &'static str {
    match value {
        SuppliedSessionHealthOutcome::Healthy => "healthy",
        SuppliedSessionHealthOutcome::Unhealthy => "unhealthy",
        SuppliedSessionHealthOutcome::Indeterminate => "indeterminate",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_body_state_token(value: SuppliedSessionBodyState) -> &'static str {
    match value {
        SuppliedSessionBodyState::Complete => "complete",
        SuppliedSessionBodyState::Incomplete => "incomplete",
        SuppliedSessionBodyState::Unavailable => "unavailable",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_predicate_outcome_token(
    value: SuppliedSessionPredicateOutcome,
) -> &'static str {
    match value {
        SuppliedSessionPredicateOutcome::Matched => "matched",
        SuppliedSessionPredicateOutcome::NotMatched => "not_matched",
        SuppliedSessionPredicateOutcome::NotEvaluated => "not_evaluated",
    }
}

#[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
const fn supplied_session_resource_outcome_token(
    value: SuppliedSessionResourceOutcome,
) -> &'static str {
    match value {
        SuppliedSessionResourceOutcome::Committed => "committed",
        SuppliedSessionResourceOutcome::HealthUnqualified => "health_unqualified",
        SuppliedSessionResourceOutcome::HttpError => "http_error",
        SuppliedSessionResourceOutcome::RedirectRefused => "redirect_refused",
        SuppliedSessionResourceOutcome::Incomplete => "incomplete",
        SuppliedSessionResourceOutcome::TransportFailed => "transport_failed",
        SuppliedSessionResourceOutcome::NotDispatched => "not_dispatched",
    }
}

#[cfg(all(feature = "scanning", feature = "authorization-review"))]
#[derive(Serialize)]
struct AssessmentAuthorizationAuditDocument {
    schema: &'static str,
    capability_id: &'static str,
    policy_id: String,
    selected_path_count: u8,
    ignored_path_count: u8,
    request_count: u8,
    outcome: &'static str,
    primary_stable: Option<bool>,
    peer_stable: Option<bool>,
    cross_resources_equivalent: Option<bool>,
    item_projected: bool,
}

#[cfg(all(feature = "scanning", feature = "authorization-review"))]
impl AssessmentAuthorizationAuditDocument {
    fn from_audit(audit: &crate::web_runtime::WebAssessmentAuthorizationAudit) -> Self {
        Self {
            schema: "security.authorization-review-audit/v1",
            capability_id: RESOURCE_AUTHORIZATION_REVIEW_CAPABILITY_ID,
            policy_id: audit.policy_id().to_string(),
            selected_path_count: audit.selected_path_count(),
            ignored_path_count: audit.ignored_path_count(),
            request_count: audit.request_count(),
            outcome: authorization_review_outcome_token(audit.outcome()),
            primary_stable: audit.primary_stable(),
            peer_stable: audit.peer_stable(),
            cross_resources_equivalent: audit.cross_resources_equivalent(),
            item_projected: audit.item_projected(),
        }
    }

    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        let projected_count = items
            .iter()
            .filter(|item| item.capability_id == RESOURCE_AUTHORIZATION_REVIEW_CAPABILITY_ID)
            .count();
        let positive = self.outcome == "stable_cross_principal_equivalence";
        if self.schema != "security.authorization-review-audit/v1"
            || self.capability_id != RESOURCE_AUTHORIZATION_REVIEW_CAPABILITY_ID
            || !self.policy_id.starts_with("authorization-policy-sha256:")
            || self.selected_path_count == 0
            || usize::from(self.selected_path_count) > HARD_MAX_AUTHORIZATION_REVIEW_SELECTED_PATHS
            || usize::from(self.ignored_path_count) > HARD_MAX_AUTHORIZATION_REVIEW_IGNORED_PATHS
            || usize::from(self.request_count) > MAX_AUTHORIZATION_REVIEW_REQUESTS
            || projected_count > 1
            || self.item_projected != (projected_count == 1)
            || positive != self.item_projected
            || (positive && usize::from(self.request_count) != MAX_AUTHORIZATION_REVIEW_REQUESTS)
            || (positive
                && (self.primary_stable != Some(true)
                    || self.peer_stable != Some(true)
                    || self.cross_resources_equivalent != Some(true)))
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> [(&'static str, String); 11] {
        [
            ("Audit schema", self.schema.to_owned()),
            ("Capability", self.capability_id.to_owned()),
            ("Policy ID", self.policy_id.clone()),
            ("Selected path count", self.selected_path_count.to_string()),
            ("Ignored path count", self.ignored_path_count.to_string()),
            ("Request count", self.request_count.to_string()),
            ("Outcome", self.outcome.to_owned()),
            ("Primary stable", optional_bool_token(self.primary_stable)),
            ("Peer stable", optional_bool_token(self.peer_stable)),
            (
                "Cross resources equivalent",
                optional_bool_token(self.cross_resources_equivalent),
            ),
            ("Item projected", self.item_projected.to_string()),
        ]
    }
}

#[cfg(all(feature = "scanning", feature = "websocket-review"))]
const WEBSOCKET_REVIEW_PHYSICAL_FRAME_COUNT: &str = "unavailable";
#[cfg(all(feature = "scanning", feature = "websocket-review"))]
const WEBSOCKET_REVIEW_MAX_FRAME_SIZE: &str = "bounded_by_max_inbound_message_bytes";
#[cfg(all(feature = "scanning", feature = "websocket-review"))]
const WEBSOCKET_REVIEW_TRANSPORT_BYTE_SCOPE: &str = "socket_wire_bytes_tls_ciphertext_when_wss";
#[cfg(all(feature = "scanning", feature = "websocket-review"))]
const WEBSOCKET_REVIEW_CLAIM_LIMITS: [&str; 8] = [
    "browser_origin_security_not_established",
    "authentication_not_established",
    "authorization_not_established",
    "availability_not_established",
    "vulnerability_not_established",
    "exploitability_not_established",
    "impact_not_established",
    "source_authenticity_not_established",
];
#[cfg(all(feature = "scanning", feature = "websocket-review"))]
const WEBSOCKET_SUPPLIED_SESSION_CLAIM_LIMITS: [&str; 9] = [
    "browser_origin_security_not_established",
    "authentication_not_established",
    "authorization_not_established",
    "availability_not_established",
    "vulnerability_not_established",
    "exploitability_not_established",
    "impact_not_established",
    "source_authenticity_not_established",
    "continuous_authentication_not_established",
];

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_CLAIM_LIMITS: [&str; 7] = [
    "not_confirmed_xxe",
    "file_read_not_performed",
    "data_exfiltration_not_performed",
    "internal_network_access_not_performed",
    "parser_identity_not_established",
    "impact_validation_not_performed",
    "source_authentication_not_established",
];
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_TITLE: &str =
    "Repeated correlated outbound interactions after XML inputs";
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_CATEGORY: &str = "XML external resource resolution";
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_SUMMARY: &str = "Two independently allocated callback targets received distinct correlated HTTP interactions after fixed candidate and replay XML documents; parser identity, semantic effect, exploitability, and impact remain unestablished.";
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_REMEDIATION_ID: &str =
    "web.remediation.xml-external-entity-policy@1";
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_REMEDIATION_SUMMARY: &str = "Disable unneeded external entity resolution and independently review the exact server-side XML parser policy before treating this observation as a vulnerability.";
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_CONTROL_EVIDENCE_COUNT: usize = 3;
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const XML_EXTERNAL_ENTITY_REVIEW_CANDIDATE_EVIDENCE_COUNT: usize = 5;
#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const MAX_XML_EXTERNAL_ENTITY_COMPLETE_TARGET_RESPONSE_BYTES: u64 =
    XML_EXTERNAL_ENTITY_TARGET_REQUESTS as u64 * MAX_XML_EXTERNAL_ENTITY_TARGET_RESPONSE_BYTES;

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
#[derive(Serialize)]
struct AssessmentXmlExternalEntityReviewAuditDocument {
    schema: &'static str,
    algorithm: &'static str,
    policy: AssessmentXmlExternalEntityPolicyDocument,
    outcome: &'static str,
    target: AssessmentXmlExternalEntityTargetDocument,
    provider: AssessmentXmlExternalEntityProviderDocument,
    item_projected: bool,
    semantic_effect: &'static str,
    impact_validation: &'static str,
    claim_limits: Vec<&'static str>,
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
#[derive(Serialize)]
struct AssessmentXmlExternalEntityPolicyDocument {
    id: String,
    method: &'static str,
    media_type: &'static str,
    control_model: &'static str,
    execution_mode: &'static str,
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
#[derive(Serialize)]
struct AssessmentXmlExternalEntityTargetDocument {
    request_count: u8,
    request_body_bytes: u64,
    response_bytes: u64,
    complete: bool,
    accounting_complete: bool,
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
#[derive(Serialize)]
struct AssessmentXmlExternalEntityProviderDocument {
    request_count: u8,
    active_verification_count: u8,
    preflight_clean: bool,
    control_callback_observed: bool,
    candidate_callback_observed: bool,
    replay_callback_observed: bool,
    callback_targets_distinct: bool,
    event_identities_distinct: bool,
    cleanup_verified: bool,
    complete: bool,
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
impl AssessmentXmlExternalEntityReviewAuditDocument {
    fn from_audit(audit: &XmlExternalEntityReviewAudit) -> Result<Self, ReportError> {
        let document = Self {
            schema: audit.schema(),
            algorithm: audit.algorithm(),
            policy: AssessmentXmlExternalEntityPolicyDocument {
                id: audit.policy_id().to_owned(),
                method: "post",
                media_type: audit.media_type(),
                control_model: audit.control_model(),
                execution_mode: audit.execution_mode().as_str(),
            },
            outcome: xml_external_entity_outcome_token(audit.outcome()),
            target: AssessmentXmlExternalEntityTargetDocument {
                request_count: audit.target_request_count(),
                request_body_bytes: audit.target_request_body_bytes(),
                response_bytes: audit.target_response_bytes(),
                complete: audit.target_complete(),
                accounting_complete: audit.target_accounting_complete(),
            },
            provider: AssessmentXmlExternalEntityProviderDocument {
                request_count: audit.provider_request_count(),
                active_verification_count: audit.active_verification_count(),
                preflight_clean: audit.preflight_clean(),
                control_callback_observed: audit.control_callback_observed(),
                candidate_callback_observed: audit.candidate_callback_observed(),
                replay_callback_observed: audit.replay_callback_observed(),
                callback_targets_distinct: audit.callback_targets_distinct(),
                event_identities_distinct: audit.event_identities_distinct(),
                cleanup_verified: audit.cleanup_verified(),
                complete: audit.provider_accounting_complete(),
            },
            item_projected: audit.item_projected(),
            semantic_effect: xml_external_entity_operation_token(audit.semantic_effect()),
            impact_validation: xml_external_entity_operation_token(audit.impact_validation()),
            claim_limits: {
                let limits = audit.claim_limits();
                if limits.maximum_disposition() != XmlExternalEntityMaximumDisposition::NeedsReview
                    || limits.semantic_effect() != XmlExternalEntityOperationStatus::NotPerformed
                    || limits.impact_validation() != XmlExternalEntityOperationStatus::NotPerformed
                    || audit.method() != XML_EXTERNAL_ENTITY_REVIEW_METHOD
                {
                    return Err(ReportError::Serialization);
                }
                XML_EXTERNAL_ENTITY_REVIEW_CLAIM_LIMITS.to_vec()
            },
        };
        document.validate_wire()?;
        Ok(document)
    }

    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        self.validate_wire()?;
        let matching_items = items
            .iter()
            .filter(|item| item.capability_id == XML_EXTERNAL_ENTITY_REVIEW_CAPABILITY_ID)
            .collect::<Vec<_>>();
        if matching_items.len() > 1
            || self.item_projected != (matching_items.len() == 1)
            || matching_items.first().is_some_and(|item| {
                item.subject_reference != "subject-0000"
                    || item.presentation_target != "assessment_subject"
                    || item.title != XML_EXTERNAL_ENTITY_REVIEW_TITLE
                    || item.disposition != "needs_review"
                    || item.claim_basis != "differential"
                    || item.severity.is_some()
                    || item.confidence_ppm != 900_000
                    || item.redacted_summary != XML_EXTERNAL_ENTITY_REVIEW_SUMMARY
                    || item.category != XML_EXTERNAL_ENTITY_REVIEW_CATEGORY
                    || item.cwe != Some("CWE-611")
                    || item.remediation.id != XML_EXTERNAL_ENTITY_REVIEW_REMEDIATION_ID
                    || item.remediation.summary != XML_EXTERNAL_ENTITY_REVIEW_REMEDIATION_SUMMARY
                    || !xml_external_entity_evidence_linkage_is_exact(item)
            })
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn validate_wire(&self) -> Result<(), ReportError> {
        const OUTCOMES: [&str; 13] = [
            "not_eligible",
            "control_incomplete",
            "preflight_contaminated",
            "control_callback_observed",
            "no_callback",
            "candidate_only",
            "replay_only",
            "correlation_mismatch",
            "cleanup_incomplete",
            "cancelled",
            "budget_exhausted",
            "incomplete",
            "repeated_external_entity_resolution_observed",
        ];
        let positive = self.outcome == "repeated_external_entity_resolution_observed";
        let no_callbacks = !self.provider.control_callback_observed
            && !self.provider.candidate_callback_observed
            && !self.provider.replay_callback_observed;
        let provider_empty_consistent = self.provider.request_count != 0
            || (self.provider.active_verification_count == 0
                && !self.provider.preflight_clean
                && !self.provider.control_callback_observed
                && !self.provider.candidate_callback_observed
                && !self.provider.replay_callback_observed
                && !self.provider.callback_targets_distinct
                && !self.provider.event_identities_distinct
                && !self.provider.cleanup_verified
                && !self.provider.complete);
        let callback_facts_consistent = no_callbacks || self.provider.callback_targets_distinct;
        let event_facts_consistent = !self.provider.event_identities_distinct
            || (self.provider.callback_targets_distinct
                && self.provider.candidate_callback_observed
                && self.provider.replay_callback_observed);
        let provider_completion_consistent = !self.provider.complete
            || (usize::from(self.provider.request_count) >= 9
                && self.provider.preflight_clean
                && self.provider.callback_targets_distinct);
        let target_started_consistent = self.target.request_count == 0
            || (self.provider.request_count > 0
                && self.provider.preflight_clean
                && self.provider.callback_targets_distinct);
        let complete_lifecycle = usize::from(self.target.request_count)
            == XML_EXTERNAL_ENTITY_TARGET_REQUESTS
            && self.target.request_body_bytes > 0
            && self.provider.request_count > 0
            && self.target.complete
            && self.target.accounting_complete
            && usize::from(self.provider.active_verification_count)
                == XML_EXTERNAL_ENTITY_ACTIVE_VERIFICATIONS
            && self.provider.preflight_clean
            && !self.provider.control_callback_observed
            && self.provider.callback_targets_distinct
            && self.provider.cleanup_verified
            && self.provider.complete;
        let complete_positive = complete_lifecycle
            && self.provider.candidate_callback_observed
            && self.provider.replay_callback_observed
            && self.provider.event_identities_distinct;
        let empty_lifecycle = self.target.request_count == 0
            && self.provider.request_count == 0
            && no_callbacks
            && !self.target.complete
            && !self.provider.preflight_clean
            && !self.provider.callback_targets_distinct
            && !self.provider.event_identities_distinct
            && !self.provider.cleanup_verified
            && !self.target.accounting_complete
            && !self.provider.complete;
        let stopped_lifecycle = !complete_lifecycle
            && !self.provider.control_callback_observed
            && (!self.target.accounting_complete || !self.provider.complete);
        let outcome_facts_match = match self.outcome {
            "not_eligible" => empty_lifecycle,
            "control_incomplete" => {
                self.target.request_count == 0
                    && !self.target.complete
                    && !self.provider.preflight_clean
                    && no_callbacks
                    && !self.target.accounting_complete
                    && !self.provider.complete
            },
            "preflight_contaminated" => {
                self.target.request_count == 0
                    && self.provider.request_count > 0
                    && !self.provider.preflight_clean
                    && !no_callbacks
                    && self.provider.callback_targets_distinct
                    && !self.target.complete
                    && !self.target.accounting_complete
                    && !self.provider.complete
            },
            "control_callback_observed" => {
                self.provider.preflight_clean
                    && self.provider.control_callback_observed
                    && self.target.request_count > 0
                    && !self.target.complete
                    && !self.target.accounting_complete
                    && !self.provider.complete
            },
            "no_callback" => complete_lifecycle && no_callbacks,
            "candidate_only" => {
                complete_lifecycle
                    && self.provider.candidate_callback_observed
                    && !self.provider.replay_callback_observed
                    && !self.provider.event_identities_distinct
            },
            "replay_only" => {
                complete_lifecycle
                    && !self.provider.candidate_callback_observed
                    && self.provider.replay_callback_observed
                    && !self.provider.event_identities_distinct
            },
            "correlation_mismatch" => {
                self.provider.preflight_clean
                    && !self.provider.control_callback_observed
                    && (self.provider.candidate_callback_observed
                        || self.provider.replay_callback_observed)
                    && !self.provider.event_identities_distinct
            },
            "cleanup_incomplete" => {
                self.provider.preflight_clean
                    && !self.provider.control_callback_observed
                    && !self.provider.cleanup_verified
            },
            "cancelled" | "budget_exhausted" | "incomplete" => stopped_lifecycle,
            "repeated_external_entity_resolution_observed" => complete_positive,
            _ => false,
        };
        if self.schema != XML_EXTERNAL_ENTITY_REVIEW_AUDIT_SCHEMA
            || self.algorithm != XML_EXTERNAL_ENTITY_REVIEW_ALGORITHM
            || !valid_xml_external_entity_policy_id(&self.policy.id)
            || self.policy.method != "post"
            || self.policy.media_type != XML_EXTERNAL_ENTITY_REVIEW_MEDIA_TYPE
            || self.policy.control_model != XML_EXTERNAL_ENTITY_REVIEW_CONTROL_MODEL
            || !matches!(
                self.policy.execution_mode,
                "production" | "owned_numeric_loopback_test"
            )
            || !OUTCOMES.contains(&self.outcome)
            || usize::from(self.target.request_count) > XML_EXTERNAL_ENTITY_TARGET_REQUESTS
            || self.target.request_body_bytes
                > u64::try_from(XML_EXTERNAL_ENTITY_TARGET_REQUESTS)
                    .map_err(|_| ReportError::Serialization)?
                    .checked_mul(
                        u64::try_from(MAX_XML_EXTERNAL_ENTITY_DOCUMENT_BYTES)
                            .map_err(|_| ReportError::Serialization)?,
                    )
                    .ok_or(ReportError::Serialization)?
            || self.target.response_bytes > 256 * 1_024 * 1_024
            || (self.target.complete
                && self.target.response_bytes
                    > MAX_XML_EXTERNAL_ENTITY_COMPLETE_TARGET_RESPONSE_BYTES)
            || (self.target.request_count == 0) != (self.target.request_body_bytes == 0)
            || (self.target.complete
                && usize::from(self.target.request_count) != XML_EXTERNAL_ENTITY_TARGET_REQUESTS)
            || (self.target.accounting_complete && !self.target.complete)
            || usize::from(self.provider.request_count) > MAX_XML_EXTERNAL_ENTITY_PROVIDER_REQUESTS
            || usize::from(self.provider.active_verification_count)
                > XML_EXTERNAL_ENTITY_ACTIVE_VERIFICATIONS
            || self.provider.active_verification_count != u8::from(self.target.request_count >= 2)
            || !callback_facts_consistent
            || !event_facts_consistent
            || !provider_empty_consistent
            || !provider_completion_consistent
            || !target_started_consistent
            || !outcome_facts_match
            || self.item_projected != positive
            || self.semantic_effect != "not_performed"
            || self.impact_validation != "not_performed"
            || self.claim_limits.as_slice() != XML_EXTERNAL_ENTITY_REVIEW_CLAIM_LIMITS
            || positive != complete_positive
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        render_serializable_json(self, MAX_RENDERED_REPORT_BYTES)
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        vec![
            ("Schema", self.schema.to_owned()),
            ("Algorithm", self.algorithm.to_owned()),
            ("Outcome", self.outcome.to_owned()),
            ("Pseudonymous policy digest", self.policy.id.clone()),
            ("Method", self.policy.method.to_owned()),
            ("Media type", self.policy.media_type.to_owned()),
            ("Control model", self.policy.control_model.to_owned()),
            ("Execution mode", self.policy.execution_mode.to_owned()),
            (
                "Target request count",
                self.target.request_count.to_string(),
            ),
            (
                "Target request body bytes",
                self.target.request_body_bytes.to_string(),
            ),
            (
                "Target response bytes",
                self.target.response_bytes.to_string(),
            ),
            ("Target complete", self.target.complete.to_string()),
            (
                "Target accounting complete",
                self.target.accounting_complete.to_string(),
            ),
            (
                "Provider request count",
                self.provider.request_count.to_string(),
            ),
            (
                "Active verification count",
                self.provider.active_verification_count.to_string(),
            ),
            ("Preflight clean", self.provider.preflight_clean.to_string()),
            (
                "Control callback observed",
                self.provider.control_callback_observed.to_string(),
            ),
            (
                "Candidate callback observed",
                self.provider.candidate_callback_observed.to_string(),
            ),
            (
                "Replay callback observed",
                self.provider.replay_callback_observed.to_string(),
            ),
            (
                "Callback targets distinct",
                self.provider.callback_targets_distinct.to_string(),
            ),
            (
                "Event identities distinct",
                self.provider.event_identities_distinct.to_string(),
            ),
            (
                "Cleanup verified",
                self.provider.cleanup_verified.to_string(),
            ),
            (
                "Provider accounting complete",
                self.provider.complete.to_string(),
            ),
            ("Item projected", self.item_projected.to_string()),
            ("Semantic effect", self.semantic_effect.to_owned()),
            ("Impact validation", self.impact_validation.to_owned()),
            ("Claim limits", self.claim_limits.join(",")),
        ]
    }
}

#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
#[derive(Serialize)]
struct AssessmentTemplateEvaluationReviewAuditDocument {
    schema: &'static str,
    policy_id: &'static str,
    family_id: &'static str,
    outcome: &'static str,
    engine_identity: &'static str,
    coverage: AssessmentTemplateEvaluationCoverageDocument,
    operations: AssessmentTemplateEvaluationOperationsDocument,
    claim_limits: Vec<&'static str>,
}

#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
#[derive(Serialize)]
struct AssessmentTemplateEvaluationCoverageDocument {
    selected_case_count: u8,
    attempted_request_count: u8,
    active_request_count: u8,
    completed_response_count: u8,
    committed_response_count: u8,
    projected_item_count: u8,
}

#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
#[derive(Serialize)]
struct AssessmentTemplateEvaluationOperationsDocument {
    outbound_interaction: &'static str,
    os_execution: &'static str,
    file_access: &'static str,
    impact_validation: &'static str,
}

#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
impl AssessmentTemplateEvaluationReviewAuditDocument {
    fn from_audit(audit: &TemplateEvaluationReviewAudit) -> Result<Self, ReportError> {
        let document = Self {
            schema: audit.schema(),
            policy_id: audit.policy_id(),
            family_id: audit.family_id(),
            outcome: template_evaluation_outcome_token(audit.outcome()),
            engine_identity: audit.engine_identity(),
            coverage: AssessmentTemplateEvaluationCoverageDocument {
                selected_case_count: audit.selected_case_count(),
                attempted_request_count: audit.attempted_request_count(),
                active_request_count: audit.active_request_count(),
                completed_response_count: audit.completed_response_count(),
                committed_response_count: audit.committed_response_count(),
                projected_item_count: audit.projected_item_count(),
            },
            operations: AssessmentTemplateEvaluationOperationsDocument {
                outbound_interaction: audit.outbound_interaction(),
                os_execution: audit.os_execution(),
                file_access: audit.file_access(),
                impact_validation: audit.impact_validation(),
            },
            claim_limits: audit.claim_limits().to_vec(),
        };
        document.validate_wire()?;
        Ok(document)
    }

    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        self.validate_wire()?;
        let matching_items = items
            .iter()
            .filter(|item| item.capability_id == TEMPLATE_EVALUATION_REVIEW_CAPABILITY_ID)
            .collect::<Vec<_>>();
        if matching_items.len() != usize::from(self.coverage.projected_item_count)
            || matching_items.len() > 1
            || matching_items.first().is_some_and(|item| {
                item.subject_reference != "subject-0000"
                    || item.presentation_target != "query_parameter"
                    || item.title != TEMPLATE_EVALUATION_REVIEW_TITLE
                    || item.disposition != "needs_review"
                    || item.claim_basis != "differential"
                    || item.severity.is_some()
                    || item.confidence_ppm != TEMPLATE_EVALUATION_REVIEW_CONFIDENCE_PPM
                    || item.redacted_summary != TEMPLATE_EVALUATION_REVIEW_SUMMARY
                    || item.category != TEMPLATE_EVALUATION_REVIEW_CATEGORY
                    || item.cwe != Some("CWE-1336")
                    || item.remediation.id != TEMPLATE_EVALUATION_REVIEW_REMEDIATION_ID
                    || item.remediation.summary != TEMPLATE_EVALUATION_REVIEW_REMEDIATION_SUMMARY
                    || !template_evaluation_evidence_linkage_is_exact(item)
            })
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn validate_wire(&self) -> Result<(), ReportError> {
        let positive = self.outcome == "candidate_specific_evaluation";
        let parent_absent = self.outcome == "parent_not_observed";
        let outcome_is_known = matches!(
            self.outcome,
            "parent_not_observed"
                | "literal_or_escaped"
                | "unsupported_representation"
                | "replay_mismatch"
                | "candidate_specific_evaluation"
                | "incomplete"
        );
        let counts_are_bounded = matches!(self.coverage.selected_case_count, 0 | 2)
            && self.coverage.attempted_request_count <= 4
            && self.coverage.active_request_count <= 2
            && self.coverage.completed_response_count <= 4
            && self.coverage.committed_response_count <= 4
            && self.coverage.projected_item_count <= 1;
        let counts_are_ordered = self.coverage.completed_response_count
            <= self.coverage.attempted_request_count
            && self.coverage.committed_response_count <= self.coverage.completed_response_count
            && self.coverage.active_request_count <= self.coverage.attempted_request_count;
        let outcome_matches = if parent_absent {
            self.coverage.selected_case_count == 0
                && self.coverage.attempted_request_count == 0
                && self.coverage.active_request_count == 0
                && self.coverage.completed_response_count == 0
                && self.coverage.committed_response_count == 0
                && self.coverage.projected_item_count == 0
        } else if positive {
            self.coverage.selected_case_count == 2
                && self.coverage.attempted_request_count == 4
                && self.coverage.active_request_count == 2
                && self.coverage.completed_response_count == 4
                && self.coverage.committed_response_count == 4
                && self.coverage.projected_item_count == 1
        } else if matches!(
            self.outcome,
            "literal_or_escaped" | "unsupported_representation" | "replay_mismatch"
        ) {
            self.coverage.selected_case_count == 2
                && self.coverage.attempted_request_count == 4
                && self.coverage.active_request_count == 2
                && self.coverage.completed_response_count == 4
                && self.coverage.committed_response_count == 4
                && self.coverage.projected_item_count == 0
        } else {
            self.coverage.selected_case_count == 2 && self.coverage.projected_item_count == 0
        };
        if self.schema != TEMPLATE_EVALUATION_REVIEW_AUDIT_SCHEMA
            || self.policy_id != TEMPLATE_EVALUATION_REVIEW_POLICY_ID
            || self.family_id != TEMPLATE_EVALUATION_REVIEW_FAMILY_ID
            || !outcome_is_known
            || self.engine_identity != TEMPLATE_EVALUATION_ENGINE_IDENTITY
            || self.operations.outbound_interaction != TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED
            || self.operations.os_execution != TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED
            || self.operations.file_access != TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED
            || self.operations.impact_validation != TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED
            || self.claim_limits.as_slice() != TEMPLATE_EVALUATION_REVIEW_CLAIM_LIMITS
            || !counts_are_bounded
            || !counts_are_ordered
            || !outcome_matches
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        render_serializable_json(self, MAX_RENDERED_REPORT_BYTES)
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        vec![
            ("Schema", self.schema.to_owned()),
            ("Policy", self.policy_id.to_owned()),
            ("Expression family", self.family_id.to_owned()),
            ("Outcome", self.outcome.to_owned()),
            ("Engine identity", self.engine_identity.to_owned()),
            (
                "Selected case count",
                self.coverage.selected_case_count.to_string(),
            ),
            (
                "Attempted request count",
                self.coverage.attempted_request_count.to_string(),
            ),
            (
                "Active request count",
                self.coverage.active_request_count.to_string(),
            ),
            (
                "Completed response count",
                self.coverage.completed_response_count.to_string(),
            ),
            (
                "Committed response count",
                self.coverage.committed_response_count.to_string(),
            ),
            (
                "Projected item count",
                self.coverage.projected_item_count.to_string(),
            ),
            (
                "Outbound interaction",
                self.operations.outbound_interaction.to_owned(),
            ),
            ("OS execution", self.operations.os_execution.to_owned()),
            ("File access", self.operations.file_access.to_owned()),
            (
                "Impact validation",
                self.operations.impact_validation.to_owned(),
            ),
            ("Claim limits", self.claim_limits.join(",")),
        ]
    }
}

#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
const fn template_evaluation_outcome_token(
    outcome: TemplateEvaluationReviewOutcome,
) -> &'static str {
    outcome.as_str()
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
fn valid_xml_external_entity_policy_id(value: &str) -> bool {
    value
        .strip_prefix("xml-external-entity-policy-sha256:")
        .is_some_and(|digest| {
            digest.len() == 64
                && digest
                    .bytes()
                    .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
        })
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
fn xml_external_entity_evidence_linkage_is_exact(item: &AssessmentItemDocument<'_>) -> bool {
    if !item.evidence_references.is_empty()
        || item.control_evidence_references.len()
            != XML_EXTERNAL_ENTITY_REVIEW_CONTROL_EVIDENCE_COUNT
        || item.candidate_evidence_references.len()
            != XML_EXTERNAL_ENTITY_REVIEW_CANDIDATE_EVIDENCE_COUNT
        || item.evidence_count
            != u64::try_from(
                XML_EXTERNAL_ENTITY_REVIEW_CONTROL_EVIDENCE_COUNT
                    + XML_EXTERNAL_ENTITY_REVIEW_CANDIDATE_EVIDENCE_COUNT,
            )
            .unwrap_or(u64::MAX)
    {
        return false;
    }
    let ordinals = item
        .control_evidence_references
        .iter()
        .chain(&item.candidate_evidence_references)
        .map(|reference| assessment_reference_ordinal(reference, "evidence"))
        .collect::<Option<Vec<_>>>();
    ordinals.is_some_and(|ordinals| {
        ordinals
            .windows(2)
            .all(|pair| pair[0].checked_add(1) == Some(pair[1]))
    })
}

#[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
fn template_evaluation_evidence_linkage_is_exact(item: &AssessmentItemDocument<'_>) -> bool {
    item.evidence_references.is_empty()
        && item.control_evidence_references.len()
            == TEMPLATE_EVALUATION_REVIEW_CONTROL_EVIDENCE_COUNT
        && item.candidate_evidence_references.len()
            == TEMPLATE_EVALUATION_REVIEW_CANDIDATE_EVIDENCE_COUNT
        && item.evidence_count
            == u64::try_from(
                TEMPLATE_EVALUATION_REVIEW_CONTROL_EVIDENCE_COUNT
                    + TEMPLATE_EVALUATION_REVIEW_CANDIDATE_EVIDENCE_COUNT,
            )
            .unwrap_or(u64::MAX)
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
fn assessment_reference_ordinal(value: &str, kind: &str) -> Option<u64> {
    let suffix = value
        .strip_prefix(kind)
        .and_then(|value| value.strip_prefix('-'))?;
    ((4..=10).contains(&suffix.len())
        && suffix.bytes().all(|byte| byte.is_ascii_digit())
        && (suffix.len() == 4 || !suffix.starts_with('0')))
    .then(|| suffix.parse().ok())
    .flatten()
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const fn xml_external_entity_outcome_token(
    outcome: XmlExternalEntityReviewOutcome,
) -> &'static str {
    match outcome {
        XmlExternalEntityReviewOutcome::NotEligible => "not_eligible",
        XmlExternalEntityReviewOutcome::ControlIncomplete => "control_incomplete",
        XmlExternalEntityReviewOutcome::PreflightContaminated => "preflight_contaminated",
        XmlExternalEntityReviewOutcome::ControlCallbackObserved => "control_callback_observed",
        XmlExternalEntityReviewOutcome::NoCallback => "no_callback",
        XmlExternalEntityReviewOutcome::CandidateOnly => "candidate_only",
        XmlExternalEntityReviewOutcome::ReplayOnly => "replay_only",
        XmlExternalEntityReviewOutcome::CorrelationMismatch => "correlation_mismatch",
        XmlExternalEntityReviewOutcome::CleanupIncomplete => "cleanup_incomplete",
        XmlExternalEntityReviewOutcome::Cancelled => "cancelled",
        XmlExternalEntityReviewOutcome::BudgetExhausted => "budget_exhausted",
        XmlExternalEntityReviewOutcome::Incomplete => "incomplete",
        XmlExternalEntityReviewOutcome::RepeatedExternalEntityResolutionObserved => {
            "repeated_external_entity_resolution_observed"
        },
    }
}

#[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
const fn xml_external_entity_operation_token(
    status: XmlExternalEntityOperationStatus,
) -> &'static str {
    match status {
        XmlExternalEntityOperationStatus::NotPerformed => "not_performed",
    }
}

#[cfg(all(feature = "scanning", feature = "websocket-review"))]
#[derive(Serialize)]
struct AssessmentWebSocketReviewAuditDocument {
    schema: &'static str,
    capability_id: &'static str,
    selected: bool,
    policy_reference: String,
    endpoint_reference: String,
    context: &'static str,
    #[cfg(feature = "supplied-session-review")]
    #[serde(skip_serializing_if = "Option::is_none")]
    supplied_session_context: Option<AssessmentWebSocketSuppliedSessionContextDocument>,
    methodology: AssessmentWebSocketReviewMethodologyDocument,
    coverage: AssessmentWebSocketReviewCoverageDocument,
    messages: Vec<AssessmentWebSocketReviewMessageDocument>,
    claim_limits: Vec<&'static str>,
}

#[cfg(all(
    feature = "scanning",
    feature = "websocket-review",
    feature = "supplied-session-review"
))]
#[derive(Serialize)]
struct AssessmentWebSocketSuppliedSessionContextDocument {
    mode: &'static str,
    policy_reference: String,
    application_reference: String,
    principal_reference: String,
    principal_alias: String,
    principal_assurance: &'static str,
    credential_mechanism: &'static str,
    session_epoch: u8,
    startup_health: Option<AssessmentWebSocketSuppliedSessionHealthDocument>,
    terminal_health: Option<AssessmentWebSocketSuppliedSessionHealthDocument>,
    qualification: &'static str,
    continuous_authentication_established: bool,
}

#[cfg(all(
    feature = "scanning",
    feature = "websocket-review",
    feature = "supplied-session-review"
))]
#[derive(Serialize)]
struct AssessmentWebSocketSuppliedSessionHealthDocument {
    outcome: &'static str,
    evidence_reference: Option<String>,
}

#[cfg(all(
    feature = "scanning",
    feature = "websocket-review",
    feature = "supplied-session-review"
))]
impl AssessmentWebSocketSuppliedSessionContextDocument {
    fn validate_internal(
        &self,
        request_attempt_count: u8,
        request_admitted_count: u8,
    ) -> Result<(), ReportError> {
        let health_is_valid = |health: &AssessmentWebSocketSuppliedSessionHealthDocument| {
            matches!(health.outcome, "healthy" | "unhealthy" | "indeterminate")
                && health
                    .evidence_reference
                    .as_deref()
                    .is_none_or(|reference| {
                        valid_supplied_session_reference(
                            reference,
                            "supplied-session-checkpoint-evidence-sha256:",
                        )
                    })
        };
        if self.mode != "health_qualified_authorization_header"
            || !valid_supplied_session_reference(
                &self.policy_reference,
                "supplied-session-policy-sha256:",
            )
            || !valid_supplied_session_reference(
                &self.application_reference,
                "supplied-session-application-sha256:",
            )
            || self.principal_reference != "supplied-session-principal-0001"
            || !valid_supplied_session_principal_alias(&self.principal_alias)
            || self.principal_assurance != "operator_declared"
            || self.credential_mechanism != "authorization_header"
            || self.session_epoch != 1
            || self.continuous_authentication_established
            || self
                .startup_health
                .as_ref()
                .is_some_and(|health| !health_is_valid(health))
            || self
                .terminal_health
                .as_ref()
                .is_some_and(|health| !health_is_valid(health))
        {
            return Err(ReportError::Serialization);
        }
        let startup_healthy = self.startup_health.as_ref().is_some_and(|health| {
            health.outcome == "healthy" && health.evidence_reference.is_some()
        });
        let terminal_healthy = self.terminal_health.as_ref().is_some_and(|health| {
            health.outcome == "healthy" && health.evidence_reference.is_some()
        });
        let qualification_is_valid = match self.qualification {
            "context_qualified" => {
                request_admitted_count == 1 && startup_healthy && terminal_healthy
            },
            "context_unqualified" => {
                request_admitted_count == 1 && startup_healthy && !terminal_healthy
            },
            "not_established" => request_admitted_count == 0 && request_attempt_count <= 1,
            _ => false,
        };
        if qualification_is_valid {
            Ok(())
        } else {
            Err(ReportError::Serialization)
        }
    }

    #[cfg(feature = "supplied-session-review")]
    fn validate_against_supplied_session(
        &self,
        session: &AssessmentSuppliedSessionAuditDocument,
    ) -> Result<(), ReportError> {
        if session.schema != SUPPLIED_SESSION_AUDIT_SCHEMA
            || session.policy_reference != self.policy_reference
            || session.application_reference != self.application_reference
            || session.principal_reference != self.principal_reference
            || session.principal_alias != self.principal_alias
            || session.principal_assurance != self.principal_assurance
            || session.credential_mechanism != self.credential_mechanism
            || session.selected_resource_count != 1
            || session.resources.len() != 1
            || session.continuous_authentication_established
        {
            return Err(ReportError::Serialization);
        }
        let startup = session
            .checkpoints
            .iter()
            .find(|checkpoint| checkpoint.phase == "startup");
        let terminal = session
            .checkpoints
            .iter()
            .find(|checkpoint| checkpoint.phase == "terminal");
        if session
            .checkpoints
            .iter()
            .filter(|checkpoint| checkpoint.phase == "startup")
            .count()
            > 1
            || session
                .checkpoints
                .iter()
                .filter(|checkpoint| checkpoint.phase == "terminal")
                .count()
                > 1
        {
            return Err(ReportError::Serialization);
        }
        let health_matches =
            |projected: Option<&AssessmentWebSocketSuppliedSessionHealthDocument>,
             checkpoint: Option<&AssessmentSuppliedSessionCheckpointDocument>| {
                projected.is_some() == checkpoint.is_some()
                    && projected
                        .zip(checkpoint)
                        .is_none_or(|(projected, checkpoint)| {
                            projected.outcome == checkpoint.outcome
                                && projected.evidence_reference == checkpoint.evidence_reference
                        })
            };
        if health_matches(self.startup_health.as_ref(), startup)
            && health_matches(self.terminal_health.as_ref(), terminal)
        {
            Ok(())
        } else {
            Err(ReportError::Serialization)
        }
    }
}

#[cfg(all(feature = "scanning", feature = "websocket-review"))]
#[derive(Serialize)]
struct AssessmentWebSocketReviewMethodologyDocument {
    origin_mode: &'static str,
    compression: &'static str,
    reconnect: &'static str,
    http2_extended_connect: &'static str,
    subprotocol: &'static str,
    physical_frame_count: &'static str,
    max_frame_size: &'static str,
    limits: AssessmentWebSocketReviewLimitsDocument,
}

#[cfg(all(feature = "scanning", feature = "websocket-review"))]
#[derive(Serialize)]
struct AssessmentWebSocketReviewLimitsDocument {
    max_connections: u8,
    max_outbound_application_bytes: u64,
    max_inbound_application_bytes: u64,
    max_outbound_message_bytes: u64,
    max_inbound_message_bytes: u64,
    max_messages: u64,
    max_control_frames: u64,
    max_wall_time_ms: u64,
}

#[cfg(all(feature = "scanning", feature = "websocket-review"))]
#[derive(Serialize)]
struct AssessmentWebSocketReviewCoverageDocument {
    terminal: &'static str,
    completeness: &'static str,
    first_failure: Option<&'static str>,
    request_attempt_count: u8,
    request_admitted_count: u8,
    connection_attempt_count: u8,
    handshake_completed_count: u8,
    outbound_message_count: u64,
    inbound_message_count: u64,
    outbound_control_frame_count: u64,
    inbound_control_frame_count: u64,
    outbound_application_bytes: u64,
    inbound_application_bytes: u64,
    transport_read_bytes: u64,
    transport_write_bytes: u64,
    accounted_request_body_bytes: u64,
    accounted_transport_response_bytes: u64,
    transport_byte_scope: &'static str,
    expected_response_count: u64,
    matched_response_count: u64,
    mismatched_response_count: u64,
}

#[cfg(all(feature = "scanning", feature = "websocket-review"))]
#[derive(Serialize)]
struct AssessmentWebSocketReviewMessageDocument {
    message_reference: String,
    expected_response_reference: String,
    outbound_length: u64,
    inbound_length: Option<u64>,
    status: &'static str,
}

#[cfg(all(feature = "scanning", feature = "websocket-review"))]
impl AssessmentWebSocketReviewAuditDocument {
    fn has_supplied_session_context(&self) -> bool {
        #[cfg(feature = "supplied-session-review")]
        {
            self.supplied_session_context.is_some()
        }
        #[cfg(not(feature = "supplied-session-review"))]
        {
            false
        }
    }

    fn from_audit(audit: &WebAssessmentWebSocketReviewAudit) -> Result<Self, ReportError> {
        let limits = audit.limits();
        let claim_limits = audit
            .claim_limits()
            .iter()
            .map(|limit| limit.as_str())
            .collect::<Vec<_>>();
        #[cfg(feature = "supplied-session-review")]
        let claim_limits = {
            let mut claim_limits = claim_limits;
            if audit.schema() == WEBSOCKET_SUPPLIED_SESSION_AUDIT_SCHEMA {
                claim_limits.push("continuous_authentication_not_established");
            }
            claim_limits
        };
        let document = Self {
            schema: audit.schema(),
            capability_id: audit.capability_id(),
            selected: audit.selected(),
            policy_reference: audit.policy_reference().to_owned(),
            endpoint_reference: audit.endpoint_reference().to_owned(),
            context: audit.context(),
            #[cfg(feature = "supplied-session-review")]
            supplied_session_context: audit.supplied_session_context().map(|context| {
                AssessmentWebSocketSuppliedSessionContextDocument {
                    mode: "health_qualified_authorization_header",
                    policy_reference: context.policy_reference().to_owned(),
                    application_reference: context.application_reference().to_owned(),
                    principal_reference: context.principal_reference().to_owned(),
                    principal_alias: context.principal_alias().to_owned(),
                    principal_assurance: context.principal_assurance(),
                    credential_mechanism: context.credential_mechanism(),
                    session_epoch: context.epoch(),
                    startup_health: context.startup_health().map(|health| {
                        AssessmentWebSocketSuppliedSessionHealthDocument {
                            outcome: health.outcome(),
                            evidence_reference: health.evidence_reference().map(str::to_owned),
                        }
                    }),
                    terminal_health: context.terminal_health().map(|health| {
                        AssessmentWebSocketSuppliedSessionHealthDocument {
                            outcome: health.outcome(),
                            evidence_reference: health.evidence_reference().map(str::to_owned),
                        }
                    }),
                    qualification: context.qualification().as_str(),
                    continuous_authentication_established: context
                        .continuous_authentication_established(),
                }
            }),
            methodology: AssessmentWebSocketReviewMethodologyDocument {
                origin_mode: audit.origin_mode().as_str(),
                compression: if audit.compression_enabled() {
                    "enabled"
                } else {
                    "disabled"
                },
                reconnect: if audit.reconnect_enabled() {
                    "enabled"
                } else {
                    "disabled"
                },
                http2_extended_connect: audit.http2_extended_connect(),
                subprotocol: if audit.subprotocol_requested() {
                    "present"
                } else {
                    "absent"
                },
                physical_frame_count: WEBSOCKET_REVIEW_PHYSICAL_FRAME_COUNT,
                max_frame_size: WEBSOCKET_REVIEW_MAX_FRAME_SIZE,
                limits: AssessmentWebSocketReviewLimitsDocument {
                    max_connections: limits.max_connections(),
                    max_outbound_application_bytes: limits.max_outbound_application_bytes(),
                    max_inbound_application_bytes: limits.max_inbound_application_bytes(),
                    max_outbound_message_bytes: limits.max_outbound_message_bytes(),
                    max_inbound_message_bytes: limits.max_inbound_message_bytes(),
                    max_messages: limits.max_messages(),
                    max_control_frames: limits.max_control_frames(),
                    max_wall_time_ms: limits.max_wall_time_ms(),
                },
            },
            coverage: AssessmentWebSocketReviewCoverageDocument {
                terminal: audit.terminal().as_str(),
                completeness: audit.completeness().as_str(),
                first_failure: audit.first_failure().map(|failure| failure.as_str()),
                request_attempt_count: audit.request_attempt_count(),
                request_admitted_count: audit.request_admitted_count(),
                connection_attempt_count: audit.connection_attempt_count(),
                handshake_completed_count: audit.handshake_completed_count(),
                outbound_message_count: audit.outbound_message_count(),
                inbound_message_count: audit.inbound_message_count(),
                outbound_control_frame_count: audit.outbound_control_frame_count(),
                inbound_control_frame_count: audit.inbound_control_frame_count(),
                outbound_application_bytes: audit.outbound_application_bytes(),
                inbound_application_bytes: audit.inbound_application_bytes(),
                transport_read_bytes: audit.transport_read_bytes(),
                transport_write_bytes: audit.transport_write_bytes(),
                accounted_request_body_bytes: audit.accounted_request_body_bytes(),
                accounted_transport_response_bytes: audit.accounted_transport_response_bytes(),
                transport_byte_scope: audit.transport_byte_scope(),
                expected_response_count: audit.expected_response_count(),
                matched_response_count: audit.matched_response_count(),
                mismatched_response_count: audit.mismatched_response_count(),
            },
            messages: audit
                .messages()
                .iter()
                .map(|message| AssessmentWebSocketReviewMessageDocument {
                    message_reference: message.message_reference().to_owned(),
                    expected_response_reference: message.expected_response_reference().to_owned(),
                    outbound_length: message.outbound_length(),
                    inbound_length: message.inbound_length(),
                    status: message.status().as_str(),
                })
                .collect(),
            claim_limits,
        };
        document.validate_wire()?;
        Ok(document)
    }

    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        if items
            .iter()
            .any(|item| item.capability_id == WEBSOCKET_REVIEW_CAPABILITY_ID)
        {
            return Err(ReportError::Serialization);
        }
        self.validate_wire()
    }

    fn validate_wire(&self) -> Result<(), ReportError> {
        let limits = &self.methodology.limits;
        let coverage = &self.coverage;
        let mut message_references = std::collections::BTreeSet::new();
        let mut outbound_messages = 0_u64;
        let mut inbound_messages = 0_u64;
        let mut outbound_bytes = 0_u64;
        let mut inbound_bytes = 0_u64;
        let mut matched = 0_u64;
        let mut mismatched = 0_u64;
        let mut phase = 0_u8;
        for message in &self.messages {
            if !valid_websocket_review_reference(
                &message.message_reference,
                "websocket-message-revision-sha256:",
            ) || !message_references.insert(message.message_reference.as_str())
                || !valid_websocket_review_reference(
                    &message.expected_response_reference,
                    "websocket-expected-response-revision-sha256:",
                )
                || message.outbound_length > limits.max_outbound_message_bytes
                || message
                    .inbound_length
                    .is_some_and(|length| length > limits.max_inbound_message_bytes)
            {
                return Err(ReportError::Serialization);
            }
            match message.status {
                "response_matched" | "response_mismatched"
                    if phase == 0 && message.inbound_length.is_some() =>
                {
                    outbound_messages = outbound_messages
                        .checked_add(1)
                        .ok_or(ReportError::Serialization)?;
                    inbound_messages = inbound_messages
                        .checked_add(1)
                        .ok_or(ReportError::Serialization)?;
                    outbound_bytes = outbound_bytes
                        .checked_add(message.outbound_length)
                        .ok_or(ReportError::Serialization)?;
                    inbound_bytes = inbound_bytes
                        .checked_add(message.inbound_length.unwrap_or_default())
                        .ok_or(ReportError::Serialization)?;
                    if message.status == "response_matched" {
                        matched += 1;
                    } else {
                        mismatched += 1;
                    }
                },
                "sent_no_response" if phase == 0 && message.inbound_length.is_none() => {
                    phase = 1;
                    outbound_messages = outbound_messages
                        .checked_add(1)
                        .ok_or(ReportError::Serialization)?;
                    outbound_bytes = outbound_bytes
                        .checked_add(message.outbound_length)
                        .ok_or(ReportError::Serialization)?;
                },
                "not_sent" if message.inbound_length.is_none() => phase = 2,
                _ => return Err(ReportError::Serialization),
            }
        }
        let failure_shape = match coverage.first_failure {
            None => coverage.terminal == "completed",
            Some("authority_already_minted" | "endpoint_outside_authority") => {
                coverage.terminal == "authority_refused"
            },
            Some(
                "message_too_large"
                | "message_limit_reached"
                | "control_frame_limit_reached"
                | "application_byte_limit_reached"
                | "parent_response_budget_reached",
            ) => coverage.terminal == "limit_reached",
            Some("cancelled") => coverage.terminal == "cancelled",
            Some("deadline_reached") => coverage.terminal == "deadline_reached",
            Some(
                "parent_authority_unavailable"
                | "request_construction"
                | "connection_failed"
                | "handshake_rejected"
                | "extension_negotiation_refused"
                | "subprotocol_negotiation_refused"
                | "send_failed"
                | "read_failed"
                | "binary_message_unsupported"
                | "close_failed"
                | "peer_closed"
                | "internal_invariant",
            ) => coverage.terminal == "incomplete",
            Some(_) => false,
        };
        let complete = coverage.terminal == "completed"
            && coverage.completeness == "configured_exchange_complete"
            && coverage.first_failure.is_none();
        let incomplete = coverage.terminal != "completed"
            && coverage.completeness == "incomplete"
            && coverage.first_failure.is_some();
        let no_admitted_activity = coverage.request_admitted_count != 0
            || (coverage.connection_attempt_count == 0
                && coverage.handshake_completed_count == 0
                && coverage.outbound_message_count == 0
                && coverage.inbound_message_count == 0
                && coverage.outbound_control_frame_count == 0
                && coverage.inbound_control_frame_count == 0
                && coverage.outbound_application_bytes == 0
                && coverage.inbound_application_bytes == 0
                && coverage.transport_read_bytes == 0
                && coverage.transport_write_bytes == 0);
        let completed_exchange = coverage.terminal != "completed"
            || (coverage.request_attempt_count == 1
                && coverage.request_admitted_count == 1
                && coverage.connection_attempt_count == 1
                && coverage.handshake_completed_count == 1
                && coverage.outbound_message_count == coverage.expected_response_count
                && coverage.inbound_message_count == coverage.expected_response_count);
        let context_is_valid = match self.schema {
            WEBSOCKET_REVIEW_AUDIT_SCHEMA => {
                self.context == "anonymous" && {
                    #[cfg(feature = "supplied-session-review")]
                    {
                        self.supplied_session_context.is_none()
                    }
                    #[cfg(not(feature = "supplied-session-review"))]
                    {
                        true
                    }
                }
            },
            #[cfg(feature = "supplied-session-review")]
            WEBSOCKET_SUPPLIED_SESSION_AUDIT_SCHEMA => {
                self.context == "supplied_session"
                    && self
                        .supplied_session_context
                        .as_ref()
                        .is_some_and(|context| {
                            context
                                .validate_internal(
                                    coverage.request_attempt_count,
                                    coverage.request_admitted_count,
                                )
                                .is_ok()
                        })
            },
            _ => false,
        };
        let expected_claim_limits: &[&str] = if self.schema == WEBSOCKET_REVIEW_AUDIT_SCHEMA {
            &WEBSOCKET_REVIEW_CLAIM_LIMITS
        } else {
            &WEBSOCKET_SUPPLIED_SESSION_CLAIM_LIMITS
        };
        if !context_is_valid
            || self.capability_id != WEBSOCKET_REVIEW_CAPABILITY_ID
            || !self.selected
            || !valid_websocket_review_reference(&self.policy_reference, "websocket-policy-sha256:")
            || !valid_websocket_review_reference(
                &self.endpoint_reference,
                "websocket-endpoint-sha256:",
            )
            || !matches!(self.methodology.origin_mode, "application_origin" | "omit")
            || self.methodology.compression != "disabled"
            || self.methodology.reconnect != "disabled"
            || self.methodology.http2_extended_connect != "unsupported"
            || !matches!(self.methodology.subprotocol, "present" | "absent")
            || self.methodology.physical_frame_count != WEBSOCKET_REVIEW_PHYSICAL_FRAME_COUNT
            || self.methodology.max_frame_size != WEBSOCKET_REVIEW_MAX_FRAME_SIZE
            || limits.max_connections != MAX_WEBSOCKET_REVIEW_CONNECTIONS
            || limits.max_outbound_application_bytes
                != MAX_WEBSOCKET_REVIEW_APPLICATION_BYTES_PER_DIRECTION
            || limits.max_inbound_application_bytes
                != MAX_WEBSOCKET_REVIEW_APPLICATION_BYTES_PER_DIRECTION
            || !(1..=MAX_WEBSOCKET_REVIEW_APPLICATION_BYTES_PER_DIRECTION)
                .contains(&limits.max_outbound_message_bytes)
            || !(1..=MAX_WEBSOCKET_REVIEW_APPLICATION_BYTES_PER_DIRECTION)
                .contains(&limits.max_inbound_message_bytes)
            || !(1..=u64::try_from(MAX_WEBSOCKET_REVIEW_MESSAGES)
                .map_err(|_| ReportError::Serialization)?)
                .contains(&limits.max_messages)
            || !(1..=u64::from(MAX_WEBSOCKET_REVIEW_CONTROL_FRAMES))
                .contains(&limits.max_control_frames)
            || !(1..=MAX_WEBSOCKET_REVIEW_WALL_TIME_MS).contains(&limits.max_wall_time_ms)
            || self.messages.is_empty()
            || u64::try_from(self.messages.len()).map_err(|_| ReportError::Serialization)?
                != coverage.expected_response_count
            || coverage.expected_response_count > limits.max_messages
            || coverage.request_attempt_count > 1
            || coverage.request_admitted_count > coverage.request_attempt_count
            || coverage.connection_attempt_count > coverage.request_admitted_count
            || coverage.handshake_completed_count > coverage.connection_attempt_count
            || coverage.inbound_message_count > coverage.outbound_message_count
            || coverage
                .outbound_control_frame_count
                .checked_add(coverage.inbound_control_frame_count)
                .is_none_or(|count| count > limits.max_control_frames)
            || coverage.outbound_application_bytes > limits.max_outbound_application_bytes
            || coverage.inbound_application_bytes > limits.max_inbound_application_bytes
            || coverage.transport_read_bytes > HARD_MAX_WEB_ASSESSMENT_TOTAL_RESPONSE_BYTES
            || coverage.transport_read_bytes < coverage.inbound_application_bytes
            || coverage.transport_write_bytes < coverage.outbound_application_bytes
            || coverage.accounted_request_body_bytes != 0
            || coverage.accounted_transport_response_bytes != coverage.transport_read_bytes
            || coverage.transport_byte_scope != WEBSOCKET_REVIEW_TRANSPORT_BYTE_SCOPE
            || coverage.outbound_message_count != outbound_messages
            || coverage.inbound_message_count != inbound_messages
            || coverage.outbound_application_bytes != outbound_bytes
            || coverage.inbound_application_bytes != inbound_bytes
            || coverage.matched_response_count != matched
            || coverage.mismatched_response_count != mismatched
            || coverage
                .matched_response_count
                .checked_add(coverage.mismatched_response_count)
                != Some(coverage.inbound_message_count)
            || !(complete || incomplete)
            || !failure_shape
            || !no_admitted_activity
            || !completed_exchange
            || self.claim_limits.as_slice() != expected_claim_limits
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        let mut metadata = Vec::with_capacity(29);
        metadata.push(("Audit schema", self.schema.to_owned()));
        metadata.push(("Capability", self.capability_id.to_owned()));
        metadata.push(("Selected", self.selected.to_string()));
        metadata.push(("Policy reference", self.policy_reference.clone()));
        metadata.push(("Endpoint reference", self.endpoint_reference.clone()));
        metadata.push(("Context", self.context.to_owned()));
        #[cfg(feature = "supplied-session-review")]
        if let Some(context) = &self.supplied_session_context {
            metadata.push(("Session principal alias", context.principal_alias.clone()));
            metadata.push(("Session epoch", context.session_epoch.to_string()));
            metadata.push((
                "Session startup health",
                context
                    .startup_health
                    .as_ref()
                    .map_or("not_observed", |health| health.outcome)
                    .to_owned(),
            ));
            metadata.push((
                "Session terminal health",
                context
                    .terminal_health
                    .as_ref()
                    .map_or("not_observed", |health| health.outcome)
                    .to_owned(),
            ));
            metadata.push(("Session qualification", context.qualification.to_owned()));
            metadata.push((
                "Continuous authentication established",
                context.continuous_authentication_established.to_string(),
            ));
        }
        metadata.push(("Origin mode", self.methodology.origin_mode.to_owned()));
        metadata.push(("Compression", self.methodology.compression.to_owned()));
        metadata.push(("Reconnect", self.methodology.reconnect.to_owned()));
        metadata.push((
            "HTTP/2 extended CONNECT",
            self.methodology.http2_extended_connect.to_owned(),
        ));
        metadata.push((
            "Subprotocol declaration",
            self.methodology.subprotocol.to_owned(),
        ));
        metadata.push((
            "Physical frame count",
            self.methodology.physical_frame_count.to_owned(),
        ));
        metadata.push(("Terminal", self.coverage.terminal.to_owned()));
        metadata.push(("Completeness", self.coverage.completeness.to_owned()));
        metadata.push((
            "First failure",
            self.coverage.first_failure.unwrap_or("none").to_owned(),
        ));
        metadata.push((
            "Request attempts/admitted",
            format!(
                "{}/{}",
                self.coverage.request_attempt_count, self.coverage.request_admitted_count
            ),
        ));
        metadata.push((
            "Connection attempts/handshakes",
            format!(
                "{}/{}",
                self.coverage.connection_attempt_count, self.coverage.handshake_completed_count
            ),
        ));
        metadata.push((
            "Application messages outbound/inbound",
            format!(
                "{}/{}",
                self.coverage.outbound_message_count, self.coverage.inbound_message_count
            ),
        ));
        metadata.push((
            "Observable control events outbound/inbound",
            format!(
                "{}/{}",
                self.coverage.outbound_control_frame_count,
                self.coverage.inbound_control_frame_count
            ),
        ));
        metadata.push((
            "Application bytes outbound/inbound",
            format!(
                "{}/{}",
                self.coverage.outbound_application_bytes, self.coverage.inbound_application_bytes
            ),
        ));
        metadata.push((
            "Transport bytes written/read",
            format!(
                "{}/{}",
                self.coverage.transport_write_bytes, self.coverage.transport_read_bytes
            ),
        ));
        metadata.push((
            "Accounted request/response bytes",
            format!(
                "{}/{}",
                self.coverage.accounted_request_body_bytes,
                self.coverage.accounted_transport_response_bytes
            ),
        ));
        metadata.push((
            "Responses expected/matched/mismatched",
            format!(
                "{}/{}/{}",
                self.coverage.expected_response_count,
                self.coverage.matched_response_count,
                self.coverage.mismatched_response_count
            ),
        ));
        metadata
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "websocket-review"))]
fn valid_websocket_review_reference(value: &str, prefix: &str) -> bool {
    value.len() == prefix.len() + 64
        && value.starts_with(prefix)
        && value[prefix.len()..]
            .bytes()
            .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
}

#[cfg(all(feature = "scanning", feature = "authorization-review"))]
fn optional_bool_token(value: Option<bool>) -> String {
    match value {
        Some(true) => "true".to_owned(),
        Some(false) => "false".to_owned(),
        None => "not available".to_owned(),
    }
}

#[cfg(all(feature = "scanning", feature = "authorization-review"))]
const fn authorization_review_outcome_token(outcome: AuthorizationReviewOutcome) -> &'static str {
    match outcome {
        AuthorizationReviewOutcome::NotEligible => "not_eligible",
        AuthorizationReviewOutcome::PrimaryBaselineInvalid => "primary_baseline_invalid",
        AuthorizationReviewOutcome::PrimaryUnstable => "primary_unstable",
        AuthorizationReviewOutcome::PeerDenied => "peer_denied",
        AuthorizationReviewOutcome::PeerUnstable => "peer_unstable",
        AuthorizationReviewOutcome::CrossStatusDifferent => "cross_status_different",
        AuthorizationReviewOutcome::CrossFieldsEquivalentOnly => "cross_fields_equivalent_only",
        AuthorizationReviewOutcome::CrossResourcesDifferent => "cross_resources_different",
        AuthorizationReviewOutcome::StableCrossPrincipalEquivalence => {
            "stable_cross_principal_equivalence"
        },
        AuthorizationReviewOutcome::DefensiveInterference => "defensive_interference",
        AuthorizationReviewOutcome::RateLimited => "rate_limited",
        AuthorizationReviewOutcome::RedirectObserved => "redirect_observed",
        AuthorizationReviewOutcome::UnsupportedMedia => "unsupported_media",
        AuthorizationReviewOutcome::MalformedJson => "malformed_json",
        AuthorizationReviewOutcome::GenericJsonErrorEnvelope => "generic_json_error_envelope",
        AuthorizationReviewOutcome::SelectedPathMissing => "selected_path_missing",
        AuthorizationReviewOutcome::Truncated => "truncated",
        AuthorizationReviewOutcome::Incomplete => "incomplete",
        AuthorizationReviewOutcome::BudgetExhausted => "budget_exhausted",
        AuthorizationReviewOutcome::Cancelled => "cancelled",
        AuthorizationReviewOutcome::ContractMismatch => "contract_mismatch",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct AssessmentWordPressAuditDocument {
    schema: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    review_basis_schema: Option<&'static str>,
    capability_id: &'static str,
    catalog_status: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    catalog_schema: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    catalog: Option<WordPressCatalogDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    inventory_import: Option<WordPressInventoryImportDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    external_review: Option<WordPressExternalReviewDocument>,
    signal_count: u16,
    evidence_reference_count: u16,
    additional_request_count: u8,
    item_projected: bool,
    component_count: usize,
    advisory_count: usize,
    components: Vec<WordPressComponentDocument>,
    advisories: Vec<WordPressAdvisoryDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V2: &str = "security.wordpress-discovery-audit/v2";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V3: &str = "security.wordpress-discovery-audit/v3";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V4: &str = "security.wordpress-discovery-audit/v4";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_DISCOVERY_POLICY_ID: &str =
    "termivar.wordpress-deployment-aware-metadata-discovery/v1";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_PAGE_SCOPED_DISCOVERY_POLICY_ID: &str =
    "termivar.wordpress-page-scoped-metadata-discovery/v1";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_SUPPLIED_SESSION_DISCOVERY_POLICY_ID: &str =
    "termivar.wordpress-supplied-session-metadata-discovery/v1";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_FORM_LOGIN_DISCOVERY_POLICY_ID: &str =
    "termivar.wordpress-supplied-session-metadata-discovery/v2";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_DISCOVERY_LAYOUT_SCHEMA: &str = "security.wordpress-layout/v1";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_LAYOUT_BYTES: u64 = 16 * 1024;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_DISCOVERY_CAPABILITY_ID: &str = "technology.wordpress-metadata-discovery@1";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_SOURCES: usize = 32;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_REQUESTS: u8 = 12;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_PAGE_DISCOVERY_AUDIT_REQUESTS: u8 = 3;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_PAGE_DISCOVERY_AUDIT_CANDIDATES: u16 = 4_096;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_PAGE_DISCOVERY_AUDIT_INTERPRETED_BYTES: u64 = 768 * 1024;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_SUPPLIED_SESSION_PAGE_AUDIT_COUNT: usize = 4;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_SUPPLIED_SESSION_PAGE_AUDIT_INTERPRETED_BYTES: u64 = 256 * 1024;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_RESPONSE_BYTES: u64 = 2 * 1024 * 1024;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_REST_REQUESTS: usize = 1;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_THEME_REQUESTS: usize = 3;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_PLUGIN_REQUESTS: usize = 8;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_OMITTED_CANDIDATES: u64 = 4_064;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_METADATA_BYTES: usize = 256;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_VERSION_BYTES: usize = 64;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_NAMESPACE_BYTES: usize = 128;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_DISCOVERY_AUDIT_NAMESPACES: usize = 64;
/// Separate optional wire audit for explicitly selected metadata collection.
///
/// Collection details remain separate from the versioned WordPress review
/// result. A discovery-influenced review uses audit v7 so the vocabulary and
/// request accounting of previously published v1-v6 documents stay unchanged.
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct AssessmentWordPressDiscoveryAuditDocument {
    schema: &'static str,
    capability_id: &'static str,
    policy_id: &'static str,
    selected: bool,
    method: &'static str,
    credential_mode: &'static str,
    seed_count: u8,
    candidate_count: u8,
    candidate_limit_reached: bool,
    omitted_candidate_count: u64,
    attempted_request_count: u8,
    completed_response_count: u8,
    committed_response_count: u8,
    response_bytes: u64,
    source_count: usize,
    layout: WordPressDiscoveryLayoutDocument,
    #[serde(skip_serializing_if = "Option::is_none")]
    page_collection: Option<WordPressPageCollectionDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    supplied_session_pages: Option<WordPressSuppliedSessionPageCollectionDocument>,
    sources: Vec<WordPressDiscoverySourceDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressSuppliedSessionPageCollectionDocument {
    mode: &'static str,
    policy_reference: String,
    application_reference: String,
    principal_reference: String,
    credential_mechanism: &'static str,
    session_epoch: u8,
    selected_count: u8,
    committed_count: u8,
    accepted_association_count: u8,
    rejected_association_count: u8,
    not_established_association_count: u8,
    not_evaluated_count: u8,
    interpreted_response_bytes: u64,
    pages: Vec<WordPressSuppliedSessionPageDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressSuppliedSessionPageDocument {
    page_reference: String,
    resource_reference: String,
    resource_evidence_reference: Option<String>,
    acquisition: &'static str,
    association: &'static str,
    outcome: &'static str,
    interpreted_response_bytes: u64,
    evidence_reference_count: usize,
    evidence_references: Vec<String>,
    fingerprint_evaluation: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_ASSET_FINGERPRINT_AUDIT_SCHEMA: &str =
    "security.wordpress-asset-fingerprint-audit/v1";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_ASSET_FINGERPRINT_POLICY_ID: &str =
    "termivar.wordpress-observed-asset-fingerprint/v1";
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const MAX_WORDPRESS_ASSET_FINGERPRINT_CANDIDATE_IDENTITIES: usize = 256;
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const WORDPRESS_ASSET_FINGERPRINT_CAPABILITY_ID: &str =
    "technology.wordpress-asset-fingerprint-candidate@1";

/// Optional conditional byte-comparison audit. It never becomes installed-
/// version evidence and remains separate from the discovery transport audit.
#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct AssessmentWordPressAssetFingerprintAuditDocument {
    schema: &'static str,
    capability_id: &'static str,
    policy_id: &'static str,
    selected: bool,
    representation_profile: &'static str,
    finite_reference_scope: &'static str,
    same_release_assumption: &'static str,
    installed_version_assurance: &'static str,
    source_authenticity: &'static str,
    catalogue: WordPressAssetFingerprintCatalogueDocument,
    candidate_count: u64,
    selected_resource_count: usize,
    omitted_resource_count: usize,
    attempted_request_count: u8,
    reused_response_count: usize,
    fetched_response_count: usize,
    response_bytes: u64,
    stop: &'static str,
    resource_count: usize,
    resources: Vec<WordPressAssetFingerprintResourceDocument>,
    component_count: usize,
    components: Vec<WordPressAssetFingerprintComponentDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintCatalogueDocument {
    schema: &'static str,
    id: String,
    revision: String,
    source_namespace: String,
    byte_length: u64,
    sha256: String,
    semantic_sha256: String,
    retained_bytes: usize,
    component_count: usize,
    release_count: usize,
    file_count: usize,
    provenance: WordPressAssetFingerprintProvenanceDocument,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintProvenanceDocument {
    reference: String,
    revision: String,
    notices: Vec<WordPressAssetFingerprintNoticeDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintNoticeDocument {
    id: String,
    party: String,
    notice: String,
    license: String,
    license_reference: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintResourceDocument {
    component: WordPressComponentIdentityDocument,
    relative_path: String,
    resource_reference: String,
    source_page_references: Vec<String>,
    observed_variant_count: usize,
    acquisition: &'static str,
    outcome: &'static str,
    request_attempted: bool,
    interpreted_response_bytes: u64,
    response_bytes: u64,
    evidence_reference_count: usize,
    evidence_references: Vec<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    observation: Option<WordPressAssetFingerprintObservationDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintObservationDocument {
    byte_length: u64,
    sha256: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintComponentDocument {
    identity: WordPressComponentIdentityDocument,
    catalogue_component_listed: bool,
    state: &'static str,
    candidate_resource_count: usize,
    selected_resource_count: usize,
    completely_interpreted_resource_count: usize,
    omitted_resource_count: usize,
    informative_resource_count: usize,
    listed_matrix_complete: bool,
    compatible_release_ids: Vec<String>,
    undetermined_release_ids: Vec<String>,
    inconsistent_release_ids: Vec<String>,
    resource_count: usize,
    resources: Vec<WordPressAssetFingerprintResourceMatchDocument>,
    release_count: usize,
    releases: Vec<WordPressAssetFingerprintReleaseMatchDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintResourceMatchDocument {
    relative_path: String,
    distinct_observation_count: usize,
    informative: bool,
    release_relation_count: usize,
    release_relations: Vec<WordPressAssetFingerprintReleaseRelationDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintReleaseRelationDocument {
    release_id: String,
    relation: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    unknown_reason: Option<&'static str>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintReleaseMatchDocument {
    release_id: String,
    version: String,
    build_variant: Option<String>,
    state: &'static str,
    source: WordPressAssetFingerprintReleaseSourceDocument,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAssetFingerprintReleaseSourceDocument {
    reference: String,
    revision: String,
    notice_ids: Vec<String>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressPageCollectionDocument {
    mode: &'static str,
    entry_page_reference: String,
    candidate_count: u16,
    selected_count: u8,
    omitted_candidate_count: u16,
    reused_response_count: u8,
    fetched_response_count: u8,
    not_observed_count: u8,
    rejected_response_count: u8,
    accepted_association_count: u8,
    rejected_association_count: u8,
    attempted_request_count: u8,
    completed_response_count: u8,
    committed_response_count: u8,
    interpreted_response_bytes: u64,
    response_bytes: u64,
    pages: Vec<WordPressPageSourceDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressPageSourceDocument {
    page_reference: String,
    acquisition: &'static str,
    association: &'static str,
    outcome: &'static str,
    request_attempted: bool,
    interpreted_response_bytes: u64,
    response_bytes: u64,
    evidence_reference_count: usize,
    evidence_references: Vec<String>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressDiscoveryLayoutDocument {
    application_reference: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    declaration: Option<WordPressDiscoveryLayoutDeclarationDocument>,
    roles: Vec<WordPressDiscoveryLayoutRoleDocument>,
    skipped_foreign_origin_count: u16,
    skipped_sibling_application_count: u16,
    conflicting_association_count: u16,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressDiscoveryLayoutDeclarationDocument {
    schema: &'static str,
    byte_length: u64,
    sha256: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressDiscoveryLayoutRoleDocument {
    role: &'static str,
    status: &'static str,
    basis: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    reference: Option<String>,
    candidate_count: u16,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressDiscoverySourceDocument {
    kind: &'static str,
    association: &'static str,
    resource_reference: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    role_reference: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    component: Option<WordPressComponentIdentityDocument>,
    parent_depth: u8,
    outcome: &'static str,
    request_attempted: bool,
    response_bytes: u64,
    evidence_reference_count: usize,
    evidence_references: Vec<String>,
    #[serde(skip_serializing_if = "Vec::is_empty")]
    source_page_references: Vec<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    source_supplied_session_page_references: Option<Vec<String>>,
    #[serde(skip_serializing_if = "Vec::is_empty")]
    namespaces: Vec<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    theme: Option<WordPressThemeDiscoveryDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    plugin: Option<WordPressPluginDiscoveryDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressThemeDiscoveryDocument {
    #[serde(skip_serializing_if = "Option::is_none")]
    name: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    version: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    template: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    requires_wordpress: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    requires_php: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    tested_up_to: Option<String>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressPluginDiscoveryDocument {
    #[serde(skip_serializing_if = "Option::is_none")]
    name: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    stable_tag: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    requires_wordpress: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    requires_php: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    tested_up_to: Option<String>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressCatalogDocument {
    id: String,
    revision: String,
    retrieved_on: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressComponentIdentityDocument {
    kind: &'static str,
    slug: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressComponentDocument {
    identity: WordPressComponentIdentityDocument,
    evidence_class: &'static str,
    identity_sources: Vec<&'static str>,
    confidence_classes: Vec<&'static str>,
    versions: Vec<WordPressVersionEvidenceDocument>,
    activation: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    inventory_status: Option<&'static str>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressInventoryImportDocument {
    coverage: WordPressInventoryCoverageDocument,
    component_count: usize,
    limitations: Vec<WordPressInventoryLimitationDocument>,
    inputs: Vec<WordPressInventoryInputDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressInventoryCoverageDocument {
    core: &'static str,
    plugins: &'static str,
    themes: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressInventoryLimitationDocument {
    declared_name: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    version: Option<String>,
    status: &'static str,
    reason: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressInventoryInputDocument {
    class: &'static str,
    byte_length: usize,
    sha256: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalReviewDocument {
    source_namespace: &'static str,
    source_format: &'static str,
    mapping_revision: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    identity_mapping_policy: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    identity_source_assurance: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    resource_policy: Option<&'static str>,
    comparison_policy: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    comparison_profile: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    policy_selection: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    source_semantics_assurance: Option<&'static str>,
    input: WordPressExternalInputDocument,
    counts: WordPressExternalCountsDocument,
    notices: Vec<WordPressExternalNoticeDocument>,
    evaluations: Vec<WordPressExternalEvaluationDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    identity_limitations: Option<Vec<WordPressExternalIdentityLimitationDocument>>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalInputDocument {
    byte_length: u64,
    sha256: String,
    semantic_sha256: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    accounted_retained_bytes: Option<usize>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalCountsDocument {
    parsed_records: usize,
    software_associations: usize,
    #[serde(skip_serializing_if = "Option::is_none")]
    exact_identity_associations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    candidate_identity_associations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    ambiguous_identity_associations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    unresolved_identity_associations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    projected_identity_limitations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    unprojected_identity_limitations: Option<usize>,
    selected_associations: usize,
    evaluable_associations: usize,
    unsupported_associations: usize,
    excluded_associations: usize,
    #[serde(skip_serializing_if = "Option::is_none")]
    mapped_unselected_associations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    within_associations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    outside_associations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    indeterminate_associations: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    selected_ranges: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    evaluated_ranges: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    containing_ranges: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    noncontaining_ranges: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    unsupported_ranges: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    invalid_ranges: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    not_evaluated_ranges: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    partial_range_coverage_associations: Option<usize>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalNoticeDocument {
    id: String,
    message: String,
    party: String,
    notice: String,
    license: String,
    license_url: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalEvaluationDocument {
    key: WordPressExternalEvaluationKeyDocument,
    #[serde(skip_serializing_if = "Option::is_none")]
    identity_mapping: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    identity_collision_raw_count: Option<usize>,
    title: String,
    display_name: String,
    informational: bool,
    description: String,
    references: Vec<String>,
    record_reference: Option<String>,
    cwe: Option<WordPressExternalCweDocument>,
    cvss: Option<WordPressExternalCvssDocument>,
    cve: Option<String>,
    cve_link: Option<String>,
    researchers: Vec<String>,
    source_dates: WordPressExternalSourceDatesDocument,
    affected_ranges: Vec<WordPressExternalRangeDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    range_evaluations: Option<Vec<WordPressExternalRangeEvaluationDocument>>,
    source_patched: bool,
    source_patched_versions: Vec<String>,
    source_remediation: String,
    notice_ids: Vec<String>,
    component_evidence: &'static str,
    version_evidence_resolution: WordPressExternalVersionEvidenceResolutionDocument,
    version_relation: &'static str,
    #[serde(skip_serializing_if = "Option::is_none")]
    version_relation_reason: Option<&'static str>,
    applicability: &'static str,
    execution: WordPressExternalExecutionDocument,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalIdentityLimitationDocument {
    key: WordPressExternalIdentityLimitationKeyDocument,
    identity_resolution: &'static str,
    title: String,
    display_name: String,
    references: Vec<String>,
    record_reference: Option<String>,
    affected_ranges: Vec<WordPressExternalRangeDocument>,
    range_evaluations: Vec<WordPressExternalRangeEvaluationDocument>,
    source_patched: bool,
    source_patched_versions: Vec<String>,
    source_remediation: String,
    notice_ids: Vec<String>,
    version_relation: &'static str,
    version_relation_reason: &'static str,
    applicability: &'static str,
    execution: WordPressExternalExecutionDocument,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalIdentityLimitationKeyDocument {
    source_namespace: &'static str,
    upstream_id: String,
    source_component: WordPressExternalSourceComponentIdentityDocument,
    source_association_fingerprint: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalVersionEvidenceResolutionDocument {
    status: &'static str,
    evidence_row_count: usize,
    distinct_spelling_count: usize,
    #[serde(skip_serializing_if = "Option::is_none")]
    semantic_status: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    semantic_reason: Option<&'static str>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalRangeEvaluationDocument {
    relation: &'static str,
    reason: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalEvaluationKeyDocument {
    source_namespace: String,
    upstream_id: String,
    component: WordPressComponentIdentityDocument,
    #[serde(skip_serializing_if = "Option::is_none")]
    source_component: Option<WordPressExternalSourceComponentIdentityDocument>,
    #[serde(skip_serializing_if = "Option::is_none")]
    source_association_fingerprint: Option<String>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalSourceComponentIdentityDocument {
    kind: &'static str,
    slug: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalCweDocument {
    id: u32,
    name: String,
    description: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalCvssDocument {
    vector: String,
    score: String,
    rating: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalSourceDatesDocument {
    published: Option<String>,
    updated: Option<String>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalRangeDocument {
    label: String,
    from_kind: &'static str,
    from_version: String,
    from_inclusive: bool,
    to_kind: &'static str,
    to_version: String,
    to_inclusive: bool,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressExternalExecutionDocument {
    exploit_execution: &'static str,
    impact_validation: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressVersionEvidenceDocument {
    value: String,
    source: &'static str,
    confidence: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAdvisoryDocument {
    id: String,
    component: WordPressComponentIdentityDocument,
    source: WordPressAdvisorySourceDocument,
    cve: Option<String>,
    summary: String,
    affected_ranges: Vec<WordPressAffectedRangeDocument>,
    fixed_versions: Vec<String>,
    prerequisites: Vec<WordPressPrerequisiteDocument>,
    remediation: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    comparison_profile: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    version_resolution: Option<&'static str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    version_resolution_reason: Option<&'static str>,
    component_evidence: &'static str,
    version_relation: &'static str,
    applicability: &'static str,
    exploit_execution: &'static str,
    impact_validation: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAdvisorySourceDocument {
    reference: String,
    revision: String,
    retrieved_on: String,
    usage_basis: String,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressAffectedRangeDocument {
    lower: Option<WordPressVersionEndpointDocument>,
    upper: Option<WordPressVersionEndpointDocument>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressVersionEndpointDocument {
    declared: String,
    inclusive: bool,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Serialize)]
struct WordPressPrerequisiteDocument {
    kind: &'static str,
    expected: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    patch_id: Option<String>,
    outcome: &'static str,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
#[derive(Clone, Copy, PartialEq, Eq)]
enum WordPressPresentationGroup {
    ReviewCandidate,
    Contradicted,
    Limitation,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
struct WordPressPresentationCounts {
    review_candidates: usize,
    contradicted: usize,
    limitations: usize,
    source_guidance: usize,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl AssessmentWordPressAuditDocument {
    fn from_audit(audit: &WebAssessmentWordPressAudit) -> Self {
        let result = audit.result();
        let profiled = result.catalog_schema() == Some(WordPressAdvisoryCatalogSchema::V2);
        let external_schema = result.external_review().is_some();
        let explicit_external_schema = result.external_review().is_some_and(|review| {
            review.comparison_policy()
                == WordPressExternalComparisonPolicy::TermivarWordfenceV3ExplicitInterpretationV1
        });
        let source_identity_external_schema = result
            .external_review()
            .is_some_and(crate::wordpress_review::WordPressExternalReview::requires_audit_v6);
        let inventory_import = result.inventory_summary().map(|summary| {
            let coverage = summary.coverage();
            WordPressInventoryImportDocument {
                coverage: WordPressInventoryCoverageDocument {
                    core: wordpress_inventory_category_status(coverage.core()),
                    plugins: wordpress_inventory_category_status(coverage.plugins()),
                    themes: wordpress_inventory_category_status(coverage.themes()),
                },
                component_count: summary.component_count(),
                limitations: summary
                    .limitations()
                    .iter()
                    .map(|limitation| WordPressInventoryLimitationDocument {
                        declared_name: limitation.declared_name().to_owned(),
                        version: limitation.version().map(str::to_owned),
                        status: wordpress_inventory_entry_status(limitation.status()),
                        reason: wordpress_inventory_limitation_reason(limitation.reason()),
                    })
                    .collect(),
                inputs: result
                    .local_input_provenance()
                    .iter()
                    .map(|input| WordPressInventoryInputDocument {
                        class: wordpress_local_input_class(input.class()),
                        byte_length: input.byte_length(),
                        sha256: lowercase_hex(input.sha256()),
                    })
                    .collect(),
            }
        });
        let inventory_schema = inventory_import.is_some();
        let catalog = result
            .catalog_metadata()
            .map(|metadata| WordPressCatalogDocument {
                id: metadata.id().to_owned(),
                revision: metadata.revision().to_owned(),
                retrieved_on: metadata.retrieved_on().to_owned(),
            });
        let components = result
            .components()
            .iter()
            .map(|component| WordPressComponentDocument {
                identity: wordpress_component_identity(component.identity()),
                evidence_class: wordpress_evidence_class(component.evidence_class()),
                identity_sources: component
                    .identity_sources()
                    .iter()
                    .copied()
                    .map(wordpress_evidence_source)
                    .collect(),
                confidence_classes: component
                    .confidence_classes()
                    .iter()
                    .copied()
                    .map(wordpress_confidence)
                    .collect(),
                versions: component
                    .versions()
                    .iter()
                    .map(|version| WordPressVersionEvidenceDocument {
                        value: version.value().to_owned(),
                        source: wordpress_evidence_source(version.source()),
                        confidence: wordpress_confidence(version.confidence()),
                    })
                    .collect(),
                activation: component.activation().map(wordpress_activation),
                inventory_status: component
                    .inventory_status()
                    .map(wordpress_inventory_entry_status),
            })
            .collect::<Vec<_>>();
        let external_review = result
            .external_review()
            .map(wordpress_external_review_document);
        let advisories = result
            .advisories()
            .iter()
            .map(|evaluation| {
                let record = evaluation.record();
                WordPressAdvisoryDocument {
                    id: record.id().to_owned(),
                    component: wordpress_component_identity(record.component()),
                    source: WordPressAdvisorySourceDocument {
                        reference: record.source().reference().to_owned(),
                        revision: record.source().revision().to_owned(),
                        retrieved_on: record.source().retrieved_on().to_owned(),
                        usage_basis: record.source().usage_basis().to_owned(),
                    },
                    cve: record.cve().map(str::to_owned),
                    summary: record.summary().to_owned(),
                    affected_ranges: if profiled {
                        record
                            .profiled_affected_ranges()
                            .iter()
                            .map(|range| WordPressAffectedRangeDocument {
                                lower: range.lower().map(|endpoint| {
                                    WordPressVersionEndpointDocument {
                                        declared: endpoint.declared().to_owned(),
                                        inclusive: endpoint.inclusive(),
                                    }
                                }),
                                upper: range.upper().map(|endpoint| {
                                    WordPressVersionEndpointDocument {
                                        declared: endpoint.declared().to_owned(),
                                        inclusive: endpoint.inclusive(),
                                    }
                                }),
                            })
                            .collect()
                    } else {
                        record
                            .affected_ranges()
                            .iter()
                            .map(|range| WordPressAffectedRangeDocument {
                                lower: range.lower().map(|endpoint| {
                                    WordPressVersionEndpointDocument {
                                        declared: endpoint.declared().to_owned(),
                                        inclusive: endpoint.inclusive(),
                                    }
                                }),
                                upper: range.upper().map(|endpoint| {
                                    WordPressVersionEndpointDocument {
                                        declared: endpoint.declared().to_owned(),
                                        inclusive: endpoint.inclusive(),
                                    }
                                }),
                            })
                            .collect()
                    },
                    fixed_versions: record.fixed_versions().to_vec(),
                    prerequisites: evaluation
                        .prerequisites()
                        .iter()
                        .map(|prerequisite| {
                            wordpress_prerequisite(
                                prerequisite.prerequisite(),
                                prerequisite.outcome(),
                            )
                        })
                        .collect(),
                    remediation: record.remediation().map(str::to_owned),
                    comparison_profile: profiled
                        .then_some(wordpress_comparison_profile(record.comparison_profile())),
                    version_resolution: evaluation
                        .version_resolution()
                        .map(wordpress_version_resolution),
                    version_resolution_reason: evaluation
                        .version_resolution_reason()
                        .map(wordpress_version_resolution_reason),
                    component_evidence: wordpress_evidence_class(evaluation.component_evidence()),
                    version_relation: wordpress_version_relation(evaluation.version_relation()),
                    applicability: wordpress_applicability(evaluation.applicability()),
                    exploit_execution: wordpress_execution(evaluation.exploit_execution()),
                    impact_validation: wordpress_execution(evaluation.impact_validation()),
                }
            })
            .collect::<Vec<_>>();
        let review_basis_schema = if source_identity_external_schema {
            "security.wordpress-review-audit/v6"
        } else if explicit_external_schema {
            "security.wordpress-review-audit/v5"
        } else if external_schema {
            "security.wordpress-review-audit/v4"
        } else if inventory_schema {
            "security.wordpress-review-audit/v3"
        } else if profiled {
            "security.wordpress-review-audit/v2"
        } else {
            "security.wordpress-review-audit/v1"
        };
        let discovery_influenced = audit.discovery().is_some();
        let fingerprint_influenced = audit.asset_fingerprints().is_some();
        Self {
            schema: if fingerprint_influenced {
                "security.wordpress-review-audit/v8"
            } else if discovery_influenced {
                "security.wordpress-review-audit/v7"
            } else {
                review_basis_schema
            },
            review_basis_schema: (discovery_influenced || fingerprint_influenced)
                .then_some(review_basis_schema),
            capability_id: WORDPRESS_REVIEW_CAPABILITY_ID,
            catalog_status: wordpress_catalog_status(result.catalog_status()),
            catalog_schema: if inventory_schema && !external_schema {
                result
                    .catalog_schema()
                    .map(WordPressAdvisoryCatalogSchema::id)
            } else {
                None
            },
            catalog,
            inventory_import,
            external_review,
            signal_count: audit.signal_count(),
            evidence_reference_count: audit.evidence_reference_count(),
            additional_request_count: audit.additional_request_count(),
            item_projected: audit.item_projected(),
            component_count: components.len(),
            advisory_count: advisories.len(),
            components,
            advisories,
        }
    }

    fn validate(&self, items: &[AssessmentItemDocument<'_>]) -> Result<(), ReportError> {
        let projected = items
            .iter()
            .filter(|item| item.capability_id == WORDPRESS_REVIEW_CAPABILITY_ID)
            .count();
        let discovery_influenced = matches!(
            self.schema,
            "security.wordpress-review-audit/v7" | "security.wordpress-review-audit/v8"
        );
        let review_basis_schema = if discovery_influenced {
            self.review_basis_schema.unwrap_or("")
        } else {
            self.schema
        };
        let external = matches!(
            review_basis_schema,
            "security.wordpress-review-audit/v4"
                | "security.wordpress-review-audit/v5"
                | "security.wordpress-review-audit/v6"
        );
        let source_identity_external = review_basis_schema == "security.wordpress-review-audit/v6";
        let explicit_external = match review_basis_schema {
            "security.wordpress-review-audit/v5" => true,
            "security.wordpress-review-audit/v6" => self
                .external_review
                .as_ref()
                .is_some_and(|review| review.comparison_profile.is_some()),
            _ => false,
        };
        let catalog_consistent = if external {
            self.catalog_status == "evaluated" && self.catalog.is_none()
        } else {
            matches!(
                (self.catalog_status, self.catalog.as_ref()),
                ("catalogue_not_supplied", None) | ("evaluated", Some(_))
            )
        };
        let version_evidence_count = self
            .components
            .iter()
            .try_fold(0_usize, |count, component| {
                count.checked_add(component.versions.len())
            });
        let discovery_evidence_present = self.components.iter().any(|component| {
            component
                .identity_sources
                .contains(&"theme_stylesheet_declaration")
                || component
                    .versions
                    .iter()
                    .any(|version| version.source == "theme_stylesheet_declaration")
        });
        let inventory = review_basis_schema == "security.wordpress-review-audit/v3";
        let profiled = review_basis_schema == "security.wordpress-review-audit/v2"
            || (inventory && self.catalog_schema == Some(WORDPRESS_ADVISORY_CATALOG_SCHEMA_V2));
        let basis_schema_valid = matches!(
            review_basis_schema,
            "security.wordpress-review-audit/v1"
                | "security.wordpress-review-audit/v2"
                | "security.wordpress-review-audit/v3"
                | "security.wordpress-review-audit/v4"
                | "security.wordpress-review-audit/v5"
                | "security.wordpress-review-audit/v6"
        );
        let schema_valid = basis_schema_valid
            && if discovery_influenced {
                self.review_basis_schema == Some(review_basis_schema)
            } else {
                self.review_basis_schema.is_none()
            };
        let catalogue_schema_valid = if external {
            self.catalog_schema.is_none()
        } else if inventory {
            matches!(
                (self.catalog_status, self.catalog_schema),
                ("catalogue_not_supplied", None)
                    | (
                        "evaluated",
                        Some(
                            WORDPRESS_ADVISORY_CATALOG_SCHEMA
                                | WORDPRESS_ADVISORY_CATALOG_SCHEMA_V2
                        )
                    )
            )
        } else {
            self.catalog_schema.is_none()
        };
        let inventory_valid = match (&self.inventory_import, inventory, external) {
            (Some(import), true, false) | (Some(import), false, true) => {
                import.is_valid(&self.components)
            },
            (None, false, _) => self
                .components
                .iter()
                .all(|component| component.inventory_status.is_none()),
            _ => false,
        };
        let external_valid = match (&self.external_review, external) {
            (Some(review), true) => review.is_valid(
                &self.components,
                explicit_external,
                source_identity_external,
            ),
            (None, false) => true,
            _ => false,
        };
        if !schema_valid
            || self.capability_id != WORDPRESS_REVIEW_CAPABILITY_ID
            || !catalog_consistent
            || !catalogue_schema_valid
            || !inventory_valid
            || !external_valid
            || (!discovery_influenced && discovery_evidence_present)
            || if discovery_influenced {
                self.additional_request_count > MAX_WORDPRESS_DISCOVERY_AUDIT_REQUESTS
            } else {
                self.additional_request_count != 0
            }
            || usize::from(self.signal_count) > MAX_WORDPRESS_SIGNALS
            || usize::from(self.evidence_reference_count) > MAX_WORDPRESS_SIGNALS
            || self.component_count != self.components.len()
            || self.component_count > MAX_WORDPRESS_RESULT_COMPONENTS
            || version_evidence_count
                .is_none_or(|count| count > MAX_WORDPRESS_RESULT_VERSION_EVIDENCE)
            || self.advisory_count != self.advisories.len()
            || self.advisory_count > MAX_WORDPRESS_ADVISORY_RECORDS
            || (external && self.advisory_count != 0)
            || projected > 1
            || self.item_projected != (projected == 1)
            || self.item_projected != (self.signal_count > 0)
            || self.item_projected != (self.evidence_reference_count > 0)
            || ((review_basis_schema == "security.wordpress-review-audit/v2" || external)
                && self.catalog_status != "evaluated")
            || self
                .advisories
                .iter()
                .any(|advisory| !advisory.profile_fields_are_valid(profiled))
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        let mut metadata = vec![
            ("Audit schema", self.schema.to_owned()),
            ("Capability", self.capability_id.to_owned()),
            ("Catalog status", self.catalog_status.to_owned()),
            ("Signal count", self.signal_count.to_string()),
            (
                "Evidence reference count",
                self.evidence_reference_count.to_string(),
            ),
            (
                "Additional request count",
                self.additional_request_count.to_string(),
            ),
            ("Item projected", self.item_projected.to_string()),
            ("Component count", self.component_count.to_string()),
            ("Advisory count", self.advisory_count.to_string()),
        ];
        if let Some(schema) = self.review_basis_schema {
            metadata.insert(1, ("Review basis schema", schema.to_owned()));
        }
        metadata
    }

    fn presentation_counts(&self) -> WordPressPresentationCounts {
        let mut counts = WordPressPresentationCounts {
            review_candidates: 0,
            contradicted: 0,
            limitations: 0,
            source_guidance: self.external_review.as_ref().map_or(0, |external| {
                let evaluated = external
                    .evaluations
                    .iter()
                    .filter(|evaluation| external_evaluation_has_source_guidance(evaluation))
                    .count();
                let limitations = external
                    .identity_limitations
                    .as_ref()
                    .map_or(0, |limitations| {
                        limitations
                            .iter()
                            .filter(|limitation| {
                                limitation.source_patched
                                    || !limitation.source_patched_versions.is_empty()
                                    || !limitation.source_remediation.is_empty()
                            })
                            .count()
                    });
                evaluated + limitations
            }),
        };
        if let Some(external) = &self.external_review {
            for evaluation in &external.evaluations {
                match wordpress_external_advisory_group(evaluation) {
                    WordPressPresentationGroup::ReviewCandidate => counts.review_candidates += 1,
                    WordPressPresentationGroup::Contradicted => counts.contradicted += 1,
                    WordPressPresentationGroup::Limitation => counts.limitations += 1,
                }
            }
            counts.limitations = counts
                .limitations
                .saturating_add(external.identity_limitations.as_ref().map_or(0, Vec::len))
                .saturating_add(
                    external
                        .counts
                        .unprojected_identity_limitations
                        .unwrap_or(0),
                );
        }
        for advisory in &self.advisories {
            match wordpress_advisory_group(advisory) {
                WordPressPresentationGroup::ReviewCandidate => counts.review_candidates += 1,
                WordPressPresentationGroup::Contradicted => counts.contradicted += 1,
                WordPressPresentationGroup::Limitation => counts.limitations += 1,
            }
            if advisory_has_source_guidance(advisory) {
                counts.source_guidance += 1;
            }
        }
        counts
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl AssessmentWordPressDiscoveryAuditDocument {
    fn from_wordpress_audit(
        audit: &WebAssessmentWordPressAudit,
        evidence_references: &[String],
    ) -> Result<Option<Self>, ReportError> {
        let Some(discovery) = audit.discovery() else {
            if evidence_references.is_empty() {
                return Ok(None);
            }
            return Err(ReportError::Serialization);
        };
        let mut evidence_references = evidence_references.iter();
        let page_collection = discovery
            .page_scope()
            .map(|page_scope| {
                let pages = page_scope
                    .pages()
                    .iter()
                    .map(|page| {
                        let evidence_reference_count = page.evidence_ids().len();
                        let page_evidence_references = evidence_references
                            .by_ref()
                            .take(evidence_reference_count)
                            .cloned()
                            .collect::<Vec<_>>();
                        if page_evidence_references.len() != evidence_reference_count {
                            return Err(ReportError::Serialization);
                        }
                        Ok(WordPressPageSourceDocument {
                            page_reference: page.page_reference().to_owned(),
                            acquisition: page.acquisition().as_str(),
                            association: page.association().as_str(),
                            outcome: page.outcome().as_str(),
                            request_attempted: page.request_attempted(),
                            interpreted_response_bytes: page.interpreted_response_bytes(),
                            response_bytes: page.response_bytes(),
                            evidence_reference_count,
                            evidence_references: page_evidence_references,
                        })
                    })
                    .collect::<Result<Vec<_>, ReportError>>()?;
                Ok(WordPressPageCollectionDocument {
                    mode: page_scope.mode().as_str(),
                    entry_page_reference: page_scope.entry_page_reference().to_owned(),
                    candidate_count: page_scope.candidate_count(),
                    selected_count: page_scope.selected_count(),
                    omitted_candidate_count: page_scope.omitted_candidate_count(),
                    reused_response_count: page_scope.reused_response_count(),
                    fetched_response_count: page_scope.fetched_response_count(),
                    not_observed_count: page_scope.not_observed_count(),
                    rejected_response_count: page_scope.rejected_response_count(),
                    accepted_association_count: page_scope.accepted_association_count(),
                    rejected_association_count: page_scope.rejected_association_count(),
                    attempted_request_count: page_scope.attempted_request_count(),
                    completed_response_count: page_scope.completed_response_count(),
                    committed_response_count: page_scope.committed_response_count(),
                    interpreted_response_bytes: page_scope.interpreted_response_bytes(),
                    response_bytes: page_scope.response_bytes(),
                    pages,
                })
            })
            .transpose()?;
        let supplied_session_pages = discovery
            .supplied_session_pages()
            .map(|scope| {
                let pages = scope
                    .pages()
                    .iter()
                    .map(|page| {
                        let evidence_reference_count = page.evidence_ids().len();
                        let page_evidence_references = evidence_references
                            .by_ref()
                            .take(evidence_reference_count)
                            .cloned()
                            .collect::<Vec<_>>();
                        if page_evidence_references.len() != evidence_reference_count {
                            return Err(ReportError::Serialization);
                        }
                        Ok(WordPressSuppliedSessionPageDocument {
                            page_reference: page.context_page_reference().to_owned(),
                            resource_reference: page.resource_reference().to_owned(),
                            resource_evidence_reference: page
                                .resource_evidence_reference()
                                .map(str::to_owned),
                            acquisition: "reused_supplied_session_response",
                            association: page.association().as_str(),
                            outcome: page.outcome().as_str(),
                            interpreted_response_bytes: page.interpreted_response_bytes(),
                            evidence_reference_count,
                            evidence_references: page_evidence_references,
                            fingerprint_evaluation: page.fingerprint_evaluation(),
                        })
                    })
                    .collect::<Result<Vec<_>, ReportError>>()?;
                Ok(WordPressSuppliedSessionPageCollectionDocument {
                    mode: scope.mode(),
                    policy_reference: scope.policy_reference().to_owned(),
                    application_reference: scope.application_reference().to_owned(),
                    principal_reference: scope.principal_reference().to_owned(),
                    credential_mechanism: scope.credential_mechanism().as_str(),
                    session_epoch: scope.epoch(),
                    selected_count: scope.selected_count(),
                    committed_count: scope.committed_count(),
                    accepted_association_count: scope.accepted_count(),
                    rejected_association_count: scope.rejected_count(),
                    not_established_association_count: scope.not_established_count(),
                    not_evaluated_count: scope.not_evaluated_count(),
                    interpreted_response_bytes: scope.interpreted_response_bytes(),
                    pages,
                })
            })
            .transpose()?;
        let supplied_session_scoped = supplied_session_pages.is_some();
        let sources = discovery
            .sources()
            .iter()
            .map(|source| {
                let evidence_reference_count = source.evidence_ids().len();
                let source_evidence_references = evidence_references
                    .by_ref()
                    .take(evidence_reference_count)
                    .cloned()
                    .collect::<Vec<_>>();
                if source_evidence_references.len() != evidence_reference_count {
                    return Err(ReportError::Serialization);
                }
                let component =
                    source
                        .component_kind()
                        .zip(source.component_slug())
                        .map(|(kind, slug)| WordPressComponentIdentityDocument {
                            kind: wordpress_component_kind(kind),
                            slug: slug.to_owned(),
                        });
                let theme = source
                    .theme()
                    .map(|metadata| WordPressThemeDiscoveryDocument {
                        name: metadata.name().map(str::to_owned),
                        version: metadata.version().map(str::to_owned),
                        template: metadata.template().map(str::to_owned),
                        requires_wordpress: metadata.requires_wordpress().map(str::to_owned),
                        requires_php: metadata.requires_php().map(str::to_owned),
                        tested_up_to: metadata.tested_up_to().map(str::to_owned),
                    });
                let plugin = source
                    .plugin()
                    .map(|metadata| WordPressPluginDiscoveryDocument {
                        name: metadata.name().map(str::to_owned),
                        stable_tag: metadata.stable_tag().map(str::to_owned),
                        requires_wordpress: metadata.requires_wordpress().map(str::to_owned),
                        requires_php: metadata.requires_php().map(str::to_owned),
                        tested_up_to: metadata.tested_up_to().map(str::to_owned),
                    });
                Ok(WordPressDiscoverySourceDocument {
                    kind: source.kind().as_str(),
                    association: source.association().as_str(),
                    resource_reference: source.resource_reference().to_owned(),
                    role_reference: source.role_reference().map(str::to_owned),
                    component,
                    parent_depth: source.parent_depth(),
                    outcome: source.outcome().as_str(),
                    request_attempted: source.request_attempted(),
                    response_bytes: source.response_bytes(),
                    evidence_reference_count,
                    evidence_references: source_evidence_references,
                    source_page_references: source.source_page_references().to_vec(),
                    source_supplied_session_page_references: supplied_session_scoped
                        .then(|| source.source_supplied_session_page_references().to_vec()),
                    namespaces: source.namespaces().to_vec(),
                    theme,
                    plugin,
                })
            })
            .collect::<Result<Vec<_>, ReportError>>()?;
        if evidence_references.next().is_some() {
            return Err(ReportError::Serialization);
        }
        let layout = discovery.layout();
        let layout = WordPressDiscoveryLayoutDocument {
            application_reference: layout.application_reference().to_owned(),
            declaration: layout.declaration().map(|declaration| {
                WordPressDiscoveryLayoutDeclarationDocument {
                    schema: WORDPRESS_DISCOVERY_LAYOUT_SCHEMA,
                    byte_length: declaration.byte_length(),
                    sha256: declaration.sha256().to_owned(),
                }
            }),
            roles: layout
                .roles()
                .iter()
                .map(|role| WordPressDiscoveryLayoutRoleDocument {
                    role: role.role().as_str(),
                    status: role.status().as_str(),
                    basis: role.basis().as_str(),
                    reference: role.reference().map(str::to_owned),
                    candidate_count: role.candidate_count(),
                })
                .collect(),
            skipped_foreign_origin_count: layout.skipped_foreign_origin_count(),
            skipped_sibling_application_count: layout.skipped_sibling_application_count(),
            conflicting_association_count: layout.conflicting_association_count(),
        };
        Ok(Some(Self {
            schema: if supplied_session_pages.is_some() {
                WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V4
            } else if page_collection.is_some() {
                WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V3
            } else {
                WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V2
            },
            capability_id: WORDPRESS_DISCOVERY_CAPABILITY_ID,
            policy_id: discovery.policy_id(),
            selected: discovery.selected(),
            method: "get",
            credential_mode: "anonymous",
            seed_count: discovery.seed_count(),
            candidate_count: discovery.candidate_count(),
            candidate_limit_reached: discovery.candidate_limit_reached(),
            omitted_candidate_count: discovery.omitted_candidate_count(),
            attempted_request_count: discovery.attempted_request_count(),
            completed_response_count: discovery.completed_response_count(),
            committed_response_count: discovery.committed_response_count(),
            response_bytes: discovery.response_bytes(),
            source_count: sources.len(),
            layout,
            page_collection,
            supplied_session_pages,
            sources,
        }))
    }

    fn validate(&self) -> Result<(), ReportError> {
        let page_validation = self
            .page_collection
            .as_ref()
            .map(WordPressPageCollectionDocument::validate)
            .transpose()?;
        let supplied_session_page_validation = self
            .supplied_session_pages
            .as_ref()
            .map(WordPressSuppliedSessionPageCollectionDocument::validate)
            .transpose()?;
        let source_bytes = self.sources.iter().try_fold(0_u64, |total, source| {
            total.checked_add(source.response_bytes)
        });
        let evidence_references = self.sources.iter().try_fold(0_usize, |total, source| {
            total.checked_add(source.evidence_reference_count)
        });
        let unique_evidence_references = self
            .sources
            .iter()
            .flat_map(|source| source.evidence_references.iter())
            .collect::<std::collections::BTreeSet<_>>()
            .len();
        let attempted_sources = self
            .sources
            .iter()
            .filter(|source| source.request_attempted)
            .count();
        let attempted_rest_sources = self
            .sources
            .iter()
            .filter(|source| source.request_attempted && source.kind == "rest_index")
            .count();
        let attempted_theme_sources = self
            .sources
            .iter()
            .filter(|source| source.request_attempted && source.kind == "theme_stylesheet")
            .count();
        let attempted_plugin_sources = self
            .sources
            .iter()
            .filter(|source| source.request_attempted && source.kind == "plugin_readme")
            .count();
        let unique_source_count = self
            .sources
            .iter()
            .map(|source| source.resource_reference.as_str())
            .collect::<std::collections::BTreeSet<_>>()
            .len();
        let is_page_scoped = page_validation.is_some();
        let is_supplied_session_scoped = supplied_session_page_validation.is_some();
        let is_form_login_scoped = supplied_session_page_validation
            .as_ref()
            .is_some_and(|scope| scope.form_login);
        let combined_request_count = self.attempted_request_count.checked_add(
            self.page_collection
                .as_ref()
                .map_or(0, |pages| pages.attempted_request_count),
        );
        let combined_response_bytes = self.response_bytes.checked_add(
            self.page_collection
                .as_ref()
                .map_or(0, |pages| pages.response_bytes),
        );
        if self.schema
            != if is_supplied_session_scoped {
                WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V4
            } else if is_page_scoped {
                WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V3
            } else {
                WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V2
            }
            || self.capability_id != WORDPRESS_DISCOVERY_CAPABILITY_ID
            || self.policy_id
                != if is_supplied_session_scoped {
                    if is_form_login_scoped {
                        WORDPRESS_FORM_LOGIN_DISCOVERY_POLICY_ID
                    } else {
                        WORDPRESS_SUPPLIED_SESSION_DISCOVERY_POLICY_ID
                    }
                } else if is_page_scoped {
                    WORDPRESS_PAGE_SCOPED_DISCOVERY_POLICY_ID
                } else {
                    WORDPRESS_DISCOVERY_POLICY_ID
                }
            || !self.selected
            || self.method != "get"
            || self.credential_mode != "anonymous"
            || usize::from(self.seed_count) > MAX_WORDPRESS_DISCOVERY_AUDIT_SOURCES
            || usize::from(self.candidate_count) > MAX_WORDPRESS_DISCOVERY_AUDIT_SOURCES
            || self.seed_count > self.candidate_count
            || self.candidate_limit_reached != (self.omitted_candidate_count > 0)
            || self.omitted_candidate_count > MAX_WORDPRESS_DISCOVERY_AUDIT_OMITTED_CANDIDATES
            || (self.omitted_candidate_count > 0
                && usize::from(self.candidate_count) != MAX_WORDPRESS_DISCOVERY_AUDIT_SOURCES)
            || self.attempted_request_count > MAX_WORDPRESS_DISCOVERY_AUDIT_REQUESTS
            || combined_request_count
                .is_none_or(|count| count > MAX_WORDPRESS_DISCOVERY_AUDIT_REQUESTS)
            || combined_response_bytes
                .is_none_or(|bytes| bytes > MAX_WORDPRESS_DISCOVERY_AUDIT_RESPONSE_BYTES)
            || self.attempted_request_count > self.candidate_count
            || attempted_sources != usize::from(self.attempted_request_count)
            || attempted_rest_sources > MAX_WORDPRESS_DISCOVERY_AUDIT_REST_REQUESTS
            || attempted_theme_sources > MAX_WORDPRESS_DISCOVERY_AUDIT_THEME_REQUESTS
            || attempted_plugin_sources > MAX_WORDPRESS_DISCOVERY_AUDIT_PLUGIN_REQUESTS
            || self.completed_response_count > self.attempted_request_count
            || self.committed_response_count != self.completed_response_count
            || self.source_count != self.sources.len()
            || self.source_count > MAX_WORDPRESS_DISCOVERY_AUDIT_SOURCES
            || unique_source_count != self.source_count
            || usize::from(self.candidate_count) != self.source_count
            || source_bytes != Some(self.response_bytes)
            || evidence_references != Some(usize::from(self.committed_response_count))
            || unique_evidence_references != usize::from(self.committed_response_count)
            || !self.layout.is_valid()
            || self.sources.iter().any(|source| {
                !source.is_valid(
                    &self.layout,
                    page_validation
                        .as_ref()
                        .map(|validation| &validation.accepted_page_references),
                    self.page_collection
                        .as_ref()
                        .map(|pages| pages.entry_page_reference.as_str()),
                    supplied_session_page_validation
                        .as_ref()
                        .map(|validation| &validation.accepted_page_references),
                    is_supplied_session_scoped,
                )
            })
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        let mut metadata = vec![
            ("Discovery audit schema", self.schema.to_owned()),
            ("Discovery policy", self.policy_id.to_owned()),
            (
                "Selected application reference",
                self.layout.application_reference.clone(),
            ),
            (
                "Layout declaration",
                if self.layout.declaration.is_some() {
                    "operator supplied".to_owned()
                } else {
                    "not supplied".to_owned()
                },
            ),
            ("Request method", self.method.to_owned()),
            ("Credential mode", self.credential_mode.to_owned()),
            ("Admitted seeds", self.seed_count.to_string()),
            ("Selected candidates", self.candidate_count.to_string()),
            (
                "Candidate limit reached",
                self.candidate_limit_reached.to_string(),
            ),
            (
                "Omitted candidates",
                self.omitted_candidate_count.to_string(),
            ),
            (
                "Attempted requests",
                self.attempted_request_count.to_string(),
            ),
            (
                "Completed responses",
                self.completed_response_count.to_string(),
            ),
            ("Discovery response bytes", self.response_bytes.to_string()),
            (
                "Skipped foreign-origin advertisements",
                self.layout.skipped_foreign_origin_count.to_string(),
            ),
            (
                "Skipped sibling-application advertisements",
                self.layout.skipped_sibling_application_count.to_string(),
            ),
            (
                "Conflicting layout associations",
                self.layout.conflicting_association_count.to_string(),
            ),
        ];
        if let Some(pages) = &self.page_collection {
            metadata.extend([
                ("Page scope mode", pages.mode.to_owned()),
                ("Selected secondary pages", pages.selected_count.to_string()),
                (
                    "Reused page responses",
                    pages.reused_response_count.to_string(),
                ),
                (
                    "Fetched page responses",
                    pages.fetched_response_count.to_string(),
                ),
                (
                    "Page request attempts",
                    pages.attempted_request_count.to_string(),
                ),
                (
                    "Interpreted secondary-page bytes",
                    pages.interpreted_response_bytes.to_string(),
                ),
                ("New secondary-page bytes", pages.response_bytes.to_string()),
            ]);
        }
        if let Some(pages) = &self.supplied_session_pages {
            metadata.extend([
                ("Supplied-session page mode", pages.mode.to_owned()),
                ("Session policy reference", pages.policy_reference.clone()),
                (
                    "Session application reference",
                    pages.application_reference.clone(),
                ),
                (
                    "Session principal reference",
                    pages.principal_reference.clone(),
                ),
                (
                    "Session credential mechanism",
                    pages.credential_mechanism.to_owned(),
                ),
                ("Session epoch", pages.session_epoch.to_string()),
                (
                    "Selected supplied-session pages",
                    pages.selected_count.to_string(),
                ),
                (
                    "Committed supplied-session pages",
                    pages.committed_count.to_string(),
                ),
                (
                    "Accepted supplied-session associations",
                    pages.accepted_association_count.to_string(),
                ),
                (
                    "Rejected supplied-session associations",
                    pages.rejected_association_count.to_string(),
                ),
                (
                    "Supplied-session associations not established",
                    pages.not_established_association_count.to_string(),
                ),
                (
                    "Supplied-session pages not evaluated",
                    pages.not_evaluated_count.to_string(),
                ),
                (
                    "Interpreted supplied-session bytes",
                    pages.interpreted_response_bytes.to_string(),
                ),
            ]);
        }
        metadata
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl AssessmentWordPressAssetFingerprintAuditDocument {
    fn from_execution(
        execution: &WordPressAssetFingerprintExecution,
        evidence_references: &[String],
    ) -> Result<Self, ReportError> {
        let catalog = execution.catalog();
        let metadata = catalog.catalog();
        let provenance = metadata.provenance();
        let catalogue = WordPressAssetFingerprintCatalogueDocument {
            schema: WORDPRESS_ASSET_FINGERPRINT_CATALOG_SCHEMA,
            id: metadata.id().to_owned(),
            revision: metadata.revision().to_owned(),
            source_namespace: metadata.source_namespace().to_owned(),
            byte_length: catalog.byte_length(),
            sha256: lowercase_hex(catalog.sha256()),
            semantic_sha256: lowercase_hex(catalog.semantic_sha256()),
            retained_bytes: catalog.retained_bytes(),
            component_count: catalog.components().len(),
            release_count: catalog.release_count(),
            file_count: catalog.file_count(),
            provenance: WordPressAssetFingerprintProvenanceDocument {
                reference: provenance.reference().to_owned(),
                revision: provenance.revision().to_owned(),
                notices: provenance
                    .notices()
                    .iter()
                    .map(|notice| WordPressAssetFingerprintNoticeDocument {
                        id: notice.id().to_owned(),
                        party: notice.party().to_owned(),
                        notice: notice.notice().to_owned(),
                        license: notice.license().to_owned(),
                        license_reference: notice.license_reference().to_owned(),
                    })
                    .collect(),
            },
        };
        let mut evidence_references = evidence_references.iter();
        let resources = execution
            .resources()
            .iter()
            .map(|resource| {
                let evidence_reference_count = resource.evidence_ids().len();
                let resource_evidence_references = evidence_references
                    .by_ref()
                    .take(evidence_reference_count)
                    .cloned()
                    .collect::<Vec<_>>();
                if resource_evidence_references.len() != evidence_reference_count {
                    return Err(ReportError::Serialization);
                }
                Ok(WordPressAssetFingerprintResourceDocument {
                    component: wordpress_component_identity(resource.component()),
                    relative_path: resource.relative_path().to_owned(),
                    resource_reference: resource.resource_reference().to_owned(),
                    source_page_references: resource.source_page_references().to_vec(),
                    observed_variant_count: resource.observed_variant_count(),
                    acquisition: resource.acquisition().as_str(),
                    outcome: resource.outcome().as_str(),
                    request_attempted: resource.request_attempted(),
                    interpreted_response_bytes: resource.interpreted_response_bytes(),
                    response_bytes: resource.response_bytes(),
                    evidence_reference_count,
                    evidence_references: resource_evidence_references,
                    observation: resource.observation().map(|observation| {
                        WordPressAssetFingerprintObservationDocument {
                            byte_length: observation.byte_length(),
                            sha256: lowercase_hex(observation.sha256()),
                        }
                    }),
                })
            })
            .collect::<Result<Vec<_>, ReportError>>()?;
        if evidence_references.next().is_some() {
            return Err(ReportError::Serialization);
        }
        let components = execution
            .component_matches()
            .iter()
            .map(|matched| {
                let catalog_component = catalog.component(matched.identity());
                if matched.catalogue_component_listed() != catalog_component.is_some() {
                    return Err(ReportError::Serialization);
                }
                let resources = matched
                    .resources()
                    .iter()
                    .map(|resource| WordPressAssetFingerprintResourceMatchDocument {
                        relative_path: resource.relative_path().to_owned(),
                        distinct_observation_count: resource.distinct_observation_count(),
                        informative: resource.informative(),
                        release_relation_count: resource.releases().len(),
                        release_relations: resource
                            .releases()
                            .iter()
                            .map(|release| WordPressAssetFingerprintReleaseRelationDocument {
                                release_id: release.release_id().to_owned(),
                                relation: wordpress_asset_fingerprint_relation(release.relation()),
                                unknown_reason: release
                                    .unknown_reason()
                                    .map(wordpress_asset_fingerprint_unknown_reason),
                            })
                            .collect(),
                    })
                    .collect::<Vec<_>>();
                let releases = matched
                    .releases()
                    .iter()
                    .map(|release| {
                        let Some(source) = catalog_component
                            .and_then(|component| {
                                component.releases().iter().find(|candidate| {
                                    candidate.release_id() == release.release_id()
                                })
                            })
                            .map(|release| release.source())
                        else {
                            return Err(ReportError::Serialization);
                        };
                        Ok(WordPressAssetFingerprintReleaseMatchDocument {
                            release_id: release.release_id().to_owned(),
                            version: release.version().to_owned(),
                            build_variant: release.build_variant().map(str::to_owned),
                            state: wordpress_asset_fingerprint_release_state(release.state()),
                            source: WordPressAssetFingerprintReleaseSourceDocument {
                                reference: source.reference().to_owned(),
                                revision: source.revision().to_owned(),
                                notice_ids: source.notice_ids().to_vec(),
                            },
                        })
                    })
                    .collect::<Result<Vec<_>, ReportError>>()?;
                let compatible_release_ids = matched
                    .compatible_release_ids()
                    .map(str::to_owned)
                    .collect::<Vec<_>>();
                let undetermined_release_ids = matched
                    .undetermined_release_ids()
                    .map(str::to_owned)
                    .collect::<Vec<_>>();
                let inconsistent_release_ids = matched
                    .inconsistent_release_ids()
                    .map(str::to_owned)
                    .collect::<Vec<_>>();
                Ok(WordPressAssetFingerprintComponentDocument {
                    identity: wordpress_component_identity(matched.identity()),
                    catalogue_component_listed: matched.catalogue_component_listed(),
                    state: wordpress_asset_fingerprint_aggregate_state(matched.state()),
                    candidate_resource_count: matched.candidate_resource_count(),
                    selected_resource_count: matched.selected_resource_count(),
                    completely_interpreted_resource_count: matched
                        .completely_interpreted_resource_count(),
                    omitted_resource_count: matched.omitted_resource_count(),
                    informative_resource_count: matched.informative_resource_count(),
                    listed_matrix_complete: matched.listed_matrix_complete(),
                    compatible_release_ids,
                    undetermined_release_ids,
                    inconsistent_release_ids,
                    resource_count: resources.len(),
                    resources,
                    release_count: releases.len(),
                    releases,
                })
            })
            .collect::<Result<Vec<_>, ReportError>>()?;
        Ok(Self {
            schema: WORDPRESS_ASSET_FINGERPRINT_AUDIT_SCHEMA,
            capability_id: WORDPRESS_ASSET_FINGERPRINT_CAPABILITY_ID,
            policy_id: WORDPRESS_ASSET_FINGERPRINT_POLICY_ID,
            selected: true,
            representation_profile: WORDPRESS_ASSET_FINGERPRINT_REPRESENTATION_PROFILE,
            finite_reference_scope: "listed_releases_only",
            same_release_assumption: "considered_paths_share_one_listed_release_artifact_set",
            installed_version_assurance: "not_established_by_asset_fingerprints",
            source_authenticity: "not_established",
            catalogue,
            candidate_count: execution.candidate_count(),
            selected_resource_count: execution.selected_resource_count(),
            omitted_resource_count: execution.omitted_resource_count(),
            attempted_request_count: execution.attempted_request_count(),
            reused_response_count: execution.reused_response_count(),
            fetched_response_count: execution.fetched_response_count(),
            response_bytes: execution.response_bytes(),
            stop: execution.stop().as_str(),
            resource_count: resources.len(),
            resources,
            component_count: components.len(),
            components,
        })
    }

    fn evidence_reference_count(&self) -> usize {
        self.resources
            .iter()
            .map(|resource| resource.evidence_reference_count)
            .sum()
    }

    fn validate(
        &self,
        review: &AssessmentWordPressAuditDocument,
        discovery: &AssessmentWordPressDiscoveryAuditDocument,
    ) -> Result<(), ReportError> {
        let resource_bytes = self.resources.iter().try_fold(0_u64, |total, resource| {
            total.checked_add(resource.response_bytes)
        });
        let attempts = self
            .resources
            .iter()
            .filter(|resource| resource.request_attempted)
            .count();
        let reused = self
            .resources
            .iter()
            .filter(|resource| resource.acquisition == "reused")
            .count();
        let fetched = self
            .resources
            .iter()
            .filter(|resource| resource.acquisition == "fetched" && resource.outcome == "observed")
            .count();
        let unique_resource_keys = self
            .resources
            .iter()
            .map(|resource| {
                (
                    resource.component.kind,
                    resource.component.slug.as_str(),
                    resource.relative_path.as_str(),
                )
            })
            .collect::<std::collections::BTreeSet<_>>();
        let ambiguous_variant_resource_keys = self
            .resources
            .iter()
            .filter(|resource| resource.observed_variant_count > 1)
            .map(|resource| {
                (
                    resource.component.kind,
                    resource.component.slug.as_str(),
                    resource.relative_path.as_str(),
                )
            })
            .collect::<std::collections::BTreeSet<_>>();
        let unique_component_keys = self
            .components
            .iter()
            .map(|component| (component.identity.kind, component.identity.slug.as_str()))
            .collect::<std::collections::BTreeSet<_>>();
        let selected_component_keys = self
            .resources
            .iter()
            .map(|resource| (resource.component.kind, resource.component.slug.as_str()))
            .collect::<std::collections::BTreeSet<_>>();
        let selected_component_candidate_count = self
            .components
            .iter()
            .try_fold(0_usize, |total, component| {
                total.checked_add(component.candidate_resource_count)
            });
        let selected_component_omitted_count = self
            .components
            .iter()
            .try_fold(0_usize, |total, component| {
                total.checked_add(component.omitted_resource_count)
            });
        let selected_component_release_count = self
            .components
            .iter()
            .try_fold(0_usize, |total, component| {
                total.checked_add(component.release_count)
            });
        let represented_reference_count =
            self.components
                .iter()
                .try_fold(0_usize, |component_total, component| {
                    component.resources.iter().try_fold(
                        component_total,
                        |resource_total, resource| {
                            resource.release_relations.iter().try_fold(
                                resource_total,
                                |total, relation| {
                                    if relation.relation != "unknown"
                                        || relation.unknown_reason
                                            == Some("conflicting_observations")
                                    {
                                        total.checked_add(1)
                                    } else {
                                        Some(total)
                                    }
                                },
                            )
                        },
                    )
                });
        let source_pages_valid = discovery.page_collection.as_ref().is_none_or(|pages| {
            let mut allowed = pages
                .pages
                .iter()
                .filter(|page| page.association == "accepted")
                .map(|page| page.page_reference.as_str())
                .collect::<std::collections::BTreeSet<_>>();
            allowed.insert(pages.entry_page_reference.as_str());
            self.resources.iter().all(|resource| {
                resource
                    .source_page_references
                    .iter()
                    .all(|reference| allowed.contains(reference.as_str()))
            })
        });
        if self.schema != WORDPRESS_ASSET_FINGERPRINT_AUDIT_SCHEMA
            || self.capability_id != WORDPRESS_ASSET_FINGERPRINT_CAPABILITY_ID
            || self.policy_id != WORDPRESS_ASSET_FINGERPRINT_POLICY_ID
            || !self.selected
            || self.representation_profile != WORDPRESS_ASSET_FINGERPRINT_REPRESENTATION_PROFILE
            || self.finite_reference_scope != "listed_releases_only"
            || self.same_release_assumption
                != "considered_paths_share_one_listed_release_artifact_set"
            || self.installed_version_assurance != "not_established_by_asset_fingerprints"
            || self.source_authenticity != "not_established"
            || self.stop != "complete"
            || review.schema != "security.wordpress-review-audit/v8"
            || self.candidate_count
                != u64::try_from(
                    self.selected_resource_count
                        .checked_add(self.omitted_resource_count)
                        .ok_or(ReportError::Serialization)?,
                )
                .map_err(|_| ReportError::Serialization)?
            || self.candidate_count
                > u64::try_from(MAX_WORDPRESS_ASSET_FINGERPRINT_CANDIDATE_IDENTITIES)
                    .map_err(|_| ReportError::Serialization)?
            || (self.candidate_count > 0 && self.selected_resource_count == 0)
            || self.resource_count != self.resources.len()
            || self.resource_count != self.selected_resource_count
            || self.resource_count > 4
            || attempts != usize::from(self.attempted_request_count)
            || reused != self.reused_response_count
            || fetched != self.fetched_response_count
            || resource_bytes != Some(self.response_bytes)
            || unique_resource_keys.len() != self.resources.len()
            || self.component_count != self.components.len()
            || self.component_count > 2
            || unique_component_keys.len() != self.components.len()
            || unique_component_keys != selected_component_keys
            || selected_component_candidate_count.is_none_or(|count| {
                u64::try_from(count).map_or(true, |count| count > self.candidate_count)
            })
            || selected_component_omitted_count
                .is_none_or(|count| count > self.omitted_resource_count)
            || self
                .components
                .iter()
                .any(|component| !component.catalogue_component_listed)
            || self.component_count > self.catalogue.component_count
            || selected_component_release_count
                .is_none_or(|count| count > self.catalogue.release_count)
            || represented_reference_count.is_none_or(|count| count > self.catalogue.file_count)
            || !source_pages_valid
            || !self.catalogue.is_valid()
            || self.resources.iter().any(|resource| !resource.is_valid())
            || self.components.iter().any(|component| {
                !component.is_valid(
                    &self.catalogue,
                    &unique_resource_keys,
                    &ambiguous_variant_resource_keys,
                )
            })
        {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }

    fn metadata(&self) -> Vec<(&'static str, String)> {
        vec![
            ("Fingerprint audit schema", self.schema.to_owned()),
            ("Fingerprint policy", self.policy_id.to_owned()),
            ("Reference scope", self.finite_reference_scope.to_owned()),
            ("Catalogue ID", self.catalogue.id.clone()),
            ("Catalogue revision", self.catalogue.revision.clone()),
            ("Catalogue SHA-256", self.catalogue.sha256.clone()),
            (
                "Catalogue semantic SHA-256",
                self.catalogue.semantic_sha256.clone(),
            ),
            (
                "Observed asset candidates",
                self.candidate_count.to_string(),
            ),
            (
                "Selected resources",
                self.selected_resource_count.to_string(),
            ),
            ("Omitted resources", self.omitted_resource_count.to_string()),
            ("Reused responses", self.reused_response_count.to_string()),
            ("Fetched responses", self.fetched_response_count.to_string()),
            (
                "Fingerprint requests",
                self.attempted_request_count.to_string(),
            ),
            (
                "Fingerprint response bytes",
                self.response_bytes.to_string(),
            ),
            ("Collection stop", self.stop.to_owned()),
        ]
    }

    fn wire_json(&self) -> Result<String, ReportError> {
        serde_json::to_string(self).map_err(|_| ReportError::Serialization)
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressAssetFingerprintCatalogueDocument {
    fn is_valid(&self) -> bool {
        self.schema == WORDPRESS_ASSET_FINGERPRINT_CATALOG_SCHEMA
            && self.byte_length > 0
            && self.byte_length <= MAX_WORDPRESS_ASSET_FINGERPRINT_CATALOG_BYTES as u64
            && valid_lowercase_sha256(&self.sha256)
            && valid_lowercase_sha256(&self.semantic_sha256)
            && self.retained_bytes > 0
            && self.retained_bytes <= MAX_WORDPRESS_ASSET_FINGERPRINT_RETAINED_BYTES
            && (1..=MAX_WORDPRESS_ASSET_FINGERPRINT_CATALOG_COMPONENTS)
                .contains(&self.component_count)
            && self.release_count > 0
            && self.release_count
                <= MAX_WORDPRESS_ASSET_FINGERPRINT_CATALOG_COMPONENTS
                    * MAX_WORDPRESS_ASSET_FINGERPRINT_RELEASES_PER_COMPONENT
            && self.file_count > 0
            && self.file_count <= MAX_WORDPRESS_ASSET_FINGERPRINT_CATALOG_FILES
            && self.provenance.notices.len() <= 32
            && self
                .provenance
                .notices
                .iter()
                .map(|notice| notice.id.as_str())
                .collect::<std::collections::BTreeSet<_>>()
                .len()
                == self.provenance.notices.len()
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressAssetFingerprintResourceDocument {
    fn is_valid(&self) -> bool {
        let observed = self.outcome == "observed";
        matches!(self.component.kind, "plugin" | "theme")
            && crate::wordpress_review::valid_slug(&self.component.slug)
            && self.relative_path.len() <= MAX_WORDPRESS_ASSET_FINGERPRINT_PATH_BYTES
            && crate::wordpress_review::valid_wordpress_asset_fingerprint_path(&self.relative_path)
            && valid_wordpress_discovery_reference(&self.resource_reference)
            && !self.source_page_references.is_empty()
            && self.source_page_references.len() <= 4
            && self
                .source_page_references
                .windows(2)
                .all(|pair| pair[0] < pair[1])
            && self
                .source_page_references
                .iter()
                .all(|reference| valid_wordpress_discovery_reference(reference))
            && self.observed_variant_count > 0
            && self.observed_variant_count <= MAX_WORDPRESS_ASSET_FINGERPRINT_CANDIDATE_IDENTITIES
            && matches!(self.acquisition, "reused" | "fetched" | "not_acquired")
            && matches!(
                self.outcome,
                "observed"
                    | "ordinary_response_ineligible"
                    | "request_failed"
                    | "unauthorized"
                    | "not_found"
                    | "redirect_observed"
                    | "partial_or_incomplete"
                    | "unsupported_media_type"
                    | "unsupported_content_encoding"
                    | "inconsistent_content_length"
                    | "conflicting_representations"
            )
            && match self.acquisition {
                "reused" => {
                    !self.request_attempted
                        && self.response_bytes == 0
                        && matches!(self.outcome, "observed" | "conflicting_representations")
                },
                "fetched" => {
                    self.request_attempted
                        && matches!(
                            self.outcome,
                            "observed"
                                | "request_failed"
                                | "unauthorized"
                                | "not_found"
                                | "redirect_observed"
                                | "partial_or_incomplete"
                                | "unsupported_media_type"
                                | "unsupported_content_encoding"
                                | "inconsistent_content_length"
                        )
                },
                "not_acquired" => {
                    !self.request_attempted
                        && self.response_bytes == 0
                        && self.outcome == "ordinary_response_ineligible"
                },
                _ => false,
            }
            && self.interpreted_response_bytes <= MAX_WORDPRESS_ASSET_FINGERPRINT_ASSET_BYTES
            && self.evidence_reference_count == self.evidence_references.len()
            && match self.outcome {
                "observed" => self.evidence_reference_count == 1,
                "conflicting_representations" => (1..=8).contains(&self.evidence_reference_count),
                _ => self.evidence_reference_count == 0,
            }
            && self
                .evidence_references
                .iter()
                .all(|reference| valid_opaque_assessment_reference(reference, "evidence"))
            && observed == self.observation.is_some()
            && self.observation.as_ref().is_none_or(|observation| {
                observation.byte_length == self.interpreted_response_bytes
                    && observation.byte_length <= MAX_WORDPRESS_ASSET_FINGERPRINT_ASSET_BYTES
                    && valid_lowercase_sha256(&observation.sha256)
            })
            && (observed || self.interpreted_response_bytes == 0)
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressAssetFingerprintComponentDocument {
    fn is_valid(
        &self,
        catalogue: &WordPressAssetFingerprintCatalogueDocument,
        observed_resources: &std::collections::BTreeSet<(&str, &str, &str)>,
        ambiguous_variant_resources: &std::collections::BTreeSet<(&str, &str, &str)>,
    ) -> bool {
        let release_ids = self
            .releases
            .iter()
            .map(|release| release.release_id.as_str())
            .collect::<std::collections::BTreeSet<_>>();
        let compatible = self
            .compatible_release_ids
            .iter()
            .map(String::as_str)
            .collect::<std::collections::BTreeSet<_>>();
        let undetermined = self
            .undetermined_release_ids
            .iter()
            .map(String::as_str)
            .collect::<std::collections::BTreeSet<_>>();
        let inconsistent = self
            .inconsistent_release_ids
            .iter()
            .map(String::as_str)
            .collect::<std::collections::BTreeSet<_>>();
        let classified_release_ids = compatible
            .iter()
            .chain(&undetermined)
            .chain(&inconsistent)
            .copied()
            .collect::<std::collections::BTreeSet<_>>();
        let has_unassessed_variant = self.resources.iter().any(|resource| {
            ambiguous_variant_resources.contains(&(
                self.identity.kind,
                self.identity.slug.as_str(),
                resource.relative_path.as_str(),
            ))
        });
        let collection_complete = self.candidate_resource_count == self.selected_resource_count
            && self.selected_resource_count == self.completely_interpreted_resource_count
            && !has_unassessed_variant;
        matches!(self.identity.kind, "plugin" | "theme")
            && crate::wordpress_review::valid_slug(&self.identity.slug)
            && self.release_count == self.releases.len()
            && self.release_count <= MAX_WORDPRESS_ASSET_FINGERPRINT_RELEASES_PER_COMPONENT
            && self.catalogue_component_listed != self.releases.is_empty()
            && self.candidate_resource_count
                == self
                    .selected_resource_count
                    .saturating_add(self.omitted_resource_count)
            && self.candidate_resource_count > 0
            && self.selected_resource_count > 0
            && self.selected_resource_count
                <= MAX_WORDPRESS_ASSET_FINGERPRINT_RESOURCES_PER_COMPONENT
            && self.completely_interpreted_resource_count <= self.selected_resource_count
            && self.completely_interpreted_resource_count <= self.resource_count
            && self.resource_count <= self.selected_resource_count
            && (collection_complete
                || (!self.listed_matrix_complete
                    && !matches!(
                        self.state,
                        "single_catalogue_candidate"
                            | "multiple_catalogue_candidates"
                            | "no_consistent_catalogue_release"
                            | "no_catalogue_byte_match"
                    )))
            && release_ids.len() == self.releases.len()
            && compatible.is_disjoint(&undetermined)
            && compatible.is_disjoint(&inconsistent)
            && undetermined.is_disjoint(&inconsistent)
            && classified_release_ids == release_ids
            && self.resource_count == self.resources.len()
            && self.resource_count <= MAX_WORDPRESS_ASSET_FINGERPRINT_RESOURCES_PER_COMPONENT
            && !(has_unassessed_variant
                && (self.listed_matrix_complete
                    || matches!(
                        self.state,
                        "single_catalogue_candidate" | "multiple_catalogue_candidates"
                    )))
            && self
                .resources
                .iter()
                .map(|resource| resource.relative_path.as_str())
                .collect::<std::collections::BTreeSet<_>>()
                .len()
                == self.resources.len()
            && self.resources.iter().all(|resource| {
                observed_resources.contains(&(
                    self.identity.kind,
                    self.identity.slug.as_str(),
                    resource.relative_path.as_str(),
                )) && resource.release_relation_count == resource.release_relations.len()
                    && resource.release_relations.len() == self.releases.len()
                    && resource
                        .release_relations
                        .iter()
                        .map(|relation| relation.release_id.as_str())
                        .collect::<std::collections::BTreeSet<_>>()
                        == release_ids
            })
            && self.informative_resource_count
                == self
                    .resources
                    .iter()
                    .filter(|resource| resource.informative)
                    .count()
            && self.releases.iter().all(|release| {
                let notice_ids = release
                    .source
                    .notice_ids
                    .iter()
                    .map(String::as_str)
                    .collect::<std::collections::BTreeSet<_>>();
                notice_ids.len() == release.source.notice_ids.len()
                    && notice_ids.iter().all(|id| {
                        catalogue
                            .provenance
                            .notices
                            .iter()
                            .any(|notice| notice.id == *id)
                    })
            })
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_asset_fingerprint_relation(
    relation: WordPressAssetFingerprintRelation,
) -> &'static str {
    match relation {
        WordPressAssetFingerprintRelation::Match => "match",
        WordPressAssetFingerprintRelation::Mismatch => "mismatch",
        WordPressAssetFingerprintRelation::Unknown => "unknown",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_asset_fingerprint_unknown_reason(
    reason: WordPressAssetFingerprintUnknownReason,
) -> &'static str {
    match reason {
        WordPressAssetFingerprintUnknownReason::MissingReference => "missing_reference",
        WordPressAssetFingerprintUnknownReason::ConflictingObservations => {
            "conflicting_observations"
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_asset_fingerprint_release_state(
    state: WordPressAssetFingerprintReleaseState,
) -> &'static str {
    match state {
        WordPressAssetFingerprintReleaseState::Compatible => "compatible",
        WordPressAssetFingerprintReleaseState::Inconsistent => "inconsistent",
        WordPressAssetFingerprintReleaseState::Undetermined => "undetermined",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_asset_fingerprint_aggregate_state(
    state: WordPressAssetFingerprintAggregateState,
) -> &'static str {
    match state {
        WordPressAssetFingerprintAggregateState::SingleCatalogueCandidate => {
            "single_catalogue_candidate"
        },
        WordPressAssetFingerprintAggregateState::MultipleCatalogueCandidates => {
            "multiple_catalogue_candidates"
        },
        WordPressAssetFingerprintAggregateState::ProvisionalCandidates => "provisional_candidates",
        WordPressAssetFingerprintAggregateState::NoConsistentCatalogueRelease => {
            "no_consistent_catalogue_release"
        },
        WordPressAssetFingerprintAggregateState::NoCatalogueByteMatch => "no_catalogue_byte_match",
        WordPressAssetFingerprintAggregateState::Undetermined => "undetermined",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
struct ValidatedWordPressPageCollection {
    accepted_page_references: std::collections::BTreeSet<String>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
struct ValidatedWordPressSuppliedSessionPageCollection {
    accepted_page_references: std::collections::BTreeSet<String>,
    form_login: bool,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressSuppliedSessionPageCollectionDocument {
    fn validate(&self) -> Result<ValidatedWordPressSuppliedSessionPageCollection, ReportError> {
        let mut page_references = std::collections::BTreeSet::new();
        let mut resource_references = std::collections::BTreeSet::new();
        let mut resource_evidence_references = std::collections::BTreeSet::new();
        let mut evidence_references = std::collections::BTreeSet::new();
        let mut accepted_page_references = std::collections::BTreeSet::new();
        let mut committed_count = 0_usize;
        let mut accepted_count = 0_usize;
        let mut rejected_count = 0_usize;
        let mut not_established_count = 0_usize;
        let mut not_evaluated_count = 0_usize;
        let mut interpreted_response_bytes = 0_u64;
        for page in &self.pages {
            if !page.is_valid()
                || !page_references.insert(page.page_reference.clone())
                || !resource_references.insert(page.resource_reference.clone())
                || page
                    .resource_evidence_reference
                    .as_ref()
                    .is_some_and(|reference| {
                        !resource_evidence_references.insert(reference.clone())
                    })
                || page
                    .evidence_references
                    .iter()
                    .any(|reference| !evidence_references.insert(reference.clone()))
            {
                return Err(ReportError::Serialization);
            }
            committed_count += usize::from(page.resource_evidence_reference.is_some());
            match page.association {
                "accepted" => {
                    accepted_count += 1;
                    accepted_page_references.insert(page.page_reference.clone());
                },
                "rejected" => rejected_count += 1,
                "not_established" => not_established_count += 1,
                _ => return Err(ReportError::Serialization),
            }
            not_evaluated_count += usize::from(matches!(
                page.outcome,
                "unsupported_content" | "invalid_utf8" | "not_evaluated"
            ));
            interpreted_response_bytes = interpreted_response_bytes
                .checked_add(page.interpreted_response_bytes)
                .ok_or(ReportError::Serialization)?;
        }
        let form_login = self.mode == "form_login_supplied_session_resources";
        if !matches!(
            self.mode,
            "committed_supplied_session_resources" | "form_login_supplied_session_resources"
        ) || !valid_wordpress_supplied_session_reference(
            &self.policy_reference,
            "supplied-session-policy-sha256:",
        ) || !valid_wordpress_supplied_session_reference(
            &self.application_reference,
            "supplied-session-application-sha256:",
        ) || self.principal_reference != "supplied-session-principal-0001"
            || !matches!(
                self.credential_mechanism,
                "authorization_header" | "cookie_jar"
            )
            || if form_login {
                self.session_epoch > 1
            } else {
                self.session_epoch != 1
            }
            || usize::from(self.selected_count) != self.pages.len()
            || self.pages.len() > MAX_WORDPRESS_SUPPLIED_SESSION_PAGE_AUDIT_COUNT
            || usize::from(self.committed_count) != committed_count
            || usize::from(self.accepted_association_count) != accepted_count
            || usize::from(self.rejected_association_count) != rejected_count
            || usize::from(self.not_established_association_count) != not_established_count
            || accepted_count
                .checked_add(rejected_count)
                .and_then(|count| count.checked_add(not_established_count))
                != Some(self.pages.len())
            || usize::from(self.not_evaluated_count) != not_evaluated_count
            || interpreted_response_bytes != self.interpreted_response_bytes
            || self.interpreted_response_bytes
                > MAX_WORDPRESS_SUPPLIED_SESSION_PAGE_AUDIT_INTERPRETED_BYTES
        {
            return Err(ReportError::Serialization);
        }
        if self.session_epoch == 0
            && (committed_count != 0
                || accepted_count != 0
                || rejected_count != 0
                || not_established_count != self.pages.len()
                || not_evaluated_count != self.pages.len()
                || interpreted_response_bytes != 0
                || self.pages.iter().any(|page| {
                    page.outcome != "not_evaluated"
                        || page.resource_evidence_reference.is_some()
                        || !page.evidence_references.is_empty()
                }))
        {
            return Err(ReportError::Serialization);
        }
        Ok(ValidatedWordPressSuppliedSessionPageCollection {
            accepted_page_references,
            form_login,
        })
    }

    #[cfg(feature = "supplied-session-review")]
    fn validate_against_supplied_session(
        &self,
        session: &AssessmentSuppliedSessionAuditDocument,
    ) -> Result<(), ReportError> {
        let form_login = self.mode == "form_login_supplied_session_resources";
        let acquisition_matches = if form_login {
            session.schema == "security.supplied-session-audit/v3"
                && self.credential_mechanism == "cookie_jar"
                && session.login.as_ref().map(|login| login.final_epoch) == Some(self.session_epoch)
        } else {
            matches!(
                session.schema,
                "security.supplied-session-audit/v1" | "security.supplied-session-audit/v2"
            ) && self.session_epoch == 1
        };
        if !acquisition_matches
            || self.policy_reference != session.policy_reference
            || self.application_reference != session.application_reference
            || self.principal_reference != session.principal_reference
            || self.credential_mechanism != session.credential_mechanism
            || usize::from(self.selected_count) != session.resources.len()
            || self.selected_count != session.selected_resource_count
            || self.committed_count != session.committed_resource_count
        {
            return Err(ReportError::Serialization);
        }
        let mut seen = std::collections::BTreeSet::new();
        for page in &self.pages {
            if !seen.insert(page.resource_reference.as_str()) {
                return Err(ReportError::Serialization);
            }
            let resource = session
                .resources
                .iter()
                .find(|resource| resource.resource_reference == page.resource_reference)
                .ok_or(ReportError::Serialization)?;
            let committed_evidence_reference = if resource.outcome == "committed" {
                resource.evidence_reference.as_deref()
            } else {
                None
            };
            let planned_before_session = form_login
                && self.session_epoch == 0
                && resource.epoch == 1
                && resource.outcome == "not_dispatched"
                && resource.status.is_none()
                && resource.response_bytes == 0;
            if (!planned_before_session && resource.epoch != self.session_epoch)
                || page.resource_evidence_reference.as_deref() != committed_evidence_reference
                || page.interpreted_response_bytes > resource.response_bytes
            {
                return Err(ReportError::Serialization);
            }
        }
        if seen.len() != session.resources.len() {
            return Err(ReportError::Serialization);
        }
        Ok(())
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressSuppliedSessionPageDocument {
    fn is_valid(&self) -> bool {
        let evidence_shape_valid = match self.association {
            "accepted" => self.outcome == "accepted" && self.evidence_reference_count == 1,
            "rejected" => {
                matches!(
                    self.outcome,
                    "incompatible_application" | "soft_404" | "login_response" | "truncated"
                ) && self.evidence_reference_count == 1
            },
            "not_established" => match self.outcome {
                "no_component_signals" => self.evidence_reference_count == 1,
                "unsupported_content" | "invalid_utf8" | "not_evaluated" => {
                    self.evidence_reference_count == 0 && self.interpreted_response_bytes == 0
                },
                _ => false,
            },
            _ => false,
        };
        valid_wordpress_discovery_reference(&self.page_reference)
            && valid_wordpress_supplied_session_reference(
                &self.resource_reference,
                "supplied-session-resource-sha256:",
            )
            && self
                .resource_evidence_reference
                .as_deref()
                .is_none_or(|reference| {
                    valid_wordpress_supplied_session_reference(
                        reference,
                        "supplied-session-resource-evidence-sha256:",
                    )
                })
            && self.acquisition == "reused_supplied_session_response"
            && evidence_shape_valid
            && self.interpreted_response_bytes <= 64 * 1024
            && self.evidence_reference_count == self.evidence_references.len()
            && self
                .evidence_references
                .windows(2)
                .all(|pair| pair[0] < pair[1])
            && self
                .evidence_references
                .iter()
                .all(|reference| valid_opaque_assessment_reference(reference, "evidence"))
            && match (self.resource_evidence_reference.as_ref(), self.outcome) {
                (None, "not_evaluated") => {
                    self.evidence_reference_count == 0 && self.interpreted_response_bytes == 0
                },
                (Some(_), outcome) => outcome != "not_evaluated",
                (None, _) => false,
            }
            && self.fingerprint_evaluation == "not_selected_in_v1"
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_wordpress_supplied_session_reference(value: &str, prefix: &str) -> bool {
    value.len() == prefix.len() + 64
        && value.starts_with(prefix)
        && value[prefix.len()..]
            .bytes()
            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressPageCollectionDocument {
    fn validate(&self) -> Result<ValidatedWordPressPageCollection, ReportError> {
        let attempted = self
            .pages
            .iter()
            .filter(|page| page.request_attempted)
            .count();
        let completed = self
            .pages
            .iter()
            .filter(|page| page.evidence_reference_count == 1)
            .count();
        let interpreted_bytes = self.pages.iter().try_fold(0_u64, |total, page| {
            total.checked_add(page.interpreted_response_bytes)
        });
        let response_bytes = self
            .pages
            .iter()
            .try_fold(0_u64, |total, page| total.checked_add(page.response_bytes));
        let mut page_references = std::collections::BTreeSet::new();
        let mut evidence_references = std::collections::BTreeSet::new();
        let mut accepted_page_references = std::collections::BTreeSet::new();
        for page in &self.pages {
            if !page.is_valid()
                || !page_references.insert(page.page_reference.clone())
                || page
                    .evidence_references
                    .iter()
                    .any(|reference| !evidence_references.insert(reference.clone()))
            {
                return Err(ReportError::Serialization);
            }
            if page.association == "accepted" {
                accepted_page_references.insert(page.page_reference.clone());
            }
        }
        let reused = self
            .pages
            .iter()
            .filter(|page| page.acquisition == "reused" && page.evidence_reference_count == 1)
            .count();
        let fetched = self
            .pages
            .iter()
            .filter(|page| page.acquisition == "fetched" && page.evidence_reference_count == 1)
            .count();
        let not_observed = self
            .pages
            .iter()
            .filter(|page| page.acquisition == "not_observed")
            .count();
        let rejected = self
            .pages
            .iter()
            .filter(|page| page.association == "rejected")
            .count();
        let accepted = self
            .pages
            .iter()
            .filter(|page| page.association == "accepted")
            .count();
        if !matches!(self.mode, "observed" | "linked")
            || !valid_wordpress_discovery_reference(&self.entry_page_reference)
            || self.candidate_count > MAX_WORDPRESS_PAGE_DISCOVERY_AUDIT_CANDIDATES
            || self.selected_count > MAX_WORDPRESS_PAGE_DISCOVERY_AUDIT_REQUESTS
            || u16::from(self.selected_count) > self.candidate_count
            || usize::from(self.selected_count) != self.pages.len()
            || self.candidate_count
                != u16::from(self.selected_count).saturating_add(self.omitted_candidate_count)
            || self.omitted_candidate_count > MAX_WORDPRESS_PAGE_DISCOVERY_AUDIT_CANDIDATES
            || self.reused_response_count as usize != reused
            || self.fetched_response_count as usize != fetched
            || self.not_observed_count as usize != not_observed
            || self.rejected_response_count as usize != rejected
            || self.accepted_association_count as usize != accepted
            || self.rejected_association_count as usize != rejected
            || self.attempted_request_count > MAX_WORDPRESS_PAGE_DISCOVERY_AUDIT_REQUESTS
            || self.attempted_request_count as usize != attempted
            || self.completed_response_count as usize != completed
            || self.committed_response_count != self.completed_response_count
            || interpreted_bytes != Some(self.interpreted_response_bytes)
            || response_bytes != Some(self.response_bytes)
            || self.interpreted_response_bytes
                > MAX_WORDPRESS_PAGE_DISCOVERY_AUDIT_INTERPRETED_BYTES
            || (self.mode == "observed"
                && (self.attempted_request_count != 0
                    || self.fetched_response_count != 0
                    || self.response_bytes != 0))
        {
            return Err(ReportError::Serialization);
        }
        Ok(ValidatedWordPressPageCollection {
            accepted_page_references,
        })
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressPageSourceDocument {
    fn is_valid(&self) -> bool {
        let acquisition_valid = matches!(self.acquisition, "reused" | "fetched" | "not_observed");
        let association_valid = matches!(
            self.association,
            "accepted" | "rejected" | "not_established"
        );
        let outcome_valid = matches!(
            self.outcome,
            "accepted"
                | "no_component_signals"
                | "not_observed"
                | "incompatible_application"
                | "soft_404"
                | "login_response"
                | "unsupported_content"
                | "malformed"
                | "truncated"
                | "request_failed"
                | "rate_limited"
                | "budget_exhausted"
                | "cancelled"
                | "deadline_exceeded"
        );
        valid_wordpress_discovery_reference(&self.page_reference)
            && acquisition_valid
            && association_valid
            && outcome_valid
            && self.interpreted_response_bytes <= 256 * 1024
            && self.evidence_reference_count <= 1
            && self.evidence_references.len() == self.evidence_reference_count
            && self
                .evidence_references
                .iter()
                .all(|reference| valid_opaque_assessment_reference(reference, "evidence"))
            && (self.evidence_reference_count == 1 || self.interpreted_response_bytes == 0)
            && (self.request_attempted || self.response_bytes == 0)
            && match self.acquisition {
                "reused" => {
                    !self.request_attempted
                        && self.response_bytes == 0
                        && self.evidence_reference_count == 1
                },
                "fetched" => self.request_attempted && self.evidence_reference_count == 1,
                "not_observed" => {
                    !self.request_attempted
                        && self.response_bytes == 0
                        && self.interpreted_response_bytes == 0
                        && self.evidence_reference_count == 0
                        && self.outcome == "not_observed"
                },
                _ => false,
            }
            && match self.association {
                "accepted" => self.outcome == "accepted" && self.evidence_reference_count == 1,
                "rejected" => {
                    !matches!(
                        self.outcome,
                        "accepted" | "no_component_signals" | "not_observed"
                    ) && self.evidence_reference_count == 1
                },
                "not_established" => {
                    matches!(self.outcome, "no_component_signals" | "not_observed")
                        && (self.outcome == "not_observed") != (self.evidence_reference_count == 1)
                },
                _ => false,
            }
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_discovery_matches_review(
    review: &AssessmentWordPressAuditDocument,
    discovery: &AssessmentWordPressDiscoveryAuditDocument,
) -> bool {
    for source in &discovery.sources {
        if !source.is_exact_role_bound_component(&discovery.layout) {
            continue;
        }
        let Some(source_component) = source.component.as_ref() else {
            return false;
        };
        let Some(review_component) = review.components.iter().find(|component| {
            component.identity.kind == source_component.kind
                && component.identity.slug == source_component.slug
        }) else {
            return false;
        };
        if !review_component
            .identity_sources
            .contains(&"same_origin_asset_path")
        {
            return false;
        }
    }

    let mut discovered = std::collections::BTreeMap::new();
    let mut required = std::collections::BTreeMap::new();
    for source in &discovery.sources {
        if source.kind != "theme_stylesheet" || !source.is_exact_theme_role_bound(&discovery.layout)
        {
            continue;
        }
        let Some(version) = source
            .theme
            .as_ref()
            .and_then(|theme| theme.version.as_deref())
        else {
            continue;
        };
        let Some(component) = source.component.as_ref() else {
            return false;
        };
        let key = (component.kind, component.slug.as_str());
        if source.outcome != "observed"
            || component.kind != "theme"
            || discovered.insert(key, version).is_some()
            || (source.parent_depth == 0 && required.insert(key, version).is_some())
        {
            return false;
        }
    }

    let mut reviewed = std::collections::BTreeMap::new();
    for component in &review.components {
        for version in &component.versions {
            if version.source != "theme_stylesheet_declaration" {
                continue;
            }
            if component.identity.kind != "theme"
                || reviewed
                    .insert(
                        (component.identity.kind, component.identity.slug.as_str()),
                        version.value.as_str(),
                    )
                    .is_some()
            {
                return false;
            }
        }
    }
    required
        .iter()
        .all(|(component, version)| reviewed.get(component) == Some(version))
        && reviewed
            .iter()
            .all(|(component, version)| discovered.get(component) == Some(version))
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressDiscoveryLayoutDocument {
    fn is_valid(&self) -> bool {
        const ROLES: [&str; 4] = ["core", "themes", "plugins", "rest_index"];
        valid_wordpress_discovery_reference(&self.application_reference)
            && self.declaration.as_ref().is_none_or(|declaration| {
                declaration.schema == WORDPRESS_DISCOVERY_LAYOUT_SCHEMA
                    && declaration.byte_length > 0
                    && declaration.byte_length <= MAX_WORDPRESS_DISCOVERY_LAYOUT_BYTES
                    && valid_lowercase_sha256(&declaration.sha256)
            })
            && self.roles.len() == ROLES.len()
            && self
                .roles
                .iter()
                .zip(ROLES)
                .all(|(role, expected)| role.role == expected && role.is_valid())
            && self.declaration.is_some()
                == self
                    .roles
                    .iter()
                    .any(|role| role.basis == "operator_declaration")
    }

    fn exact_role(&self, role: &str) -> Option<&WordPressDiscoveryLayoutRoleDocument> {
        self.roles
            .iter()
            .find(|entry| entry.role == role && entry.status == "exact")
    }

    fn exact_role_reference(&self, role: &str) -> Option<&str> {
        self.exact_role(role)
            .and_then(|entry| entry.reference.as_deref())
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressDiscoveryLayoutRoleDocument {
    fn is_valid(&self) -> bool {
        let role_valid = matches!(self.role, "core" | "themes" | "plugins" | "rest_index");
        let basis_valid = matches!(
            self.basis,
            "conventional_asset" | "structured_advertisement" | "operator_declaration" | "none"
        ) && match self.role {
            "rest_index" => matches!(
                self.basis,
                "structured_advertisement" | "operator_declaration" | "none"
            ),
            "core" | "themes" | "plugins" => matches!(
                self.basis,
                "conventional_asset" | "operator_declaration" | "none"
            ),
            _ => false,
        };
        role_valid
            && basis_valid
            && match self.status {
                "exact" => {
                    self.basis != "none"
                        && self.candidate_count > 0
                        && self
                            .reference
                            .as_deref()
                            .is_some_and(valid_wordpress_discovery_reference)
                },
                "ambiguous" => {
                    self.basis != "none" && self.candidate_count >= 2 && self.reference.is_none()
                },
                "unresolved" => {
                    self.basis == "none" && self.candidate_count == 0 && self.reference.is_none()
                },
                _ => false,
            }
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressDiscoverySourceDocument {
    fn is_valid(
        &self,
        layout: &WordPressDiscoveryLayoutDocument,
        accepted_page_references: Option<&std::collections::BTreeSet<String>>,
        entry_page_reference: Option<&str>,
        accepted_supplied_session_page_references: Option<&std::collections::BTreeSet<String>>,
        supplied_session_scoped: bool,
    ) -> bool {
        let component_valid = self.component.as_ref().is_none_or(|component| {
            matches!(component.kind, "core" | "plugin" | "theme")
                && crate::wordpress_review::valid_slug(&component.slug)
                && ((component.kind == "core") == (component.slug == "wordpress"))
        });
        let strings_valid = self
            .namespaces
            .iter()
            .all(|value| valid_wordpress_discovery_namespace(value))
            && self
                .theme
                .as_ref()
                .is_none_or(WordPressThemeDiscoveryDocument::is_valid)
            && self
                .plugin
                .as_ref()
                .is_none_or(WordPressPluginDiscoveryDocument::is_valid);
        let source_shape_valid = match self.kind {
            "rest_index" => {
                self.component.is_none()
                    && self.parent_depth == 0
                    && self.theme.is_none()
                    && self.plugin.is_none()
            },
            "theme_stylesheet" => {
                self.component
                    .as_ref()
                    .is_some_and(|component| component.kind == "theme")
                    && self.parent_depth <= 1
                    && self.namespaces.is_empty()
                    && self.plugin.is_none()
            },
            "plugin_readme" => {
                self.component
                    .as_ref()
                    .is_some_and(|component| component.kind == "plugin")
                    && self.parent_depth == 0
                    && self.namespaces.is_empty()
                    && self.theme.is_none()
            },
            _ => false,
        };
        let observed_shape_valid = match self.kind {
            "rest_index" => !self.namespaces.is_empty(),
            "theme_stylesheet" => self
                .theme
                .as_ref()
                .is_some_and(|metadata| metadata.name.is_some()),
            "plugin_readme" => self
                .plugin
                .as_ref()
                .is_some_and(|metadata| metadata.name.is_some()),
            _ => false,
        };
        let completed_response = matches!(
            self.outcome,
            "observed"
                | "no_metadata"
                | "not_found"
                | "unauthorized"
                | "rate_limited"
                | "redirect_observed"
                | "unsupported_content"
                | "malformed"
                | "truncated"
        );
        let outcome_valid = completed_response
            || matches!(
                self.outcome,
                "invalid_advertisement"
                    | "request_failed"
                    | "budget_exhausted"
                    | "cancelled"
                    | "deadline_exceeded"
                    | "not_selected_by_limit"
                    | "not_attempted_after_throttle"
            );
        let metadata_absent =
            self.namespaces.is_empty() && self.theme.is_none() && self.plugin.is_none();
        let definitely_not_dispatched = matches!(
            self.outcome,
            "invalid_advertisement" | "not_selected_by_limit" | "not_attempted_after_throttle"
        );
        let role = match self.kind {
            "rest_index" => "rest_index",
            "theme_stylesheet" => "themes",
            "plugin_readme" => "plugins",
            _ => return false,
        };
        let exact_role_bound = self.role_reference.as_deref().is_some_and(|reference| {
            layout.exact_role_reference(role) == Some(reference)
                && valid_wordpress_discovery_reference(reference)
        });
        let binding_required = self.request_attempted
            || completed_response
            || self.theme.is_some()
            || self.plugin.is_some()
            || !self.namespaces.is_empty();
        let association_valid = match self.association {
            "structured_advertisement" | "operator_qualified_advertisement" => {
                role == "rest_index"
                    && self.role_reference.is_some()
                    && layout.exact_role(role).is_some_and(|entry| {
                        entry.basis
                            == if self.association == "structured_advertisement" {
                                "structured_advertisement"
                            } else {
                                "operator_declaration"
                            }
                    })
            },
            "observed_conventional" | "explicit_operator" => {
                matches!(role, "themes" | "plugins")
                    && self.parent_depth == 0
                    && self.role_reference.is_some()
                    && layout.exact_role(role).is_some_and(|entry| {
                        entry.basis
                            == if self.association == "observed_conventional" {
                                "conventional_asset"
                            } else {
                                "operator_declaration"
                            }
                    })
            },
            "same_theme_base_parent" => {
                role == "themes" && self.parent_depth == 1 && self.role_reference.is_some()
            },
            "invalid_advertisement" => {
                role == "rest_index"
                    && self.outcome == "invalid_advertisement"
                    && self.role_reference.is_none()
            },
            _ => false,
        };
        let source_pages_valid = match (accepted_page_references, entry_page_reference) {
            (Some(accepted), Some(entry)) => {
                !self.source_page_references.is_empty()
                    && self.source_page_references.len() <= 4
                    && self
                        .source_page_references
                        .windows(2)
                        .all(|pair| pair[0] < pair[1])
                    && self.source_page_references.iter().all(|reference| {
                        valid_wordpress_discovery_reference(reference)
                            && (reference == entry || accepted.contains(reference))
                    })
            },
            (None, None) => self.source_page_references.is_empty(),
            _ => false,
        };
        let supplied_session_pages_valid = match (
            supplied_session_scoped,
            self.source_supplied_session_page_references.as_ref(),
            accepted_supplied_session_page_references,
        ) {
            (true, Some(references), Some(accepted)) => {
                references.len() <= MAX_WORDPRESS_SUPPLIED_SESSION_PAGE_AUDIT_COUNT
                    && references.windows(2).all(|pair| pair[0] < pair[1])
                    && references.iter().all(|reference| {
                        valid_wordpress_discovery_reference(reference)
                            && accepted.contains(reference)
                    })
            },
            (false, None, None) => true,
            _ => false,
        };
        component_valid
            && strings_valid
            && source_shape_valid
            && outcome_valid
            && source_pages_valid
            && supplied_session_pages_valid
            && valid_wordpress_discovery_reference(&self.resource_reference)
            && association_valid
            && ((!binding_required && self.role_reference.is_none()) || exact_role_bound)
            && self.evidence_reference_count == usize::from(completed_response)
            && self.evidence_references.len() == self.evidence_reference_count
            && self
                .evidence_references
                .iter()
                .all(|reference| valid_opaque_assessment_reference(reference, "evidence"))
            && (!completed_response || self.request_attempted)
            && (self.request_attempted || self.response_bytes == 0)
            && (!definitely_not_dispatched || !self.request_attempted)
            && (if self.outcome == "observed" {
                observed_shape_valid
            } else {
                metadata_absent
            })
            && self.namespaces.len() <= MAX_WORDPRESS_DISCOVERY_AUDIT_NAMESPACES
    }

    fn is_exact_role_bound_component(&self, layout: &WordPressDiscoveryLayoutDocument) -> bool {
        if self.parent_depth != 0 || !matches!(self.kind, "theme_stylesheet" | "plugin_readme") {
            return false;
        }
        let role = if self.kind == "theme_stylesheet" {
            "themes"
        } else {
            "plugins"
        };
        self.role_reference
            .as_deref()
            .is_some_and(|reference| layout.exact_role_reference(role) == Some(reference))
    }

    fn is_exact_theme_role_bound(&self, layout: &WordPressDiscoveryLayoutDocument) -> bool {
        self.kind == "theme_stylesheet"
            && self.parent_depth <= 1
            && self
                .role_reference
                .as_deref()
                .is_some_and(|reference| layout.exact_role_reference("themes") == Some(reference))
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_wordpress_discovery_reference(value: &str) -> bool {
    valid_prefixed_lowercase_sha256(value, "sha256:")
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressThemeDiscoveryDocument {
    fn is_valid(&self) -> bool {
        [
            self.name.as_deref(),
            self.template.as_deref(),
            self.requires_wordpress.as_deref(),
            self.requires_php.as_deref(),
            self.tested_up_to.as_deref(),
        ]
        .into_iter()
        .flatten()
        .all(valid_wordpress_discovery_metadata)
            && self
                .version
                .as_deref()
                .is_none_or(valid_wordpress_discovery_version)
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressPluginDiscoveryDocument {
    fn is_valid(&self) -> bool {
        [
            self.name.as_deref(),
            self.stable_tag.as_deref(),
            self.requires_wordpress.as_deref(),
            self.requires_php.as_deref(),
            self.tested_up_to.as_deref(),
        ]
        .into_iter()
        .flatten()
        .all(valid_wordpress_discovery_metadata)
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_wordpress_discovery_metadata(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= MAX_WORDPRESS_DISCOVERY_AUDIT_METADATA_BYTES
        && !value.chars().any(char::is_control)
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_wordpress_discovery_version(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= MAX_WORDPRESS_DISCOVERY_AUDIT_VERSION_BYTES
        && !value.chars().any(char::is_control)
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_wordpress_discovery_namespace(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= MAX_WORDPRESS_DISCOVERY_AUDIT_NAMESPACE_BYTES
        && value.is_ascii()
        && !value.chars().any(char::is_control)
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_advisory_group(
    evaluation: &WordPressExternalEvaluationDocument,
) -> WordPressPresentationGroup {
    match evaluation.applicability {
        "version_match_under_selected_policy" => WordPressPresentationGroup::ReviewCandidate,
        "no_version_match_under_selected_policy" => WordPressPresentationGroup::Contradicted,
        _ => WordPressPresentationGroup::Limitation,
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_advisory_group(advisory: &WordPressAdvisoryDocument) -> WordPressPresentationGroup {
    match advisory.applicability {
        "candidate_match_on_declared_facts" => WordPressPresentationGroup::ReviewCandidate,
        "contradicted_by_declared_facts" => WordPressPresentationGroup::Contradicted,
        _ => WordPressPresentationGroup::Limitation,
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn advisory_has_source_guidance(advisory: &WordPressAdvisoryDocument) -> bool {
    !advisory.fixed_versions.is_empty() || advisory.remediation.is_some()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_evaluation_has_source_guidance(
    evaluation: &WordPressExternalEvaluationDocument,
) -> bool {
    evaluation.source_patched
        || !evaluation.source_patched_versions.is_empty()
        || !evaluation.source_remediation.is_empty()
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
struct WordPressExternalComponentValidation<'a> {
    component: &'a WordPressComponentDocument,
    evidence_status: &'static str,
    evidence_row_count: usize,
    distinct_spelling_count: usize,
    semantic_status: Option<&'static str>,
    semantic_reason: Option<&'static str>,
    selected_version: Option<crate::wordpress_version::ProfiledVersionKey>,
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressExternalReviewDocument {
    fn external_collection_limit(&self) -> usize {
        const RESOURCE_V1_COLLECTION_LIMIT: usize = 64;
        if matches!(
            self.resource_policy,
            Some(WORDFENCE_V3_RESOURCE_POLICY_V2 | WORDFENCE_V3_RESOURCE_POLICY_V3)
        ) {
            crate::wordpress_review::MAX_WORDFENCE_V3_RANGES_PER_ASSOCIATION
        } else {
            RESOURCE_V1_COLLECTION_LIMIT
        }
    }

    fn external_description_limit(&self) -> usize {
        const RESOURCE_V1_DESCRIPTION_LIMIT: usize = 2_048;
        const RESOURCE_V2_DESCRIPTION_LIMIT: usize = 4_096;
        if matches!(
            self.resource_policy,
            Some(WORDFENCE_V3_RESOURCE_POLICY_V2 | WORDFENCE_V3_RESOURCE_POLICY_V3)
        ) {
            RESOURCE_V2_DESCRIPTION_LIMIT
        } else {
            RESOURCE_V1_DESCRIPTION_LIMIT
        }
    }

    fn accounted_retained_limit(&self) -> usize {
        const RESOURCE_V1_RETAINED_INDEX_LIMIT: usize = 64 * 1_024 * 1_024;
        const RESOURCE_V2_RETAINED_INDEX_LIMIT: usize = 128 * 1_024 * 1_024;
        match self.resource_policy {
            Some(WORDFENCE_V3_RESOURCE_POLICY_V3) => {
                crate::wordpress_review::MAX_WORDFENCE_V3_RETAINED_BYTES
            },
            Some(WORDFENCE_V3_RESOURCE_POLICY_V2) => RESOURCE_V2_RETAINED_INDEX_LIMIT,
            _ => RESOURCE_V1_RETAINED_INDEX_LIMIT,
        }
    }

    fn source_identity_contract_is_valid(&self, source_identity: bool) -> bool {
        let identity_counts = [
            self.counts.exact_identity_associations,
            self.counts.candidate_identity_associations,
            self.counts.ambiguous_identity_associations,
            self.counts.unresolved_identity_associations,
        ];
        if !source_identity {
            return self.mapping_revision == WORDFENCE_V3_MAPPING_REVISION
                && self.identity_mapping_policy.is_none()
                && self.identity_source_assurance.is_none()
                && self.resource_policy.is_none()
                && self.input.accounted_retained_bytes.is_none()
                && self.counts.mapped_unselected_associations.is_none()
                && self.counts.projected_identity_limitations.is_none()
                && self.counts.unprojected_identity_limitations.is_none()
                && identity_counts.iter().all(Option::is_none)
                && self.evaluations.iter().all(|evaluation| {
                    evaluation.identity_mapping.is_none()
                        && evaluation.identity_collision_raw_count.is_none()
                        && evaluation.key.source_component.is_none()
                        && evaluation.key.source_association_fingerprint.is_none()
                })
                && self.identity_limitations.is_none();
        }

        let [Some(exact), Some(candidate), Some(ambiguous), Some(unresolved)] = identity_counts
        else {
            return false;
        };
        let mapping_revision_is_valid = match self.mapping_revision {
            WORDFENCE_V3_MAPPING_REVISION => candidate == 0 && ambiguous == 0 && unresolved == 0,
            WORDFENCE_V3_MAPPING_REVISION_V2 => candidate != 0 || ambiguous != 0 || unresolved != 0,
            _ => false,
        };
        let resource_policy_is_valid = matches!(
            self.resource_policy,
            Some(
                WORDFENCE_V3_RESOURCE_POLICY_V1
                    | WORDFENCE_V3_RESOURCE_POLICY_V2
                    | WORDFENCE_V3_RESOURCE_POLICY_V3
            )
        );
        let v6_is_required = self.mapping_revision == WORDFENCE_V3_MAPPING_REVISION_V2
            || self.resource_policy != Some(WORDFENCE_V3_RESOURCE_POLICY_V1);
        let limitations_match = match (
            self.counts.projected_identity_limitations,
            self.counts.unprojected_identity_limitations,
            self.identity_limitations.as_ref(),
        ) {
            (Some(projected), Some(unprojected), Some(limitations)) => {
                projected == limitations.len()
                    && projected <= MAX_WORDPRESS_EXTERNAL_IDENTITY_LIMITATION_PROJECTIONS
                    && projected.checked_add(unprojected) == Some(unresolved)
            },
            _ => false,
        };
        let excluded_partition_matches = self
            .counts
            .mapped_unselected_associations
            .and_then(|mapped| mapped.checked_add(unresolved))
            == Some(self.counts.excluded_associations);
        mapping_revision_is_valid
            && self.identity_mapping_policy == Some(WORDFENCE_V3_IDENTITY_MAPPING_POLICY)
            && self.identity_source_assurance == Some("not_established")
            && resource_policy_is_valid
            && v6_is_required
            && limitations_match
            && excluded_partition_matches
            && self.input.accounted_retained_bytes.is_some()
            && exact
                .checked_add(candidate)
                .and_then(|count| count.checked_add(ambiguous))
                .and_then(|count| count.checked_add(unresolved))
                == Some(self.counts.software_associations)
    }

    fn is_valid(
        &self,
        components: &[WordPressComponentDocument],
        explicit: bool,
        source_identity: bool,
    ) -> bool {
        let selected_profile = match (
            explicit,
            self.comparison_profile,
            self.policy_selection,
            self.source_semantics_assurance,
        ) {
            (false, None, None, None) => None,
            (
                true,
                Some(profile @ ("numeric-dotted/v1" | "php-release-subset/v1")),
                Some("explicit_operator"),
                Some("not_established"),
            ) => Some(profile),
            _ => return false,
        };
        if self.source_namespace != "wordfence-intelligence"
            || self.source_format != "wordfence-v3-production"
            || !self.source_identity_contract_is_valid(source_identity)
            || (!explicit
                && self.comparison_policy
                    != WordPressExternalComparisonPolicy::WordfenceV3SourceSemanticsUnresolvedV1
                        .id())
            || (explicit
                && self.comparison_policy
                    != WordPressExternalComparisonPolicy::TermivarWordfenceV3ExplicitInterpretationV1
                        .id())
            || self.input.byte_length == 0
            || self.input.byte_length
                > crate::wordpress_review::MAX_WORDFENCE_V3_PRODUCTION_BYTES as u64
            || !valid_lowercase_sha256(&self.input.sha256)
            || !valid_lowercase_sha256(&self.input.semantic_sha256)
            || self
                .input
                .accounted_retained_bytes
                .is_some_and(|bytes| bytes == 0 || bytes > self.accounted_retained_limit())
            || self.counts.parsed_records > crate::wordpress_review::MAX_WORDFENCE_V3_RECORDS
            || self.counts.software_associations
                > crate::wordpress_review::MAX_WORDFENCE_V3_SOFTWARE_ASSOCIATIONS
            || self.counts.selected_associations != self.evaluations.len()
            || self.counts.selected_associations > MAX_WORDPRESS_ADVISORY_RECORDS
            || self.notices.len() > MAX_WORDPRESS_ADVISORY_RECORDS
            || !wordpress_external_source_counts_are_valid(
                self.counts.parsed_records,
                self.counts.software_associations,
            )
            || self
                .counts
                .selected_associations
                .checked_add(self.counts.excluded_associations)
                != Some(self.counts.software_associations)
            || self
                .counts
                .evaluable_associations
                .checked_add(self.counts.unsupported_associations)
                != Some(self.counts.selected_associations)
            || !self.counts.is_valid(explicit)
        {
            return false;
        }

        let mut notices_by_id = std::collections::BTreeMap::new();
        let notices_are_valid = self.notices.iter().all(|notice| {
            valid_prefixed_lowercase_sha256(&notice.id, "wordfence-notice-sha256:")
                && notices_by_id.insert(notice.id.as_str(), notice).is_none()
        });
        if !notices_are_valid || !self.notices.windows(2).all(|pair| pair[0].id < pair[1].id) {
            return false;
        }

        let mut resolution_work = 0_usize;
        let mut component_validations = std::collections::BTreeMap::new();
        for component in components {
            if selected_profile.is_some() {
                let Some(next_work) = resolution_work.checked_add(component.versions.len()) else {
                    return false;
                };
                resolution_work = next_work;
                if resolution_work > crate::wordpress_review::MAX_WORDPRESS_VERSION_RESOLUTION_WORK
                {
                    return false;
                }
            }
            let Some(validation) = external_component_validation(component, selected_profile)
            else {
                return false;
            };
            if component_validations
                .insert(
                    (component.identity.kind, component.identity.slug.as_str()),
                    validation,
                )
                .is_some()
            {
                return false;
            }
        }

        let mut evaluation_ids = std::collections::BTreeSet::new();
        let mut source_association_base_ids = std::collections::BTreeSet::new();
        let mut referenced_notices = std::collections::BTreeSet::new();
        let mut interpretation_work = 0_usize;
        let mut selected_identity_counts = [0_usize; 3];
        let collection_limit = self.external_collection_limit();
        let description_limit = self.external_description_limit();
        let expanded_source_values = matches!(
            self.resource_policy,
            Some(WORDFENCE_V3_RESOURCE_POLICY_V2 | WORDFENCE_V3_RESOURCE_POLICY_V3)
        );
        let evaluations_are_valid = self.evaluations.iter().all(|evaluation| {
            let Some(profiled_validation) = component_validations.get(&(
                evaluation.key.component.kind,
                evaluation.key.component.slug.as_str(),
            )) else {
                return false;
            };
            let Some(identity_mapping) =
                external_identity_mapping_is_valid(evaluation, source_identity)
            else {
                return false;
            };
            if evaluation
                .identity_collision_raw_count
                .is_some_and(|count| count > self.counts.software_associations)
            {
                return false;
            }
            selected_identity_counts[match identity_mapping {
                WordfenceV3IdentityMapping::Exact => 0,
                WordfenceV3IdentityMapping::AsciiCaseFoldCandidate => 1,
                WordfenceV3IdentityMapping::AsciiCaseFoldAmbiguous => 2,
            }] += 1;
            let unprofiled_validation;
            let validation = if explicit && identity_mapping != WordfenceV3IdentityMapping::Exact {
                unprofiled_validation =
                    external_component_validation(profiled_validation.component, None);
                let Some(validation) = unprofiled_validation.as_ref() else {
                    return false;
                };
                validation
            } else {
                profiled_validation
            };
            let component = validation.component;
            if explicit && identity_mapping == WordfenceV3IdentityMapping::Exact {
                let Some(next_work) =
                    crate::wordpress_version::checked_accumulate_external_interpretation_work(
                        interpretation_work,
                        evaluation.affected_ranges.len(),
                        evaluation.source_patched_versions.len(),
                        crate::wordpress_review::MAX_WORDPRESS_EVALUATION_WORK,
                    )
                else {
                    return false;
                };
                interpretation_work = next_work;
            } else if explicit {
                let Some(next_work) =
                    interpretation_work.checked_add(evaluation.affected_ranges.len())
                else {
                    return false;
                };
                interpretation_work = next_work;
                if interpretation_work > crate::wordpress_review::MAX_WORDPRESS_EVALUATION_WORK {
                    return false;
                }
            }
            let source_kind = evaluation
                .key
                .source_component
                .as_ref()
                .map_or(evaluation.key.component.kind, |source| source.kind);
            let source_slug = evaluation
                .key
                .source_component
                .as_ref()
                .map_or(evaluation.key.component.slug.as_str(), |source| {
                    source.slug.as_str()
                });
            let identity = (
                evaluation.key.source_namespace.as_str(),
                evaluation.key.upstream_id.as_str(),
                evaluation.key.component.kind,
                evaluation.key.component.slug.as_str(),
                source_kind,
                source_slug,
                evaluation.key.source_association_fingerprint.as_deref(),
            );
            let source_association_base_is_unique = source_association_base_ids.insert((
                evaluation.key.source_namespace.as_str(),
                evaluation.key.upstream_id.as_str(),
                source_kind,
                source_slug,
            ));
            let mut local_notices = std::collections::BTreeSet::new();
            let evaluation_notices_are_valid = evaluation.notice_ids.iter().all(|id| {
                if notices_by_id.contains_key(id.as_str()) && local_notices.insert(id.as_str()) {
                    referenced_notices.insert(id.clone());
                    true
                } else {
                    false
                }
            });
            let has_defiant_notice = evaluation.notice_ids.iter().any(|id| {
                notices_by_id
                    .get(id.as_str())
                    .is_some_and(|notice| notice.party == "defiant")
            });
            let expected_record_reference =
                wordpress_external_record_reference(&evaluation.references);
            let validated_version = external_version_evidence_resolution_is_valid(
                &evaluation.version_evidence_resolution,
                validation,
            );
            evaluation.key.source_namespace == self.source_namespace
                && valid_lowercase_uuid(&evaluation.key.upstream_id)
                && evaluation_ids.insert(identity)
                && (expanded_source_values || source_association_base_is_unique)
                && component.evidence_class == evaluation.component_evidence
                && (!source_identity
                    || evaluation
                        .key
                        .source_association_fingerprint
                        .as_deref()
                        .is_some_and(|fingerprint| {
                            valid_prefixed_lowercase_sha256(
                                fingerprint,
                                "wordfence-source-association-sha256:",
                            )
                        }))
                && validated_version.is_some()
                && evaluation.references.len()
                    <= crate::wordpress_review::MAX_WORDFENCE_V3_REFERENCES
                && external_researchers_are_valid(&evaluation.researchers, expanded_source_values)
                && evaluation.description.len() <= description_limit
                && evaluation
                    .cwe
                    .as_ref()
                    .is_none_or(|cwe| cwe.description.len() <= description_limit)
                && evaluation.affected_ranges.len() <= collection_limit
                && evaluation.source_patched_versions.len() <= collection_limit
                && external_source_versions_are_valid(
                    &evaluation.source_patched_versions,
                    expanded_source_values,
                )
                && evaluation.notice_ids.len()
                    <= crate::wordpress_review::MAX_WORDFENCE_V3_NOTICE_PARTIES
                && evaluation_notices_are_valid
                && evaluation.record_reference.as_deref() == expected_record_reference
                && (!has_defiant_notice
                    || evaluation
                        .record_reference
                        .as_deref()
                        .is_some_and(is_wordfence_vulnerability_reference))
                && (evaluation.cve_link.is_none() || evaluation.cve.is_some())
                && evaluation
                    .affected_ranges
                    .iter()
                    .all(|range| range.is_valid(expanded_source_values))
                && external_range_labels_are_unique(&evaluation.affected_ranges)
                && evaluation.is_valid_interpretation(
                    explicit,
                    selected_profile,
                    validated_version.flatten(),
                    identity_mapping,
                )
                && evaluation.execution.exploit_execution == "not_performed"
                && evaluation.execution.impact_validation == "not_performed"
        });
        let mut limitation_ids = std::collections::BTreeSet::new();
        let limitations_are_valid = if source_identity {
            self.identity_limitations
                .as_ref()
                .is_some_and(|limitations| {
                    limitations.iter().all(|limitation| {
                        let source_association_base_is_unique =
                            source_association_base_ids.insert((
                                limitation.key.source_namespace,
                                limitation.key.upstream_id.as_str(),
                                limitation.key.source_component.kind,
                                limitation.key.source_component.slug.as_str(),
                            ));
                        limitation.is_valid(
                            self.source_namespace,
                            &notices_by_id,
                            &mut referenced_notices,
                            collection_limit,
                            expanded_source_values,
                        ) && (expanded_source_values || source_association_base_is_unique)
                            && limitation_ids.insert((
                                limitation.key.source_namespace,
                                limitation.key.upstream_id.as_str(),
                                limitation.key.source_component.kind,
                                limitation.key.source_component.slug.as_str(),
                                limitation.key.source_association_fingerprint.as_str(),
                            ))
                    }) && limitations.windows(2).all(|pair| {
                        (
                            pair[0].key.source_namespace,
                            pair[0].key.upstream_id.as_str(),
                            pair[0].key.source_component.kind,
                            pair[0].key.source_component.slug.as_str(),
                            pair[0].key.source_association_fingerprint.as_str(),
                        ) < (
                            pair[1].key.source_namespace,
                            pair[1].key.upstream_id.as_str(),
                            pair[1].key.source_component.kind,
                            pair[1].key.source_component.slug.as_str(),
                            pair[1].key.source_association_fingerprint.as_str(),
                        )
                    })
                })
        } else {
            self.identity_limitations.is_none()
        };
        evaluations_are_valid
            && limitations_are_valid
            && self
                .counts
                .selected_identity_counts_are_valid(selected_identity_counts)
            && self.counts.matches_evaluations(&self.evaluations, explicit)
            && referenced_notices == notices_by_id.keys().map(|id| (*id).to_owned()).collect()
            && self.evaluations.windows(2).all(|pair| {
                (
                    pair[0].key.source_namespace.as_str(),
                    pair[0].key.upstream_id.as_str(),
                    pair[0].key.component.kind,
                    pair[0].key.component.slug.as_str(),
                    pair[0]
                        .key
                        .source_component
                        .as_ref()
                        .map_or(pair[0].key.component.kind, |source| source.kind),
                    pair[0]
                        .key
                        .source_component
                        .as_ref()
                        .map_or(pair[0].key.component.slug.as_str(), |source| {
                            source.slug.as_str()
                        }),
                    pair[0].key.source_association_fingerprint.as_deref(),
                ) < (
                    pair[1].key.source_namespace.as_str(),
                    pair[1].key.upstream_id.as_str(),
                    pair[1].key.component.kind,
                    pair[1].key.component.slug.as_str(),
                    pair[1]
                        .key
                        .source_component
                        .as_ref()
                        .map_or(pair[1].key.component.kind, |source| source.kind),
                    pair[1]
                        .key
                        .source_component
                        .as_ref()
                        .map_or(pair[1].key.component.slug.as_str(), |source| {
                            source.slug.as_str()
                        }),
                    pair[1].key.source_association_fingerprint.as_deref(),
                )
            })
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressExternalIdentityLimitationDocument {
    fn is_valid(
        &self,
        namespace: &str,
        notices: &std::collections::BTreeMap<&str, &WordPressExternalNoticeDocument>,
        referenced_notices: &mut std::collections::BTreeSet<String>,
        collection_limit: usize,
        expanded_source_values: bool,
    ) -> bool {
        let expected_record_reference = wordpress_external_record_reference(&self.references);
        let mut local_notices = std::collections::BTreeSet::new();
        let notice_ids_are_valid = self.notice_ids.iter().all(|id| {
            if notices.contains_key(id.as_str()) && local_notices.insert(id.as_str()) {
                referenced_notices.insert(id.clone());
                true
            } else {
                false
            }
        });
        let has_defiant_notice = self.notice_ids.iter().any(|id| {
            notices
                .get(id.as_str())
                .is_some_and(|notice| notice.party == "defiant")
        });
        self.key.source_namespace == namespace
            && valid_lowercase_uuid(&self.key.upstream_id)
            && valid_prefixed_lowercase_sha256(
                &self.key.source_association_fingerprint,
                "wordfence-source-association-sha256:",
            )
            && valid_wordfence_raw_source_identity(&self.key.source_component)
            && !wordfence_raw_source_identity_can_map(&self.key.source_component)
            && self.identity_resolution == "canonical_identity_unavailable"
            && !self.title.is_empty()
            && self.title.len() <= 1_024
            && !self.display_name.is_empty()
            && self.display_name.len() <= 1_024
            && self.references.len() <= crate::wordpress_review::MAX_WORDFENCE_V3_REFERENCES
            && self.record_reference.as_deref() == expected_record_reference
            && (!has_defiant_notice
                || self
                    .record_reference
                    .as_deref()
                    .is_some_and(is_wordfence_vulnerability_reference))
            && self.affected_ranges.len() <= collection_limit
            && self
                .affected_ranges
                .iter()
                .all(|range| range.is_valid(expanded_source_values))
            && external_range_labels_are_unique(&self.affected_ranges)
            && self.range_evaluations.len() == self.affected_ranges.len()
            && self.range_evaluations.iter().all(|range| {
                range.relation == "not_evaluated"
                    && range.reason == "canonical_identity_unavailable"
            })
            && self.source_patched_versions.len() <= collection_limit
            && external_source_versions_are_valid(
                &self.source_patched_versions,
                expanded_source_values,
            )
            && self.source_remediation.len()
                <= crate::wordpress_review::MAX_WORDPRESS_REMEDIATION_BYTES
            && self.notice_ids.len() <= crate::wordpress_review::MAX_WORDFENCE_V3_NOTICE_PARTIES
            && notice_ids_are_valid
            && self.version_relation == "not_evaluated"
            && self.version_relation_reason == "canonical_identity_unavailable"
            && self.applicability == "indeterminate"
            && self.execution.exploit_execution == "not_performed"
            && self.execution.impact_validation == "not_performed"
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressExternalCountsDocument {
    fn selected_identity_counts_are_valid(&self, selected: [usize; 3]) -> bool {
        match (
            self.exact_identity_associations,
            self.candidate_identity_associations,
            self.ambiguous_identity_associations,
            self.unresolved_identity_associations,
        ) {
            (None, None, None, None) => {
                selected[0] == self.selected_associations && selected[1] == 0 && selected[2] == 0
            },
            (Some(exact), Some(candidate), Some(ambiguous), Some(_)) => {
                selected[0] <= exact
                    && selected[1] <= candidate
                    && selected[2] <= ambiguous
                    && selected
                        .iter()
                        .try_fold(0_usize, |total, count| total.checked_add(*count))
                        == Some(self.selected_associations)
            },
            _ => false,
        }
    }

    fn is_valid(&self, explicit: bool) -> bool {
        let extended = [
            self.within_associations,
            self.outside_associations,
            self.indeterminate_associations,
            self.selected_ranges,
            self.evaluated_ranges,
            self.containing_ranges,
            self.noncontaining_ranges,
            self.unsupported_ranges,
            self.invalid_ranges,
            self.not_evaluated_ranges,
            self.partial_range_coverage_associations,
        ];
        if !explicit {
            return extended.iter().all(Option::is_none)
                && self.evaluable_associations == 0
                && self.unsupported_associations == self.selected_associations;
        }
        let [Some(within), Some(outside), Some(indeterminate), Some(selected_ranges), Some(evaluated_ranges), Some(containing), Some(noncontaining), Some(unsupported_ranges), Some(invalid_ranges), Some(not_evaluated_ranges), Some(partial)] =
            extended
        else {
            return false;
        };
        within
            .checked_add(outside)
            .is_some_and(|value| value == self.evaluable_associations)
            && self.unsupported_associations == indeterminate
            && self
                .evaluable_associations
                .checked_add(indeterminate)
                .is_some_and(|value| value == self.selected_associations)
            && containing
                .checked_add(noncontaining)
                .is_some_and(|value| value == evaluated_ranges)
            && evaluated_ranges
                .checked_add(unsupported_ranges)
                .and_then(|value| value.checked_add(invalid_ranges))
                .and_then(|value| value.checked_add(not_evaluated_ranges))
                .is_some_and(|value| value == selected_ranges)
            && partial <= within
    }

    fn matches_evaluations(
        &self,
        evaluations: &[WordPressExternalEvaluationDocument],
        explicit: bool,
    ) -> bool {
        if !explicit {
            return true;
        }
        let mut within = 0_usize;
        let mut outside = 0_usize;
        let mut indeterminate = 0_usize;
        let mut containing = 0_usize;
        let mut noncontaining = 0_usize;
        let mut unsupported = 0_usize;
        let mut invalid = 0_usize;
        let mut not_evaluated = 0_usize;
        let mut partial = 0_usize;
        for evaluation in evaluations {
            match evaluation.version_relation {
                "within_supported_range_under_selected_policy" => within += 1,
                "outside_declared_ranges_under_selected_policy" => outside += 1,
                "indeterminate" => indeterminate += 1,
                _ => return false,
            }
            if evaluation.version_relation_reason == Some("containing_range_with_partial_coverage")
            {
                partial += 1;
            }
            let Some(ranges) = &evaluation.range_evaluations else {
                return false;
            };
            for range in ranges {
                match range.relation {
                    "contains" => containing += 1,
                    "does_not_contain" => noncontaining += 1,
                    "unsupported" => unsupported += 1,
                    "invalid_under_profile" => invalid += 1,
                    "not_evaluated" => not_evaluated += 1,
                    _ => return false,
                }
            }
        }
        self.within_associations == Some(within)
            && self.outside_associations == Some(outside)
            && self.indeterminate_associations == Some(indeterminate)
            && self.selected_ranges
                == containing
                    .checked_add(noncontaining)
                    .and_then(|value| value.checked_add(unsupported))
                    .and_then(|value| value.checked_add(invalid))
                    .and_then(|value| value.checked_add(not_evaluated))
            && self.containing_ranges == Some(containing)
            && self.noncontaining_ranges == Some(noncontaining)
            && self.unsupported_ranges == Some(unsupported)
            && self.invalid_ranges == Some(invalid)
            && self.not_evaluated_ranges == Some(not_evaluated)
            && self.partial_range_coverage_associations == Some(partial)
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressExternalEvaluationDocument {
    fn is_valid_interpretation(
        &self,
        explicit: bool,
        selected_profile: Option<&str>,
        selected_version: Option<&crate::wordpress_version::ProfiledVersionKey>,
        identity_mapping: WordfenceV3IdentityMapping,
    ) -> bool {
        if !explicit {
            return self.range_evaluations.is_none()
                && self.version_relation == "source_comparison_semantics_unresolved"
                && self.version_relation_reason.is_none()
                && self.applicability == "indeterminate_unsupported";
        }
        let Some(ranges) = &self.range_evaluations else {
            return false;
        };
        if ranges.len() != self.affected_ranges.len()
            || !ranges
                .iter()
                .all(WordPressExternalRangeEvaluationDocument::is_valid)
        {
            return false;
        }
        let Some(profile) = selected_profile else {
            return false;
        };
        if identity_mapping != WordfenceV3IdentityMapping::Exact {
            let expected_reason = match identity_mapping {
                WordfenceV3IdentityMapping::Exact => return false,
                WordfenceV3IdentityMapping::AsciiCaseFoldCandidate => "identity_mapping_candidate",
                WordfenceV3IdentityMapping::AsciiCaseFoldAmbiguous => "identity_mapping_ambiguous",
            };
            return selected_version.is_none()
                && self.version_evidence_resolution.semantic_status.is_none()
                && self.version_evidence_resolution.semantic_reason.is_none()
                && ranges.iter().all(|range| {
                    range.relation == "not_evaluated" && range.reason == expected_reason
                })
                && self.version_relation == "indeterminate"
                && self.version_relation_reason == Some(expected_reason)
                && self.applicability == "indeterminate";
        }
        let semantic_status = self.version_evidence_resolution.semantic_status;
        if !ranges
            .iter()
            .zip(&self.affected_ranges)
            .all(|(rendered, source)| {
                expected_external_range_interpretation(
                    source,
                    profile,
                    semantic_status,
                    selected_version,
                ) == Some((rendered.relation, rendered.reason))
            })
        {
            return false;
        }
        let contains = ranges.iter().any(|range| range.relation == "contains");
        let unsupported = ranges.iter().any(|range| range.relation == "unsupported");
        let invalid = ranges
            .iter()
            .any(|range| range.relation == "invalid_under_profile");
        let source_patched_version_conflict = external_patched_version_conflicts(
            &self.source_patched_versions,
            &self.affected_ranges,
            profile,
        );
        let all_outside = !ranges.is_empty()
            && ranges
                .iter()
                .all(|range| range.relation == "does_not_contain");
        let semantic_status = self.version_evidence_resolution.semantic_status;
        match (
            self.version_relation,
            self.version_relation_reason,
            self.applicability,
        ) {
            (
                "within_supported_range_under_selected_policy",
                Some("containing_range"),
                "version_match_under_selected_policy",
            ) => {
                semantic_status == Some("supported_equivalent")
                    && contains
                    && !unsupported
                    && !invalid
                    && !source_patched_version_conflict
            },
            (
                "within_supported_range_under_selected_policy",
                Some("containing_range_with_partial_coverage"),
                "version_match_under_selected_policy",
            ) => {
                semantic_status == Some("supported_equivalent")
                    && contains
                    && unsupported
                    && !invalid
                    && !source_patched_version_conflict
            },
            (
                "outside_declared_ranges_under_selected_policy",
                Some("all_ranges_outside"),
                "no_version_match_under_selected_policy",
            ) => {
                semantic_status == Some("supported_equivalent")
                    && all_outside
                    && !source_patched_version_conflict
            },
            ("indeterminate", Some("invalid_affected_range"), "indeterminate") => invalid,
            (
                "indeterminate",
                Some("source_patched_version_within_affected_range"),
                "indeterminate",
            ) => !invalid && source_patched_version_conflict,
            ("indeterminate", Some("missing_version_evidence"), "indeterminate") => {
                semantic_status == Some("missing") && !invalid && !source_patched_version_conflict
            },
            ("indeterminate", Some("conflicting_version_evidence"), "indeterminate") => {
                semantic_status == Some("conflicting")
                    && !invalid
                    && !source_patched_version_conflict
            },
            ("indeterminate", Some("unsupported_version_evidence"), "indeterminate") => {
                semantic_status == Some("unsupported")
                    && !invalid
                    && !source_patched_version_conflict
            },
            ("indeterminate", Some("missing_affected_ranges"), "indeterminate") => {
                semantic_status == Some("supported_equivalent")
                    && ranges.is_empty()
                    && !source_patched_version_conflict
            },
            ("indeterminate", Some("unsupported_affected_range"), "indeterminate") => {
                semantic_status == Some("supported_equivalent")
                    && unsupported
                    && !contains
                    && !invalid
                    && !source_patched_version_conflict
            },
            _ => false,
        }
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressExternalRangeEvaluationDocument {
    fn is_valid(&self) -> bool {
        matches!(
            (self.relation, self.reason),
            ("contains", "selected_version_within_bounds")
                | ("does_not_contain", "selected_version_outside_bounds")
                | ("not_evaluated", "missing_version_evidence")
                | ("not_evaluated", "conflicting_version_evidence")
                | ("not_evaluated", "unsupported_version_evidence")
                | ("not_evaluated", "identity_mapping_candidate")
                | ("not_evaluated", "identity_mapping_ambiguous")
                | ("unsupported", "unsupported_lower_bound")
                | ("unsupported", "unsupported_upper_bound")
                | ("unsupported", "unsupported_both_bounds")
                | ("invalid_under_profile", "reversed_bounds")
                | ("invalid_under_profile", "empty_exclusive_interval")
        )
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_source_counts_are_valid(
    parsed_records: usize,
    software_associations: usize,
) -> bool {
    match parsed_records {
        0 => software_associations == 0,
        count => {
            software_associations >= count
                && count
                    .checked_mul(MAX_WORDFENCE_V3_SOFTWARE_PER_RECORD)
                    .is_some_and(|maximum| software_associations <= maximum)
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_version_evidence_resolution_is_valid<'a>(
    resolution: &WordPressExternalVersionEvidenceResolutionDocument,
    validation: &'a WordPressExternalComponentValidation<'_>,
) -> Option<Option<&'a crate::wordpress_version::ProfiledVersionKey>> {
    (resolution.evidence_row_count == validation.evidence_row_count
        && resolution.distinct_spelling_count == validation.distinct_spelling_count
        && resolution.status == validation.evidence_status
        && resolution.semantic_status == validation.semantic_status
        && resolution.semantic_reason == validation.semantic_reason)
        .then_some(validation.selected_version.as_ref())
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_component_validation<'a>(
    component: &'a WordPressComponentDocument,
    selected_profile: Option<&str>,
) -> Option<WordPressExternalComponentValidation<'a>> {
    let distinct_spelling_count = component
        .versions
        .iter()
        .map(|version| version.value.as_str())
        .collect::<std::collections::BTreeSet<_>>()
        .len();
    let evidence_row_count = component.versions.len();
    let evidence_status =
        wordpress_external_version_evidence_status(evidence_row_count, distinct_spelling_count)?;
    let (semantic_status, semantic_reason, selected_version) = match selected_profile {
        None => (None, None, None),
        Some(profile) => {
            let (status, reason, selected) = external_semantic_resolution(component, profile)?;
            (Some(status), Some(reason), selected)
        },
    };
    Some(WordPressExternalComponentValidation {
        component,
        evidence_status,
        evidence_row_count,
        distinct_spelling_count,
        semantic_status,
        semantic_reason,
        selected_version,
    })
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_semantic_resolution(
    component: &WordPressComponentDocument,
    profile: &str,
) -> Option<(
    &'static str,
    &'static str,
    Option<crate::wordpress_version::ProfiledVersionKey>,
)> {
    let profile = match profile {
        "numeric-dotted/v1" => WordPressComparisonProfile::NumericDottedV1,
        "php-release-subset/v1" => WordPressComparisonProfile::PhpReleaseSubsetV1,
        _ => return None,
    };
    if component.versions.is_empty() {
        return Some(("missing", "no_version_evidence", None));
    }
    let mut selected = None::<crate::wordpress_version::ProfiledVersionKey>;
    let mut conflicting = false;
    let mut unsupported = false;
    for evidence in &component.versions {
        match crate::wordpress_version::ProfiledVersionKey::parse(profile, &evidence.value) {
            Ok(version) => {
                if selected.as_ref().is_some_and(|selected| {
                    selected.compare(&version).ok() != Some(std::cmp::Ordering::Equal)
                }) {
                    conflicting = true;
                } else if selected.is_none() {
                    selected = Some(version);
                }
            },
            Err(_) => unsupported = true,
        }
    }
    if conflicting {
        Some(("conflicting", "conflicting_version_evidence", None))
    } else if unsupported || selected.is_none() {
        Some(("unsupported", "unsupported_version_evidence", None))
    } else if component.versions.len() == 1 {
        Some(("supported_equivalent", "single_supported_version", selected))
    } else {
        Some((
            "supported_equivalent",
            "equivalent_supported_versions",
            selected,
        ))
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn expected_external_range_interpretation(
    range: &WordPressExternalRangeDocument,
    profile: &str,
    semantic_status: Option<&str>,
    selected_version: Option<&crate::wordpress_version::ProfiledVersionKey>,
) -> Option<(&'static str, &'static str)> {
    let profile = match profile {
        "numeric-dotted/v1" => WordPressComparisonProfile::NumericDottedV1,
        "php-release-subset/v1" => WordPressComparisonProfile::PhpReleaseSubsetV1,
        _ => return None,
    };
    let lower = reporting_external_range_endpoint(
        range.from_kind,
        &range.from_version,
        range.from_inclusive,
        profile,
    );
    let upper = reporting_external_range_endpoint(
        range.to_kind,
        &range.to_version,
        range.to_inclusive,
        profile,
    );
    let (lower, upper) = match (lower, upper) {
        (Err(()), Err(())) => return Some(("unsupported", "unsupported_both_bounds")),
        (Err(()), Ok(_)) => return Some(("unsupported", "unsupported_lower_bound")),
        (Ok(_), Err(())) => return Some(("unsupported", "unsupported_upper_bound")),
        (Ok(lower), Ok(upper)) => (lower, upper),
    };
    if let (Some((lower, lower_inclusive)), Some((upper, upper_inclusive))) = (&lower, &upper) {
        match lower.compare(upper).ok()? {
            std::cmp::Ordering::Greater => {
                return Some(("invalid_under_profile", "reversed_bounds"));
            },
            std::cmp::Ordering::Equal if !(*lower_inclusive && *upper_inclusive) => {
                return Some(("invalid_under_profile", "empty_exclusive_interval"));
            },
            std::cmp::Ordering::Less | std::cmp::Ordering::Equal => {},
        }
    }
    let Some(selected) = selected_version else {
        return match semantic_status {
            Some("missing") => Some(("not_evaluated", "missing_version_evidence")),
            Some("conflicting") => Some(("not_evaluated", "conflicting_version_evidence")),
            Some("unsupported") => Some(("not_evaluated", "unsupported_version_evidence")),
            _ => None,
        };
    };
    if semantic_status != Some("supported_equivalent") {
        return None;
    }
    let above_lower = lower.as_ref().is_none_or(|(lower, inclusive)| {
        lower.compare(selected).ok().is_some_and(|ordering| {
            ordering == std::cmp::Ordering::Less
                || (ordering == std::cmp::Ordering::Equal && *inclusive)
        })
    });
    let below_upper = upper.as_ref().is_none_or(|(upper, inclusive)| {
        selected.compare(upper).ok().is_some_and(|ordering| {
            ordering == std::cmp::Ordering::Less
                || (ordering == std::cmp::Ordering::Equal && *inclusive)
        })
    });
    Some(if above_lower && below_upper {
        ("contains", "selected_version_within_bounds")
    } else {
        ("does_not_contain", "selected_version_outside_bounds")
    })
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn reporting_external_range_endpoint(
    kind: &str,
    value: &str,
    inclusive: bool,
    profile: WordPressComparisonProfile,
) -> Result<Option<(crate::wordpress_version::ProfiledVersionKey, bool)>, ()> {
    match kind {
        "any" if value == "*" => Ok(None),
        "declared" if value != "*" => {
            crate::wordpress_version::ProfiledVersionKey::parse(profile, value)
                .map(|version| Some((version, inclusive)))
                .map_err(|_| ())
        },
        _ => Err(()),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_patched_version_conflicts(
    patched_versions: &[String],
    ranges: &[WordPressExternalRangeDocument],
    profile: &str,
) -> bool {
    let profile = match profile {
        "numeric-dotted/v1" => WordPressComparisonProfile::NumericDottedV1,
        "php-release-subset/v1" => WordPressComparisonProfile::PhpReleaseSubsetV1,
        _ => return false,
    };
    patched_versions.iter().any(|declared| {
        crate::wordpress_version::ProfiledVersionKey::parse(profile, declared)
            .ok()
            .is_some_and(|version| {
                ranges.iter().any(|range| {
                    expected_external_range_interpretation(
                        range,
                        profile.id(),
                        Some("supported_equivalent"),
                        Some(&version),
                    )
                    .is_some_and(|(relation, _)| relation == "contains")
                })
            })
    })
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressExternalRangeDocument {
    fn is_valid(&self, expanded_source_values: bool) -> bool {
        external_range_value_is_valid(self.from_kind, &self.from_version, expanded_source_values)
            && external_range_value_is_valid(self.to_kind, &self.to_version, expanded_source_values)
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_range_labels_are_unique(ranges: &[WordPressExternalRangeDocument]) -> bool {
    let mut labels = std::collections::BTreeSet::new();
    ranges
        .iter()
        .all(|range| labels.insert(range.label.as_str()))
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_range_value_is_valid(kind: &str, value: &str, expanded_source_values: bool) -> bool {
    match kind {
        "any" => value == "*",
        "declared" => external_source_version_is_valid(value, expanded_source_values),
        _ => false,
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_source_versions_are_valid(values: &[String], expanded_source_values: bool) -> bool {
    let mut unique = std::collections::BTreeSet::new();
    values.iter().all(|value| {
        external_source_version_is_valid(value, expanded_source_values)
            && unique.insert(value.as_str())
    })
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_source_version_is_valid(value: &str, expanded_source_values: bool) -> bool {
    if !expanded_source_values {
        return valid_inventory_version(value) && value != "*";
    }
    !value.is_empty()
        && value.len() <= crate::wordpress_review::MAX_WORDPRESS_VERSION_BYTES
        && value != "*"
        && !value.chars().any(char::is_control)
        && !value.chars().next().is_some_and(char::is_whitespace)
        && !value.chars().next_back().is_some_and(char::is_whitespace)
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_researchers_are_valid(values: &[String], expanded_source_values: bool) -> bool {
    if values.len() > crate::wordpress_review::MAX_WORDFENCE_V3_RESEARCHERS {
        return false;
    }
    let mut unique = std::collections::BTreeSet::new();
    values.iter().all(|value| {
        !value.is_empty()
            && value.len() <= crate::wordpress_review::MAX_WORDFENCE_V3_RESEARCHER_BYTES
            && !value
                .chars()
                .any(|character| character.is_control() && !matches!(character, '\n' | '\r' | '\t'))
            && (expanded_source_values || unique.insert(value.as_str()))
    })
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_prefixed_lowercase_sha256(value: &str, prefix: &str) -> bool {
    value
        .strip_prefix(prefix)
        .is_some_and(valid_lowercase_sha256)
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_lowercase_uuid(value: &str) -> bool {
    value.len() == 36
        && value.bytes().enumerate().all(|(index, byte)| match index {
            8 | 13 | 18 | 23 => byte == b'-',
            _ => byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte),
        })
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressInventoryImportDocument {
    fn is_valid(&self, components: &[WordPressComponentDocument]) -> bool {
        let mut classes = std::collections::BTreeSet::new();
        let mut total_bytes = 0_usize;
        for input in &self.inputs {
            if !matches!(
                input.class,
                "wp_cli_plugins_json" | "wp_cli_themes_json" | "wp_cli_core_version_file"
            ) || !classes.insert(input.class)
                || input.byte_length == 0
                || (input.class == "wp_cli_core_version_file"
                    && input.byte_length > crate::wordpress_review::MAX_WORDPRESS_VERSION_BYTES + 2)
                || !valid_lowercase_sha256(&input.sha256)
            {
                return false;
            }
            let Some(next) = total_bytes.checked_add(input.byte_length) else {
                return false;
            };
            total_bytes = next;
        }
        let supplied = |class| classes.contains(class);
        if self.inputs.is_empty()
            || self.inputs.len() > 3
            || total_bytes > MAX_WORDPRESS_SAVED_INVENTORY_BYTES
            || (self.coverage.core == "supplied") != supplied("wp_cli_core_version_file")
            || (self.coverage.plugins == "supplied") != supplied("wp_cli_plugins_json")
            || (self.coverage.themes == "supplied") != supplied("wp_cli_themes_json")
            || !matches!(self.coverage.core, "supplied" | "not_supplied")
            || !matches!(self.coverage.plugins, "supplied" | "not_supplied")
            || !matches!(self.coverage.themes, "supplied" | "not_supplied")
        {
            return false;
        }

        let inventory_components = components
            .iter()
            .filter(|component| component.inventory_status.is_some())
            .count();
        if self.component_count != inventory_components
            || self
                .component_count
                .checked_add(self.limitations.len())
                .is_none_or(|count| {
                    count > crate::wordpress_review::MAX_WORDPRESS_CONTEXT_COMPONENTS
                })
            || components
                .iter()
                .any(|component| !component.inventory_status_is_valid(&self.coverage))
        {
            return false;
        }

        let mut limitations = std::collections::BTreeSet::new();
        self.limitations.iter().all(|limitation| {
            self.coverage.plugins == "supplied"
                && limitation.status == "drop_in"
                && limitation.reason == "drop_in_identity_is_not_catalog_slug"
                && valid_inventory_label(&limitation.declared_name)
                && limitation
                    .version
                    .as_deref()
                    .is_none_or(valid_inventory_version)
                && limitations.insert(limitation.declared_name.as_str())
        })
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressComponentDocument {
    fn inventory_status_is_valid(&self, coverage: &WordPressInventoryCoverageDocument) -> bool {
        let operator_supplied = self.identity_sources.contains(&"operator_context");
        let Some(status) = self.inventory_status else {
            return !operator_supplied;
        };
        if !operator_supplied {
            return false;
        }
        match status {
            "core_version_supplied" => {
                self.identity.kind == "core"
                    && self.identity.slug == "wordpress"
                    && self.activation.is_none()
                    && coverage.core == "supplied"
            },
            "active" => {
                ((self.identity.kind == "plugin" && coverage.plugins == "supplied")
                    || (self.identity.kind == "theme" && coverage.themes == "supplied"))
                    && self.activation == Some("active")
            },
            "inactive" => {
                ((self.identity.kind == "plugin" && coverage.plugins == "supplied")
                    || (self.identity.kind == "theme" && coverage.themes == "supplied"))
                    && self.activation == Some("inactive")
            },
            "active_network" => {
                self.identity.kind == "plugin"
                    && coverage.plugins == "supplied"
                    && self.activation == Some("network_active")
            },
            "must_use" => {
                self.identity.kind == "plugin"
                    && coverage.plugins == "supplied"
                    && self.activation.is_none()
            },
            "parent" => {
                self.identity.kind == "theme"
                    && coverage.themes == "supplied"
                    && self.activation.is_none()
            },
            _ => false,
        }
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_lowercase_sha256(value: &str) -> bool {
    value.len() == 64
        && value
            .bytes()
            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_inventory_label(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= crate::wordpress_review::MAX_WORDPRESS_SLUG_BYTES
        && !matches!(value, "." | "..")
        && value
            .bytes()
            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_inventory_version(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= crate::wordpress_review::MAX_WORDPRESS_VERSION_BYTES
        && !value
            .chars()
            .any(|character| character.is_whitespace() || character.is_control())
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
impl WordPressAdvisoryDocument {
    fn profile_fields_are_valid(&self, profiled: bool) -> bool {
        if !profiled {
            return self.comparison_profile.is_none()
                && self.version_resolution.is_none()
                && self.version_resolution_reason.is_none();
        }
        let Some(profile) = self.comparison_profile else {
            return false;
        };
        if !matches!(profile, "numeric-dotted/v1" | "php-release-subset/v1") {
            return false;
        }
        matches!(
            (self.version_resolution, self.version_resolution_reason),
            (Some("missing"), Some("no_version_evidence"))
                | (
                    Some("supported_equivalent"),
                    Some("single_supported_version" | "equivalent_supported_versions")
                )
                | (Some("conflicting"), Some("conflicting_version_evidence"))
                | (Some("unsupported"), Some("unsupported_version_evidence"))
        )
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_component_identity(
    identity: &crate::wordpress_review::WordPressComponentIdentity,
) -> WordPressComponentIdentityDocument {
    WordPressComponentIdentityDocument {
        kind: wordpress_component_kind(identity.kind()),
        slug: identity.slug().to_owned(),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_prerequisite(
    prerequisite: &WordPressPrerequisite,
    outcome: WordPressPrerequisiteOutcome,
) -> WordPressPrerequisiteDocument {
    let (kind, expected, patch_id) = match prerequisite {
        WordPressPrerequisite::HostingOs { equals } => {
            ("hosting_os", wordpress_hosting_os(*equals).to_owned(), None)
        },
        WordPressPrerequisite::Multisite { equals } => {
            ("multisite", wordpress_multisite(*equals).to_owned(), None)
        },
        WordPressPrerequisite::Activation { equals } => {
            ("activation", wordpress_activation(*equals).to_owned(), None)
        },
        WordPressPrerequisite::Patch { id, equals } => (
            "patch",
            wordpress_patch(*equals).to_owned(),
            Some(id.clone()),
        ),
        WordPressPrerequisite::Unsupported { name } => ("unsupported", name.clone(), None),
    };
    WordPressPrerequisiteDocument {
        kind,
        expected,
        patch_id,
        outcome: wordpress_prerequisite_outcome(outcome),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_component_kind(kind: WordPressComponentKind) -> &'static str {
    match kind {
        WordPressComponentKind::Core => "core",
        WordPressComponentKind::Plugin => "plugin",
        WordPressComponentKind::Theme => "theme",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_catalog_status(status: WordPressCatalogStatus) -> &'static str {
    match status {
        WordPressCatalogStatus::CatalogNotSupplied => "catalogue_not_supplied",
        WordPressCatalogStatus::Evaluated => "evaluated",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_evidence_source(source: WordPressEvidenceSource) -> &'static str {
    match source {
        WordPressEvidenceSource::GeneratorMetadata => "generator_metadata",
        WordPressEvidenceSource::SameOriginAssetPath => "same_origin_asset_path",
        WordPressEvidenceSource::ThemeStylesheetDeclaration => "theme_stylesheet_declaration",
        WordPressEvidenceSource::OperatorContext => "operator_context",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_confidence(confidence: WordPressEvidenceConfidence) -> &'static str {
    match confidence {
        WordPressEvidenceConfidence::PublicDeclaration => "public_declaration",
        WordPressEvidenceConfidence::StructuralHint => "structural_hint",
        WordPressEvidenceConfidence::OperatorAssertion => "operator_assertion",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_evidence_class(class: WordPressComponentEvidenceClass) -> &'static str {
    match class {
        WordPressComponentEvidenceClass::ObservedHint => "observed_hint",
        WordPressComponentEvidenceClass::OperatorSupplied => "operator_supplied",
        WordPressComponentEvidenceClass::Conflicting => "conflicting",
        WordPressComponentEvidenceClass::Unknown => "unknown",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_activation(state: WordPressActivationState) -> &'static str {
    match state {
        WordPressActivationState::Active => "active",
        WordPressActivationState::Inactive => "inactive",
        WordPressActivationState::NetworkActive => "network_active",
        WordPressActivationState::Unknown => "unknown",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_inventory_category_status(
    status: WordPressInventoryCategoryStatus,
) -> &'static str {
    match status {
        WordPressInventoryCategoryStatus::NotSupplied => "not_supplied",
        WordPressInventoryCategoryStatus::Supplied => "supplied",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_inventory_entry_status(status: WordPressInventoryEntryStatus) -> &'static str {
    match status {
        WordPressInventoryEntryStatus::CoreVersionSupplied => "core_version_supplied",
        WordPressInventoryEntryStatus::Active => "active",
        WordPressInventoryEntryStatus::Inactive => "inactive",
        WordPressInventoryEntryStatus::NetworkActive => "active_network",
        WordPressInventoryEntryStatus::MustUse => "must_use",
        WordPressInventoryEntryStatus::DropIn => "drop_in",
        WordPressInventoryEntryStatus::Parent => "parent",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_inventory_limitation_reason(
    reason: WordPressInventoryLimitationReason,
) -> &'static str {
    match reason {
        WordPressInventoryLimitationReason::DropInIdentityIsNotCatalogSlug => {
            "drop_in_identity_is_not_catalog_slug"
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_local_input_class(class: WordPressLocalInputClass) -> &'static str {
    match class {
        WordPressLocalInputClass::PluginsJson => "wp_cli_plugins_json",
        WordPressLocalInputClass::ThemesJson => "wp_cli_themes_json",
        WordPressLocalInputClass::CoreVersionFile => "wp_cli_core_version_file",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn lowercase_hex(bytes: &[u8]) -> String {
    const DIGITS: &[u8; 16] = b"0123456789abcdef";
    let mut encoded = String::with_capacity(bytes.len().saturating_mul(2));
    for byte in bytes {
        encoded.push(char::from(DIGITS[usize::from(byte >> 4)]));
        encoded.push(char::from(DIGITS[usize::from(byte & 0x0f)]));
    }
    encoded
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_review_document(
    review: &crate::wordpress_review::WordPressExternalReview,
) -> WordPressExternalReviewDocument {
    let counts = review.counts();
    let comparison_policy = wordpress_external_comparison_policy(review.comparison_policy());
    let explicit = review.comparison_profile().is_some();
    let source_identity = review.requires_audit_v6();
    WordPressExternalReviewDocument {
        source_namespace: review.source_namespace(),
        source_format: review.source_format(),
        mapping_revision: review.mapping_revision(),
        identity_mapping_policy: source_identity.then_some(review.identity_mapping_policy()),
        identity_source_assurance: source_identity.then_some(review.identity_source_assurance()),
        resource_policy: source_identity.then_some(review.resource_policy()),
        comparison_policy,
        comparison_profile: review
            .comparison_profile()
            .map(wordpress_comparison_profile),
        policy_selection: explicit.then_some("explicit_operator"),
        source_semantics_assurance: explicit.then_some("not_established"),
        input: WordPressExternalInputDocument {
            byte_length: review.byte_length(),
            sha256: lowercase_hex(review.sha256()),
            semantic_sha256: lowercase_hex(review.semantic_sha256()),
            accounted_retained_bytes: source_identity.then_some(review.retained_bytes()),
        },
        counts: WordPressExternalCountsDocument {
            parsed_records: counts.parsed_records(),
            software_associations: counts.software_associations(),
            exact_identity_associations: source_identity
                .then_some(counts.exact_identity_associations()),
            candidate_identity_associations: source_identity
                .then_some(counts.candidate_identity_associations()),
            ambiguous_identity_associations: source_identity
                .then_some(counts.ambiguous_identity_associations()),
            unresolved_identity_associations: source_identity
                .then_some(counts.unresolved_identity_associations()),
            projected_identity_limitations: source_identity
                .then_some(counts.projected_identity_limitations()),
            unprojected_identity_limitations: source_identity
                .then_some(counts.unprojected_identity_limitations()),
            selected_associations: counts.selected_associations(),
            evaluable_associations: counts.evaluable_associations(),
            unsupported_associations: counts.unsupported_associations(),
            excluded_associations: counts.excluded_associations(),
            mapped_unselected_associations: source_identity
                .then_some(counts.mapped_unselected_associations()),
            within_associations: explicit.then_some(counts.within_associations()),
            outside_associations: explicit.then_some(counts.outside_associations()),
            indeterminate_associations: explicit.then_some(counts.indeterminate_associations()),
            selected_ranges: explicit.then_some(counts.selected_ranges()),
            evaluated_ranges: explicit.then_some(counts.evaluated_ranges()),
            containing_ranges: explicit.then_some(counts.containing_ranges()),
            noncontaining_ranges: explicit.then_some(counts.noncontaining_ranges()),
            unsupported_ranges: explicit.then_some(counts.unsupported_ranges()),
            invalid_ranges: explicit.then_some(counts.invalid_ranges()),
            not_evaluated_ranges: explicit.then_some(counts.not_evaluated_ranges()),
            partial_range_coverage_associations: explicit
                .then_some(counts.partial_range_coverage_associations()),
        },
        notices: review
            .notices()
            .iter()
            .map(|notice| WordPressExternalNoticeDocument {
                id: notice.id().to_owned(),
                message: notice.message().to_owned(),
                party: notice.party().to_owned(),
                notice: notice.notice().to_owned(),
                license: notice.license().to_owned(),
                license_url: notice.license_url().to_owned(),
            })
            .collect(),
        evaluations: review
            .evaluations()
            .iter()
            .map(|evaluation| wordpress_external_evaluation_document(evaluation, source_identity))
            .collect(),
        identity_limitations: source_identity.then(|| {
            review
                .identity_limitations()
                .iter()
                .map(wordpress_external_identity_limitation_document)
                .collect()
        }),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_external_comparison_policy(
    policy: WordPressExternalComparisonPolicy,
) -> &'static str {
    match policy {
        WordPressExternalComparisonPolicy::WordfenceV3SourceSemanticsUnresolvedV1 => {
            "wordfence-v3/source-semantics-unresolved/v1"
        },
        WordPressExternalComparisonPolicy::TermivarWordfenceV3ExplicitInterpretationV1 => {
            "termivar.wordfence-v3-explicit-interpretation/v1"
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn external_identity_mapping_is_valid(
    evaluation: &WordPressExternalEvaluationDocument,
    source_identity: bool,
) -> Option<WordfenceV3IdentityMapping> {
    if !source_identity {
        return (evaluation.identity_mapping.is_none()
            && evaluation.identity_collision_raw_count.is_none()
            && evaluation.key.source_component.is_none())
        .then_some(WordfenceV3IdentityMapping::Exact);
    }

    let source = evaluation.key.source_component.as_ref()?;
    if !valid_wordfence_source_identity(source) {
        return None;
    }
    let mapping = match evaluation.identity_mapping? {
        "exact" => WordfenceV3IdentityMapping::Exact,
        "ascii_case_fold_candidate" => WordfenceV3IdentityMapping::AsciiCaseFoldCandidate,
        "ascii_case_fold_ambiguous" => WordfenceV3IdentityMapping::AsciiCaseFoldAmbiguous,
        _ => return None,
    };
    let canonical = &evaluation.key.component;
    let same_kind = source.kind == canonical.kind;
    let exact = same_kind && source.slug == canonical.slug;
    let case_fold = same_kind
        && source.slug != canonical.slug
        && source.slug.eq_ignore_ascii_case(&canonical.slug);
    match mapping {
        WordfenceV3IdentityMapping::Exact => {
            (exact && evaluation.identity_collision_raw_count.is_none()).then_some(mapping)
        },
        WordfenceV3IdentityMapping::AsciiCaseFoldCandidate => {
            (case_fold && evaluation.identity_collision_raw_count.is_none()).then_some(mapping)
        },
        WordfenceV3IdentityMapping::AsciiCaseFoldAmbiguous => evaluation
            .identity_collision_raw_count
            .is_some_and(|count| count >= 2)
            .then_some(mapping)
            .filter(|_| case_fold),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_wordfence_source_identity(
    identity: &WordPressExternalSourceComponentIdentityDocument,
) -> bool {
    const MAX_SOURCE_SLUG_BYTES: usize = 128;
    matches!(identity.kind, "core" | "plugin" | "theme")
        && !identity.slug.is_empty()
        && identity.slug.len() <= MAX_SOURCE_SLUG_BYTES
        && !identity.slug.starts_with('-')
        && !identity.slug.ends_with('-')
        && !identity.slug.contains("--")
        && identity
            .slug
            .bytes()
            .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn valid_wordfence_raw_source_identity(
    identity: &WordPressExternalSourceComponentIdentityDocument,
) -> bool {
    const MAX_SOURCE_SLUG_BYTES: usize = 128;
    matches!(identity.kind, "core" | "plugin" | "theme")
        && !identity.slug.is_empty()
        && identity.slug.len() <= MAX_SOURCE_SLUG_BYTES
        && identity.slug.is_ascii()
        && !identity.slug.bytes().any(|byte| byte.is_ascii_control())
        && identity
            .slug
            .bytes()
            .any(|byte| byte.is_ascii_alphanumeric())
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordfence_raw_source_identity_can_map(
    identity: &WordPressExternalSourceComponentIdentityDocument,
) -> bool {
    valid_wordfence_source_identity(identity)
        && identity.slug.len() <= crate::wordpress_review::MAX_WORDPRESS_SLUG_BYTES
        && match identity.kind {
            "core" => identity.slug.eq_ignore_ascii_case("wordpress"),
            "plugin" | "theme" => !identity.slug.eq_ignore_ascii_case("wordpress"),
            _ => false,
        }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_evaluation_document(
    evaluation: &crate::wordpress_review::WordPressExternalAdvisoryEvaluation,
    source_identity: bool,
) -> WordPressExternalEvaluationDocument {
    let key = evaluation.key();
    WordPressExternalEvaluationDocument {
        key: WordPressExternalEvaluationKeyDocument {
            source_namespace: key.source_namespace().to_owned(),
            upstream_id: key.upstream_id().to_owned(),
            component: wordpress_component_identity(key.component()),
            source_component: source_identity.then(|| {
                WordPressExternalSourceComponentIdentityDocument {
                    kind: wordpress_component_kind(key.source_component().kind()),
                    slug: key.source_component().slug().to_owned(),
                }
            }),
            source_association_fingerprint: source_identity.then(|| {
                format!(
                    "wordfence-source-association-sha256:{}",
                    lowercase_hex(key.source_association_sha256())
                )
            }),
        },
        identity_mapping: source_identity.then_some(evaluation.identity_mapping().as_str()),
        identity_collision_raw_count: if source_identity {
            evaluation.identity_collision_raw_count()
        } else {
            None
        },
        title: evaluation.title().to_owned(),
        display_name: evaluation.display_name().to_owned(),
        informational: evaluation.informational(),
        description: evaluation.description().to_owned(),
        references: evaluation.references().to_vec(),
        record_reference: wordpress_external_record_reference(evaluation.references())
            .map(str::to_owned),
        cwe: evaluation.cwe().map(|cwe| WordPressExternalCweDocument {
            id: cwe.id(),
            name: cwe.name().to_owned(),
            description: cwe.description().to_owned(),
        }),
        cvss: evaluation.cvss().map(|cvss| WordPressExternalCvssDocument {
            vector: cvss.vector().to_owned(),
            score: cvss.score().to_owned(),
            rating: wordpress_external_cvss_rating(cvss.rating()),
        }),
        cve: evaluation.cve().map(str::to_owned),
        cve_link: evaluation.cve_link().map(str::to_owned),
        researchers: evaluation.researchers().to_vec(),
        source_dates: WordPressExternalSourceDatesDocument {
            published: evaluation.published().map(str::to_owned),
            updated: evaluation.updated().map(str::to_owned),
        },
        affected_ranges: evaluation
            .affected_ranges()
            .iter()
            .map(|range| {
                let (from_kind, from_version) =
                    wordpress_external_range_value(range.from().value());
                let (to_kind, to_version) = wordpress_external_range_value(range.to().value());
                WordPressExternalRangeDocument {
                    label: range.label().to_owned(),
                    from_kind,
                    from_version,
                    from_inclusive: range.from().inclusive(),
                    to_kind,
                    to_version,
                    to_inclusive: range.to().inclusive(),
                }
            })
            .collect(),
        range_evaluations: evaluation.range_evaluations().map(|ranges| {
            ranges
                .iter()
                .map(|range| WordPressExternalRangeEvaluationDocument {
                    relation: wordpress_external_range_relation(range.relation()),
                    reason: wordpress_external_range_reason(range.reason()),
                })
                .collect()
        }),
        source_patched: evaluation.source_patched(),
        source_patched_versions: evaluation.source_patched_versions().to_vec(),
        source_remediation: evaluation.source_remediation().to_owned(),
        notice_ids: evaluation.notice_ids().to_vec(),
        component_evidence: wordpress_evidence_class(evaluation.component_evidence()),
        version_evidence_resolution: wordpress_external_version_evidence_resolution(
            evaluation.version_evidence_resolution(),
        ),
        version_relation: wordpress_external_version_relation(evaluation.version_relation()),
        version_relation_reason: evaluation.range_evaluations().map(|_| {
            wordpress_external_version_relation_reason(evaluation.version_relation_reason())
        }),
        applicability: wordpress_external_applicability(evaluation.applicability()),
        execution: WordPressExternalExecutionDocument {
            exploit_execution: wordpress_execution(evaluation.exploit_execution()),
            impact_validation: wordpress_execution(evaluation.impact_validation()),
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_identity_limitation_document(
    limitation: &crate::wordpress_review::WordPressExternalIdentityLimitation,
) -> WordPressExternalIdentityLimitationDocument {
    let affected_ranges = limitation
        .affected_ranges()
        .iter()
        .map(wordpress_external_range_document)
        .collect::<Vec<_>>();
    WordPressExternalIdentityLimitationDocument {
        key: WordPressExternalIdentityLimitationKeyDocument {
            source_namespace: "wordfence-intelligence",
            upstream_id: limitation.upstream_id().to_owned(),
            source_component: WordPressExternalSourceComponentIdentityDocument {
                kind: wordpress_component_kind(limitation.source_component().kind()),
                slug: limitation.source_component().slug().to_owned(),
            },
            source_association_fingerprint: format!(
                "wordfence-source-association-sha256:{}",
                lowercase_hex(limitation.source_association_sha256())
            ),
        },
        identity_resolution: "canonical_identity_unavailable",
        title: limitation.title().to_owned(),
        display_name: limitation.display_name().to_owned(),
        references: limitation.references().to_vec(),
        record_reference: wordpress_external_record_reference(limitation.references())
            .map(str::to_owned),
        range_evaluations: affected_ranges
            .iter()
            .map(|_| WordPressExternalRangeEvaluationDocument {
                relation: "not_evaluated",
                reason: "canonical_identity_unavailable",
            })
            .collect(),
        affected_ranges,
        source_patched: limitation.source_patched(),
        source_patched_versions: limitation.source_patched_versions().to_vec(),
        source_remediation: limitation.source_remediation().to_owned(),
        notice_ids: limitation.notice_ids().to_vec(),
        version_relation: "not_evaluated",
        version_relation_reason: "canonical_identity_unavailable",
        applicability: "indeterminate",
        execution: WordPressExternalExecutionDocument {
            exploit_execution: "not_performed",
            impact_validation: "not_performed",
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_range_document(
    range: &crate::wordpress_review::WordfenceV3AffectedRange,
) -> WordPressExternalRangeDocument {
    let (from_kind, from_version) = wordpress_external_range_value(range.from().value());
    let (to_kind, to_version) = wordpress_external_range_value(range.to().value());
    WordPressExternalRangeDocument {
        label: range.label().to_owned(),
        from_kind,
        from_version,
        from_inclusive: range.from().inclusive(),
        to_kind,
        to_version,
        to_inclusive: range.to().inclusive(),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_record_reference(references: &[String]) -> Option<&str> {
    references
        .iter()
        .map(String::as_str)
        .filter(|reference| is_wordfence_vulnerability_reference(reference))
        .min()
        .or_else(|| {
            references
                .iter()
                .map(String::as_str)
                .filter(|reference| is_strict_https_reference(reference))
                .min()
        })
}

#[cfg(all(
    feature = "scanning",
    any(feature = "wordpress-review", feature = "control-reference-mapping")
))]
fn is_strict_https_reference(value: &str) -> bool {
    url::Url::parse(value).ok().is_some_and(|url| {
        url.scheme() == "https"
            && url.has_host()
            && url.username().is_empty()
            && url.password().is_none()
            && url.port().is_none()
            && url.as_str() == value
    })
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn is_wordfence_vulnerability_reference(value: &str) -> bool {
    const PREFIX: &str = "/threat-intel/vulnerabilities/";
    url::Url::parse(value).ok().is_some_and(|url| {
        matches!(url.scheme(), "http" | "https")
            && url.host_str() == Some("www.wordfence.com")
            && url.username().is_empty()
            && url.password().is_none()
            && url.port().is_none()
            && url.as_str() == value
            && url.path().starts_with(PREFIX)
            && url.path().len() > PREFIX.len()
            && has_supported_wordfence_reference_query(&url)
            && url.fragment().is_none()
    })
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn has_supported_wordfence_reference_query(url: &url::Url) -> bool {
    const MAX_SOURCE_VALUE_BYTES: usize = 64;
    // Keep this in lockstep with the strict Production import contract.
    match url.query() {
        None => true,
        Some(query) => query.strip_prefix("source=").is_some_and(|value| {
            !value.is_empty()
                && value.len() <= MAX_SOURCE_VALUE_BYTES
                && value.bytes().all(|byte| {
                    byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~')
                })
        }),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_version_evidence_resolution(
    resolution: &crate::wordpress_review::WordPressExternalVersionEvidenceResolution,
) -> WordPressExternalVersionEvidenceResolutionDocument {
    WordPressExternalVersionEvidenceResolutionDocument {
        status: match resolution.status() {
            WordPressExternalVersionEvidenceStatus::Missing => "missing",
            WordPressExternalVersionEvidenceStatus::SingleDeclaration => "single_declaration",
            WordPressExternalVersionEvidenceStatus::RepeatedExactDeclaration => {
                "repeated_exact_declaration"
            },
            WordPressExternalVersionEvidenceStatus::MultipleDistinctDeclarations => {
                "multiple_distinct_declarations"
            },
        },
        evidence_row_count: resolution.evidence_row_count(),
        distinct_spelling_count: resolution.distinct_spelling_count(),
        semantic_status: resolution
            .semantic_status()
            .map(wordpress_version_resolution),
        semantic_reason: resolution
            .semantic_reason()
            .map(wordpress_version_resolution_reason),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_external_version_evidence_status(
    evidence_row_count: usize,
    distinct_spelling_count: usize,
) -> Option<&'static str> {
    match (evidence_row_count, distinct_spelling_count) {
        (0, 0) => Some("missing"),
        (1, 1) => Some("single_declaration"),
        (count, 1) if count > 1 => Some("repeated_exact_declaration"),
        (count, distinct) if count > 1 && distinct > 1 && distinct <= count => {
            Some("multiple_distinct_declarations")
        },
        _ => None,
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
fn wordpress_external_range_value(value: &WordfenceV3RangeValue) -> (&'static str, String) {
    match value {
        WordfenceV3RangeValue::Any => ("any", "*".to_owned()),
        WordfenceV3RangeValue::Declared(value) => ("declared", value.clone()),
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_external_cvss_rating(rating: WordfenceV3CvssRating) -> &'static str {
    match rating {
        WordfenceV3CvssRating::None => "none",
        WordfenceV3CvssRating::Low => "low",
        WordfenceV3CvssRating::Medium => "medium",
        WordfenceV3CvssRating::High => "high",
        WordfenceV3CvssRating::Critical => "critical",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_external_version_relation(
    relation: WordPressExternalVersionRelation,
) -> &'static str {
    match relation {
        WordPressExternalVersionRelation::SourceComparisonSemanticsUnresolved => {
            "source_comparison_semantics_unresolved"
        },
        WordPressExternalVersionRelation::WithinSupportedRangeUnderSelectedPolicy => {
            "within_supported_range_under_selected_policy"
        },
        WordPressExternalVersionRelation::OutsideDeclaredRangesUnderSelectedPolicy => {
            "outside_declared_ranges_under_selected_policy"
        },
        WordPressExternalVersionRelation::Indeterminate => "indeterminate",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_external_version_relation_reason(
    reason: WordPressExternalVersionRelationReason,
) -> &'static str {
    match reason {
        WordPressExternalVersionRelationReason::SourceComparisonSemanticsUnresolved => {
            "source_comparison_semantics_unresolved"
        },
        WordPressExternalVersionRelationReason::ContainingRange => "containing_range",
        WordPressExternalVersionRelationReason::ContainingRangeWithPartialCoverage => {
            "containing_range_with_partial_coverage"
        },
        WordPressExternalVersionRelationReason::AllRangesOutside => "all_ranges_outside",
        WordPressExternalVersionRelationReason::MissingVersionEvidence => {
            "missing_version_evidence"
        },
        WordPressExternalVersionRelationReason::ConflictingVersionEvidence => {
            "conflicting_version_evidence"
        },
        WordPressExternalVersionRelationReason::UnsupportedVersionEvidence => {
            "unsupported_version_evidence"
        },
        WordPressExternalVersionRelationReason::MissingAffectedRanges => "missing_affected_ranges",
        WordPressExternalVersionRelationReason::UnsupportedAffectedRange => {
            "unsupported_affected_range"
        },
        WordPressExternalVersionRelationReason::InvalidAffectedRange => "invalid_affected_range",
        WordPressExternalVersionRelationReason::SourcePatchedVersionWithinAffectedRange => {
            "source_patched_version_within_affected_range"
        },
        WordPressExternalVersionRelationReason::IdentityMappingCandidate => {
            "identity_mapping_candidate"
        },
        WordPressExternalVersionRelationReason::IdentityMappingAmbiguous => {
            "identity_mapping_ambiguous"
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_external_range_relation(
    relation: WordPressExternalRangeRelation,
) -> &'static str {
    match relation {
        WordPressExternalRangeRelation::Contains => "contains",
        WordPressExternalRangeRelation::DoesNotContain => "does_not_contain",
        WordPressExternalRangeRelation::NotEvaluated => "not_evaluated",
        WordPressExternalRangeRelation::Unsupported => "unsupported",
        WordPressExternalRangeRelation::InvalidUnderProfile => "invalid_under_profile",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_external_range_reason(reason: WordPressExternalRangeReason) -> &'static str {
    match reason {
        WordPressExternalRangeReason::SelectedVersionWithinBounds => {
            "selected_version_within_bounds"
        },
        WordPressExternalRangeReason::SelectedVersionOutsideBounds => {
            "selected_version_outside_bounds"
        },
        WordPressExternalRangeReason::MissingVersionEvidence => "missing_version_evidence",
        WordPressExternalRangeReason::ConflictingVersionEvidence => "conflicting_version_evidence",
        WordPressExternalRangeReason::UnsupportedVersionEvidence => "unsupported_version_evidence",
        WordPressExternalRangeReason::UnsupportedLowerBound => "unsupported_lower_bound",
        WordPressExternalRangeReason::UnsupportedUpperBound => "unsupported_upper_bound",
        WordPressExternalRangeReason::UnsupportedBothBounds => "unsupported_both_bounds",
        WordPressExternalRangeReason::ReversedBounds => "reversed_bounds",
        WordPressExternalRangeReason::EmptyExclusiveInterval => "empty_exclusive_interval",
        WordPressExternalRangeReason::IdentityMappingCandidate => "identity_mapping_candidate",
        WordPressExternalRangeReason::IdentityMappingAmbiguous => "identity_mapping_ambiguous",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_external_applicability(
    applicability: WordPressExternalApplicability,
) -> &'static str {
    match applicability {
        WordPressExternalApplicability::IndeterminateUnsupported => "indeterminate_unsupported",
        WordPressExternalApplicability::VersionMatchUnderSelectedPolicy => {
            "version_match_under_selected_policy"
        },
        WordPressExternalApplicability::NoVersionMatchUnderSelectedPolicy => {
            "no_version_match_under_selected_policy"
        },
        WordPressExternalApplicability::Indeterminate => "indeterminate",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_hosting_os(os: WordPressHostingOs) -> &'static str {
    match os {
        WordPressHostingOs::Linux => "linux",
        WordPressHostingOs::Windows => "windows",
        WordPressHostingOs::Macos => "macos",
        WordPressHostingOs::Bsd => "bsd",
        WordPressHostingOs::Other => "other",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_multisite(state: WordPressMultisiteState) -> &'static str {
    match state {
        WordPressMultisiteState::Enabled => "enabled",
        WordPressMultisiteState::Disabled => "disabled",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_patch(state: WordPressPatchState) -> &'static str {
    match state {
        WordPressPatchState::Applied => "applied",
        WordPressPatchState::NotApplied => "not_applied",
        WordPressPatchState::Unknown => "unknown",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_version_relation(relation: WordPressVersionRelation) -> &'static str {
    match relation {
        WordPressVersionRelation::WithinDeclaredRange => "within_declared_range",
        WordPressVersionRelation::OutsideDeclaredRanges => "outside_declared_ranges",
        WordPressVersionRelation::Unknown => "unknown",
        WordPressVersionRelation::Unsupported => "unsupported",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_comparison_profile(profile: WordPressComparisonProfile) -> &'static str {
    match profile {
        WordPressComparisonProfile::NumericDottedV1 => "numeric-dotted/v1",
        WordPressComparisonProfile::PhpReleaseSubsetV1 => "php-release-subset/v1",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_version_resolution(resolution: WordPressVersionResolution) -> &'static str {
    match resolution {
        WordPressVersionResolution::Missing => "missing",
        WordPressVersionResolution::SupportedEquivalent => "supported_equivalent",
        WordPressVersionResolution::Conflicting => "conflicting",
        WordPressVersionResolution::Unsupported => "unsupported",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_version_resolution_reason(
    reason: WordPressVersionResolutionReason,
) -> &'static str {
    match reason {
        WordPressVersionResolutionReason::NoVersionEvidence => "no_version_evidence",
        WordPressVersionResolutionReason::SingleSupportedVersion => "single_supported_version",
        WordPressVersionResolutionReason::EquivalentSupportedVersions => {
            "equivalent_supported_versions"
        },
        WordPressVersionResolutionReason::ConflictingVersionEvidence => {
            "conflicting_version_evidence"
        },
        WordPressVersionResolutionReason::UnsupportedVersionEvidence => {
            "unsupported_version_evidence"
        },
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_prerequisite_outcome(outcome: WordPressPrerequisiteOutcome) -> &'static str {
    match outcome {
        WordPressPrerequisiteOutcome::MatchedOnSuppliedFacts => "matched_on_supplied_facts",
        WordPressPrerequisiteOutcome::ContradictedOnSuppliedFacts => {
            "contradicted_on_supplied_facts"
        },
        WordPressPrerequisiteOutcome::Unknown => "unknown",
        WordPressPrerequisiteOutcome::Unsupported => "unsupported",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_applicability(applicability: WordPressApplicability) -> &'static str {
    match applicability {
        WordPressApplicability::CandidateMatchOnDeclaredFacts => {
            "candidate_match_on_declared_facts"
        },
        WordPressApplicability::ContradictedByDeclaredFacts => "contradicted_by_declared_facts",
        WordPressApplicability::IndeterminateMissingEvidence => "indeterminate_missing_evidence",
        WordPressApplicability::IndeterminateUnsupported => "indeterminate_unsupported",
    }
}

#[cfg(all(feature = "scanning", feature = "wordpress-review"))]
const fn wordpress_execution(status: WordPressExecutionStatus) -> &'static str {
    match status {
        WordPressExecutionStatus::NotPerformed => "not_performed",
    }
}

#[cfg(feature = "scanning")]
#[derive(Serialize)]
struct AssessmentItemDocument<'a> {
    schema: &'a str,
    capability_id: &'a str,
    subject_reference: String,
    #[serde(skip_serializing)]
    presentation_target: &'static str,
    title: &'a str,
    disposition: &'static str,
    claim_basis: &'static str,
    severity: Option<&'static str>,
    confidence_ppm: u32,
    fingerprint: &'a str,
    evidence_count: u64,
    redacted_summary: &'a str,
    category: &'a str,
    cwe: Option<&'a str>,
    remediation: AssessmentRemediationDocument<'a>,
    evidence_references: Vec<String>,
    control_evidence_references: Vec<String>,
    candidate_evidence_references: Vec<String>,
    case_reference: Option<String>,
    outcome_reference: Option<String>,
    verification_stage: Option<&'static str>,
}

#[cfg(feature = "scanning")]
impl<'a> AssessmentItemDocument<'a> {
    fn from_item(item: &'a crate::web_runtime::AssessmentItem) -> Result<Self, ReportError> {
        let remediation = item.remediation();
        let linkage = AssessmentBasisLinkageDocument::from_basis(item.basis())?;
        let evidence_count =
            u64::try_from(item.evidence_count()).map_err(|_| ReportError::Serialization)?;
        if linkage.reference_count()? != evidence_count {
            return Err(ReportError::Serialization);
        }
        Ok(Self {
            schema: item.schema(),
            capability_id: item.capability_id(),
            subject_reference: item.subject_reference().to_string(),
            presentation_target: item.presentation_target_kind(),
            title: item.title(),
            disposition: item.disposition().as_str(),
            claim_basis: assessment_basis_token(item.basis()),
            severity: item.severity().map(severity_token),
            confidence_ppm: item.confidence().parts_per_million(),
            fingerprint: item.fingerprint(),
            evidence_count,
            redacted_summary: item.redacted_summary(),
            category: item.category(),
            cwe: item.cwe(),
            remediation: AssessmentRemediationDocument {
                id: remediation.id(),
                summary: remediation.summary(),
            },
            evidence_references: linkage.evidence_references,
            control_evidence_references: linkage.control_evidence_references,
            candidate_evidence_references: linkage.candidate_evidence_references,
            case_reference: linkage.case_reference,
            outcome_reference: linkage.outcome_reference,
            verification_stage: linkage.verification_stage,
        })
    }

    fn validate(&self) -> Result<(), ReportError> {
        if !valid_opaque_assessment_reference(&self.subject_reference, "subject") {
            return Err(ReportError::Serialization);
        }
        if !matches!(
            self.presentation_target,
            "assessment_subject"
                | "query_parameter"
                | "ssrf_oast_query"
                | "authorization_resource"
                | "openapi_document"
                | "rest_operation"
        ) {
            return Err(ReportError::Serialization);
        }
        let mut references: Vec<&str> = Vec::new();
        for reference in self
            .evidence_references
            .iter()
            .chain(&self.control_evidence_references)
            .chain(&self.candidate_evidence_references)
        {
            if !valid_opaque_assessment_reference(reference, "evidence")
                || references.contains(&reference.as_str())
            {
                return Err(ReportError::Serialization);
            }
            references.push(reference);
        }
        if u64::try_from(references.len()).map_err(|_| ReportError::Serialization)?
            != self.evidence_count
        {
            return Err(ReportError::Serialization);
        }
        let linkage_is_valid = match self.claim_basis {
            "observation" => {
                self.disposition == "informational"
                    && !self.evidence_references.is_empty()
                    && self.control_evidence_references.is_empty()
                    && self.candidate_evidence_references.is_empty()
                    && self.case_reference.is_none()
                    && self.outcome_reference.is_none()
                    && self.verification_stage.is_none()
            },
            "differential" => {
                let atomic_pair = self.evidence_references.len() == 1
                    && self.control_evidence_references.is_empty()
                    && self.candidate_evidence_references.is_empty();
                let matched_pair = self.evidence_references.is_empty()
                    && !self.control_evidence_references.is_empty()
                    && !self.candidate_evidence_references.is_empty();
                self.disposition == "needs_review"
                    && (atomic_pair || matched_pair)
                    && self.case_reference.is_none()
                    && self.outcome_reference.is_none()
                    && self.verification_stage.is_none()
            },
            "verifier_transition" => {
                self.disposition == "confirmed"
                    && !self.evidence_references.is_empty()
                    && self.control_evidence_references.is_empty()
                    && self.candidate_evidence_references.is_empty()
                    && self.case_reference.as_deref().is_some_and(|reference| {
                        valid_opaque_assessment_reference(reference, "case")
                    })
                    && self.outcome_reference.as_deref().is_some_and(|reference| {
                        valid_opaque_assessment_reference(reference, "outcome")
                    })
                    && matches!(self.verification_stage, Some("passive" | "active"))
            },
            _ => false,
        };
        if linkage_is_valid {
            Ok(())
        } else {
            Err(ReportError::Serialization)
        }
    }
}

#[cfg(feature = "scanning")]
fn valid_opaque_assessment_reference(value: &str, kind: &str) -> bool {
    let Some(suffix) = value
        .strip_prefix(kind)
        .and_then(|value| value.strip_prefix('-'))
    else {
        return false;
    };
    suffix.len() >= 4
        && suffix.bytes().all(|byte| byte.is_ascii_digit())
        && (suffix.len() == 4 || !suffix.starts_with('0'))
}

#[cfg(feature = "scanning")]
fn assessment_reference_list(references: &[String]) -> String {
    if references.is_empty() {
        "not applicable".to_owned()
    } else {
        references.join(", ")
    }
}

#[cfg(feature = "scanning")]
struct AssessmentBasisLinkageDocument {
    evidence_references: Vec<String>,
    control_evidence_references: Vec<String>,
    candidate_evidence_references: Vec<String>,
    case_reference: Option<String>,
    outcome_reference: Option<String>,
    verification_stage: Option<&'static str>,
}

#[cfg(feature = "scanning")]
impl AssessmentBasisLinkageDocument {
    fn from_basis(basis: &AssessmentBasis) -> Result<Self, ReportError> {
        match basis {
            AssessmentBasis::Observation(observation) => {
                let evidence_references = observation
                    .evidence()
                    .iter()
                    .map(ToString::to_string)
                    .collect::<Vec<_>>();
                if evidence_references.is_empty() {
                    return Err(ReportError::Serialization);
                }
                Ok(Self {
                    evidence_references,
                    control_evidence_references: Vec::new(),
                    candidate_evidence_references: Vec::new(),
                    case_reference: None,
                    outcome_reference: None,
                    verification_stage: None,
                })
            },
            AssessmentBasis::Differential(differential) => {
                if let Some(reference) = differential.paired_comparison() {
                    if !differential.control().is_empty() || !differential.candidate().is_empty() {
                        return Err(ReportError::Serialization);
                    }
                    return Ok(Self {
                        evidence_references: vec![reference.to_string()],
                        control_evidence_references: Vec::new(),
                        candidate_evidence_references: Vec::new(),
                        case_reference: None,
                        outcome_reference: None,
                        verification_stage: None,
                    });
                }
                let control_evidence_references = differential
                    .control()
                    .iter()
                    .map(ToString::to_string)
                    .collect::<Vec<_>>();
                let candidate_evidence_references = differential
                    .candidate()
                    .iter()
                    .map(ToString::to_string)
                    .collect::<Vec<_>>();
                if control_evidence_references.is_empty()
                    || candidate_evidence_references.is_empty()
                {
                    return Err(ReportError::Serialization);
                }
                Ok(Self {
                    evidence_references: Vec::new(),
                    control_evidence_references,
                    candidate_evidence_references,
                    case_reference: None,
                    outcome_reference: None,
                    verification_stage: None,
                })
            },
            AssessmentBasis::Verifier(verifier) => {
                let evidence_references = verifier
                    .evidence()
                    .iter()
                    .map(ToString::to_string)
                    .collect::<Vec<_>>();
                if evidence_references.is_empty() {
                    return Err(ReportError::Serialization);
                }
                Ok(Self {
                    evidence_references,
                    control_evidence_references: Vec::new(),
                    candidate_evidence_references: Vec::new(),
                    case_reference: Some(verifier.case_reference().to_string()),
                    outcome_reference: Some(verifier.outcome_reference().to_string()),
                    verification_stage: Some(verifier.stage().as_str()),
                })
            },
        }
    }

    fn reference_count(&self) -> Result<u64, ReportError> {
        self.evidence_references
            .len()
            .checked_add(self.control_evidence_references.len())
            .and_then(|count| count.checked_add(self.candidate_evidence_references.len()))
            .and_then(|count| u64::try_from(count).ok())
            .ok_or(ReportError::Serialization)
    }
}

#[cfg(feature = "scanning")]
#[derive(Serialize)]
struct AssessmentRemediationDocument<'a> {
    id: &'a str,
    summary: &'a str,
}

#[cfg(feature = "scanning")]
const fn assessment_basis_token(basis: &AssessmentBasis) -> &'static str {
    match basis {
        AssessmentBasis::Observation(_) => "observation",
        AssessmentBasis::Differential(_) => "differential",
        AssessmentBasis::Verifier(_) => "verifier_transition",
    }
}

#[derive(Serialize)]
struct ReportDocument<'a> {
    schema: &'static str,
    source_schema: &'a str,
    status: &'static str,
    stop_code: &'static str,
    target: &'a str,
    authorized_origin: &'a str,
    started_at: String,
    completed_at: String,
    accounting: AccountingDocument,
    steps: Vec<StepDocument<'a>>,
    outcomes: Vec<OutcomeDocument<'a>>,
}

impl<'a> ReportDocument<'a> {
    fn from_report(report: &'a RunReport) -> Result<Self, ReportError> {
        Ok(Self {
            schema: REPORT_DOCUMENT_SCHEMA,
            source_schema: report.schema(),
            status: run_status_token(report.status()),
            stop_code: stop_code_token(report.stop_reason().code()),
            target: report.target(),
            authorized_origin: report.authorized_origin(),
            started_at: report.started_at().to_rfc3339(),
            completed_at: report.completed_at().to_rfc3339(),
            accounting: AccountingDocument::from_report(report),
            steps: report.steps().iter().map(StepDocument::from_step).collect(),
            outcomes: report
                .outcomes()
                .iter()
                .map(OutcomeDocument::from_outcome)
                .collect::<Result<Vec<_>, _>>()?,
        })
    }

    fn metadata(&self) -> [(&'static str, &str); 8] {
        [
            ("Schema", self.schema),
            ("Source schema", self.source_schema),
            ("Status", self.status),
            ("Stop code", self.stop_code),
            ("Target", self.target),
            ("Authorized origin", self.authorized_origin),
            ("Started at", &self.started_at),
            ("Completed at", &self.completed_at),
        ]
    }
}

#[derive(Serialize)]
struct AccountingDocument {
    requests: AccountingDimension,
    response_body_bytes: AccountingDimension,
    request_body_bytes: AccountingDimension,
    wall_time_ms: AccountingDimension,
}

impl AccountingDocument {
    fn from_report(report: &RunReport) -> Self {
        let accounting = report.accounting();
        Self {
            requests: AccountingDimension::from_accounting(accounting.requests()),
            response_body_bytes: AccountingDimension::from_accounting(
                accounting.response_body_bytes(),
            ),
            request_body_bytes: AccountingDimension::from_accounting(
                accounting.request_body_bytes(),
            ),
            wall_time_ms: AccountingDimension::from_accounting(accounting.wall_time_ms()),
        }
    }

    fn dimensions(&self) -> [(&'static str, &AccountingDimension); 4] {
        [
            ("requests", &self.requests),
            ("response_body_bytes", &self.response_body_bytes),
            ("request_body_bytes", &self.request_body_bytes),
            ("wall_time_ms", &self.wall_time_ms),
        ]
    }
}

#[derive(Serialize)]
struct AccountingDimension {
    mode: &'static str,
    limit: Option<String>,
    consumed: Option<String>,
    remaining: Option<String>,
}

impl AccountingDimension {
    fn from_accounting(accounting: &ResourceAccounting) -> Self {
        Self {
            mode: accounting_mode_token(accounting.mode()),
            limit: accounting.limit().map(|value| value.to_string()),
            consumed: accounting.consumed().map(|value| value.to_string()),
            remaining: accounting.remaining().map(|value| value.to_string()),
        }
    }
}

#[derive(Serialize)]
struct StepDocument<'a> {
    ordinal: u32,
    action_id: &'a str,
    status: &'static str,
    duration_ms: String,
}

impl<'a> StepDocument<'a> {
    fn from_step(step: &'a termivar_core::RunStepReport) -> Self {
        Self {
            ordinal: step.ordinal(),
            action_id: step.action_id(),
            status: step_status_token(step.status()),
            duration_ms: step.duration_ms().to_string(),
        }
    }
}

#[derive(Serialize)]
struct OutcomeDocument<'a> {
    kind: &'static str,
    action_id: &'a str,
    severity: &'static str,
    disposition: &'static str,
    confidence_ppm: u32,
    evidence_count: u64,
    redacted_summary: &'a str,
}

impl<'a> OutcomeDocument<'a> {
    fn from_outcome(outcome: &'a RunOutcomeRecord) -> Result<Self, ReportError> {
        Ok(Self {
            kind: if outcome.verification_outcome().is_some() {
                "verification_outcome"
            } else {
                "unresolved_observation"
            },
            action_id: outcome.action_id(),
            severity: severity_token(outcome.severity()),
            disposition: disposition_token(outcome.disposition()),
            confidence_ppm: outcome.confidence().parts_per_million(),
            evidence_count: u64::try_from(outcome.evidence_ids().len())
                .map_err(|_| ReportError::Serialization)?,
            redacted_summary: outcome.redacted_summary(),
        })
    }
}

fn run_status_token(status: RunStatus) -> &'static str {
    match status {
        RunStatus::Complete => "complete",
        RunStatus::Partial => "partial",
        RunStatus::Cancelled => "cancelled",
        RunStatus::Failed => "failed",
        _ => "unrecognized",
    }
}

fn stop_code_token(code: RunStopCode) -> &'static str {
    match code {
        RunStopCode::Completed => "completed",
        RunStopCode::NoEligibleAction => "no_eligible_action",
        RunStopCode::BudgetExhausted => "budget_exhausted",
        RunStopCode::ReportLimitExceeded => "report_limit_exceeded",
        RunStopCode::Cancelled => "cancelled",
        RunStopCode::StepFailed => "step_failed",
        RunStopCode::StepTimedOut => "step_timed_out",
        RunStopCode::TaskJoinFailed => "task_join_failed",
        RunStopCode::RuntimeFailed => "runtime_failed",
        _ => "unrecognized",
    }
}

fn step_status_token(status: RunStepStatus) -> &'static str {
    match status {
        RunStepStatus::Succeeded => "succeeded",
        RunStepStatus::Failed => "failed",
        RunStepStatus::TimedOut => "timed_out",
        RunStepStatus::Cancelled => "cancelled",
        RunStepStatus::Skipped => "skipped",
        RunStepStatus::BudgetExhausted => "budget_exhausted",
        _ => "unrecognized",
    }
}

fn accounting_mode_token(mode: ResourceAccountingMode) -> &'static str {
    match mode {
        ResourceAccountingMode::Metered => "metered",
        ResourceAccountingMode::Observed => "observed",
        ResourceAccountingMode::Unmetered => "unmetered",
        _ => "unrecognized",
    }
}

fn disposition_token(disposition: OutcomeStatus) -> &'static str {
    match disposition {
        OutcomeStatus::Success => "success",
        OutcomeStatus::Blocked => "blocked",
        OutcomeStatus::Unknown => "unknown",
        OutcomeStatus::FalsePositive => "false_positive",
        OutcomeStatus::NeedsReview => "needs_review",
        OutcomeStatus::ConfirmedNegative => "confirmed_negative",
        _ => "unrecognized",
    }
}

fn severity_token(severity: SecuritySeverity) -> &'static str {
    match severity {
        SecuritySeverity::Info => "info",
        SecuritySeverity::Low => "low",
        SecuritySeverity::Medium => "medium",
        SecuritySeverity::High => "high",
        SecuritySeverity::Critical => "critical",
        _ => "unrecognized",
    }
}

fn write_visible_codepoint(output: &mut RenderBuffer, character: char) -> Result<(), ReportError> {
    output.push_fmt(format_args!("\\u{{{:04X}}}", u32::from(character)))
}

fn is_bidi_control(character: char) -> bool {
    matches!(
        character,
        '\u{061C}'
            | '\u{200E}'
            | '\u{200F}'
            | '\u{202A}'..='\u{202E}'
            | '\u{2066}'..='\u{2069}'
    )
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::collections::BTreeSet;
    use termivar_core::{
        EntityId, EvidenceId, Outcome, Probability, RunAccounting, RunReportInput, RunStepReport,
        RunStopReason, VerificationStage,
    };

    const PRIVATE_SUBJECT: &str = "private-subject-sentinel";
    const PRIVATE_EVIDENCE: &str = "private-evidence-sentinel";
    const PRIVATE_RATIONALE: &str = "private-rationale-sentinel";
    const PRIVATE_CASE: &str = "private-case-sentinel";
    const PRIVATE_RULE: &str = "private-rule-sentinel";
    const PRIVATE_HYPOTHESIS: &str = "private-hypothesis-sentinel";
    const PRIVATE_STEP_DETAIL: &str = "private-step-detail-sentinel";
    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    const WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V1: &str = "security.wordpress-discovery-audit/v1";
    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    const WORDPRESS_DISCOVERY_POLICY_ID_V1: &str = "termivar.wordpress-metadata-discovery/v1";

    #[cfg(all(feature = "scanning", feature = "recon-ct-provider"))]
    #[test]
    fn certspotter_issuance_reference_contains_no_raw_bidi_input() {
        let raw = "opaque/\u{202e}name@example.com";
        let (reference, byte_length) = recon_certspotter_issuance_reference(raw).unwrap();

        assert_eq!(byte_length, raw.len() as u64);
        assert!(valid_recon_certspotter_issuance_reference(&reference));
        assert!(reference.is_ascii());
        assert!(!reference.contains(raw));
        assert!(!reference.contains('\u{202e}'));
        assert!(!reference.contains("opaque/"));
        assert!(!reference.contains("name@example.com"));
    }

    fn complete_report(target: &str, summary: &str) -> RunReport {
        report_for_status(
            RunStatus::Complete,
            RunStopCode::Completed,
            vec![RunStepReport::new(
                1,
                "scan.observe",
                RunStepStatus::Succeeded,
                25,
                Some(PRIVATE_STEP_DETAIL.to_string()),
            )
            .unwrap()],
            target,
            summary,
        )
    }

    fn report_for_status(
        status: RunStatus,
        stop_code: RunStopCode,
        steps: Vec<RunStepReport>,
        target: &str,
        summary: &str,
    ) -> RunReport {
        let outcome = Outcome::verified(
            PRIVATE_CASE,
            EntityId::new(PRIVATE_SUBJECT).unwrap(),
            "scan.observe",
            PRIVATE_HYPOTHESIS,
            PRIVATE_RULE,
            VerificationStage::Passive,
            OutcomeStatus::Success,
            Probability::from_parts_per_million(812_345).unwrap(),
            PRIVATE_RATIONALE,
            BTreeSet::from([EvidenceId::parse(PRIVATE_EVIDENCE).unwrap()]),
        )
        .unwrap();
        let outcome = RunOutcomeRecord::from_outcome(outcome, summary).unwrap();
        let input = RunReportInput::new(
            status,
            RunStopReason::new(stop_code, "private-stop-detail-sentinel").unwrap(),
            target,
            "https://example.test",
            "2026-08-20T10:00:00Z".parse().unwrap(),
            "2026-08-20T10:00:01Z".parse().unwrap(),
        )
        .unwrap()
        .with_accounting(RunAccounting::new(
            ResourceAccounting::metered(10, 4),
            ResourceAccounting::observed(900),
            ResourceAccounting::unmetered(),
            ResourceAccounting::metered(2_000, 1_000),
        ))
        .with_steps(steps)
        .with_outcomes(if status == RunStatus::Failed {
            Vec::new()
        } else {
            vec![outcome]
        });
        RunReport::new(input).unwrap()
    }

    fn maximum_accounting_report() -> RunReport {
        let outcome = RunOutcomeRecord::unresolved(
            EntityId::new(PRIVATE_SUBJECT).unwrap(),
            "scan.observe",
            PRIVATE_RATIONALE,
            "summary",
        )
        .unwrap();
        let input = RunReportInput::new(
            RunStatus::Complete,
            RunStopReason::new(RunStopCode::Completed, "done").unwrap(),
            "target",
            "origin",
            "2026-08-20T10:00:00Z".parse().unwrap(),
            "2026-08-20T10:00:01Z".parse().unwrap(),
        )
        .unwrap()
        .with_accounting(RunAccounting::new(
            ResourceAccounting::metered(u64::MAX, u64::MAX),
            ResourceAccounting::observed(u64::MAX),
            ResourceAccounting::metered(u64::MAX, 0),
            ResourceAccounting::metered(u64::MAX, 1),
        ))
        .with_steps(vec![RunStepReport::new(
            1,
            "scan.observe",
            RunStepStatus::Succeeded,
            u64::MAX,
            None,
        )
        .unwrap()])
        .with_outcomes(vec![outcome]);
        RunReport::new(input).unwrap()
    }

    fn parse_csv_line(line: &str) -> Vec<String> {
        let bytes = line.as_bytes();
        let mut index = 0;
        let mut cells = Vec::new();
        while index < bytes.len() {
            assert_eq!(bytes[index], b'"');
            index += 1;
            let mut cell = Vec::new();
            loop {
                assert!(index < bytes.len());
                if bytes[index] == b'"' {
                    if bytes.get(index + 1) == Some(&b'"') {
                        cell.push(b'"');
                        index += 2;
                        continue;
                    }
                    index += 1;
                    break;
                }
                cell.push(bytes[index]);
                index += 1;
            }
            cells.push(String::from_utf8(cell).unwrap());
            if index == bytes.len() {
                break;
            }
            assert_eq!(bytes[index], b',');
            index += 1;
        }
        cells
    }

    #[cfg(feature = "scanning")]
    fn observation_assessment_document(text: &str) -> AssessmentDocument<'_> {
        AssessmentDocument {
            schema: ASSESSMENT_REPORT_DOCUMENT_SCHEMA,
            source_schema: crate::web_runtime::ASSESSMENT_RUN_REPORT_SCHEMA,
            run_schema: termivar_core::RUN_REPORT_SCHEMA,
            profile_schema: crate::web_runtime::SCAN_PROFILE_V1_SCHEMA,
            profile: "web-review",
            status: "complete",
            subject_count: 1,
            item_count: 1,
            #[cfg(feature = "supplied-session-review")]
            supplied_session: None,
            #[cfg(feature = "authorization-review")]
            authorization_review: None,
            #[cfg(feature = "websocket-review")]
            websocket_review: None,
            #[cfg(feature = "xml-external-entity-review")]
            xml_external_entity_review: None,
            #[cfg(feature = "template-evaluation-review")]
            template_evaluation_review: None,
            #[cfg(feature = "openapi-review")]
            openapi_review: None,
            #[cfg(feature = "rest-review")]
            rest_review: None,
            #[cfg(feature = "secret-exposure-review")]
            secret_exposure_review: None,
            #[cfg(feature = "tls-observation")]
            tls_observation: None,
            #[cfg(feature = "tls-negotiation-review")]
            tls_negotiation_review: None,
            #[cfg(feature = "jwt-policy-review")]
            jwt_policy_review: None,
            #[cfg(feature = "control-reference-mapping")]
            control_reference_mapping: None,
            #[cfg(feature = "recon-snapshot-import")]
            recon_snapshot_import: None,
            #[cfg(feature = "recon-ct-provider")]
            recon_certspotter: None,
            #[cfg(feature = "wordpress-review")]
            wordpress_review: None,
            #[cfg(feature = "wordpress-review")]
            wordpress_discovery: None,
            #[cfg(feature = "wordpress-review")]
            wordpress_asset_fingerprints: None,
            items: vec![AssessmentItemDocument {
                schema: crate::web_runtime::ASSESSMENT_ITEM_SCHEMA,
                capability_id: text,
                subject_reference: "subject-0000".to_owned(),
                presentation_target: "assessment_subject",
                title: text,
                disposition: "informational",
                claim_basis: "observation",
                severity: None,
                confidence_ppm: 750_000,
                fingerprint: text,
                evidence_count: 1,
                redacted_summary: text,
                category: text,
                cwe: None,
                remediation: AssessmentRemediationDocument {
                    id: text,
                    summary: text,
                },
                evidence_references: vec!["evidence-0000".to_owned()],
                control_evidence_references: Vec::new(),
                candidate_evidence_references: Vec::new(),
                case_reference: None,
                outcome_reference: None,
                verification_stage: None,
            }],
        }
    }

    #[cfg(all(feature = "scanning", feature = "websocket-review"))]
    fn websocket_review_document() -> AssessmentWebSocketReviewAuditDocument {
        AssessmentWebSocketReviewAuditDocument {
            schema: WEBSOCKET_REVIEW_AUDIT_SCHEMA,
            capability_id: WEBSOCKET_REVIEW_CAPABILITY_ID,
            selected: true,
            policy_reference: format!("websocket-policy-sha256:{}", "a".repeat(64)),
            endpoint_reference: format!("websocket-endpoint-sha256:{}", "b".repeat(64)),
            context: "anonymous",
            #[cfg(feature = "supplied-session-review")]
            supplied_session_context: None,
            methodology: AssessmentWebSocketReviewMethodologyDocument {
                origin_mode: "application_origin",
                compression: "disabled",
                reconnect: "disabled",
                http2_extended_connect: "unsupported",
                subprotocol: "present",
                physical_frame_count: WEBSOCKET_REVIEW_PHYSICAL_FRAME_COUNT,
                max_frame_size: WEBSOCKET_REVIEW_MAX_FRAME_SIZE,
                limits: AssessmentWebSocketReviewLimitsDocument {
                    max_connections: 1,
                    max_outbound_application_bytes: 65_536,
                    max_inbound_application_bytes: 65_536,
                    max_outbound_message_bytes: 4_096,
                    max_inbound_message_bytes: 4_096,
                    max_messages: 2,
                    max_control_frames: 4,
                    max_wall_time_ms: 1_000,
                },
            },
            coverage: AssessmentWebSocketReviewCoverageDocument {
                terminal: "completed",
                completeness: "configured_exchange_complete",
                first_failure: None,
                request_attempt_count: 1,
                request_admitted_count: 1,
                connection_attempt_count: 1,
                handshake_completed_count: 1,
                outbound_message_count: 2,
                inbound_message_count: 2,
                outbound_control_frame_count: 1,
                inbound_control_frame_count: 0,
                outbound_application_bytes: 9,
                inbound_application_bytes: 15,
                transport_read_bytes: 241,
                transport_write_bytes: 198,
                accounted_request_body_bytes: 0,
                accounted_transport_response_bytes: 241,
                transport_byte_scope: WEBSOCKET_REVIEW_TRANSPORT_BYTE_SCOPE,
                expected_response_count: 2,
                matched_response_count: 2,
                mismatched_response_count: 0,
            },
            messages: vec![
                AssessmentWebSocketReviewMessageDocument {
                    message_reference: format!(
                        "websocket-message-revision-sha256:{}",
                        "c".repeat(64)
                    ),
                    expected_response_reference: format!(
                        "websocket-expected-response-revision-sha256:{}",
                        "d".repeat(64)
                    ),
                    outbound_length: 4,
                    inbound_length: Some(7),
                    status: "response_matched",
                },
                AssessmentWebSocketReviewMessageDocument {
                    message_reference: format!(
                        "websocket-message-revision-sha256:{}",
                        "e".repeat(64)
                    ),
                    expected_response_reference: format!(
                        "websocket-expected-response-revision-sha256:{}",
                        "f".repeat(64)
                    ),
                    outbound_length: 5,
                    inbound_length: Some(8),
                    status: "response_matched",
                },
            ],
            claim_limits: WEBSOCKET_REVIEW_CLAIM_LIMITS.to_vec(),
        }
    }

    #[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
    fn xml_external_entity_review_document() -> AssessmentXmlExternalEntityReviewAuditDocument {
        AssessmentXmlExternalEntityReviewAuditDocument {
            schema: XML_EXTERNAL_ENTITY_REVIEW_AUDIT_SCHEMA,
            algorithm: XML_EXTERNAL_ENTITY_REVIEW_ALGORITHM,
            policy: AssessmentXmlExternalEntityPolicyDocument {
                id: format!("xml-external-entity-policy-sha256:{}", "a".repeat(64)),
                method: "post",
                media_type: "application/xml; charset=utf-8",
                control_model: XML_EXTERNAL_ENTITY_REVIEW_CONTROL_MODEL,
                execution_mode: "owned_numeric_loopback_test",
            },
            outcome: "repeated_external_entity_resolution_observed",
            target: AssessmentXmlExternalEntityTargetDocument {
                request_count: 3,
                request_body_bytes: 768,
                response_bytes: 96,
                complete: true,
                accounting_complete: true,
            },
            provider: AssessmentXmlExternalEntityProviderDocument {
                request_count: 12,
                active_verification_count: 1,
                preflight_clean: true,
                control_callback_observed: false,
                candidate_callback_observed: true,
                replay_callback_observed: true,
                callback_targets_distinct: true,
                event_identities_distinct: true,
                cleanup_verified: true,
                complete: true,
            },
            item_projected: true,
            semantic_effect: "not_performed",
            impact_validation: "not_performed",
            claim_limits: XML_EXTERNAL_ENTITY_REVIEW_CLAIM_LIMITS.to_vec(),
        }
    }

    #[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
    fn xml_external_entity_item_document() -> AssessmentItemDocument<'static> {
        AssessmentItemDocument {
            schema: crate::web_runtime::ASSESSMENT_ITEM_SCHEMA,
            capability_id: XML_EXTERNAL_ENTITY_REVIEW_CAPABILITY_ID,
            subject_reference: "subject-0000".to_owned(),
            presentation_target: "assessment_subject",
            title: XML_EXTERNAL_ENTITY_REVIEW_TITLE,
            disposition: "needs_review",
            claim_basis: "differential",
            severity: None,
            confidence_ppm: 900_000,
            fingerprint: "sha256:2222222222222222222222222222222222222222222222222222222222222222",
            evidence_count: 8,
            redacted_summary: XML_EXTERNAL_ENTITY_REVIEW_SUMMARY,
            category: XML_EXTERNAL_ENTITY_REVIEW_CATEGORY,
            cwe: Some("CWE-611"),
            remediation: AssessmentRemediationDocument {
                id: XML_EXTERNAL_ENTITY_REVIEW_REMEDIATION_ID,
                summary: XML_EXTERNAL_ENTITY_REVIEW_REMEDIATION_SUMMARY,
            },
            evidence_references: Vec::new(),
            control_evidence_references: vec![
                "evidence-0000".to_owned(),
                "evidence-0001".to_owned(),
                "evidence-0002".to_owned(),
            ],
            candidate_evidence_references: vec![
                "evidence-0003".to_owned(),
                "evidence-0004".to_owned(),
                "evidence-0005".to_owned(),
                "evidence-0006".to_owned(),
                "evidence-0007".to_owned(),
            ],
            case_reference: None,
            outcome_reference: None,
            verification_stage: None,
        }
    }

    #[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
    fn xml_external_entity_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observation_assessment_document(
            "sha256:1111111111111111111111111111111111111111111111111111111111111111",
        );
        document.subject_count = 2;
        document.items[0] = xml_external_entity_item_document();
        document.xml_external_entity_review = Some(xml_external_entity_review_document());
        document
    }

    #[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
    fn assert_xml_external_entity_item_mutation_rejected(
        mutate: impl FnOnce(&mut AssessmentItemDocument<'static>),
    ) {
        let mut document = xml_external_entity_assessment_document();
        mutate(&mut document.items[0]);
        assert_eq!(document.validate(), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
    fn template_evaluation_review_document(
        outcome: &'static str,
        projected_item_count: u8,
    ) -> AssessmentTemplateEvaluationReviewAuditDocument {
        AssessmentTemplateEvaluationReviewAuditDocument {
            schema: TEMPLATE_EVALUATION_REVIEW_AUDIT_SCHEMA,
            policy_id: TEMPLATE_EVALUATION_REVIEW_POLICY_ID,
            family_id: TEMPLATE_EVALUATION_REVIEW_FAMILY_ID,
            outcome,
            engine_identity: TEMPLATE_EVALUATION_ENGINE_IDENTITY,
            coverage: AssessmentTemplateEvaluationCoverageDocument {
                selected_case_count: 2,
                attempted_request_count: 4,
                active_request_count: 2,
                completed_response_count: 4,
                committed_response_count: 4,
                projected_item_count,
            },
            operations: AssessmentTemplateEvaluationOperationsDocument {
                outbound_interaction: TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED,
                os_execution: TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED,
                file_access: TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED,
                impact_validation: TEMPLATE_EVALUATION_OPERATION_NOT_PERFORMED,
            },
            claim_limits: TEMPLATE_EVALUATION_REVIEW_CLAIM_LIMITS.to_vec(),
        }
    }

    #[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
    fn template_evaluation_review_item_document() -> AssessmentItemDocument<'static> {
        AssessmentItemDocument {
            schema: crate::web_runtime::ASSESSMENT_ITEM_SCHEMA,
            capability_id: TEMPLATE_EVALUATION_REVIEW_CAPABILITY_ID,
            subject_reference: "subject-0000".to_owned(),
            presentation_target: "query_parameter",
            title: TEMPLATE_EVALUATION_REVIEW_TITLE,
            disposition: "needs_review",
            claim_basis: "differential",
            severity: None,
            confidence_ppm: TEMPLATE_EVALUATION_REVIEW_CONFIDENCE_PPM,
            fingerprint: "sha256:3333333333333333333333333333333333333333333333333333333333333333",
            evidence_count: 12,
            redacted_summary: TEMPLATE_EVALUATION_REVIEW_SUMMARY,
            category: TEMPLATE_EVALUATION_REVIEW_CATEGORY,
            cwe: Some("CWE-1336"),
            remediation: AssessmentRemediationDocument {
                id: TEMPLATE_EVALUATION_REVIEW_REMEDIATION_ID,
                summary: TEMPLATE_EVALUATION_REVIEW_REMEDIATION_SUMMARY,
            },
            evidence_references: Vec::new(),
            control_evidence_references: (0..6)
                .map(|ordinal| format!("evidence-{ordinal:04}"))
                .collect(),
            candidate_evidence_references: (6..12)
                .map(|ordinal| format!("evidence-{ordinal:04}"))
                .collect(),
            case_reference: None,
            outcome_reference: None,
            verification_stage: None,
        }
    }

    #[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
    fn template_evaluation_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observation_assessment_document(
            "sha256:4444444444444444444444444444444444444444444444444444444444444444",
        );
        document.items[0] = template_evaluation_review_item_document();
        document.template_evaluation_review = Some(template_evaluation_review_document(
            "candidate_specific_evaluation",
            1,
        ));
        document
    }

    #[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
    fn assert_template_evaluation_item_mutation_rejected(
        mutate: impl FnOnce(&mut AssessmentItemDocument<'static>),
    ) {
        let mut document = template_evaluation_assessment_document();
        mutate(&mut document.items[0]);
        assert_eq!(document.validate(), Err(ReportError::Serialization));
    }

    #[cfg(all(
        feature = "scanning",
        feature = "websocket-review",
        feature = "supplied-session-review"
    ))]
    fn supplied_session_websocket_review_document() -> AssessmentWebSocketReviewAuditDocument {
        let mut document = websocket_review_document();
        document.schema = WEBSOCKET_SUPPLIED_SESSION_AUDIT_SCHEMA;
        document.context = "supplied_session";
        document.supplied_session_context =
            Some(AssessmentWebSocketSuppliedSessionContextDocument {
                mode: "health_qualified_authorization_header",
                policy_reference: format!("supplied-session-policy-sha256:{}", "1".repeat(64)),
                application_reference: format!(
                    "supplied-session-application-sha256:{}",
                    "2".repeat(64)
                ),
                principal_reference: "supplied-session-principal-0001".to_owned(),
                principal_alias: "fixture-user".to_owned(),
                principal_assurance: "operator_declared",
                credential_mechanism: "authorization_header",
                session_epoch: 1,
                startup_health: Some(AssessmentWebSocketSuppliedSessionHealthDocument {
                    outcome: "healthy",
                    evidence_reference: Some(format!(
                        "supplied-session-checkpoint-evidence-sha256:{}",
                        "6".repeat(64)
                    )),
                }),
                terminal_health: Some(AssessmentWebSocketSuppliedSessionHealthDocument {
                    outcome: "healthy",
                    evidence_reference: Some(format!(
                        "supplied-session-checkpoint-evidence-sha256:{}",
                        "7".repeat(64)
                    )),
                }),
                qualification: "context_qualified",
                continuous_authentication_established: false,
            });
        document
            .claim_limits
            .push("continuous_authentication_not_established");
        document
    }

    #[cfg(all(
        feature = "scanning",
        feature = "websocket-review",
        feature = "supplied-session-review"
    ))]
    fn not_established_supplied_session_websocket_review_document(
    ) -> AssessmentWebSocketReviewAuditDocument {
        let mut document = supplied_session_websocket_review_document();
        let context = document
            .supplied_session_context
            .as_mut()
            .expect("V2 fixture has supplied-session context");
        context.qualification = "not_established";
        document.coverage.terminal = "incomplete";
        document.coverage.completeness = "incomplete";
        document.coverage.first_failure = Some("parent_authority_unavailable");
        document.coverage.request_attempt_count = 1;
        document.coverage.request_admitted_count = 0;
        document.coverage.connection_attempt_count = 0;
        document.coverage.handshake_completed_count = 0;
        document.coverage.outbound_message_count = 0;
        document.coverage.inbound_message_count = 0;
        document.coverage.outbound_control_frame_count = 0;
        document.coverage.inbound_control_frame_count = 0;
        document.coverage.outbound_application_bytes = 0;
        document.coverage.inbound_application_bytes = 0;
        document.coverage.transport_read_bytes = 0;
        document.coverage.transport_write_bytes = 0;
        document.coverage.accounted_request_body_bytes = 0;
        document.coverage.accounted_transport_response_bytes = 0;
        document.coverage.matched_response_count = 0;
        document.coverage.mismatched_response_count = 0;
        for message in &mut document.messages {
            message.inbound_length = None;
            message.status = "not_sent";
        }
        document
    }

    #[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
    fn control_reference_sources() -> Vec<AssessmentControlReferenceSourceDocument> {
        vec![
            AssessmentControlReferenceSourceDocument {
                source_id: "iso-iec-27001-2022-amd-1-2024",
                framework_id: "iso-iec-27001",
                edition: "2022",
                revision_or_amendment: Some("Amd-1:2024"),
                authority_kind: "international_standards_organization",
                source_url: "https://www.iso.org/standard/27001",
                source_verified_at: "2026-09-20",
                mapping_availability: "bibliographic_only_rights_deferred",
                rights_basis: "bibliographic_metadata_only",
            },
            AssessmentControlReferenceSourceDocument {
                source_id: "kvkk-guide-72-2025-04",
                framework_id: "kvkk-personal-data-security-guide",
                edition: "2025-04",
                revision_or_amendment: Some("KVKK-Yayinlari-No-72"),
                authority_kind: "statutory_authority",
                source_url: "https://kvkk.gov.tr/SharedFolderServer/CMSFiles/7512d0d4-f345-41cb-bc5b-8d5cf125e3a1.pdf",
                source_verified_at: "2026-09-20",
                mapping_availability: "relevant_technical_context_only",
                rights_basis: "official_reference_only",
            },
            AssessmentControlReferenceSourceDocument {
                source_id: "kvkk-law-6698-article-12",
                framework_id: "kvkk-law-6698",
                edition: "6698",
                revision_or_amendment: Some("Madde-12"),
                authority_kind: "statutory_authority",
                source_url: "https://www.kvkk.gov.tr/Icerik/2040/Veri-Guvenligine-Iliskin-Yukumlulukler",
                source_verified_at: "2026-09-20",
                mapping_availability: "relevant_technical_context_only",
                rights_basis: "official_reference_only",
            },
            AssessmentControlReferenceSourceDocument {
                source_id: "owasp-top-10-2025",
                framework_id: "owasp-top-10",
                edition: "2025",
                revision_or_amendment: None,
                authority_kind: "community_security_project",
                source_url: "https://top10.owasp.org/2025/0x00_2025-Introduction/",
                source_verified_at: "2026-09-20",
                mapping_availability: "reviewed_identifiers_and_titles",
                rights_basis: "identifiers_and_titles_with_attribution",
            },
            AssessmentControlReferenceSourceDocument {
                source_id: "pci-dss-4.0.1",
                framework_id: "pci-dss",
                edition: "4.0.1",
                revision_or_amendment: Some("published-2024-06-11"),
                authority_kind: "industry_standards_body",
                source_url: "https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1",
                source_verified_at: "2026-09-20",
                mapping_availability: "bibliographic_only_rights_deferred",
                rights_basis: "bibliographic_metadata_only",
            },
        ]
    }

    #[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
    fn selected_empty_control_reference_mapping_audit(
    ) -> AssessmentControlReferenceMappingAuditDocument {
        AssessmentControlReferenceMappingAuditDocument {
            schema: CONTROL_REFERENCE_MAPPING_AUDIT_SCHEMA,
            policy: CONTROL_REFERENCE_MAPPING_POLICY_ID,
            selected: true,
            catalogue: AssessmentControlReferenceCatalogueDocument {
                id: CONTROL_REFERENCE_MAPPING_CATALOGUE_ID,
                revision: CONTROL_REFERENCE_MAPPING_CATALOGUE_REVISION,
            },
            sources: control_reference_sources(),
            coverage: AssessmentControlReferenceCoverageDocument {
                considered_item_count: 0,
                mapped_item_count: 0,
                unmapped_item_count: 0,
                relationship_count: 0,
                reference_link_count: 0,
                omitted_item_count: 0,
                omitted_reference_link_count: 0,
            },
            external_activity: AssessmentControlReferenceExternalActivityDocument {
                target_request_count: 0,
                provider_request_count: 0,
                source_retrieval: "not_performed",
            },
            claim_limits: AssessmentControlReferenceClaimLimitsDocument {
                control_assessment: "not_performed",
                compliance: "not_established",
                certification: "not_established",
                legal_conclusion: "not_established",
                source_authentication: "not_established",
            },
            relationships: Vec::new(),
        }
    }

    #[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
    fn mapped_control_reference_document() -> AssessmentDocument<'static> {
        let mut document = observation_assessment_document("web.passive.csp.missing@1");
        document.items[0].fingerprint = "assessment-fingerprint-v1:csp-missing";
        let mut audit = selected_empty_control_reference_mapping_audit();
        audit.coverage.considered_item_count = 1;
        audit.coverage.mapped_item_count = 1;
        audit.coverage.relationship_count = 1;
        audit.coverage.reference_link_count = 1;
        audit.relationships.push(AssessmentControlReferenceRelationshipDocument {
            item_fingerprint: "assessment-fingerprint-v1:csp-missing".to_owned(),
            capability_id: "web.passive.csp.missing@1".to_owned(),
            cwe: None,
            item_basis: "observation",
            references: vec![AssessmentControlReferenceLinkDocument {
                rule_id: "termivar.mapping.csp-missing-to-owasp-a02-2025@1",
                source_id: "owasp-top-10-2025",
                framework_id: "owasp-top-10",
                edition: "2025",
                control_reference: "A02:2025",
                control_title: Some("Security Misconfiguration"),
                mapping_basis: "exact_capability_and_assessment_basis",
                applicability: "conditional_technical_context",
                applicability_condition:
                    "The mapped item is the exact complete-response CSP-missing observation.",
                assurance: "reviewed_primary_source_identifier",
                original_mapping_rationale: "The exact missing-policy observation is relevant to browser content-policy configuration review; it is not proof of executable injection or a control assessment.",
            }],
        });
        document.control_reference_mapping = Some(audit);
        document
    }

    #[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
    #[test]
    fn selected_empty_control_reference_mapping_is_distinct_and_rendered_in_every_format() {
        let mut document = observation_assessment_document("unmapped.fixture-capability@1");
        document.items.clear();
        document.item_count = 0;
        document.control_reference_mapping = Some(selected_empty_control_reference_mapping_audit());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &value["control_reference_mapping"];
        assert_eq!(audit["selected"], true);
        assert_eq!(audit["coverage"]["considered_item_count"], 0);
        assert_eq!(audit["coverage"]["relationship_count"], 0);
        assert_eq!(audit["relationships"], serde_json::json!([]));
        assert_eq!(audit["external_activity"]["target_request_count"], 0);
        assert_eq!(audit["claim_limits"]["compliance"], "not_established");

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(html.contains("Versioned control-reference mapping audit"));
        assert!(markdown.contains("Versioned control-reference mapping audit"));
        assert!(csv.contains("control_reference_mapping_audit"));
    }

    #[cfg(all(feature = "scanning", feature = "recon-snapshot-import"))]
    #[test]
    fn selected_empty_recon_snapshot_is_rendered_safely_in_every_format() {
        let snapshot = crate::recon_snapshot::parse_recon_snapshot(
            br#"{
                "schema":"security.recon-snapshot/v1",
                "snapshot_id":"synthetic-empty-snapshot",
                "snapshot_revision":"revision-1",
                "sources":[{
                    "source_id":"synthetic-source",
                    "namespace":"owned.fixture",
                    "revision":"source-r1",
                    "provider_time":null,
                    "observed_time":"2026-09-20T10:30:00Z",
                    "collection_method":"owned-offline-fixture",
                    "completeness":"unknown",
                    "origin":"</script><script>synthetic_recon_inert()</script>",
                    "rights":{"status":"permitted_as_declared","attribution":null,"notice":null}
                }],
                "records":[]
            }"#,
        )
        .unwrap();
        let mut document = observation_assessment_document("unmapped.fixture-capability@1");
        document.items.clear();
        document.item_count = 0;
        document.recon_snapshot_import =
            Some(AssessmentReconSnapshotImportAuditDocument::from_audit(&snapshot).unwrap());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert_eq!(value["recon_snapshot_import"]["selected"], true);
        assert_eq!(
            value["recon_snapshot_import"]["records"],
            serde_json::json!([])
        );
        assert_eq!(
            value["recon_snapshot_import"]["claim_limits"]["scan_authority"],
            "not_granted"
        );

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(html.contains("Offline reconnaissance snapshot import"));
        assert!(markdown.contains("Offline reconnaissance snapshot import"));
        assert!(csv.contains("recon_snapshot_import_audit"));
        assert!(!html.contains("<script>synthetic_recon_inert()</script>"));
        let hostile_markdown_line = markdown
            .lines()
            .find(|line| line.contains("<script>synthetic_recon_inert()</script>"))
            .expect("the declared source remains visible in a Markdown code span");
        assert!(hostile_markdown_line.starts_with("- `"));
        assert!(hostile_markdown_line.ends_with('`'));
    }

    #[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
    #[test]
    fn mapped_control_reference_output_preserves_item_identity_and_claim_limits() {
        let document = mapped_control_reference_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        let relationship = &value["control_reference_mapping"]["relationships"][0];
        assert_eq!(
            relationship["item_fingerprint"],
            value["items"][0]["fingerprint"]
        );
        assert_eq!(
            relationship["capability_id"],
            value["items"][0]["capability_id"]
        );
        assert_eq!(relationship["item_basis"], value["items"][0]["claim_basis"]);
        assert_eq!(
            relationship["references"][0]["control_reference"],
            "A02:2025"
        );
        assert_ne!(
            relationship["references"][0]["control_reference"],
            "A03:2021"
        );
        assert_eq!(
            value["control_reference_mapping"]["claim_limits"]["control_assessment"],
            "not_performed"
        );
        assert_eq!(
            value["control_reference_mapping"]["claim_limits"]["legal_conclusion"],
            "not_established"
        );

        for format in [
            ReportFormat::Html,
            ReportFormat::Markdown,
            ReportFormat::Csv,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("A02:2025"));
            assert!(rendered.contains("not_established"));
            assert!(!rendered.contains("A03:2021"));
        }
        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("Security Misconfiguration"));
            assert!(rendered.contains("exact_capability_and_assessment_basis"));
            assert!(rendered.contains(
                "The mapped item is the exact complete-response CSP-missing observation."
            ));
            assert!(rendered.contains("source_verified_at=2026-09-20"));
        }
    }

    #[cfg(all(feature = "scanning", feature = "control-reference-mapping"))]
    #[test]
    fn control_reference_mapping_writer_rejects_cross_link_rights_and_accounting_mutations() {
        let mut missing_item = mapped_control_reference_document();
        missing_item
            .control_reference_mapping
            .as_mut()
            .unwrap()
            .relationships[0]
            .item_fingerprint = "assessment-fingerprint-v1:substituted".to_owned();
        assert_eq!(
            render_assessment_with_limit(&missing_item, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );

        let mut false_activity = mapped_control_reference_document();
        false_activity
            .control_reference_mapping
            .as_mut()
            .unwrap()
            .external_activity
            .target_request_count = 1;
        assert_eq!(
            render_assessment_with_limit(&false_activity, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );

        let mut compliance_claim = mapped_control_reference_document();
        compliance_claim
            .control_reference_mapping
            .as_mut()
            .unwrap()
            .claim_limits
            .compliance = "established";
        assert_eq!(
            render_assessment_with_limit(&compliance_claim, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );

        let mut rights_deferred_link = mapped_control_reference_document();
        let reference = &mut rights_deferred_link
            .control_reference_mapping
            .as_mut()
            .unwrap()
            .relationships[0]
            .references[0];
        reference.source_id = "pci-dss-4.0.1";
        reference.framework_id = "pci-dss";
        reference.edition = "4.0.1";
        reference.control_reference = "requirement-not-retained";
        assert_eq!(
            render_assessment_with_limit(&rights_deferred_link, ReportFormat::Json, usize::MAX,),
            Err(ReportError::Serialization)
        );

        let mut count_mismatch = mapped_control_reference_document();
        count_mismatch
            .control_reference_mapping
            .as_mut()
            .unwrap()
            .coverage
            .reference_link_count = 2;
        assert_eq!(
            render_assessment_with_limit(&count_mismatch, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
    }

    #[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
    fn empty_secret_exposure_audit_document() -> AssessmentSecretExposureAuditDocument {
        AssessmentSecretExposureAuditDocument {
            schema: SECRET_EXPOSURE_AUDIT_SCHEMA,
            policy: SECRET_EXPOSURE_POLICY_ID,
            catalogue_id: SECRET_EXPOSURE_CATALOGUE_ID,
            catalogue_revision: SECRET_EXPOSURE_CATALOGUE_REVISION,
            representation: SECRET_EXPOSURE_REPRESENTATION,
            context: SECRET_EXPOSURE_CONTEXT,
            selected: true,
            additional_request_count: 0,
            response_count: 0,
            evaluated_response_count: 0,
            not_evaluated_response_count: 0,
            body_derived_projection_suppressed_response_count: 0,
            interpreted_byte_count: 0,
            per_response_byte_limit: u64::try_from(MAX_SECRET_EXPOSURE_BODY_BYTES).unwrap(),
            total_byte_limit: MAX_SECRET_EXPOSURE_TOTAL_BODY_BYTES,
            observation_count: 0,
            omitted_observation_count: 0,
            match_occurrence_count: 0,
            outcomes: Vec::new(),
            observations: Vec::new(),
            source_authentication: "not_established",
            secret_validity: "not_tested",
            provider_validation: "not_performed",
            exploit_execution: "not_performed",
            impact_validation: "not_performed",
            raw_values_retained: false,
            public_secret_hashes_retained: false,
        }
    }

    #[cfg(all(feature = "scanning", feature = "tls-observation"))]
    fn tls_observation_audit_document() -> AssessmentTlsObservationAuditDocument {
        AssessmentTlsObservationAuditDocument {
            schema: TLS_OBSERVATION_AUDIT_SCHEMA,
            policy: TLS_OBSERVATION_POLICY_ID,
            selected: true,
            additional_request_count: 0,
            assessment_request_count: 2,
            target_scheme: "https",
            observation_source_scope: TLS_OBSERVATION_SOURCE_SCOPE,
            observation_clock_assurance: TLS_OBSERVATION_CLOCK_ASSURANCE,
            successful_https_response_count: 2,
            plaintext_response_count: 0,
            tls_info_unavailable_count: 0,
            malformed_certificate_count: 0,
            certificate_limit_rejection_count: 0,
            unretained_leaf_response_count: 0,
            leaf_observation_count: 1,
            protocol: TLS_OBSERVATION_BACKEND_LIMIT,
            cipher_suite: TLS_OBSERVATION_BACKEND_LIMIT,
            alpn_protocol: TLS_OBSERVATION_BACKEND_LIMIT,
            full_chain: TLS_OBSERVATION_BACKEND_LIMIT,
            connection_reuse: TLS_OBSERVATION_BACKEND_LIMIT,
            session_resumption: TLS_OBSERVATION_BACKEND_LIMIT,
            handshake_kind: TLS_OBSERVATION_BACKEND_LIMIT,
            revocation: TLS_OBSERVATION_REVOCATION_STATUS,
            transport_validation_scope: TLS_OBSERVATION_VALIDATION_SCOPE,
            active_tls_matrix: "not_performed",
            source_authentication: "not_established",
            observations: vec![AssessmentTlsLeafObservationDocument {
                leaf_certificate_sha256:
                    "abababababababababababababababababababababababababababababababab".to_owned(),
                leaf_certificate_byte_length: 768,
                not_before_epoch_seconds: 100,
                not_after_epoch_seconds: 300,
                observed_at_epoch_seconds: 200,
                dns_san_count: 2,
                ip_san_count: 1,
                other_san_count: 0,
                san_count_truncated: false,
                certificate_time_status: "valid_at_observation",
                response_occurrence_count: 2,
                standard_transport_validation_succeeded: true,
            }],
        }
    }

    #[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
    fn tls_negotiation_review_audit_document() -> AssessmentTlsNegotiationReviewAuditDocument {
        AssessmentTlsNegotiationReviewAuditDocument {
            schema: TLS_NEGOTIATION_REVIEW_AUDIT_SCHEMA,
            policy: TLS_NEGOTIATION_REVIEW_POLICY_ID,
            selected: true,
            methodology: AssessmentTlsNegotiationMethodologyDocument {
                target_binding: "selected_https_target_exact_host_sni_port",
                address_selection: "single_deterministic_address_under_selected_authority",
                execution_order: "tls13_then_tls12_then_backend_unsupported_rows",
                maximum_in_flight_connections: 1,
                network_capable_cell_count: 2,
                matrix_cell_count: 5,
                retries: "none",
                redirects: "none",
                proxy: "not_used",
                application_data: "not_sent",
                credentials: "not_sent",
                client_certificate: "not_sent",
                alpn: "not_offered",
                session_resumption: "disabled",
                certificate_validation: "standard_configured_trust",
            },
            coverage: AssessmentTlsNegotiationCoverageDocument {
                terminal: "completed",
                connection_attempt_limit: 2,
                connection_in_flight_limit: 1,
                per_connection_ingress_byte_limit: 128 * 1_024,
                total_ingress_byte_limit: 256 * 1_024,
                per_connection_egress_byte_limit: 64 * 1_024,
                total_egress_byte_limit: 128 * 1_024,
                attempted_connection_count: 2,
                completed_handshake_count: 2,
                accounted_ingress_tls_bytes: 3_948,
                observed_egress_tls_bytes: 496,
                client_backend_unsupported_cell_count: 3,
            },
            capability_observations: vec![
                AssessmentTlsNegotiationCellDocument {
                    cell_id: "tls13_default_provider",
                    offered_protocol: "tls1.3",
                    client_backend: "rustls-ring",
                    dispatch_status: "dispatched",
                    outcome: "negotiated",
                    support: "observed_supported",
                    transport_validation: "succeeded",
                    negotiated_protocol: Some("tls1.3"),
                    negotiated_cipher_suite: Some("tls13_aes_256_gcm_sha384"),
                    accounted_ingress_tls_bytes: 2_048,
                    observed_egress_tls_bytes: 256,
                },
                AssessmentTlsNegotiationCellDocument {
                    cell_id: "tls12_default_provider",
                    offered_protocol: "tls1.2",
                    client_backend: "rustls-ring",
                    dispatch_status: "dispatched",
                    outcome: "negotiated",
                    support: "observed_supported",
                    transport_validation: "succeeded",
                    negotiated_protocol: Some("tls1.2"),
                    negotiated_cipher_suite: Some("tls12_ecdhe_rsa_aes_128_gcm_sha256"),
                    accounted_ingress_tls_bytes: 1_900,
                    observed_egress_tls_bytes: 240,
                },
                AssessmentTlsNegotiationCellDocument {
                    cell_id: "tls11_legacy_protocol",
                    offered_protocol: "tls1.1",
                    client_backend: "rustls-ring",
                    dispatch_status: "not_dispatched",
                    outcome: "client_backend_unsupported",
                    support: "not_tested_client_backend_unsupported",
                    transport_validation: "not_applicable",
                    negotiated_protocol: None,
                    negotiated_cipher_suite: None,
                    accounted_ingress_tls_bytes: 0,
                    observed_egress_tls_bytes: 0,
                },
                AssessmentTlsNegotiationCellDocument {
                    cell_id: "tls10_legacy_protocol",
                    offered_protocol: "tls1.0",
                    client_backend: "rustls-ring",
                    dispatch_status: "not_dispatched",
                    outcome: "client_backend_unsupported",
                    support: "not_tested_client_backend_unsupported",
                    transport_validation: "not_applicable",
                    negotiated_protocol: None,
                    negotiated_cipher_suite: None,
                    accounted_ingress_tls_bytes: 0,
                    observed_egress_tls_bytes: 0,
                },
                AssessmentTlsNegotiationCellDocument {
                    cell_id: "legacy_cipher_suites",
                    offered_protocol: "legacy_cipher_suites",
                    client_backend: "rustls-ring",
                    dispatch_status: "not_dispatched",
                    outcome: "client_backend_unsupported",
                    support: "not_tested_client_backend_unsupported",
                    transport_validation: "not_applicable",
                    negotiated_protocol: None,
                    negotiated_cipher_suite: None,
                    accounted_ingress_tls_bytes: 0,
                    observed_egress_tls_bytes: 0,
                },
            ],
            claim_limits: TLS_NEGOTIATION_REVIEW_CLAIM_LIMITS,
        }
    }

    #[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
    fn jwt_policy_review_audit_document() -> AssessmentJwtPolicyReviewAuditDocument {
        AssessmentJwtPolicyReviewAuditDocument {
            schema: JWT_POLICY_REVIEW_AUDIT_SCHEMA,
            policy: JWT_POLICY_REVIEW_POLICY_ID,
            selected: true,
            parsing_status: "parsed",
            parsing_rejection: None,
            policy_status: "consistent",
            local_signature_status: "verified",
            target_acceptance_status: "not_performed",
            methodology: AssessmentJwtPolicyMethodologyDocument {
                algorithm: JWT_POLICY_ALGORITHM,
                representation: JWT_POLICY_REPRESENTATION,
                local_key_source: JWT_POLICY_LOCAL_KEY_SOURCE,
                key_source_assurance: JWT_POLICY_KEY_SOURCE_ASSURANCE,
                token_carried_key_selection: JWT_POLICY_TOKEN_KEY_SELECTION,
                operator_policy_reference: "synthetic-policy".to_owned(),
                operator_policy_revision: "synthetic-policy-v1".to_owned(),
                local_public_key_sha256: format!("sha256:{}", "a".repeat(64)),
                expected_type_selected: true,
                expected_issuer_selected: true,
                expected_audience_selected: true,
                required_claim_count: 2,
                require_expiration: true,
                allowed_clock_skew_seconds: 30,
                evaluation_time_unix_seconds: 1_700_000_000,
                clock_assurance: JWT_POLICY_CLOCK_ASSURANCE,
            },
            external_activity: AssessmentJwtExternalActivityDocument {
                target_request_count: 0,
                remote_key_retrieval: JWT_POLICY_EXTERNAL_NOT_PERFORMED,
                token_forwarding: JWT_POLICY_EXTERNAL_NOT_PERFORMED,
            },
            policy_violations: Vec::new(),
            source_authentication: JWT_POLICY_SOURCE_AUTHENTICATION,
            #[cfg(feature = "jwt-target-acceptance-review")]
            preparation_reference: None,
            #[cfg(feature = "jwt-target-acceptance-review")]
            target_acceptance: None,
        }
    }

    #[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
    fn jwt_target_policy_review_audit_document() -> AssessmentJwtPolicyReviewAuditDocument {
        let policy = crate::jwt_target_acceptance::JwtTargetAcceptancePolicy::new(
            ("synthetic-target-policy", "synthetic-target-v1"),
            url::Url::parse("https://owned.invalid/app/").unwrap(),
            url::Url::parse("https://owned.invalid/app/canary").unwrap(),
            "protected-canary",
            "private-marker-sentinel",
        )
        .unwrap();
        let markers = [
            JwtTargetAcceptanceMarkerStatus::Observed,
            JwtTargetAcceptanceMarkerStatus::NotObserved,
            JwtTargetAcceptanceMarkerStatus::Observed,
            JwtTargetAcceptanceMarkerStatus::Observed,
            JwtTargetAcceptanceMarkerStatus::NotObserved,
            JwtTargetAcceptanceMarkerStatus::Observed,
        ];
        let legs = JwtTargetAcceptanceLegRole::ORDERED
            .into_iter()
            .zip(markers)
            .enumerate()
            .map(|(index, (role, marker))| {
                let retained_response_bytes = u64::try_from(index + 101).unwrap();
                let accounted_transport_response_bytes = if index == 0 {
                    70_000
                } else {
                    retained_response_bytes
                };
                crate::jwt_target_acceptance::JwtTargetAcceptanceLegFact::new_with_transport_accounting(
                    role,
                    JwtTargetAcceptanceDispatchStatus::Dispatched,
                    JwtTargetAcceptanceCommitStatus::Committed,
                    JwtTargetAcceptanceResponseStatus::CompleteAndClassified,
                    marker,
                    retained_response_bytes,
                    accounted_transport_response_bytes,
                    Some(format!("jwt-target-leg:{:064x}", index + 1)),
                )
                .unwrap()
            })
            .collect();
        let preparation_binding =
            crate::jwt_target_acceptance::JwtTargetAcceptanceBinding::synthetic_for_test(0x5A);
        let target = JwtTargetAcceptanceAudit::from_legs(&policy, legs)
            .unwrap()
            .bind_to_preparation(preparation_binding.clone());
        let target = AssessmentJwtTargetAcceptanceAuditDocument::from_audit(&target).unwrap();
        let mut document = jwt_policy_review_audit_document();
        document.schema = JWT_POLICY_REVIEW_AUDIT_SCHEMA_V2;
        document.target_acceptance_status = target.status;
        document.external_activity.target_request_count =
            target.accounting.dispatched_request_count;
        document.external_activity.token_forwarding = "performed";
        document.preparation_reference = Some(preparation_binding.reference());
        document.target_acceptance = Some(target);
        document
    }

    #[cfg(all(feature = "scanning", feature = "authorization-review"))]
    #[test]
    fn positive_authorization_audit_requires_all_three_relational_proofs() {
        let document = observation_assessment_document(RESOURCE_AUTHORIZATION_REVIEW_CAPABILITY_ID);
        let valid = AssessmentAuthorizationAuditDocument {
            schema: "security.authorization-review-audit/v1",
            capability_id: RESOURCE_AUTHORIZATION_REVIEW_CAPABILITY_ID,
            policy_id: format!("authorization-policy-sha256:{}", "a".repeat(64)),
            selected_path_count: 1,
            ignored_path_count: 0,
            request_count: 4,
            outcome: "stable_cross_principal_equivalence",
            primary_stable: Some(true),
            peer_stable: Some(true),
            cross_resources_equivalent: Some(true),
            item_projected: true,
        };
        assert_eq!(valid.validate(&document.items), Ok(()));

        for (primary, peer, cross) in [
            (None, Some(true), Some(true)),
            (Some(false), Some(true), Some(true)),
            (Some(true), None, Some(true)),
            (Some(true), Some(false), Some(true)),
            (Some(true), Some(true), None),
            (Some(true), Some(true), Some(false)),
        ] {
            let invalid = AssessmentAuthorizationAuditDocument {
                primary_stable: primary,
                peer_stable: peer,
                cross_resources_equivalent: cross,
                ..AssessmentAuthorizationAuditDocument {
                    schema: valid.schema,
                    capability_id: valid.capability_id,
                    policy_id: valid.policy_id.clone(),
                    selected_path_count: valid.selected_path_count,
                    ignored_path_count: valid.ignored_path_count,
                    request_count: valid.request_count,
                    outcome: valid.outcome,
                    primary_stable: valid.primary_stable,
                    peer_stable: valid.peer_stable,
                    cross_resources_equivalent: valid.cross_resources_equivalent,
                    item_projected: valid.item_projected,
                }
            };
            assert_eq!(
                invalid.validate(&document.items),
                Err(ReportError::Serialization)
            );
        }
    }

    #[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
    #[test]
    fn jwt_policy_review_audit_is_value_free_and_rendered_in_every_format() {
        let mut document = observation_assessment_document("unrelated.observation@1");
        document.jwt_policy_review = Some(jwt_policy_review_audit_document());

        for format in [
            ReportFormat::Json,
            ReportFormat::Csv,
            ReportFormat::Html,
            ReportFormat::Markdown,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("security.jwt-policy-review-audit/v1"));
            assert!(rendered.contains("termivar.jwt-local-policy/es256-v1"));
            assert!(rendered.contains("explicit_operator_supplied_public_jwk"));
            assert!(rendered.contains("operator_supplied_not_authenticated"));
            assert!(rendered.contains("not_performed"));
            assert!(!rendered.contains("synthetic-secret-claim-value"));
            assert!(!rendered.contains("BEGIN PRIVATE KEY"));
        }

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &value["jwt_policy_review"];
        assert_eq!(audit["parsing_status"], "parsed");
        assert_eq!(audit["policy_status"], "consistent");
        assert_eq!(audit["local_signature_status"], "verified");
        assert_eq!(audit["target_acceptance_status"], "not_performed");
        assert_eq!(audit["external_activity"]["target_request_count"], 0);
        assert_eq!(audit["policy_violations"], serde_json::json!([]));
        assert!(audit.get("parsing_rejection").is_none());
        assert!(audit.get("raw_token").is_none());
        assert!(audit.get("claims").is_none());
        assert!(audit.get("verification_key").is_none());

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        let rows: Vec<Vec<String>> = csv.lines().map(parse_csv_line).collect();
        let headers = &rows[0];
        let column = |name: &str| headers.iter().position(|header| header == name).unwrap();
        let audit_row = rows
            .iter()
            .find(|row| row[column("record_type")] == "jwt_policy_review_audit")
            .unwrap();
        assert_eq!(audit_row[column("evidence_count")], "0");
    }

    #[cfg(all(feature = "scanning", feature = "jwt-policy-review"))]
    #[test]
    fn jwt_policy_review_writer_rejects_boundary_and_state_mutations() {
        let mut document = observation_assessment_document("unrelated.observation@1");
        document.jwt_policy_review = Some(jwt_policy_review_audit_document());
        assert!(render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).is_ok());

        document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .methodology
            .algorithm = "none";
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .methodology
            .algorithm = JWT_POLICY_ALGORITHM;
        document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .methodology
            .expected_type_selected = false;
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .methodology
            .expected_type_selected = true;
        document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .methodology
            .local_public_key_sha256 = "sha256:NOT-HEX".to_owned();
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .methodology
            .local_public_key_sha256 = format!("sha256:{}", "a".repeat(64));
        document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .external_activity
            .target_request_count = 1;
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        let audit = document.jwt_policy_review.as_mut().unwrap();
        audit.external_activity.target_request_count = 0;
        audit.policy_status = "inconsistent";
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        let audit = document.jwt_policy_review.as_mut().unwrap();
        audit.policy_violations = vec![AssessmentJwtPolicyViolationDocument {
            kind: "missing_required_claim",
            ordinal: Some(1),
        }];
        assert!(render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).is_ok());
        document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .policy_violations
            .push(AssessmentJwtPolicyViolationDocument {
                kind: "missing_required_claim",
                ordinal: Some(1),
            });
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
    }

    #[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
    #[test]
    fn jwt_target_selected_writer_is_strict_value_free_and_preserves_transport_accounting() {
        let mut document = observation_assessment_document("unrelated.observation@1");
        document.jwt_policy_review = Some(jwt_target_policy_review_audit_document());

        for format in [
            ReportFormat::Json,
            ReportFormat::Csv,
            ReportFormat::Html,
            ReportFormat::Markdown,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("security.jwt-policy-review-audit/v2"));
            assert!(rendered
                .contains("invalid_signature_control_marker_observed_with_anonymous_control"));
            assert!(!rendered.contains("private-marker-sentinel"));
            assert!(!rendered.contains("https://owned.invalid"));
        }

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        let target = &value["jwt_policy_review"]["target_acceptance"];
        assert_eq!(target["accounting"]["retained_response_bytes"], 621);
        assert_eq!(
            target["accounting"]["accounted_transport_response_bytes"],
            70_520
        );
        assert_eq!(target["legs"][0]["retained_response_bytes"], 101);
        assert_eq!(
            target["legs"][0]["accounted_transport_response_bytes"],
            70_000
        );
        assert_eq!(target["legs"].as_array().unwrap().len(), 6);

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        let rows: Vec<Vec<String>> = csv.lines().map(parse_csv_line).collect();
        let headers = &rows[0];
        let column = |name: &str| headers.iter().position(|header| header == name).unwrap();
        let audit_row = rows
            .iter()
            .find(|row| row[column("record_type")] == "jwt_policy_review_audit")
            .unwrap();
        assert_eq!(audit_row[column("evidence_count")], "6");

        let mut cancelled_document = observation_assessment_document("unrelated.observation@1");
        let mut cancelled = jwt_target_policy_review_audit_document();
        cancelled.target_acceptance_status = "not_performed";
        cancelled.external_activity.target_request_count = 0;
        cancelled.external_activity.token_forwarding = JWT_POLICY_EXTERNAL_NOT_PERFORMED;
        let cancelled_target = cancelled.target_acceptance.as_mut().unwrap();
        cancelled_target.status = "not_performed";
        cancelled_target.accounting.dispatched_request_count = 0;
        cancelled_target.accounting.dispatched_passive_request_count = 0;
        cancelled_target.accounting.dispatched_active_request_count = 0;
        cancelled_target.accounting.committed_response_count = 0;
        cancelled_target.accounting.retained_response_bytes = 0;
        cancelled_target
            .accounting
            .accounted_transport_response_bytes = 0;
        cancelled_target.dimensions.valid_marker = "not_evaluated";
        cancelled_target.dimensions.anonymous_marker = "not_evaluated";
        cancelled_target.dimensions.invalid_marker = "not_evaluated";
        cancelled_target.conclusion = AssessmentJwtTargetAcceptanceConclusionDocument {
            kind: "incomplete",
            incomplete_reason: Some(AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
                kind: "leg_not_dispatched",
                role: Some("valid_candidate"),
                not_eligible_reason: None,
            }),
        };
        for leg in &mut cancelled_target.legs {
            leg.dispatch_status = "not_dispatched";
            leg.commit_status = "not_committed";
            leg.response_status = "not_classified";
            leg.marker_status = "not_evaluated";
            leg.retained_response_bytes = 0;
            leg.accounted_transport_response_bytes = 0;
            leg.evidence_reference = None;
        }
        cancelled_document.jwt_policy_review = Some(cancelled);
        assert!(
            render_assessment_with_limit(&cancelled_document, ReportFormat::Json, usize::MAX,)
                .is_ok()
        );
        let cancelled_csv =
            render_assessment_with_limit(&cancelled_document, ReportFormat::Csv, usize::MAX)
                .unwrap();
        let cancelled_rows: Vec<Vec<String>> = cancelled_csv.lines().map(parse_csv_line).collect();
        let cancelled_headers = &cancelled_rows[0];
        let cancelled_column = |name: &str| {
            cancelled_headers
                .iter()
                .position(|header| header == name)
                .unwrap()
        };
        let cancelled_audit_row = cancelled_rows
            .iter()
            .find(|row| row[cancelled_column("record_type")] == "jwt_policy_review_audit")
            .unwrap();
        assert_eq!(cancelled_audit_row[cancelled_column("evidence_count")], "0");
        cancelled_document
            .jwt_policy_review
            .as_mut()
            .unwrap()
            .local_signature_status = "invalid";
        assert_eq!(
            render_assessment_with_limit(&cancelled_document, ReportFormat::Json, usize::MAX,),
            Err(ReportError::Serialization)
        );

        let audit = document.jwt_policy_review.as_mut().unwrap();
        audit.local_signature_status = "invalid";
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        let audit = document.jwt_policy_review.as_mut().unwrap();
        audit.local_signature_status = "verified";
        audit
            .target_acceptance
            .as_mut()
            .unwrap()
            .accounting
            .committed_response_count = 5;
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
    }

    #[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
    #[test]
    fn jwt_target_human_renderers_preserve_value_free_incomplete_reasons() {
        for (reason, other_reason) in [
            (
                "runtime_authority_unavailable",
                "request_budget_unavailable",
            ),
            (
                "request_budget_unavailable",
                "runtime_authority_unavailable",
            ),
        ] {
            let mut document = observation_assessment_document("unrelated.observation@1");
            let mut audit = jwt_target_policy_review_audit_document();
            audit.target_acceptance_status = "not_performed";
            audit.external_activity.target_request_count = 0;
            audit.external_activity.token_forwarding = JWT_POLICY_EXTERNAL_NOT_PERFORMED;
            let target = audit.target_acceptance.as_mut().unwrap();
            target.status = "not_performed";
            target.accounting.dispatched_request_count = 0;
            target.accounting.dispatched_passive_request_count = 0;
            target.accounting.dispatched_active_request_count = 0;
            target.accounting.committed_response_count = 0;
            target.accounting.retained_response_bytes = 0;
            target.accounting.accounted_transport_response_bytes = 0;
            target.dimensions.valid_marker = "not_evaluated";
            target.dimensions.anonymous_marker = "not_evaluated";
            target.dimensions.invalid_marker = "not_evaluated";
            target.legs.clear();
            target.conclusion = AssessmentJwtTargetAcceptanceConclusionDocument {
                kind: "incomplete",
                incomplete_reason: Some(AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
                    kind: "not_eligible",
                    role: None,
                    not_eligible_reason: Some(reason),
                }),
            };
            document.jwt_policy_review = Some(audit);

            let expected = format!("kind=not_eligible;not_eligible_reason={reason}");
            for format in [ReportFormat::Html, ReportFormat::Markdown] {
                let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
                assert!(rendered.contains("Target incomplete reason"));
                assert!(rendered.contains(&expected));
                assert!(!rendered.contains(other_reason));
                assert!(!rendered.contains("private-marker-sentinel"));
                assert!(!rendered.contains("https://owned.invalid"));
            }
        }

        let mut document = observation_assessment_document("unrelated.observation@1");
        let mut audit = jwt_target_policy_review_audit_document();
        audit.target_acceptance_status = "not_performed";
        audit.external_activity.target_request_count = 0;
        audit.external_activity.token_forwarding = JWT_POLICY_EXTERNAL_NOT_PERFORMED;
        let target = audit.target_acceptance.as_mut().unwrap();
        target.status = "not_performed";
        target.accounting.dispatched_request_count = 0;
        target.accounting.dispatched_passive_request_count = 0;
        target.accounting.dispatched_active_request_count = 0;
        target.accounting.committed_response_count = 0;
        target.accounting.retained_response_bytes = 0;
        target.accounting.accounted_transport_response_bytes = 0;
        target.dimensions.valid_marker = "not_evaluated";
        target.dimensions.anonymous_marker = "not_evaluated";
        target.dimensions.invalid_marker = "not_evaluated";
        target.conclusion = AssessmentJwtTargetAcceptanceConclusionDocument {
            kind: "incomplete",
            incomplete_reason: Some(AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
                kind: "leg_not_dispatched",
                role: Some("valid_candidate"),
                not_eligible_reason: None,
            }),
        };
        for leg in &mut target.legs {
            leg.dispatch_status = "not_dispatched";
            leg.commit_status = "not_committed";
            leg.response_status = "not_classified";
            leg.marker_status = "not_evaluated";
            leg.retained_response_bytes = 0;
            leg.accounted_transport_response_bytes = 0;
            leg.evidence_reference = None;
        }
        document.jwt_policy_review = Some(audit);
        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("kind=leg_not_dispatched;role=valid_candidate"));
            assert!(!rendered.contains("private-marker-sentinel"));
            assert!(!rendered.contains("https://owned.invalid"));
        }
    }

    #[cfg(all(feature = "scanning", feature = "jwt-target-acceptance-review"))]
    #[test]
    fn jwt_target_writer_rejects_binding_and_derived_state_mutations() {
        let render = |audit: AssessmentJwtPolicyReviewAuditDocument| {
            let mut document = observation_assessment_document("unrelated.observation@1");
            document.jwt_policy_review = Some(audit);
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX)
        };

        let mut mismatched_binding = jwt_target_policy_review_audit_document();
        mismatched_binding.preparation_reference =
            Some(format!("jwt-target-preparation:{}", "b".repeat(64)));
        assert_eq!(render(mismatched_binding), Err(ReportError::Serialization));

        let mut invalid_dimension = jwt_target_policy_review_audit_document();
        invalid_dimension
            .target_acceptance
            .as_mut()
            .unwrap()
            .dimensions
            .invalid_marker = "not_observed_stable";
        assert_eq!(render(invalid_dimension), Err(ReportError::Serialization));

        let mut invalid_conclusion = jwt_target_policy_review_audit_document();
        invalid_conclusion
            .target_acceptance
            .as_mut()
            .unwrap()
            .conclusion = AssessmentJwtTargetAcceptanceConclusionDocument {
            kind: "inconclusive",
            incomplete_reason: None,
        };
        assert_eq!(render(invalid_conclusion), Err(ReportError::Serialization));

        let mut post_stop_dispatch = jwt_target_policy_review_audit_document();
        let target = post_stop_dispatch.target_acceptance.as_mut().unwrap();
        let first = &mut target.legs[0];
        first.commit_status = "not_committed";
        first.response_status = "incomplete";
        first.marker_status = "not_evaluated";
        first.evidence_reference = None;
        target.accounting.committed_response_count -= 1;
        assert_eq!(render(post_stop_dispatch), Err(ReportError::Serialization));

        let mut empty = jwt_target_policy_review_audit_document()
            .target_acceptance
            .take()
            .unwrap();
        empty.status = "not_performed";
        empty.accounting.dispatched_request_count = 0;
        empty.accounting.dispatched_passive_request_count = 0;
        empty.accounting.dispatched_active_request_count = 0;
        empty.accounting.committed_response_count = 0;
        empty.accounting.retained_response_bytes = 0;
        empty.accounting.accounted_transport_response_bytes = 0;
        empty.dimensions.valid_marker = "not_evaluated";
        empty.dimensions.anonymous_marker = "not_evaluated";
        empty.dimensions.invalid_marker = "not_evaluated";
        empty.legs.clear();
        empty.conclusion = AssessmentJwtTargetAcceptanceConclusionDocument {
            kind: "incomplete",
            incomplete_reason: Some(AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
                kind: "not_eligible",
                role: None,
                not_eligible_reason: Some("local_signature_not_established"),
            }),
        };
        assert!(empty.validate().is_ok());
        empty.conclusion = AssessmentJwtTargetAcceptanceConclusionDocument {
            kind: "incomplete",
            incomplete_reason: Some(AssessmentJwtTargetAcceptanceIncompleteReasonDocument {
                kind: "leg_not_dispatched",
                role: Some("valid_candidate"),
                not_eligible_reason: None,
            }),
        };
        assert_eq!(empty.validate(), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "tls-observation"))]
    #[test]
    fn tls_observation_audit_is_rendered_honestly_in_every_format() {
        let mut document = observation_assessment_document("unrelated.observation@1");
        document.tls_observation = Some(tls_observation_audit_document());

        for format in [
            ReportFormat::Json,
            ReportFormat::Csv,
            ReportFormat::Html,
            ReportFormat::Markdown,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("security.tls-observation-audit/v1"));
            assert!(rendered.contains("termivar.existing-connection-tls-observation/v1"));
            assert!(rendered.contains("not_exposed_by_backend"));
            assert!(rendered.contains("not_checked"));
            assert!(rendered.contains("not_established"));
            assert!(rendered
                .contains("abababababababababababababababababababababababababababababababab"));
            assert!(!rendered.contains("certificate.example.test"));
            assert!(!rendered.contains("BEGIN CERTIFICATE"));
        }

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &value["tls_observation"];
        assert_eq!(audit["additional_request_count"], 0);
        assert_eq!(audit["assessment_request_count"], 2);
        assert_eq!(
            audit["observation_source_scope"],
            "assessment_exact_origin_existing_connections/v1"
        );
        assert_eq!(
            audit["observation_clock_assurance"],
            "local_system_clock_not_independently_verified"
        );
        assert_eq!(audit["leaf_observation_count"], 1);
        assert_eq!(audit["alpn_protocol"], "not_exposed_by_backend");
        assert_eq!(audit["session_resumption"], "not_exposed_by_backend");
        assert_eq!(audit["active_tls_matrix"], "not_performed");
        assert_eq!(
            audit["observations"][0]["standard_transport_validation_succeeded"],
            true
        );
    }

    #[cfg(all(feature = "scanning", feature = "tls-observation"))]
    #[test]
    fn tls_observation_writer_rejects_accounting_and_claim_mutations() {
        let mut document = observation_assessment_document("unrelated.observation@1");
        document.tls_observation = Some(tls_observation_audit_document());
        assert!(render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).is_ok());

        document
            .tls_observation
            .as_mut()
            .unwrap()
            .observation_source_scope = "unscoped";
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        document
            .tls_observation
            .as_mut()
            .unwrap()
            .observation_source_scope = TLS_OBSERVATION_SOURCE_SCOPE;
        document
            .tls_observation
            .as_mut()
            .unwrap()
            .observation_clock_assurance = "verified";
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        document
            .tls_observation
            .as_mut()
            .unwrap()
            .observation_clock_assurance = TLS_OBSERVATION_CLOCK_ASSURANCE;

        document
            .tls_observation
            .as_mut()
            .unwrap()
            .successful_https_response_count = 1;
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        document
            .tls_observation
            .as_mut()
            .unwrap()
            .successful_https_response_count = 2;
        document
            .tls_observation
            .as_mut()
            .unwrap()
            .assessment_request_count = 1;
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        document
            .tls_observation
            .as_mut()
            .unwrap()
            .assessment_request_count = 2;
        document.tls_observation.as_mut().unwrap().alpn_protocol = "h2";
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
        let audit = document.tls_observation.as_mut().unwrap();
        audit.alpn_protocol = TLS_OBSERVATION_BACKEND_LIMIT;
        audit.observations[0].san_count_truncated = true;
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );
    }

    #[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
    #[test]
    fn tls_negotiation_review_audit_is_rendered_honestly_in_every_format() {
        // This test also sends the rendered document through the strict saved-
        // report reader. The generic renderer fixture reuses this literal for
        // every item string, including `fingerprint`, so use an independently
        // valid digest rather than a display-only capability label.
        let mut document = observation_assessment_document(concat!(
            "sha256:",
            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        ));
        #[cfg(feature = "tls-observation")]
        {
            document.tls_observation = Some(tls_observation_audit_document());
        }
        document.tls_negotiation_review = Some(tls_negotiation_review_audit_document());

        for format in [
            ReportFormat::Json,
            ReportFormat::Csv,
            ReportFormat::Html,
            ReportFormat::Markdown,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("security.tls-negotiation-review-audit/v1"));
            assert!(rendered.contains("termivar.active-tls-negotiation-review/v1"));
            assert!(rendered.contains("tls13_default_provider"));
            assert!(rendered.contains("tls12_default_provider"));
            assert!(rendered.contains("client_backend_unsupported"));
            assert!(rendered.contains("finite_matrix_not_complete_server_capability_enumeration"));
            assert!(!rendered.contains("owned-tls.private.invalid"));
            assert!(!rendered.contains("BEGIN CERTIFICATE"));
            assert!(!rendered.contains("Authorization: Bearer"));
        }

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        comparison::import_assessment_summary(json.as_bytes()).unwrap();
        let self_comparison = comparison::compare_reports(
            json.as_bytes(),
            json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let self_comparison: serde_json::Value = serde_json::from_str(&self_comparison).unwrap();
        assert_eq!(
            self_comparison["tls_negotiation_review_comparison"]["status"],
            "compared"
        );
        for facet in ["methodology", "coverage", "capability_observations"] {
            assert_eq!(
                self_comparison["tls_negotiation_review_comparison"][facet]["status"],
                "unchanged"
            );
        }
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &value["tls_negotiation_review"];
        assert_eq!(audit["selected"], true);
        assert_eq!(audit["coverage"]["terminal"], "completed");
        assert_eq!(audit["coverage"]["attempted_connection_count"], 2);
        assert_eq!(audit["coverage"]["completed_handshake_count"], 2);
        assert_eq!(
            audit["capability_observations"].as_array().unwrap().len(),
            5
        );
        assert_eq!(
            audit["capability_observations"][0]["negotiated_protocol"],
            "tls1.3"
        );
        assert_eq!(
            audit["capability_observations"][1]["negotiated_protocol"],
            "tls1.2"
        );
        assert_eq!(
            audit["capability_observations"][2]["support"],
            "not_tested_client_backend_unsupported"
        );
        assert!(audit.get("host").is_none());
        assert!(audit.get("resolved_address").is_none());
        assert!(audit.get("certificate").is_none());
        assert!(audit.get("error").is_none());
        #[cfg(feature = "tls-observation")]
        assert_eq!(
            value["tls_observation"]["active_tls_matrix"],
            "not_performed"
        );

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        let rows: Vec<Vec<String>> = csv.lines().map(parse_csv_line).collect();
        assert!(rows
            .iter()
            .all(|row| row.len() == ASSESSMENT_CSV_HEADERS.len()));
        assert!(rows.iter().any(|row| row
            .first()
            .is_some_and(|cell| cell == "tls_negotiation_review_audit")));
    }

    #[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
    #[test]
    fn tls_negotiation_review_writer_rejects_incomplete_terminal_shapes() {
        let render = |audit: AssessmentTlsNegotiationReviewAuditDocument| {
            let mut document = observation_assessment_document("unrelated.observation@1");
            document.tls_negotiation_review = Some(audit);
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX)
        };

        let producer_parent_unavailable =
            WebAssessmentTlsNegotiationReviewAudit::parent_authority_unavailable();
        assert_eq!(
            AssessmentTlsNegotiationReviewAuditDocument::from_audit(&producer_parent_unavailable)
                .map(|_| ()),
            Err(ReportError::Serialization)
        );

        let mut parent_unavailable = tls_negotiation_review_audit_document();
        for cell in parent_unavailable
            .capability_observations
            .iter_mut()
            .take(2)
        {
            cell.dispatch_status = "not_dispatched";
            cell.outcome = "parent_authority_unavailable";
            cell.support = "not_established";
            cell.transport_validation = "not_established";
            cell.negotiated_protocol = None;
            cell.negotiated_cipher_suite = None;
            cell.accounted_ingress_tls_bytes = 0;
            cell.observed_egress_tls_bytes = 0;
        }
        parent_unavailable.coverage.terminal = "parent_authority_unavailable";
        parent_unavailable.coverage.attempted_connection_count = 0;
        parent_unavailable.coverage.completed_handshake_count = 0;
        parent_unavailable.coverage.accounted_ingress_tls_bytes = 0;
        parent_unavailable.coverage.observed_egress_tls_bytes = 0;
        assert_eq!(render(parent_unavailable), Err(ReportError::Serialization));

        let mut dispatched_budget = tls_negotiation_review_audit_document();
        let second = &mut dispatched_budget.capability_observations[1];
        second.outcome = "budget_exhausted";
        second.support = "not_established";
        second.transport_validation = "not_established";
        second.negotiated_protocol = None;
        second.negotiated_cipher_suite = None;
        dispatched_budget.coverage.terminal = "budget_exhausted";
        dispatched_budget.coverage.completed_handshake_count = 1;
        assert_eq!(render(dispatched_budget), Err(ReportError::Serialization));

        for (terminal, first_outcome) in [
            ("budget_exhausted", "budget_exhausted"),
            ("cancelled", "cancelled"),
            ("deadline_reached", "deadline_reached"),
            ("deadline_reached", "budget_exhausted"),
        ] {
            let mut stopped = tls_negotiation_review_audit_document();
            for (index, cell) in stopped
                .capability_observations
                .iter_mut()
                .take(2)
                .enumerate()
            {
                cell.dispatch_status = "not_dispatched";
                cell.outcome = if index == 0 {
                    first_outcome
                } else {
                    "not_reached"
                };
                cell.support = "not_established";
                cell.transport_validation = "not_established";
                cell.negotiated_protocol = None;
                cell.negotiated_cipher_suite = None;
                cell.accounted_ingress_tls_bytes = 0;
                cell.observed_egress_tls_bytes = 0;
            }
            stopped.coverage.terminal = terminal;
            stopped.coverage.attempted_connection_count = 0;
            stopped.coverage.completed_handshake_count = 0;
            stopped.coverage.accounted_ingress_tls_bytes = 0;
            stopped.coverage.observed_egress_tls_bytes = 0;
            assert_eq!(
                render(stopped),
                Err(ReportError::Serialization),
                "terminal={terminal};outcome={first_outcome}"
            );
        }
    }

    #[cfg(all(feature = "scanning", feature = "tls-negotiation-review"))]
    #[test]
    fn tls_negotiation_review_writer_rejects_shape_and_accounting_mutations() {
        let render = |audit: AssessmentTlsNegotiationReviewAuditDocument| {
            let mut document = observation_assessment_document("unrelated.observation@1");
            document.tls_negotiation_review = Some(audit);
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX)
        };
        assert!(render(tls_negotiation_review_audit_document()).is_ok());

        let mut wrong_schema = tls_negotiation_review_audit_document();
        wrong_schema.schema = "security.tls-negotiation-review-audit/v2";
        assert_eq!(render(wrong_schema), Err(ReportError::Serialization));

        let mut unselected = tls_negotiation_review_audit_document();
        unselected.selected = false;
        assert_eq!(render(unselected), Err(ReportError::Serialization));

        let mut wrong_order = tls_negotiation_review_audit_document();
        wrong_order.capability_observations.swap(0, 1);
        assert_eq!(render(wrong_order), Err(ReportError::Serialization));

        let mut aggregate_mismatch = tls_negotiation_review_audit_document();
        aggregate_mismatch.coverage.accounted_ingress_tls_bytes -= 1;
        assert_eq!(render(aggregate_mismatch), Err(ReportError::Serialization));

        let mut fake_legacy_dispatch = tls_negotiation_review_audit_document();
        fake_legacy_dispatch.capability_observations[2].dispatch_status = "dispatched";
        assert_eq!(
            render(fake_legacy_dispatch),
            Err(ReportError::Serialization)
        );

        let mut stale_negotiated_fields = tls_negotiation_review_audit_document();
        stale_negotiated_fields.capability_observations[0].outcome = "handshake_failed";
        assert_eq!(
            render(stale_negotiated_fields),
            Err(ReportError::Serialization)
        );

        let mut later_dispatch_after_stop = tls_negotiation_review_audit_document();
        let first = &mut later_dispatch_after_stop.capability_observations[0];
        first.dispatch_status = "not_dispatched";
        first.outcome = "budget_exhausted";
        first.support = "not_established";
        first.transport_validation = "not_established";
        first.negotiated_protocol = None;
        first.negotiated_cipher_suite = None;
        first.accounted_ingress_tls_bytes = 0;
        first.observed_egress_tls_bytes = 0;
        later_dispatch_after_stop.coverage.terminal = "budget_exhausted";
        later_dispatch_after_stop
            .coverage
            .attempted_connection_count = 1;
        later_dispatch_after_stop.coverage.completed_handshake_count = 1;
        later_dispatch_after_stop
            .coverage
            .accounted_ingress_tls_bytes = 1_900;
        later_dispatch_after_stop.coverage.observed_egress_tls_bytes = 240;
        assert_eq!(
            render(later_dispatch_after_stop),
            Err(ReportError::Serialization)
        );

        let mut completed_after_budget = tls_negotiation_review_audit_document();
        let second = &mut completed_after_budget.capability_observations[1];
        second.outcome = "budget_exhausted";
        second.support = "not_established";
        second.transport_validation = "not_established";
        second.negotiated_protocol = None;
        second.negotiated_cipher_suite = None;
        completed_after_budget.coverage.completed_handshake_count = 1;
        assert_eq!(
            render(completed_after_budget),
            Err(ReportError::Serialization)
        );

        let mut incomplete_claimed_complete = tls_negotiation_review_audit_document();
        let first = &mut incomplete_claimed_complete.capability_observations[0];
        first.outcome = "transport_failed";
        first.support = "not_established";
        first.transport_validation = "not_established";
        first.negotiated_protocol = None;
        first.negotiated_cipher_suite = None;
        let second = &mut incomplete_claimed_complete.capability_observations[1];
        second.dispatch_status = "not_dispatched";
        second.outcome = "not_reached";
        second.support = "not_established";
        second.transport_validation = "not_established";
        second.negotiated_protocol = None;
        second.negotiated_cipher_suite = None;
        second.accounted_ingress_tls_bytes = 0;
        second.observed_egress_tls_bytes = 0;
        incomplete_claimed_complete
            .coverage
            .attempted_connection_count = 1;
        incomplete_claimed_complete
            .coverage
            .completed_handshake_count = 0;
        incomplete_claimed_complete
            .coverage
            .accounted_ingress_tls_bytes = 2_048;
        incomplete_claimed_complete
            .coverage
            .observed_egress_tls_bytes = 256;
        assert_eq!(
            render(incomplete_claimed_complete),
            Err(ReportError::Serialization)
        );
    }

    #[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
    fn positive_secret_exposure_assessment_document() -> AssessmentDocument<'static> {
        let mut document =
            observation_assessment_document("exposure.response-stripe-live-secret@1");
        document.items[0].title = "A live-mode provider-secret shape was observed";
        document.items[0].redacted_summary =
            "A complete response contained a redacted provider-secret shape.";
        document.items[0].category = "passive-secret-exposure";
        document.items[0].remediation.id = "secret-exposure.review-response@1";
        document.items[0].remediation.summary =
            "Review the response source and rotate affected credentials when independently confirmed.";
        document.items[0].evidence_references = vec!["evidence-0007".to_owned()];
        let mut audit = empty_secret_exposure_audit_document();
        audit.response_count = 1;
        audit.evaluated_response_count = 1;
        audit.body_derived_projection_suppressed_response_count = 1;
        audit.interpreted_byte_count = 96;
        audit.observation_count = 1;
        audit.match_occurrence_count = 2;
        audit.outcomes = vec![AssessmentSecretExposureOutcomeDocument {
            outcome: "evaluated",
            count: 1,
        }];
        audit.observations = vec![AssessmentSecretExposureObservationDocument {
            detector_class: "stripe_live_secret",
            capability_id: "exposure.response-stripe-live-secret@1",
            occurrence_count: 2,
            evidence_references: vec!["evidence-0007".to_owned()],
        }];
        document.secret_exposure_review = Some(audit);
        document
    }

    #[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
    fn retained_secret_exposure_limit_document() -> AssessmentDocument<'static> {
        let mut document = observation_assessment_document(SECRET_EXPOSURE_CAPABILITIES[0].1);
        document.items.clear();
        let mut observations = Vec::with_capacity(MAX_SECRET_EXPOSURE_RETAINED_OBSERVATIONS);
        for index in 0..MAX_SECRET_EXPOSURE_RETAINED_OBSERVATIONS {
            let (detector_class, capability_id) =
                SECRET_EXPOSURE_CAPABILITIES[index % SECRET_EXPOSURE_CAPABILITIES.len()];
            let evidence_reference = format!("evidence-{:04}", index + 100);
            let mut item = observation_assessment_document(capability_id)
                .items
                .pop()
                .unwrap();
            item.fingerprint = Box::leak(format!("sha256:{:064x}", index + 1).into_boxed_str());
            item.evidence_references = vec![evidence_reference.clone()];
            document.items.push(item);
            observations.push(AssessmentSecretExposureObservationDocument {
                detector_class,
                capability_id,
                occurrence_count: 1,
                evidence_references: vec![evidence_reference],
            });
        }
        document.item_count = u64::try_from(document.items.len()).unwrap();
        let mut audit = empty_secret_exposure_audit_document();
        audit.response_count = 9;
        audit.evaluated_response_count = 9;
        audit.body_derived_projection_suppressed_response_count = 9;
        audit.interpreted_byte_count = 4_096;
        audit.observation_count = u64::try_from(MAX_SECRET_EXPOSURE_RETAINED_OBSERVATIONS).unwrap();
        audit.omitted_observation_count = 1;
        audit.match_occurrence_count = 33;
        audit.outcomes = vec![AssessmentSecretExposureOutcomeDocument {
            outcome: "evaluated",
            count: 9,
        }];
        audit.observations = observations;
        document.secret_exposure_review = Some(audit);
        document
    }

    #[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
    #[test]
    fn selected_empty_secret_exposure_audit_is_rendered_without_inventing_an_item() {
        let mut document = observation_assessment_document("unrelated.observation@1");
        document.secret_exposure_review = Some(empty_secret_exposure_audit_document());

        for format in [
            ReportFormat::Json,
            ReportFormat::Csv,
            ReportFormat::Html,
            ReportFormat::Markdown,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("security.passive-secret-exposure-audit/v1"));
            assert!(rendered.contains("termivar.passive-secret-exposure/v1"));
            assert!(!rendered.contains("sk_live_private-render-sentinel"));
        }
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert_eq!(value["secret_exposure_review"]["selected"], true);
        assert_eq!(value["secret_exposure_review"]["response_count"], 0);
        assert_eq!(
            value["secret_exposure_review"]["body_derived_projection_suppressed_response_count"],
            0
        );
        assert_eq!(
            value["secret_exposure_review"]["observations"],
            serde_json::json!([])
        );
        assert_eq!(
            value["secret_exposure_review"]["additional_request_count"],
            0
        );
    }

    #[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
    #[test]
    fn secret_exposure_audit_and_item_are_cross_linked_and_value_free_in_every_renderer() {
        let document = positive_secret_exposure_assessment_document();
        for format in [
            ReportFormat::Json,
            ReportFormat::Csv,
            ReportFormat::Html,
            ReportFormat::Markdown,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("stripe_live_secret"));
            assert!(rendered.contains("exposure.response-stripe-live-secret@1"));
            assert!(rendered.contains("evidence-0007"));
            assert!(rendered.contains("not_performed"));
            assert!(rendered.contains("not_established"));
            assert!(!rendered.contains("sk_live_private-render-sentinel"));
        }
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert_eq!(value["secret_exposure_review"]["observation_count"], 1);
        assert_eq!(value["secret_exposure_review"]["match_occurrence_count"], 2);
        assert_eq!(
            value["secret_exposure_review"]["body_derived_projection_suppressed_response_count"],
            1
        );
        assert_eq!(
            value["secret_exposure_review"]["observations"][0]["evidence_references"],
            serde_json::json!(["evidence-0007"]),
        );
        assert_eq!(
            value["secret_exposure_review"]["raw_values_retained"],
            false
        );
        assert_eq!(
            value["secret_exposure_review"]["public_secret_hashes_retained"],
            false,
        );
    }

    #[cfg(all(feature = "scanning", feature = "secret-exposure-review"))]
    #[test]
    fn secret_exposure_writer_rejects_missing_or_inconsistent_cross_links_and_accounting() {
        assert!(render_assessment_with_limit(
            &retained_secret_exposure_limit_document(),
            ReportFormat::Json,
            usize::MAX,
        )
        .is_ok());

        let mut missing_audit = positive_secret_exposure_assessment_document();
        missing_audit.secret_exposure_review = None;
        assert_eq!(
            render_assessment_with_limit(&missing_audit, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization),
        );

        let mut wrong_reference = positive_secret_exposure_assessment_document();
        wrong_reference
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .observations[0]
            .evidence_references[0] = "evidence-0008".to_owned();
        assert_eq!(
            render_assessment_with_limit(&wrong_reference, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization),
        );

        let mut wrong_partition = positive_secret_exposure_assessment_document();
        wrong_partition
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .not_evaluated_response_count = 1;
        assert_eq!(
            render_assessment_with_limit(&wrong_partition, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization),
        );

        let mut raw_retention = positive_secret_exposure_assessment_document();
        raw_retention
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .raw_values_retained = true;
        assert_eq!(
            render_assessment_with_limit(&raw_retention, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization),
        );

        let mut missing_match_suppression = positive_secret_exposure_assessment_document();
        missing_match_suppression
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .body_derived_projection_suppressed_response_count = 0;
        assert_eq!(
            render_assessment_with_limit(
                &missing_match_suppression,
                ReportFormat::Json,
                usize::MAX,
            ),
            Err(ReportError::Serialization),
        );

        let mut excessive_suppression = positive_secret_exposure_assessment_document();
        excessive_suppression
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .body_derived_projection_suppressed_response_count = 2;
        assert_eq!(
            render_assessment_with_limit(&excessive_suppression, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization),
        );

        let mut clean_response_suppression =
            observation_assessment_document("unrelated.observation@1");
        let mut clean_audit = empty_secret_exposure_audit_document();
        clean_audit.response_count = 1;
        clean_audit.evaluated_response_count = 1;
        clean_audit.body_derived_projection_suppressed_response_count = 1;
        clean_audit.outcomes = vec![AssessmentSecretExposureOutcomeDocument {
            outcome: "evaluated",
            count: 1,
        }];
        clean_response_suppression.secret_exposure_review = Some(clean_audit);
        assert!(render_assessment_with_limit(
            &clean_response_suppression,
            ReportFormat::Json,
            usize::MAX,
        )
        .is_ok());
        clean_response_suppression
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .body_derived_projection_suppressed_response_count = 0;
        assert_eq!(
            render_assessment_with_limit(
                &clean_response_suppression,
                ReportFormat::Json,
                usize::MAX,
            ),
            Err(ReportError::Serialization),
        );

        let mut missing_refusal_suppression =
            observation_assessment_document("unrelated.observation@1");
        let mut refused_audit = empty_secret_exposure_audit_document();
        refused_audit.response_count = 1;
        refused_audit.not_evaluated_response_count = 1;
        refused_audit.outcomes = vec![AssessmentSecretExposureOutcomeDocument {
            outcome: "invalid_utf8",
            count: 1,
        }];
        missing_refusal_suppression.secret_exposure_review = Some(refused_audit);
        assert_eq!(
            render_assessment_with_limit(
                &missing_refusal_suppression,
                ReportFormat::Json,
                usize::MAX,
            ),
            Err(ReportError::Serialization),
        );

        let mut missing_item = positive_secret_exposure_assessment_document();
        missing_item.items[0].capability_id = "unrelated.observation@1";
        assert_eq!(
            render_assessment_with_limit(&missing_item, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization),
        );

        let mut shared_reference = positive_secret_exposure_assessment_document();
        let mut second_item =
            observation_assessment_document("exposure.response-aws-access-key-pair@1")
                .items
                .pop()
                .unwrap();
        second_item.evidence_references = vec!["evidence-0007".to_owned()];
        shared_reference.items.push(second_item);
        shared_reference.item_count = 2;
        let audit = shared_reference.secret_exposure_review.as_mut().unwrap();
        audit.observation_count = 2;
        audit.match_occurrence_count = 3;
        audit
            .observations
            .push(AssessmentSecretExposureObservationDocument {
                detector_class: "aws_access_key_pair",
                capability_id: "exposure.response-aws-access-key-pair@1",
                occurrence_count: 1,
                evidence_references: vec!["evidence-0007".to_owned()],
            });
        assert_eq!(
            render_assessment_with_limit(&shared_reference, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization),
        );

        let mut retained_equals_total = retained_secret_exposure_limit_document();
        retained_equals_total
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .match_occurrence_count = 32;
        assert_eq!(
            render_assessment_with_limit(&retained_equals_total, ReportFormat::Json, usize::MAX,),
            Err(ReportError::Serialization),
        );

        let mut impossible_below_cap_omission = positive_secret_exposure_assessment_document();
        let below_cap_audit = impossible_below_cap_omission
            .secret_exposure_review
            .as_mut()
            .unwrap();
        below_cap_audit.omitted_observation_count = 1;
        below_cap_audit.match_occurrence_count = 3;
        assert_eq!(
            render_assessment_with_limit(
                &impossible_below_cap_omission,
                ReportFormat::Json,
                usize::MAX,
            ),
            Err(ReportError::Serialization),
        );

        let mut omitted_rows_exceed_missing_occurrences = retained_secret_exposure_limit_document();
        omitted_rows_exceed_missing_occurrences
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .omitted_observation_count = 2;
        assert_eq!(
            render_assessment_with_limit(
                &omitted_rows_exceed_missing_occurrences,
                ReportFormat::Json,
                usize::MAX,
            ),
            Err(ReportError::Serialization),
        );

        let mut missing_occurrences_exceed_omitted_rows = retained_secret_exposure_limit_document();
        let missing_upper_audit = missing_occurrences_exceed_omitted_rows
            .secret_exposure_review
            .as_mut()
            .unwrap();
        missing_upper_audit.match_occurrence_count = 97;
        assert_eq!(
            render_assessment_with_limit(
                &missing_occurrences_exceed_omitted_rows,
                ReportFormat::Json,
                usize::MAX,
            ),
            Err(ReportError::Serialization),
        );

        let mut many_suppressed_responses_one_match =
            positive_secret_exposure_assessment_document();
        let positive_count_audit = many_suppressed_responses_one_match
            .secret_exposure_review
            .as_mut()
            .unwrap();
        positive_count_audit.response_count = 10;
        positive_count_audit.evaluated_response_count = 10;
        positive_count_audit.body_derived_projection_suppressed_response_count = 10;
        positive_count_audit.match_occurrence_count = 1;
        positive_count_audit.outcomes[0].count = 10;
        positive_count_audit.observations[0].occurrence_count = 1;
        assert!(render_assessment_with_limit(
            &many_suppressed_responses_one_match,
            ReportFormat::Json,
            usize::MAX,
        )
        .is_ok());
        many_suppressed_responses_one_match
            .secret_exposure_review
            .as_mut()
            .unwrap()
            .body_derived_projection_suppressed_response_count = 9;
        assert_eq!(
            render_assessment_with_limit(
                &many_suppressed_responses_one_match,
                ReportFormat::Json,
                usize::MAX,
            ),
            Err(ReportError::Serialization),
        );

        let mut observations_exceed_evaluated_capacity = retained_secret_exposure_limit_document();
        let evaluated_capacity_audit = observations_exceed_evaluated_capacity
            .secret_exposure_review
            .as_mut()
            .unwrap();
        evaluated_capacity_audit.evaluated_response_count = 7;
        evaluated_capacity_audit.not_evaluated_response_count = 2;
        evaluated_capacity_audit.body_derived_projection_suppressed_response_count = 9;
        evaluated_capacity_audit.outcomes = vec![
            AssessmentSecretExposureOutcomeDocument {
                outcome: "evaluated",
                count: 7,
            },
            AssessmentSecretExposureOutcomeDocument {
                outcome: "unsupported_media_type",
                count: 2,
            },
        ];
        assert_eq!(
            render_assessment_with_limit(
                &observations_exceed_evaluated_capacity,
                ReportFormat::Json,
                usize::MAX,
            ),
            Err(ReportError::Serialization),
        );

        let mut zero_total_with_omission =
            observation_assessment_document("unrelated.observation@1");
        let mut zero_total_audit = empty_secret_exposure_audit_document();
        zero_total_audit.response_count = 1;
        zero_total_audit.evaluated_response_count = 1;
        zero_total_audit.omitted_observation_count = 1;
        zero_total_audit.outcomes = vec![AssessmentSecretExposureOutcomeDocument {
            outcome: "evaluated",
            count: 1,
        }];
        zero_total_with_omission.secret_exposure_review = Some(zero_total_audit);
        assert_eq!(
            render_assessment_with_limit(&zero_total_with_omission, ReportFormat::Json, usize::MAX,),
            Err(ReportError::Serialization),
        );
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    fn complete_supplied_session_audit_document() -> AssessmentSuppliedSessionAuditDocument {
        AssessmentSuppliedSessionAuditDocument {
            schema: SUPPLIED_SESSION_AUDIT_SCHEMA,
            capability_id: SUPPLIED_SESSION_CAPABILITY_ID,
            policy_reference: format!("supplied-session-policy-sha256:{}", "1".repeat(64)),
            application_reference: format!(
                "supplied-session-application-sha256:{}",
                "2".repeat(64)
            ),
            principal_reference: "supplied-session-principal-0001".to_owned(),
            principal_alias: "fixture-user".to_owned(),
            principal_assurance: "operator_declared",
            credential_mechanism: "authorization_header",
            credential_acquisition: None,
            cookie_policy: None,
            cookie_lifecycle: None,
            login: None,
            renewal: None,
            oauth_code: None,
            oauth_refresh: None,
            oauth_authorization: None,
            oauth_token_exchange: None,
            health_oracle: AssessmentSuppliedSessionHealthOracleDocument {
                kind: "json_boolean_true",
                field_reference: format!("supplied-session-health-field-sha256:{}", "3".repeat(64)),
            },
            outcome: "complete",
            coverage: "complete",
            checkpoints: vec![
                AssessmentSuppliedSessionCheckpointDocument {
                    sequence: 0,
                    phase: "startup",
                    after_subject_count: 0,
                    evidence_reference: Some(format!(
                        "supplied-session-checkpoint-evidence-sha256:{}",
                        "6".repeat(64)
                    )),
                    outcome: "healthy",
                    status: Some(200),
                    body_state: "complete",
                    predicate: "matched",
                    response_bytes: 17,
                    epoch: None,
                },
                AssessmentSuppliedSessionCheckpointDocument {
                    sequence: 1,
                    phase: "terminal",
                    after_subject_count: 1,
                    evidence_reference: Some(format!(
                        "supplied-session-checkpoint-evidence-sha256:{}",
                        "7".repeat(64)
                    )),
                    outcome: "healthy",
                    status: Some(200),
                    body_state: "complete",
                    predicate: "matched",
                    response_bytes: 19,
                    epoch: None,
                },
            ],
            resources: vec![AssessmentSuppliedSessionResourceDocument {
                sequence: 0,
                resource_reference: format!("supplied-session-resource-sha256:{}", "4".repeat(64)),
                evidence_reference: Some(format!(
                    "supplied-session-resource-evidence-sha256:{}",
                    "5".repeat(64)
                )),
                outcome: "committed",
                status: Some(200),
                response_bytes: 23,
                epoch: 1,
            }],
            selected_resource_count: 1,
            dispatched_resource_count: 1,
            committed_resource_count: 1,
            dispatched_request_count: 3,
            response_bytes: 59,
            response_byte_limit: 65_536,
            response_byte_limit_exceeded: false,
            refresh_performed: false,
            anonymous_fallback_performed: false,
            continuous_authentication_established: false,
            exploit_execution: "not_performed",
            impact_validation: "not_performed",
        }
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn oauth_renewal_checkpoint_display_preserves_legacy_and_separate_epoch() {
        let health = AssessmentSuppliedSessionCheckpointDocument {
            sequence: 2,
            phase: "renewal",
            after_subject_count: 1,
            evidence_reference: Some(format!(
                "supplied-session-checkpoint-evidence-sha256:{}",
                "e".repeat(64)
            )),
            outcome: "healthy",
            status: Some(200),
            body_state: "complete",
            predicate: "matched",
            response_bytes: 29,
            epoch: Some(2),
        };
        assert_eq!(health.human_summary(true), format!(
            "sequence=2;phase=renewal;after_subject_count=1;evidence_reference=supplied-session-checkpoint-evidence-sha256:{};outcome=healthy;status=200;body_state=complete;predicate=matched;response_bytes=29;epoch=2",
            "e".repeat(64)
        ));
        assert!(!health.human_summary(false).contains(";epoch="));
        let legacy = complete_supplied_session_audit_document();
        assert!(serde_json::to_value(&legacy)
            .unwrap()
            .get("oauth_refresh")
            .is_none());
        assert_eq!(legacy.checkpoints[0].human_summary(false), format!(
            "sequence=0;phase=startup;after_subject_count=0;evidence_reference=supplied-session-checkpoint-evidence-sha256:{};outcome=healthy;status=200;body_state=complete;predicate=matched;response_bytes=17",
            "6".repeat(64)
        ));
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    fn complete_cookie_supplied_session_audit_document() -> AssessmentSuppliedSessionAuditDocument {
        let mut document = complete_supplied_session_audit_document();
        document.schema = SUPPLIED_SESSION_COOKIE_AUDIT_SCHEMA;
        document.credential_mechanism = "cookie_jar";
        document.cookie_policy = Some(AssessmentSuppliedSessionCookiePolicyDocument {
            declared_count: 2,
            host_only_count: 1,
            domain_count: 1,
            secure_count: 2,
            http_only_count: 1,
            session_count: 1,
            persistent_count: 1,
            same_site_missing_count: 0,
            same_site_strict_count: 1,
            same_site_lax_count: 0,
            same_site_none_count: 1,
            update_policy: "stop_on_selected_cookie",
            browser_semantics: "attributes_preserved_not_browser_csrf_emulation",
        });
        document.cookie_lifecycle = Some(AssessmentSuppliedSessionCookieLifecycleDocument {
            initial_epoch: 1,
            final_epoch: 1,
            selected_update_response_count: 0,
            unselected_update_response_count: 1,
            update_classification_failure_count: 0,
            updates_applied: 0,
        });
        document
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    fn complete_form_login_supplied_session_audit_document(
    ) -> AssessmentSuppliedSessionAuditDocument {
        let mut document = complete_cookie_supplied_session_audit_document();
        document.schema = SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA;
        document.credential_acquisition = Some("bounded_form_login");
        document.cookie_policy = Some(AssessmentSuppliedSessionCookiePolicyDocument {
            declared_count: 1,
            host_only_count: 1,
            domain_count: 0,
            secure_count: 0,
            http_only_count: 1,
            session_count: 1,
            persistent_count: 0,
            same_site_missing_count: 0,
            same_site_strict_count: 0,
            same_site_lax_count: 1,
            same_site_none_count: 0,
            update_policy: "stop_on_selected_cookie",
            browser_semantics: "attributes_preserved_not_browser_csrf_emulation",
        });
        document.cookie_lifecycle = Some(AssessmentSuppliedSessionCookieLifecycleDocument {
            initial_epoch: 0,
            final_epoch: 1,
            selected_update_response_count: 0,
            unselected_update_response_count: 0,
            update_classification_failure_count: 0,
            updates_applied: 0,
        });
        document.login = Some(AssessmentSuppliedSessionLoginDocument {
            login_reference: format!("supplied-session-login-sha256:{}", "9".repeat(64)),
            max_attempts: 1,
            attempt_count: 1,
            page_dispatched: true,
            page_status: Some(200),
            page_body_state: "complete",
            form_outcome: "matched",
            form_error_code: None,
            submit_dispatched: true,
            submit_status: Some(200),
            submit_body_state: "complete",
            submit_outcome: "cookie_acquired",
            acquired_cookie_count: 1,
            response_bytes: 54,
            initial_epoch: 0,
            final_epoch: 1,
            pre_session_cookie_applied: false,
        });
        document.dispatched_request_count = 5;
        document.response_bytes = 113;
        document
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    fn unavailable_form_login_supplied_session_audit_document(
    ) -> AssessmentSuppliedSessionAuditDocument {
        let mut document = complete_form_login_supplied_session_audit_document();
        document.outcome = "login_form_unavailable";
        document.coverage = "none";
        document.checkpoints.clear();
        document.resources[0].evidence_reference = None;
        document.resources[0].outcome = "not_dispatched";
        document.resources[0].status = None;
        document.resources[0].response_bytes = 0;
        document.dispatched_resource_count = 0;
        document.committed_resource_count = 0;
        document.dispatched_request_count = 1;
        document.response_bytes = 41;
        document.cookie_lifecycle.as_mut().unwrap().final_epoch = 0;
        document.login = Some(AssessmentSuppliedSessionLoginDocument {
            login_reference: format!("supplied-session-login-sha256:{}", "9".repeat(64)),
            max_attempts: 1,
            attempt_count: 0,
            page_dispatched: true,
            page_status: Some(200),
            page_body_state: "complete",
            form_outcome: "missing",
            form_error_code: Some("missing_csrf"),
            submit_dispatched: false,
            submit_status: None,
            submit_body_state: "unavailable",
            submit_outcome: "not_dispatched",
            acquired_cookie_count: 0,
            response_bytes: 41,
            initial_epoch: 0,
            final_epoch: 0,
            pre_session_cookie_applied: false,
        });
        document
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    fn unavailable_form_login_cookie_supplied_session_audit_document(
    ) -> AssessmentSuppliedSessionAuditDocument {
        let mut document = complete_form_login_supplied_session_audit_document();
        document.outcome = "login_cookie_unavailable";
        document.coverage = "none";
        document.checkpoints.clear();
        document.resources[0].evidence_reference = None;
        document.resources[0].outcome = "not_dispatched";
        document.resources[0].status = None;
        document.resources[0].response_bytes = 0;
        document.dispatched_resource_count = 0;
        document.committed_resource_count = 0;
        document.dispatched_request_count = 2;
        document.response_bytes = 54;
        document.cookie_lifecycle.as_mut().unwrap().final_epoch = 0;
        let login = document.login.as_mut().unwrap();
        login.submit_outcome = "cookie_unavailable";
        login.acquired_cookie_count = 0;
        login.final_epoch = 0;
        document
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    fn stopped_cookie_supplied_session_audit_document(
        outcome: &'static str,
    ) -> AssessmentSuppliedSessionAuditDocument {
        let mut document = complete_cookie_supplied_session_audit_document();
        document.outcome = outcome;
        document.coverage = "none";
        document.checkpoints.truncate(1);
        document.resources[0].evidence_reference = None;
        document.resources[0].outcome = "not_dispatched";
        document.resources[0].status = None;
        document.resources[0].response_bytes = 0;
        document.dispatched_resource_count = 0;
        document.committed_resource_count = 0;
        document.dispatched_request_count = 1;
        document.response_bytes = document.checkpoints[0].response_bytes;
        document
            .cookie_lifecycle
            .as_mut()
            .unwrap()
            .unselected_update_response_count = 0;
        document
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn supplied_session_v1_wire_bytes_remain_frozen() {
        let expected = concat!(
            r#"{"schema":"security.supplied-session-audit/v1","capability_id":"session.supplied-context-assessment@1","policy_reference":"supplied-session-policy-sha256:1111111111111111111111111111111111111111111111111111111111111111","application_reference":"supplied-session-application-sha256:2222222222222222222222222222222222222222222222222222222222222222","principal_reference":"supplied-session-principal-0001","principal_alias":"fixture-user","principal_assurance":"operator_declared","credential_mechanism":"authorization_header","health_oracle":{"kind":"json_boolean_true","field_reference":"supplied-session-health-field-sha256:3333333333333333333333333333333333333333333333333333333333333333"},"outcome":"complete","coverage":"complete","checkpoints":[{"sequence":0,"phase":"startup","after_subject_count":0,"evidence_reference":"supplied-session-checkpoint-evidence-sha256:6666666666666666666666666666666666666666666666666666666666666666","outcome":"healthy","status":200,"body_state":"complete","predicate":"matched","response_bytes":17},"#,
            r#"{"sequence":1,"phase":"terminal","after_subject_count":1,"evidence_reference":"supplied-session-checkpoint-evidence-sha256:7777777777777777777777777777777777777777777777777777777777777777","outcome":"healthy","status":200,"body_state":"complete","predicate":"matched","response_bytes":19}],"resources":[{"sequence":0,"resource_reference":"supplied-session-resource-sha256:4444444444444444444444444444444444444444444444444444444444444444","evidence_reference":"supplied-session-resource-evidence-sha256:5555555555555555555555555555555555555555555555555555555555555555","outcome":"committed","status":200,"response_bytes":23,"epoch":1}],"selected_resource_count":1,"dispatched_resource_count":1,"committed_resource_count":1,"dispatched_request_count":3,"response_bytes":59,"response_byte_limit":65536,"response_byte_limit_exceeded":false,"refresh_performed":false,"anonymous_fallback_performed":false,"continuous_authentication_established":false,"exploit_execution":"not_performed","impact_validation":"not_performed"}"#,
        );
        assert_eq!(
            complete_supplied_session_audit_document()
                .wire_json()
                .unwrap(),
            expected
        );
    }

    #[cfg(feature = "scanning")]
    fn complete_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observation_assessment_document("passive.header.hsts.missing@1");
        document.items[0].title = "Strict transport policy was not observed";
        document.items[0].fingerprint = "assessment-fingerprint-v1:0001";
        document.items[0].redacted_summary = "Bounded response metadata did not include HSTS.";
        document.items[0].category = "transport-policy";
        document.items[0].remediation = AssessmentRemediationDocument {
            id: "remediation.transport.hsts@1",
            summary: "Review whether this HTTPS response should declare HSTS.",
        };
        document.items.push(AssessmentItemDocument {
            schema: crate::web_runtime::ASSESSMENT_ITEM_SCHEMA,
            capability_id: "cors.policy.relationship@1",
            subject_reference: "subject-0000".to_owned(),
            presentation_target: "assessment_subject",
            title: "CORS policy relationship warrants review",
            disposition: "needs_review",
            claim_basis: "differential",
            severity: Some("low"),
            confidence_ppm: 825_000,
            fingerprint: "assessment-fingerprint-v1:0002",
            evidence_count: 2,
            redacted_summary: "A matched control and candidate differed under review policy.",
            category: "cross-origin-policy",
            cwe: Some("CWE-942"),
            remediation: AssessmentRemediationDocument {
                id: "remediation.cors.policy@1",
                summary: "Review the intended origin and credential relationship.",
            },
            evidence_references: Vec::new(),
            control_evidence_references: vec!["evidence-0001".to_owned()],
            candidate_evidence_references: vec!["evidence-0002".to_owned()],
            case_reference: None,
            outcome_reference: None,
            verification_stage: None,
        });
        document.items.push(AssessmentItemDocument {
            schema: crate::web_runtime::ASSESSMENT_ITEM_SCHEMA,
            capability_id: "review.confirmed.test-boundary@1",
            subject_reference: "subject-0000".to_owned(),
            presentation_target: "assessment_subject",
            title: "Verifier-authorized transition",
            disposition: "confirmed",
            claim_basis: "verifier_transition",
            severity: Some("high"),
            confidence_ppm: 990_000,
            fingerprint: "assessment-fingerprint-v1:0003",
            evidence_count: 2,
            redacted_summary: "A case-correlated verifier transition satisfied claim policy.",
            category: "verification-boundary",
            cwe: Some("CWE-20"),
            remediation: AssessmentRemediationDocument {
                id: "remediation.verified.test-boundary@1",
                summary: "Apply the capability-owned remediation and verify the correction.",
            },
            evidence_references: vec!["evidence-0003".to_owned(), "evidence-0004".to_owned()],
            control_evidence_references: Vec::new(),
            candidate_evidence_references: Vec::new(),
            case_reference: Some("case-0000".to_owned()),
            outcome_reference: Some("outcome-0000".to_owned()),
            verification_stage: Some("active"),
        });
        document.item_count = 3;
        document
    }

    #[cfg(all(feature = "scanning", feature = "openapi-review"))]
    fn observed_openapi_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observation_assessment_document(OPENAPI_REVIEW_CAPABILITY_ID);
        document.items[0].title = "OpenAPI contract observed";
        document.items[0].fingerprint = "assessment-openapi-fingerprint-v1:0001";
        document.items[0].redacted_summary =
            "A bounded OpenAPI contract was reproduced by one anonymous GET replay.";
        document.items[0].category = "api-surface";
        document.items[0].remediation = AssessmentRemediationDocument {
            id: "api.openapi-contract-review@1",
            summary: "Confirm that publishing this OpenAPI contract matches deployment policy.",
        };
        document.openapi_review = Some(AssessmentOpenApiAuditDocument {
            schema: "security.openapi-review-audit/v1",
            capability_id: OPENAPI_REVIEW_CAPABILITY_ID,
            outcome: openapi_outcome(OpenApiRuntimeOutcome::DocumentObserved),
            candidate_source: crate::web_runtime::OpenApiCandidateSource::DiscoveredOpenApiJson,
            request_count: 2,
            active_verification_count: 1,
            version: Some("3.1.0"),
            semantic_digest: Some(
                "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef".to_owned(),
            ),
            path_count: 3,
            operation_count: 5,
            get_operation_count: 2,
            write_operation_count: 3,
            path_parameter_count: 1,
            query_parameter_count: 2,
            explicit_auth_operation_count: 3,
            anonymous_operation_count: 2,
            url_like_operation_count: 1,
            multipart_operation_count: 1,
            deprecated_operation_count: 1,
            replay_matched: true,
            item_projected: true,
        });
        document
    }

    #[cfg(all(feature = "scanning", feature = "rest-review"))]
    fn observed_rest_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observation_assessment_document(REST_REVIEW_CAPABILITY_ID);
        document.items[0].title = "REST operation surface observed";
        document.items[0].fingerprint = "assessment-rest-fingerprint-v1:0001";
        document.items[0].redacted_summary =
            "Two anonymous exact-origin GET requests reproduced the same bounded JSON resource structure.";
        document.items[0].category = "api-surface";
        document.items[0].remediation = AssessmentRemediationDocument {
            id: "api.rest-readonly-surface-review@1",
            summary: "Confirm that anonymously exposing this documented read-only operation matches deployment policy.",
        };
        document.rest_review = Some(AssessmentRestAuditDocument {
            schema: "security.rest-readonly-review-audit/v1",
            capability_id: REST_REVIEW_CAPABILITY_ID,
            enabled: true,
            method: "get",
            outcome: rest_outcome(RestRuntimeOutcome::SurfaceObserved),
            request_count: 2,
            active_verification_count: 1,
            eligible_operation_count: 3,
            selected_operation_identity: Some(
                "openapi-operation-sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
                    .to_owned(),
            ),
            documented_response: Some(rest_documented_response(
                RestDocumentedResponseClass::JsonCompatible,
            )),
            observed_media: rest_observed_media(RestObservedMediaClass::JsonCompatible),
            status_class: Some(2),
            replay_stable: true,
            item_projected: true,
        });
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn observed_wordpress_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observation_assessment_document(WORDPRESS_REVIEW_CAPABILITY_ID);
        document.items[0].title = "WordPress surface hints observed";
        document.items[0].fingerprint = "assessment-wordpress-fingerprint-v1:0001";
        document.items[0].redacted_summary =
            "The root response contained bounded structured WordPress hints; installation authenticity and advisory impact were not established.";
        document.items[0].category = "technology-observation";
        document.items[0].remediation = AssessmentRemediationDocument {
            id: "wordpress-inventory-review",
            summary: "Review supplied WordPress context and advisory applicability independently.",
        };
        document.wordpress_review = Some(AssessmentWordPressAuditDocument {
            schema: "security.wordpress-review-audit/v1",
            review_basis_schema: None,
            capability_id: WORDPRESS_REVIEW_CAPABILITY_ID,
            catalog_status: "evaluated",
            catalog_schema: None,
            catalog: Some(WordPressCatalogDocument {
                id: "termivar-synthetic-wordpress-reporting".to_owned(),
                revision: "synthetic-v1".to_owned(),
                retrieved_on: "2026-09-06".to_owned(),
            }),
            inventory_import: None,
            external_review: None,
            signal_count: 1,
            evidence_reference_count: 1,
            additional_request_count: 0,
            item_projected: true,
            component_count: 1,
            advisory_count: 1,
            components: vec![WordPressComponentDocument {
                identity: WordPressComponentIdentityDocument {
                    kind: "core",
                    slug: "wordpress".to_owned(),
                },
                evidence_class: "observed_hint",
                identity_sources: vec!["generator_metadata"],
                confidence_classes: vec!["public_declaration"],
                versions: vec![WordPressVersionEvidenceDocument {
                    value: "6.9.4".to_owned(),
                    source: "generator_metadata",
                    confidence: "public_declaration",
                }],
                activation: None,
                inventory_status: None,
            }],
            advisories: vec![WordPressAdvisoryDocument {
                id: "SYNTHETIC-REPORTING-WORDPRESS-0001".to_owned(),
                component: WordPressComponentIdentityDocument {
                    kind: "core",
                    slug: "wordpress".to_owned(),
                },
                source: WordPressAdvisorySourceDocument {
                    reference: "https://example.invalid/termivar/synthetic/reporting".to_owned(),
                    revision: "synthetic-v1".to_owned(),
                    retrieved_on: "2026-09-06".to_owned(),
                    usage_basis:
                        "Fictional test data created for Termivar reporting; not a real advisory."
                            .to_owned(),
                },
                cve: None,
                summary: "Synthetic bounded summary <script>inert()</script>".to_owned(),
                affected_ranges: vec![WordPressAffectedRangeDocument {
                    lower: Some(WordPressVersionEndpointDocument {
                        declared: "6.9.0".to_owned(),
                        inclusive: true,
                    }),
                    upper: Some(WordPressVersionEndpointDocument {
                        declared: "6.9.5".to_owned(),
                        inclusive: false,
                    }),
                }],
                fixed_versions: vec!["6.9.5".to_owned()],
                prerequisites: vec![WordPressPrerequisiteDocument {
                    kind: "hosting_os",
                    expected: "linux".to_owned(),
                    patch_id: None,
                    outcome: "unknown",
                }],
                remediation: Some("Review the supplied upstream remediation guidance.".to_owned()),
                comparison_profile: None,
                version_resolution: None,
                version_resolution_reason: None,
                component_evidence: "observed_hint",
                version_relation: "within_declared_range",
                applicability: "indeterminate_missing_evidence",
                exploit_execution: "not_performed",
                impact_validation: "not_performed",
            }],
        });
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn discovered_wordpress_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observed_wordpress_assessment_document();
        document.items[0].fingerprint =
            "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
        document.items.push(AssessmentItemDocument {
            schema: crate::web_runtime::ASSESSMENT_ITEM_SCHEMA,
            capability_id: WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID,
            subject_reference: "subject-0000".to_owned(),
            presentation_target: "assessment_subject",
            title: "WordPress metadata-source response outcome observed",
            disposition: "informational",
            claim_basis: "observation",
            severity: None,
            confidence_ppm: 550_000,
            fingerprint:
                "sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
            evidence_count: 3,
            redacted_summary: "Bounded response evidence from selected public WordPress metadata sources was collected; usable metadata, installation authenticity, vulnerable-code reachability, and advisory impact were not established.",
            category: "wordpress-metadata-source-response",
            cwe: None,
            remediation: AssessmentRemediationDocument {
                id: "wordpress-metadata-review",
                summary: "Confirm the installation inventory and source-qualified metadata before making a security or remediation decision.",
            },
            evidence_references: vec![
                "evidence-0001".to_owned(),
                "evidence-0002".to_owned(),
                "evidence-0003".to_owned(),
            ],
            control_evidence_references: Vec::new(),
            candidate_evidence_references: Vec::new(),
            case_reference: None,
            outcome_reference: None,
            verification_stage: None,
        });
        document.item_count = document.items.len() as u64;
        let review = document.wordpress_review.as_mut().unwrap();
        review.schema = "security.wordpress-review-audit/v7";
        review.review_basis_schema = Some("security.wordpress-review-audit/v1");
        review.additional_request_count = 3;
        review.components.push(WordPressComponentDocument {
            identity: WordPressComponentIdentityDocument {
                kind: "theme",
                slug: "termivar-child".to_owned(),
            },
            evidence_class: "observed_hint",
            identity_sources: vec!["same_origin_asset_path", "theme_stylesheet_declaration"],
            confidence_classes: vec!["structural_hint", "public_declaration"],
            versions: vec![WordPressVersionEvidenceDocument {
                value: "1.2.3".to_owned(),
                source: "theme_stylesheet_declaration",
                confidence: "public_declaration",
            }],
            activation: None,
            inventory_status: None,
        });
        review.components.push(WordPressComponentDocument {
            identity: WordPressComponentIdentityDocument {
                kind: "plugin",
                slug: "termivar-metadata-lab".to_owned(),
            },
            evidence_class: "observed_hint",
            identity_sources: vec!["same_origin_asset_path"],
            confidence_classes: vec!["structural_hint"],
            versions: Vec::new(),
            activation: None,
            inventory_status: None,
        });
        review.component_count = review.components.len();
        document.wordpress_discovery = Some(AssessmentWordPressDiscoveryAuditDocument {
            schema: WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V2,
            capability_id: WORDPRESS_DISCOVERY_CAPABILITY_ID,
            policy_id: WORDPRESS_DISCOVERY_POLICY_ID,
            selected: true,
            method: "get",
            credential_mode: "anonymous",
            seed_count: 3,
            candidate_count: 3,
            candidate_limit_reached: false,
            omitted_candidate_count: 0,
            attempted_request_count: 3,
            completed_response_count: 3,
            committed_response_count: 3,
            response_bytes: 768,
            source_count: 3,
            layout: WordPressDiscoveryLayoutDocument {
                application_reference: format!("sha256:{}", "a".repeat(64)),
                declaration: None,
                roles: vec![
                    WordPressDiscoveryLayoutRoleDocument {
                        role: "core",
                        status: "unresolved",
                        basis: "none",
                        reference: None,
                        candidate_count: 0,
                    },
                    WordPressDiscoveryLayoutRoleDocument {
                        role: "themes",
                        status: "exact",
                        basis: "conventional_asset",
                        reference: Some(format!("sha256:{}", "d".repeat(64))),
                        candidate_count: 1,
                    },
                    WordPressDiscoveryLayoutRoleDocument {
                        role: "plugins",
                        status: "exact",
                        basis: "conventional_asset",
                        reference: Some(format!("sha256:{}", "e".repeat(64))),
                        candidate_count: 1,
                    },
                    WordPressDiscoveryLayoutRoleDocument {
                        role: "rest_index",
                        status: "exact",
                        basis: "structured_advertisement",
                        reference: Some(format!("sha256:{}", "f".repeat(64))),
                        candidate_count: 1,
                    },
                ],
                skipped_foreign_origin_count: 0,
                skipped_sibling_application_count: 0,
                conflicting_association_count: 0,
            },
            page_collection: None,
            supplied_session_pages: None,
            sources: vec![
                WordPressDiscoverySourceDocument {
                    kind: "rest_index",
                    association: "structured_advertisement",
                    resource_reference: format!("sha256:{}", "1".repeat(64)),
                    role_reference: Some(format!("sha256:{}", "f".repeat(64))),
                    component: None,
                    parent_depth: 0,
                    outcome: "observed",
                    request_attempted: true,
                    response_bytes: 256,
                    evidence_reference_count: 1,
                    evidence_references: vec!["evidence-0001".to_owned()],
                    source_page_references: Vec::new(),
                    source_supplied_session_page_references: None,
                    namespaces: vec!["wp/v2".to_owned(), "termivar-lab/v1".to_owned()],
                    theme: None,
                    plugin: None,
                },
                WordPressDiscoverySourceDocument {
                    kind: "theme_stylesheet",
                    association: "observed_conventional",
                    resource_reference: format!("sha256:{}", "2".repeat(64)),
                    role_reference: Some(format!("sha256:{}", "d".repeat(64))),
                    component: Some(WordPressComponentIdentityDocument {
                        kind: "theme",
                        slug: "termivar-child".to_owned(),
                    }),
                    parent_depth: 0,
                    outcome: "observed",
                    request_attempted: true,
                    response_bytes: 256,
                    evidence_reference_count: 1,
                    evidence_references: vec!["evidence-0002".to_owned()],
                    source_page_references: Vec::new(),
                    source_supplied_session_page_references: None,
                    namespaces: Vec::new(),
                    theme: Some(WordPressThemeDiscoveryDocument {
                        name: Some("Termivar child".to_owned()),
                        version: Some("1.2.3".to_owned()),
                        template: Some("termivar-parent".to_owned()),
                        requires_wordpress: Some("6.8".to_owned()),
                        requires_php: Some("8.1".to_owned()),
                        tested_up_to: Some("6.9".to_owned()),
                    }),
                    plugin: None,
                },
                WordPressDiscoverySourceDocument {
                    kind: "plugin_readme",
                    association: "observed_conventional",
                    resource_reference: format!("sha256:{}", "3".repeat(64)),
                    role_reference: Some(format!("sha256:{}", "e".repeat(64))),
                    component: Some(WordPressComponentIdentityDocument {
                        kind: "plugin",
                        slug: "termivar-metadata-lab".to_owned(),
                    }),
                    parent_depth: 0,
                    outcome: "observed",
                    request_attempted: true,
                    response_bytes: 256,
                    evidence_reference_count: 1,
                    evidence_references: vec!["evidence-0003".to_owned()],
                    source_page_references: Vec::new(),
                    source_supplied_session_page_references: None,
                    namespaces: Vec::new(),
                    theme: None,
                    plugin: Some(WordPressPluginDiscoveryDocument {
                        name: Some("Termivar metadata lab".to_owned()),
                        stable_tag: Some("9.9.9".to_owned()),
                        requires_wordpress: Some("6.8".to_owned()),
                        requires_php: Some("8.1".to_owned()),
                        tested_up_to: Some("6.9".to_owned()),
                    }),
                },
            ],
        });
        document
    }

    #[cfg(all(
        feature = "scanning",
        feature = "wordpress-review",
        feature = "supplied-session-review"
    ))]
    fn supplied_session_wordpress_assessment_document() -> AssessmentDocument<'static> {
        let mut document = discovered_wordpress_assessment_document();
        let session = complete_supplied_session_audit_document();
        let page_reference = format!("sha256:{}", "b".repeat(64));
        let resource_reference = session.resources[0].resource_reference.clone();
        let resource_evidence_reference = session.resources[0].evidence_reference.clone();
        let discovery = document.wordpress_discovery.as_mut().unwrap();
        discovery.schema = WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V4;
        discovery.policy_id = WORDPRESS_SUPPLIED_SESSION_DISCOVERY_POLICY_ID;
        discovery.supplied_session_pages = Some(WordPressSuppliedSessionPageCollectionDocument {
            mode: "committed_supplied_session_resources",
            policy_reference: session.policy_reference.clone(),
            application_reference: session.application_reference.clone(),
            principal_reference: session.principal_reference.clone(),
            credential_mechanism: session.credential_mechanism,
            session_epoch: 1,
            selected_count: 1,
            committed_count: 1,
            accepted_association_count: 1,
            rejected_association_count: 0,
            not_established_association_count: 0,
            not_evaluated_count: 0,
            interpreted_response_bytes: 23,
            pages: vec![WordPressSuppliedSessionPageDocument {
                page_reference: page_reference.clone(),
                resource_reference,
                resource_evidence_reference,
                acquisition: "reused_supplied_session_response",
                association: "accepted",
                outcome: "accepted",
                interpreted_response_bytes: 23,
                evidence_reference_count: 1,
                evidence_references: vec!["evidence-0004".to_owned()],
                fingerprint_evaluation: "not_selected_in_v1",
            }],
        });
        for source in &mut discovery.sources {
            source.source_supplied_session_page_references =
                Some(if source.kind == "plugin_readme" {
                    vec![page_reference.clone()]
                } else {
                    Vec::new()
                });
        }
        let item = document
            .items
            .iter_mut()
            .find(|item| item.capability_id == WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID)
            .unwrap();
        item.evidence_count = 4;
        item.evidence_references.push("evidence-0004".to_owned());
        document.supplied_session = Some(session);
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn page_scoped_wordpress_assessment_document() -> AssessmentDocument<'static> {
        let mut document = discovered_wordpress_assessment_document();
        let entry_reference = format!("sha256:{}", "8".repeat(64));
        let page_reference = format!("sha256:{}", "9".repeat(64));
        let discovery = document.wordpress_discovery.as_mut().unwrap();
        discovery.schema = WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V3;
        discovery.policy_id = WORDPRESS_PAGE_SCOPED_DISCOVERY_POLICY_ID;
        discovery.page_collection = Some(WordPressPageCollectionDocument {
            mode: "observed",
            entry_page_reference: entry_reference.clone(),
            candidate_count: 1,
            selected_count: 1,
            omitted_candidate_count: 0,
            reused_response_count: 1,
            fetched_response_count: 0,
            not_observed_count: 0,
            rejected_response_count: 0,
            accepted_association_count: 1,
            rejected_association_count: 0,
            attempted_request_count: 0,
            completed_response_count: 1,
            committed_response_count: 1,
            interpreted_response_bytes: 128,
            response_bytes: 0,
            pages: vec![WordPressPageSourceDocument {
                page_reference: page_reference.clone(),
                acquisition: "reused",
                association: "accepted",
                outcome: "accepted",
                request_attempted: false,
                interpreted_response_bytes: 128,
                response_bytes: 0,
                evidence_reference_count: 1,
                evidence_references: vec!["evidence-0001".to_owned()],
            }],
        });
        for (ordinal, source) in discovery.sources.iter_mut().enumerate() {
            source.evidence_references = vec![format!("evidence-{:04}", ordinal + 2)];
            source.source_page_references = if source.kind == "rest_index" {
                vec![entry_reference.clone()]
            } else {
                vec![page_reference.clone()]
            };
        }
        let item = document
            .items
            .iter_mut()
            .find(|item| item.capability_id == WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID)
            .unwrap();
        item.evidence_count = 4;
        item.evidence_references = (1..=4)
            .map(|ordinal| format!("evidence-{ordinal:04}"))
            .collect();
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn profiled_wordpress_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observed_wordpress_assessment_document();
        let audit = document.wordpress_review.as_mut().unwrap();
        audit.schema = "security.wordpress-review-audit/v2";
        audit.catalog.as_mut().unwrap().revision = "synthetic-v2".to_owned();
        audit.components[0].versions[0].value = "2.4.0-beta1".to_owned();
        let advisory = &mut audit.advisories[0];
        advisory.affected_ranges = vec![WordPressAffectedRangeDocument {
            lower: Some(WordPressVersionEndpointDocument {
                declared: "2.4.0-beta0".to_owned(),
                inclusive: true,
            }),
            upper: Some(WordPressVersionEndpointDocument {
                declared: "2.4.0".to_owned(),
                inclusive: false,
            }),
        }];
        advisory.fixed_versions = vec!["2.4.0".to_owned()];
        advisory.comparison_profile = Some("php-release-subset/v1");
        advisory.version_resolution = Some("supported_equivalent");
        advisory.version_resolution_reason = Some("single_supported_version");
        advisory.version_relation = "within_declared_range";
        advisory.applicability = "candidate_match_on_declared_facts";
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn saved_inventory_wordpress_assessment_document() -> AssessmentDocument<'static> {
        let mut document = observed_wordpress_assessment_document();
        document.items[0].fingerprint =
            "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
        let audit = document.wordpress_review.as_mut().unwrap();
        audit.schema = "security.wordpress-review-audit/v3";
        audit.catalog_schema = Some(WORDPRESS_ADVISORY_CATALOG_SCHEMA);
        audit.inventory_import = Some(WordPressInventoryImportDocument {
            coverage: WordPressInventoryCoverageDocument {
                core: "not_supplied",
                plugins: "supplied",
                themes: "not_supplied",
            },
            component_count: 1,
            limitations: Vec::new(),
            inputs: vec![WordPressInventoryInputDocument {
                class: "wp_cli_plugins_json",
                byte_length: 71,
                sha256: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
                    .to_owned(),
            }],
        });
        audit.components.push(WordPressComponentDocument {
            identity: WordPressComponentIdentityDocument {
                kind: "plugin",
                slug: "synthetic-plugin".to_owned(),
            },
            evidence_class: "operator_supplied",
            identity_sources: vec!["operator_context"],
            confidence_classes: vec!["operator_assertion"],
            versions: vec![WordPressVersionEvidenceDocument {
                value: "1.2.3-vendor".to_owned(),
                source: "operator_context",
                confidence: "operator_assertion",
            }],
            activation: Some("active"),
            inventory_status: Some("active"),
        });
        audit.component_count = audit.components.len();
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn external_wordpress_assessment_document() -> AssessmentDocument<'static> {
        external_wordpress_assessment_document_from_bytes(include_bytes!(
            "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
        ))
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn external_wordpress_assessment_document_from_bytes(
        bytes: &[u8],
    ) -> AssessmentDocument<'static> {
        let catalog = crate::wordpress_review::parse_wordfence_v3_production(bytes).unwrap();
        let inputs = crate::wordpress_review::WordPressReviewInputs::new(None, None)
            .with_wordfence_v3_catalog(catalog)
            .unwrap();
        let signals = [
            crate::wordpress_review::WordPressComponentSignal::same_origin_asset(
                WordPressComponentKind::Plugin,
                "termivar-fixture-component",
            )
            .unwrap(),
        ];
        let result = crate::wordpress_review::evaluate_wordpress_review(&signals, &inputs).unwrap();

        let mut document = observed_wordpress_assessment_document();
        document.items[0].fingerprint =
            "sha256:1123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
        let audit = document.wordpress_review.as_mut().unwrap();
        audit.catalog = None;
        audit.catalog_schema = None;
        audit.inventory_import = None;
        audit.advisories.clear();
        audit.advisory_count = 0;
        audit.components[0] = WordPressComponentDocument {
            identity: WordPressComponentIdentityDocument {
                kind: "plugin",
                slug: "termivar-fixture-component".to_owned(),
            },
            evidence_class: "observed_hint",
            identity_sources: vec!["same_origin_asset_path"],
            confidence_classes: vec!["structural_hint"],
            versions: Vec::new(),
            activation: None,
            inventory_status: None,
        };
        let external_review = wordpress_external_review_document(result.external_review().unwrap());
        audit.schema = if external_review.resource_policy.is_some() {
            "security.wordpress-review-audit/v6"
        } else {
            "security.wordpress-review-audit/v4"
        };
        audit.external_review = Some(external_review);
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn external_fixture_source_association_fingerprint() -> String {
        let catalog = crate::wordpress_review::parse_wordfence_v3_production(
            &include_bytes!(
                "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
            )[..],
        )
        .unwrap();
        let inputs = crate::wordpress_review::WordPressReviewInputs::new(None, None)
            .with_wordfence_v3_catalog(catalog)
            .unwrap();
        let signals = [
            crate::wordpress_review::WordPressComponentSignal::same_origin_asset(
                WordPressComponentKind::Plugin,
                "termivar-fixture-component",
            )
            .unwrap(),
        ];
        let result = crate::wordpress_review::evaluate_wordpress_review(&signals, &inputs).unwrap();
        let evaluation = result
            .external_review()
            .unwrap()
            .evaluations()
            .first()
            .unwrap();
        format!(
            "wordfence-source-association-sha256:{}",
            lowercase_hex(evaluation.key().source_association_sha256())
        )
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn explicitly_profiled_external_wordpress_assessment_document(
        profile: WordPressComparisonProfile,
    ) -> AssessmentDocument<'static> {
        let catalog = crate::wordpress_review::parse_wordfence_v3_production(
            &include_bytes!(
                "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
            )[..],
        )
        .unwrap();
        let context = crate::wordpress_review::parse_wordpress_context(
            br#"{
              "schema":"security.wordpress-context/v1",
              "root":"https://example.test/",
              "components":[
                {"kind":"plugin","slug":"termivar-fixture-component","version":"1.0"}
              ]
            }"#,
        )
        .unwrap();
        let inputs = crate::wordpress_review::WordPressReviewInputs::new(Some(context), None)
            .with_wordfence_v3_catalog(catalog)
            .unwrap()
            .with_external_version_profile(profile)
            .unwrap();
        let signals = [
            crate::wordpress_review::WordPressComponentSignal::same_origin_asset(
                WordPressComponentKind::Plugin,
                "termivar-fixture-component",
            )
            .unwrap(),
        ];
        let result = crate::wordpress_review::evaluate_wordpress_review(&signals, &inputs).unwrap();

        let mut document = observed_wordpress_assessment_document();
        document.items[0].fingerprint =
            "sha256:2123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
        let audit = document.wordpress_review.as_mut().unwrap();
        audit.catalog = None;
        audit.catalog_schema = None;
        audit.inventory_import = None;
        audit.advisories.clear();
        audit.advisory_count = 0;
        audit.components = result
            .components()
            .iter()
            .map(|component| WordPressComponentDocument {
                identity: wordpress_component_identity(component.identity()),
                evidence_class: wordpress_evidence_class(component.evidence_class()),
                identity_sources: component
                    .identity_sources()
                    .iter()
                    .copied()
                    .map(wordpress_evidence_source)
                    .collect(),
                confidence_classes: component
                    .confidence_classes()
                    .iter()
                    .copied()
                    .map(wordpress_confidence)
                    .collect(),
                versions: component
                    .versions()
                    .iter()
                    .map(|version| WordPressVersionEvidenceDocument {
                        value: version.value().to_owned(),
                        source: wordpress_evidence_source(version.source()),
                        confidence: wordpress_confidence(version.confidence()),
                    })
                    .collect(),
                activation: component.activation().map(wordpress_activation),
                inventory_status: component
                    .inventory_status()
                    .map(wordpress_inventory_entry_status),
            })
            .collect();
        audit.component_count = audit.components.len();
        let external_review = wordpress_external_review_document(result.external_review().unwrap());
        audit.schema = if external_review.resource_policy.is_some() {
            "security.wordpress-review-audit/v6"
        } else {
            "security.wordpress-review-audit/v5"
        };
        audit.external_review = Some(external_review);
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn source_identity_external_wordpress_assessment_document(
        profile: Option<WordPressComparisonProfile>,
        collision: bool,
    ) -> AssessmentDocument<'static> {
        const FIRST_ID: &str = "00000000-0000-4000-8000-000000000001";
        let mut source: serde_json::Value = serde_json::from_slice(include_bytes!(
            "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
        ))
        .unwrap();
        let software = source[FIRST_ID]["software"].as_array_mut().unwrap();
        if collision {
            let mut alternate = software[0].clone();
            alternate["slug"] = serde_json::Value::String("TERMIVAR-FIXTURE-COMPONENT".to_owned());
            software.push(alternate);
        } else {
            software[0]["slug"] =
                serde_json::Value::String("Termivar-Fixture-Component".to_owned());
        }
        let encoded = serde_json::to_vec(&source).unwrap();
        let catalog =
            crate::wordpress_review::parse_wordfence_v3_production(encoded.as_slice()).unwrap();
        let context = profile.map(|_| {
            crate::wordpress_review::parse_wordpress_context(
                br#"{
                  "schema":"security.wordpress-context/v1",
                  "root":"https://example.test/",
                  "components":[
                    {"kind":"plugin","slug":"termivar-fixture-component","version":"1.0"}
                  ]
                }"#,
            )
            .unwrap()
        });
        let inputs = crate::wordpress_review::WordPressReviewInputs::new(context, None)
            .with_wordfence_v3_catalog(catalog)
            .unwrap();
        let inputs = if let Some(profile) = profile {
            inputs.with_external_version_profile(profile).unwrap()
        } else {
            inputs
        };
        let signals = [
            crate::wordpress_review::WordPressComponentSignal::same_origin_asset(
                WordPressComponentKind::Plugin,
                "termivar-fixture-component",
            )
            .unwrap(),
        ];
        let result = crate::wordpress_review::evaluate_wordpress_review(&signals, &inputs).unwrap();

        let mut document = profile.map_or_else(external_wordpress_assessment_document, |profile| {
            explicitly_profiled_external_wordpress_assessment_document(profile)
        });
        let audit = document.wordpress_review.as_mut().unwrap();
        audit.schema = "security.wordpress-review-audit/v6";
        audit.external_review = Some(wordpress_external_review_document(
            result.external_review().unwrap(),
        ));
        document
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn unresolved_identity_external_wordpress_assessment_document(
        profile: Option<WordPressComparisonProfile>,
    ) -> AssessmentDocument<'static> {
        unresolved_identity_external_wordpress_assessment_document_with_slug(
            profile,
            "vendor/plugin.php",
        )
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    fn unresolved_identity_external_wordpress_assessment_document_with_slug(
        profile: Option<WordPressComparisonProfile>,
        source_slug: &str,
    ) -> AssessmentDocument<'static> {
        const FIRST_ID: &str = "00000000-0000-4000-8000-000000000001";
        let mut source: serde_json::Value = serde_json::from_slice(include_bytes!(
            "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
        ))
        .unwrap();
        source[FIRST_ID]["software"][0]["slug"] = serde_json::Value::String(source_slug.to_owned());
        let encoded = serde_json::to_vec(&source).unwrap();
        let catalog =
            crate::wordpress_review::parse_wordfence_v3_production(encoded.as_slice()).unwrap();
        let context = profile.map(|_| {
            crate::wordpress_review::parse_wordpress_context(
                br#"{
                  "schema":"security.wordpress-context/v1",
                  "root":"https://example.test/",
                  "components":[
                    {"kind":"plugin","slug":"termivar-fixture-component","version":"1.0"}
                  ]
                }"#,
            )
            .unwrap()
        });
        let inputs = crate::wordpress_review::WordPressReviewInputs::new(context, None)
            .with_wordfence_v3_catalog(catalog)
            .unwrap();
        let inputs = if let Some(profile) = profile {
            inputs.with_external_version_profile(profile).unwrap()
        } else {
            inputs
        };
        let signals = [
            crate::wordpress_review::WordPressComponentSignal::same_origin_asset(
                WordPressComponentKind::Plugin,
                "termivar-fixture-component",
            )
            .unwrap(),
        ];
        let result = crate::wordpress_review::evaluate_wordpress_review(&signals, &inputs).unwrap();

        let mut document = profile.map_or_else(external_wordpress_assessment_document, |profile| {
            explicitly_profiled_external_wordpress_assessment_document(profile)
        });
        let audit = document.wordpress_review.as_mut().unwrap();
        audit.schema = "security.wordpress-review-audit/v6";
        audit.external_review = Some(wordpress_external_review_document(
            result.external_review().unwrap(),
        ));
        document
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn assessment_json_schema_is_additive_minimized_and_linkage_preserving() {
        let document = complete_assessment_document();
        let rendered =
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let value: serde_json::Value = serde_json::from_str(&rendered).unwrap();
        assert_eq!(value["schema"], ASSESSMENT_REPORT_DOCUMENT_SCHEMA);
        assert_eq!(
            value["source_schema"],
            crate::web_runtime::ASSESSMENT_RUN_REPORT_SCHEMA
        );
        assert_eq!(value["run_schema"], termivar_core::RUN_REPORT_SCHEMA);
        assert_eq!(value["profile_schema"], "venom.scan-profile/v1");
        assert_eq!(value["profile"], "web-review");
        assert_eq!(value["status"], "complete");
        assert_eq!(value["subject_count"], 1);
        assert_eq!(value["item_count"], 3);
        let item_keys = value["items"][0]
            .as_object()
            .unwrap()
            .keys()
            .map(String::as_str)
            .collect::<BTreeSet<_>>();
        assert_eq!(
            item_keys,
            BTreeSet::from([
                "candidate_evidence_references",
                "capability_id",
                "case_reference",
                "category",
                "claim_basis",
                "confidence_ppm",
                "control_evidence_references",
                "cwe",
                "disposition",
                "evidence_count",
                "evidence_references",
                "fingerprint",
                "outcome_reference",
                "redacted_summary",
                "remediation",
                "schema",
                "severity",
                "subject_reference",
                "title",
                "verification_stage",
            ])
        );
        assert!(value["items"][0].get("presentation_target").is_none());
        assert_eq!(value["items"][0]["disposition"], "informational");
        assert_eq!(value["items"][0]["claim_basis"], "observation");
        assert_eq!(
            value["items"][0]["evidence_references"],
            serde_json::json!(["evidence-0000"])
        );
        assert_eq!(value["items"][1]["disposition"], "needs_review");
        assert_eq!(value["items"][1]["claim_basis"], "differential");
        assert_eq!(
            value["items"][1]["control_evidence_references"],
            serde_json::json!(["evidence-0001"])
        );
        assert_eq!(
            value["items"][1]["candidate_evidence_references"],
            serde_json::json!(["evidence-0002"])
        );
        assert_eq!(value["items"][2]["disposition"], "confirmed");
        assert_eq!(value["items"][2]["claim_basis"], "verifier_transition");
        assert_eq!(value["items"][2]["case_reference"], "case-0000");
        assert_eq!(value["items"][2]["outcome_reference"], "outcome-0000");
        assert_eq!(value["items"][2]["verification_stage"], "active");
        assert!(!rendered.contains(REPORT_DOCUMENT_SCHEMA));
        for forbidden_key in [
            "target",
            "authorized_origin",
            "body",
            "headers",
            "cookie",
            "authorization",
            "case_id",
            "outcome_id",
            "verifier_rule_id",
        ] {
            assert!(value.get(forbidden_key).is_none());
        }
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn assessment_dispositions_claim_bases_and_opaque_links_are_visible_in_every_format() {
        let document = complete_assessment_document();
        for format in ReportGenerator::available_formats() {
            let rendered = render_assessment_with_limit(&document, *format, usize::MAX).unwrap();
            for token in [
                "informational",
                "needs_review",
                "confirmed",
                "observation",
                "differential",
                "verifier_transition",
                "evidence-0000",
                "evidence-0001",
                "evidence-0002",
                "evidence-0003",
                "evidence-0004",
                "case-0000",
                "outcome-0000",
                "active",
            ] {
                assert!(rendered.contains(token), "{format:?} omitted {token}");
            }
        }
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn assessment_human_reports_lead_with_bounded_decisions_and_actionable_items() {
        let document = complete_assessment_document();
        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap(),
            html
        );
        assert_eq!(
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap(),
            markdown
        );

        for (rendered, headings) in [
            (
                html.as_str(),
                [
                    "<h2>Decision overview</h2>",
                    "<h2>Actionable items</h2>",
                    "<h2>Technical audit appendix</h2>",
                ],
            ),
            (
                markdown.as_str(),
                [
                    "## Decision overview",
                    "## Actionable items",
                    "## Technical audit appendix",
                ],
            ),
        ] {
            let positions = headings.map(|heading| {
                rendered
                    .find(heading)
                    .unwrap_or_else(|| panic!("missing human-report heading {heading}"))
            });
            assert!(positions[0] < positions[1] && positions[1] < positions[2]);
            for literal in [
                "These counts describe typed assessment items, not a count of confirmed vulnerabilities.",
                "Verifier-bound confirmed items",
                "Needs-review candidates",
                "Informational observations",
                "What was observed",
                "Opaque assessment subject reference (not proof of affectedness or location)",
                "Assessment target kind (resource location withheld)",
                "Collection and principal context",
                "What was not established",
                "Recommended action (not a verified fix)",
                "Safe verification guidance",
                "Item schema",
                "Evidence reference count",
                "Recommendation ID",
                "report integrity does not establish target truth or remediation",
            ] {
                assert!(rendered.contains(literal), "human report omitted {literal}");
            }
            for title in [
                "Verifier-authorized transition",
                "CORS policy relationship warrants review",
                "Strict transport policy was not observed",
            ] {
                assert_eq!(rendered.matches(title).count(), 1, "{title}");
            }
            let confirmed = rendered.find("Verifier-authorized transition").unwrap();
            let needs_review = rendered
                .find("CORS policy relationship warrants review")
                .unwrap();
            let informational = rendered
                .find("Strict transport policy was not observed")
                .unwrap();
            assert!(confirmed < needs_review && needs_review < informational);
            assert!(rendered.contains(
                "This observation alone does not establish a vulnerability, exploitability, impact, or remediation."
            ));
            assert!(rendered.contains(
                "This review candidate is not a confirmed vulnerability; exploitability, impact, and remediation were not established."
            ));
            assert!(rendered.contains(
                "Confirmation applies only to the cited verifier transition; broader impact, root cause, and remediation remain unestablished unless separately evidenced."
            ));
            assert!(rendered.contains("report integrity alone does not verify remediation"));
            assert!(rendered.contains(
                "only if the exact target, context, case, and separate current authorization are established"
            ));
            assert!(rendered.contains(
                "This is evidence-assurance order, not severity, impact, or remediation priority."
            ));
            assert!(
                rendered.contains("Unassigned severity does not mean low or zero")
                    || rendered.contains("unassigned does not mean low or zero")
            );
            assert_eq!(
                rendered
                    .matches("Assessment target kind (resource location withheld)")
                    .count(),
                3
            );
            assert_eq!(rendered.matches("assessment_subject").count(), 3);
        }

        for (label, count) in [
            ("Verifier-bound confirmed items", 1),
            ("Needs-review candidates", 1),
            ("Informational observations", 1),
        ] {
            assert!(html.contains(&format!("<strong>{count}</strong><span>{label}</span>")));
            assert!(markdown.contains(&format!("- {label}: `{count}`")));
        }

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        for machine in [&json, &csv] {
            for presentation_only in [
                "Decision overview",
                "Actionable items",
                "Assessment target kind (resource location withheld)",
                "presentation_target",
                "assessment_subject",
                "What was not established",
                "Safe verification guidance",
                "Technical audit appendix",
            ] {
                assert!(!machine.contains(presentation_only));
            }
        }
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn empty_assessment_human_reports_do_not_claim_security_or_complete_coverage() {
        let mut document = observation_assessment_document("test.observation@1");
        document.items.clear();
        document.item_count = 0;
        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains(
                "No assessment item was projected. This does not establish that the application is secure or that coverage was exhaustive."
            ));
            assert!(rendered.contains(
                "No assessment items were projected. This is not evidence that the application is secure or that assessment coverage was complete."
            ));
            assert!(rendered.contains("Verifier-bound confirmed items"));
            assert!(rendered.contains("Needs-review candidates"));
            assert!(rendered.contains("Informational observations"));
            assert!(!rendered.contains("Result: secure"));
            assert!(!rendered.contains("Coverage: complete"));
        }
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn actionable_items_do_not_invent_item_level_principal_attribution() {
        let mut document = complete_assessment_document();
        document.supplied_session = Some(complete_supplied_session_audit_document());
        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            let limitation = "The run includes a supplied-session audit, but this item is not assigned to a principal by the current report contract.";
            assert_eq!(rendered.matches(limitation).count(), 3);
            assert!(rendered.contains("operator_declared"));
            assert!(rendered.contains("Continuous authentication established"));
            assert!(!rendered.contains("observed by fixture-user"));
            assert!(!rendered.contains("authenticated finding"));
        }
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn absent_supplied_session_audit_preserves_every_rendered_contract() {
        let document = complete_assessment_document();
        assert!(document.supplied_session.is_none());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert!(parsed.get("supplied_session").is_none());

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(!csv.contains("supplied_session_audit"));

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(!html.contains("Supplied session assessment audit"));

        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(!markdown.contains("Supplied session assessment audit"));
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn supplied_session_audit_is_value_free_audit_only_and_visible_in_every_format() {
        let mut document = observation_assessment_document("test.observation@1");
        document.supplied_session = Some(complete_supplied_session_audit_document());
        document.validate().unwrap();

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["supplied_session"];
        assert_eq!(audit["schema"], SUPPLIED_SESSION_AUDIT_SCHEMA);
        assert_eq!(audit["capability_id"], SUPPLIED_SESSION_CAPABILITY_ID);
        assert_eq!(
            audit["principal_reference"],
            "supplied-session-principal-0001"
        );
        assert_eq!(audit["principal_alias"], "fixture-user");
        assert_eq!(audit["principal_assurance"], "operator_declared");
        assert_eq!(audit["credential_mechanism"], "authorization_header");
        assert_eq!(audit["outcome"], "complete");
        assert_eq!(audit["coverage"], "complete");
        assert_eq!(audit["response_byte_limit"], 65_536);
        assert_eq!(audit["response_byte_limit_exceeded"], false);
        assert_eq!(audit["checkpoints"].as_array().unwrap().len(), 2);
        assert!(audit["checkpoints"][0]["evidence_reference"]
            .as_str()
            .unwrap()
            .starts_with("supplied-session-checkpoint-evidence-sha256:"));
        assert_eq!(audit["resources"].as_array().unwrap().len(), 1);
        assert!(audit["resources"][0]["evidence_reference"]
            .as_str()
            .unwrap()
            .starts_with("supplied-session-resource-evidence-sha256:"));
        assert_eq!(audit["exploit_execution"], "not_performed");
        assert_eq!(audit["impact_validation"], "not_performed");
        assert!(json.contains("supplied-session-resource-sha256:"));
        for forbidden in ["Authorization", "Bearer ", "https://", "cookie"] {
            assert!(!json.contains(forbidden));
        }

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(csv.contains("supplied_session_audit"));
        assert!(csv.contains("subject_boundary") || csv.contains("terminal"));
        assert!(csv.contains("supplied-session-resource-sha256:"));
        assert!(csv.contains("supplied-session-resource-evidence-sha256:"));
        assert!(csv.contains("supplied-session-checkpoint-evidence-sha256:"));

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(html.contains("Supplied session assessment audit"));
        assert!(html.contains("Health oracle"));
        assert!(html.contains("json_boolean_true"));
        assert!(html.contains("supplied-session-health-field-sha256:"));
        assert!(html.contains("Health checkpoints"));
        assert!(html.contains("Protected resources"));
        assert!(html.contains("supplied-session-resource-evidence-sha256:"));
        assert!(html.contains("supplied-session-checkpoint-evidence-sha256:"));

        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(markdown.contains("\n### Supplied session assessment audit\n"));
        assert!(!markdown.contains("\n## Supplied session assessment audit\n"));
        assert!(markdown.contains("Health oracle"));
        assert!(markdown.contains("json_boolean_true"));
        assert!(markdown.contains("supplied-session-health-field-sha256:"));
        assert!(markdown.contains("\n#### Health checkpoints\n"));
        assert!(markdown.contains("\n#### Protected resources\n"));
        assert!(!markdown.contains("\n### Health checkpoints\n"));
        assert!(!markdown.contains("\n### Protected resources\n"));
        assert!(markdown.contains("supplied-session-resource-evidence-sha256:"));
        assert!(markdown.contains("supplied-session-checkpoint-evidence-sha256:"));
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn cookie_supplied_session_audit_is_strict_value_free_and_visible_in_every_format() {
        let mut document = observation_assessment_document("test.observation@1");
        document.supplied_session = Some(complete_cookie_supplied_session_audit_document());
        document
            .supplied_session
            .as_ref()
            .unwrap()
            .validate(&document.items)
            .unwrap();
        document.validate().unwrap();

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["supplied_session"];
        assert_eq!(audit["schema"], SUPPLIED_SESSION_COOKIE_AUDIT_SCHEMA);
        assert_eq!(audit["credential_mechanism"], "cookie_jar");
        assert_eq!(audit["cookie_policy"]["declared_count"], 2);
        assert_eq!(audit["cookie_policy"]["host_only_count"], 1);
        assert_eq!(audit["cookie_policy"]["domain_count"], 1);
        assert_eq!(
            audit["cookie_policy"]["browser_semantics"],
            "attributes_preserved_not_browser_csrf_emulation"
        );
        assert_eq!(
            audit["cookie_lifecycle"]["unselected_update_response_count"],
            1
        );
        assert_eq!(audit["cookie_lifecycle"]["updates_applied"], 0);
        for forbidden in [
            "cookie-session-secret-canary",
            "selected-cookie-name",
            "example.test/private",
            "session-cookie.tsv",
        ] {
            assert!(!json.contains(forbidden));
        }

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(csv.contains("attributes_preserved_not_browser_csrf_emulation"));
        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(html.contains("Declared cookies"));
        assert!(html.contains("Cookie updates applied"));
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(markdown.contains("Declared cookies"));
        assert!(markdown.contains("Cookie updates applied"));
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn form_login_supplied_session_audit_is_value_free_and_keeps_the_epoch_transition() {
        let mut document = observation_assessment_document("test.observation@1");
        document.supplied_session = Some(complete_form_login_supplied_session_audit_document());
        document.validate().unwrap();

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["supplied_session"];
        assert_eq!(audit["schema"], SUPPLIED_SESSION_FORM_LOGIN_AUDIT_SCHEMA);
        assert_eq!(audit["credential_mechanism"], "cookie_jar");
        assert_eq!(audit["credential_acquisition"], "bounded_form_login");
        assert_eq!(audit["login"]["max_attempts"], 1);
        assert_eq!(audit["login"]["attempt_count"], 1);
        assert_eq!(audit["login"]["form_outcome"], "matched");
        assert_eq!(audit["login"]["submit_outcome"], "cookie_acquired");
        assert_eq!(audit["login"]["initial_epoch"], 0);
        assert_eq!(audit["login"]["final_epoch"], 1);
        assert_eq!(audit["cookie_lifecycle"]["initial_epoch"], 0);
        assert_eq!(audit["cookie_lifecycle"]["final_epoch"], 1);
        assert_eq!(audit["dispatched_request_count"], 5);
        assert_eq!(audit["response_bytes"], 113);
        for forbidden in [
            "S07-username-secret",
            "S07-password-secret",
            "S07-csrf-secret",
            "session-cookie-secret",
            "username_field",
            "password_field",
            "csrf_field",
        ] {
            assert!(!json.contains(forbidden));
        }

        for format in [
            ReportFormat::Csv,
            ReportFormat::Html,
            ReportFormat::Markdown,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("bounded_form_login"));
            assert!(rendered.contains("cookie_acquired"));
            assert!(rendered.contains("supplied-session-login-sha256:"));
            assert!(!rendered.contains("S07-password-secret"));
        }

        let mut invalid = complete_form_login_supplied_session_audit_document();
        invalid.login.as_mut().unwrap().initial_epoch = 1;
        assert_eq!(invalid.validate(&[]), Err(ReportError::Serialization));
        let mut invalid = complete_form_login_supplied_session_audit_document();
        invalid.login.as_mut().unwrap().acquired_cookie_count = 0;
        assert_eq!(invalid.validate(&[]), Err(ReportError::Serialization));
        let mut invalid = complete_form_login_supplied_session_audit_document();
        invalid.login.as_mut().unwrap().form_error_code = Some("S07-password-secret");
        assert_eq!(invalid.validate(&[]), Err(ReportError::Serialization));
        let mut invalid = complete_form_login_supplied_session_audit_document();
        invalid.login = None;
        assert_eq!(invalid.validate(&[]), Err(ReportError::Serialization));
        let mut invalid = complete_form_login_supplied_session_audit_document();
        invalid
            .cookie_lifecycle
            .as_mut()
            .unwrap()
            .unselected_update_response_count = 4;
        assert_eq!(invalid.validate(&[]), Err(ReportError::Serialization));

        let failed_login = unavailable_form_login_supplied_session_audit_document();
        failed_login.validate(&[]).unwrap();
        let failure_json = failed_login.wire_json().unwrap();
        let failure: serde_json::Value = serde_json::from_str(&failure_json).unwrap();
        assert_eq!(failure["outcome"], "login_form_unavailable");
        assert_eq!(failure["coverage"], "none");
        assert_eq!(failure["login"]["form_outcome"], "missing");
        assert_eq!(failure["login"]["form_error_code"], "missing_csrf");
        assert_eq!(failure["login"]["submit_outcome"], "not_dispatched");
        assert_eq!(failure["login"]["final_epoch"], 0);
        assert_eq!(failure["cookie_lifecycle"]["final_epoch"], 0);
        assert_eq!(failure["dispatched_request_count"], 1);
        assert_eq!(failure["response_bytes"], 41);
        for forbidden in [
            "S07-username-secret",
            "S07-password-secret",
            "S07-csrf-secret",
            "session-cookie-secret",
        ] {
            assert!(!failure_json.contains(forbidden));
        }

        for forged_outcome in ["runtime_limit", "cancelled"] {
            let mut invalid = unavailable_form_login_supplied_session_audit_document();
            invalid.outcome = forged_outcome;
            assert_eq!(
                invalid.validate(&[]),
                Err(ReportError::Serialization),
                "missing form state was accepted as {forged_outcome}"
            );
        }

        let mut unavailable_body = unavailable_form_login_supplied_session_audit_document();
        let login = unavailable_body.login.as_mut().unwrap();
        login.form_outcome = "ineligible_response";
        login.form_error_code = Some("inexact_final_target");
        login.page_body_state = "unavailable";
        assert_eq!(
            unavailable_body.validate(&[]),
            Err(ReportError::Serialization)
        );

        let unavailable_cookie = unavailable_form_login_cookie_supplied_session_audit_document();
        unavailable_cookie.validate(&[]).unwrap();
        let unavailable_cookie_json = unavailable_cookie.wire_json().unwrap();
        let unavailable_cookie_value: serde_json::Value =
            serde_json::from_str(&unavailable_cookie_json).unwrap();
        assert_eq!(
            unavailable_cookie_value["outcome"],
            "login_cookie_unavailable"
        );
        assert_eq!(
            unavailable_cookie_value["login"]["submit_outcome"],
            "cookie_unavailable"
        );
        assert_eq!(
            unavailable_cookie_value["checkpoints"],
            serde_json::json!([])
        );
        assert_eq!(
            unavailable_cookie_value["resources"][0]["outcome"],
            "not_dispatched"
        );

        let mut unavailable_redirect =
            unavailable_form_login_cookie_supplied_session_audit_document();
        unavailable_redirect.outcome = "login_submit_unavailable";
        let login = unavailable_redirect.login.as_mut().unwrap();
        login.submit_outcome = "redirect_refused";
        login.submit_status = Some(302);
        login.submit_body_state = "unavailable";
        assert_eq!(
            unavailable_redirect.validate(&[]),
            Err(ReportError::Serialization)
        );

        let mut forged_epoch = complete_form_login_supplied_session_audit_document();
        forged_epoch.login.as_mut().unwrap().final_epoch = 0;
        forged_epoch.cookie_lifecycle.as_mut().unwrap().final_epoch = 0;
        assert_eq!(forged_epoch.validate(&[]), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn supplied_session_writer_keeps_v1_and_v2_cookie_contracts_disjoint() {
        let mut v1_with_cookie_fields = complete_supplied_session_audit_document();
        let v2 = complete_cookie_supplied_session_audit_document();
        v1_with_cookie_fields.cookie_policy = v2.cookie_policy;
        v1_with_cookie_fields.cookie_lifecycle = v2.cookie_lifecycle;
        assert_eq!(
            v1_with_cookie_fields.validate(&[]),
            Err(ReportError::Serialization)
        );

        let mut v2_missing_policy = complete_cookie_supplied_session_audit_document();
        v2_missing_policy.cookie_policy = None;
        assert_eq!(
            v2_missing_policy.validate(&[]),
            Err(ReportError::Serialization)
        );

        let mut wrong_partition = complete_cookie_supplied_session_audit_document();
        wrong_partition
            .cookie_policy
            .as_mut()
            .unwrap()
            .host_only_count = 2;
        assert_eq!(
            wrong_partition.validate(&[]),
            Err(ReportError::Serialization)
        );

        let mut insecure_same_site_none = complete_cookie_supplied_session_audit_document();
        insecure_same_site_none
            .cookie_policy
            .as_mut()
            .unwrap()
            .secure_count = 0;
        assert_eq!(
            insecure_same_site_none.validate(&[]),
            Err(ReportError::Serialization)
        );

        let mut false_update_outcome = complete_cookie_supplied_session_audit_document();
        false_update_outcome.outcome = "credential_update_required";
        false_update_outcome.coverage = "partial";
        assert_eq!(
            false_update_outcome.validate(&[]),
            Err(ReportError::Serialization)
        );

        for login_outcome in [
            "login_form_unavailable",
            "login_submit_unavailable",
            "login_cookie_unavailable",
        ] {
            let mut v1 = complete_supplied_session_audit_document();
            let mut v2 = complete_cookie_supplied_session_audit_document();
            for document in [&mut v1, &mut v2] {
                document.outcome = login_outcome;
                document.coverage = "none";
                document.checkpoints.clear();
                document.resources[0].evidence_reference = None;
                document.resources[0].outcome = "not_dispatched";
                document.resources[0].status = None;
                document.resources[0].response_bytes = 0;
                document.dispatched_resource_count = 0;
                document.committed_resource_count = 0;
                document.dispatched_request_count = 0;
                document.response_bytes = 0;
                if let Some(lifecycle) = document.cookie_lifecycle.as_mut() {
                    lifecycle.unselected_update_response_count = 0;
                }
                assert_eq!(
                    document.validate(&[]),
                    Err(ReportError::Serialization),
                    "legacy schema accepted V3-only outcome {login_outcome}"
                );
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn supplied_session_writer_rejects_v1_cookie_stop_outcomes_but_accepts_v2_states() {
        for (outcome, coverage) in [
            ("credential_update_required", "partial"),
            ("credential_update_unusable", "none"),
        ] {
            let mut v1 = complete_supplied_session_audit_document();
            v1.outcome = outcome;
            v1.coverage = coverage;
            assert_eq!(
                v1.validate(&[]),
                Err(ReportError::Serialization),
                "V1 accepted cookie-only outcome {outcome}"
            );
        }

        let mut required =
            stopped_cookie_supplied_session_audit_document("credential_update_required");
        required
            .cookie_lifecycle
            .as_mut()
            .unwrap()
            .selected_update_response_count = 1;
        required.validate(&[]).unwrap();

        let mut unusable =
            stopped_cookie_supplied_session_audit_document("credential_update_unusable");
        unusable
            .cookie_lifecycle
            .as_mut()
            .unwrap()
            .update_classification_failure_count = 1;
        unusable.validate(&[]).unwrap();

        unusable
            .cookie_lifecycle
            .as_mut()
            .unwrap()
            .unselected_update_response_count = 1;
        assert_eq!(unusable.validate(&[]), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn supplied_session_writer_rejects_duplicate_activity_evidence_references() {
        let mut duplicate_checkpoint = complete_supplied_session_audit_document();
        duplicate_checkpoint.checkpoints[1].evidence_reference = duplicate_checkpoint.checkpoints
            [0]
        .evidence_reference
        .clone();
        assert_eq!(
            duplicate_checkpoint.validate(&[]),
            Err(ReportError::Serialization)
        );

        let mut duplicate_resource = complete_supplied_session_audit_document();
        duplicate_resource.checkpoints[1].phase = "subject_boundary";
        duplicate_resource
            .checkpoints
            .push(AssessmentSuppliedSessionCheckpointDocument {
                sequence: 2,
                phase: "terminal",
                after_subject_count: 2,
                evidence_reference: Some(format!(
                    "supplied-session-checkpoint-evidence-sha256:{}",
                    "8".repeat(64)
                )),
                outcome: "healthy",
                status: Some(200),
                body_state: "complete",
                predicate: "matched",
                response_bytes: 31,
                epoch: None,
            });
        duplicate_resource
            .resources
            .push(AssessmentSuppliedSessionResourceDocument {
                sequence: 1,
                resource_reference: format!("supplied-session-resource-sha256:{}", "9".repeat(64)),
                evidence_reference: duplicate_resource.resources[0].evidence_reference.clone(),
                outcome: "committed",
                status: Some(200),
                response_bytes: 29,
                epoch: 1,
            });
        duplicate_resource.selected_resource_count = 2;
        duplicate_resource.dispatched_resource_count = 2;
        duplicate_resource.committed_resource_count = 2;
        duplicate_resource.dispatched_request_count = 5;
        duplicate_resource.response_bytes = 119;
        assert_eq!(
            duplicate_resource.validate(&[]),
            Err(ReportError::Serialization)
        );
    }

    #[cfg(all(feature = "scanning", feature = "supplied-session-review"))]
    #[test]
    fn supplied_session_writer_preserves_an_honest_single_chunk_byte_overrun() {
        let mut overrun = complete_supplied_session_audit_document();
        overrun.resources[0].response_bytes = MAX_SUPPLIED_SESSION_TOTAL_RESPONSE_BYTES + 1;
        overrun.response_bytes = MAX_SUPPLIED_SESSION_TOTAL_RESPONSE_BYTES + 37;
        overrun.response_byte_limit = MAX_SUPPLIED_SESSION_TOTAL_RESPONSE_BYTES;
        overrun.response_byte_limit_exceeded = true;
        assert!(overrun.validate(&[]).is_ok());

        overrun.response_byte_limit_exceeded = false;
        assert_eq!(overrun.validate(&[]), Err(ReportError::Serialization));

        overrun.response_byte_limit = 0;
        overrun.response_byte_limit_exceeded = true;
        assert_eq!(overrun.validate(&[]), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "authorization-review"))]
    #[test]
    fn absent_authorization_audit_adds_no_wire_field_row_or_section() {
        let document = complete_assessment_document();
        assert!(document.authorization_review.is_none());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert!(parsed.get("authorization_review").is_none());

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(!csv.contains("authorization_review_audit"));

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(!html.contains("Resource authorization review audit"));

        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(!markdown.contains("Resource authorization review audit"));
    }

    #[cfg(all(feature = "scanning", feature = "websocket-review"))]
    #[test]
    fn websocket_review_writer_is_value_free_strict_and_honest_in_every_format() {
        let mut document = observation_assessment_document("ordinary-observation");
        document.items.clear();
        document.item_count = 0;
        document.websocket_review = Some(websocket_review_document());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["websocket_review"];
        assert_eq!(audit["schema"], WEBSOCKET_REVIEW_AUDIT_SCHEMA);
        assert!(audit.get("supplied_session_context").is_none());
        assert_eq!(audit["coverage"]["transport_read_bytes"], 241);
        assert_eq!(audit["coverage"]["accounted_transport_response_bytes"], 241);
        assert_eq!(audit["methodology"]["physical_frame_count"], "unavailable");
        assert_eq!(audit["messages"].as_array().unwrap().len(), 2);
        for forbidden in [
            "observed_response_reference",
            "outbound_frame_count",
            "inbound_frame_count",
            "max_frames",
            "wss://",
            "payload",
            "private-subprotocol",
            "backend error",
        ] {
            assert!(!json.contains(forbidden));
        }

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(csv.contains("websocket_review_audit"));
        assert!(csv.contains("accounted_transport_response_bytes"));
        assert!(!csv.contains("observed_response_reference"));

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        for rendered in [&html, &markdown] {
            assert!(rendered.contains("WebSocket protocol review audit"));
            assert!(rendered.contains("encrypted TLS records"));
            assert!(rendered.contains("websocket-message-revision-sha256:"));
            assert!(!rendered.contains("observed_response_reference"));
        }

        document
            .websocket_review
            .as_mut()
            .unwrap()
            .coverage
            .transport_read_bytes = 14;
        document
            .websocket_review
            .as_mut()
            .unwrap()
            .coverage
            .accounted_transport_response_bytes = 14;
        assert_eq!(document.validate(), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
    #[test]
    fn xml_external_entity_review_writer_is_value_free_strict_and_rendered_everywhere() {
        let mut document = xml_external_entity_assessment_document();

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        comparison::import_assessment_summary(json.as_bytes()).unwrap();
        let audit = &parsed["xml_external_entity_review"];
        assert_eq!(audit["schema"], XML_EXTERNAL_ENTITY_REVIEW_AUDIT_SCHEMA);
        assert_eq!(audit["policy"]["method"], "post");
        assert_eq!(audit["target"]["request_count"], 3);
        assert_eq!(audit["provider"]["event_identities_distinct"], true);
        assert_eq!(audit["semantic_effect"], "not_performed");
        assert_eq!(audit["impact_validation"], "not_performed");
        assert_eq!(audit["claim_limits"].as_array().unwrap().len(), 7);

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(csv.contains("xml_external_entity_review_audit"));
        assert!(csv.contains(XML_EXTERNAL_ENTITY_REVIEW_AUDIT_SCHEMA));
        let audit_row = csv
            .lines()
            .find(|line| line.contains("xml_external_entity_review_audit"))
            .unwrap();
        let audit_cells = parse_csv_line(audit_row);
        assert_eq!(audit_cells.len(), ASSESSMENT_CSV_HEADERS.len());
        assert_eq!(audit_cells[18], "8");
        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        for rendered in [&json, &csv, &html, &markdown] {
            assert!(rendered.contains("xml-external-entity-policy-sha256:"));
            assert!(rendered.contains("not_confirmed_xxe"));
            for forbidden in [
                "https://provider.invalid",
                "/private/xml-endpoint",
                "<!DOCTYPE",
                "SYSTEM",
                "file:///",
                "callback-token-sentinel",
                "raw-provider-error",
            ] {
                assert!(!rendered.contains(forbidden));
            }
        }

        document
            .xml_external_entity_review
            .as_mut()
            .unwrap()
            .provider
            .control_callback_observed = true;
        assert_eq!(document.validate(), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
    #[test]
    fn xml_external_entity_review_empty_negative_audit_is_allowed_but_positive_item_requires_it() {
        let mut document = observation_assessment_document("ordinary-observation");
        document.items.clear();
        document.item_count = 0;
        let mut audit = xml_external_entity_review_document();
        audit.outcome = "not_eligible";
        audit.target.request_count = 0;
        audit.target.request_body_bytes = 0;
        audit.target.response_bytes = 0;
        audit.target.complete = false;
        audit.target.accounting_complete = false;
        audit.provider.request_count = 0;
        audit.provider.active_verification_count = 0;
        audit.provider.preflight_clean = false;
        audit.provider.candidate_callback_observed = false;
        audit.provider.replay_callback_observed = false;
        audit.provider.callback_targets_distinct = false;
        audit.provider.event_identities_distinct = false;
        audit.provider.cleanup_verified = false;
        audit.provider.complete = false;
        audit.item_projected = false;
        document.xml_external_entity_review = Some(audit);
        assert!(document.validate().is_ok());

        document.items.push(xml_external_entity_item_document());
        document.item_count = 1;
        assert_eq!(document.validate(), Err(ReportError::Serialization));
        document.xml_external_entity_review = None;
        assert_eq!(document.validate(), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
    #[test]
    fn xml_external_entity_review_writer_rejects_substituted_item_contract() {
        assert!(xml_external_entity_assessment_document().validate().is_ok());

        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.subject_reference = "subject-0001".to_owned();
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.presentation_target = "request";
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.title = "Substituted XML observation";
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.category = "substituted category";
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.remediation.id = "web.remediation.substituted@1";
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.remediation.summary = "Substituted remediation.";
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.confidence_ppm = 899_999;
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.evidence_count = 1;
            item.evidence_references = vec!["evidence-0000".to_owned()];
            item.control_evidence_references.clear();
            item.candidate_evidence_references.clear();
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.evidence_count = 7;
            item.control_evidence_references.pop();
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.control_evidence_references.swap(0, 1);
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.candidate_evidence_references[4] = "evidence-0008".to_owned();
        });
        assert_xml_external_entity_item_mutation_rejected(|item| {
            item.candidate_evidence_references[0] = "evidence-0002".to_owned();
        });
    }

    #[cfg(all(feature = "scanning", feature = "xml-external-entity-review"))]
    #[test]
    fn xml_external_entity_review_writer_rejects_impossible_negative_lifecycle_facts() {
        let mut audit = xml_external_entity_review_document();
        audit.outcome = "candidate_only";
        audit.provider.replay_callback_observed = false;
        audit.provider.event_identities_distinct = false;
        audit.item_projected = false;
        assert!(audit.validate_wire().is_ok());

        audit.provider.active_verification_count = 0;
        assert_eq!(audit.validate_wire(), Err(ReportError::Serialization));
        audit.provider.active_verification_count = 1;

        audit.target.complete = false;
        assert_eq!(audit.validate_wire(), Err(ReportError::Serialization));
        audit.target.complete = true;

        audit.provider.callback_targets_distinct = false;
        assert_eq!(audit.validate_wire(), Err(ReportError::Serialization));

        let mut oversized_response = xml_external_entity_review_document();
        oversized_response.target.response_bytes =
            MAX_XML_EXTERNAL_ENTITY_COMPLETE_TARGET_RESPONSE_BYTES + 1;
        assert_eq!(
            oversized_response.validate_wire(),
            Err(ReportError::Serialization)
        );

        let mut stopped_with_complete_accounting = xml_external_entity_review_document();
        stopped_with_complete_accounting.outcome = "incomplete";
        stopped_with_complete_accounting.provider.cleanup_verified = false;
        stopped_with_complete_accounting.item_projected = false;
        assert_eq!(
            stopped_with_complete_accounting.validate_wire(),
            Err(ReportError::Serialization)
        );
    }

    #[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
    #[test]
    fn template_evaluation_review_writer_is_value_free_strict_and_rendered_everywhere() {
        let document = template_evaluation_assessment_document();
        assert!(document.validate().is_ok());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        comparison::import_assessment_summary(json.as_bytes()).unwrap();
        let audit = &parsed["template_evaluation_review"];
        assert_eq!(audit["schema"], TEMPLATE_EVALUATION_REVIEW_AUDIT_SCHEMA);
        assert_eq!(audit["policy_id"], TEMPLATE_EVALUATION_REVIEW_POLICY_ID);
        assert_eq!(audit["family_id"], TEMPLATE_EVALUATION_REVIEW_FAMILY_ID);
        assert_eq!(audit["outcome"], "candidate_specific_evaluation");
        assert_eq!(audit["engine_identity"], "not_established");
        assert_eq!(audit["coverage"]["selected_case_count"], 2);
        assert_eq!(audit["coverage"]["attempted_request_count"], 4);
        assert_eq!(audit["coverage"]["active_request_count"], 2);
        assert_eq!(audit["coverage"]["completed_response_count"], 4);
        assert_eq!(audit["coverage"]["committed_response_count"], 4);
        assert_eq!(audit["coverage"]["projected_item_count"], 1);
        assert_eq!(audit["operations"]["os_execution"], "not_performed");
        assert_eq!(audit["operations"]["file_access"], "not_performed");
        assert_eq!(audit["claim_limits"].as_array().unwrap().len(), 7);
        assert_eq!(parsed["items"][0]["confidence_ppm"], 1_000_000);
        assert_eq!(parsed["items"][0]["evidence_count"], 12);
        assert_eq!(
            parsed["items"][0]["control_evidence_references"]
                .as_array()
                .unwrap()
                .len(),
            6
        );
        assert_eq!(
            parsed["items"][0]["candidate_evidence_references"]
                .as_array()
                .unwrap()
                .len(),
            6
        );

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        let audit_row = csv
            .lines()
            .find(|line| line.contains("template_evaluation_review_audit"))
            .unwrap();
        let audit_cells = parse_csv_line(audit_row);
        assert_eq!(audit_cells.len(), ASSESSMENT_CSV_HEADERS.len());
        assert_eq!(audit_cells[18], "12");

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        for rendered in [&json, &csv, &html, &markdown] {
            assert!(rendered.contains("candidate_specific_evaluation"));
            assert!(rendered.contains("engine_identity_not_established"));
            assert!(rendered.contains(TEMPLATE_EVALUATION_REVIEW_CAPABILITY_ID));
            for forbidden in [
                "{{",
                "query=",
                "https://target.invalid",
                "jinja2.exceptions",
                "raw-template-body",
                "raw-transport-error",
            ] {
                assert!(!rendered.contains(forbidden));
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
    #[test]
    fn template_evaluation_review_selected_empty_audit_is_valid_and_cross_link_is_mandatory() {
        let mut document = observation_assessment_document("ordinary-observation");
        document.items.clear();
        document.item_count = 0;
        document.template_evaluation_review =
            Some(template_evaluation_review_document("literal_or_escaped", 0));
        assert!(document.validate().is_ok());
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        comparison::import_assessment_summary(json.as_bytes()).unwrap();

        document
            .items
            .push(template_evaluation_review_item_document());
        document.item_count = 1;
        assert_eq!(document.validate(), Err(ReportError::Serialization));

        let mut positive_without_audit = template_evaluation_assessment_document();
        positive_without_audit.template_evaluation_review = None;
        assert_eq!(
            positive_without_audit.validate(),
            Err(ReportError::Serialization)
        );

        let mut historical = observation_assessment_document("ordinary-observation");
        historical.items[0].fingerprint =
            "sha256:5555555555555555555555555555555555555555555555555555555555555555";
        let historical_json =
            render_assessment_with_limit(&historical, ReportFormat::Json, usize::MAX).unwrap();
        let historical_value: serde_json::Value = serde_json::from_str(&historical_json).unwrap();
        assert!(historical_value.get("template_evaluation_review").is_none());
        comparison::import_assessment_summary(historical_json.as_bytes()).unwrap();
    }

    #[cfg(all(feature = "scanning", feature = "template-evaluation-review"))]
    #[test]
    fn template_evaluation_review_writer_rejects_invalid_counts_and_substituted_cross_links() {
        let mut invalid_positive =
            template_evaluation_review_document("candidate_specific_evaluation", 1);
        invalid_positive.coverage.committed_response_count = 3;
        assert_eq!(
            invalid_positive.validate_wire(),
            Err(ReportError::Serialization)
        );

        let mut invalid_negative = template_evaluation_review_document("incomplete", 0);
        invalid_negative.coverage.selected_case_count = 0;
        assert_eq!(
            invalid_negative.validate_wire(),
            Err(ReportError::Serialization)
        );

        let mut partial_incomplete = template_evaluation_review_document("incomplete", 0);
        partial_incomplete.coverage.attempted_request_count = 3;
        partial_incomplete.coverage.active_request_count = 1;
        partial_incomplete.coverage.completed_response_count = 2;
        partial_incomplete.coverage.committed_response_count = 2;
        assert!(partial_incomplete.validate_wire().is_ok());

        for outcome in [
            "literal_or_escaped",
            "unsupported_representation",
            "replay_mismatch",
        ] {
            let mut incomplete_terminal = template_evaluation_review_document(outcome, 0);
            incomplete_terminal.coverage.attempted_request_count = 0;
            incomplete_terminal.coverage.active_request_count = 0;
            incomplete_terminal.coverage.completed_response_count = 0;
            incomplete_terminal.coverage.committed_response_count = 0;
            assert_eq!(
                incomplete_terminal.validate_wire(),
                Err(ReportError::Serialization)
            );
        }

        let mut invalid_parent_absent =
            template_evaluation_review_document("parent_not_observed", 0);
        assert_eq!(
            invalid_parent_absent.validate_wire(),
            Err(ReportError::Serialization)
        );
        invalid_parent_absent.coverage = AssessmentTemplateEvaluationCoverageDocument {
            selected_case_count: 0,
            attempted_request_count: 0,
            active_request_count: 0,
            completed_response_count: 0,
            committed_response_count: 0,
            projected_item_count: 0,
        };
        assert!(invalid_parent_absent.validate_wire().is_ok());

        assert_template_evaluation_item_mutation_rejected(|item| {
            item.subject_reference = "subject-0001".to_owned();
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            item.presentation_target = "assessment_subject";
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            item.title = "Substituted template result";
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            item.claim_basis = "observation";
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            item.cwe = Some("CWE-94");
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            item.confidence_ppm = 999_999;
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            let moved = item.control_evidence_references.pop().unwrap();
            item.candidate_evidence_references.push(moved);
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            let moved = item.candidate_evidence_references.pop().unwrap();
            item.control_evidence_references.push(moved);
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            item.evidence_count = 1;
            item.evidence_references = vec!["evidence-0000".to_owned()];
            item.control_evidence_references.clear();
            item.candidate_evidence_references.clear();
        });
        assert_template_evaluation_item_mutation_rejected(|item| {
            item.candidate_evidence_references[0] = item.control_evidence_references[0].clone();
        });
    }

    #[cfg(all(
        feature = "scanning",
        feature = "websocket-review",
        feature = "supplied-session-review"
    ))]
    #[test]
    fn websocket_v2_writer_cross_validates_session_health_and_separates_protocol_completion() {
        let mut document = observation_assessment_document("ordinary-observation");
        document.items.clear();
        document.item_count = 0;
        document.supplied_session = Some(complete_supplied_session_audit_document());
        document.websocket_review = Some(supplied_session_websocket_review_document());
        assert!(document.validate().is_ok());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["websocket_review"];
        assert_eq!(audit["schema"], "security.websocket-review-audit/v2");
        assert_eq!(audit["context"], "supplied_session");
        assert_eq!(
            audit["supplied_session_context"]["qualification"],
            "context_qualified"
        );
        assert_eq!(
            audit["supplied_session_context"]["continuous_authentication_established"],
            false
        );
        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("protocol-exchange completion"));
            assert!(rendered.contains("continuous authentication"));
            assert!(!rendered.contains("Authorization: Bearer"));
        }

        let mut multiple_resources = observation_assessment_document("ordinary-observation");
        multiple_resources.items.clear();
        multiple_resources.item_count = 0;
        let mut session = complete_supplied_session_audit_document();
        session.checkpoints.insert(
            1,
            AssessmentSuppliedSessionCheckpointDocument {
                sequence: 1,
                phase: "subject_boundary",
                after_subject_count: 1,
                evidence_reference: Some(format!(
                    "supplied-session-checkpoint-evidence-sha256:{}",
                    "8".repeat(64)
                )),
                outcome: "healthy",
                status: Some(200),
                body_state: "complete",
                predicate: "matched",
                response_bytes: 31,
                epoch: None,
            },
        );
        session.checkpoints[2].sequence = 2;
        session.checkpoints[2].after_subject_count = 2;
        session
            .resources
            .push(AssessmentSuppliedSessionResourceDocument {
                sequence: 1,
                resource_reference: format!("supplied-session-resource-sha256:{}", "9".repeat(64)),
                evidence_reference: Some(format!(
                    "supplied-session-resource-evidence-sha256:{}",
                    "a".repeat(64)
                )),
                outcome: "committed",
                status: Some(200),
                response_bytes: 29,
                epoch: 1,
            });
        session.selected_resource_count = 2;
        session.dispatched_resource_count = 2;
        session.committed_resource_count = 2;
        session.dispatched_request_count = 5;
        session.response_bytes = 119;
        assert!(session.validate(&[]).is_ok());
        multiple_resources.supplied_session = Some(session);
        multiple_resources.websocket_review = Some(supplied_session_websocket_review_document());
        assert_eq!(
            multiple_resources.validate(),
            Err(ReportError::Serialization)
        );

        document
            .websocket_review
            .as_mut()
            .unwrap()
            .coverage
            .terminal = "incomplete";
        document
            .websocket_review
            .as_mut()
            .unwrap()
            .coverage
            .completeness = "incomplete";
        document
            .websocket_review
            .as_mut()
            .unwrap()
            .coverage
            .first_failure = Some("close_failed");
        assert!(document.validate().is_ok());

        document
            .websocket_review
            .as_mut()
            .unwrap()
            .supplied_session_context
            .as_mut()
            .unwrap()
            .terminal_health
            .as_mut()
            .unwrap()
            .evidence_reference = Some(format!(
            "supplied-session-checkpoint-evidence-sha256:{}",
            "9".repeat(64)
        ));
        assert_eq!(document.validate(), Err(ReportError::Serialization));
    }

    #[cfg(all(
        feature = "scanning",
        feature = "websocket-review",
        feature = "supplied-session-review"
    ))]
    #[test]
    fn websocket_v2_writer_accepts_zero_admission_only_as_not_established() {
        let mut document = observation_assessment_document("ordinary-observation");
        document.items.clear();
        document.item_count = 0;
        document.supplied_session = Some(complete_supplied_session_audit_document());
        document.websocket_review =
            Some(not_established_supplied_session_websocket_review_document());
        assert!(document.validate().is_ok());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["websocket_review"];
        assert_eq!(
            audit["supplied_session_context"]["qualification"],
            "not_established"
        );
        assert_eq!(audit["coverage"]["request_attempt_count"], 1);
        assert_eq!(audit["coverage"]["request_admitted_count"], 0);
        assert_eq!(
            audit["supplied_session_context"]["startup_health"]["outcome"],
            "healthy"
        );
        assert_eq!(
            audit["supplied_session_context"]["terminal_health"]["outcome"],
            "healthy"
        );

        for invalid_qualification in ["context_qualified", "context_unqualified"] {
            document
                .websocket_review
                .as_mut()
                .unwrap()
                .supplied_session_context
                .as_mut()
                .unwrap()
                .qualification = invalid_qualification;
            assert_eq!(document.validate(), Err(ReportError::Serialization));
        }
        document
            .websocket_review
            .as_mut()
            .unwrap()
            .supplied_session_context
            .as_mut()
            .unwrap()
            .qualification = "not_established";
        document
            .websocket_review
            .as_mut()
            .unwrap()
            .coverage
            .request_admitted_count = 1;
        assert_eq!(document.validate(), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "openapi-review"))]
    #[test]
    fn openapi_reporting_absent_audit_adds_no_wire_field_row_or_section() {
        let document = complete_assessment_document();
        assert!(document.openapi_review.is_none());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert!(parsed.get("openapi_review").is_none());

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(!csv.contains("openapi_review_audit"));

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(!html.contains("OpenAPI review audit"));

        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(!markdown.contains("OpenAPI review audit"));
    }

    #[cfg(all(feature = "scanning", feature = "openapi-review"))]
    #[test]
    fn openapi_reporting_positive_audit_is_minimized_and_redacted_in_every_format() {
        let document = observed_openapi_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = parsed["openapi_review"].as_object().unwrap();
        assert_eq!(audit["outcome"], "document_observed");
        assert_eq!(audit["request_count"], 2);
        assert_eq!(audit["active_verification_count"], 1);
        assert_eq!(audit["item_projected"], true);
        let audit_keys = audit
            .keys()
            .map(String::as_str)
            .collect::<std::collections::BTreeSet<_>>();
        let expected_audit_keys = [
            "schema",
            "capability_id",
            "outcome",
            "candidate_source",
            "request_count",
            "active_verification_count",
            "version",
            "semantic_digest",
            "path_count",
            "operation_count",
            "get_operation_count",
            "write_operation_count",
            "path_parameter_count",
            "query_parameter_count",
            "explicit_auth_operation_count",
            "anonymous_operation_count",
            "url_like_operation_count",
            "multipart_operation_count",
            "deprecated_operation_count",
            "replay_matched",
            "item_projected",
        ]
        .into_iter()
        .collect();
        assert_eq!(audit_keys, expected_audit_keys);
        for forbidden_key in [
            "document",
            "raw_document",
            "server",
            "servers",
            "example",
            "examples",
            "request",
            "response",
            "headers",
            "cookies",
            "authorization",
        ] {
            assert!(!audit.contains_key(forbidden_key));
        }

        for format in ReportGenerator::available_formats() {
            let rendered = render_assessment_with_limit(&document, *format, usize::MAX).unwrap();
            assert!(rendered.contains(OPENAPI_REVIEW_CAPABILITY_ID));
            assert!(rendered.contains("document_observed"));
            for sentinel in [
                "RAW-OPENAPI-DOCUMENT-MUST-NOT-LEAK-4E5A91",
                "https://private-openapi-server.example.test/secret",
                "OPENAPI-EXAMPLE-VALUE-MUST-NOT-LEAK-13C8D7",
                "Bearer OPENAPI-AUTH-MUST-NOT-LEAK-98A02F",
                "session=OPENAPI-COOKIE-MUST-NOT-LEAK-79BD10",
            ] {
                assert!(!rendered.contains(sentinel), "{format:?} leaked {sentinel}");
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "openapi-review"))]
    #[test]
    fn openapi_reporting_outcome_tokens_are_exhaustive_and_stable() {
        for (outcome, token) in [
            (OpenApiRuntimeOutcome::NotEligible, "not_eligible"),
            (OpenApiRuntimeOutcome::DocumentObserved, "document_observed"),
            (
                OpenApiRuntimeOutcome::Swagger20MetadataOnly,
                "swagger_20_metadata_only",
            ),
            (
                OpenApiRuntimeOutcome::UnsupportedVersion,
                "unsupported_version",
            ),
            (OpenApiRuntimeOutcome::ReplayMismatch, "replay_mismatch"),
            (OpenApiRuntimeOutcome::UnsupportedMedia, "unsupported_media"),
            (OpenApiRuntimeOutcome::Malformed, "malformed"),
            (OpenApiRuntimeOutcome::LimitExceeded, "limit_exceeded"),
            (OpenApiRuntimeOutcome::TooLarge, "too_large"),
            (OpenApiRuntimeOutcome::RedirectObserved, "redirect_observed"),
            (OpenApiRuntimeOutcome::RateLimited, "rate_limited"),
            (
                OpenApiRuntimeOutcome::DefensiveInterference,
                "defensive_interference",
            ),
            (OpenApiRuntimeOutcome::HttpError, "http_error"),
            (OpenApiRuntimeOutcome::Truncated, "truncated"),
            (OpenApiRuntimeOutcome::Incomplete, "incomplete"),
            (OpenApiRuntimeOutcome::BudgetExhausted, "budget_exhausted"),
            (OpenApiRuntimeOutcome::Cancelled, "cancelled"),
        ] {
            assert_eq!(openapi_outcome(outcome), token);
        }
    }

    #[cfg(all(feature = "scanning", feature = "rest-review"))]
    #[test]
    fn rest_reporting_absent_audit_adds_no_wire_field_row_or_section() {
        let document = complete_assessment_document();
        assert!(document.rest_review.is_none());

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert!(parsed.get("rest_review").is_none());

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(!csv.contains("rest_readonly_review_audit"));

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(!html.contains("REST read-only review audit"));

        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(!markdown.contains("REST read-only review audit"));
    }

    #[cfg(all(feature = "scanning", feature = "rest-review"))]
    #[test]
    fn rest_reporting_positive_audit_is_minimized_and_redacted_in_every_format() {
        let document = observed_rest_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = parsed["rest_review"].as_object().unwrap();
        assert_eq!(audit["schema"], "security.rest-readonly-review-audit/v1");
        assert_eq!(audit["capability_id"], REST_REVIEW_CAPABILITY_ID);
        assert_eq!(audit["enabled"], true);
        assert_eq!(audit["method"], "get");
        assert_eq!(audit["outcome"], "surface_observed");
        assert_eq!(audit["request_count"], 2);
        assert_eq!(audit["active_verification_count"], 1);
        assert_eq!(audit["eligible_operation_count"], 3);
        assert_eq!(audit["documented_response"], "json_compatible");
        assert_eq!(audit["observed_media"], "json_compatible");
        assert_eq!(audit["status_class"], 2);
        assert_eq!(audit["replay_stable"], true);
        assert_eq!(audit["item_projected"], true);
        let keys = audit
            .keys()
            .map(String::as_str)
            .collect::<std::collections::BTreeSet<_>>();
        let expected = [
            "schema",
            "capability_id",
            "enabled",
            "method",
            "outcome",
            "request_count",
            "active_verification_count",
            "eligible_operation_count",
            "selected_operation_identity",
            "documented_response",
            "observed_media",
            "status_class",
            "replay_stable",
            "item_projected",
        ]
        .into_iter()
        .collect();
        assert_eq!(keys, expected);
        for forbidden_key in [
            "url",
            "path",
            "query",
            "body",
            "response",
            "scalar_values",
            "examples",
            "defaults",
            "credentials",
            "server",
        ] {
            assert!(!audit.contains_key(forbidden_key));
        }

        for format in ReportGenerator::available_formats() {
            let rendered = render_assessment_with_limit(&document, *format, usize::MAX).unwrap();
            assert!(rendered.contains(REST_REVIEW_CAPABILITY_ID));
            assert!(rendered.contains("surface_observed"));
            for sentinel in [
                "REST-RAW-PATH-MUST-NOT-LEAK-5C61E8",
                "REST-QUERY-MUST-NOT-LEAK-6A7B20",
                "REST-RESPONSE-BODY-MUST-NOT-LEAK-9073D4",
                "REST-SCALAR-MUST-NOT-LEAK-44B8F1",
                "Bearer REST-AUTH-MUST-NOT-LEAK-A31E09",
                "session=REST-COOKIE-MUST-NOT-LEAK-190AF2",
            ] {
                assert!(!rendered.contains(sentinel), "{format:?} leaked {sentinel}");
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "rest-review"))]
    #[test]
    fn rest_reporting_contract_rejects_inconsistent_positive_truth() {
        let mut too_many_requests = observed_rest_assessment_document();
        too_many_requests
            .rest_review
            .as_mut()
            .unwrap()
            .request_count = 3;
        let mut no_replay = observed_rest_assessment_document();
        no_replay.rest_review.as_mut().unwrap().replay_stable = false;
        let mut no_audit = observed_rest_assessment_document();
        no_audit.rest_review = None;
        let mut wrong_identity = observed_rest_assessment_document();
        wrong_identity
            .rest_review
            .as_mut()
            .unwrap()
            .selected_operation_identity = Some("raw/path".to_owned());
        let mut wrong_method = observed_rest_assessment_document();
        wrong_method.rest_review.as_mut().unwrap().method = "post";

        for document in [
            too_many_requests,
            no_replay,
            no_audit,
            wrong_identity,
            wrong_method,
        ] {
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&document, *format, usize::MAX),
                    Err(ReportError::Serialization)
                );
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_reporting_is_bounded_typed_and_escaped_in_every_format() {
        let document = observed_wordpress_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["wordpress_review"];
        assert_eq!(audit["schema"], "security.wordpress-review-audit/v1");
        assert_eq!(audit["capability_id"], WORDPRESS_REVIEW_CAPABILITY_ID);
        assert_eq!(audit["catalog_status"], "evaluated");
        assert_eq!(
            audit["catalog"]["id"],
            "termivar-synthetic-wordpress-reporting"
        );
        assert_eq!(audit["catalog"]["revision"], "synthetic-v1");
        assert_eq!(audit["catalog"]["retrieved_on"], "2026-09-06");
        assert_eq!(audit["signal_count"], 1);
        assert_eq!(audit["evidence_reference_count"], 1);
        assert_eq!(audit["additional_request_count"], 0);
        assert_eq!(audit["item_projected"], true);
        assert_eq!(audit["component_count"], 1);
        assert_eq!(audit["advisory_count"], 1);
        assert_eq!(audit["components"][0]["identity"]["kind"], "core");
        assert_eq!(
            audit["components"][0]["versions"][0]["confidence"],
            "public_declaration"
        );
        assert_eq!(
            audit["advisories"][0]["applicability"],
            "indeterminate_missing_evidence"
        );
        assert_eq!(audit["advisories"][0]["exploit_execution"], "not_performed");
        assert_eq!(audit["advisories"][0]["impact_validation"], "not_performed");
        assert!(audit.get("external_review").is_none());
        assert!(audit["advisories"][0].get("comparison_profile").is_none());
        assert!(audit["advisories"][0].get("version_resolution").is_none());
        assert!(audit["advisories"][0]
            .get("version_resolution_reason")
            .is_none());

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(csv.contains("wordpress_review_audit"));
        assert!(csv.contains("SYNTHETIC-REPORTING-WORDPRESS-0001"));
        let audit_row = csv
            .lines()
            .find(|line| line.contains("wordpress_review_audit"))
            .unwrap();
        assert_eq!(
            parse_csv_line(audit_row).len(),
            ASSESSMENT_CSV_HEADERS.len()
        );
        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(html.contains("WordPress evidence review audit"));
        assert!(html.contains("SYNTHETIC-REPORTING-WORDPRESS-0001"));
        assert!(!html.contains("<script>inert()</script>"));
        assert!(html.contains("&lt;script&gt;inert()&lt;/script&gt;"));
        assert!(!html.contains("<script"));
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(markdown.contains("WordPress evidence review audit"));
        assert!(markdown.contains("SYNTHETIC-REPORTING-WORDPRESS-0001"));
        assert!(markdown.contains("not_performed"));
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_discovery_reporting_is_separate_strict_and_reader_compatible() {
        let document = discovered_wordpress_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let discovery = &parsed["wordpress_discovery"];
        assert_eq!(
            parsed["wordpress_review"]["schema"],
            "security.wordpress-review-audit/v7"
        );
        assert_eq!(
            parsed["wordpress_review"]["review_basis_schema"],
            "security.wordpress-review-audit/v1"
        );
        assert_eq!(discovery["schema"], WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V2);
        assert_eq!(discovery["policy_id"], WORDPRESS_DISCOVERY_POLICY_ID);
        assert_eq!(
            WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V1,
            "security.wordpress-discovery-audit/v1"
        );
        assert_eq!(
            WORDPRESS_DISCOVERY_POLICY_ID_V1,
            "termivar.wordpress-metadata-discovery/v1"
        );
        assert_eq!(discovery["method"], "get");
        assert_eq!(discovery["credential_mode"], "anonymous");
        assert_eq!(discovery["candidate_limit_reached"], false);
        assert_eq!(discovery["omitted_candidate_count"], 0);
        assert_eq!(discovery["attempted_request_count"], 3);
        assert_eq!(discovery["completed_response_count"], 3);
        assert_eq!(discovery["committed_response_count"], 3);
        assert_eq!(discovery["response_bytes"], 768);
        assert_eq!(
            discovery["layout"]["application_reference"],
            format!("sha256:{}", "a".repeat(64))
        );
        assert!(discovery["layout"].get("declaration").is_none());
        assert_eq!(
            discovery["layout"]["roles"].as_array().map(Vec::len),
            Some(4)
        );
        assert_eq!(discovery["layout"]["roles"][1]["role"], "themes");
        assert_eq!(discovery["layout"]["roles"][1]["status"], "exact");
        assert_eq!(
            discovery["sources"][0]["association"],
            "structured_advertisement"
        );
        assert_eq!(
            discovery["sources"][1]["association"],
            "observed_conventional"
        );
        assert_eq!(
            discovery["sources"][1]["role_reference"],
            discovery["layout"]["roles"][1]["reference"]
        );
        assert_eq!(
            discovery["sources"][2]["role_reference"],
            discovery["layout"]["roles"][2]["reference"]
        );
        assert_eq!(discovery["sources"][0]["namespaces"][0], "wp/v2");
        assert_eq!(discovery["sources"][1]["theme"]["version"], "1.2.3");
        assert_eq!(discovery["sources"][2]["plugin"]["stable_tag"], "9.9.9");
        assert_eq!(discovery["sources"][1]["theme"]["requires_php"], "8.1");
        assert_eq!(discovery["sources"][2]["plugin"]["requires_php"], "8.1");
        assert_eq!(
            parsed["wordpress_review"]["additional_request_count"], 3,
            "the discovery-influenced v7 audit must expose actual broker attempts"
        );
        assert!(parsed["wordpress_review"]["components"]
            .as_array()
            .unwrap()
            .iter()
            .flat_map(|component| component["versions"].as_array().into_iter().flatten())
            .all(|version| version["value"] != "9.9.9"));

        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains(WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V2));
            assert!(rendered.contains("termivar-metadata-lab"));
            assert!(rendered.contains("9.9.9"));
            assert!(rendered.contains("not installed version"));
            assert!(rendered.contains("Selected application and deployment layout"));
            assert!(rendered.contains("observed_conventional"));
            assert!(rendered.contains("opaque location identities"));
            assert!(!rendered.contains("confirmed_vulnerability"));
        }
        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(csv.contains("wordpress_discovery_audit"));
        assert!(csv.contains(WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V2));
        assert!(csv.contains("termivar-metadata-lab"));

        let comparison = comparison::compare_reports(
            json.as_bytes(),
            json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        assert_eq!(
            comparison["wordpress_review_comparison"]["methodology"]["status"],
            "unchanged"
        );
        assert_eq!(
            comparison["wordpress_review_comparison"]["coverage"]["status"],
            "not_established"
        );
        assert_eq!(comparison["unchanged"].as_array().map(Vec::len), Some(2));
        assert_eq!(comparison["only_in_after"], serde_json::json!([]));
        assert_eq!(comparison["only_in_before"], serde_json::json!([]));
        assert_eq!(comparison["changed"], serde_json::json!([]));

        let mut renumbered: serde_json::Value = serde_json::from_str(&json).unwrap();
        let replacement_references = ["evidence-0101", "evidence-0102", "evidence-0103"];
        for (source, replacement) in renumbered["wordpress_discovery"]["sources"]
            .as_array_mut()
            .unwrap()
            .iter_mut()
            .zip(replacement_references)
        {
            source["evidence_references"] = serde_json::json!([replacement]);
        }
        let discovery_item = renumbered["items"]
            .as_array_mut()
            .unwrap()
            .iter_mut()
            .find(|item| item["capability_id"] == WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID)
            .unwrap();
        discovery_item["evidence_references"] = serde_json::json!(replacement_references);
        let renumbered = serde_json::to_vec(&renumbered).unwrap();
        let renumbering_comparison = comparison::compare_reports(
            json.as_bytes(),
            &renumbered,
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let renumbering_comparison: serde_json::Value =
            serde_json::from_str(&renumbering_comparison).unwrap();
        assert_eq!(
            renumbering_comparison["only_in_after"],
            serde_json::json!([])
        );
        assert_eq!(
            renumbering_comparison["only_in_before"],
            serde_json::json!([])
        );
        assert_eq!(renumbering_comparison["changed"], serde_json::json!([]));
        assert_eq!(
            renumbering_comparison["unchanged"].as_array().map(Vec::len),
            Some(2),
            "report-local evidence reference renumbering is not a semantic change"
        );
        assert_eq!(
            renumbering_comparison["wordpress_review_comparison"]["methodology"]["status"],
            "unchanged"
        );
        assert_eq!(
            renumbering_comparison["wordpress_review_comparison"]["coverage"]["status"],
            "not_established"
        );

        let mut review_only_document = observed_wordpress_assessment_document();
        review_only_document.items[0].fingerprint =
            "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
        let review_only =
            render_assessment_with_limit(&review_only_document, ReportFormat::Json, usize::MAX)
                .unwrap();
        let collection_change = comparison::compare_reports(
            review_only.as_bytes(),
            json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let collection_change: serde_json::Value =
            serde_json::from_str(&collection_change).unwrap();
        assert_eq!(
            collection_change["wordpress_review_comparison"]["methodology"]["status"],
            "changed"
        );
        assert_eq!(
            collection_change["wordpress_review_comparison"]["coverage"]["status"],
            "changed"
        );
        assert_eq!(
            collection_change["only_in_after"]
                .as_array()
                .and_then(|items| items.first())
                .map(|item| &item["capability_id"]),
            Some(&serde_json::json!(
                WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID
            )),
            "the distinct observation must remain in Report Compare's exhaustive four-group partition"
        );
        assert_eq!(
            collection_change["only_in_before"],
            serde_json::json!([]),
            "absence of discovery must not be labelled remediation"
        );

        let reverse_collection_change = comparison::compare_reports(
            json.as_bytes(),
            review_only.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let reverse_collection_change: serde_json::Value =
            serde_json::from_str(&reverse_collection_change).unwrap();
        assert_eq!(
            reverse_collection_change["only_in_after"],
            serde_json::json!([])
        );
        assert_eq!(
            reverse_collection_change["only_in_before"]
                .as_array()
                .and_then(|items| items.first())
                .map(|item| &item["capability_id"]),
            Some(&serde_json::json!(
                WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID
            ))
        );
        assert_eq!(
            reverse_collection_change["wordpress_review_comparison"]["methodology"]["status"],
            "changed"
        );
        assert_eq!(
            reverse_collection_change["wordpress_review_comparison"]["coverage"]["status"],
            "changed"
        );

        let mut invalid: serde_json::Value = serde_json::from_str(&json).unwrap();
        invalid["wordpress_discovery"]["attempted_request_count"] = serde_json::json!(4);
        let invalid = serde_json::to_vec(&invalid).unwrap();
        assert_eq!(
            comparison::import_assessment_summary(&invalid),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut false_commit: serde_json::Value = serde_json::from_str(&json).unwrap();
        false_commit["wordpress_discovery"]["sources"][0]["evidence_reference_count"] =
            serde_json::json!(0);
        assert_eq!(
            comparison::import_assessment_summary(&serde_json::to_vec(&false_commit).unwrap()),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut false_observation: serde_json::Value = serde_json::from_str(&json).unwrap();
        false_observation["wordpress_discovery"]["sources"][0]
            .as_object_mut()
            .unwrap()
            .remove("namespaces");
        assert_eq!(
            comparison::import_assessment_summary(&serde_json::to_vec(&false_observation).unwrap()),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut old_schema_vocabulary_leak: serde_json::Value =
            serde_json::from_str(&json).unwrap();
        old_schema_vocabulary_leak
            .as_object_mut()
            .unwrap()
            .remove("wordpress_discovery");
        let review = old_schema_vocabulary_leak["wordpress_review"]
            .as_object_mut()
            .unwrap();
        review.insert(
            "schema".to_owned(),
            serde_json::json!("security.wordpress-review-audit/v1"),
        );
        review.remove("review_basis_schema");
        review.insert("additional_request_count".to_owned(), serde_json::json!(0));
        assert_eq!(
            comparison::import_assessment_summary(
                &serde_json::to_vec(&old_schema_vocabulary_leak).unwrap()
            ),
            Err(comparison::ComparisonError::InvalidDocument),
            "legacy audit schemas must not accept discovery-only evidence vocabulary"
        );

        let mut false_discovery_confidence: serde_json::Value =
            serde_json::from_str(&json).unwrap();
        let theme = false_discovery_confidence["wordpress_review"]["components"]
            .as_array_mut()
            .unwrap()
            .iter_mut()
            .find(|component| component["identity"]["slug"] == "termivar-child")
            .unwrap();
        theme["confidence_classes"]
            .as_array_mut()
            .unwrap()
            .push(serde_json::json!("operator_assertion"));
        assert_eq!(
            comparison::import_assessment_summary(
                &serde_json::to_vec(&false_discovery_confidence).unwrap()
            ),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut missing_basis: serde_json::Value = serde_json::from_str(&json).unwrap();
        missing_basis["wordpress_review"]
            .as_object_mut()
            .unwrap()
            .remove("review_basis_schema");
        assert_eq!(
            comparison::import_assessment_summary(&serde_json::to_vec(&missing_basis).unwrap()),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut mismatched_request_accounting: serde_json::Value =
            serde_json::from_str(&json).unwrap();
        mismatched_request_accounting["wordpress_review"]["additional_request_count"] =
            serde_json::json!(2);
        assert_eq!(
            comparison::import_assessment_summary(
                &serde_json::to_vec(&mismatched_request_accounting).unwrap()
            ),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut invalid_slug: serde_json::Value = serde_json::from_str(&json).unwrap();
        invalid_slug["wordpress_discovery"]["sources"][1]["component"]["slug"] =
            serde_json::json!("../theme");
        assert_eq!(
            comparison::import_assessment_summary(&serde_json::to_vec(&invalid_slug).unwrap()),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut duplicate_source: serde_json::Value = serde_json::from_str(&json).unwrap();
        let duplicate = duplicate_source["wordpress_discovery"]["sources"][1].clone();
        duplicate_source["wordpress_discovery"]["sources"]
            .as_array_mut()
            .unwrap()
            .push(duplicate);
        for field in [
            "candidate_count",
            "attempted_request_count",
            "completed_response_count",
            "committed_response_count",
            "source_count",
        ] {
            duplicate_source["wordpress_discovery"][field] = serde_json::json!(4);
        }
        duplicate_source["wordpress_discovery"]["response_bytes"] = serde_json::json!(1_024);
        duplicate_source["wordpress_review"]["additional_request_count"] = serde_json::json!(4);
        assert_eq!(
            comparison::import_assessment_summary(&serde_json::to_vec(&duplicate_source).unwrap()),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut false_candidate_limit: serde_json::Value = serde_json::from_str(&json).unwrap();
        false_candidate_limit["wordpress_discovery"]["candidate_limit_reached"] =
            serde_json::json!(true);
        assert_eq!(
            comparison::import_assessment_summary(
                &serde_json::to_vec(&false_candidate_limit).unwrap()
            ),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut too_many_theme_requests: serde_json::Value = serde_json::from_str(&json).unwrap();
        for ordinal in 0..3 {
            too_many_theme_requests["wordpress_discovery"]["sources"]
                .as_array_mut()
                .unwrap()
                .push(serde_json::json!({
                    "kind": "theme_stylesheet",
                    "component": {
                        "kind": "theme",
                        "slug": format!("quota-theme-{ordinal}"),
                    },
                    "parent_depth": 1,
                    "outcome": "request_failed",
                    "request_attempted": true,
                    "response_bytes": 0,
                    "evidence_reference_count": 0,
                    "evidence_references": [],
                }));
        }
        too_many_theme_requests["wordpress_discovery"]["candidate_count"] = serde_json::json!(6);
        too_many_theme_requests["wordpress_discovery"]["attempted_request_count"] =
            serde_json::json!(6);
        too_many_theme_requests["wordpress_discovery"]["source_count"] = serde_json::json!(6);
        too_many_theme_requests["wordpress_review"]["additional_request_count"] =
            serde_json::json!(6);
        assert_eq!(
            comparison::import_assessment_summary(
                &serde_json::to_vec(&too_many_theme_requests).unwrap()
            ),
            Err(comparison::ComparisonError::InvalidDocument),
            "the strict reader must reject a reconciled audit above the three-theme request ceiling"
        );

        let mut invalid_producer_slug = discovered_wordpress_assessment_document();
        invalid_producer_slug
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[1]
            .component
            .as_mut()
            .unwrap()
            .slug = "../theme".to_owned();
        assert_eq!(
            render_assessment_with_limit(&invalid_producer_slug, ReportFormat::Json, usize::MAX),
            Err(ReportError::Serialization)
        );

        let mut false_candidate_limit_producer = discovered_wordpress_assessment_document();
        false_candidate_limit_producer
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .candidate_limit_reached = true;
        assert_eq!(
            render_assessment_with_limit(
                &false_candidate_limit_producer,
                ReportFormat::Json,
                usize::MAX
            ),
            Err(ReportError::Serialization)
        );

        let mut too_many_theme_requests_producer = discovered_wordpress_assessment_document();
        let discovery = too_many_theme_requests_producer
            .wordpress_discovery
            .as_mut()
            .unwrap();
        for ordinal in 0..3 {
            discovery.sources.push(WordPressDiscoverySourceDocument {
                kind: "theme_stylesheet",
                association: "same_theme_base_parent",
                resource_reference: format!("sha256:{:064x}", ordinal + 4),
                role_reference: Some(format!("sha256:{}", "d".repeat(64))),
                component: Some(WordPressComponentIdentityDocument {
                    kind: "theme",
                    slug: format!("quota-theme-{ordinal}"),
                }),
                parent_depth: 1,
                outcome: "request_failed",
                request_attempted: true,
                response_bytes: 0,
                evidence_reference_count: 0,
                evidence_references: Vec::new(),
                source_page_references: Vec::new(),
                source_supplied_session_page_references: None,
                namespaces: Vec::new(),
                theme: None,
                plugin: None,
            });
        }
        discovery.candidate_count = 6;
        discovery.attempted_request_count = 6;
        discovery.source_count = 6;
        too_many_theme_requests_producer
            .wordpress_review
            .as_mut()
            .unwrap()
            .additional_request_count = 6;
        assert_eq!(
            render_assessment_with_limit(
                &too_many_theme_requests_producer,
                ReportFormat::Json,
                usize::MAX
            ),
            Err(ReportError::Serialization),
            "the report writer must reject a reconciled audit above the three-theme request ceiling"
        );

        // The broker charges the whole transport-delivered chunk that crosses
        // its two-MiB retention boundary. That chunk has no source-level fixed
        // maximum, so the strict reader validates u64 accounting and exact
        // reconciliation rather than inventing a three-MiB wire ceiling.
        let mut chunk_overrun: serde_json::Value = serde_json::from_str(&json).unwrap();
        let observed = 4_u64 * 1_024 * 1_024;
        chunk_overrun["wordpress_discovery"]["sources"][0]["response_bytes"] =
            serde_json::json!(observed);
        chunk_overrun["wordpress_discovery"]["response_bytes"] = serde_json::json!(observed + 512);
        comparison::import_assessment_summary(&serde_json::to_vec(&chunk_overrun).unwrap())
            .unwrap();
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn page_scoped_discovery_v3_is_strict_feature_independent_and_compared_as_methodology() {
        let document = page_scoped_wordpress_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let discovery = &parsed["wordpress_discovery"];
        assert_eq!(discovery["schema"], WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V3);
        assert_eq!(
            discovery["policy_id"],
            WORDPRESS_PAGE_SCOPED_DISCOVERY_POLICY_ID
        );
        assert_eq!(discovery["page_collection"]["mode"], "observed");
        assert_eq!(
            discovery["page_collection"]["interpreted_response_bytes"],
            128
        );
        assert_eq!(discovery["page_collection"]["response_bytes"], 0);
        assert_eq!(
            discovery["sources"][1]["source_page_references"],
            serde_json::json!([format!("sha256:{}", "9".repeat(64))])
        );
        comparison::import_assessment_summary(json.as_bytes()).unwrap();

        let self_comparison = comparison::compare_reports(
            json.as_bytes(),
            json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let self_comparison: serde_json::Value = serde_json::from_str(&self_comparison).unwrap();
        assert_eq!(
            self_comparison["wordpress_review_comparison"]["methodology"]["status"],
            "unchanged"
        );
        assert_eq!(
            self_comparison["wordpress_review_comparison"]["discovery_source_content"]["status"],
            "unchanged"
        );

        let entry_only = discovered_wordpress_assessment_document();
        let entry_only =
            render_assessment_with_limit(&entry_only, ReportFormat::Json, usize::MAX).unwrap();
        let scope_change = comparison::compare_reports(
            entry_only.as_bytes(),
            json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let scope_change: serde_json::Value = serde_json::from_str(&scope_change).unwrap();
        assert_eq!(
            scope_change["wordpress_review_comparison"]["methodology"]["status"],
            "changed"
        );
        assert_eq!(
            scope_change["wordpress_review_comparison"]["coverage"]["status"],
            "changed"
        );

        for mutation in [
            "missing_page_collection",
            "missing_source_page_reference",
            "unknown_source_page_reference",
            "fabricated_page_evidence_count",
        ] {
            let mut invalid = parsed.clone();
            match mutation {
                "missing_page_collection" => {
                    invalid["wordpress_discovery"]
                        .as_object_mut()
                        .unwrap()
                        .remove("page_collection");
                },
                "missing_source_page_reference" => {
                    invalid["wordpress_discovery"]["sources"][1]
                        .as_object_mut()
                        .unwrap()
                        .remove("source_page_references");
                },
                "unknown_source_page_reference" => {
                    invalid["wordpress_discovery"]["sources"][1]["source_page_references"] =
                        serde_json::json!([format!("sha256:{}", "7".repeat(64))]);
                },
                "fabricated_page_evidence_count" => {
                    invalid["wordpress_discovery"]["page_collection"]["pages"][0]
                        ["evidence_reference_count"] = serde_json::json!(0);
                },
                _ => unreachable!(),
            }
            assert_eq!(
                comparison::import_assessment_summary(&serde_json::to_vec(&invalid).unwrap()),
                Err(comparison::ComparisonError::InvalidDocument),
                "mutation {mutation} must fail closed"
            );
        }
    }

    #[cfg(all(
        feature = "scanning",
        feature = "wordpress-review",
        feature = "supplied-session-review"
    ))]
    #[test]
    fn supplied_session_discovery_v4_is_cross_linked_rendered_and_compared() {
        let document = supplied_session_wordpress_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let discovery = &parsed["wordpress_discovery"];
        assert_eq!(discovery["schema"], WORDPRESS_DISCOVERY_AUDIT_SCHEMA_V4);
        assert_eq!(
            discovery["policy_id"],
            WORDPRESS_SUPPLIED_SESSION_DISCOVERY_POLICY_ID
        );
        assert_eq!(
            discovery["supplied_session_pages"]["mode"],
            "committed_supplied_session_resources"
        );
        assert_eq!(
            discovery["supplied_session_pages"]["credential_mechanism"],
            "authorization_header"
        );
        assert_eq!(
            discovery["supplied_session_pages"]["pages"][0]["fingerprint_evaluation"],
            "not_selected_in_v1"
        );
        assert_eq!(
            discovery["sources"][0]["source_supplied_session_page_references"],
            serde_json::json!([])
        );
        assert_eq!(
            discovery["sources"][2]["source_supplied_session_page_references"],
            serde_json::json!([format!("sha256:{}", "b".repeat(64))])
        );
        assert!(discovery.get("page_collection").is_none());
        comparison::import_assessment_summary(json.as_bytes()).unwrap();

        for format in [
            ReportFormat::Html,
            ReportFormat::Markdown,
            ReportFormat::Csv,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("supplied-session"));
            assert!(rendered.contains("not_selected_in_v1"));
            assert!(!rendered.contains("Bearer "));
            assert!(!rendered.contains("Cookie:"));
        }

        let comparison = comparison::compare_reports(
            json.as_bytes(),
            json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        let wordpress = &comparison["wordpress_review_comparison"];
        assert_eq!(
            wordpress["schema"],
            "termivar-wordpress-review-comparison/v4"
        );
        assert_eq!(wordpress["status"], "compared");
        assert_eq!(wordpress["methodology"]["status"], "unchanged");
        assert_eq!(
            wordpress["components"]["only_in_before"],
            serde_json::json!([])
        );
        assert_eq!(
            wordpress["components"]["only_in_after"],
            serde_json::json!([])
        );

        let mut changed_coverage = supplied_session_wordpress_assessment_document();
        let pages = changed_coverage
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .supplied_session_pages
            .as_mut()
            .unwrap();
        pages.pages[0].interpreted_response_bytes = 22;
        pages.interpreted_response_bytes = 22;
        let changed_coverage =
            render_assessment_with_limit(&changed_coverage, ReportFormat::Json, usize::MAX)
                .unwrap();
        let comparison = comparison::compare_reports(
            json.as_bytes(),
            changed_coverage.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        let wordpress = &comparison["wordpress_review_comparison"];
        assert_eq!(wordpress["status"], "compared");
        assert_eq!(wordpress["methodology"]["status"], "unchanged");
        assert_eq!(wordpress["coverage"]["status"], "changed");
        assert_eq!(
            wordpress["components"]["only_in_before"],
            serde_json::json!([])
        );
        assert_eq!(
            wordpress["components"]["only_in_after"],
            serde_json::json!([])
        );

        let old_entry_only = discovered_wordpress_assessment_document();
        let old_entry_only =
            render_assessment_with_limit(&old_entry_only, ReportFormat::Json, usize::MAX).unwrap();
        let old_entry_only: serde_json::Value = serde_json::from_str(&old_entry_only).unwrap();
        assert!(old_entry_only["wordpress_discovery"]
            .get("supplied_session_pages")
            .is_none());
        assert!(old_entry_only["wordpress_discovery"]["sources"]
            .as_array()
            .unwrap()
            .iter()
            .all(|source| source
                .get("source_supplied_session_page_references")
                .is_none()));
    }

    #[cfg(all(
        feature = "scanning",
        feature = "wordpress-review",
        feature = "supplied-session-review"
    ))]
    #[test]
    fn supplied_session_discovery_v4_rejects_broken_cross_links_and_context_pairing() {
        let valid = supplied_session_wordpress_assessment_document();
        let valid_json =
            render_assessment_with_limit(&valid, ReportFormat::Json, usize::MAX).unwrap();
        let valid_value: serde_json::Value = serde_json::from_str(&valid_json).unwrap();

        for mutation in [
            "missing_source_array",
            "unknown_source_page",
            "resource_reference_mismatch",
            "resource_evidence_mismatch",
            "policy_mismatch",
            "committed_count_mismatch",
            "rejected_page_as_source",
        ] {
            let mut invalid = valid_value.clone();
            match mutation {
                "missing_source_array" => {
                    invalid["wordpress_discovery"]["sources"][0]
                        .as_object_mut()
                        .unwrap()
                        .remove("source_supplied_session_page_references");
                },
                "unknown_source_page" => {
                    invalid["wordpress_discovery"]["sources"][2]
                        ["source_supplied_session_page_references"] =
                        serde_json::json!([format!("sha256:{}", "c".repeat(64))]);
                },
                "resource_reference_mismatch" => {
                    invalid["wordpress_discovery"]["supplied_session_pages"]["pages"][0]
                        ["resource_reference"] = serde_json::json!(format!(
                        "supplied-session-resource-sha256:{}",
                        "c".repeat(64)
                    ));
                },
                "resource_evidence_mismatch" => {
                    invalid["wordpress_discovery"]["supplied_session_pages"]["pages"][0]
                        ["resource_evidence_reference"] = serde_json::json!(format!(
                        "supplied-session-resource-evidence-sha256:{}",
                        "c".repeat(64)
                    ));
                },
                "policy_mismatch" => {
                    invalid["wordpress_discovery"]["supplied_session_pages"]["policy_reference"] = serde_json::json!(
                        format!("supplied-session-policy-sha256:{}", "c".repeat(64))
                    );
                },
                "committed_count_mismatch" => {
                    invalid["wordpress_discovery"]["supplied_session_pages"]["committed_count"] =
                        serde_json::json!(0);
                },
                "rejected_page_as_source" => {
                    let page =
                        &mut invalid["wordpress_discovery"]["supplied_session_pages"]["pages"][0];
                    page["association"] = serde_json::json!("rejected");
                    page["outcome"] = serde_json::json!("incompatible_application");
                    let scope = &mut invalid["wordpress_discovery"]["supplied_session_pages"];
                    scope["accepted_association_count"] = serde_json::json!(0);
                    scope["rejected_association_count"] = serde_json::json!(1);
                },
                _ => unreachable!(),
            }
            assert_eq!(
                comparison::import_assessment_summary(&serde_json::to_vec(&invalid).unwrap()),
                Err(comparison::ComparisonError::InvalidDocument),
                "mutation {mutation} must fail closed"
            );
        }

        let mut other_context = supplied_session_wordpress_assessment_document();
        let application_reference =
            format!("supplied-session-application-sha256:{}", "c".repeat(64));
        other_context
            .supplied_session
            .as_mut()
            .unwrap()
            .application_reference = application_reference.clone();
        other_context
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .supplied_session_pages
            .as_mut()
            .unwrap()
            .application_reference = application_reference;
        let other_context =
            render_assessment_with_limit(&other_context, ReportFormat::Json, usize::MAX).unwrap();
        let comparison = comparison::compare_reports(
            valid_json.as_bytes(),
            other_context.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        let wordpress = &comparison["wordpress_review_comparison"];
        assert_eq!(wordpress["status"], "not_compared");
        assert_eq!(wordpress["reason"], "supplied_session_context_mismatch");
        assert_eq!(wordpress["components"]["paired_unchanged_count"], 0);
        assert_eq!(
            wordpress["components"]["only_in_before"],
            serde_json::json!([])
        );
        assert_eq!(
            wordpress["components"]["only_in_after"],
            serde_json::json!([])
        );
        assert_eq!(
            comparison["only_in_before"].as_array().map(Vec::len),
            Some(2)
        );
        assert_eq!(
            comparison["only_in_after"].as_array().map(Vec::len),
            Some(2)
        );

        // The V1 principal reference is deliberately generic. Two reports
        // with the same policy/application digests but different
        // operator-declared aliases must therefore remain different session
        // contexts for both top-level items and the nested WordPress audit.
        // The reduced supplied-session page binding does not carry that alias
        // and cannot independently authorize WordPress entity pairing.
        let mut other_principal = supplied_session_wordpress_assessment_document();
        other_principal
            .supplied_session
            .as_mut()
            .unwrap()
            .principal_alias = "fixture-peer".to_owned();
        let other_principal =
            render_assessment_with_limit(&other_principal, ReportFormat::Json, usize::MAX).unwrap();
        let comparison = comparison::compare_reports(
            valid_json.as_bytes(),
            other_principal.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        assert_eq!(
            comparison["supplied_session_comparison"]["status"],
            "not_compared"
        );
        assert_eq!(
            comparison["supplied_session_comparison"]["reason"],
            "operator_declared_principal_changed"
        );
        let wordpress = &comparison["wordpress_review_comparison"];
        assert_eq!(
            wordpress["schema"],
            "termivar-wordpress-review-comparison/v4"
        );
        assert_eq!(wordpress["status"], "not_compared");
        assert_eq!(wordpress["reason"], "supplied_session_context_mismatch");
        assert_eq!(wordpress["methodology"]["status"], "unchanged");
        assert_eq!(
            wordpress["methodology"]["changed_fields"],
            serde_json::json!([])
        );
        assert_eq!(wordpress["coverage"]["status"], "not_established");
        assert_eq!(
            wordpress["coverage"]["changed_fields"],
            serde_json::json!([])
        );
        assert_eq!(wordpress["provenance"]["status"], "unchanged");
        assert_eq!(
            wordpress["provenance"]["changed_fields"],
            serde_json::json!([])
        );
        assert_eq!(wordpress["discovery_source_content"]["status"], "unchanged");
        assert_eq!(
            wordpress["discovery_source_content"]["changed_fields"],
            serde_json::json!([])
        );
        for entity_group in ["components", "advisories"] {
            let entities = &wordpress[entity_group];
            assert_eq!(entities["paired_unchanged_count"], 0);
            assert_eq!(entities["paired_changed"], serde_json::json!([]));
            assert_eq!(entities["only_in_before"], serde_json::json!([]));
            assert_eq!(entities["only_in_after"], serde_json::json!([]));
        }
        assert_eq!(
            comparison["only_in_before"].as_array().map(Vec::len),
            Some(2)
        );
        assert_eq!(
            comparison["only_in_after"].as_array().map(Vec::len),
            Some(2)
        );
        assert!(comparison["changed"].as_array().unwrap().is_empty());
        assert!(comparison["unchanged"].as_array().unwrap().is_empty());

        // Health and coverage are outcome facets, not session identity. A
        // later loss for the same declared principal/policy/application must
        // remain comparable while the changed collection coverage is shown.
        let mut session_lost = supplied_session_wordpress_assessment_document();
        {
            let session = session_lost.supplied_session.as_mut().unwrap();
            session.outcome = "session_lost";
            session.coverage = "none";
            session.checkpoints[1].outcome = "unhealthy";
            session.checkpoints[1].predicate = "not_matched";
            session.resources[0].outcome = "health_unqualified";
            session.committed_resource_count = 0;
        }
        {
            let discovery = session_lost.wordpress_discovery.as_mut().unwrap();
            let pages = discovery.supplied_session_pages.as_mut().unwrap();
            pages.committed_count = 0;
            pages.accepted_association_count = 0;
            pages.not_established_association_count = 1;
            pages.not_evaluated_count = 1;
            pages.interpreted_response_bytes = 0;
            let page = &mut pages.pages[0];
            page.resource_evidence_reference = None;
            page.association = "not_established";
            page.outcome = "not_evaluated";
            page.interpreted_response_bytes = 0;
            page.evidence_reference_count = 0;
            page.evidence_references.clear();
            for source in &mut discovery.sources {
                source.source_supplied_session_page_references = Some(Vec::new());
            }
        }
        let discovery_item = session_lost
            .items
            .iter_mut()
            .find(|item| item.capability_id == WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID)
            .unwrap();
        discovery_item.evidence_count = 3;
        discovery_item
            .evidence_references
            .retain(|reference| reference != "evidence-0004");
        let session_lost =
            render_assessment_with_limit(&session_lost, ReportFormat::Json, usize::MAX).unwrap();
        let comparison = comparison::compare_reports(
            valid_json.as_bytes(),
            session_lost.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        assert_eq!(
            comparison["supplied_session_comparison"]["status"],
            "compared_within_same_declared_context"
        );
        assert_eq!(
            comparison["supplied_session_comparison"]["health_and_coverage"]["status"],
            "changed"
        );
        let wordpress = &comparison["wordpress_review_comparison"];
        assert_eq!(wordpress["status"], "compared");
        assert!(wordpress.get("reason").is_none());
        assert_eq!(wordpress["methodology"]["status"], "unchanged");
        assert_eq!(
            wordpress["methodology"]["changed_fields"],
            serde_json::json!([])
        );
        assert_eq!(wordpress["coverage"]["status"], "changed");
        assert_eq!(
            wordpress["coverage"]["changed_fields"],
            serde_json::json!(["wordpress_discovery"])
        );
        assert_eq!(wordpress["provenance"]["status"], "unchanged");
        assert_eq!(
            wordpress["provenance"]["changed_fields"],
            serde_json::json!([])
        );
        assert_eq!(wordpress["discovery_source_content"]["status"], "changed");
        assert_eq!(
            wordpress["discovery_source_content"]["changed_fields"],
            serde_json::json!(["supplied_session_pages"])
        );
        assert_eq!(wordpress["components"]["paired_unchanged_count"], 2);
        assert_eq!(
            wordpress["components"]["paired_changed"]
                .as_array()
                .map(Vec::len),
            Some(1)
        );
        assert_eq!(
            wordpress["components"]["paired_changed"][0]["key"],
            serde_json::json!({"kind": "plugin", "slug": "termivar-metadata-lab"})
        );
        assert_eq!(
            wordpress["components"]["paired_changed"][0]["changed_dimensions"],
            serde_json::json!(["discovery_metadata"])
        );
        assert_eq!(wordpress["advisories"]["paired_unchanged_count"], 1);
        assert_eq!(
            wordpress["advisories"]["paired_changed"],
            serde_json::json!([])
        );
        for entity_group in ["components", "advisories"] {
            assert_eq!(
                wordpress[entity_group]["only_in_before"],
                serde_json::json!([])
            );
            assert_eq!(
                wordpress[entity_group]["only_in_after"],
                serde_json::json!([])
            );
        }
        assert!(comparison["only_in_before"].as_array().unwrap().is_empty());
        assert!(comparison["only_in_after"].as_array().unwrap().is_empty());
        assert_eq!(comparison["changed"].as_array().map(Vec::len), Some(1));
        assert_eq!(
            comparison["changed"][0]["capability_id"],
            WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID
        );
        assert_eq!(
            comparison["changed"][0]["changed_fields"],
            serde_json::json!(["evidence"])
        );
        assert_eq!(comparison["unchanged"].as_array().map(Vec::len), Some(1));
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_discovery_writer_enforces_component_links_and_runtime_field_bounds() {
        let render = |document: &AssessmentDocument<'_>| {
            render_assessment_with_limit(document, ReportFormat::Json, usize::MAX)
        };

        let mut missing_component = discovered_wordpress_assessment_document();
        let review = missing_component.wordpress_review.as_mut().unwrap();
        review.components.retain(|component| {
            !(component.identity.kind == "plugin"
                && component.identity.slug == "termivar-metadata-lab")
        });
        review.component_count = review.components.len();
        assert_eq!(render(&missing_component), Err(ReportError::Serialization));

        let mut wrong_source_class = discovered_wordpress_assessment_document();
        let component = wrong_source_class
            .wordpress_review
            .as_mut()
            .unwrap()
            .components
            .iter_mut()
            .find(|component| component.identity.slug == "termivar-metadata-lab")
            .unwrap();
        component.identity_sources = vec!["operator_context"];
        component.confidence_classes = vec!["operator_assertion"];
        component.evidence_class = "operator_supplied";
        assert_eq!(render(&wrong_source_class), Err(ReportError::Serialization));

        let mut metadata_at_limit = discovered_wordpress_assessment_document();
        metadata_at_limit
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[2]
            .plugin
            .as_mut()
            .unwrap()
            .name = Some("m".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_METADATA_BYTES));
        render(&metadata_at_limit).unwrap();
        metadata_at_limit
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[2]
            .plugin
            .as_mut()
            .unwrap()
            .name = Some("m".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_METADATA_BYTES + 1));
        assert_eq!(render(&metadata_at_limit), Err(ReportError::Serialization));

        let mut version_at_limit = discovered_wordpress_assessment_document();
        let version = "1".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_VERSION_BYTES);
        version_at_limit
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[1]
            .theme
            .as_mut()
            .unwrap()
            .version = Some(version.clone());
        version_at_limit
            .wordpress_review
            .as_mut()
            .unwrap()
            .components
            .iter_mut()
            .find(|component| component.identity.slug == "termivar-child")
            .unwrap()
            .versions[0]
            .value = version;
        render(&version_at_limit).unwrap();
        let oversized_version = "1".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_VERSION_BYTES + 1);
        version_at_limit
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[1]
            .theme
            .as_mut()
            .unwrap()
            .version = Some(oversized_version.clone());
        version_at_limit
            .wordpress_review
            .as_mut()
            .unwrap()
            .components
            .iter_mut()
            .find(|component| component.identity.slug == "termivar-child")
            .unwrap()
            .versions[0]
            .value = oversized_version;
        assert_eq!(render(&version_at_limit), Err(ReportError::Serialization));

        let mut namespace_at_limit = discovered_wordpress_assessment_document();
        namespace_at_limit
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[0]
            .namespaces[0] = "n".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_NAMESPACE_BYTES);
        render(&namespace_at_limit).unwrap();
        namespace_at_limit
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[0]
            .namespaces[0] = "n".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_NAMESPACE_BYTES + 1);
        assert_eq!(render(&namespace_at_limit), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_discovery_writer_enforces_deployment_layout_and_source_bindings() {
        let render = |document: &AssessmentDocument<'_>| {
            render_assessment_with_limit(document, ReportFormat::Json, usize::MAX)
        };

        let mut declared = discovered_wordpress_assessment_document();
        declared
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .layout
            .declaration = Some(WordPressDiscoveryLayoutDeclarationDocument {
            schema: WORDPRESS_DISCOVERY_LAYOUT_SCHEMA,
            byte_length: MAX_WORDPRESS_DISCOVERY_LAYOUT_BYTES,
            sha256: "9".repeat(64),
        });
        let core = &mut declared.wordpress_discovery.as_mut().unwrap().layout.roles[0];
        core.status = "exact";
        core.basis = "operator_declaration";
        core.reference = Some(format!("sha256:{}", "c".repeat(64)));
        core.candidate_count = 1;
        render(&declared).unwrap();
        declared
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .layout
            .declaration
            .as_mut()
            .unwrap()
            .byte_length = 0;
        assert_eq!(render(&declared), Err(ReportError::Serialization));

        let mut reordered_roles = discovered_wordpress_assessment_document();
        reordered_roles
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .layout
            .roles
            .swap(1, 2);
        assert_eq!(render(&reordered_roles), Err(ReportError::Serialization));

        let mut missing_exact_reference = discovered_wordpress_assessment_document();
        missing_exact_reference
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .layout
            .roles[1]
            .reference = None;
        assert_eq!(
            render(&missing_exact_reference),
            Err(ReportError::Serialization)
        );

        let mut mismatched_role_reference = discovered_wordpress_assessment_document();
        mismatched_role_reference
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[1]
            .role_reference = Some(format!("sha256:{}", "e".repeat(64)));
        assert_eq!(
            render(&mismatched_role_reference),
            Err(ReportError::Serialization)
        );

        let mut duplicate_resource = discovered_wordpress_assessment_document();
        let duplicate_reference = duplicate_resource
            .wordpress_discovery
            .as_ref()
            .unwrap()
            .sources[0]
            .resource_reference
            .clone();
        duplicate_resource
            .wordpress_discovery
            .as_mut()
            .unwrap()
            .sources[1]
            .resource_reference = duplicate_reference;
        assert_eq!(render(&duplicate_resource), Err(ReportError::Serialization));

        let mut parent_only = discovered_wordpress_assessment_document();
        let review = parent_only.wordpress_review.as_mut().unwrap();
        review
            .components
            .retain(|component| component.identity.slug != "termivar-child");
        review.component_count = review.components.len();
        let source = &mut parent_only.wordpress_discovery.as_mut().unwrap().sources[1];
        source.component.as_mut().unwrap().slug = "termivar-parent".to_owned();
        source.parent_depth = 1;
        source.association = "same_theme_base_parent";
        render(&parent_only).expect(
            "a role-bound parent-depth source remains metadata but does not require a depth-zero review component",
        );

        let review = parent_only.wordpress_review.as_mut().unwrap();
        review.components.push(WordPressComponentDocument {
            identity: WordPressComponentIdentityDocument {
                kind: "theme",
                slug: "termivar-parent".to_owned(),
            },
            evidence_class: "observed_hint",
            identity_sources: vec!["same_origin_asset_path", "theme_stylesheet_declaration"],
            confidence_classes: vec!["structural_hint", "public_declaration"],
            versions: vec![WordPressVersionEvidenceDocument {
                value: "1.2.3".to_owned(),
                source: "theme_stylesheet_declaration",
                confidence: "public_declaration",
            }],
            activation: None,
            inventory_status: None,
        });
        review.component_count = review.components.len();
        render(&parent_only)
            .expect("a projected same-base parent version must match its discovery source");

        parent_only
            .wordpress_review
            .as_mut()
            .unwrap()
            .components
            .last_mut()
            .unwrap()
            .versions[0]
            .value = "9.9.9".to_owned();
        assert_eq!(render(&parent_only), Err(ReportError::Serialization));
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_discovery_importer_rejects_unlinked_components_and_runtime_bound_overruns() {
        let json = render_assessment_with_limit(
            &discovered_wordpress_assessment_document(),
            ReportFormat::Json,
            usize::MAX,
        )
        .unwrap();
        let valid: serde_json::Value = serde_json::from_str(&json).unwrap();

        let mut unlinked = valid.clone();
        unlinked["wordpress_discovery"]["sources"][2]["component"]["slug"] =
            serde_json::json!("unseen-plugin");
        assert_eq!(
            comparison::import_assessment_summary(&serde_json::to_vec(&unlinked).unwrap()),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut metadata_at_limit = valid.clone();
        metadata_at_limit["wordpress_discovery"]["sources"][2]["plugin"]["name"] =
            serde_json::json!("m".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_METADATA_BYTES));
        comparison::import_assessment_summary(&serde_json::to_vec(&metadata_at_limit).unwrap())
            .unwrap();
        metadata_at_limit["wordpress_discovery"]["sources"][2]["plugin"]["name"] =
            serde_json::json!("m".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_METADATA_BYTES + 1));
        assert_eq!(
            comparison::import_assessment_summary(&serde_json::to_vec(&metadata_at_limit).unwrap()),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut version_at_limit = valid.clone();
        let version = "1".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_VERSION_BYTES);
        version_at_limit["wordpress_discovery"]["sources"][1]["theme"]["version"] =
            serde_json::json!(version);
        version_at_limit["wordpress_review"]["components"]
            .as_array_mut()
            .unwrap()
            .iter_mut()
            .find(|component| component["identity"]["slug"] == "termivar-child")
            .unwrap()["versions"][0]["value"] = serde_json::json!(version);
        comparison::import_assessment_summary(&serde_json::to_vec(&version_at_limit).unwrap())
            .unwrap();
        let oversized_version = "1".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_VERSION_BYTES + 1);
        version_at_limit["wordpress_discovery"]["sources"][1]["theme"]["version"] =
            serde_json::json!(oversized_version);
        version_at_limit["wordpress_review"]["components"]
            .as_array_mut()
            .unwrap()
            .iter_mut()
            .find(|component| component["identity"]["slug"] == "termivar-child")
            .unwrap()["versions"][0]["value"] = serde_json::json!(oversized_version);
        assert_eq!(
            comparison::import_assessment_summary(&serde_json::to_vec(&version_at_limit).unwrap()),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut namespace_at_limit = valid.clone();
        namespace_at_limit["wordpress_discovery"]["sources"][0]["namespaces"][0] =
            serde_json::json!("n".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_NAMESPACE_BYTES));
        comparison::import_assessment_summary(&serde_json::to_vec(&namespace_at_limit).unwrap())
            .unwrap();
        namespace_at_limit["wordpress_discovery"]["sources"][0]["namespaces"][0] =
            serde_json::json!("n".repeat(MAX_WORDPRESS_DISCOVERY_AUDIT_NAMESPACE_BYTES + 1));
        assert_eq!(
            comparison::import_assessment_summary(
                &serde_json::to_vec(&namespace_at_limit).unwrap()
            ),
            Err(comparison::ComparisonError::InvalidDocument)
        );
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn profiled_wordpress_reporting_exposes_method_and_uncertainty_in_every_format() {
        let document = profiled_wordpress_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let advisory = &parsed["wordpress_review"]["advisories"][0];
        assert_eq!(
            parsed["wordpress_review"]["schema"],
            "security.wordpress-review-audit/v2"
        );
        assert_eq!(advisory["comparison_profile"], "php-release-subset/v1");
        assert_eq!(advisory["version_resolution"], "supported_equivalent");
        assert_eq!(
            advisory["version_resolution_reason"],
            "single_supported_version"
        );
        assert_eq!(advisory["version_relation"], "within_declared_range");
        assert_eq!(
            advisory["applicability"],
            "candidate_match_on_declared_facts"
        );
        assert_eq!(advisory["exploit_execution"], "not_performed");
        assert_eq!(advisory["impact_validation"], "not_performed");
        assert!(parsed["wordpress_review"].get("external_review").is_none());

        for format in [
            ReportFormat::Html,
            ReportFormat::Markdown,
            ReportFormat::Csv,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("security.wordpress-review-audit/v2"));
            assert!(rendered.contains("php-release-subset/v1"));
            assert!(rendered.contains("single_supported_version"));
            assert!(rendered.contains("not_performed"));
            assert!(!rendered.contains("confirmed_vulnerability"));
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn external_wordpress_reporting_is_source_qualified_and_reader_compatible() {
        let document = external_wordpress_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["wordpress_review"];
        let external = &audit["external_review"];
        assert_eq!(audit["schema"], "security.wordpress-review-audit/v4");
        assert_eq!(audit["catalog_status"], "evaluated");
        assert!(audit.get("catalog").is_none());
        assert!(audit.get("catalog_schema").is_none());
        assert!(audit.get("inventory_import").is_none());
        assert_eq!(audit["advisory_count"], 0);
        assert_eq!(audit["advisories"], serde_json::json!([]));
        assert_eq!(external["source_namespace"], "wordfence-intelligence");
        assert_eq!(external["source_format"], "wordfence-v3-production");
        assert_eq!(
            external["mapping_revision"],
            "termivar-wordfence-v3-production/v1"
        );
        assert_eq!(
            external["comparison_policy"],
            "wordfence-v3/source-semantics-unresolved/v1"
        );
        assert_eq!(external["input"]["byte_length"], 3883);
        assert_eq!(
            external["input"]["sha256"],
            "d9ed3140f44ae1e0a3746beb9937de2d829d28c068101120a9104c3349901db7"
        );
        assert!(external["input"]["semantic_sha256"]
            .as_str()
            .is_some_and(valid_lowercase_sha256));
        assert_eq!(external["counts"]["parsed_records"], 2);
        assert_eq!(external["counts"]["software_associations"], 3);
        assert_eq!(external["counts"]["selected_associations"], 1);
        assert_eq!(external["counts"]["evaluable_associations"], 0);
        assert_eq!(external["counts"]["unsupported_associations"], 1);
        assert_eq!(external["counts"]["excluded_associations"], 2);
        for absent in [
            "comparison_profile",
            "policy_selection",
            "source_semantics_assurance",
            "identity_mapping_policy",
            "identity_source_assurance",
            "resource_policy",
        ] {
            assert!(external.get(absent).is_none());
        }
        assert!(external["input"].get("accounted_retained_bytes").is_none());
        for absent in [
            "exact_identity_associations",
            "candidate_identity_associations",
            "ambiguous_identity_associations",
            "unresolved_identity_associations",
            "projected_identity_limitations",
            "unprojected_identity_limitations",
            "within_associations",
            "outside_associations",
            "indeterminate_associations",
            "selected_ranges",
            "evaluated_ranges",
            "containing_ranges",
            "noncontaining_ranges",
            "unsupported_ranges",
            "invalid_ranges",
            "not_evaluated_ranges",
            "partial_range_coverage_associations",
        ] {
            assert!(external["counts"].get(absent).is_none());
        }
        assert_eq!(external["notices"].as_array().unwrap().len(), 1);
        let evaluation = &external["evaluations"][0];
        assert!(evaluation.get("identity_mapping").is_none());
        assert!(evaluation.get("identity_collision_raw_count").is_none());
        assert!(evaluation["key"].get("source_component").is_none());
        assert_eq!(evaluation["key"]["component"]["kind"], "plugin");
        assert_eq!(
            evaluation["key"]["component"]["slug"],
            "termivar-fixture-component"
        );
        assert_eq!(
            evaluation["version_relation"],
            "source_comparison_semantics_unresolved"
        );
        assert_eq!(
            evaluation["version_evidence_resolution"]["status"],
            "missing"
        );
        assert_eq!(
            evaluation["version_evidence_resolution"]["evidence_row_count"],
            0
        );
        assert_eq!(
            evaluation["version_evidence_resolution"]["distinct_spelling_count"],
            0
        );
        assert_eq!(evaluation["applicability"], "indeterminate_unsupported");
        assert!(evaluation.get("range_evaluations").is_none());
        assert!(evaluation.get("version_relation_reason").is_none());
        assert!(evaluation["version_evidence_resolution"]
            .get("semantic_status")
            .is_none());
        assert!(evaluation["version_evidence_resolution"]
            .get("semantic_reason")
            .is_none());
        assert_eq!(
            evaluation["record_reference"],
            "https://example.invalid/termivar/wordfence-v3/fixture-advisory-1"
        );
        assert_eq!(
            evaluation["execution"]["exploit_execution"],
            "not_performed"
        );
        assert_eq!(
            evaluation["execution"]["impact_validation"],
            "not_performed"
        );
        assert!(comparison::import_assessment_summary(json.as_bytes()).is_ok());

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(html.contains("<h3>External source attribution</h3>"));
        assert!(html.contains(
            "rel=\"noreferrer noopener\" href=\"https://example.invalid/termivar/wordfence-v3/fixture-advisory-1\">Selected source reference</a>"
        ));
        assert!(html.contains("Synthetic fixture material created for Termivar parser testing."));
        assert!(html.contains("This fictional fixture text may be copied"));
        assert!(html.contains(
            "href=\"https://example.invalid/termivar/wordfence-v3/synthetic-fixture-terms\">License terms</a>"
        ));

        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(markdown.contains("\n#### External source attribution\n"));
        assert!(!markdown.contains("\n### External source attribution\n"));
        assert!(markdown.contains(
            "[Selected source reference](<https://example.invalid/termivar/wordfence-v3/fixture-advisory-1>)"
        ));
        assert!(markdown.contains("\n##### Rights notices\n"));
        assert!(!markdown.contains("\n#### Rights notices\n"));
        assert!(markdown.contains(
            "[License terms](<https://example.invalid/termivar/wordfence-v3/synthetic-fixture-terms>)"
        ));

        for format in [
            ReportFormat::Html,
            ReportFormat::Markdown,
            ReportFormat::Csv,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            for expected in [
                "security.wordpress-review-audit/v4",
                "wordfence-intelligence",
                "source_comparison_semantics_unresolved",
                "indeterminate_unsupported",
                "not_performed",
            ] {
                assert!(rendered.contains(expected), "{format:?} omitted {expected}");
            }
            assert!(!rendered.contains("candidate_match_on_declared_facts"));
            assert!(!rendered.contains("confirmed_vulnerability"));
            for v5_only_label in [
                "Comparison profile",
                "Policy selection",
                "Source comparison semantics assurance",
                "Version-relation reason",
                "Semantic version resolution",
                "Semantic resolution reason",
                "Within-range associations",
                "Outside-range associations",
                "Indeterminate associations",
                "Selected source ranges",
                "Evaluated ranges",
                "Containing ranges",
                "Noncontaining ranges",
                "Unsupported ranges",
                "Invalid ranges",
                "Ranges not evaluated",
                "Qualified partial-range matches",
            ] {
                assert!(
                    !rendered.contains(v5_only_label),
                    "{format:?} changed the v4 presentation with {v5_only_label}"
                );
            }
        }

        for (parsed_records, software_associations, excluded_associations) in
            [(0_usize, 1_usize, 0_usize), (1, 2_049, 2_048)]
        {
            let mut invalid = external_wordpress_assessment_document();
            let counts = &mut invalid
                .wordpress_review
                .as_mut()
                .unwrap()
                .external_review
                .as_mut()
                .unwrap()
                .counts;
            counts.parsed_records = parsed_records;
            counts.software_associations = software_associations;
            counts.excluded_associations = excluded_associations;
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&invalid, *format, usize::MAX),
                    Err(ReportError::Serialization)
                );
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn explicit_external_policy_reporting_is_v5_strict_and_reader_compatible() {
        for (profile, profile_id, relation, reason, applicability, within, outside) in [
            (
                WordPressComparisonProfile::NumericDottedV1,
                "numeric-dotted/v1",
                "within_supported_range_under_selected_policy",
                "containing_range",
                "version_match_under_selected_policy",
                1_u64,
                0_u64,
            ),
            (
                WordPressComparisonProfile::PhpReleaseSubsetV1,
                "php-release-subset/v1",
                "outside_declared_ranges_under_selected_policy",
                "all_ranges_outside",
                "no_version_match_under_selected_policy",
                0,
                1,
            ),
        ] {
            let document = explicitly_profiled_external_wordpress_assessment_document(profile);
            let json =
                render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
            let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
            let audit = &parsed["wordpress_review"];
            let external = &audit["external_review"];
            assert!(comparison::import_assessment_summary(json.as_bytes()).is_ok());
            let self_comparison = comparison::compare_reports(
                json.as_bytes(),
                json.as_bytes(),
                comparison::ComparisonFormat::Json,
            )
            .unwrap();
            let self_comparison: serde_json::Value =
                serde_json::from_str(&self_comparison).unwrap();
            assert_eq!(
                self_comparison["wordpress_review_comparison"]["status"],
                "compared"
            );
            assert_eq!(
                self_comparison["wordpress_review_comparison"]["advisories"]
                    ["paired_unchanged_count"],
                1
            );
            let evaluation = &external["evaluations"][0];

            assert_eq!(audit["schema"], "security.wordpress-review-audit/v5");
            assert_eq!(
                external["comparison_policy"],
                "termivar.wordfence-v3-explicit-interpretation/v1"
            );
            assert_eq!(external["comparison_profile"], profile_id);
            assert_eq!(external["policy_selection"], "explicit_operator");
            assert_eq!(external["source_semantics_assurance"], "not_established");
            for absent in [
                "identity_mapping_policy",
                "identity_source_assurance",
                "resource_policy",
            ] {
                assert!(external.get(absent).is_none());
            }
            assert!(external["input"].get("accounted_retained_bytes").is_none());
            assert_eq!(external["counts"]["selected_associations"], 1);
            assert_eq!(external["counts"]["evaluable_associations"], 1);
            assert_eq!(external["counts"]["unsupported_associations"], 0);
            assert_eq!(external["counts"]["within_associations"], within);
            assert_eq!(external["counts"]["outside_associations"], outside);
            assert_eq!(external["counts"]["indeterminate_associations"], 0);
            assert_eq!(external["counts"]["selected_ranges"], 2);
            assert_eq!(external["counts"]["evaluated_ranges"], 2);
            assert_eq!(external["counts"]["unsupported_ranges"], 0);
            assert_eq!(external["counts"]["invalid_ranges"], 0);
            assert_eq!(external["counts"]["not_evaluated_ranges"], 0);
            assert_eq!(evaluation["version_relation"], relation);
            assert!(evaluation.get("identity_mapping").is_none());
            assert!(evaluation.get("identity_collision_raw_count").is_none());
            assert!(evaluation["key"].get("source_component").is_none());
            assert_eq!(evaluation["version_relation_reason"], reason);
            assert_eq!(evaluation["applicability"], applicability);
            assert_eq!(
                evaluation["version_evidence_resolution"]["semantic_status"],
                "supported_equivalent"
            );
            assert_eq!(
                evaluation["version_evidence_resolution"]["semantic_reason"],
                "single_supported_version"
            );
            assert_eq!(evaluation["range_evaluations"].as_array().unwrap().len(), 2);
            assert_eq!(
                evaluation["execution"]["exploit_execution"],
                "not_performed"
            );
            assert_eq!(
                evaluation["execution"]["impact_validation"],
                "not_performed"
            );
            assert!(comparison::import_assessment_summary(json.as_bytes()).is_ok());

            for format in [
                ReportFormat::Html,
                ReportFormat::Markdown,
                ReportFormat::Csv,
            ] {
                let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
                for expected in [
                    "security.wordpress-review-audit/v5",
                    "termivar.wordfence-v3-explicit-interpretation/v1",
                    profile_id,
                    "explicit_operator",
                    "not_established",
                    relation,
                    reason,
                    applicability,
                    "not_performed",
                ] {
                    assert!(rendered.contains(expected), "{format:?} omitted {expected}");
                }
                assert!(!rendered.contains("confirmed_vulnerability"));
                assert!(!rendered.contains("verified_remediation"));
                assert!(!rendered.contains("Unsupported relevant associations"));
            }
        }

        let mut source_conflict = explicitly_profiled_external_wordpress_assessment_document(
            WordPressComparisonProfile::NumericDottedV1,
        );
        let external = source_conflict
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap();
        external.counts.within_associations = Some(0);
        external.counts.indeterminate_associations = Some(1);
        external.counts.evaluable_associations = 0;
        external.counts.unsupported_associations = 1;
        let evaluation = &mut external.evaluations[0];
        evaluation.source_patched_versions[0] = "1.1".to_owned();
        evaluation.version_relation = "indeterminate";
        evaluation.version_relation_reason = Some("source_patched_version_within_affected_range");
        evaluation.applicability = "indeterminate";
        let source_conflict_json =
            render_assessment_with_limit(&source_conflict, ReportFormat::Json, usize::MAX).unwrap();
        assert!(source_conflict_json.contains("source_patched_version_within_affected_range"));
        assert!(comparison::import_assessment_summary(source_conflict_json.as_bytes()).is_ok());

        let mut stale_source_conflict = source_conflict;
        stale_source_conflict
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .evaluations[0]
            .version_relation_reason = Some("containing_range");
        for format in ReportGenerator::available_formats() {
            assert_eq!(
                render_assessment_with_limit(&stale_source_conflict, *format, usize::MAX),
                Err(ReportError::Serialization)
            );
        }

        let mut invalid_documents = Vec::new();

        let mut invalid = explicitly_profiled_external_wordpress_assessment_document(
            WordPressComparisonProfile::NumericDottedV1,
        );
        invalid
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .source_semantics_assurance = Some("established");
        invalid_documents.push(invalid);

        let mut invalid = explicitly_profiled_external_wordpress_assessment_document(
            WordPressComparisonProfile::NumericDottedV1,
        );
        invalid
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .evaluations[0]
            .affected_ranges[0]
            .from_version = "9.0".to_owned();
        invalid_documents.push(invalid);

        let mut invalid = explicitly_profiled_external_wordpress_assessment_document(
            WordPressComparisonProfile::NumericDottedV1,
        );
        let range = &mut invalid
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .evaluations[0]
            .range_evaluations
            .as_mut()
            .unwrap()[1];
        range.relation = "not_evaluated";
        range.reason = "missing_version_evidence";
        invalid_documents.push(invalid);

        let mut invalid = explicitly_profiled_external_wordpress_assessment_document(
            WordPressComparisonProfile::NumericDottedV1,
        );
        invalid
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .counts
            .within_associations = Some(0);
        invalid_documents.push(invalid);

        let mut invalid = explicitly_profiled_external_wordpress_assessment_document(
            WordPressComparisonProfile::NumericDottedV1,
        );
        invalid
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .evaluations[0]
            .range_evaluations
            .as_mut()
            .unwrap()[0]
            .reason = "selected_version_outside_bounds";
        invalid_documents.push(invalid);

        let mut invalid = explicitly_profiled_external_wordpress_assessment_document(
            WordPressComparisonProfile::NumericDottedV1,
        );
        invalid
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .evaluations[0]
            .applicability = "no_version_match_under_selected_policy";
        invalid_documents.push(invalid);

        for invalid in invalid_documents {
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&invalid, *format, usize::MAX),
                    Err(ReportError::Serialization)
                );
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn source_identity_reporting_is_v6_strict_and_keeps_uncertainty_visible() {
        for profile in [None, Some(WordPressComparisonProfile::NumericDottedV1)] {
            let document = source_identity_external_wordpress_assessment_document(profile, false);
            let json =
                render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
            let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
            let audit = &parsed["wordpress_review"];
            let external = &audit["external_review"];
            assert_eq!(audit["schema"], "security.wordpress-review-audit/v6");
            assert_eq!(
                external["mapping_revision"],
                WORDFENCE_V3_MAPPING_REVISION_V2
            );
            assert_eq!(
                external["identity_mapping_policy"],
                WORDFENCE_V3_IDENTITY_MAPPING_POLICY
            );
            assert_eq!(external["identity_source_assurance"], "not_established");
            assert_eq!(external["resource_policy"], WORDFENCE_V3_RESOURCE_POLICY_V1);
            assert!(external["input"]["accounted_retained_bytes"]
                .as_u64()
                .is_some_and(|bytes| bytes > 0));
            assert_eq!(external["counts"]["software_associations"], 3);
            assert_eq!(external["counts"]["exact_identity_associations"], 2);
            assert_eq!(external["counts"]["candidate_identity_associations"], 1);
            assert_eq!(external["counts"]["ambiguous_identity_associations"], 0);
            assert_eq!(external["counts"]["unresolved_identity_associations"], 0);
            let evaluation = &external["evaluations"][0];
            assert_eq!(
                evaluation["key"]["source_component"],
                serde_json::json!({
                    "kind": "plugin",
                    "slug": "Termivar-Fixture-Component"
                })
            );
            assert_eq!(evaluation["identity_mapping"], "ascii_case_fold_candidate");
            assert!(evaluation.get("identity_collision_raw_count").is_none());
            if profile.is_some() {
                assert_eq!(evaluation["version_relation"], "indeterminate");
                assert_eq!(
                    evaluation["version_relation_reason"],
                    "identity_mapping_candidate"
                );
                assert_eq!(evaluation["applicability"], "indeterminate");
                assert!(evaluation["range_evaluations"]
                    .as_array()
                    .unwrap()
                    .iter()
                    .all(|range| range["relation"] == "not_evaluated"
                        && range["reason"] == "identity_mapping_candidate"));
                assert!(evaluation["version_evidence_resolution"]
                    .get("semantic_status")
                    .is_none());
            } else {
                assert_eq!(
                    evaluation["version_relation"],
                    "source_comparison_semantics_unresolved"
                );
                assert_eq!(evaluation["applicability"], "indeterminate_unsupported");
                assert!(evaluation.get("range_evaluations").is_none());
            }

            for format in [
                ReportFormat::Html,
                ReportFormat::Markdown,
                ReportFormat::Csv,
            ] {
                let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
                for expected in [
                    "security.wordpress-review-audit/v6",
                    "Termivar-Fixture-Component",
                    "ascii_case_fold_candidate",
                    "not_established",
                ] {
                    assert!(rendered.contains(expected), "{format:?} omitted {expected}");
                }
                assert!(!rendered.contains("Irrelevant associations excluded"));
                assert!(!rendered.contains("confirmed_vulnerability"));
                assert!(!rendered.contains("verified_remediation"));
            }
        }

        let collision = source_identity_external_wordpress_assessment_document(None, true);
        let json =
            render_assessment_with_limit(&collision, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let external = &parsed["wordpress_review"]["external_review"];
        assert_eq!(external["counts"]["software_associations"], 4);
        assert_eq!(external["counts"]["exact_identity_associations"], 3);
        assert_eq!(external["counts"]["candidate_identity_associations"], 0);
        assert_eq!(external["counts"]["ambiguous_identity_associations"], 1);
        let ambiguous = external["evaluations"]
            .as_array()
            .unwrap()
            .iter()
            .find(|evaluation| evaluation["identity_mapping"] == "ascii_case_fold_ambiguous")
            .unwrap();
        assert_eq!(ambiguous["identity_collision_raw_count"], 2);

        const FIRST_ID: &str = "00000000-0000-4000-8000-000000000001";
        let mut expanded_source: serde_json::Value = serde_json::from_slice(include_bytes!(
            "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
        ))
        .unwrap();
        expanded_source[FIRST_ID]["description"] = serde_json::Value::String("d".repeat(2_049));
        let expanded_bytes = serde_json::to_vec(&expanded_source).unwrap();
        let expanded = external_wordpress_assessment_document_from_bytes(&expanded_bytes);
        let json = render_assessment_with_limit(&expanded, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let external = &parsed["wordpress_review"]["external_review"];
        assert!(comparison::import_assessment_summary(json.as_bytes()).is_ok());
        let self_comparison = comparison::compare_reports(
            json.as_bytes(),
            json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let self_comparison: serde_json::Value = serde_json::from_str(&self_comparison).unwrap();
        assert_eq!(
            self_comparison["wordpress_review_comparison"]["advisories"]["paired_unchanged_count"],
            1
        );
        assert_eq!(
            parsed["wordpress_review"]["schema"],
            "security.wordpress-review-audit/v6"
        );
        assert_eq!(external["mapping_revision"], WORDFENCE_V3_MAPPING_REVISION);
        assert_eq!(external["resource_policy"], WORDFENCE_V3_RESOURCE_POLICY_V2);
        assert_eq!(external["counts"]["exact_identity_associations"], 3);
        assert_eq!(external["counts"]["candidate_identity_associations"], 0);
        assert_eq!(external["evaluations"][0]["identity_mapping"], "exact");
        assert_eq!(
            external["evaluations"][0]["key"]["source_component"]["slug"],
            "termivar-fixture-component"
        );

        let mut opaque_source: serde_json::Value = serde_json::from_slice(include_bytes!(
            "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
        ))
        .unwrap();
        opaque_source[FIRST_ID]["researchers"] =
            serde_json::json!(["Synthetic Researcher", "Synthetic Researcher"]);
        opaque_source[FIRST_ID]["software"][0]["affected_versions"]["[1.0.0, 1.2.3]"]
            ["to_version"] = serde_json::Value::String("0.1.2 β".to_owned());
        opaque_source[FIRST_ID]["software"][0]["patched_versions"] =
            serde_json::json!(["44.0 (17-08-2023)"]);
        let opaque_bytes = serde_json::to_vec(&opaque_source).unwrap();
        let opaque = external_wordpress_assessment_document_from_bytes(&opaque_bytes);
        let opaque_json =
            render_assessment_with_limit(&opaque, ReportFormat::Json, usize::MAX).unwrap();
        let opaque_parsed: serde_json::Value = serde_json::from_str(&opaque_json).unwrap();
        let opaque_evaluation = &opaque_parsed["wordpress_review"]["external_review"]
            ["evaluations"]
            .as_array()
            .unwrap()
            .iter()
            .find(|evaluation| evaluation["key"]["upstream_id"] == FIRST_ID)
            .unwrap();
        assert_eq!(
            opaque_evaluation["researchers"],
            serde_json::json!(["Synthetic Researcher", "Synthetic Researcher"])
        );
        assert_eq!(
            opaque_evaluation["affected_ranges"][0]["to_version"],
            "0.1.2 β"
        );
        assert_eq!(
            opaque_evaluation["source_patched_versions"],
            serde_json::json!(["44.0 (17-08-2023)"])
        );
        assert!(comparison::import_assessment_summary(opaque_json.as_bytes()).is_ok());
        assert!(comparison::compare_reports(
            opaque_json.as_bytes(),
            opaque_json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .is_ok());

        let mut duplicate_researcher_under_v1 =
            source_identity_external_wordpress_assessment_document(None, false);
        duplicate_researcher_under_v1
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .evaluations[0]
            .researchers = vec!["Synthetic Researcher".to_owned(); 2];
        let mut opaque_version_under_v1 =
            source_identity_external_wordpress_assessment_document(None, false);
        opaque_version_under_v1
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .evaluations[0]
            .affected_ranges[0]
            .to_version = "0.1.2 β".to_owned();
        for invalid in [duplicate_researcher_under_v1, opaque_version_under_v1] {
            assert_eq!(
                render_assessment_with_limit(&invalid, ReportFormat::Json, usize::MAX),
                Err(ReportError::Serialization)
            );
        }

        let mut wrong_mapping = source_identity_external_wordpress_assessment_document(None, false);
        wrong_mapping
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .evaluations[0]
            .identity_mapping = Some("exact");
        let mut false_decision = source_identity_external_wordpress_assessment_document(
            Some(WordPressComparisonProfile::NumericDottedV1),
            false,
        );
        let external = false_decision
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap();
        external.counts.evaluable_associations = 1;
        external.counts.unsupported_associations = 0;
        external.counts.outside_associations = Some(1);
        external.counts.indeterminate_associations = Some(0);
        let evaluation = &mut external.evaluations[0];
        evaluation.version_relation = "outside_declared_ranges_under_selected_policy";
        evaluation.version_relation_reason = Some("all_ranges_outside");
        evaluation.applicability = "no_version_match_under_selected_policy";
        for invalid in [wrong_mapping, false_decision] {
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&invalid, *format, usize::MAX),
                    Err(ReportError::Serialization)
                );
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn unresolved_external_identities_remain_visible_strict_and_comparable() {
        let document = unresolved_identity_external_wordpress_assessment_document(Some(
            WordPressComparisonProfile::NumericDottedV1,
        ));
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let external = &parsed["wordpress_review"]["external_review"];
        assert_eq!(external["counts"]["software_associations"], 3);
        assert_eq!(external["counts"]["unresolved_identity_associations"], 1);
        assert_eq!(external["counts"]["projected_identity_limitations"], 1);
        assert_eq!(external["counts"]["unprojected_identity_limitations"], 0);
        assert_eq!(external["counts"]["mapped_unselected_associations"], 2);
        assert_eq!(external["counts"]["excluded_associations"], 3);
        assert_eq!(external["evaluations"].as_array().unwrap().len(), 0);
        let limitation = &external["identity_limitations"][0];
        assert_eq!(
            limitation["key"]["source_component"],
            serde_json::json!({"kind":"plugin","slug":"vendor/plugin.php"})
        );
        assert_eq!(
            limitation["identity_resolution"],
            "canonical_identity_unavailable"
        );
        assert_eq!(limitation["version_relation"], "not_evaluated");
        assert_eq!(
            limitation["version_relation_reason"],
            "canonical_identity_unavailable"
        );
        assert_eq!(limitation["applicability"], "indeterminate");
        assert!(limitation["range_evaluations"]
            .as_array()
            .unwrap()
            .iter()
            .all(|range| range["relation"] == "not_evaluated"
                && range["reason"] == "canonical_identity_unavailable"));
        assert!(comparison::import_assessment_summary(json.as_bytes()).is_ok());

        for slug in ["valid-plugin", "Valid-Plugin"] {
            let mut invalid = unresolved_identity_external_wordpress_assessment_document(Some(
                WordPressComparisonProfile::NumericDottedV1,
            ));
            invalid
                .wordpress_review
                .as_mut()
                .unwrap()
                .external_review
                .as_mut()
                .unwrap()
                .identity_limitations
                .as_mut()
                .unwrap()[0]
                .key
                .source_component
                .slug = slug.to_owned();
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&invalid, *format, usize::MAX),
                    Err(ReportError::Serialization),
                    "a mappable source identity must not be projected as unavailable"
                );
            }
        }

        let mut missing_projection = parsed.clone();
        missing_projection["wordpress_review"]["external_review"]["identity_limitations"] =
            serde_json::json!([]);
        let mut false_projection_partition = parsed.clone();
        false_projection_partition["wordpress_review"]["external_review"]["counts"]
            ["unprojected_identity_limitations"] = serde_json::json!(1);
        let mut invalid_raw_identity = parsed.clone();
        invalid_raw_identity["wordpress_review"]["external_review"]["identity_limitations"][0]
            ["key"]["source_component"]["slug"] = serde_json::json!("vendor\nplugin.php");
        let mut false_relation = parsed.clone();
        false_relation["wordpress_review"]["external_review"]["identity_limitations"][0]
            ["version_relation"] =
            serde_json::json!("outside_declared_ranges_under_selected_policy");
        let mut unbound_notice_import = parsed.clone();
        unbound_notice_import["wordpress_review"]["external_review"]["identity_limitations"][0]
            ["notice_ids"] = serde_json::json!([]);
        let mut false_exact_limitation = parsed.clone();
        false_exact_limitation["wordpress_review"]["external_review"]["identity_limitations"][0]
            ["key"]["source_component"]["slug"] = serde_json::json!("valid-plugin");
        let mut false_candidate_limitation = parsed.clone();
        false_candidate_limitation["wordpress_review"]["external_review"]["identity_limitations"]
            [0]["key"]["source_component"]["slug"] = serde_json::json!("Valid-Plugin");
        for invalid in [
            missing_projection,
            false_projection_partition,
            invalid_raw_identity,
            false_relation,
            unbound_notice_import,
            false_exact_limitation,
            false_candidate_limitation,
        ] {
            let encoded = serde_json::to_vec(&invalid).unwrap();
            assert_eq!(
                comparison::import_assessment_summary(&encoded),
                Err(comparison::ComparisonError::InvalidDocument)
            );
        }

        let self_comparison = comparison::compare_reports(
            json.as_bytes(),
            json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let self_comparison: serde_json::Value = serde_json::from_str(&self_comparison).unwrap();
        let changes = &self_comparison["wordpress_review_comparison"]["advisories"];
        assert_eq!(changes["paired_unchanged_count"], 1);
        assert_eq!(changes["paired_changed"].as_array().unwrap().len(), 0);

        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            for expected in [
                "vendor/plugin.php",
                "canonical_identity_unavailable",
                "not_evaluated",
                "Synthetic fixture guidance",
            ] {
                assert!(rendered.contains(expected), "{format:?} omitted {expected}");
            }
        }

        let renamed = unresolved_identity_external_wordpress_assessment_document_with_slug(
            Some(WordPressComparisonProfile::NumericDottedV1),
            "vendor/renamed.php",
        );
        let renamed_json =
            render_assessment_with_limit(&renamed, ReportFormat::Json, usize::MAX).unwrap();
        let comparison = comparison::compare_reports(
            json.as_bytes(),
            renamed_json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        let changes = &comparison["wordpress_review_comparison"]["advisories"];
        assert_eq!(changes["paired_unchanged_count"], 0);
        assert_eq!(changes["only_in_before"].as_array().unwrap().len(), 1);
        assert_eq!(changes["only_in_after"].as_array().unwrap().len(), 1);

        let mut wrong_count = unresolved_identity_external_wordpress_assessment_document(None);
        wrong_count
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .counts
            .unresolved_identity_associations = Some(0);
        let mut false_result = unresolved_identity_external_wordpress_assessment_document(None);
        false_result
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .identity_limitations
            .as_mut()
            .unwrap()[0]
            .version_relation = "outside_declared_ranges_under_selected_policy";
        let mut unbound_notice = unresolved_identity_external_wordpress_assessment_document(None);
        unbound_notice
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .identity_limitations
            .as_mut()
            .unwrap()[0]
            .notice_ids
            .clear();
        for invalid in [wrong_count, false_result, unbound_notice] {
            assert_eq!(
                render_assessment_with_limit(&invalid, ReportFormat::Json, usize::MAX),
                Err(ReportError::Serialization)
            );
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn legacy_external_exact_identity_normalizes_for_v6_semantic_comparison() {
        let before = external_wordpress_assessment_document();
        let mut after = external_wordpress_assessment_document();
        let audit = after.wordpress_review.as_mut().unwrap();
        audit.schema = "security.wordpress-review-audit/v6";
        let external = audit.external_review.as_mut().unwrap();
        external.identity_mapping_policy = Some(WORDFENCE_V3_IDENTITY_MAPPING_POLICY);
        external.identity_source_assurance = Some("not_established");
        external.resource_policy = Some(WORDFENCE_V3_RESOURCE_POLICY_V2);
        external.input.accounted_retained_bytes = Some(1);
        external.counts.exact_identity_associations = Some(3);
        external.counts.candidate_identity_associations = Some(0);
        external.counts.ambiguous_identity_associations = Some(0);
        external.counts.unresolved_identity_associations = Some(0);
        external.counts.projected_identity_limitations = Some(0);
        external.counts.unprojected_identity_limitations = Some(0);
        external.counts.mapped_unselected_associations =
            Some(external.counts.excluded_associations);
        external.identity_limitations = Some(Vec::new());
        let source_association_fingerprint = external_fixture_source_association_fingerprint();
        for evaluation in &mut external.evaluations {
            evaluation.identity_mapping = Some("exact");
            evaluation.key.source_component =
                Some(WordPressExternalSourceComponentIdentityDocument {
                    kind: evaluation.key.component.kind,
                    slug: evaluation.key.component.slug.clone(),
                });
            evaluation.key.source_association_fingerprint =
                Some(source_association_fingerprint.clone());
        }
        let before_json =
            render_assessment_with_limit(&before, ReportFormat::Json, usize::MAX).unwrap();
        let after_json =
            render_assessment_with_limit(&after, ReportFormat::Json, usize::MAX).unwrap();
        let comparison = comparison::compare_reports(
            before_json.as_bytes(),
            after_json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        let wordpress = &comparison["wordpress_review_comparison"];
        assert_eq!(wordpress["methodology"]["status"], "changed");
        assert_eq!(wordpress["advisories"]["paired_unchanged_count"], 1);
        assert_eq!(
            wordpress["advisories"]["paired_changed"]
                .as_array()
                .unwrap()
                .len(),
            0
        );
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn external_source_variants_round_trip_and_compare_under_the_stable_source_key() {
        fn variant_document(
            display_name: &str,
            reverse_source_order: bool,
        ) -> AssessmentDocument<'static> {
            let mut source: serde_json::Value = serde_json::from_slice(include_bytes!(
                "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
            ))
            .unwrap();
            let software = source["00000000-0000-4000-8000-000000000001"]["software"]
                .as_array_mut()
                .unwrap();
            let mut variant = software[0].clone();
            variant["name"] = serde_json::Value::String(display_name.to_owned());
            variant["remediation"] =
                serde_json::Value::String("Synthetic alternate declaration guidance.".to_owned());
            software.push(variant);
            if reverse_source_order {
                software.reverse();
            }
            let bytes = serde_json::to_vec(&source).unwrap();
            external_wordpress_assessment_document_from_bytes(&bytes)
        }

        let before = variant_document("[SYNTHETIC] Alternate declaration A", false);
        let reordered = variant_document("[SYNTHETIC] Alternate declaration A", true);
        let after = variant_document("[SYNTHETIC] Alternate declaration B", false);
        let before_json =
            render_assessment_with_limit(&before, ReportFormat::Json, usize::MAX).unwrap();
        let reordered_json =
            render_assessment_with_limit(&reordered, ReportFormat::Json, usize::MAX).unwrap();
        let after_json =
            render_assessment_with_limit(&after, ReportFormat::Json, usize::MAX).unwrap();

        let parsed: serde_json::Value = serde_json::from_str(&before_json).unwrap();
        let external = &parsed["wordpress_review"]["external_review"];
        assert_eq!(
            parsed["wordpress_review"]["schema"],
            "security.wordpress-review-audit/v6"
        );
        assert_eq!(
            external["resource_policy"],
            "termivar.wordfence-v3-bounded-capacity/v2"
        );
        let evaluations = external["evaluations"].as_array().unwrap();
        assert_eq!(evaluations.len(), 2);
        let fingerprints = evaluations
            .iter()
            .map(|evaluation| {
                evaluation["key"]["source_association_fingerprint"]
                    .as_str()
                    .unwrap()
            })
            .collect::<std::collections::BTreeSet<_>>();
        assert_eq!(fingerprints.len(), 2);

        let mut reordered_wire = parsed.clone();
        let reordered_evaluation =
            &mut reordered_wire["wordpress_review"]["external_review"]["evaluations"][0];
        reordered_evaluation["affected_ranges"]
            .as_array_mut()
            .unwrap()
            .reverse();
        reordered_evaluation["source_patched_versions"]
            .as_array_mut()
            .unwrap()
            .reverse();
        let reordered_wire = serde_json::to_vec(&reordered_wire).unwrap();
        comparison::import_assessment_summary(&reordered_wire).unwrap();

        let mut tampered_fingerprint = parsed.clone();
        let fingerprint = tampered_fingerprint["wordpress_review"]["external_review"]
            ["evaluations"][0]["key"]["source_association_fingerprint"]
            .as_str()
            .unwrap()
            .to_owned();
        let replacement = if fingerprint.ends_with('0') { '1' } else { '0' };
        tampered_fingerprint["wordpress_review"]["external_review"]["evaluations"][0]["key"]
            ["source_association_fingerprint"] = serde_json::Value::String(format!(
            "{}{replacement}",
            &fingerprint[..fingerprint.len() - 1]
        ));
        let tampered_fingerprint = serde_json::to_vec(&tampered_fingerprint).unwrap();
        assert_eq!(
            comparison::import_assessment_summary(&tampered_fingerprint),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        let mut duplicate_range_label = parsed.clone();
        let ranges = duplicate_range_label["wordpress_review"]["external_review"]["evaluations"][0]
            ["affected_ranges"]
            .as_array_mut()
            .unwrap();
        ranges.push(ranges[0].clone());
        let duplicate_range_label = serde_json::to_vec(&duplicate_range_label).unwrap();
        assert_eq!(
            comparison::import_assessment_summary(&duplicate_range_label),
            Err(comparison::ComparisonError::InvalidDocument)
        );

        for candidate in [&before_json, &reordered_json, &after_json] {
            comparison::import_assessment_summary(candidate.as_bytes()).unwrap();
        }
        for same in [&before_json, &reordered_json] {
            let comparison = comparison::compare_reports(
                before_json.as_bytes(),
                same.as_bytes(),
                comparison::ComparisonFormat::Json,
            )
            .unwrap();
            let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
            let advisories = &comparison["wordpress_review_comparison"]["advisories"];
            assert_eq!(advisories["paired_unchanged_count"], 1);
            assert_eq!(advisories["paired_changed"].as_array().unwrap().len(), 0);
            assert_eq!(advisories["only_in_before"].as_array().unwrap().len(), 0);
            assert_eq!(advisories["only_in_after"].as_array().unwrap().len(), 0);
        }

        let comparison = comparison::compare_reports(
            before_json.as_bytes(),
            after_json.as_bytes(),
            comparison::ComparisonFormat::Json,
        )
        .unwrap();
        let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
        let advisories = &comparison["wordpress_review_comparison"]["advisories"];
        assert_eq!(advisories["paired_unchanged_count"], 0);
        assert_eq!(advisories["paired_changed"].as_array().unwrap().len(), 1);
        assert_eq!(advisories["only_in_before"].as_array().unwrap().len(), 0);
        assert_eq!(advisories["only_in_after"].as_array().unwrap().len(), 0);
        assert_eq!(
            advisories["paired_changed"][0]["changed_dimensions"],
            serde_json::json!(["source_association_variants"])
        );

        let discovery_json = render_assessment_with_limit(
            &discovered_wordpress_assessment_document(),
            ReportFormat::Json,
            usize::MAX,
        )
        .unwrap();
        let discovery_document: serde_json::Value = serde_json::from_str(&discovery_json).unwrap();
        let discovery = discovery_document["wordpress_discovery"].clone();
        let discovery_item = discovery_document["items"]
            .as_array()
            .unwrap()
            .iter()
            .find(|item| item["capability_id"] == WORDPRESS_DISCOVERY_OBSERVATION_CAPABILITY_ID)
            .unwrap()
            .clone();
        let depth_zero_identities = discovery["sources"]
            .as_array()
            .unwrap()
            .iter()
            .filter(|source| source["parent_depth"] == 0 && !source["component"].is_null())
            .map(|source| source["component"].clone())
            .collect::<Vec<_>>();
        assert_eq!(depth_zero_identities.len(), 2);
        let discovery_components = depth_zero_identities
            .iter()
            .map(|identity| {
                let matches = discovery_document["wordpress_review"]["components"]
                    .as_array()
                    .unwrap()
                    .iter()
                    .filter(|component| component["identity"] == *identity)
                    .collect::<Vec<_>>();
                assert_eq!(matches.len(), 1);
                matches[0].clone()
            })
            .collect::<Vec<_>>();
        let as_discovery_v7 = |source: &str| {
            let mut value: serde_json::Value = serde_json::from_str(source).unwrap();
            let review = value["wordpress_review"].as_object_mut().unwrap();
            let basis = review["schema"].clone();
            review.insert(
                "schema".to_owned(),
                serde_json::json!("security.wordpress-review-audit/v7"),
            );
            review.insert("review_basis_schema".to_owned(), basis);
            review.insert("additional_request_count".to_owned(), serde_json::json!(3));
            let components = review["components"].as_array_mut().unwrap();
            for discovery_component in &discovery_components {
                assert!(components
                    .iter()
                    .all(|component| { component["identity"] != discovery_component["identity"] }));
                components.push(discovery_component.clone());
            }
            let component_count = components.len();
            review.insert(
                "component_count".to_owned(),
                serde_json::json!(component_count),
            );
            value["wordpress_discovery"] = discovery.clone();
            let items = value["items"].as_array_mut().unwrap();
            items.push(discovery_item.clone());
            value["item_count"] = serde_json::json!(items.len());
            serde_json::to_vec(&value).unwrap()
        };
        let v7_before = as_discovery_v7(&before_json);
        let v7_reordered = as_discovery_v7(&reordered_json);
        let v7_after = as_discovery_v7(&after_json);
        for same in [&v7_before, &v7_reordered] {
            comparison::import_assessment_summary(same).unwrap();
            let comparison =
                comparison::compare_reports(&v7_before, same, comparison::ComparisonFormat::Json)
                    .unwrap();
            let comparison: serde_json::Value = serde_json::from_str(&comparison).unwrap();
            let advisories = &comparison["wordpress_review_comparison"]["advisories"];
            assert_eq!(advisories["paired_unchanged_count"], 1);
            assert_eq!(advisories["paired_changed"], serde_json::json!([]));
        }
        let v7_comparison =
            comparison::compare_reports(&v7_before, &v7_after, comparison::ComparisonFormat::Json)
                .unwrap();
        let v7_comparison: serde_json::Value = serde_json::from_str(&v7_comparison).unwrap();
        let v7_advisories = &v7_comparison["wordpress_review_comparison"]["advisories"];
        assert_eq!(v7_advisories["paired_unchanged_count"], 0);
        assert_eq!(v7_advisories["paired_changed"].as_array().unwrap().len(), 1);
        assert_eq!(
            v7_advisories["paired_changed"][0]["changed_dimensions"],
            serde_json::json!(["source_association_variants"])
        );

        let mut impossible_v1: serde_json::Value = serde_json::from_str(&before_json).unwrap();
        impossible_v1["wordpress_review"]["external_review"]["resource_policy"] =
            serde_json::Value::String(WORDFENCE_V3_RESOURCE_POLICY_V1.to_owned());
        let impossible_v1 = serde_json::to_vec(&impossible_v1).unwrap();
        assert_eq!(
            comparison::import_assessment_summary(&impossible_v1),
            Err(comparison::ComparisonError::InvalidDocument)
        );
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_human_reports_group_typed_results_without_claim_promotion_or_wire_dump() {
        let cases = [
            (
                observed_wordpress_assessment_document(),
                0_usize,
                1_usize,
                "SYNTHETIC-REPORTING-WORDPRESS-0001",
            ),
            (
                profiled_wordpress_assessment_document(),
                1,
                0,
                "php-release-subset/v1",
            ),
            (
                external_wordpress_assessment_document(),
                0,
                1,
                "wordfence-v3/source-semantics-unresolved/v1",
            ),
        ];

        for (document, candidates, limitations, distinguishing_value) in cases {
            let html =
                render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
            let markdown =
                render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX)
                    .unwrap();

            for rendered in [&html, &markdown] {
                for heading in [
                    "Source and coverage",
                    "Component evidence",
                    "Review candidates",
                    "Contradicted on supplied facts",
                    "Evaluation limitations",
                    "Source-declared remediation information",
                ] {
                    assert!(rendered.contains(heading), "missing {heading}");
                }
                assert!(rendered.contains(distinguishing_value));
                assert!(rendered.contains("not_performed"));
                assert!(!rendered.contains("confirmed_vulnerability"));
                assert!(!rendered.contains("verified_remediation"));
                assert!(!rendered.contains("\"external_review\":"));
                assert!(!rendered.contains("\"advisories\":"));
            }

            assert!(html.contains(&format!(
                "<strong>{candidates}</strong><span>Review candidates</span>"
            )));
            assert!(html.contains(&format!(
                "<strong>{limitations}</strong><span>Evaluation limitations</span>"
            )));
            assert!(markdown.contains(&format!("- Review candidates: `{candidates}`")));
            assert!(markdown.contains(&format!("- Evaluation limitations: `{limitations}`")));
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_human_grouping_is_mutually_exclusive_ordered_and_deterministic() {
        const ADVISORY_ID: &str = "SYNTHETIC-REPORTING-WORDPRESS-0001";
        let candidate = profiled_wordpress_assessment_document();
        let mut contradicted = profiled_wordpress_assessment_document();
        let contradicted_advisory =
            &mut contradicted.wordpress_review.as_mut().unwrap().advisories[0];
        contradicted_advisory.applicability = "contradicted_by_declared_facts";
        contradicted_advisory.version_relation = "outside_declared_ranges";
        let limitation = observed_wordpress_assessment_document();

        for (document, expected_counts) in [
            (candidate, [1_usize, 0_usize, 0_usize]),
            (contradicted, [0, 1, 0]),
            (limitation, [0, 0, 1]),
        ] {
            for format in [ReportFormat::Html, ReportFormat::Markdown] {
                let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
                let repeated = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
                assert_eq!(rendered, repeated);

                let heading = |title| match format {
                    ReportFormat::Html => format!("<h3>{title}</h3>"),
                    ReportFormat::Markdown => format!("### {title}\n"),
                    _ => unreachable!(),
                };
                let candidate_heading = rendered.find(&heading("Review candidates")).unwrap();
                let contradicted_heading = rendered
                    .find(&heading("Contradicted on supplied facts"))
                    .unwrap();
                let limitation_heading = rendered.find(&heading("Evaluation limitations")).unwrap();
                let remediation_heading = rendered
                    .find(&heading("Source-declared remediation information"))
                    .unwrap();
                assert!(candidate_heading < contradicted_heading);
                assert!(contradicted_heading < limitation_heading);
                assert!(limitation_heading < remediation_heading);
                assert_eq!(rendered.matches(ADVISORY_ID).count(), 1);
                assert_eq!(rendered.matches("not_performed").count(), 2);

                let advisory = rendered.find(ADVISORY_ID).unwrap();
                let (expected_start, expected_end) = if expected_counts[0] == 1 {
                    (candidate_heading, contradicted_heading)
                } else if expected_counts[1] == 1 {
                    (contradicted_heading, limitation_heading)
                } else {
                    (limitation_heading, remediation_heading)
                };
                assert!(expected_start < advisory && advisory < expected_end);

                for (label, count) in [
                    ("Review candidates", expected_counts[0]),
                    ("Contradicted on supplied facts", expected_counts[1]),
                    ("Evaluation limitations", expected_counts[2]),
                ] {
                    let expected = match format {
                        ReportFormat::Html => {
                            format!("<strong>{count}</strong><span>{label}</span>")
                        },
                        ReportFormat::Markdown => format!("- {label}: `{count}`"),
                        _ => unreachable!(),
                    };
                    assert!(
                        rendered.contains(&expected),
                        "{format:?} omitted {expected}"
                    );
                }
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn saved_inventory_human_report_distinguishes_supplied_and_missing_categories() {
        let mut document = saved_inventory_wordpress_assessment_document();
        document
            .wordpress_review
            .as_mut()
            .unwrap()
            .inventory_import
            .as_mut()
            .unwrap()
            .limitations
            .push(WordPressInventoryLimitationDocument {
                declared_name: "synthetic-dropin.php".to_owned(),
                version: Some("1.0".to_owned()),
                status: "drop_in",
                reason: "drop_in_identity_is_not_catalog_slug",
            });
        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();

        for rendered in [&html, &markdown] {
            for expected in [
                "Core inventory",
                "Plugin inventory",
                "Theme inventory",
                "not_supplied",
                "supplied",
                "Saved inventory provenance and limitations",
                "wp_cli_plugins_json",
                "operator_supplied",
                "operator_context",
                "operator_assertion",
                "1.2.3-vendor",
                "Unsupported inventory row",
                "synthetic-dropin.php",
                "drop_in_identity_is_not_catalog_slug",
            ] {
                assert!(rendered.contains(expected), "missing {expected}");
            }
            assert!(!rendered.contains("PRIVATE"));
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn external_wordpress_human_report_reconciles_source_counts_and_declared_guidance() {
        let document = external_wordpress_assessment_document();
        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            for expected in [
                "Parsed source records",
                "Software associations",
                "Relevant associations",
                "Evaluable associations",
                "Unsupported relevant associations",
                "Irrelevant associations excluded",
                "source_comparison_semantics_unresolved",
                "missing",
                "Source patched flag",
                "Source-declared patched versions",
                "Source-declared remediation",
                "Source-declared CVSS metadata",
                "Source informational classification",
                "Source bibliography",
                "Source researchers",
                "Source notice identifiers",
                "Synthetic Fixture Author",
                "not_performed",
            ] {
                assert!(rendered.contains(expected), "{format:?} missing {expected}");
            }
            assert!(rendered.contains("Evaluations with source guidance"));
            assert!(!rendered.contains("Records with source guidance"));
            assert!(rendered.contains("not an automatic update"));
            assert!(rendered.contains("not confirmed vulnerabilities"));
            assert!(!rendered.contains("eleven verified vulnerabilities"));
            assert_eq!(
                rendered
                    .matches("Synthetic fixture guidance: review a source-declared patched version")
                    .count(),
                1
            );
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_human_presentation_respects_the_report_output_limit() {
        let document = external_wordpress_assessment_document();
        for format in [ReportFormat::Html, ReportFormat::Markdown] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert_eq!(
                render_assessment_with_limit(&document, format, rendered.len()),
                Ok(rendered.clone())
            );
            assert_eq!(
                render_assessment_with_limit(&document, format, rendered.len() - 1),
                Err(ReportError::OutputLimitExceeded {
                    limit: rendered.len() - 1
                })
            );
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn external_wordpress_reporting_preserves_parser_accepted_safe_text() {
        const ID: &str = "00000000-0000-4000-8000-000000000001";
        let mut source: serde_json::Value = serde_json::from_slice(include_bytes!(
            "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
        ))
        .unwrap();
        let record = source[ID].as_object_mut().unwrap();
        record.insert(
            "title".to_owned(),
            serde_json::json!("Synthetic\nreport title"),
        );
        record.insert(
            "description".to_owned(),
            serde_json::json!("Synthetic\tdescription"),
        );
        record["cwe"]["name"] = serde_json::json!("Synthetic\tCWE");
        record["cwe"]["description"] = serde_json::json!("Synthetic\rCWE detail");
        record["cvss"]["vector"] = serde_json::json!("CVSS:3.1/AV:N\n");
        record["researchers"][0] = serde_json::json!("Synthetic\tResearcher");
        let software = record["software"].as_array_mut().unwrap();
        software[0]["name"] = serde_json::json!("Synthetic\tPlugin");
        software[0]["remediation"] = serde_json::json!("Synthetic\rremediation");
        let ranges = software[0]["affected_versions"].as_object_mut().unwrap();
        let range = ranges.remove("[1.0.0, 1.2.3]").unwrap();
        ranges.insert("[1.0.0, 1.2.3]\n".to_owned(), range);

        let bytes = serde_json::to_vec(&source).unwrap();
        let document = external_wordpress_assessment_document_from_bytes(&bytes);
        let rendered =
            render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&rendered).unwrap();
        let evaluation = &parsed["wordpress_review"]["external_review"]["evaluations"][0];
        assert_eq!(evaluation["title"], "Synthetic\nreport title");
        assert_eq!(evaluation["display_name"], "Synthetic\tPlugin");
        assert_eq!(
            evaluation["affected_ranges"][0]["label"],
            "[1.0.0, 1.2.3]\n"
        );
        assert!(comparison::import_assessment_summary(rendered.as_bytes()).is_ok());

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(html.contains("Synthetic\\u{000A}report title"));
        assert!(html.contains("Synthetic\\u{0009}description"));
        assert!(!html.contains("Synthetic\nreport title"));
        assert!(!html.contains("<script"));
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(markdown.contains("Synthetic\\u{000A}report title"));
        assert!(markdown.contains("Synthetic\\u{0009}description"));
        assert!(!markdown.contains("Synthetic\nreport title"));

        let mut invalid = parsed;
        invalid["wordpress_review"]["external_review"]["evaluations"][0]["title"] =
            serde_json::json!("control\u{1}character");
        let invalid = serde_json::to_vec(&invalid).unwrap();
        assert!(comparison::import_assessment_summary(&invalid).is_err());
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn defiant_notice_renders_the_exact_source_record_link() {
        const ID: &str = "00000000-0000-4000-8000-000000000001";
        const RECORD: &str = "https://www.wordfence.com/threat-intel/vulnerabilities/synthetic-fixture?source=api-test";
        let mut source: serde_json::Value = serde_json::from_slice(include_bytes!(
            "../../../docs/examples/wordpress-review/wordfence-v3/production.synthetic.json"
        ))
        .unwrap();
        let record = source[ID].as_object_mut().unwrap();
        record.insert("references".to_owned(), serde_json::json!([RECORD]));
        let copyrights = record["copyrights"].as_object_mut().unwrap();
        let notice = copyrights.remove("termivar_fixture_author").unwrap();
        copyrights.insert("defiant".to_owned(), notice);

        let bytes = serde_json::to_vec(&source).unwrap();
        let document = external_wordpress_assessment_document_from_bytes(&bytes);
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert_eq!(
            parsed["wordpress_review"]["external_review"]["evaluations"][0]["record_reference"],
            RECORD
        );
        assert!(comparison::import_assessment_summary(json.as_bytes()).is_ok());
        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(html.contains(&format!("href=\"{RECORD}\">Selected source reference</a>")));
        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(markdown.contains(&format!("[Selected source reference](<{RECORD}>)")));
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn saved_inventory_reporting_is_path_free_versioned_and_reader_compatible() {
        let document = saved_inventory_wordpress_assessment_document();
        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        let audit = &parsed["wordpress_review"];
        assert_eq!(audit["schema"], "security.wordpress-review-audit/v3");
        assert!(audit.get("external_review").is_none());
        assert_eq!(audit["catalog_schema"], WORDPRESS_ADVISORY_CATALOG_SCHEMA);
        assert_eq!(audit["inventory_import"]["component_count"], 1);
        assert_eq!(
            audit["inventory_import"]["inputs"][0]["class"],
            "wp_cli_plugins_json"
        );
        assert_eq!(
            audit["inventory_import"]["inputs"][0]["sha256"],
            "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
        );
        assert_eq!(audit["components"][1]["inventory_status"], "active");
        assert!(comparison::import_assessment_summary(json.as_bytes()).is_ok());

        for format in [
            ReportFormat::Html,
            ReportFormat::Markdown,
            ReportFormat::Csv,
        ] {
            let rendered = render_assessment_with_limit(&document, format, usize::MAX).unwrap();
            assert!(rendered.contains("security.wordpress-review-audit/v3"));
            assert!(rendered.contains("wp_cli_plugins_json"));
            assert!(!rendered.contains("PRIVATE"));
        }

        let mut missing_inventory = saved_inventory_wordpress_assessment_document();
        missing_inventory
            .wordpress_review
            .as_mut()
            .unwrap()
            .inventory_import = None;
        let mut wrong_digest = saved_inventory_wordpress_assessment_document();
        wrong_digest
            .wordpress_review
            .as_mut()
            .unwrap()
            .inventory_import
            .as_mut()
            .unwrap()
            .inputs[0]
            .sha256 = "A".repeat(64);
        let mut status_without_context = saved_inventory_wordpress_assessment_document();
        let component = &mut status_without_context
            .wordpress_review
            .as_mut()
            .unwrap()
            .components[1];
        component.identity_sources = vec!["same_origin_asset_path"];
        component.confidence_classes = vec!["structural_hint"];

        let mut status_without_inventory_count = saved_inventory_wordpress_assessment_document();
        let audit = status_without_inventory_count
            .wordpress_review
            .as_mut()
            .unwrap();
        audit.components[1].inventory_status = None;
        audit.inventory_import.as_mut().unwrap().component_count = 0;

        let mut status_outside_supplied_category = saved_inventory_wordpress_assessment_document();
        let component = &mut status_outside_supplied_category
            .wordpress_review
            .as_mut()
            .unwrap()
            .components[1];
        component.identity.kind = "theme";
        component.identity.slug = "synthetic-theme".to_owned();

        for document in [
            missing_inventory,
            wrong_digest,
            status_without_context,
            status_without_inventory_count,
            status_outside_supplied_category,
        ] {
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&document, *format, usize::MAX),
                    Err(ReportError::Serialization)
                );
            }
        }

        let mut combined_observed_and_operator = saved_inventory_wordpress_assessment_document();
        let component = &mut combined_observed_and_operator
            .wordpress_review
            .as_mut()
            .unwrap()
            .components[1];
        component.evidence_class = "observed_hint";
        component.identity_sources = vec!["same_origin_asset_path", "operator_context"];
        component.confidence_classes = vec!["structural_hint", "operator_assertion"];
        component.versions.insert(
            0,
            WordPressVersionEvidenceDocument {
                value: "1.2.3-vendor".to_owned(),
                source: "same_origin_asset_path",
                confidence: "structural_hint",
            },
        );
        let json = render_assessment_with_limit(
            &combined_observed_and_operator,
            ReportFormat::Json,
            usize::MAX,
        )
        .unwrap();
        assert!(comparison::import_assessment_summary(json.as_bytes()).is_ok());
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_reporting_rejects_inconsistent_audit_truth() {
        let mut extra_request = observed_wordpress_assessment_document();
        extra_request
            .wordpress_review
            .as_mut()
            .unwrap()
            .additional_request_count = 1;
        let mut missing_item = observed_wordpress_assessment_document();
        missing_item
            .wordpress_review
            .as_mut()
            .unwrap()
            .item_projected = false;
        let mut missing_audit = observed_wordpress_assessment_document();
        missing_audit.wordpress_review = None;
        let mut wrong_component_count = observed_wordpress_assessment_document();
        wrong_component_count
            .wordpress_review
            .as_mut()
            .unwrap()
            .component_count = 2;
        let mut missing_catalog = observed_wordpress_assessment_document();
        missing_catalog.wordpress_review.as_mut().unwrap().catalog = None;
        let mut v1_profile_leak = observed_wordpress_assessment_document();
        v1_profile_leak
            .wordpress_review
            .as_mut()
            .unwrap()
            .advisories[0]
            .comparison_profile = Some("numeric-dotted/v1");
        let mut v2_missing_resolution = profiled_wordpress_assessment_document();
        v2_missing_resolution
            .wordpress_review
            .as_mut()
            .unwrap()
            .advisories[0]
            .version_resolution = None;
        let mut v2_contradictory_resolution = profiled_wordpress_assessment_document();
        let advisory = &mut v2_contradictory_resolution
            .wordpress_review
            .as_mut()
            .unwrap()
            .advisories[0];
        advisory.version_resolution = Some("unsupported");
        advisory.version_resolution_reason = Some("single_supported_version");
        let mut v4_missing_external = external_wordpress_assessment_document();
        v4_missing_external
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review = None;
        let mut v4_native_catalog = external_wordpress_assessment_document();
        v4_native_catalog.wordpress_review.as_mut().unwrap().catalog =
            Some(WordPressCatalogDocument {
                id: "invalid-native-catalog".to_owned(),
                revision: "invalid".to_owned(),
                retrieved_on: "2026-09-07".to_owned(),
            });
        let mut v4_wrong_digest = external_wordpress_assessment_document();
        v4_wrong_digest
            .wordpress_review
            .as_mut()
            .unwrap()
            .external_review
            .as_mut()
            .unwrap()
            .input
            .sha256 = "A".repeat(64);

        for document in [
            extra_request,
            missing_item,
            missing_audit,
            wrong_component_count,
            missing_catalog,
            v1_profile_leak,
            v2_missing_resolution,
            v2_contradictory_resolution,
            v4_missing_external,
            v4_native_catalog,
            v4_wrong_digest,
        ] {
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&document, *format, usize::MAX),
                    Err(ReportError::Serialization)
                );
            }
        }
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_reporting_and_import_share_combined_result_bounds() {
        let mut maximum_components = observed_wordpress_assessment_document();
        maximum_components.items[0].fingerprint =
            "sha256:0000000000000000000000000000000000000000000000000000000000000001";
        let audit = maximum_components.wordpress_review.as_mut().unwrap();
        audit.catalog_status = "catalogue_not_supplied";
        audit.catalog = None;
        audit.signal_count = u16::try_from(MAX_WORDPRESS_SIGNALS).unwrap();
        audit.evidence_reference_count = 1;
        audit.advisories.clear();
        audit.advisory_count = 0;
        audit.components = (0..MAX_WORDPRESS_RESULT_COMPONENTS)
            .map(|index| {
                let observed = index < MAX_WORDPRESS_SIGNALS;
                WordPressComponentDocument {
                    identity: WordPressComponentIdentityDocument {
                        kind: "plugin",
                        slug: format!("component-{index:03}"),
                    },
                    evidence_class: if observed {
                        "observed_hint"
                    } else {
                        "operator_supplied"
                    },
                    identity_sources: vec![if observed {
                        "same_origin_asset_path"
                    } else {
                        "operator_context"
                    }],
                    confidence_classes: vec![if observed {
                        "structural_hint"
                    } else {
                        "operator_assertion"
                    }],
                    versions: Vec::new(),
                    activation: None,
                    inventory_status: None,
                }
            })
            .collect();
        audit.component_count = audit.components.len();
        let maximum_components_json = render_assessment_with_limit(
            &maximum_components,
            ReportFormat::Json,
            MAX_RENDERED_REPORT_BYTES,
        )
        .unwrap();
        comparison::import_assessment_summary(maximum_components_json.as_bytes()).unwrap();

        let mut maximum_versions = observed_wordpress_assessment_document();
        maximum_versions.items[0].fingerprint =
            "sha256:0000000000000000000000000000000000000000000000000000000000000001";
        let audit = maximum_versions.wordpress_review.as_mut().unwrap();
        audit.catalog_status = "catalogue_not_supplied";
        audit.catalog = None;
        audit.signal_count = u16::try_from(MAX_WORDPRESS_SIGNALS).unwrap();
        audit.evidence_reference_count = 1;
        audit.advisories.clear();
        audit.advisory_count = 0;
        let mut components = vec![WordPressComponentDocument {
            identity: WordPressComponentIdentityDocument {
                kind: "core",
                slug: "wordpress".to_owned(),
            },
            evidence_class: "conflicting",
            identity_sources: vec!["generator_metadata"],
            confidence_classes: vec!["public_declaration"],
            versions: (0..MAX_WORDPRESS_SIGNALS)
                .map(|index| WordPressVersionEvidenceDocument {
                    value: format!("1.0.{index}"),
                    source: "generator_metadata",
                    confidence: "public_declaration",
                })
                .collect(),
            activation: None,
            inventory_status: None,
        }];
        components.extend(
            (0..MAX_WORDPRESS_RESULT_COMPONENTS - MAX_WORDPRESS_SIGNALS).map(|index| {
                WordPressComponentDocument {
                    identity: WordPressComponentIdentityDocument {
                        kind: "plugin",
                        slug: format!("declared-{index:03}"),
                    },
                    evidence_class: "operator_supplied",
                    identity_sources: vec!["operator_context"],
                    confidence_classes: vec!["operator_assertion"],
                    versions: vec![WordPressVersionEvidenceDocument {
                        value: format!("2.0.{index}"),
                        source: "operator_context",
                        confidence: "operator_assertion",
                    }],
                    activation: None,
                    inventory_status: None,
                }
            }),
        );
        audit.components = components;
        audit.component_count = audit.components.len();
        assert_eq!(
            audit
                .components
                .iter()
                .map(|component| component.versions.len())
                .sum::<usize>(),
            MAX_WORDPRESS_RESULT_VERSION_EVIDENCE
        );
        let maximum_versions_json = render_assessment_with_limit(
            &maximum_versions,
            ReportFormat::Json,
            MAX_RENDERED_REPORT_BYTES,
        )
        .unwrap();
        comparison::import_assessment_summary(maximum_versions_json.as_bytes()).unwrap();
    }

    #[cfg(all(feature = "scanning", feature = "wordpress-review"))]
    #[test]
    fn wordpress_reporting_tokens_are_exhaustive_and_semantically_named() {
        for (kind, token) in [
            (WordPressComponentKind::Core, "core"),
            (WordPressComponentKind::Plugin, "plugin"),
            (WordPressComponentKind::Theme, "theme"),
        ] {
            assert_eq!(wordpress_component_kind(kind), token);
        }
        for (source, token) in [
            (
                WordPressEvidenceSource::GeneratorMetadata,
                "generator_metadata",
            ),
            (
                WordPressEvidenceSource::SameOriginAssetPath,
                "same_origin_asset_path",
            ),
            (
                WordPressEvidenceSource::ThemeStylesheetDeclaration,
                "theme_stylesheet_declaration",
            ),
            (WordPressEvidenceSource::OperatorContext, "operator_context"),
        ] {
            assert_eq!(wordpress_evidence_source(source), token);
        }
        for (confidence, token) in [
            (
                WordPressEvidenceConfidence::PublicDeclaration,
                "public_declaration",
            ),
            (
                WordPressEvidenceConfidence::StructuralHint,
                "structural_hint",
            ),
            (
                WordPressEvidenceConfidence::OperatorAssertion,
                "operator_assertion",
            ),
        ] {
            assert_eq!(wordpress_confidence(confidence), token);
        }
        for (class, token) in [
            (
                WordPressComponentEvidenceClass::ObservedHint,
                "observed_hint",
            ),
            (
                WordPressComponentEvidenceClass::OperatorSupplied,
                "operator_supplied",
            ),
            (WordPressComponentEvidenceClass::Conflicting, "conflicting"),
            (WordPressComponentEvidenceClass::Unknown, "unknown"),
        ] {
            assert_eq!(wordpress_evidence_class(class), token);
        }
        for (relation, token) in [
            (
                WordPressVersionRelation::WithinDeclaredRange,
                "within_declared_range",
            ),
            (
                WordPressVersionRelation::OutsideDeclaredRanges,
                "outside_declared_ranges",
            ),
            (WordPressVersionRelation::Unknown, "unknown"),
            (WordPressVersionRelation::Unsupported, "unsupported"),
        ] {
            assert_eq!(wordpress_version_relation(relation), token);
        }
        for (profile, token) in [
            (
                WordPressComparisonProfile::NumericDottedV1,
                "numeric-dotted/v1",
            ),
            (
                WordPressComparisonProfile::PhpReleaseSubsetV1,
                "php-release-subset/v1",
            ),
        ] {
            assert_eq!(wordpress_comparison_profile(profile), token);
        }
        for (resolution, token) in [
            (WordPressVersionResolution::Missing, "missing"),
            (
                WordPressVersionResolution::SupportedEquivalent,
                "supported_equivalent",
            ),
            (WordPressVersionResolution::Conflicting, "conflicting"),
            (WordPressVersionResolution::Unsupported, "unsupported"),
        ] {
            assert_eq!(wordpress_version_resolution(resolution), token);
        }
        for (reason, token) in [
            (
                WordPressVersionResolutionReason::NoVersionEvidence,
                "no_version_evidence",
            ),
            (
                WordPressVersionResolutionReason::SingleSupportedVersion,
                "single_supported_version",
            ),
            (
                WordPressVersionResolutionReason::EquivalentSupportedVersions,
                "equivalent_supported_versions",
            ),
            (
                WordPressVersionResolutionReason::ConflictingVersionEvidence,
                "conflicting_version_evidence",
            ),
            (
                WordPressVersionResolutionReason::UnsupportedVersionEvidence,
                "unsupported_version_evidence",
            ),
        ] {
            assert_eq!(wordpress_version_resolution_reason(reason), token);
        }
        for (applicability, token) in [
            (
                WordPressApplicability::CandidateMatchOnDeclaredFacts,
                "candidate_match_on_declared_facts",
            ),
            (
                WordPressApplicability::ContradictedByDeclaredFacts,
                "contradicted_by_declared_facts",
            ),
            (
                WordPressApplicability::IndeterminateMissingEvidence,
                "indeterminate_missing_evidence",
            ),
            (
                WordPressApplicability::IndeterminateUnsupported,
                "indeterminate_unsupported",
            ),
        ] {
            assert_eq!(wordpress_applicability(applicability), token);
        }
        assert_eq!(
            wordpress_catalog_status(WordPressCatalogStatus::CatalogNotSupplied),
            "catalogue_not_supplied"
        );
        assert_eq!(
            wordpress_catalog_status(WordPressCatalogStatus::Evaluated),
            "evaluated"
        );
        assert_eq!(
            wordpress_execution(WordPressExecutionStatus::NotPerformed),
            "not_performed"
        );

        for prerequisite in [
            WordPressPrerequisite::HostingOs {
                equals: WordPressHostingOs::Linux,
            },
            WordPressPrerequisite::Multisite {
                equals: WordPressMultisiteState::Enabled,
            },
            WordPressPrerequisite::Activation {
                equals: WordPressActivationState::NetworkActive,
            },
            WordPressPrerequisite::Patch {
                id: "upstream-fix".to_owned(),
                equals: WordPressPatchState::NotApplied,
            },
            WordPressPrerequisite::Unsupported {
                name: "php-runtime".to_owned(),
            },
        ] {
            let document =
                wordpress_prerequisite(&prerequisite, WordPressPrerequisiteOutcome::Unknown);
            assert_eq!(document.outcome, "unknown");
            assert_eq!(document.kind == "patch", document.patch_id.is_some());
        }
        for (outcome, token) in [
            (
                WordPressPrerequisiteOutcome::MatchedOnSuppliedFacts,
                "matched_on_supplied_facts",
            ),
            (
                WordPressPrerequisiteOutcome::ContradictedOnSuppliedFacts,
                "contradicted_on_supplied_facts",
            ),
            (WordPressPrerequisiteOutcome::Unknown, "unknown"),
            (WordPressPrerequisiteOutcome::Unsupported, "unsupported"),
        ] {
            assert_eq!(wordpress_prerequisite_outcome(outcome), token);
        }
        for (activation, token) in [
            (WordPressActivationState::Active, "active"),
            (WordPressActivationState::Inactive, "inactive"),
            (WordPressActivationState::NetworkActive, "network_active"),
            (WordPressActivationState::Unknown, "unknown"),
        ] {
            assert_eq!(wordpress_activation(activation), token);
        }
        for (os, token) in [
            (WordPressHostingOs::Linux, "linux"),
            (WordPressHostingOs::Windows, "windows"),
            (WordPressHostingOs::Macos, "macos"),
            (WordPressHostingOs::Bsd, "bsd"),
            (WordPressHostingOs::Other, "other"),
        ] {
            assert_eq!(wordpress_hosting_os(os), token);
        }
        for (state, token) in [
            (WordPressMultisiteState::Enabled, "enabled"),
            (WordPressMultisiteState::Disabled, "disabled"),
        ] {
            assert_eq!(wordpress_multisite(state), token);
        }
        for (state, token) in [
            (WordPressPatchState::Applied, "applied"),
            (WordPressPatchState::NotApplied, "not_applied"),
            (WordPressPatchState::Unknown, "unknown"),
        ] {
            assert_eq!(wordpress_patch(state), token);
        }
    }

    #[cfg(all(feature = "scanning", feature = "rest-review"))]
    #[test]
    fn rest_reporting_outcome_and_class_tokens_are_exhaustive_and_stable() {
        for (outcome, token) in [
            (RestRuntimeOutcome::NotEligible, "not_eligible"),
            (RestRuntimeOutcome::SurfaceObserved, "surface_observed"),
            (RestRuntimeOutcome::ReplayMismatch, "replay_mismatch"),
            (RestRuntimeOutcome::CompleteNonJson, "complete_non_json"),
            (RestRuntimeOutcome::Redirect, "redirect"),
            (
                RestRuntimeOutcome::AuthenticationRequired,
                "authentication_required",
            ),
            (RestRuntimeOutcome::Forbidden, "forbidden"),
            (RestRuntimeOutcome::NotFound, "not_found"),
            (RestRuntimeOutcome::RateLimited, "rate_limited"),
            (
                RestRuntimeOutcome::DefensiveInterference,
                "defensive_interference",
            ),
            (RestRuntimeOutcome::ServerError, "server_error"),
            (RestRuntimeOutcome::UnsupportedMedia, "unsupported_media"),
            (RestRuntimeOutcome::Truncated, "truncated"),
            (RestRuntimeOutcome::Incomplete, "incomplete"),
            (RestRuntimeOutcome::Cancelled, "cancelled"),
            (RestRuntimeOutcome::BudgetExhausted, "budget_exhausted"),
        ] {
            assert_eq!(rest_outcome(outcome), token);
        }
        assert_eq!(
            rest_documented_response(RestDocumentedResponseClass::JsonCompatible),
            "json_compatible"
        );
        assert_eq!(
            rest_documented_response(RestDocumentedResponseClass::Unknown),
            "unknown"
        );
        for (media, token) in [
            (RestObservedMediaClass::JsonCompatible, "json_compatible"),
            (RestObservedMediaClass::Text, "text"),
            (RestObservedMediaClass::Unsupported, "unsupported"),
            (RestObservedMediaClass::Unknown, "unknown"),
        ] {
            assert_eq!(rest_observed_media(media), token);
        }
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn assessment_confirmed_linkage_fails_closed_when_incomplete_or_mismatched() {
        let mut missing_outcome = complete_assessment_document();
        missing_outcome.items[2].outcome_reference = None;
        let mut downgraded_basis = complete_assessment_document();
        downgraded_basis.items[2].claim_basis = "observation";
        let mut cross_basis_evidence = complete_assessment_document();
        cross_basis_evidence.items[1].candidate_evidence_references =
            vec!["evidence-0001".to_owned()];
        for document in [missing_outcome, downgraded_basis, cross_basis_evidence] {
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&document, *format, usize::MAX),
                    Err(ReportError::Serialization)
                );
            }
        }
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn assessment_renderers_escape_controls_bidi_html_markdown_and_csv_formulae() {
        const HOSTILE: &str = " \t=2+3,<script>alert(`x`)</script>&'\u{202E}\n# injected";
        let document = observation_assessment_document(HOSTILE);

        let json = render_assessment_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        assert!(!json.contains('\t'));
        assert!(!json.contains('\u{202E}'));
        assert!(!json.contains('\n'));
        assert!(json.contains("\\u202E"));
        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert_eq!(parsed["items"][0]["title"], HOSTILE);

        let html = render_assessment_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        assert!(!html.contains("<script>"));
        assert!(!html.contains('\u{202E}'));
        assert!(html.contains("&lt;script&gt;"));
        assert!(html.contains("\\u{202E}\\u{000A}"));

        let markdown =
            render_assessment_with_limit(&document, ReportFormat::Markdown, usize::MAX).unwrap();
        assert!(!markdown.contains("\n# injected"));
        assert!(!markdown.contains('\u{202E}'));
        assert!(markdown.contains("\\u{202E}\\u{000A}# injected"));

        let csv = render_assessment_with_limit(&document, ReportFormat::Csv, usize::MAX).unwrap();
        assert!(!csv.contains('\t'));
        assert!(!csv.contains('\u{202E}'));
        assert!(!csv.contains("\n# injected"));
        assert!(csv.contains("' \\u{0009}=2+3"));
        let rows: Vec<Vec<String>> = csv.lines().map(parse_csv_line).collect();
        assert_eq!(rows[0].len(), ASSESSMENT_CSV_HEADERS.len());
        assert!(rows
            .iter()
            .all(|row| row.len() == ASSESSMENT_CSV_HEADERS.len()));
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn assessment_output_ceiling_is_shared_byte_exact_and_returns_no_partial_document() {
        let document = complete_assessment_document();
        for format in ReportGenerator::available_formats() {
            let rendered = render_assessment_with_limit(&document, *format, usize::MAX).unwrap();
            assert_eq!(
                render_assessment_with_limit(&document, *format, rendered.len()).unwrap(),
                rendered
            );
            assert_eq!(
                render_assessment_with_limit(&document, *format, rendered.len() - 1),
                Err(ReportError::OutputLimitExceeded {
                    limit: rendered.len() - 1
                })
            );
        }

        let oversized = "x".repeat(MAX_RENDERED_REPORT_BYTES + 1);
        let document = observation_assessment_document(&oversized);
        assert_eq!(
            render_assessment_with_limit(
                &document,
                ReportFormat::Markdown,
                MAX_RENDERED_REPORT_BYTES
            ),
            Err(ReportError::OutputLimitExceeded {
                limit: MAX_RENDERED_REPORT_BYTES
            })
        );
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn assessment_documents_never_emit_secret_or_raw_runtime_sentinels() {
        let document = complete_assessment_document();
        for format in ReportGenerator::available_formats() {
            let rendered = render_assessment_with_limit(&document, *format, usize::MAX).unwrap();
            for sentinel in [
                "Bearer secret-sentinel",
                "session=secret-sentinel",
                "cookie-value-sentinel",
                "csrf-value-sentinel",
                "https://private.example.test/secret/path",
                "raw-response-body-sentinel",
                "private-evidence-id-sentinel",
                "private-case-id-sentinel",
                "private-outcome-id-sentinel",
                "private-verifier-id-sentinel",
            ] {
                assert!(!rendered.contains(sentinel));
            }
        }
    }

    #[cfg(feature = "scanning")]
    #[test]
    fn assessment_presentation_target_rejects_unclosed_or_location_bearing_values() {
        for invalid in [
            "",
            "subject",
            "query_parameter:return_to",
            "https://private.example.test/secret/path",
        ] {
            let mut document = complete_assessment_document();
            document.items[0].presentation_target = invalid;
            for format in ReportGenerator::available_formats() {
                assert_eq!(
                    render_assessment_with_limit(&document, *format, usize::MAX),
                    Err(ReportError::Serialization)
                );
            }
        }
    }

    #[test]
    fn public_format_metadata_and_order_are_stable() {
        assert_eq!(
            ReportGenerator::available_formats(),
            &[
                ReportFormat::Json,
                ReportFormat::Csv,
                ReportFormat::Html,
                ReportFormat::Markdown,
            ]
        );
        let metadata = [
            (ReportFormat::Json, "json", "application/json", "json"),
            (ReportFormat::Csv, "csv", "text/csv; charset=utf-8", "csv"),
            (
                ReportFormat::Html,
                "html",
                "text/html; charset=utf-8",
                "html",
            ),
            (
                ReportFormat::Markdown,
                "markdown",
                "text/markdown; charset=utf-8",
                "md",
            ),
        ];
        for (format, name, media_type, extension) in metadata {
            assert_eq!(format.as_str(), name);
            assert_eq!(format.media_type(), media_type);
            assert_eq!(format.extension(), extension);
        }
    }

    #[test]
    fn lifecycle_statuses_and_stop_codes_render_in_every_format() {
        let cases = [
            (
                RunStatus::Complete,
                RunStopCode::Completed,
                RunStepStatus::Succeeded,
                "complete",
                "completed",
            ),
            (
                RunStatus::Partial,
                RunStopCode::StepFailed,
                RunStepStatus::Failed,
                "partial",
                "step_failed",
            ),
            (
                RunStatus::Cancelled,
                RunStopCode::Cancelled,
                RunStepStatus::Cancelled,
                "cancelled",
                "cancelled",
            ),
            (
                RunStatus::Failed,
                RunStopCode::RuntimeFailed,
                RunStepStatus::Failed,
                "failed",
                "runtime_failed",
            ),
        ];
        for (status, stop_code, step_status, status_token, stop_token) in cases {
            let steps = vec![RunStepReport::new(1, "scan.observe", step_status, 1, None).unwrap()];
            let report = report_for_status(status, stop_code, steps, "target", "summary");
            for format in ReportGenerator::available_formats() {
                let rendered = ReportGenerator::generate(&report, *format).unwrap();
                assert!(rendered.contains(status_token));
                assert!(rendered.contains(stop_token));
            }
        }
    }

    #[test]
    fn non_complete_lifecycle_is_prominent_in_human_formats() {
        let report = report_for_status(
            RunStatus::Partial,
            RunStopCode::StepFailed,
            vec![RunStepReport::new(1, "scan.observe", RunStepStatus::Failed, 1, None).unwrap()],
            "target",
            "summary",
        );
        let html = ReportGenerator::generate(&report, ReportFormat::Html).unwrap();
        assert!(
            html.contains("<aside class=\"lifecycle\">") && html.contains("Run did not complete")
        );
        let markdown = ReportGenerator::generate(&report, ReportFormat::Markdown).unwrap();
        assert!(markdown.contains("> **Lifecycle notice:** This run did not complete."));
    }

    #[test]
    fn json_projection_has_exact_metadata_and_minimized_outcome_shape() {
        let report = complete_report("https://example.test/path", "redacted summary");
        let rendered = ReportGenerator::generate(&report, ReportFormat::Json).unwrap();
        let value: serde_json::Value = serde_json::from_str(&rendered).unwrap();
        assert_eq!(value["schema"], REPORT_DOCUMENT_SCHEMA);
        assert_eq!(value["source_schema"], termivar_core::RUN_REPORT_SCHEMA);
        assert_eq!(value["status"], "complete");
        assert_eq!(value["stop_code"], "completed");
        assert_eq!(value["target"], "https://example.test/path");
        assert_eq!(value["authorized_origin"], "https://example.test");
        assert_eq!(value["started_at"], "2026-08-20T10:00:00+00:00");
        assert_eq!(value["completed_at"], "2026-08-20T10:00:01+00:00");
        assert_eq!(
            value["accounting"]["requests"],
            serde_json::json!({"mode":"metered","limit":"10","consumed":"4","remaining":"6"})
        );
        assert_eq!(
            value["steps"][0],
            serde_json::json!({
                "ordinal":1,
                "action_id":"scan.observe",
                "status":"succeeded",
                "duration_ms":"25"
            })
        );
        assert_eq!(
            value["outcomes"][0],
            serde_json::json!({
                "kind":"verification_outcome",
                "action_id":"scan.observe",
                "severity":"info",
                "disposition":"success",
                "confidence_ppm":812345,
                "evidence_count":1,
                "redacted_summary":"redacted summary"
            })
        );
    }

    #[test]
    fn unresolved_observation_kind_is_distinct() {
        let unresolved = RunOutcomeRecord::unresolved(
            EntityId::new(PRIVATE_SUBJECT).unwrap(),
            "scan.observe",
            PRIVATE_RATIONALE,
            "summary",
        )
        .unwrap();
        let input = RunReportInput::new(
            RunStatus::Complete,
            RunStopReason::new(RunStopCode::Completed, "done").unwrap(),
            "target",
            "origin",
            "2026-08-20T10:00:00Z".parse().unwrap(),
            "2026-08-20T10:00:01Z".parse().unwrap(),
        )
        .unwrap()
        .with_steps(vec![RunStepReport::new(
            1,
            "scan.observe",
            RunStepStatus::Succeeded,
            1,
            None,
        )
        .unwrap()])
        .with_outcomes(vec![unresolved]);
        let report = RunReport::new(input).unwrap();
        let rendered = ReportGenerator::generate(&report, ReportFormat::Json).unwrap();
        let value: serde_json::Value = serde_json::from_str(&rendered).unwrap();
        assert_eq!(value["outcomes"][0]["kind"], "unresolved_observation");
        assert_eq!(value["outcomes"][0]["confidence_ppm"], 0);
        assert_eq!(value["outcomes"][0]["evidence_count"], 0);
    }

    #[test]
    fn private_source_fields_never_cross_any_renderer() {
        let report = complete_report("target", "public redacted summary");
        let source_fingerprint = report.outcomes()[0].fingerprint().to_owned();
        let forbidden = [
            PRIVATE_SUBJECT,
            PRIVATE_EVIDENCE,
            PRIVATE_RATIONALE,
            PRIVATE_CASE,
            PRIVATE_RULE,
            PRIVATE_HYPOTHESIS,
            PRIVATE_STEP_DETAIL,
            "private-stop-detail-sentinel",
            "evidence_ids",
            "rationale",
        ];
        for format in ReportGenerator::available_formats() {
            let rendered = ReportGenerator::generate(&report, *format).unwrap();
            assert!(!rendered.contains(&source_fingerprint));
            assert!(!rendered.to_ascii_lowercase().contains("fingerprint"));
            for sentinel in forbidden {
                assert!(!rendered.contains(sentinel));
            }
        }
    }

    #[test]
    fn html_is_self_contained_csp_guarded_and_contextually_escaped() {
        let hostile = "<script>alert(\"x\")</script>&'\u{202E}\n";
        let report = complete_report(hostile, hostile);
        let html = ReportGenerator::generate(&report, ReportFormat::Html).unwrap();
        assert!(html.starts_with("<!doctype html>"));
        assert!(html.contains("default-src 'none'"));
        assert!(html.contains("style-src 'unsafe-inline'"));
        assert!(!html.contains("<script>"));
        assert!(!html.contains("src=\"http"));
        assert!(!html.contains("href="));
        assert!(html.contains("&lt;script&gt;"));
        assert!(html.contains("&quot;x&quot;"));
        assert!(html.contains("&amp;&#39;\\u{202E}\\u{000A}"));
    }

    #[test]
    fn markdown_uses_dynamic_code_spans_for_all_untrusted_text() {
        let hostile = "`` </code> [link](https://attacker.test) ![image](x)\n# injected";
        let report = complete_report(hostile, hostile);
        let markdown = ReportGenerator::generate(&report, ReportFormat::Markdown).unwrap();
        assert!(markdown.contains(
            "``` `` </code> [link](https://attacker.test) ![image](x)\\u{000A}# injected ```"
        ));
        assert!(!markdown.contains("\n# injected"));
        assert!(!markdown.lines().any(|line| line.starts_with('<')));
    }

    #[test]
    fn csv_quotes_every_cell_neutralizes_formulas_and_visualizes_controls() {
        let hostile = " \t=2+3,\"quoted\"\u{202E}\nnext";
        let report = complete_report(hostile, hostile);
        let csv = ReportGenerator::generate(&report, ReportFormat::Csv).unwrap();
        for line in csv.lines() {
            assert!(line.starts_with('"'));
            assert!(line.ends_with('"'));
        }
        assert!(csv.contains("\"' \\u{0009}=2+3,\"\"quoted\"\"\\u{202E}\\u{000A}next\""));
        assert!(!csv.contains('\t'));
        assert!(!csv.contains('\u{202E}'));
        assert!(!csv.contains("\nnext"));
        for prefix in ['=', '+', '-', '@'] {
            let value = format!(" \t{prefix}payload");
            let mut output = RenderBuffer::new(1_024);
            write_csv_cell(&mut output, &value).unwrap();
            assert!(output.finish().starts_with("\"' \\u{0009}"));
        }
    }

    #[test]
    fn csv_rows_match_header_width_and_step_named_columns() {
        let report = complete_report("target,\"quoted\"", "summary,\"quoted\"");
        let csv = ReportGenerator::generate(&report, ReportFormat::Csv).unwrap();
        let rows: Vec<Vec<String>> = csv.lines().map(parse_csv_line).collect();
        let headers = &rows[0];
        assert_eq!(headers.len(), CSV_HEADERS.len());
        for row in &rows[1..] {
            assert_eq!(row.len(), headers.len(), "CSV row width drifted: {row:?}");
        }

        let column = |name: &str| headers.iter().position(|header| header == name).unwrap();
        let step = rows
            .iter()
            .find(|row| row[column("record_type")] == "step")
            .unwrap();
        assert_eq!(step[column("action_id")], "scan.observe");
        assert_eq!(step[column("duration_ms")], "25");
        assert_eq!(step[column("status_or_disposition")], "succeeded");
        assert_eq!(step[column("severity")], "");
        assert_eq!(step[column("redacted_summary")], "");
    }

    #[test]
    fn visible_encodings_are_injective_for_markers_backslashes_and_bidi() {
        let render_csv_cell = |value: &str| {
            let mut output = RenderBuffer::new(1_024);
            write_csv_cell(&mut output, value).unwrap();
            output.finish()
        };
        let formula = render_csv_cell("=1+1");
        let literal_apostrophe = render_csv_cell("'=1+1");
        assert_eq!(formula, "\"'=1+1\"");
        assert_eq!(literal_apostrophe, "\"\\u{0027}=1+1\"");
        assert_ne!(formula, literal_apostrophe);

        let actual_bidi_csv = render_csv_cell("\u{202E}");
        let literal_bidi_csv = render_csv_cell("\\u{202E}");
        assert_eq!(actual_bidi_csv, "\"\\u{202E}\"");
        assert_eq!(literal_bidi_csv, "\"\\\\u{202E}\"");
        assert_ne!(actual_bidi_csv, literal_bidi_csv);

        let render_html_text = |value: &str| {
            let mut output = RenderBuffer::new(1_024);
            write_html_text(&mut output, value).unwrap();
            output.finish()
        };
        assert_eq!(render_html_text("\u{202E}"), "\\u{202E}");
        assert_eq!(render_html_text("\\u{202E}"), "\\\\u{202E}");

        assert_eq!(visible_text("\u{202E}"), "\\u{202E}");
        assert_eq!(visible_text("\\u{202E}"), "\\\\u{202E}");
    }

    #[test]
    fn json_escapes_bidi_and_c1_controls_with_parsed_semantics_unchanged() {
        let payload = "actual:\u{202E}:c1:\u{0085}:literal:\\u{202E}";
        let report = complete_report(payload, payload);
        let document = ReportDocument::from_report(&report).unwrap();
        let raw = serde_json::to_string(&document).unwrap();
        let rendered = render_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();

        assert!(rendered.len() > raw.len());
        assert!(!rendered.contains('\u{202E}'));
        assert!(!rendered.contains('\u{0085}'));
        assert!(rendered.contains("\\u202E"));
        assert!(rendered.contains("\\u0085"));

        let parsed: serde_json::Value = serde_json::from_str(&rendered).unwrap();
        assert_eq!(parsed["target"], payload);
        assert_eq!(parsed["outcomes"][0]["redacted_summary"], payload);
        assert_eq!(
            render_with_limit(&document, ReportFormat::Json, rendered.len()).unwrap(),
            rendered
        );
        assert_eq!(
            render_with_limit(&document, ReportFormat::Json, rendered.len() - 1),
            Err(ReportError::OutputLimitExceeded {
                limit: rendered.len() - 1
            })
        );
    }

    #[test]
    fn maximum_u64_values_are_decimal_strings_and_deterministic() {
        let report = maximum_accounting_report();
        let maximum = u64::MAX.to_string();
        let json = ReportGenerator::generate(&report, ReportFormat::Json).unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert_eq!(value["accounting"]["requests"]["limit"], maximum);
        assert_eq!(value["accounting"]["requests"]["consumed"], maximum);
        assert_eq!(
            value["accounting"]["response_body_bytes"]["consumed"],
            maximum
        );
        assert_eq!(
            value["accounting"]["request_body_bytes"]["remaining"],
            maximum
        );
        assert_eq!(value["steps"][0]["duration_ms"], maximum);
        assert!(value["steps"][0]["duration_ms"].is_string());

        for format in ReportGenerator::available_formats() {
            let first = ReportGenerator::generate(&report, *format).unwrap();
            let second = ReportGenerator::generate(&report, *format).unwrap();
            assert_eq!(first, second);
            assert!(first.contains(&maximum));
        }
    }

    #[test]
    fn markdown_empty_and_all_space_code_spans_are_unambiguous() {
        let render = |value: &str| {
            let mut output = RenderBuffer::new(1_024);
            write_markdown_code_span(&mut output, value).unwrap();
            output.finish()
        };
        assert_eq!(render(""), "`\\u{EMPTY}`");
        assert_eq!(render(" "), "` `");
        assert_eq!(render("   "), "`   `");
        assert_eq!(render("\\u{EMPTY}"), "`\\\\u{EMPTY}`");
        assert_ne!(render(""), render("\\u{EMPTY}"));
    }

    #[test]
    fn output_limit_is_applied_after_escape_expansion_without_partial_return() {
        let report = complete_report("<&", "summary");
        let document = ReportDocument::from_report(&report).unwrap();
        let full_html = render_with_limit(&document, ReportFormat::Html, usize::MAX).unwrap();
        let exact = render_with_limit(&document, ReportFormat::Html, full_html.len()).unwrap();
        assert_eq!(exact, full_html);
        assert_eq!(
            render_with_limit(&document, ReportFormat::Html, full_html.len() - 1),
            Err(ReportError::OutputLimitExceeded {
                limit: full_html.len() - 1
            })
        );

        let escaped_target_offset = full_html.find("&lt;&amp;").unwrap();
        let raw_boundary = escaped_target_offset + "<&".len();
        assert_eq!(
            render_with_limit(&document, ReportFormat::Html, raw_boundary),
            Err(ReportError::OutputLimitExceeded {
                limit: raw_boundary
            })
        );
    }

    #[test]
    fn json_cap_and_utf8_boundaries_are_byte_exact() {
        let report = complete_report("é", "雪");
        let document = ReportDocument::from_report(&report).unwrap();
        let full = render_with_limit(&document, ReportFormat::Json, usize::MAX).unwrap();
        assert!(full.chars().count() < full.len());
        assert!(full.contains("é"));
        assert!(full.contains("雪"));
        assert_eq!(
            render_with_limit(&document, ReportFormat::Json, full.len() - 1),
            Err(ReportError::OutputLimitExceeded {
                limit: full.len() - 1
            })
        );
        assert_eq!(
            render_with_limit(&document, ReportFormat::Json, full.len()).unwrap(),
            full
        );
    }

    #[test]
    fn every_format_is_byte_deterministic_with_stable_envelopes() {
        let report = complete_report("target", "summary");
        let document = ReportDocument::from_report(&report).unwrap();
        for format in ReportGenerator::available_formats() {
            let first = ReportGenerator::generate(&report, *format).unwrap();
            let second = ReportGenerator::generate(&report, *format).unwrap();
            assert_eq!(first.as_bytes(), second.as_bytes());
            assert!(first.len() <= MAX_RENDERED_REPORT_BYTES);
            assert_eq!(
                render_with_limit(&document, *format, first.len()).unwrap(),
                first
            );
            assert_eq!(
                render_with_limit(&document, *format, first.len() - 1),
                Err(ReportError::OutputLimitExceeded {
                    limit: first.len() - 1
                })
            );
        }
        let json = ReportGenerator::generate(&report, ReportFormat::Json).unwrap();
        assert!(json.starts_with(
            "{\"schema\":\"venom-rendered-run/v1\",\"source_schema\":\"venom-run/v1\""
        ));
        let csv = ReportGenerator::generate(&report, ReportFormat::Csv).unwrap();
        assert!(csv.starts_with("\"record_type\",\"name\",\"value\""));
        let markdown = ReportGenerator::generate(&report, ReportFormat::Markdown).unwrap();
        assert!(markdown.starts_with("# Termivar run report\n\n- Schema: `venom-rendered-run/v1`"));
    }

    #[test]
    fn error_display_is_opaque_and_bounded() {
        let limit = ReportError::OutputLimitExceeded { limit: 7 }.to_string();
        let serialization = ReportError::Serialization.to_string();
        assert_eq!(limit, "rendered report exceeds the output byte limit");
        assert_eq!(serialization, "rendered report serialization failed");
        assert!(limit.len() < 80);
        assert!(serialization.len() < 80);
        assert!(!limit.contains('7'));
    }
}