$ErrorActionPreference = 'Stop'

$root = Split-Path -Parent $PSScriptRoot
$document = Get-Content -Raw -Encoding UTF8 -LiteralPath (Join-Path $root 'APP.openapi.json') | ConvertFrom-Json
$issues = New-Object System.Collections.Generic.List[string]

$operations = @(
  [pscustomobject]@{ Path = '/genealogy/app/genealogies/public'; Method = 'get'; Id = 'appSearchPublicGenealogies'; Responses = @('200','400','401','429','500'); SuccessRef = '#/components/schemas/RGenealogySearchCursorPage'; Parameters = @('header:clientid','query:cursor','query:keyword','query:limit') },
  [pscustomobject]@{ Path = '/genealogy/app/genealogies/{genealogyId}/join-applies'; Method = 'post'; Id = 'appCreateGenealogyJoinApplication'; Responses = @('200','400','401','403','404','409','422','429','500'); SuccessRef = '#/components/schemas/RGenealogyJoinApplicationReceipt'; Parameters = @('header:Idempotency-Key','header:clientid','path:genealogyId') },
  [pscustomobject]@{ Path = '/genealogy/app/genealogies/join-apply-requests/{requestKey}'; Method = 'get'; Id = 'appGetGenealogyJoinApplicationRequest'; Responses = @('200','400','401','404','429','500'); SuccessRef = '#/components/schemas/RGenealogyJoinApplicationRequestStatus'; Parameters = @('header:clientid','path:requestKey') },
  [pscustomobject]@{ Path = '/genealogy/app/genealogies/join-applies/mine'; Method = 'get'; Id = 'appListMyGenealogyJoinApplications'; Responses = @('200','400','401','429','500'); SuccessRef = '#/components/schemas/RMyGenealogyJoinApplicationCursorPage'; Parameters = @('header:clientid','query:cursor','query:limit') },
  [pscustomobject]@{ Path = '/genealogy/app/genealogies/join-applies/{applyId}'; Method = 'delete'; Id = 'appWithdrawGenealogyJoinApplication'; Responses = @('200','400','401','404','409','429','500'); SuccessRef = '#/components/schemas/RWithdrawnGenealogyJoinApplicationReceipt'; Parameters = @('header:clientid','path:applyId') },
  [pscustomobject]@{ Path = '/genealogy/app/genealogies/{genealogyId}/join-applies/pending'; Method = 'get'; Id = 'appListPendingGenealogyJoinApplications'; Responses = @('200','400','401','403','404','429','500'); SuccessRef = '#/components/schemas/RPendingGenealogyJoinApplicationCursorPage'; Parameters = @('header:clientid','path:genealogyId','query:cursor','query:limit') },
  [pscustomobject]@{ Path = '/genealogy/app/genealogies/{genealogyId}/join-applies/{applyId}/audit'; Method = 'put'; Id = 'appReviewGenealogyJoinApplication'; Responses = @('200','400','401','403','404','409','422','429','500'); SuccessRef = '#/components/schemas/RReviewedGenealogyJoinApplicationReceipt'; Parameters = @('header:clientid','path:applyId','path:genealogyId') }
)

function Add-Issue([string]$Message) { $script:issues.Add($Message) }

function Test-JsonBoolean([object]$Value, [bool]$Expected) {
  return $Value -is [System.Boolean] -and $Value -eq $Expected
}

function Test-IsJsonArray([object]$Value) {
  return $null -ne $Value -and $Value.GetType().IsArray
}

function Get-LocalComponentName([string]$Ref, [string]$Section, [string]$Label) {
  $pattern = '^#/components/' + [regex]::Escape($Section) + '/(?<name>[^/]+)$'
  $match = [regex]::Match($Ref, $pattern)
  if (-not $match.Success) {
    Add-Issue "$Label must use an exact local #/components/$Section/... ref; actual: $Ref"
    return ''
  }
  return $match.Groups['name'].Value
}

function Test-IsNonNullable([object]$Schema) {
  if (-not $Schema) { return $false }
  $nullable = $Schema.PSObject.Properties['nullable']
  return -not $nullable -or (Test-JsonBoolean $nullable.Value $false)
}

function Assert-NoConflictingSchemaKeywords([object]$Schema, [string]$Label, [string[]]$Allowed = @()) {
  if (-not $Schema) { return }
  foreach ($keyword in @('not', 'allOf', 'anyOf', 'oneOf', 'const', 'enum')) {
    if ($keyword -notin $Allowed -and $Schema.PSObject.Properties[$keyword]) {
      Add-Issue "$Label must not define conflicting schema keyword: $keyword"
    }
  }
}

function Assert-AllowedSchemaKeywords([object]$Schema, [string]$Label, [string[]]$Allowed) {
  if (-not $Schema) { return }
  $annotations = @('title', 'description', 'example', 'examples', 'deprecated')
  foreach ($property in @($Schema.PSObject.Properties)) {
    if ($property.Name -like 'x-*' -or $property.Name -in $annotations -or $property.Name -in $Allowed) { continue }
    Add-Issue "$Label contains an unowned schema keyword: $($property.Name)"
  }
}

function Test-IsPureComponentRef([object]$Value, [string]$ExpectedRef, [string]$Section, [string]$Label) {
  if (-not $Value) { return $false }
  $properties = @($Value.PSObject.Properties.Name)
  $actualRef = [string]$Value.'$ref'
  if ($properties.Count -ne 1 -or $properties[0] -cne '$ref' -or $actualRef -cne $ExpectedRef) {
    Add-Issue "$Label must be the sole exact local ref $ExpectedRef; actual: $actualRef"
    return $false
  }
  [void](Get-LocalComponentName $actualRef $Section $Label)
  return $true
}

function Test-IsExactReferenceObjectRef([object]$Value, [string]$ExpectedRef, [string]$Section, [string]$Label) {
  if (-not $Value) { return $false }
  $actualRef = [string]$Value.'$ref'
  $semanticSiblings = @($Value.PSObject.Properties.Name | Where-Object { $_ -notin @('$ref', 'summary', 'description') })
  if ($actualRef -cne $ExpectedRef -or $semanticSiblings.Count -gt 0) {
    Add-Issue "$Label must use exact local ref $ExpectedRef with only harmless summary/description siblings; actual: $actualRef; semantic siblings: $($semanticSiblings -join ',')"
    return $false
  }
  [void](Get-LocalComponentName $actualRef $Section $Label)
  return $true
}

function Test-IsPureSchemaRef([object]$Schema, [string]$ExpectedRef, [string]$Label) {
  return Test-IsPureComponentRef $Schema $ExpectedRef 'schemas' $Label
}

function Get-Schema([string]$Name) {
  $property = $document.components.schemas.PSObject.Properties[$Name]
  if (-not $property) { Add-Issue "missing schema owner: $Name"; return $null }
  return $property.Value
}

function Get-Operation([string]$Path, [string]$Method) {
  $pathProperty = $document.paths.PSObject.Properties[$Path]
  $operation = if ($pathProperty) { $pathProperty.Value.PSObject.Properties[$Method] } else { $null }
  if (-not $operation) { Add-Issue "missing $($Method.ToUpperInvariant()) $Path"; return $null }
  return $operation.Value
}

function Get-Parameters([string]$Path, [object]$Operation) {
  if (-not $Operation) { return @() }
  $pathItem = $document.paths.PSObject.Properties[$Path].Value
  $byIdentity = [ordered]@{}
  foreach ($scope in @(@($pathItem.parameters), @($Operation.parameters))) {
    $scopeIdentities = @{}
    foreach ($parameter in $scope) {
      if (-not $parameter) { continue }
      $resolved = $parameter
      if ($parameter.'$ref') {
        $name = Get-LocalComponentName ([string]$parameter.'$ref') 'parameters' "$Path parameter"
        if (-not $name) { continue }
        $parameterRefSiblings = @($parameter.PSObject.Properties.Name | Where-Object { $_ -notin @('$ref', 'summary', 'description') })
        if ($parameterRefSiblings.Count -gt 0) {
          Add-Issue "$Path parameter ref contains semantic sibling keywords: $($parameterRefSiblings -join ',')"
        }
        $owner = $document.components.parameters.PSObject.Properties[$name]
        if (-not $owner) { Add-Issue "missing parameter owner: $name"; continue }
        $resolved = $owner.Value
      }
      $identity = "$($resolved.in):$($resolved.name)".ToLowerInvariant()
      if ($scopeIdentities.ContainsKey($identity)) { Add-Issue "$Path contains duplicate parameter in one scope: $identity"; continue }
      $scopeIdentities[$identity] = $true
      $byIdentity[$identity] = $resolved
    }
  }
  return @($byIdentity.Values)
}

function Get-Parameter([string]$Path, [object]$Operation, [string]$In, [string]$Name) {
  $matches = @(Get-Parameters $Path $Operation | Where-Object { $_.in -eq $In -and $_.name -eq $Name })
  if ($matches.Count -ne 1) { Add-Issue "$($Operation.operationId) must define exactly one ${In}:${Name}"; return $null }
  return $matches[0]
}

function Assert-ClosedObject([object]$Schema, [string]$Name, [string[]]$Fields, [string[]]$Required) {
  if (-not $Schema) { return }
  $actualFields = @($Schema.properties.PSObject.Properties.Name | Sort-Object)
  $actualRequired = @($Schema.required | Sort-Object)
  if ($Schema.type -ne 'object' -or -not (Test-IsNonNullable $Schema) -or
      -not (Test-JsonBoolean $Schema.additionalProperties $false) -or
      ($actualFields -join ',') -ne ((@($Fields | Sort-Object)) -join ',') -or
      ($actualRequired -join ',') -ne ((@($Required | Sort-Object)) -join ',')) {
    Add-Issue "$Name must be closed; fields=$($Fields -join ','); required=$($Required -join ',')"
  }
  Assert-NoConflictingSchemaKeywords $Schema $Name
  Assert-AllowedSchemaKeywords $Schema $Name @('type', 'properties', 'required', 'additionalProperties', 'nullable')
}

function Assert-StringOwner([string]$Name, [int]$Min, [int]$Max, [string]$Pattern = '') {
  $schema = Get-Schema $Name
  if (-not $schema) { return }
  if ($schema.type -ne 'string' -or -not (Test-IsNonNullable $schema) -or [int]$schema.minLength -ne $Min -or [int]$schema.maxLength -ne $Max) {
    Add-Issue "$Name must be a non-null string length $Min..$Max"
  }
  if ($Pattern -and [string]$schema.pattern -ne $Pattern) { Add-Issue "$Name pattern drifted" }
  Assert-NoConflictingSchemaKeywords $schema $Name
  Assert-AllowedSchemaKeywords $schema $Name @('type', 'minLength', 'maxLength', 'pattern', 'nullable')
}

function Assert-PropertyRef([object]$Schema, [string]$Name, [string]$Field, [string]$Ref) {
  if (-not $Schema) { return }
  $property = $Schema.properties.PSObject.Properties[$Field]
  if (-not $property) { Add-Issue "$Name.$Field must use $Ref"; return }
  [void](Test-IsPureSchemaRef $property.Value $Ref "$Name.$Field")
}

function Assert-Union([object]$Schema, [string]$Name, [string]$Discriminator, [hashtable]$Mapping) {
  if (-not $Schema) { return }
  $expectedRefs = @($Mapping.Values | Sort-Object -Unique)
  $actualRefs = @($Schema.oneOf | ForEach-Object { [string]$_.'$ref' } | Sort-Object)
  $actualKeys = @($Schema.discriminator.mapping.PSObject.Properties.Name | Sort-Object)
  $expectedKeys = @($Mapping.Keys | Sort-Object)
  if ($Schema.discriminator.propertyName -ne $Discriminator) { Add-Issue "$Name discriminator property must be $Discriminator" }
  if (($actualRefs -join ',') -ne ($expectedRefs -join ',') -or ($actualKeys -join ',') -ne ($expectedKeys -join ',')) { Add-Issue "$Name oneOf/mapping branches drifted" }
  foreach ($key in $expectedKeys) {
    if ([string]$Schema.discriminator.mapping.$key -ne [string]$Mapping[$key]) { Add-Issue "$Name mapping $key drifted" }
  }
  foreach ($branch in @($Schema.oneOf)) {
    $branchRef = [string]$branch.'$ref'
    if ($branchRef -notin $expectedRefs) {
      Add-Issue "$Name contains an unexpected oneOf branch: $branchRef"
    } else {
      [void](Test-IsPureSchemaRef $branch $branchRef "$Name oneOf branch")
    }
  }
  Assert-AllowedSchemaKeywords $Schema $Name @('oneOf', 'discriminator')
  if ($Schema.discriminator -and
      (@($Schema.discriminator.PSObject.Properties.Name | Sort-Object) -join ',') -cne 'mapping,propertyName') {
    Add-Issue "$Name discriminator must contain only mapping and propertyName"
  }
}

function Assert-SingleEnum([object]$Schema, [string]$Name, [string]$Field, [string]$Value) {
  if (-not $Schema) { return }
  $property = $Schema.properties.PSObject.Properties[$Field]
  if (-not $property -or $property.Value.type -ne 'string' -or -not (Test-IsNonNullable $property.Value) -or -not (Test-IsJsonArray $property.Value.enum) -or @($property.Value.enum).Count -ne 1 -or $property.Value.enum[0] -ne $Value) { Add-Issue "$Name.$Field must be the single non-null value $Value" }
  if ($property) { Assert-NoConflictingSchemaKeywords $property.Value "$Name.$Field" @('enum') }
  if ($property) { Assert-AllowedSchemaKeywords $property.Value "$Name.$Field" @('type', 'enum', 'nullable') }
}

function Assert-RequestBody([object]$Operation, [string]$Label, [string]$Ref) {
  if (-not $Operation) { return }
  $content = $Operation.requestBody.content
  $media = if ($content) { $content.PSObject.Properties['application/json'] } else { $null }
  if (-not (Test-JsonBoolean $Operation.requestBody.required $true) -or -not $media -or $content.PSObject.Properties.Count -ne 1) {
    Add-Issue "$Label must require only application/json with $Ref"
  } elseif ($media) {
    [void](Test-IsPureSchemaRef $media.Value.schema $Ref "$Label request schema")
  }
}

function Assert-PathId([string]$Path, [object]$Operation, [string]$Name, [string]$Ref) {
  if (-not $Operation) { return }
  $parameter = Get-Parameter $Path $Operation 'path' $Name
  if ($parameter) {
    if (-not (Test-JsonBoolean $parameter.required $true)) { Add-Issue "$($Operation.operationId) $Name must be required" }
    [void](Test-IsPureSchemaRef $parameter.schema $Ref "$($Operation.operationId) $Name")
  }
}

function Assert-Envelope([string]$Name, [string]$DataRef) {
  $schema = Get-Schema $Name
  Assert-ClosedObject $schema $Name @('code','data') @('code','data')
  if (-not $schema) { return }
  if ($schema.properties.code.type -ne 'integer' -or -not (Test-IsNonNullable $schema.properties.code) -or -not (Test-IsJsonArray $schema.properties.code.enum) -or @($schema.properties.code.enum).Count -ne 1 -or $schema.properties.code.enum[0] -ne 200) { Add-Issue "$Name.code must be non-null integer enum [200]" }
  Assert-NoConflictingSchemaKeywords $schema.properties.code "$Name.code" @('enum')
  Assert-AllowedSchemaKeywords $schema.properties.code "$Name.code" @('type', 'enum', 'nullable')
  Assert-PropertyRef $schema $Name 'data' $DataRef
}

function Assert-ErrorEnvelope([string]$Name, [int]$Status, [string[]]$BusinessCodes, [bool]$HasCurrent = $false) {
  $schema = Get-Schema $Name
  $fields = if ($HasCurrent) { @('code','businessCode','current') } else { @('code','businessCode') }
  Assert-ClosedObject $schema $Name $fields $fields
  if (-not $schema) { return }
  if ($schema.properties.code.type -ne 'integer' -or -not (Test-IsNonNullable $schema.properties.code) -or -not (Test-IsJsonArray $schema.properties.code.enum) -or @($schema.properties.code.enum).Count -ne 1 -or $schema.properties.code.enum[0] -ne $Status) { Add-Issue "$Name.code must be non-null integer enum [$Status]" }
  $actualCodes = @($schema.properties.businessCode.enum | Sort-Object)
  if ($schema.properties.businessCode.type -ne 'string' -or -not (Test-IsNonNullable $schema.properties.businessCode) -or -not (Test-IsJsonArray $schema.properties.businessCode.enum) -or ($actualCodes -join ',') -ne ((@($BusinessCodes | Sort-Object)) -join ',')) { Add-Issue "$Name.businessCode enum drifted" }
  Assert-NoConflictingSchemaKeywords $schema.properties.code "$Name.code" @('enum')
  Assert-NoConflictingSchemaKeywords $schema.properties.businessCode "$Name.businessCode" @('enum')
  Assert-AllowedSchemaKeywords $schema.properties.code "$Name.code" @('type', 'enum', 'nullable')
  Assert-AllowedSchemaKeywords $schema.properties.businessCode "$Name.businessCode" @('type', 'enum', 'nullable')
  if ($HasCurrent) { Assert-PropertyRef $schema $Name 'current' '#/components/schemas/GenealogyJoinApplicationCurrentState' }
}

function Resolve-Response([object]$Response, [string]$Label = 'response') {
  if (-not $Response) { return $null }
  if ($Response.'$ref') {
    $name = Get-LocalComponentName ([string]$Response.'$ref') 'responses' $Label
    if (-not $name) { return $null }
    $responseRefSiblings = @($Response.PSObject.Properties.Name | Where-Object { $_ -notin @('$ref', 'summary', 'description') })
    if ($responseRefSiblings.Count -gt 0) {
      Add-Issue "$Label ref contains semantic sibling keywords: $($responseRefSiblings -join ',')"
    }
    $owner = $document.components.responses.PSObject.Properties[$name]
    if (-not $owner) {
      Add-Issue "$Label references missing response owner: $name"
      return $null
    }
    return $owner.Value
  }
  return $Response
}

function Get-ExpectedResponseSchemaRef([string]$OperationId, [string]$Status, [string]$SuccessRef) {
  if ($Status -eq '200') { return $SuccessRef }
  if ($OperationId -eq 'appGetGenealogyJoinApplicationRequest' -and $Status -eq '404') { return '#/components/schemas/RGenealogyJoinApplicationRequestNotAvailable' }
  if ($Status -eq '409') {
    if ($OperationId -eq 'appCreateGenealogyJoinApplication') { return '#/components/schemas/RJoinApplicationKeyConflict' }
    if ($OperationId -in @('appWithdrawGenealogyJoinApplication','appReviewGenealogyJoinApplication')) { return '#/components/schemas/RJoinApplicationStateConflict' }
  }
  return @{
    '400' = '#/components/schemas/RJoinApplicationBadRequest'
    '401' = '#/components/schemas/RJoinApplicationUnauthorized'
    '403' = '#/components/schemas/RJoinApplicationForbidden'
    '404' = '#/components/schemas/RJoinApplicationNotFound'
    '422' = '#/components/schemas/RJoinApplicationUnprocessable'
    '429' = '#/components/schemas/RJoinApplicationRateLimited'
    '500' = '#/components/schemas/RJoinApplicationServerError'
  }[$Status]
}

function Assert-ResponseContract([object]$Operation, [string]$Label, [string[]]$Statuses, [string]$SuccessRef) {
  if (-not $Operation) { return }
  $actual = @($Operation.responses.PSObject.Properties.Name | Sort-Object)
  if (($actual -join ',') -ne ((@($Statuses | Sort-Object)) -join ',')) { Add-Issue "$Label response set drifted: $($actual -join ',')" }
  foreach ($status in $actual) {
    if ($status -eq 'default' -or $status -match '^3') { Add-Issue "$Label must not use default or 3xx responses" }
    $response = Resolve-Response $Operation.responses.PSObject.Properties[$status].Value "$Label $status response"
    if (-not $response) { continue }
    $media = if ($response.content) { $response.content.PSObject.Properties['application/json'] } else { $null }
    if (-not $media -or $response.content.PSObject.Properties.Count -ne 1) { Add-Issue "$Label $status must use only application/json" }
    $expectedRef = Get-ExpectedResponseSchemaRef $Operation.operationId $status $SuccessRef
    $actualRef = if ($media) { [string]$media.Value.schema.'$ref' } else { '' }
    if ($expectedRef -and $media) { [void](Test-IsPureSchemaRef $media.Value.schema $expectedRef "$Label $status response schema") }
    $cache = if ($response.headers) { $response.headers.PSObject.Properties['Cache-Control'] } else { $null }
    if (-not $cache) {
      Add-Issue "$Label $status must use the shared PrivateNoStore header owner"
    } else {
      [void](Test-IsExactReferenceObjectRef $cache.Value '#/components/headers/PrivateNoStore' 'headers' "$Label $status Cache-Control")
    }
    if ($status -eq '429') {
      $retry = if ($response.headers) { $response.headers.PSObject.Properties['Retry-After'] } else { $null }
      if (-not $retry) {
        Add-Issue "$Label 429 must use the shared RetryAfter header owner"
      } else {
        [void](Test-IsExactReferenceObjectRef $retry.Value '#/components/headers/RetryAfter' 'headers' "$Label 429 Retry-After")
      }
    }
  }
}

function Assert-SecurityAndClient([string]$Path, [object]$Operation, [string]$Label) {
  if (-not $Operation) { return }
  $security = @($Operation.security)
  if ($security.Count -ne 1 -or $security[0].PSObject.Properties.Count -ne 1 -or $security[0].PSObject.Properties.Name -notcontains 'SaToken') {
    Add-Issue "$Label must require SaToken without an anonymous alternative"
  }
  $client = Get-Parameter $Path $Operation 'header' 'clientid'
  if ($client -and (-not (Test-JsonBoolean $client.required $true) -or $client.schema.type -ne 'string' -or -not (Test-IsNonNullable $client.schema) -or [int]$client.schema.minLength -ne 1 -or [int]$client.schema.maxLength -ne 128)) {
    Add-Issue "$Label clientid must be a required non-null string bounded to 1..128"
  }
  if ($client) { Assert-NoConflictingSchemaKeywords $client.schema "$Label clientid" }
  if ($client) { Assert-AllowedSchemaKeywords $client.schema "$Label clientid" @('type', 'minLength', 'maxLength', 'nullable') }
}

$parityOutput = @(& node (Join-Path $PSScriptRoot 'openapi-yaml-json-parity-runtime-smoke.js') 2>&1)
if ($LASTEXITCODE -ne 0 -or 'OPENAPI-YAML-JSON-PARITY PASS' -notin $parityOutput) {
  Add-Issue "protected JSON/YAML parity failed: $($parityOutput -join ' | ')"
}

$resolvedOperations = @{}
foreach ($entry in $operations) {
  $operation = Get-Operation $entry.Path $entry.Method
  $resolvedOperations[$entry.Id] = $operation
  if ($operation -and [string]$operation.operationId -ne $entry.Id) { Add-Issue "$($entry.Method.ToUpperInvariant()) $($entry.Path) operationId must be $($entry.Id)" }
  Assert-SecurityAndClient $entry.Path $operation "$($entry.Method.ToUpperInvariant()) $($entry.Path)"
  Assert-ResponseContract $operation "$($entry.Method.ToUpperInvariant()) $($entry.Path)" $entry.Responses $entry.SuccessRef
  if ($operation) {
    $actualParameters = @(Get-Parameters $entry.Path $operation | ForEach-Object { "$($_.in):$($_.name)" } | Sort-Object)
    $expectedParameters = @($entry.Parameters | Sort-Object)
    if (($actualParameters -join ',') -ne ($expectedParameters -join ',')) { Add-Issue "$($entry.Id) parameters must be exactly $($expectedParameters -join ','); actual=$($actualParameters -join ',')" }
  }
}
foreach ($entry in $operations) {
  $duplicates = @($document.paths.PSObject.Properties | ForEach-Object { $_.Value.PSObject.Properties | Where-Object { $_.Name -in @('get','post','put','delete','patch') -and $_.Value.operationId -eq $entry.Id } })
  if ($duplicates.Count -ne 1) { Add-Issue "operationId must be globally unique: $($entry.Id)" }
}

$headerOwners = if ($document.components.PSObject.Properties['headers']) { $document.components.headers } else { $null }
$privateHeaderProperty = if ($headerOwners) { $headerOwners.PSObject.Properties['PrivateNoStore'] } else { $null }
$privateHeader = if ($privateHeaderProperty) { $privateHeaderProperty.Value } else { $null }
if (-not $privateHeader -or $privateHeader.schema.type -ne 'string' -or -not (Test-IsNonNullable $privateHeader.schema) -or -not (Test-IsJsonArray $privateHeader.schema.enum) -or @($privateHeader.schema.enum).Count -ne 1 -or $privateHeader.schema.enum[0] -ne 'private, no-store') { Add-Issue 'PrivateNoStore header must be a fixed non-null string enum [private, no-store]' }
if ($privateHeader) { Assert-NoConflictingSchemaKeywords $privateHeader.schema 'PrivateNoStore header schema' @('enum') }
if ($privateHeader) { Assert-AllowedSchemaKeywords $privateHeader.schema 'PrivateNoStore header schema' @('type', 'enum', 'nullable') }
$retryHeaderProperty = if ($headerOwners) { $headerOwners.PSObject.Properties['RetryAfter'] } else { $null }
$retryHeader = if ($retryHeaderProperty) { $retryHeaderProperty.Value } else { $null }
if (-not $retryHeader -or $retryHeader.schema.type -ne 'integer' -or -not (Test-IsNonNullable $retryHeader.schema) -or [int]$retryHeader.schema.minimum -ne 1 -or [int]$retryHeader.schema.maximum -ne 120) { Add-Issue 'RetryAfter header must be a non-null integer 1..120 seconds' }
if ($retryHeader) { Assert-NoConflictingSchemaKeywords $retryHeader.schema 'RetryAfter header schema' }
if ($retryHeader) { Assert-AllowedSchemaKeywords $retryHeader.schema 'RetryAfter header schema' @('type', 'minimum', 'maximum', 'nullable') }

Assert-StringOwner 'GenealogyId' 1 128 '^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$'
Assert-StringOwner 'JoinApplicationId' 1 128 '^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$'
Assert-StringOwner 'JoinApplicationCursor' 1 512 '^[A-Za-z0-9_-]+$'
Assert-StringOwner 'GenealogyJoinApplicationRequestKey' 40 61 '^gja\.[0-9]{13}\.[A-Za-z0-9_-]{22,43}$'
$requestKeyOwner = Get-Schema 'GenealogyJoinApplicationRequestKey'
if ($requestKeyOwner) {
  foreach ($extension in @(
    @{ Name = 'x-issued-at-source'; Value = 'KEY_EPOCH_MILLISECONDS' },
    @{ Name = 'x-accept-window-seconds'; Value = 600 },
    @{ Name = 'x-max-future-skew-seconds'; Value = 300 },
    @{ Name = 'x-resolve-sla-seconds'; Value = 120 },
    @{ Name = 'x-random-min-bits'; Value = 128 }
  )) {
    if ($requestKeyOwner.PSObject.Properties[$extension.Name].Value -ne $extension.Value) { Add-Issue "GenealogyJoinApplicationRequestKey $($extension.Name) must be $($extension.Value)" }
  }
}

$applyBody = Get-Schema 'AppGenealogyJoinApplicationBody'
Assert-ClosedObject $applyBody 'AppGenealogyJoinApplicationBody' @('applicantName','relationDesc','applyReason') @('applicantName','relationDesc')
foreach ($field in @(
  @{ Name = 'applicantName'; Max = 50 },
  @{ Name = 'relationDesc'; Max = 100 },
  @{ Name = 'applyReason'; Max = 500 }
)) {
  $property = if ($applyBody) { $applyBody.properties.PSObject.Properties[$field.Name].Value } else { $null }
  if ($property -and ($property.type -ne 'string' -or [int]$property.minLength -ne 1 -or [int]$property.maxLength -ne $field.Max -or $property.'x-text-normalizer' -ne 'JOIN_APPLICATION_TEXT_V1')) {
    Add-Issue "AppGenealogyJoinApplicationBody.$($field.Name) must use JOIN_APPLICATION_TEXT_V1 and length 1..$($field.Max)"
  }
}

$reviewBody = Get-Schema 'AppGenealogyJoinReviewBody'
if ($reviewBody) {
  Assert-Union $reviewBody 'AppGenealogyJoinReviewBody' 'decision' @{
    APPROVE = '#/components/schemas/AppGenealogyJoinApproveBody'
    REJECT = '#/components/schemas/AppGenealogyJoinRejectBody'
  }
  if ($reviewBody.PSObject.Properties['additionalProperties']) { Add-Issue 'review union wrapper must leave closure to its two concrete branches under OpenAPI 3.0.1' }
}
$approveBody = Get-Schema 'AppGenealogyJoinApproveBody'
$rejectBody = Get-Schema 'AppGenealogyJoinRejectBody'
Assert-ClosedObject $approveBody 'AppGenealogyJoinApproveBody' @('decision') @('decision')
Assert-ClosedObject $rejectBody 'AppGenealogyJoinRejectBody' @('decision','rejectionReason') @('decision','rejectionReason')
Assert-SingleEnum $approveBody 'AppGenealogyJoinApproveBody' 'decision' 'APPROVE'
Assert-SingleEnum $rejectBody 'AppGenealogyJoinRejectBody' 'decision' 'REJECT'
if ($rejectBody -and ($rejectBody.properties.rejectionReason.type -ne 'string' -or [int]$rejectBody.properties.rejectionReason.minLength -ne 1 -or [int]$rejectBody.properties.rejectionReason.maxLength -ne 500 -or $rejectBody.properties.rejectionReason.'x-text-normalizer' -ne 'JOIN_APPLICATION_TEXT_V1')) {
  Add-Issue 'rejectionReason must use JOIN_APPLICATION_TEXT_V1 and length 1..500'
}

$searchItem = Get-Schema 'AppGenealogySearchItem'
Assert-ClosedObject $searchItem 'AppGenealogySearchItem' @('genealogyId','genealogyName','surname','regionName','ancestralHall','parentGenealogyName','branchName','certificationLabel','memberCount','updatedAt','viewerState') @('genealogyId','genealogyName','surname','regionName','viewerState')
Assert-PropertyRef $searchItem 'AppGenealogySearchItem' 'genealogyId' '#/components/schemas/GenealogyId'
if ($searchItem) {
  $expectedViewerStates = @('NOT_JOINED','MEMBER','PENDING','REJECTED','FORMER_MEMBER','OWNER')
  if ((@($searchItem.properties.viewerState.enum | Sort-Object) -join ',') -ne ((@($expectedViewerStates | Sort-Object)) -join ',')) { Add-Issue 'AppGenealogySearchItem.viewerState enum drifted' }
  foreach ($forbidden in @('phone','managerName','managerPhone','userId','inviterUserId','auditUserId','canApply')) {
    if ($searchItem.properties.PSObject.Properties[$forbidden]) { Add-Issue "search projection leaks or duplicates state: $forbidden" }
  }
}

$pendingItem = Get-Schema 'PendingGenealogyJoinApplicationItem'
Assert-ClosedObject $pendingItem 'PendingGenealogyJoinApplicationItem' @('applyId','applicantName','relationDesc','applyReason','submittedAt') @('applyId','applicantName','relationDesc','submittedAt')
Assert-PropertyRef $pendingItem 'PendingGenealogyJoinApplicationItem' 'applyId' '#/components/schemas/JoinApplicationId'
if ($pendingItem -and $pendingItem.properties.submittedAt.format -ne 'date-time') { Add-Issue 'pending submittedAt must be RFC3339 date-time' }

$mineUnion = Get-Schema 'MyGenealogyJoinApplicationItem'
$mineMapping = @{
  PENDING = '#/components/schemas/MyPendingGenealogyJoinApplication'
  APPROVED = '#/components/schemas/MyApprovedGenealogyJoinApplication'
  REJECTED = '#/components/schemas/MyRejectedGenealogyJoinApplication'
  WITHDRAWN = '#/components/schemas/MyWithdrawnGenealogyJoinApplication'
}
Assert-Union $mineUnion 'MyGenealogyJoinApplicationItem' 'status' $mineMapping
$mineBranches = @(
  @{ Name = 'MyPendingGenealogyJoinApplication'; Status = 'PENDING'; Fields = @('applyId','genealogyId','genealogyName','status','relationDesc','applyReason','submittedAt'); Required = @('applyId','genealogyId','genealogyName','status','relationDesc','submittedAt') },
  @{ Name = 'MyApprovedGenealogyJoinApplication'; Status = 'APPROVED'; Fields = @('applyId','genealogyId','genealogyName','status','relationDesc','applyReason','submittedAt','resolvedAt'); Required = @('applyId','genealogyId','genealogyName','status','relationDesc','submittedAt','resolvedAt') },
  @{ Name = 'MyRejectedGenealogyJoinApplication'; Status = 'REJECTED'; Fields = @('applyId','genealogyId','genealogyName','status','relationDesc','applyReason','submittedAt','resolvedAt','rejectionReason'); Required = @('applyId','genealogyId','genealogyName','status','relationDesc','submittedAt','resolvedAt','rejectionReason') },
  @{ Name = 'MyWithdrawnGenealogyJoinApplication'; Status = 'WITHDRAWN'; Fields = @('applyId','genealogyId','genealogyName','status','relationDesc','applyReason','submittedAt','resolvedAt'); Required = @('applyId','genealogyId','genealogyName','status','relationDesc','submittedAt','resolvedAt') }
)
foreach ($branch in $mineBranches) {
  $name = $branch.Name
  $schema = Get-Schema $name
  if ($schema) {
    Assert-ClosedObject $schema $name $branch.Fields $branch.Required
    Assert-SingleEnum $schema $name 'status' $branch.Status
    foreach ($field in @('applyId','genealogyId')) { Assert-PropertyRef $schema $name $field $(if ($field -eq 'applyId') { '#/components/schemas/JoinApplicationId' } else { '#/components/schemas/GenealogyId' }) }
    if ($schema.properties.submittedAt.format -ne 'date-time') { Add-Issue "$name.submittedAt must be date-time" }
    if ($schema.properties.PSObject.Properties['resolvedAt'] -and $schema.properties.resolvedAt.format -ne 'date-time') { Add-Issue "$name.resolvedAt must be date-time" }
  }
}
$rejectedMine = Get-Schema 'MyRejectedGenealogyJoinApplication'
if ($rejectedMine -and @($rejectedMine.required) -notcontains 'rejectionReason') { Add-Issue 'REJECTED mine branch must require applicant-visible rejectionReason' }

foreach ($pageName in @('GenealogySearchCursorPage','MyGenealogyJoinApplicationCursorPage','PendingGenealogyJoinApplicationCursorPage')) {
  $page = Get-Schema $pageName
  Assert-ClosedObject $page $pageName @('items','nextCursor') @('items')
  if ($page -and ($page.properties.PSObject.Properties['total'] -or $page.properties.PSObject.Properties['pageNum'])) { Add-Issue "$pageName must not expose total/pageNum" }
}
$pageItemRefs = @{
  GenealogySearchCursorPage = '#/components/schemas/AppGenealogySearchItem'
  MyGenealogyJoinApplicationCursorPage = '#/components/schemas/MyGenealogyJoinApplicationItem'
  PendingGenealogyJoinApplicationCursorPage = '#/components/schemas/PendingGenealogyJoinApplicationItem'
}
foreach ($pageName in $pageItemRefs.Keys) {
  $page = $document.components.schemas.PSObject.Properties[$pageName].Value
  if (-not $page) { continue }
  if ($page.properties.items.type -ne 'array' -or [string]$page.properties.items.items.'$ref' -ne $pageItemRefs[$pageName] -or [int]$page.properties.items.maxItems -ne 50) { Add-Issue "$pageName.items must be a max-50 array of $($pageItemRefs[$pageName])" }
  Assert-PropertyRef $page $pageName 'nextCursor' '#/components/schemas/JoinApplicationCursor'
}

$receipt = Get-Schema 'GenealogyJoinApplicationReceipt'
Assert-ClosedObject $receipt 'GenealogyJoinApplicationReceipt' @('applyId','genealogyId','status','submittedAt') @('applyId','genealogyId','status','submittedAt')
Assert-PropertyRef $receipt 'GenealogyJoinApplicationReceipt' 'applyId' '#/components/schemas/JoinApplicationId'
Assert-PropertyRef $receipt 'GenealogyJoinApplicationReceipt' 'genealogyId' '#/components/schemas/GenealogyId'
Assert-SingleEnum $receipt 'GenealogyJoinApplicationReceipt' 'status' 'PENDING'
if ($receipt -and $receipt.properties.submittedAt.format -ne 'date-time') { Add-Issue 'GenealogyJoinApplicationReceipt.submittedAt must be date-time' }

Assert-Envelope 'RGenealogySearchCursorPage' '#/components/schemas/GenealogySearchCursorPage'
Assert-Envelope 'RGenealogyJoinApplicationReceipt' '#/components/schemas/GenealogyJoinApplicationReceipt'
Assert-Envelope 'RGenealogyJoinApplicationRequestStatus' '#/components/schemas/GenealogyJoinApplicationRequestStatus'
Assert-Envelope 'RMyGenealogyJoinApplicationCursorPage' '#/components/schemas/MyGenealogyJoinApplicationCursorPage'
Assert-Envelope 'RWithdrawnGenealogyJoinApplicationReceipt' '#/components/schemas/WithdrawnGenealogyJoinApplicationReceipt'
Assert-Envelope 'RReviewedGenealogyJoinApplicationReceipt' '#/components/schemas/ReviewedGenealogyJoinApplicationReceipt'
Assert-Envelope 'RPendingGenealogyJoinApplicationCursorPage' '#/components/schemas/PendingGenealogyJoinApplicationCursorPage'

$reviewedUnion = Get-Schema 'ReviewedGenealogyJoinApplicationReceipt'
Assert-Union $reviewedUnion 'ReviewedGenealogyJoinApplicationReceipt' 'status' @{
  APPROVED = '#/components/schemas/ApprovedGenealogyJoinApplicationReceipt'
  REJECTED = '#/components/schemas/RejectedGenealogyJoinApplicationReceipt'
}
foreach ($branch in @(
  @{ Name='ApprovedGenealogyJoinApplicationReceipt'; Status='APPROVED'; Fields=@('applyId','status','resolvedAt'); Required=@('applyId','status','resolvedAt') },
  @{ Name='RejectedGenealogyJoinApplicationReceipt'; Status='REJECTED'; Fields=@('applyId','status','resolvedAt','rejectionReason'); Required=@('applyId','status','resolvedAt','rejectionReason') },
  @{ Name='WithdrawnGenealogyJoinApplicationReceipt'; Status='WITHDRAWN'; Fields=@('applyId','status','resolvedAt'); Required=@('applyId','status','resolvedAt') }
)) {
  $schema = Get-Schema $branch.Name
  Assert-ClosedObject $schema $branch.Name $branch.Fields $branch.Required
  Assert-SingleEnum $schema $branch.Name 'status' $branch.Status
  Assert-PropertyRef $schema $branch.Name 'applyId' '#/components/schemas/JoinApplicationId'
  if ($schema -and $schema.properties.resolvedAt.format -ne 'date-time') { Add-Issue "$($branch.Name).resolvedAt must be date-time" }
}

$currentState = Get-Schema 'GenealogyJoinApplicationCurrentState'
Assert-ClosedObject $currentState 'GenealogyJoinApplicationCurrentState' @('applyId','status','resolvedAt') @('applyId','status')
Assert-PropertyRef $currentState 'GenealogyJoinApplicationCurrentState' 'applyId' '#/components/schemas/JoinApplicationId'
if ($currentState) {
  $states = @('PENDING','APPROVED','REJECTED','WITHDRAWN')
  if ((@($currentState.properties.status.enum | Sort-Object) -join ',') -ne ((@($states | Sort-Object)) -join ',')) { Add-Issue 'current-state status enum drifted' }
}

Assert-ErrorEnvelope 'RJoinApplicationBadRequest' 400 @('CURSOR_INVALID','INVALID_REQUEST','OPERATION_KEY_INVALID')
Assert-ErrorEnvelope 'RJoinApplicationUnauthorized' 401 @('AUTHENTICATION_REQUIRED')
Assert-ErrorEnvelope 'RJoinApplicationForbidden' 403 @('JOIN_APPLICATION_FORBIDDEN')
Assert-ErrorEnvelope 'RJoinApplicationNotFound' 404 @('GENEALOGY_NOT_FOUND','JOIN_APPLICATION_NOT_FOUND')
Assert-ErrorEnvelope 'RJoinApplicationKeyConflict' 409 @('ACTIVE_PENDING_EXISTS','IDEMPOTENCY_KEY_REUSED','OPERATION_KEY_EXPIRED')
Assert-ErrorEnvelope 'RJoinApplicationStateConflict' 409 @('JOIN_APPLICATION_DECISION_CONFLICT','JOIN_APPLICATION_STATE_CHANGED') $true
if ($document.components.schemas.PSObject.Properties['RJoinApplicationConflict']) { Add-Issue 'remove broad RJoinApplicationConflict; each mutation operation must reference its precise 409 owner' }
Assert-ErrorEnvelope 'RJoinApplicationUnprocessable' 422 @('GENEALOGY_NOT_PUBLIC_APPLY','JOIN_APPLICATION_NOT_ALLOWED','REJECTION_REASON_INVALID')
Assert-ErrorEnvelope 'RJoinApplicationRateLimited' 429 @('RATE_LIMITED')
Assert-ErrorEnvelope 'RJoinApplicationServerError' 500 @('INTERNAL_ERROR')
$notAvailable = Get-Schema 'RGenealogyJoinApplicationRequestNotAvailable'
Assert-ClosedObject $notAvailable 'RGenealogyJoinApplicationRequestNotAvailable' @('code','businessCode','acceptUntil') @('code','businessCode','acceptUntil')
if ($notAvailable -and ($notAvailable.properties.code.enum[0] -ne 404 -or $notAvailable.properties.businessCode.enum[0] -ne 'JOIN_APPLICATION_REQUEST_NOT_AVAILABLE' -or $notAvailable.properties.acceptUntil.format -ne 'date-time')) { Add-Issue 'status 404 contract drifted' }

$post = $resolvedOperations['appCreateGenealogyJoinApplication']
if ($post) {
  Assert-RequestBody $post 'join POST' '#/components/schemas/AppGenealogyJoinApplicationBody'
  Assert-PathId $operations[1].Path $post 'genealogyId' '#/components/schemas/GenealogyId'
  $key = Get-Parameter $operations[1].Path $post 'header' 'Idempotency-Key'
  if ($key) {
    if (-not (Test-JsonBoolean $key.required $true)) { Add-Issue 'join POST Idempotency-Key must be required' }
    [void](Test-IsPureSchemaRef $key.schema '#/components/schemas/GenealogyJoinApplicationRequestKey' 'join POST Idempotency-Key')
  }
  $description = [string]$post.description
  foreach ($pattern in @('canonical.*method.*path.*genealogyId.*tenant.*account.*client.*body','unique.*account.*tenant.*genealogy.*PENDING','same key.*same canonical.*same receipt','same key.*different.*409','domain transaction.*application.*SUCCEEDED','FAILED_NO_COMMIT.*no domain effects','same transaction.*READY.*PUBLIC_APPLY.*application eligibility','single winner.*PUBLIC_APPLY.*MEMBER_ONLY')) {
    if ($description -notmatch "(?i)$pattern") { Add-Issue "join POST description misses: $pattern" }
  }
  if (-not (Test-IsJsonArray $post.'x-idempotency-scope') -or
      (@($post.'x-idempotency-scope') -join ',') -ne 'method,path,genealogyId,tenant,account,client,canonicalBody' -or
      -not (Test-IsJsonArray $post.'x-active-pending-unique-scope') -or
      (@($post.'x-active-pending-unique-scope') -join ',') -ne 'tenant,account,genealogyId' -or
      -not (Test-IsJsonArray $post.'x-domain-transaction-effects') -or
      (@($post.'x-domain-transaction-effects') -join ',') -ne 'JOIN_APPLICATION,SUCCEEDED_RECEIPT' -or
      -not (Test-IsJsonArray $post.'x-revalidates') -or
      (@($post.'x-revalidates') -join ',') -ne 'genealogyState,accessPreset,applicationEligibility' -or
      [string]$post.'x-public-apply-coordination' -ne 'ATOMIC_SINGLE_WINNER' -or
      -not (Test-JsonBoolean $post.'x-same-request-replays-receipt' $true) -or
      $post.'x-different-digest-error' -ne 'IDEMPOTENCY_KEY_REUSED') { Add-Issue 'join POST machine-readable idempotency/replay/transaction extensions drifted' }
}

$status = $resolvedOperations['appGetGenealogyJoinApplicationRequest']
if ($status) {
  if ($status.PSObject.Properties['requestBody']) { Add-Issue 'status GET must not define a request body' }
  $requestKey = Get-Parameter $operations[2].Path $status 'path' 'requestKey'
  if ($requestKey) {
    if (-not (Test-JsonBoolean $requestKey.required $true)) { Add-Issue 'status requestKey must be required' }
    [void](Test-IsPureSchemaRef $requestKey.schema '#/components/schemas/GenealogyJoinApplicationRequestKey' 'status requestKey')
  }
  foreach ($pattern in @('read-only.*no side effect','ABSENT.*PENDING.*SUCCEEDED.*FAILED_NO_COMMIT','terminal.*immutable','cross-account.*tenant.*client.*404','before.*acceptUntil.*404','after.*acceptUntil.*computed.*FAILED_NO_COMMIT.*no write','PENDING.*resolveBy','domain effect.*SUCCEEDED.*same transaction')) {
    if ([string]$status.description -notmatch "(?i)$pattern") { Add-Issue "status GET description misses: $pattern" }
  }
  if (-not (Test-JsonBoolean $status.'x-read-only' $true) -or -not (Test-JsonBoolean $status.'x-expired-absent-zero-write' $true)) { Add-Issue 'status GET read-only/zero-write extensions drifted' }
  $status404 = Resolve-Response $status.responses.PSObject.Properties['404'].Value 'status GET 404 response'
  $status404Retry = if ($status404.headers) { $status404.headers.PSObject.Properties['Retry-After'] } else { $null }
  if (-not $status404Retry) {
    Add-Issue 'status GET 404 must use RetryAfter before acceptUntil'
  } else {
    [void](Test-IsExactReferenceObjectRef $status404Retry.Value '#/components/headers/RetryAfter' 'headers' 'status GET 404 Retry-After')
  }
}
$statusUnion = Get-Schema 'GenealogyJoinApplicationRequestStatus'
Assert-Union $statusUnion 'GenealogyJoinApplicationRequestStatus' 'status' @{
  PENDING = '#/components/schemas/PendingGenealogyJoinApplicationRequest'
  SUCCEEDED = '#/components/schemas/SucceededGenealogyJoinApplicationRequest'
  FAILED_NO_COMMIT = '#/components/schemas/FailedGenealogyJoinApplicationRequest'
}
if ($statusUnion -and (-not (Test-JsonBoolean $statusUnion.'x-terminal-immutable' $true) -or -not (Test-IsJsonArray $statusUnion.'x-state-transitions') -or (@($statusUnion.'x-state-transitions') -join ',') -ne 'ABSENT->PENDING,PENDING->SUCCEEDED,PENDING->FAILED_NO_COMMIT')) { Add-Issue 'operation status transitions or terminal immutability drifted' }
$pendingStatus = Get-Schema 'PendingGenealogyJoinApplicationRequest'
$succeededStatus = Get-Schema 'SucceededGenealogyJoinApplicationRequest'
$failedStatus = Get-Schema 'FailedGenealogyJoinApplicationRequest'
Assert-ClosedObject $pendingStatus 'PendingGenealogyJoinApplicationRequest' @('status','resolveBy','retryAfterSeconds') @('status','resolveBy','retryAfterSeconds')
Assert-SingleEnum $pendingStatus 'PendingGenealogyJoinApplicationRequest' 'status' 'PENDING'
if ($pendingStatus -and ($pendingStatus.properties.resolveBy.format -ne 'date-time' -or $pendingStatus.properties.retryAfterSeconds.type -ne 'integer' -or [int]$pendingStatus.properties.retryAfterSeconds.minimum -ne 1 -or [int]$pendingStatus.properties.retryAfterSeconds.maximum -ne 30)) { Add-Issue 'PENDING operation status timing fields drifted' }
Assert-ClosedObject $succeededStatus 'SucceededGenealogyJoinApplicationRequest' @('status','result') @('status','result')
Assert-SingleEnum $succeededStatus 'SucceededGenealogyJoinApplicationRequest' 'status' 'SUCCEEDED'
Assert-PropertyRef $succeededStatus 'SucceededGenealogyJoinApplicationRequest' 'result' '#/components/schemas/GenealogyJoinApplicationReceipt'
Assert-ClosedObject $failedStatus 'FailedGenealogyJoinApplicationRequest' @('status') @('status')
Assert-SingleEnum $failedStatus 'FailedGenealogyJoinApplicationRequest' 'status' 'FAILED_NO_COMMIT'
if ($failedStatus -and ($failedStatus.'x-domain-effects' -ne 'NONE' -or -not (Test-JsonBoolean $failedStatus.'x-active-application-created' $false))) { Add-Issue 'FAILED_NO_COMMIT must machine-lock zero application effects' }

foreach ($listId in @('appSearchPublicGenealogies','appListMyGenealogyJoinApplications','appListPendingGenealogyJoinApplications')) {
  $operation = $resolvedOperations[$listId]
  if (-not $operation) { continue }
  $limit = Get-Parameter ($operations | Where-Object Id -eq $listId).Path $operation 'query' 'limit'
  $cursor = Get-Parameter ($operations | Where-Object Id -eq $listId).Path $operation 'query' 'cursor'
  if ($limit -and ($limit.schema.type -ne 'integer' -or -not (Test-IsNonNullable $limit.schema) -or [int]$limit.schema.minimum -ne 1 -or [int]$limit.schema.maximum -ne 50)) { Add-Issue "$listId limit must be a non-null integer 1..50" }
  if ($limit) {
    Assert-NoConflictingSchemaKeywords $limit.schema "$listId limit"
    Assert-AllowedSchemaKeywords $limit.schema "$listId limit" @('type', 'minimum', 'maximum', 'nullable')
  }
  if ($cursor) { [void](Test-IsPureSchemaRef $cursor.schema '#/components/schemas/JoinApplicationCursor' "$listId cursor") }
  foreach ($pattern in @('stable.*cursor','no total','tenant.*account.*client','filter.*cursor','tie-breaker')) {
    if ([string]$operation.description -notmatch "(?i)$pattern") { Add-Issue "$listId pagination description misses: $pattern" }
  }
  $expectedOrder = if ($listId -eq 'appSearchPublicGenealogies') { 'updatedAt:desc,genealogyId:desc' } else { 'submittedAt:desc,applyId:desc' }
  if (-not (Test-IsJsonArray $operation.'x-cursor-scope') -or (@($operation.'x-cursor-scope') -join ',') -ne 'tenant,account,client,filters' -or -not (Test-IsJsonArray $operation.'x-cursor-order') -or (@($operation.'x-cursor-order') -join ',') -ne $expectedOrder -or -not (Test-JsonBoolean $operation.'x-cursor-no-total' $true)) { Add-Issue "$listId cursor extensions drifted" }
}
$search = $resolvedOperations['appSearchPublicGenealogies']
if ($search) {
  $keyword = Get-Parameter $operations[0].Path $search 'query' 'keyword'
  if ($keyword -and (-not (Test-JsonBoolean $keyword.required $true) -or $keyword.schema.type -ne 'string' -or -not (Test-IsNonNullable $keyword.schema) -or [int]$keyword.schema.minLength -ne 1 -or [int]$keyword.schema.maxLength -ne 50)) { Add-Issue 'search keyword must be required non-null string length 1..50' }
  if ($keyword) {
    Assert-NoConflictingSchemaKeywords $keyword.schema 'search keyword'
    Assert-AllowedSchemaKeywords $keyword.schema 'search keyword' @('type', 'minLength', 'maxLength', 'nullable')
  }
}

$withdraw = $resolvedOperations['appWithdrawGenealogyJoinApplication']
if ($withdraw) {
  if ($withdraw.PSObject.Properties['requestBody']) { Add-Issue 'withdraw DELETE must not define a request body' }
  Assert-PathId $operations[4].Path $withdraw 'applyId' '#/components/schemas/JoinApplicationId'
  foreach ($pattern in @('WHERE status=PENDING','same withdraw.*same 200','audit.*race.*409','current.*state','terminal.*immutable','cross-account.*tenant.*404')) {
    if ([string]$withdraw.description -notmatch "(?i)$pattern") { Add-Issue "withdraw description misses: $pattern" }
  }
  if ($withdraw.'x-cas-where' -ne 'status=PENDING' -or -not (Test-JsonBoolean $withdraw.'x-same-action-replay' $true)) { Add-Issue 'withdraw CAS extensions drifted' }
}
$audit = $resolvedOperations['appReviewGenealogyJoinApplication']
if ($audit) {
  Assert-RequestBody $audit 'audit PUT' '#/components/schemas/AppGenealogyJoinReviewBody'
  Assert-PathId $operations[6].Path $audit 'genealogyId' '#/components/schemas/GenealogyId'
  Assert-PathId $operations[6].Path $audit 'applyId' '#/components/schemas/JoinApplicationId'
  foreach ($pattern in @('WHERE status=PENDING','same decision.*same 200','different rejection.*409','opposite decision.*409','permission.*READY.*PUBLIC_APPLY','same transaction.*member.*application','unique member')) {
    if ([string]$audit.description -notmatch "(?i)$pattern") { Add-Issue "audit description misses: $pattern" }
  }
  if ($audit.'x-cas-where' -ne 'status=PENDING' -or -not (Test-IsJsonArray $audit.'x-transaction-effects') -or (@($audit.'x-transaction-effects') -join ',') -ne 'UNIQUE_MEMBER_RELATION,APPLICATION_TERMINAL_STATE' -or -not (Test-IsJsonArray $audit.'x-revalidates') -or (@($audit.'x-revalidates') -join ',') -ne 'permission,genealogyState,accessPreset' -or -not (Test-JsonBoolean $audit.'x-same-decision-replays-receipt' $true) -or $audit.'x-opposite-decision-error' -ne 'JOIN_APPLICATION_DECISION_CONFLICT') { Add-Issue 'audit CAS/replay/transaction extensions drifted' }
}

$pendingOperation = $resolvedOperations['appListPendingGenealogyJoinApplications']
Assert-PathId $operations[5].Path $pendingOperation 'genealogyId' '#/components/schemas/GenealogyId'
foreach ($readId in @('appSearchPublicGenealogies','appListMyGenealogyJoinApplications','appListPendingGenealogyJoinApplications')) {
  $read = $resolvedOperations[$readId]
  if ($read -and $read.PSObject.Properties['requestBody']) { Add-Issue "$readId must not define a request body" }
}

foreach ($legacy in @('GenealogyJoinApplyBody','GenealogyJoinAuditBody','AppGenealogyJoinApplyBody','AppGenealogyJoinAuditBody')) {
  if ($document.components.schemas.PSObject.Properties[$legacy]) { Add-Issue "legacy APP join schema must be removed: $legacy" }
}

# No successful join response may expose account, phone, inviter, or auditor identities anywhere in its recursive schema closure.
$queue = New-Object System.Collections.Generic.Queue[string]
$seen = @{}
foreach ($entry in $operations) { $queue.Enqueue(([string]$entry.SuccessRef).Split('/')[-1]) }
while ($queue.Count -gt 0) {
  $name = $queue.Dequeue()
  if ($seen.ContainsKey($name)) { continue }
  $seen[$name] = $true
  $owner = $document.components.schemas.PSObject.Properties[$name]
  if (-not $owner) { Add-Issue "successful response closure is missing schema: $name"; continue }
  $schema = $owner.Value
  foreach ($forbidden in @('phone','appUserId','appUserPhone','inviterUserId','inviterPhone','auditUserId','auditPhone')) {
    if ($schema.properties -and $schema.properties.PSObject.Properties.Name -contains $forbidden) { Add-Issue "$name leaks forbidden identity field: $forbidden" }
  }
  $json = $schema | ConvertTo-Json -Depth 40 -Compress
  foreach ($match in [regex]::Matches($json, '#/components/schemas/(?<Name>[A-Za-z0-9._-]+)')) {
    $queue.Enqueue($match.Groups['Name'].Value)
  }
}

if ($issues.Count -gt 0) {
  Write-Output 'JOIN-APPLICATION-OPENAPI-CONTRACT BLOCKED'
  Write-Output "Issues: $($issues.Count)"
  $issues | ForEach-Object { Write-Output "- $_" }
  Write-Output 'Only accept APP.openapi.json and APP.openapi.yaml re-exported together from one backend version; never hand-edit the protected files.'
  exit 1
}

Write-Output 'JOIN-APPLICATION-OPENAPI-CONTRACT PASS'