teamcraft/

templates.rs

//! HTML templates (MiniJinja), embedded into the binary at compile time.

use minijinja::Environment;

use crate::util;

macro_rules! embed {
    ($($name:literal),* $(,)?) => {
        &[$(($name, include_str!(concat!("../templates/", $name)))),*]
    };
}

/// All templates, keyed by their path below `templates/`.
pub const TEMPLATES: &[(&str, &str)] = embed![
    "base.html",
    "macros.html",
    "login.html",
    "error.html",
    "dashboard.html",
    "explorer.html",
    "items/list.html",
    "items/new.html",
    "items/label.html",
    "items/where_used.html",
    "revisions/show.html",
    "revisions/edit.html",
    "revisions/bom.html",
    "revisions/bom_compare.html",
    "revisions/mass.html",
    "materials.html",
    "revisions/bom_from_references.html",
    "revisions/save_as.html",
    "revisions/simulation_compare.html",
    "changes/list.html",
    "changes/new.html",
    "changes/show.html",
    "requests/list.html",
    "requests/new.html",
    "requests/show.html",
    "projects/list.html",
    "projects/show.html",
    "projects/access_review.html",
    "projects/access_log.html",
    "projects/season.html",
    "files/preview.html",
    "admin/users.html",
    "admin/user_edit.html",
    "admin/holdings.html",
    "admin/audit.html",
    "admin/attributes.html",
    "admin/attribute_edit.html",
    "admin/webhooks.html",
    "admin/webhook_edit.html",
    "admin/branding.html",
    "admin/ai.html",
    "desktop/authorize.html",
    "formats.html",
    "imports/upload.html",
    "imports/preview.html",
    "notifications.html",
    "account.html",
    "assistant.html",
];

pub fn environment(instance_name: &str) -> Result<Environment<'static>, minijinja::Error> {
    let mut env = Environment::new();
    for (name, source) in TEMPLATES {
        env.add_template(name, source)?;
    }
    env.add_filter("dt", filter_dt);
    env.add_filter("num", filter_num);
    env.add_filter("fixed", filter_fixed);
    env.add_filter("sig", filter_sig);
    env.add_filter("filesize", filter_filesize);
    env.add_filter("label", filter_label);
    env.add_filter("urlencode", |value: String| util::pct_encode(&value));
    env.add_filter("age", filter_age);
    env.add_global("instance_name", instance_name.to_string());
    env.add_global("version", env!("CARGO_PKG_VERSION"));
    // cache busting of the embedded stylesheets, scripts and logos
    env.add_global("assets", crate::assets::version());
    Ok(env)
}

/// RFC 3339 timestamp → `2026-11-03 14:05 UTC`. (The browser script
/// rewrites `<time>` elements into the viewer's local time zone.)
fn filter_dt(value: Option<String>) -> String {
    match value {
        Some(v) => match chrono::DateTime::parse_from_rfc3339(&v) {
            Ok(t) => t
                .with_timezone(&chrono::Utc)
                .format("%Y-%m-%d %H:%M UTC")
                .to_string(),
            Err(_) => v,
        },
        None => "—".to_string(),
    }
}

/// RFC 3339 timestamp → its age now (`3 days`, `5 h`, `just now`), e.g.
/// how long a lock has been held; `—` for none.
fn filter_age(value: Option<String>) -> String {
    match value
        .as_deref()
        .and_then(|v| chrono::DateTime::parse_from_rfc3339(v).ok())
    {
        Some(t) => crate::domain::format_age(
            (chrono::Utc::now() - t.with_timezone(&chrono::Utc)).num_seconds(),
        ),
        None => "—".to_string(),
    }
}

/// Number with up to `decimals` (default 3) decimals; `—` for none.
fn filter_num(value: Option<f64>, decimals: Option<usize>) -> String {
    match value {
        Some(v) => util::format_number(v, decimals.unwrap_or(3)),
        None => "—".to_string(),
    }
}

/// A number with exactly `decimals` places (default 2), so a column of
/// costs or masses lines up at the decimal point; `—` when missing.
fn filter_fixed(value: Option<f64>, decimals: Option<usize>) -> String {
    match value {
        Some(v) => format!("{v:.prec$}", prec = decimals.unwrap_or(2)),
        None => "—".to_string(),
    }
}

/// A physical value with six significant digits (mass properties span
/// grams to tonnes and 10⁻⁹ to 10⁶ kg·m²); exponent form outside
/// 10⁻³ … 10⁷; `—` when missing.
fn filter_sig(value: Option<f64>) -> String {
    match value {
        None => "—".to_string(),
        Some(v) if !v.is_finite() => "—".to_string(),
        Some(0.0) => "0".to_string(),
        Some(v) if (1e-3..1e7).contains(&v.abs()) => {
            let decimals = (5 - v.abs().log10().floor() as i32).clamp(0, 9) as usize;
            util::format_number(v, decimals)
        }
        Some(v) => format!("{v:.5e}"),
    }
}

fn filter_filesize(value: i64) -> String {
    util::format_bytes(value)
}

/// `in_review` → `In Review`; a few codes have fixed labels (`in_work` → `WIP`).
fn filter_label(value: Option<String>) -> String {
    let Some(value) = value else {
        return String::new();
    };
    match value.as_str() {
        "in_work" => return "WIP".into(),
        "editor" => return "CAD editor".into(),
        _ => {}
    }
    value
        .split('_')
        .filter(|w| !w.is_empty())
        .map(|w| {
            let mut c = w.chars();
            match c.next() {
                Some(first) => first.to_uppercase().collect::<String>() + c.as_str(),
                None => String::new(),
            }
        })
        .collect::<Vec<_>>()
        .join(" ")
}

#[cfg(test)]
mod accessibility;

#[cfg(test)]
mod tests {
    use super::*;
    use serde_json::{json, Value};
    use std::cell::RefCell;

    thread_local! {
        /// Every page [`render`] produced on this thread, for the checks that
        /// run over all of them (`every_rendered_page_is_accessible`).
        static RENDERED: RefCell<Vec<(String, String)>> = const { RefCell::new(Vec::new()) };
    }

    const ME: &str = "11111111-1111-4111-8111-111111111111";
    const OTHER: &str = "22222222-2222-4222-8222-222222222222";
    const TS: &str = "2026-11-03T14:05:59.123456Z";

    fn me() -> Value {
        json!({ "id": ME, "username": "max", "display_name": "Max Muster", "initials": "MM", "avatar": 3, "role": "admin", "skin": "arch", "is_admin": true, "can_edit": true })
    }

    /// The Files card hint of `revisions/show.html` (`kind` as
    /// `domain::FilesHint::as_str`), shaped like `web::revisions::show` sends it.
    fn files_hint(kind: &str) -> Value {
        json!({ "kind": kind, "can_revise": kind == "frozen", "type_hint": "STEP, drawings, <reports>" })
    }

    fn revision(state: &str, checked_out: bool) -> Value {
        json!({
            "id": "33333333-3333-4333-8333-333333333333", "item_id": "44444444-4444-4444-8444-444444444444",
            "item_number": "PRT-000001", "item_type": "part", "unit": "each", "seq": 2, "code": "B",
            "state": state, "name": "Bracket <b>", "description": "line 1\nline 2", "material": "AlMg3",
            "mass_kg": 0.125, "unit_cost": null,
            "checked_out_by": if checked_out { json!(OTHER) } else { Value::Null },
            "checked_out_by_name": if checked_out { json!("Erika") } else { Value::Null },
            "checked_out_at": if checked_out { json!(TS) } else { Value::Null },
            "created_by": ME, "created_by_name": "Max Muster",
            "created_at": TS, "updated_at": TS, "released_at": null
        })
    }

    fn item() -> Value {
        json!({
            "id": "44444444-4444-4444-8444-444444444444", "number": "PRT-000001", "item_type": "part",
            "unit": "each", "project_id": null, "project_code": "ROCKET", "created_by": ME,
            "created_by_name": "Max Muster", "created_at": TS,
            "owner_id": ME, "owner_name": "Max Muster"
        })
    }

    fn change(status: &str) -> Value {
        json!({
            "id": "55555555-5555-4555-8555-555555555555", "number": "CHG-000001", "title": "Release bracket",
            "description": "why", "priority": "high", "status": status, "created_by": ME,
            "created_by_name": "Max Muster", "created_at": TS, "updated_at": TS,
            "submitted_at": TS, "closed_at": null
        })
    }

    fn request(status: &str) -> Value {
        json!({
            "id": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "number": "ECR-000001", "title": "Crack <at> the weld",
            "description": "Problem\nproposal", "reason": "manufacturing", "priority": "high", "status": status,
            "requested_by": OTHER, "requested_by_name": "Erika", "assignee": ME, "assignee_name": "Max Muster",
            "assignee_username": "max", "decision_comment": "not now", "decided_by": ME,
            "decided_by_name": "Max Muster", "decided_at": TS, "due_date": "2026-12-01", "created_at": TS,
            "updated_at": TS, "closed_at": null, "item_count": 1
        })
    }

    fn audit_entry() -> Value {
        json!({ "id": 1, "at": TS, "user_id": ME, "username": "max", "action": "item.create",
                "entity_type": "item", "entity_id": "44444444-4444-4444-8444-444444444444",
                "summary": "Created Part PRT-000001", "details": {} })
    }

    fn user() -> Value {
        json!({ "id": OTHER, "username": "erika", "display_name": "Erika", "email": null,
                "auth_source": "local", "role": "editor", "active": true, "created_at": TS, "last_login_at": null,
                "skin": "teamcraft" })
    }

    const ROCKET: &str = "66666666-6666-4666-8666-666666666666";

    fn project() -> Value {
        json!({ "id": ROCKET, "code": "ROCKET", "name": "Sounding rocket",
                "description": "Rocketry", "active": true, "created_at": TS,
                "oidc_group": "teamcraft-rocket", "member_count": 3, "created_by": ME })
    }

    fn roles() -> Value {
        json!([{ "value": "viewer", "label": "Viewer" }, { "value": "editor", "label": "CAD editor" },
               { "value": "admin", "label": "Admin" }])
    }

    fn page() -> Value {
        json!({ "page": 1, "pages": 2, "total": 60, "prev": null, "next": 2 })
    }

    fn with_common(mut data: Value) -> Value {
        let map = data.as_object_mut().unwrap();
        map.insert("me".into(), me());
        map.insert(
            "flash".into(),
            json!({ "kind": "success", "message": "Saved <ok>" }),
        );
        map.insert("local_login".into(), json!(true));
        map.insert("skin".into(), json!("arch"));
        map.insert("skin_scheme".into(), json!("dark"));
        map.insert(
            "branding".into(),
            json!({ "wide": "aaaabbbbcccc", "square": "ddddeeeeffff" }),
        );
        data
    }

    fn render(env: &Environment<'static>, name: &str, data: Value) -> String {
        let html = env
            .get_template(name)
            .unwrap_or_else(|e| panic!("{name}: {e:#}"))
            .render(&data)
            .unwrap_or_else(|e| panic!("{name}: {e:#}"));
        RENDERED.with(|r| r.borrow_mut().push((name.to_string(), html.clone())));
        html
    }

    /// Every page of `every_template_renders` – all templates in all the
    /// states it renders – passes the accessibility checks
    /// (`templates/accessibility.rs`).
    #[test]
    fn every_rendered_page_is_accessible() {
        RENDERED.with(|r| r.borrow_mut().clear());
        every_template_renders();
        let pages = RENDERED.with(|r| r.take());
        assert!(pages.len() > 60, "rendered pages: {}", pages.len());
        let mut problems: Vec<String> = pages
            .iter()
            .flat_map(|(name, html)| accessibility::check(name, html))
            .collect();
        problems.sort();
        problems.dedup();
        assert!(
            problems.is_empty(),
            "{} accessibility problems:\n{}",
            problems.len(),
            problems.join("\n")
        );
    }

    #[test]
    fn every_template_renders() {
        let env = environment("TeamCraft Test").expect("templates compile");
        let bom_line = json!({
            "id": "77777777-7777-4777-8777-777777777777", "parent_revision_id": "33333333-3333-4333-8333-333333333333",
            "child_item_id": "88888888-8888-4888-8888-888888888888", "child_number": "PRT-000002",
            "child_type": "part", "child_unit": "each", "find_number": 10, "quantity": 4.0, "notes": "M6",
            "child_latest_revision_id": "99999999-9999-4999-8999-999999999999", "child_latest_code": "A",
            "child_latest_state": "released", "child_name": "Bolt"
        });
        let version = |n: i32, comment: &str| {
            json!({ "id": ME, "file_id": OTHER, "version": n, "sha256": "cd".repeat(32), "size_bytes": 1000,
                    "content_type": "application/pdf", "comment": comment, "uploaded_by": ME,
                    "uploaded_by_name": "Max", "uploaded_at": TS })
        };
        let file = json!({ "id": OTHER, "revision_id": ME, "filename": "nozzle.step", "content_type": "model/step",
                           "size_bytes": 123456, "sha256": "ab".repeat(32), "uploaded_by": ME,
                           "uploaded_by_name": "Max", "uploaded_at": TS, "version": 2, "preview": true, "folder": "rover/nozzle",
                           "format": "step", "format_info": crate::cadformat::info("step"),
                           "versions": [version(2, "wall 2.5 mm"), version(1, "")] });
        let native = json!({ "id": ME, "revision_id": ME, "filename": "nozzle.SLDPRT",
                             "content_type": "application/octet-stream", "size_bytes": 4096,
                             "sha256": "ef".repeat(32), "uploaded_by": ME, "uploaded_by_name": "Max",
                             "uploaded_at": TS, "version": 1, "preview": false, "format": "solidworks-part",
                             "format_info": crate::cadformat::info("solidworks-part"),
                             "versions": [version(1, "")] });
        let unknown = json!({ "id": OTHER, "revision_id": ME, "filename": "notes.xyz",
                              "content_type": "application/x-unknown", "size_bytes": 10,
                              "sha256": "12".repeat(32), "uploaded_by": ME, "uploaded_by_name": "Max",
                              "uploaded_at": TS, "version": 1, "preview": false, "format": "",
                              "format_info": null, "versions": [version(1, "")] });
        let impact = |resolution: Option<&str>| {
            json!({ "id": ME, "item_id": ME, "item_number": "ASM-000001", "project_id": ROCKET,
                    "project_code": "ROCKET", "revision_id": OTHER, "revision_code": "A",
                    "revision_state": "released", "item_name": "Stage <1>", "source_item_id": OTHER,
                    "source_number": "PRT-000001", "source_revision_id": ME, "source_code": "B",
                    "source_name": "Bracket", "event": "released", "relation": "bom",
                    "detail": "find no. 10", "change_id": ME, "change_number": "CHG-000002",
                    "created_at": TS, "resolved_at": resolution.map(|_| TS), "resolution": resolution,
                    "resolved_by_name": resolution.map(|_| "Erika"),
                    "note": if resolution.is_some() { "fit unchanged <ok>" } else { "" } })
        };
        // services::impacts::DependentGroup: two sources on one dependent
        let impact_group = || {
            let mut obsolete = impact(None);
            obsolete["id"] = json!(OTHER);
            obsolete["source_number"] = json!("PRT-000002");
            obsolete["event"] = json!("obsolete");
            obsolete["relation"] = json!("file");
            obsolete["detail"] = json!("Stage.SLDASM references Nut.SLDPRT");
            obsolete["change_id"] = json!(null);
            obsolete["change_number"] = json!(null);
            json!({ "item_id": ME, "item_number": "ASM-000001", "item_name": "Stage <1>", "project_id": ROCKET,
                    "project_code": "ROCKET", "revision_id": OTHER, "revision_code": "A",
                    "revision_state": "released", "latest_at": TS, "impact_ids": format!("{ME},{OTHER}"),
                    "impacts": [impact(None), obsolete] })
        };
        let references = json!({
            "outgoing": [{ "id": ME, "from_revision_id": ME, "to_item_id": OTHER, "to_number": "PRT-000009",
                           "to_type": "part", "kind": "drawing", "note": "sheet 2", "to_latest_revision_id": OTHER,
                           "to_latest_code": "C", "to_latest_state": "released", "to_name": "Nozzle",
                           "released_to_revision_id": OTHER, "released_to_code": "B", "created_at": TS }],
            "incoming": [{ "reference_id": ME, "kind": "specification", "note": "", "from_revision_id": OTHER,
                           "from_item_id": OTHER, "from_number": "DOC-000003", "from_code": "A",
                           "from_name": "Welding spec", "from_state": "released", "released_to_code": "A" }],
            "files": [{ "file_id": ME, "filename": "Stage.SLDASM", "format_kind": "assembly", "references": [
                { "name": "bracket.sldprt", "matches": [{ "item_id": OTHER, "item_number": "PRT-000001",
                  "item_name": "Bracket", "revision_id": OTHER, "revision_code": "B", "revision_state": "released",
                  "file_id": OTHER, "filename": "Bracket.SLDPRT", "same_revision": false,
                  "export_name": false }] },
                { "name": "nozzle.stp", "matches": [{ "item_id": OTHER, "item_number": "PRT-000002",
                  "item_name": "Nozzle", "revision_id": OTHER, "revision_code": "A", "revision_state": "in_work",
                  "file_id": OTHER, "filename": "nozzle_v2.stp", "same_revision": false,
                  "export_name": true }] },
                { "name": "Bolt M6.SLDPRT", "matches": [] }] }],
            "file_referrers": [{ "item_id": OTHER, "item_number": "DOC-000004", "revision_id": OTHER,
                                 "revision_code": "A", "revision_state": "in_work", "item_name": "Stage drawing",
                                 "file_id": OTHER, "filename": "Stage.SLDDRW", "referenced": "Stage.SLDASM",
                                 "export_name": true }],
            "suggestions": {
                "bom": [{ "item_number": "PRT-000001", "item_name": "Bracket", "via": "Stage.SLDASM → Bracket.SLDPRT" }],
                "drawing_of": [{ "item_number": "PRT-000007", "item_name": "Hub", "via": "Hub.SLDDRW → Hub.SLDPRT" }] },
            "kinds": crate::domain::ReferenceKind::ALL.iter()
                .map(|k| json!({ "value": k.as_str(), "label": k.label() })).collect::<Vec<_>>(),
        });
        let can_all = json!({ "edit": true, "checkout": true, "checkin": true, "cancel_checkout": true,
                              "revise": true, "obsolete": true, "delete": true, "master": true, "owner": true,
                              "add_to_change": true, "acknowledge": true });

        let html = render(
            &env,
            "dashboard.html",
            with_common(json!({
                "stats": { "items": 3, "revisions_in_work": 1, "revisions_in_review": 0, "revisions_released": 2,
                           "open_changes": 1, "files": 4, "stored_bytes": 2048 },
                "checkouts": [revision("in_work", true)], "reviews": [change("in_review")],
                "my_changes": [change("draft")], "activity": [audit_entry()], "impact_groups": [impact_group()],
                "assigned_requests": [request("in_triage")], "my_requests": [request("new")],
            })),
        );
        assert!(
            html.contains("Requests assigned to me") && html.contains("due 2026-12-01"),
            "change requests on the dashboard"
        );
        assert!(html.contains("Saved &lt;ok&gt;"), "flash is escaped");
        assert!(html.contains("2 KiB"));
        assert!(
            html.contains("Dependents to check")
                && html.contains("uses it in its BOM")
                && html.contains("Stage &lt;1&gt;"),
            "open impacts on the dashboard"
        );
        for expected in [
            "2 changes to check",
            "Acknowledge all…",
            "/revisions/22222222-2222-4222-8222-222222222222/impacts/acknowledge",
            "BOM line",
            "CAD file reference",
            "via <a class=\"mono\" href=\"/changes/",
            "badge-obsolete",
            "resolves all 2 as well",
            "/revise",
        ] {
            assert!(html.contains(expected), "grouped impacts show {expected}");
        }
        assert_eq!(
            html.matches("resolves all 2 as well").count(),
            1,
            "the revise hint once per group"
        );

        let entry = json!({ "item_id": ME, "number": "PRT-000001", "item_type": "part", "project_id": ROCKET,
                            "project_code": "ROCKET", "revision_id": revision("in_work", true)["id"],
                            "code": "A", "name": "Bracket <b>",
                            "state": "in_work", "checked_out_by": ME, "checked_out_by_name": "Max Muster",
                            "checked_out_at": TS, "updated_at": TS, "file_count": 2 });
        let html = render(
            &env,
            "explorer.html",
            with_common(json!({
                "folders": [{ "id": ROCKET, "code": "ROCKET", "name": "Sounding rocket", "items": 3, "locked": 1 }],
                "folder": ROCKET, "entries": [entry], "limit": 500, "q": "",
                "selected": { "rev": revision("in_work", true), "files": [file.clone()],
                              "file_groups": [{ "files": [file.clone()], "collapsed": false }],
                              "can": { "checkout": false, "checkin": true, "cancel_checkout": true } },
                "back": crate::util::pct_encode(&format!("/vault?folder={ROCKET}&rev={OTHER}")),
                "max_upload_mb": 512,
            })),
        );
        for expected in [
            "Sounding rocket",
            "Bracket &lt;b&gt;",
            "Check in and release",
            "/cancel-checkout?back=",
            "?back=%2Fvault%3Ffolder%3D",
            "enctype=\"multipart/form-data\"",
            "class=\"selected\"",
        ] {
            assert!(html.contains(expected), "vault explorer shows {expected}");
        }
        let html = render(
            &env,
            "explorer.html",
            with_common(
                json!({ "folders": [], "folder": "mine", "entries": [], "limit": 500, "q": "",
                                "selected": null, "back": "%2Fvault", "max_upload_mb": 512 }),
            ),
        );
        assert!(html.contains("You have nothing checked out"));

        // Save As and the BOM comparison
        let html = render(
            &env,
            "revisions/save_as.html",
            with_common(
                json!({ "rev": revision("released", false), "projects": [project()],
                                "file_count": 3, "line_count": 2 }),
            ),
        );
        assert!(
            html.contains("Copy the current files (3)") && html.contains("Copy the BOM (2 lines)")
        );
        assert!(html.contains("/save-as") && html.contains("ROCKET"));
        let diff = |level: usize, change: &str, before: Value, after: Value| {
            json!({ "level": level, "change": change, "child_item_id": OTHER, "child_number": "PRT-000002",
                    "child_name": "Bolt <M6>", "unit": "each", "before": before, "after": after })
        };
        let values = |find: i32, qty: f64, rev: Value| json!({ "find_number": find, "quantity": qty, "notes": "", "revision": rev });
        let diffs = json!([
            diff(1, "added", Value::Null, values(10, 2.0, Value::Null)),
            diff(1, "removed", values(20, 1.0, Value::Null), Value::Null),
            diff(
                1,
                "changed",
                values(30, 1.0, Value::Null),
                values(30, 4.0, Value::Null)
            )
        ]);
        let summary = json!({ "added": 1, "removed": 1, "changed": 1, "unchanged": 0 });
        let html = render(
            &env,
            "revisions/bom_compare.html",
            with_common(json!({
                "rev": revision("in_work", false), "before": revision("released", false),
                "after": revision("in_work", false), "revisions": [revision("in_work", false)],
                "depth": "1", "rule": "latest", "diffs": diffs, "summary": summary,
            })),
        );
        assert!(html.contains("1 added · 1 removed · 1 changed"));
        assert!(html.contains("bom-diff-removed") && html.contains("Bolt &lt;M6&gt;"));
        assert!(
            !html.contains("<th scope=\"col\">Lvl</th>"),
            "levels only over all levels"
        );
        let deep = render(
            &env,
            "revisions/bom_compare.html",
            with_common(json!({
                "rev": revision("in_work", false), "before": revision("released", false),
                "after": revision("in_work", false), "revisions": [revision("in_work", false)],
                "depth": "all", "rule": "as_released", "summary": summary,
                "diffs": [diff(1, "changed", values(10, 1.0, json!("A")), values(10, 1.0, json!("B"))),
                          diff(2, "added", Value::Null, values(10, 2.0, json!("A"))),
                          diff(9, "removed", values(20, 1.0, Value::Null), Value::Null)],
            })),
        );
        assert!(
            deep.contains("<th scope=\"col\">Lvl</th>")
                && deep.contains("indent-2")
                && deep.contains("indent-deep")
        );
        assert!(
            deep.contains("A → <strong>B</strong>"),
            "a new child revision"
        );
        assert!(deep.contains("value=\"all\" selected"));

        render(
            &env,
            "login.html",
            json!({ "next": "/", "next_encoded": "%2F", "error": "bad", "oidc_name": "Single Sign-On",
                                           "username": "max", "local_login": true, "flash": null }),
        );
        render(
            &env,
            "error.html",
            json!({ "status": 404, "reason": "Not Found", "message": "gone", "flash": null, "local_login": true }),
        );
        let html = render(
            &env,
            "error.html",
            json!({ "status": 404, "reason": "Not Found", "message": "gone", "flash": null, "local_login": true,
                    "branding": { "wide": "aaaabbbbcccc", "square": null } }),
        );
        assert!(html.contains("/branding/wide?v=aaaabbbbcccc"));
        assert!(!html.contains("TeamCraft_Logo_White.svg"));

        let html = render(
            &env,
            "items/list.html",
            with_common(json!({
                "items": [{ "id": ME, "number": "PRT-000001", "item_type": "part", "unit": "each", "project_code": null,
                            "created_at": TS, "latest_revision_id": OTHER, "latest_code": "A", "latest_state": "in_work",
                            "name": "Bracket", "matched_file": "bracket.step", "classification": "purchased",
                            "attributes": { "vendor": "Bosch" } }],
                "pagination": page(), "base_query": "q=a%20b",
                "filter": { "q": "a b", "type": "part", "project": "", "state": "", "system": "creo",
                            "class": "purchased", "attr": "vendor", "value": "Bo" },
                "filter_error": "Length: 'abc' is not a number.",
                "projects": [project()], "types": [{ "value": "part", "label": "Part" }],
                "states": [{ "value": "in_work", "label": "In Work" }],
                "systems": crate::cadformat::SYSTEMS,
                "classifications": [{ "value": "make", "label": "In-house" }, { "value": "purchased", "label": "Purchased" }],
                "attribute_defs": [{ "key": "vendor", "label": "Vendor", "unit": "", "active": true }],
            })),
        );
        assert!(
            html.contains("<option value=\"creo\" selected>PTC Creo"),
            "CAD program filter"
        );
        assert!(
            html.contains("<option value=\"vendor\" selected>Vendor"),
            "attribute filter"
        );
        assert!(html.contains("badge-member\" title=\"Classification\">purchased"));
        assert!(
            html.contains("name=\"class\" value=\"purchased\""),
            "saved searches keep the class"
        );
        assert!(html.contains("is not a number"), "filter errors are shown");

        let html = render(
            &env,
            "formats.html",
            with_common(
                json!({ "systems": crate::cadformat::catalogue(), "previews": [".stl", ".step"] }),
            ),
        );
        for expected in [
            "SolidWorks assembly",
            ".sldasm",
            "NX part",
            "Creo part",
            ".catproduct",
            "JT visualisation",
            ".x_t",
            "/items?system=inventor",
            "by content",
        ] {
            assert!(html.contains(expected), "formats page lists {expected}");
        }
        render(
            &env,
            "items/new.html",
            with_common(json!({
                "form": { "item_type": "part", "number": "", "name": "", "description": "", "project_id": "",
                          "unit": "each", "material": "", "mass_kg": "", "unit_cost": "" },
                "error": "Name must not be empty.", "projects": [project()], "materials": [],
                "types": [{ "value": "part", "label": "Part" }], "units": units(),
            })),
        );
        // new simulation based on a revision
        let html = render(
            &env,
            "items/new.html",
            with_common(json!({
                "form": { "item_type": "simulation", "number": "", "name": "Simulation – Bracket",
                          "description": "Analysis.", "project_id": "", "basis": OTHER,
                          "basis_role": "geometry", "unit": "", "material": "", "mass_kg": "",
                          "unit_cost": "" },
                "error": null, "projects": [project()], "materials": [],
                "types": [{ "value": "simulation", "label": "Simulation" }], "units": units(),
                "basis": { "revision_id": OTHER, "item_number": "PRT-000002", "code": "A",
                           "label": "PRT-000002/A", "name": "Bracket <1>" },
                "basis_roles": [{ "value": "geometry", "label": "Geometry" }],
                "basis_other_group": true, "number_hint": "SIM-000007",
            })),
        );
        assert!(html.contains("PRT-000002") && html.contains("SIM-000007"));
        assert!(html.contains("Bracket &lt;1&gt;"));
        assert!(!html.contains("name=\"mass_kg\""));

        // alternates, supersession and replace in assemblies
        let linked = |number: &str, restricted: bool| {
            json!({ "item_id": OTHER, "number": number, "item_type": "part", "name": "Bolt <M6>",
                    "latest_revision_id": OTHER, "latest_code": "B", "latest_state": "released",
                    "note": "second <source>", "created_by_name": "Erika", "created_at": TS,
                    "two_way": true, "restricted": restricted })
        };
        let usage = |level: i32, state: &str| {
            json!({ "level": level, "child_number": "PRT-000001", "line_id": ME, "parent_revision_id": OTHER,
                    "parent_item_id": ME, "parent_number": "ASM-000001", "parent_code": "A",
                    "parent_name": "Stage <1>", "parent_state": state, "find_number": 10, "quantity": 2.0,
                    "released_child_code": null })
        };
        let plan_row = |action: &str, label: &str| {
            json!({ "line_id": ME, "find_number": 10, "quantity": 4.0, "parent_item_id": ME,
                    "parent_number": "ASM-000003", "parent_revision_id": OTHER, "parent_code": "B",
                    "parent_name": "Frame <2>", "parent_state": "in_work", "checked_out_by_name": "Max",
                    "action": action, "action_label": label })
        };
        let html = render(
            &env,
            "items/label.html",
            with_common(json!({
                "rev": revision("released", false),
                "url": "https://plm.example.org/i/PRT-000001",
            })),
        );
        // (MiniJinja escapes `/` in text as `&#x2f;`)
        assert!(
            html.contains("qr.svg") && html.contains("plm.example.org"),
            "{html}"
        );
        for (with_plan, restricted) in [(true, false), (false, true)] {
            let html = render(
                &env,
                "items/where_used.html",
                with_common(json!({
                    "item": item(), "latest": revision("released", false), "levels": 25,
                    "level_options": [{ "value": 1, "label": "1 level" }, { "value": 25, "label": "All levels" }],
                    "rows": [usage(1, "released"), usage(2, "in_work")], "truncated": with_plan, "hidden": 2,
                    "successor": linked("PRT-000002", restricted), "alternates": [linked("PRT-000003", false)],
                    "with": "PRT-000002",
                    "plan": if with_plan { json!({
                        "old_item_id": ME, "old_number": "PRT-000001", "new_item_id": OTHER,
                        "new_number": "PRT-000002", "replaced": 1, "hidden": 1,
                        "rows": [plan_row("replace", "will be replaced"),
                                 plan_row("checked_out", "checked out by somebody else")],
                    }) } else { Value::Null },
                    "plan_error": if with_plan { Value::Null } else { json!("Item 'X' not <found>.") },
                    "can_replace": true,
                })),
            );
            assert!(html.contains("Stage &lt;1&gt;"), "names are escaped");
            assert!(html.contains("+2 assemblies"), "hidden count");
            assert_eq!(html.contains("Replace in 1 BOM line"), with_plan);
            assert_eq!(html.contains("(Max)"), with_plan, "who has it checked out");
            assert_eq!(html.contains("not &lt;found&gt;"), !with_plan);
            assert_eq!(html.contains("Restricted item"), restricted);
        }

        for (state, checked_out) in [("in_work", true), ("in_work", false), ("released", false)] {
            let source = json!({ "file_id": OTHER, "filename": "nozzle.step", "sha256": "cd".repeat(32), "format": "step" });
            let similar = if checked_out {
                json!({ "status": "pending", "message": "computing", "source": source,
                        "signature": null, "ignore_scale": false, "candidates": [] })
            } else {
                json!({ "status": "ready", "message": null, "source": source, "ignore_scale": false,
                        "signature": { "extents": [120.0, 40.0, 8.0], "area": 1.0, "volume": null, "closed": false, "triangles": 12 },
                        "candidates": [{
                            "item_id": ME, "item_number": "PRT-000007", "item_type": "part", "project_code": "ROCKET",
                            "revision_id": OTHER, "revision_code": "B", "state": "released", "name": "Nozzle <i>",
                            "file_id": OTHER, "filename": "old-nozzle.stl", "identical": false,
                            "score": 91, "shape": 94, "size": 97, "extents": [118.0, 40.0, 8.0],
                            "explanation": "extents 118 × 40 × 8 vs 120 × 40 × 8, shape distribution 94 % similar",
                            "thumbnail_file_id": if state == "released" { json!(ME) } else { json!(null) },
                        }] })
            };
            // a manager looking at an active member's lock: the reason form
            let mut can_rev = can_all.clone();
            can_rev["release_with_reason"] = json!(checked_out);
            let html = render(
                &env,
                "revisions/show.html",
                with_common(json!({
                    "files_hint": files_hint(if state == "released" { "frozen" } else if checked_out { "upload" } else { "checkout" }),
                    "rev": revision(state, checked_out), "item": item(), "revisions": [revision(state, checked_out)],
                    "hidden": { "parents": 2, "incoming": 1, "changes": 1, "simulations": 0 },
                    "is_latest": false, "latest_id": OTHER, "files": [file.clone(), native.clone(), unknown.clone()],
                    "file_groups": [{ "files": [file.clone(), unknown.clone()], "collapsed": false },
                                    { "files": [native.clone()], "collapsed": true, "count": 1, "families": "SolidWorks" }],
                    "native_without_preview": state == "released", "lines": [bom_line.clone()],
                    "where_used": [{ "line_id": ME, "parent_revision_id": OTHER, "parent_item_id": ME,
                                     "parent_number": "ASM-000001", "parent_code": "A", "parent_name": "Assembly",
                                     "parent_state": "released", "find_number": 10, "quantity": 2.0 }],
                    "changes": [change("draft")], "open_change": change("draft"), "drafts": [change("draft")],
                    "history": [audit_entry()], "projects": [project()], "units": units(),
                    "references": references.clone(), "impact_groups": [impact_group()],
                    "resolved_impacts": [impact(Some("acknowledged"))],
                    "open_requests": [request("in_triage")], "similar": similar,
                    "can": can_rev,
                    "release_reason": { "min": 10, "max": 500 },
                    "max_upload_mb": 512, "assistant_enabled": state == "released",
                    "interchange": {
                        "alternates": [linked("PRT-000003", false)],
                        "alternate_for": [linked("PRT-000004", false)],
                        "successor": linked("PRT-000002", false),
                        "predecessors": [linked("PRT-000006", false)],
                        "superseded": { "88888888-8888-4888-8888-888888888888": "PRT-000005" },
                        "can_edit": checked_out,
                    },
                    "lifecycle": {
                        "states": crate::domain::LifecycleState::ALL,
                        "next": crate::domain::rules_from(crate::domain::LifecycleState::parse(state).unwrap()),
                        "rules": crate::domain::LIFECYCLE_RULES,
                    },
                    "attribute_rows": [{ "key": "length", "label": "Length", "unit": "mm", "value": "12.5", "active": true },
                                       { "key": "old", "label": "Old <code>", "unit": "", "value": "x", "active": false }],
                    "classifications": [{ "value": "make", "label": "In-house" }, { "value": "purchased", "label": "Purchased" }],
                })),
            );
            // preferred CAD program: the other program's file in a <details>
            let (open, rest) = html
                .split_once("<details class=\"other-formats\"")
                .expect("collapsed group of other CAD formats");
            assert!(open.contains("nozzle.step") && !open.contains(">nozzle.SLDPRT<"));
            assert!(rest.contains("1 file in other CAD formats (SolidWorks)"));
            assert!(rest.contains(">nozzle.SLDPRT<"));
            assert_eq!(
                html.contains("name=\"reason\" minlength=\"10\" maxlength=\"500\" required"),
                checked_out,
                "a manager releases an active member's lock with a reason"
            );
            assert!(
                html.contains("aria-current=\"step\""),
                "current lifecycle state is marked"
            );
            assert!(html.contains("<dd>12.5 mm</dd>") && html.contains("Old &lt;code&gt;"));
            assert!(
                html.contains("no longer in use"),
                "inactive attributes are marked"
            );
            assert!(
                html.contains("name=\"classification\""),
                "classification in the master data"
            );
            for expected in [
                "is superseded by",
                "Superseded by PRT-000005",
                "id=\"interchange\"",
                "PRT-000003",
                "may be replaced by",
                "supersedes",
                "second &lt;source&gt;",
                "/where-used",
            ] {
                assert!(html.contains(expected), "revision page shows {expected}");
            }
            assert_eq!(
                html.contains("Add alternate"),
                checked_out,
                "forms only for editors of the group"
            );
            assert!(html.contains("four-eyes principle"), "rules are listed");
            if checked_out {
                assert!(
                    html.contains("Comparing the shape of nozzle.step"),
                    "similar parts pending"
                );
            } else {
                assert!(
                    html.contains("PRT-000007/B")
                        && html.contains("Nozzle &lt;i&gt;")
                        && html.contains("shape distribution 94 % similar")
                        && html.contains("value=\"91\""),
                    "similar parts listed"
                );
            }
            assert!(html.contains("Bracket &lt;b&gt;"), "names are escaped");
            assert!(
                html.contains("/files/") && html.contains("/restore"),
                "rollback offered"
            );
            assert!(html.contains("Check in and release"), "check-in form");
            assert!(
                html.contains(&format!("/files/{OTHER}/preview"))
                    && html.contains(&format!("/file-versions/{ME}/preview")),
                "3D preview of the file and of its versions"
            );
            assert!(
                html.contains("STEP (ISO 10303)")
                    && html.contains("fmt fmt-exchange")
                    && html.contains("SolidWorks part")
                    && html.contains("fmt fmt-part"),
                "format labels"
            );
            for expected in [
                "Check needed:",
                "/acknowledge",
                "Drawing of",
                "PRT-000009",
                "released with",
                "Welding spec",
                "not in TeamCraft",
                "Add to BOM",
                "Hub.SLDDRW",
                "Stage.SLDDRW references Stage.SLDASM",
                "fit unchanged &lt;ok&gt;",
                "Request change…",
                "1 open change request on",
                "file=nozzle.step",
            ] {
                assert!(html.contains(expected), "revision page shows {expected}");
            }
            assert!(
                html.contains("x-unknown"),
                "unknown formats show the content type"
            );
            assert_eq!(
                html.contains("No 3D preview for native CAD files"),
                state == "released",
                "hint for native files without a neutral export"
            );
            // the sidebar: icon and drawer only when the assistant is enabled;
            // the page declares where the user is (identifiers only)
            assert_eq!(
                html.contains("id=\"assistant-drawer\"")
                    && html.contains("id=\"assistant-toggle\""),
                state == "released",
                "assistant sidebar only when enabled"
            );
            assert!(
                html.contains("data-tc-kind=\"revision\"")
                    && html.contains("data-tc-item=\"PRT-000001\"")
                    && html.contains("data-tc-revision=\"B\""),
                "the revision page declares its context"
            );
        }

        // Simulations: basis links and results on the simulation, the
        // simulations based on a part on the part
        let basis = |out_of_date: Option<&str>| {
            json!({ "id": ME, "revision_id": OTHER, "role": "geometry", "note": "fillet <r2>",
                    "basis_item_id": OTHER, "basis_number": "PRT-000001", "basis_type": "part",
                    "basis_revision_id": OTHER, "basis_code": "A", "basis_state": "released",
                    "basis_name": "Bracket", "file_version_id": ME, "file_id": OTHER,
                    "file_name": "bracket.step", "file_version": 2, "file_current_version": 3,
                    "released_revision_id": ME, "released_code": "B", "created_at": TS,
                    "out_of_date": out_of_date })
        };
        let sim_result = |name: &str, status: &str, upper: Option<f64>| {
            json!({ "id": ME, "revision_id": OTHER, "position": 1, "name": name, "value": 182.5,
                    "unit": "MPa", "lower_limit": null, "upper_limit": upper, "load_case": "LC1",
                    "solver": "CalculiX", "solver_version": "2.21", "note": "", "updated_at": TS,
                    "status": status })
        };
        let basis_roles: Vec<_> = crate::domain::BasisRole::ALL
            .iter()
            .map(|r| json!({ "value": r.as_str(), "label": r.label() }))
            .collect();
        for (state, checked_out) in [("in_work", false), ("released", false)] {
            let mut rev = revision(state, checked_out);
            rev["item_type"] = json!("simulation");
            rev["item_number"] = json!("SIM-000001");
            let mut sim_item = item();
            sim_item["item_type"] = json!("simulation");
            let editable = state == "in_work";
            let html = render(
                &env,
                "revisions/show.html",
                with_common(json!({
                    "files_hint": files_hint(if editable { "upload" } else { "frozen" }),
                    "rev": rev.clone(), "item": sim_item, "revisions": [rev.clone(), revision("released", false)],
                    "hidden": { "parents": 0, "incoming": 0, "changes": 0, "simulations": 0 },
                    "is_latest": true, "latest_id": OTHER, "files": [], "native_without_preview": false,
                    "lines": [], "where_used": [], "changes": [], "open_change": null, "drafts": [],
                    "history": [], "projects": [], "units": units(), "references": references.clone(),
                    "impact_groups": [], "resolved_impacts": [],
                    "simulation": {
                        "bases": [basis(Some("PRT-000001/B was released (simulated: A)")), basis(None)],
                        "results": [sim_result("Max. stress <vM>", "pass", Some(250.0)),
                                    sim_result("Safety factor", "fail", None),
                                    sim_result("Mass", "none", None)],
                        "summary": { "total": 3, "pass": 1, "fail": 1, "without_limits": 1 },
                        "out_of_date": 1, "roles": basis_roles.clone(),
                        "views": [{ "id": ME, "filename": "beam <load>.vtu", "version": 2 }],
                        "images": [{ "id": ME, "filename": "pressure <p>.png", "version": 1, "sha256": "ab" }],
                        "can_decide": true,
                        "proposals": [{ "id": OTHER, "revision_id": ME, "name": "Mass flow <p>", "value": 2.25, "unit": "kg/s",
                                        "lower_limit": null, "upper_limit": 3.0, "load_case": "", "solver": "", "solver_version": "",
                                        "source_file": "report <1>.pdf", "source_version": 2, "quote": "mass flow 2.25 kg/s",
                                        "status": "pending", "proposed_by": ME, "proposed_by_name": "Erika", "created_at": TS }],
                    },
                    "based_simulations": [],
                    "can": if editable { can_all.clone() } else { json!({}) }, "max_upload_mb": 512,
                    "lifecycle": {
                        "states": crate::domain::LifecycleState::ALL,
                        "next": crate::domain::rules_from(crate::domain::LifecycleState::parse(state).unwrap()),
                        "rules": crate::domain::LIFECYCLE_RULES,
                    },
                })),
            );
            for expected in [
                "Based on",
                "B was released (simulated: A)",
                "bracket.step",
                "fillet &lt;r2&gt;",
                "Out of date",
                "Up to date",
                "Max. stress &lt;vM&gt;",
                "badge badge-pass",
                "badge badge-fail",
                "1 failed",
                "no limit",
                "/simulation/compare",
                "/simulation/results.csv",
                "View result in 3D",
                "beam &lt;load&gt;.vtu v2",
                "class=\"sim-gallery\"",
                "Proposed from reports",
                "Mass flow &lt;p&gt;",
                "report &lt;1&gt;.pdf",
                "/simulation-proposals/",
                "pressure &lt;p&gt;.png",
            ] {
                assert!(html.contains(expected), "simulation page shows {expected}");
            }
            assert!(!html.contains("id=\"bom\""), "no BOM card for simulations");
            assert!(!html.contains("id=\"simulations\""));
            assert_eq!(
                html.contains("/simulation/results/import") && html.contains("/simulation/bases"),
                editable,
                "editing only while checked out"
            );
        }
        let html = render(
            &env,
            "revisions/show.html",
            with_common(json!({
                "files_hint": files_hint("hidden"),
                "rev": revision("released", false), "item": item(), "revisions": [revision("released", false)],
                "hidden": { "parents": 0, "incoming": 0, "changes": 0, "simulations": 1 },
                "is_latest": true, "latest_id": OTHER, "files": [], "native_without_preview": false,
                "lines": [], "where_used": [], "changes": [], "open_change": null, "drafts": [],
                "history": [], "projects": [], "units": units(), "references": references.clone(),
                "impact_groups": [], "resolved_impacts": [], "simulation": null,
                "based_simulations": [{
                    "simulation_item_id": OTHER, "simulation_number": "SIM-000001", "simulation_code": "A",
                    "simulation_state": "in_work", "simulation_name": "Bracket – static <LC1>",
                    "result_count": 3, "failed_count": 1, "open_impact_id": ME,
                    "basis": basis(Some("PRT-000001/B was released (simulated: A)")) }],
                "can": {}, "max_upload_mb": 512,
                "lifecycle": {
                    "states": crate::domain::LifecycleState::ALL,
                    "next": crate::domain::rules_from(crate::domain::LifecycleState::Released),
                    "rules": crate::domain::LIFECYCLE_RULES,
                },
            })),
        );
        for expected in [
            "id=\"simulations\"",
            "SIM-000001/A",
            "Bracket – static &lt;LC1&gt;",
            "1 of 3 failed",
            "check open",
            "Out of date",
        ] {
            assert!(html.contains(expected), "part page shows {expected}");
        }
        // As-built: build record and deviations of an as-built revision
        let lifecycle = |state: &str| {
            json!({
                "states": crate::domain::LifecycleState::ALL,
                "next": crate::domain::rules_from(crate::domain::LifecycleState::parse(state).unwrap()),
                "rules": crate::domain::LIFECYCLE_RULES,
            })
        };
        let kinds: Vec<_> = crate::domain::DeviationKind::ALL
            .iter()
            .map(|k| json!({ "value": k.as_str(), "label": k.label() }))
            .collect();
        let dispositions: Vec<_> = crate::domain::Disposition::ALL
            .iter()
            .map(|d| json!({ "value": d.as_str(), "label": d.label() }))
            .collect();
        let deviation = |feature: &str, disposition: &str| {
            json!({ "id": ME, "revision_id": OTHER, "position": 1, "kind": "dimension",
                    "feature": feature, "designed": "12.000 +0.018/0", "built": "12.035 <m>",
                    "disposition": disposition, "note": "", "created_by_name": "Erika",
                    "created_at": TS, "updated_at": TS })
        };
        for (state, restricted) in [("in_work", false), ("released", true)] {
            let mut rev = revision(state, false);
            rev["item_type"] = json!("as_built");
            rev["item_number"] = json!("AB-000001");
            let mut unit_item = item();
            unit_item["item_type"] = json!("as_built");
            let editable = state == "in_work";
            let html = render(
                &env,
                "revisions/show.html",
                with_common(json!({
                    "files_hint": files_hint(if editable { "upload" } else { "frozen" }),
                    "rev": rev.clone(), "item": unit_item, "revisions": [rev.clone()],
                    "hidden": { "parents": 0, "incoming": 0, "changes": 0, "simulations": 0, "units": 0 },
                    "is_latest": true, "latest_id": OTHER, "files": [], "native_without_preview": false,
                    "lines": [], "where_used": [], "changes": [], "open_change": null, "drafts": [],
                    "history": [], "projects": [], "units": units(), "references": references.clone(),
                    "impact_groups": [], "resolved_impacts": [], "simulation": null,
                    "based_simulations": [], "built_units": [], "can_be_built_to": false,
                    "as_built": {
                        "record": {
                            "revision_id": OTHER, "design_item_id": ME,
                            "design_number": if restricted { "restricted item" } else { "ASM-000003" },
                            "design_type": "assembly", "design_revision_id": ME, "design_code": "B",
                            "design_state": "released", "design_name": "Gearbox <g>",
                            "serial_number": "SN <0042>", "built_on": "2026-11-02", "note": "",
                            "updated_by_name": "Erika", "updated_at": TS, "released_code": "C",
                            "newer_design": if restricted { Value::Null } else { json!("ASM-000003/C is released (built to: B)") },
                            "restricted": restricted,
                        },
                        "deviations": [deviation("Bore <Ø12>", "open"), deviation("Flange", "scrap")],
                        "summary": { "total": 2, "open": 1, "use_as_is": 0, "rework": 0, "repair": 0, "scrap": 1 },
                        "kinds": kinds.clone(), "dispositions": dispositions.clone(),
                    },
                    "can": if editable { can_all.clone() } else { json!({}) }, "max_upload_mb": 512,
                    "lifecycle": lifecycle(state),
                })),
            );
            for expected in [
                "id=\"as-built\"",
                "Built to",
                "SN &lt;0042&gt;",
                "2026-11-02",
                "Deviations from the design",
                "1 open",
                "Bore &lt;Ø12&gt;",
                "12.035 &lt;m&gt;",
            ] {
                assert!(html.contains(expected), "as-built page shows {expected}");
            }
            assert_eq!(
                html.contains("ASM-000003/B") && html.contains("/bom/compare?with="),
                !restricted,
                "a hidden design is a placeholder"
            );
            assert_eq!(
                html.contains("/as-built/record") && html.contains("/as-built/deviations"),
                editable,
                "editing only while checked out"
            );
            assert!(!html.contains("id=\"built-units\""));
        }
        // the design side: units built to the item
        let html = render(
            &env,
            "revisions/show.html",
            with_common(json!({
                "files_hint": files_hint("frozen"),
                "rev": revision("released", false), "item": item(), "revisions": [revision("released", false)],
                "hidden": { "parents": 0, "incoming": 0, "changes": 0, "simulations": 0, "units": 2 },
                "is_latest": true, "latest_id": OTHER, "files": [], "native_without_preview": false,
                "lines": [{ "id": ME, "child_number": "PRT-000009", "child_latest_revision_id": OTHER, "child_name": "Screw", "child_code": "A" }], "where_used": [], "changes": [], "open_change": null, "drafts": [],
                "history": [], "projects": [{ "id": ME, "code": "ROCKET", "name": "Rocket" }],
                "units": units(), "references": references.clone(),
                "impact_groups": [], "resolved_impacts": [], "simulation": null, "as_built": null,
                "based_simulations": [], "can_be_built_to": true,
                "built_units": [{
                    "unit_item_id": OTHER, "unit_number": "AB-000001", "unit_revision_id": OTHER,
                    "unit_code": "A", "unit_state": "in_work", "unit_name": "Bracket – SN <7>",
                    "serial_number": "SN-7", "built_on": null, "design_revision_id": ME,
                    "design_code": "A", "deviation_count": 3, "open_count": 2,
                    "newer_design": "PRT-000001/B is released (built to: A)" }],
                "can": {}, "max_upload_mb": 512,
                "lifecycle": lifecycle("released"),
            })),
        );
        for expected in [
            "id=\"built-units\"",
            "AB-000001/A",
            "Bracket – SN &lt;7&gt;",
            "Older revision",
            "2 open",
            "+2 units in groups you cannot see",
            "Record a built unit",
            "Copy the BOM of B",
        ] {
            assert!(html.contains(expected), "part page shows {expected}");
        }
        let diff = |change: &str, before: Value, after: Value, delta: Value| {
            json!({ "change": change, "name": "Stress <max>", "load_case": "LC1", "unit": "MPa",
                    "before": before, "after": after, "delta": delta,
                    "delta_percent": if delta.is_null() { Value::Null } else { json!(-10.0) } })
        };
        let html = render(
            &env,
            "revisions/simulation_compare.html",
            with_common(json!({
                "rev": revision("in_work", false), "before": revision("released", false),
                "after": revision("in_work", false), "revisions": [revision("released", false)],
                "diffs": [diff("changed", sim_result("Stress", "fail", Some(150.0)),
                               sim_result("Stress", "pass", Some(250.0)), json!(-20.0)),
                          diff("added", Value::Null, sim_result("Mass", "none", None), Value::Null),
                          diff("removed", sim_result("Old", "pass", Some(1e9)), Value::Null, Value::Null)],
                "summary": { "added": 1, "removed": 1, "changed": 1, "unchanged": 0 },
            })),
        );
        assert!(html.contains("1 added · 1 removed · 1 changed · 0 unchanged"));
        assert!(html.contains("Stress &lt;max&gt;") && html.contains("-10 %"));
        assert!(html.contains("badge badge-fail") && html.contains("badge badge-pass"));

        // 3D preview: the server delivers the mesh, the page only draws it
        let preview = |format: &str, is_current: bool| {
            let mut shown = version(1, "first <draft>");
            shown["id"] = json!(ME);
            with_common(json!({
                "file": file.clone(), "shown": shown, "is_current": is_current,
                "versions": [version(2, "wall 2.5 mm"), version(1, "first <draft>")],
                "rev": revision("released", false),
                "format": format, "is_brep": format == "step", "is_points": format == "las",
                "is_result": format == "vtk-unstructured",
            }))
        };
        let html = render(
            &env,
            "files/preview.html",
            preview("vtk-unstructured", true),
        );
        assert!(html.contains("coloured by a result field"), "result hint");
        let html = render(&env, "files/preview.html", preview("stl", true));
        assert!(html.contains(&format!("data-src=\"/file-versions/{ME}/mesh\"")));
        assert!(!html.contains("viewer-stl"), "no STL export of an STL file");
        assert!(html.contains("/static/shared/v/") && html.contains("/js/viewer.js\""));
        assert!(html.contains("first &lt;draft&gt;"), "comments are escaped");
        let html = render(&env, "files/preview.html", preview("step", false));
        assert!(html.contains("older version"));
        assert!(html.contains("tessellated"), "STEP hint");
        assert!(
            html.contains("id=\"viewer-stl\"") && html.contains("data-name=\"nozzle.step\""),
            "STL export of STEP models"
        );
        let html = render(&env, "files/preview.html", preview("las", true));
        assert!(
            !html.contains("viewer-stl"),
            "no STL export of a point cloud"
        );
        render(
            &env,
            "revisions/edit.html",
            with_common(
                json!({ "rev": revision("in_work", false), "error": null, "materials": [] }),
            ),
        );
        let html = render(
            &env,
            "revisions/edit.html",
            with_common(json!({
                "rev": revision("in_work", false), "error": null,
                "materials": [{ "name": "Alu <7075>", "label": "2810 kg/m³" }],
                "attribute_fields": [
                    { "key": "vendor", "label": "Vendor", "unit": "", "data_type": "choice",
                      "choices": ["Bosch", "SKF"], "value": "Old <Ltd>" },
                    { "key": "rohs", "label": "RoHS", "unit": "", "data_type": "boolean", "choices": [], "value": "yes" },
                    { "key": "length", "label": "Length", "unit": "mm", "data_type": "number", "choices": [], "value": "12.5" },
                ],
            })),
        );
        assert!(html.contains("name=\"attr.vendor\"") && html.contains("Length [mm]"));
        assert!(
            html.contains("<datalist id=\"material-options\"><option value=\"Alu &lt;7075&gt;\">2810 kg&#x2f;m³</option></datalist>")
                && html.contains("data-material-hint"),
            "material suggestions are escaped"
        );
        assert!(
            html.contains("Old &lt;Ltd&gt; (no longer a choice)"),
            "removed choices stay selectable"
        );
        assert!(html.contains("<option value=\"yes\" selected>"));
        render(
            &env,
            "revisions/edit.html",
            with_common(json!({
                "rev": revision("in_work", false), "error": "Mass: 'x' is not a number.", "mass_raw": "x", "cost_raw": "", "materials": []
            })),
        );

        let node = json!({
            "line_id": ME, "level": 2, "find_number": 10, "quantity": 2.0, "notes": "", "item_id": OTHER,
            "item_number": "PRT-000002", "item_type": "part", "unit": "each",
            "revision": { "id": OTHER, "code": "A", "state": "released", "name": "Bolt", "mass_kg": 0.01, "unit_cost": 0.2 },
            "unit_mass_kg": 0.01, "total_mass_kg": 0.02, "unit_cost_total": 0.2, "total_cost": 0.4,
            "mass_complete": true, "cost_complete": false, "cycle": false, "children": []
        });
        let mut unresolved = node.clone();
        unresolved["revision"] = Value::Null;
        unresolved["level"] = json!(9);
        let child = |status: &str, label: &str| {
            json!({ "item_id": OTHER, "item_number": "PRT-000004", "item_name": "Bolt <M6>",
                    "quantity": 4.0, "quantity_text": "4", "bom_quantity_text": "2", "quantity_source": "cad_instances", "quantity_label": "CAD instances",
                    "via": "A.SLDASM → bolt.SLDPRT", "status": status, "status_label": label,
                    "bom_quantity": 2.0, "selected": status == "new" })
        };
        let from_refs = render(
            &env,
            "revisions/bom_from_references.html",
            with_common(json!({
                "rev": revision("in_work", false), "editable": true, "can_checkout": false, "differs": true,
                "plan": { "children": [child("new", "new line"), child("differs", "differs")],
                          "not_in_teamcraft": [{ "name": "ghost.SLDPRT", "via": "A.SLDASM" }],
                          "hidden": 2, "excluded": ["glue.SLDPRT"] },
            })),
        );
        assert!(from_refs.contains("Bolt &lt;M6&gt;") && from_refs.contains("BOM 2, CAD 4"));
        assert!(from_refs.contains("Not in TeamCraft") && from_refs.contains("2 hidden item(s)"));
        assert!(from_refs.contains("Add the ticked lines"));
        let not_out = render(
            &env,
            "revisions/bom_from_references.html",
            with_common(json!({
                "rev": revision("in_work", false), "editable": false, "can_checkout": true, "differs": false,
                "plan": { "children": [child("new", "new line")], "not_in_teamcraft": [], "hidden": 0, "excluded": [] },
            })),
        );
        assert!(not_out.contains("Check out and create"));
        let bom_html = render(
            &env,
            "revisions/bom.html",
            with_common(json!({
                "rev": revision("released", false), "rule": "released",
                "tree": { "total_mass_kg": 1.5, "total_cost": 10.0, "mass_complete": false, "cost_complete": true,
                          "line_count": 2, "unresolved_count": 1, "restricted_lines": 1,
                          "rollup_incomplete": true },
                "rows": [
                    { "level": 2, "indent": "\u{2003}", "has_children": false, "node": node },
                    { "level": 9, "indent": "", "has_children": false, "node": unresolved }
                ],
            })),
        );
        assert!(
            bom_html.contains("/package.zip?rule=released")
                && bom_html.contains("Pack and Go (ZIP)"),
            "Pack and Go with the selected rule"
        );

        render(
            &env,
            "changes/list.html",
            with_common(json!({
                "changes": [change("in_review")], "status": "in_review",
                "statuses": [{ "value": "draft", "label": "Draft" }], "pagination": page(),
            })),
        );
        render(
            &env,
            "changes/new.html",
            with_common(json!({
                "form": { "title": "", "description": "", "priority": "normal", "revision_id": OTHER },
                "error": null, "priorities": ["low", "normal"], "revision": revision("in_work", false),
            })),
        );
        for status in ["draft", "in_review", "rejected", "released"] {
            let html = render(
                &env,
                "changes/show.html",
                with_common(json!({
                    "change": change(status), "status_label": "Draft",
                    "hidden_dependents": 1,
                    "implements": [request("accepted")],
                    "items": [{ "revision_id": OTHER, "item_id": ME, "item_number": "PRT-000001", "code": "A",
                                "name": "Bracket", "state": "in_work", "checked_out_by_name": "Erika" }],
                    "reviews": [{ "reviewer_id": OTHER, "reviewer_username": "erika", "reviewer_name": "Erika",
                                  "decision": "approved", "comment": "ok", "decided_at": TS, "absent": null,
                                  "sign_off_method": "password", "sign_off_meaning": "approved as <owner>" },
                                 { "reviewer_id": ME, "reviewer_username": "gone", "reviewer_name": "Gone <G>",
                                  "decision": "pending", "comment": "", "decided_at": null, "absent": "deactivated" }],
                    "replacements": [user()], "review_round": 2,
                    "earlier_rounds": [{ "round": 1, "reviewer_id": OTHER, "reviewer_username": "erika", "reviewer_name": "Erika",
                                         "decision": "rejected", "comment": "<too thin>", "decided_at": TS, "closed_at": TS }],
                    "candidates": [user()], "history": [audit_entry()], "priorities": ["low", "normal"],
                    "suggested": [{ "user_id": OTHER, "username": "max", "display_name": "Max <M>", "role": "editor",
                                    "score": 7, "reasons": ["edited PRT-000001 3 times in the last 90 days",
                                                            "manager of ROVER"] },
                                  { "user_id": ME, "username": "erika", "display_name": "Erika", "role": "editor",
                                    "score": 5, "cannot_review": true, "reasons": ["edited PRT-000001 once in the last 90 days"] }],
                    "impact": [{ "root_item_id": ME, "level": 1, "item_id": OTHER, "item_number": "ASM-000001",
                                 "item_name": "Stage", "revision_id": OTHER, "revision_code": "A",
                                 "revision_state": "released", "relation": "bom", "via_number": "PRT-000001",
                                 "in_change": false }],
                    "can": { "modify": true, "edit_text": true, "submit": true, "withdraw": true, "reopen": true,
                             "cancel": true, "review": true, "replace_reviewer": true, "take_over": true },
                    "sign_off": { "reauth": "release", "rejections_too": false, "sso": false,
                                  "reauthenticated": false, "window_minutes": 10 },
                })),
            );
            assert!(
                html.contains("name=\"password\"") && html.contains("name=\"meaning\""),
                "{status}: a fresh sign-in is asked for"
            );
            assert!(
                html.contains("signed off with password")
                    && html.contains("approved as &lt;owner&gt;"),
                "{status}: the sign-off of a decision"
            );
            assert!(
                html.contains("Earlier rounds")
                    && html.contains("Cannot decide: deactivated")
                    && html.contains("&lt;too thin&gt;")
                    && html.contains("/reviewers/"),
                "{status}: rounds and absent reviewers"
            );
            assert!(
                html.contains("/take-over\""),
                "{status}: a manager takes over a deactivated author's change"
            );
            if status == "in_review" {
                let mut ctx = json!({
                    "change": change(status), "status_label": "In review",
                    "reviews": [{ "reviewer_id": ME, "reviewer_username": "gone", "reviewer_name": "Gone <G>",
                                  "decision": "pending", "comment": "", "decided_at": null, "absent": "deactivated" }],
                    "replacements": [user()], "review_round": 1, "earlier_rounds": [],
                    "items": [], "candidates": [], "history": [], "priorities": ["low", "normal"],
                    "suggested": [], "impact": [],
                    "can": { "modify": false, "review": false, "replace_reviewer": true },
                });
                let html = render(&env, "changes/show.html", with_common(ctx.take()));
                assert!(
                    html.contains("/replace") && html.contains("Substitute for"),
                    "the replace form of an absent reviewer"
                );
            }
            assert!(
                html.contains("Impact analysis") && html.contains("uses PRT-000001 in its BOM"),
                "impact analysis on the change page"
            );
            assert!(
                html.contains("Implements") && html.contains("ECR-000001"),
                "the change page names the request it implements"
            );
            assert!(
                html.contains("Suggested reviewers")
                    && html.contains("Add Max &lt;M&gt;")
                    && html.contains("name=\"username\" value=\"max\"")
                    && html.contains(
                        "edited PRT-000001 3 times in the last 90 days; manager of ROVER"
                    ),
                "suggested reviewers with their reasons"
            );
        }

        // change requests (ECR)
        let html = render(
            &env,
            "requests/list.html",
            with_common(json!({
                "requests": [request("new"), request("implemented")],
                "filter": { "status": "open", "scope": "mine", "item": "PRT-000001" },
                "statuses": crate::domain::RequestStatus::ALL.iter()
                    .map(|s| json!({ "value": s.as_str(), "label": s.label() })).collect::<Vec<_>>(),
                "base_query": "status=open&scope=mine&item=PRT-000001", "pagination": page(),
            })),
        );
        assert!(html.contains("ECR-000001") && html.contains("Crack &lt;at&gt; the weld"));
        assert!(html.contains("value=\"mine\" selected") && html.contains("In Triage"));
        let reasons = json!(crate::domain::RequestReason::ALL
            .iter()
            .map(|r| json!({ "value": r.as_str(), "label": r.label() }))
            .collect::<Vec<_>>());
        let html = render(
            &env,
            "requests/new.html",
            with_common(json!({
                "form": { "title": "", "description": "Found in nozzle.step:\n\n", "reason": "defect",
                          "priority": "normal", "due_date": "", "item_number": "", "revision_id": OTHER,
                          "note": "File: nozzle.step" },
                "error": "Title must not be empty.", "priorities": ["low", "normal"], "reasons": reasons,
                "revision": revision("released", false),
            })),
        );
        assert!(html.contains("PRT-000001/B") && html.contains("File: nozzle.step"));
        assert!(html.contains("value=\"defect\" selected") && html.contains("Raise request"));
        let request_item = json!({
            "item_id": ME, "item_number": "PRT-000001", "item_type": "part", "project_id": ROCKET,
            "project_code": "ROCKET", "revision_id": OTHER, "revision_code": "B", "revision_state": "released",
            "name": "Bracket <b>", "latest_revision_id": OTHER, "latest_code": "C", "latest_state": "in_work",
            "note": "weld seam" });
        let attachment = |ct: &str, name: &str| {
            json!({ "id": OTHER, "request_id": ME, "filename": name, "content_type": ct, "size_bytes": 2048,
                    "sha256": "ab".repeat(32), "uploaded_by": ME, "uploaded_by_name": "Max", "uploaded_at": TS })
        };
        let can_all = json!({ "edit": true, "start_triage": true, "decide": true, "assign": true, "reopen": true,
                              "withdraw": true, "implement": true, "comment": true, "attach": true });
        for status in [
            "new",
            "in_triage",
            "accepted",
            "rejected",
            "deferred",
            "implemented",
            "withdrawn",
        ] {
            let html = render(
                &env,
                "requests/show.html",
                with_common(json!({
                    "request": request(status), "status_label": "New", "reason_label": "Defect / error",
                    "hidden_changes": 1,
                    "items": [request_item.clone()], "in_work": [request_item.clone()],
                    "comments": [{ "id": OTHER, "author_id": OTHER, "author_name": "Erika",
                                   "body": "Seen on <three> parts", "created_at": TS }],
                    "attachments": [attachment("image/png", "crack.png"), attachment("application/pdf", "report.pdf")],
                    "images": [attachment("image/png", "crack.png")],
                    "changes": [change("draft")], "open_changes": [change("draft")], "candidates": [user()],
                    "history": [audit_entry()], "watching": false, "can": can_all.clone(),
                    "priorities": ["low", "normal"], "reasons": reasons.clone(), "max_attachment_mb": 10,
                })),
            );
            for expected in [
                "Crack &lt;at&gt; the weld",
                "Seen on &lt;three&gt; parts",
                "Create change order",
                "PRT-000001/C",
                "Link an open change order",
                "name=\"decision\" value=\"accept\"",
                "/request-attachments/",
                "?inline=1",
                "enctype=\"multipart/form-data\"",
                "CHG-000001",
                "weld seam",
            ] {
                assert!(
                    html.contains(expected),
                    "request page ({status}) shows {expected}"
                );
            }
            // deferred → deferred is no transition: no Defer button then
            assert_eq!(
                html.contains("name=\"decision\" value=\"defer\""),
                status != "deferred",
                "request page ({status}): Defer button"
            );
        }

        let html = render(
            &env,
            "projects/list.html",
            with_common(json!({
                "projects": [project()], "my_projects": [ROCKET], "review_due": [],
                "manager_gaps": [
                    { "project_id": ROCKET, "code": "ROCKET", "name": "Sounding <rocket>", "kind": "none",
                      "active_managers": 0, "last_active_at": null },
                    { "project_id": OTHER, "code": "ROVER", "name": "Rover", "kind": "stale",
                      "active_managers": 2, "last_active_at": TS },
                ],
                "manager_gap_ids": [ROCKET, OTHER], "stale_days": 90,
            })),
        );
        assert!(html.contains("Groups without an active manager"));
        assert!(html.contains("Sounding &lt;rocket&gt; –") && html.contains("no active manager"));
        assert!(html.contains("2 active managers, none seen for 90 days"));
        assert!(html.contains("href=\"#manager-gaps\""), "the row is marked");
        let html = render(
            &env,
            "projects/list.html",
            with_common(json!({
                "projects": [project()], "my_projects": [ROCKET], "review_due": [],
                "manager_gaps": [], "manager_gap_ids": [], "stale_days": 90,
            })),
        );
        assert!(!html.contains("manager-gaps"));
        let html = render(
            &env,
            "projects/access_review.html",
            with_common(json!({
                "project_id": OTHER, "max_note": 1000,
                "report": { "project_code": "ROVER", "project_name": "Rover <x>", "generated_at": TS,
                    "admin_read": "with_reason", "administrators_outside": 2, "stale_days": 90,
                    "members": [{ "username": "erika", "display_name": "Erika", "role": "editor", "manager": true,
                                  "source": "oidc", "active": true, "added_at": TS, "last_login_at": null, "stale": true,
                                  "conditions_met": false }],
                    "conditions": { "required_claims": [{ "claim": "site", "values": ["a", "b"] }],
                                    "allowed_networks": [], "max_signin_age_hours": null },
                    "elevations": [{ "id": OTHER, "project_id": OTHER, "user_id": OTHER, "username": "root", "reason": "audit <b>",
                                    "started_at": TS, "expires_at": TS, "ended_at": null, "active": false }],
                    "reviews": [{ "id": OTHER, "username": "root", "note": "ok", "reviewed_at": TS,
                                  "admin_read": "none", "member_count": 1 }],
                    "schedule": { "interval_days": 90, "last_review_at": TS, "next_review_at": TS, "due": true } },
            })),
        );
        assert!(html.contains("no sign-in for 90 days") && html.contains("audit &lt;b&gt;"));
        assert!(html.contains("review of this group is due") && html.contains("every 90 days"));
        assert!(html.contains("is one of a, b") && html.contains("not met"));
        let entry = json!({ "id": OTHER, "at": TS, "user_id": OTHER, "username": "erika",
                            "channel": "assistant", "kind": "view", "object_type": "item",
                            "object_id": OTHER, "label": "PRT-1 <x>", "client_address": "192.0.2.4",
                            "detail": "get_bom" });
        let html = render(
            &env,
            "projects/access_log.html",
            with_common(json!({
                "project": project(), "entries": [entry],
                "query": { "user": "erika", "kind": "view", "channel": "assistant", "object": null,
                           "since": "2026-11-01", "until": null, "limit": null, "before": null },
                "next_link": "/projects/x/access-log?user=erika&before=y", "first_page_link": null,
                "filtered": true, "read_log": true, "error": null, "collapse_minutes": 5,
                "kinds": [{ "value": "view", "label": "View" }],
                "channels": [{ "value": "assistant", "label": "Assistant" }],
            })),
        );
        assert!(html.contains("PRT-1 &lt;x&gt;") && html.contains("get_bom"));
        assert!(html.contains("Older entries") && !html.contains("Newest entries"));
        assert!(html.contains("value=\"assistant\" selected"));
        let html = render(
            &env,
            "projects/access_log.html",
            with_common(json!({
                "project": project(), "entries": [], "query": {}, "next_link": null,
                "first_page_link": "/projects/x/access-log", "filtered": false, "read_log": false,
                "error": "since must be a date", "collapse_minutes": 5, "kinds": [], "channels": [],
            })),
        );
        assert!(
            html.contains("the log of this group is off") && html.contains("since must be a date")
        );
        let html = render(
            &env,
            "projects/show.html",
            with_common(json!({
                "project": project(),
                "members": [{ "user_id": OTHER, "username": "erika", "display_name": "Erika", "role": "editor",
                              "active": true, "source": "oidc", "added_at": TS, "manager": true, "checkouts": 0 },
                            { "user_id": "33333333-3333-4333-8333-333333333333", "username": "lena", "display_name": "Lena <gone>", "role": "editor",
                              "active": false, "source": "oidc", "added_at": TS, "manager": false, "checkouts": 40 }],
                "former_holders": [{ "user_id": OTHER, "username": "tom", "display_name": "Tom <left>",
                                     "active": true, "checkouts": 3 }],
                "candidates": [user()], "is_member": true, "can_edit": true, "oidc_enabled": true,
                "can_manage": true,
                "result_templates": [{ "id": OTHER, "project_id": OTHER, "name": "Pressure <drop>", "file_pattern": "*.log",
                                       "method": "regex", "pattern": "dp:\\s*([0-9.]+)", "csv_column": "", "csv_key_column": "",
                                       "csv_key_value": "", "pick": "last", "unit": "Pa", "lower_limit": null,
                                       "upper_limit": 500.0, "load_case": "", "solver": "", "enabled": true }],
                "numbering": { "scheme": "{PROJECT}-{TYPE}-{YYYY}-{SEQ:4}", "is_default": false,
                               "next": [{ "item_type": "part", "label": "Part", "number": "ROCKET-PRT-2026-0001" }] },
                "scheme_input": "{PROJECT}-{TYPE}-{YYYY}-{SEQ:4}", "previewing": true,
                "scheme_error": "Invalid numbering scheme 'x': <bad>", "default_scheme": "{TYPE}-{SEQ:6}",
            })),
        );
        assert!(html.contains("CAD editor"));
        assert!(html.contains("via IdP group"));
        assert!(html.contains("Pressure &lt;drop&gt;") && html.contains("/result-templates/"));
        assert!(html.contains("Add template"), "managers add templates");
        assert!(html.contains("manager"), "project managers are marked");
        assert!(html.contains("Add member"), "managers add members");
        assert!(html.contains("/demote\""), "managers demote managers");
        assert!(
            html.contains("/season\""),
            "managers find the season handover"
        );
        let season = render(
            &env,
            "projects/season.html",
            with_common(json!({
                "project": project(),
                "members": [
                    { "user_id": OTHER, "username": "erika", "display_name": "Erika", "role": "editor",
                      "active": true, "source": "oidc", "manager": true, "checkouts": 0,
                      "last_active_at": TS, "expires_at": null, "expired": false },
                    { "user_id": ME, "username": "lena", "display_name": "Lena <gone>", "role": "editor",
                      "active": false, "source": "manual", "manager": false, "checkouts": 40,
                      "last_active_at": null, "expires_at": "2026-07-31", "expired": true },
                ],
                "chosen": [ME], "inactive_since": "2026-08-01",
                "release_reason": { "min": 10, "max": 500 }, "max_members": 500,
            })),
        );
        assert!(season.contains("Lena &lt;gone&gt;") && season.contains("expired"));
        assert!(season.contains(&format!("name=\"release\" value=\"{ME}\"")));
        assert!(
            season.contains(&format!(
                "name=\"remove\" value=\"{ME}\" aria-label=\"Remove lena\" checked"
            )),
            "a member whose membership expired is ticked"
        );
        assert!(
            !season.contains(&format!(
                "name=\"remove\" value=\"{OTHER}\" aria-label=\"Remove erika\" checked"
            )),
            "an active member is not"
        );
        assert!(season.contains("value=\"2026-08-01\""));
        assert!(
            html.contains("Release 40 check-outs") && html.contains("Lena &lt;gone&gt;"),
            "a deactivated member's check-outs can be released"
        );
        assert!(
            html.contains("/members/33333333-3333-4333-8333-333333333333/remove\""),
            "a deactivated member's IdP membership can be removed"
        );
        assert!(
            !html.contains(&format!("/members/{OTHER}/remove\"")),
            "an active member's IdP membership cannot"
        );
        assert!(
            html.contains("Former members still holding") && html.contains("Release 3 check-outs"),
            "former holders are listed"
        );
        assert!(
            html.contains("ROCKET-PRT-2026-0001"),
            "next numbers are shown"
        );
        assert!(html.contains("preview – not saved"));
        assert!(html.contains("value=\"{PROJECT}-{TYPE}-{YYYY}-{SEQ:4}\""));
        assert!(html.contains("&lt;bad&gt;"), "scheme errors are escaped");
        assert!(html.contains("/numbering\""), "managers edit the scheme");
        let html = render(
            &env,
            "projects/show.html",
            with_common(json!({
                "project": project(), "members": [], "candidates": [], "is_member": true,
                "can_edit": true, "oidc_enabled": false, "can_manage": true, "readable": true,
                "result_templates": [],
                "policy": { "admin_read": "implicit", "access": { "read_log": true, "log_retention_days": 90,
                    "review_interval_days": 120,
                    "interfaces": { "api_tokens": true, "mcp": false, "assistant": true, "webhooks": true, "packages": true } },
                    "conditions": { "required_claims": [{ "claim": "site", "values": ["main-office"] }],
                                    "allowed_networks": ["10.0.0.0/8", "192.168.1.0/24"], "max_signin_age_hours": 12 } },
                "review_schedule": { "interval_days": 120, "last_review_at": null, "next_review_at": TS, "due": true },
                "claim_lines": "site = main-office, <x>", "my_address": "10.1.2.3",
                "admin_modes": [{ "value": "implicit", "label": "Implicit" }],
                "interface_rows": [{ "name": "mcp", "label": "MCP <server>", "allowed": false }],
                "access_entries": [{ "id": OTHER, "at": TS, "username": "erika", "channel": "api", "kind": "download",
                    "label": "<b>secret.step</b>", "client_address": "10.0.0.1", "detail": "" }],
                "numbering": { "scheme": "{TYPE}-{SEQ:6}", "is_default": true, "next": [] },
                "scheme_input": "", "previewing": false, "scheme_error": null, "default_scheme": "{TYPE}-{SEQ:6}",
            })),
        );
        assert!(
            html.contains("/access\""),
            "managers edit the interfaces and the log"
        );
        assert!(html.contains("MCP &lt;server&gt;"));
        assert!(
            html.contains("&lt;b&gt;secret.step"),
            "log labels are escaped"
        );
        assert!(html.contains("access review due") && html.contains("value=\"120\""));
        assert!(html.contains("/access-log\""), "the whole log is linked");
        assert!(html.contains("/conditions\"") && html.contains("main-office, &lt;x&gt;"));
        assert!(html.contains("10.1.2.3") && html.contains("value=\"12\""));
        let html = render(
            &env,
            "admin/users.html",
            with_common(json!({
                "users": [user()], "roles": roles(),
                "oidc": { "admin_group": "a", "editor_group": "e", "viewer_group": null },
                "idle_sso_days": 90,
                "idle_sso": [{
                    "user_id": ME, "username": "lena", "display_name": "Lena <L>",
                    "last_login_at": null, "last_active_at": TS, "idp_logout_at": TS,
                    "memberships": 2, "tokens": 1, "checkouts": 40,
                }],
            })),
        );
        assert!(html.contains("SSO users without sign-in") && html.contains("90 days"));
        assert!(html.contains("Lena &lt;L&gt;"), "names are escaped");
        assert!(html.contains(&format!("/users/{ME}/holdings\"")));
        assert!(html.contains(">never<") && html.contains(">40<"));
        let html = render(
            &env,
            "admin/user_edit.html",
            with_common(json!({
                "user": user(), "roles": roles(), "oidc_enabled": false, "memberships": [project()],
                "handover_targets": [user()], "held_checkouts": 40, "sole_manager_of": ["CHASSIS"],
                "tokens": [{ "id": ME, "name": "ci", "token_prefix": "tc_pat_abc123", "created_at": TS,
                             "last_used_at": null, "expires_at": TS, "scope": "full", "idle_days": null },
                           { "id": ME, "name": "desktop", "token_prefix": "tc_pat_def456", "created_at": TS,
                             "last_used_at": TS, "expires_at": TS, "scope": "read_only", "idle_days": 30 }],
            })),
        );
        assert!(html.contains("/offboard\"") && html.contains("only active manager of CHASSIS"));
        assert!(html.contains("name=\"confirm_no_manager\"") && html.contains("API tokens (2)"));
        let html = render(
            &env,
            "admin/holdings.html",
            with_common(json!({
                "nothing": false,
                "h": {
                    "user_id": OTHER, "username": "lena", "display_name": "Lena <left>", "active": false,
                    "last_login_at": null, "scope": "all",
                    "checkouts": { "total": 40, "shown": [{ "revision_id": OTHER, "item_number": "PRT-000007",
                        "code": "B", "name": "Upright <x>", "project_code": "CHASSIS", "checked_out_at": TS }] },
                    "hidden_checkouts": [{ "project_code": "NTK", "count": 2 }],
                    "authored_changes": { "total": 1, "shown": [{ "id": OTHER, "number": "CO-0031",
                        "title": "Stiffer upright", "status": "rejected" }] },
                    "pending_reviews": { "total": 0, "shown": [] },
                    "assigned_requests": { "total": 1, "shown": [{ "id": OTHER, "number": "CR-0004",
                        "title": "Crack", "status": "in_triage" }] },
                    "raised_requests": { "total": 0, "shown": [] },
                    "owned_items": { "total": 1, "shown": [{ "id": OTHER, "number": "PRT-000007",
                        "name": "Upright", "project_code": null }] },
                    "memberships": [{ "project_id": OTHER, "project_code": "CHASSIS", "project_name": "Chassis",
                        "source": "oidc", "manager": true, "only_active_manager": true }],
                    "tokens": [{ "id": ME, "name": "desktop", "token_prefix": "tc_pat_def456", "created_at": TS,
                        "last_used_at": null, "expires_at": TS, "scope": "full", "idle_days": 30 }],
                },
            })),
        );
        assert!(html.contains("Lena &lt;left&gt;") && html.contains("Upright &lt;x&gt;"));
        assert!(html.contains("The first 1 of 40") && html.contains("the only active manager"));
        assert!(html.contains("2 check-outs in") && html.contains("CO-0031"));
        let html = render(
            &env,
            "admin/holdings.html",
            with_common(json!({
                "nothing": true,
                "h": {
                    "user_id": OTHER, "username": "tom", "display_name": "Tom", "active": true,
                    "last_login_at": TS, "scope": "managed",
                    "checkouts": { "total": 0, "shown": [] }, "hidden_checkouts": [],
                    "authored_changes": { "total": 0, "shown": [] },
                    "pending_reviews": { "total": 0, "shown": [] },
                    "assigned_requests": { "total": 0, "shown": [] },
                    "raised_requests": { "total": 0, "shown": [] },
                    "owned_items": { "total": 0, "shown": [] },
                    "memberships": [], "tokens": null,
                },
            })),
        );
        assert!(html.contains("holds nothing that blocks") && !html.contains("API tokens"));
        assert!(html.contains("Only what lies in the project groups you manage"));
        render(
            &env,
            "admin/audit.html",
            with_common(json!({
                "entries": [audit_entry()], "filter": { "entity_type": "item", "username": null, "action": null },
                "base_query": "entity_type=item", "pagination": page(), "per_page": 50,
            })),
        );
        // mass properties: a full report, editable and read-only settings
        let mass_line = |source: &str, warnings: Value| {
            json!({ "level": 1, "find_number": 10, "item_number": "PRT-000002",
                    "revision_id": OTHER, "revision_code": "A", "name": "Fin <x>", "quantity": 4.0,
                    "factor": 1.0, "source": source, "source_label": source,
                    "detail": "fin.stl (mm) × 2810 kg/m³ (Aluminium 7075-T6)",
                    "unit_mass_kg": 0.0425, "total_mass_kg": 0.17, "cg_m": [1.2, 0.0, 1e-9],
                    "warnings": warnings })
        };
        let report = json!({
            "rule": "latest", "root_revision_id": ME, "root_label": "ASM-000001/A", "root_name": "Vehicle",
            "root_source": "assembly", "root_detail": "", "reference_m": [0.0, 0.0, 0.0],
            "mass_kg": 12.5, "placed_mass_kg": 12.4, "unplaced_mass_kg": 0.1,
            "cg_m": [1.234567, 0.0001, -0.002], "inertia_cg": [0.1, 5.2, 5.3, 1e-6, 0.0, -2e-4],
            "inertia_ref": [0.1, 24.0, 24.1, 1e-6, 0.0, -2e-4], "principal_moments": [5.3, 5.2, 0.1],
            "lines": [mass_line("computed", json!([])), mass_line("missing", json!(["no density <x>"])),
                      mass_line("restricted", json!([]))],
            "line_count": 3, "restricted_lines": 1, "missing_lines": 1, "complete": false,
            "warnings": ["1 restricted line left out."], "lines_with_warnings": 1,
        });
        let geometry_file = json!({ "id": OTHER, "revision_id": ME, "filename": "fin.stl", "sha256": "ab",
                                    "format": "stl", "length_unit": null, "instances": 4 });
        for (editable, measured) in [(true, true), (false, false)] {
            let settings = json!({
                "settings": { "revision_id": ME, "density_kg_m3": if measured { json!(2810.0) } else { Value::Null },
                              "geometry_file_id": OTHER,
                              "measured_mass_kg": if measured { json!(1.5) } else { Value::Null },
                              "measured_cg_m": if measured { json!([1.0, 0.0, 0.0]) } else { Value::Null },
                              "measured_inertia_kg_m2": null, "measured_note": "scale <A>" },
                "files": [geometry_file.clone()], "geometry_file_id": OTHER,
                "material": if measured { json!({ "id": OTHER, "name": "AlMg3", "density_kg_m3": 2660.0,
                                                  "notes": "", "created_at": TS, "updated_at": TS }) } else { Value::Null },
            });
            let html = render(
                &env,
                "revisions/mass.html",
                with_common(json!({
                    "rev": revision("in_work", editable), "rule": "latest", "report": report,
                    "reference": "0,0,0", "reference_error": if editable { Value::Null } else { json!("bad point") },
                    "settings": settings, "chosen": geometry_file, "chosen_unit": "mm",
                    "units": [{ "value": "mm" }, { "value": "m" }, { "value": "in" }],
                    "measured_cg": if measured { json!(["1", "0", "0"]) } else { json!([]) },
                    "measured_inertia": [], "editable": editable, "is_admin": false,
                })),
            );
            assert!(html.contains("Fin &lt;x&gt;") && html.contains("no density &lt;x&gt;"));
            assert!(html.contains("1.23457") && html.contains("mass.csv?rule=latest"));
            assert_eq!(html.contains("Save mass settings"), editable);
        }
        let empty_report = json!({
            "rule": "latest", "root_revision_id": ME, "root_label": "PRT-000001/B", "root_name": "Bracket",
            "root_source": "missing", "root_detail": "", "reference_m": [0.0, 0.0, 0.0],
            "mass_kg": 0.0, "placed_mass_kg": 0.0, "unplaced_mass_kg": 0.0, "cg_m": null,
            "inertia_cg": null, "inertia_ref": null, "principal_moments": null, "lines": [],
            "line_count": 0, "restricted_lines": 0, "missing_lines": 0, "complete": false,
            "warnings": [], "lines_with_warnings": 0,
        });
        let html = render(
            &env,
            "revisions/mass.html",
            with_common(json!({
                "rev": revision("released", false), "rule": "released", "report": empty_report,
                "reference": "0,0,0", "reference_error": null,
                "settings": { "settings": { "revision_id": ME, "density_kg_m3": null, "geometry_file_id": null,
                                            "measured_mass_kg": null, "measured_cg_m": null,
                                            "measured_inertia_kg_m2": null, "measured_note": "" },
                              "files": [], "geometry_file_id": null, "material": null },
                "chosen": null, "chosen_unit": null, "units": [], "measured_cg": [], "measured_inertia": [],
                "editable": false, "is_admin": false,
            })),
        );
        assert!(html.contains("No placed mass"));
        // files of several parts: the warning, the one-click choice (only
        // when editable) and the grouped selector
        for editable in [true, false] {
            let candidate = |id: &str, name: &str, likely: bool| json!({ "file_id": id, "filename": name, "format": "jt", "likely": likely, "used": false });
            let geometry = json!({
                "choice": "ambiguous", "file": null, "file_id": null, "other_formats": 0,
                "models": 2, "files": 3, "likely_file": "asm <1>.jt", "likely_file_id": OTHER,
                "candidates": [
                    { "model": "asm <1>", "files": [candidate(OTHER, "asm <1>.jt", true)] },
                    { "model": "fin", "files": [candidate(ME, "fin.jt", false)] },
                ],
            });
            let html = render(
                &env,
                "revisions/mass.html",
                with_common(json!({
                    "rev": revision("in_work", editable), "rule": "latest", "report": empty_report,
                    "reference": "0,0,0", "reference_error": null,
                    "settings": { "settings": { "revision_id": ME, "density_kg_m3": null, "geometry_file_id": null,
                                                "measured_mass_kg": null, "measured_cg_m": null,
                                                "measured_inertia_kg_m2": null, "measured_note": "" },
                                  "files": [], "geometry_file_id": null, "geometry": geometry,
                                  "material": null },
                    "chosen": null, "chosen_unit": null, "units": [], "measured_cg": [], "measured_inertia": [],
                    "editable": editable, "is_admin": false,
                })),
            );
            assert!(html.contains("Geometry ambiguous") && html.contains("asm &lt;1&gt;.jt"));
            assert_eq!(html.contains("/mass/geometry"), editable);
            assert_eq!(html.contains("<optgroup label=\"fin\">"), editable);
        }
        for is_admin in [true, false] {
            let html = render(
                &env,
                "materials.html",
                with_common(json!({
                    "materials": [{ "id": OTHER, "name": "Aluminium <7075>", "density_kg_m3": 2810.0,
                                    "notes": "handbook", "created_at": TS, "updated_at": TS }],
                    "is_admin": is_admin,
                })),
            );
            assert!(html.contains("Aluminium &lt;7075&gt;"));
            assert_eq!(html.contains("Add material"), is_admin);
        }
        render(
            &env,
            "materials.html",
            with_common(json!({ "materials": [], "is_admin": false })),
        );
        let attr_def = json!({
            "id": ME, "key": "vendor", "label": "Vendor <Lieferant>", "data_type": "choice",
            "unit": "", "choices": ["Bosch", "SKF"], "item_types": ["part"], "position": 10,
            "active": true, "created_at": TS,
        });
        let html = render(
            &env,
            "admin/attributes.html",
            with_common(json!({
                "rows": [{ "def": attr_def, "type_label": "Choice list" }],
                "data_types": [{ "value": "text", "label": "Text" }],
                "item_types": [{ "value": "part", "label": "Part", "checked": false }],
                "next_position": 20,
            })),
        );
        assert!(html.contains("Vendor &lt;Lieferant&gt;") && html.contains("2 choices"));
        let html = render(
            &env,
            "admin/attribute_edit.html",
            with_common(json!({
                "def": attr_def, "type_label": "Choice list", "choices_text": "Bosch\nSKF",
                "item_types": [{ "value": "part", "label": "Part", "checked": true }], "in_use": 3,
            })),
        );
        assert!(html.contains("3 revisions") && html.contains("Bosch\nSKF"));
        assert!(html.contains("value=\"part\" checked"));
        let webhook = json!({
            "id": ME, "name": "ERP <export>", "url": "https://erp.example.org/in?token=x",
            "secret_hint": "tc_whsec_…a1b2", "events": ["revision.released", "change.released"],
            "project_id": OTHER, "project_code": "ROVER", "active": true, "created_by": ME,
            "created_by_name": "Max", "created_at": TS, "updated_at": TS, "secret_rotated_at": TS,
            "pending": 2, "failed_recently": 1, "last_status": "failed", "last_delivery_at": TS,
            "host": "erp.example.org",
        });
        let events = json!(crate::domain::WebhookEvent::ALL
            .iter()
            .map(|e| json!({ "value": e.as_str(), "label": e.label(),
                             "on": *e == crate::domain::WebhookEvent::ChangeReleased }))
            .collect::<Vec<_>>());
        let projects = json!([{ "id": OTHER, "code": "ROVER", "name": "Planetary rover" }]);
        let html = render(
            &env,
            "admin/webhooks.html",
            with_common(json!({
                "webhooks": [webhook.clone()], "events": events.clone(), "projects": projects.clone(),
                "targets": { "allowed_hosts": [], "allow_private": false },
            })),
        );
        for expected in [
            "ERP &lt;export&gt;",
            "badge badge-failed",
            "1 failed in 7 days",
            "value=\"simulation.result_added\"",
            "TEAMCRAFT_WEBHOOK_ALLOWED_HOSTS",
        ] {
            assert!(html.contains(expected), "webhook list shows {expected}");
        }
        assert!(!html.contains("token=x"), "the list shows the host only");
        let delivery = |status: &str, attempts: i32, code: Option<i32>, error: &str| {
            json!({
                "id": OTHER, "webhook_id": ME, "event_id": ME, "event": "change.released",
                "payload": {}, "payload_text": "{\n  \"event\": \"change.released\" <x>\n}",
                "status": status, "attempts": attempts, "next_attempt_at": TS,
                "last_status_code": code, "last_error": error, "created_at": TS, "updated_at": TS,
                "delivered_at": if status == "sent" { json!(TS) } else { json!(null) },
            })
        };
        let html = render(
            &env,
            "admin/branding.html",
            with_common(json!({
                "slots": [
                    { "kind": "wide", "label": "Wide logo", "custom": "aaaabbbbcccc", "hint": "h" },
                    { "kind": "square", "label": "Square logo", "custom": null, "hint": "h" },
                ],
                "max_kib": 512, "max_pixels": 4096,
            })),
        );
        assert!(
            html.contains("/branding/wide?v=aaaabbbbcccc"),
            "custom wide logo in the header"
        );
        assert!(
            html.contains("/admin/branding/wide/reset"),
            "reset offered for a custom logo"
        );
        assert!(
            !html.contains("/admin/branding/square/reset"),
            "no reset for the built-in logo"
        );
        // Admin → AI in every mode: provider and model shown, the key never
        let company_ai = crate::config::AssistantConfig {
            provider: crate::config::AssistantProvider::Anthropic,
            base_url: "https://api.anthropic.com/v1".into(),
            api_key: Some("sk-ant-never-shown".into()),
            model: "claude-opus-5-5".into(),
            max_steps: 8,
            max_tokens: 4096,
            request_timeout: std::time::Duration::from_secs(60),
            run_timeout: std::time::Duration::from_secs(180),
            max_concurrent: 4,
            retention_days: 30,
            internal_urls: Vec::new(),
        };
        use crate::config::LocalAgents;
        // the notice, and what the desktop app's Agent view runs on
        for (agents, assistant, says, desktop) in [
            (
                LocalAgents::Off,
                Some(&company_ai),
                "Company AI only",
                "company AI (no local option)",
            ),
            (
                LocalAgents::Off,
                None,
                "users have no AI in TeamCraft",
                "a notice that AI is switched off",
            ),
            (
                LocalAgents::Allowed,
                Some(&company_ai),
                "TEAMCRAFT_LOCAL_AGENTS=off",
                "the user chooses: company AI or local agent",
            ),
            (
                LocalAgents::Allowed,
                None,
                "No assistant is configured",
                "<dd>local agent</dd>",
            ),
        ] {
            let html = render(
                &env,
                "admin/ai.html",
                with_common(crate::services::assistant::admin_overview(
                    agents, assistant,
                )),
            );
            assert!(html.contains(says), "{agents:?}: {says}");
            assert!(html.contains(desktop), "{agents:?}: {desktop}");
            assert!(!html.contains("sk-ant-never-shown"), "the key leaked");
            if assistant.is_some() {
                assert!(html.contains("claude-opus-5-5"), "model shown");
                assert!(html.contains("api.anthropic.com"), "host shown");
                assert!(html.contains("set (not shown)"));
            }
        }
        let html = render(
            &env,
            "admin/webhook_edit.html",
            with_common(json!({
                "webhook": webhook, "host": "erp.example.org", "secret": "tc_whsec_0123",
                "events": events, "projects": projects, "max_attempts": 8, "retention_days": 30,
                "targets": { "allowed_hosts": ["erp.example.org"], "allow_private": false },
                "deliveries": [
                    delivery("sent", 1, Some(200), ""),
                    delivery("pending", 2, Some(503), "HTTP 503"),
                    delivery("failed", 8, None, "connection failed: refused"),
                ],
            })),
        );
        for expected in [
            "tc_whsec_0123",
            "data-copy=\"webhook-secret\"",
            "tc_whsec_…a1b2",
            "badge badge-retrying",
            "badge badge-failed",
            "connection failed: refused",
            "&lt;x&gt;",
            "/deliveries/",
            "value=\"change.released\" checked",
            "selected>ROVER",
        ] {
            assert!(html.contains(expected), "webhook page shows {expected}");
        }
        assert!(
            !html.contains("HTTP 503 – HTTP 503"),
            "the status code once"
        );
        let html = render(
            &env,
            "desktop/authorize.html",
            with_common(json!({
                "req": { "port": 53682, "state": "abcdefghijklmnop", "challenge": "c".repeat(43),
                         "device": "Leo's <MacBook>" },
                "token_days": 30,
            })),
        );
        assert!(
            html.contains("Leo&#x27;s &lt;MacBook&gt;"),
            "device name is escaped"
        );
        assert!(html.contains("name=\"decision\" value=\"allow\""));
        let html = render(
            &env,
            "account.html",
            with_common(json!({
                "user": user(),
                "tokens": [{ "id": ME, "name": "assistant", "token_prefix": "tc_pat_abc123", "created_at": TS,
                             "last_used_at": null, "expires_at": null, "scope": "mcp_only", "idle_days": null }],
                "new_token": { "name": "ci", "value": "tc_pat_secret", "scope": "read_only" },
                "api_base": "http://localhost:8080/api/v1",
                "skins": crate::domain::SKINS,
                "cad_families": crate::cadformat::families().iter()
                    .map(|s| json!({ "id": s.id, "short": s.short, "name": s.name }))
                    .collect::<Vec<_>>(),
                "notify": {
                    "settings": { "email": true, "email_address": "max@example.org", "mattermost": false,
                                  "mattermost_username": null, "muted": ["item_update"] },
                    "kinds": crate::domain::NotificationKind::MUTABLE.iter().map(|k| json!({
                        "value": k.as_str(), "label": k.label(), "on": *k != crate::domain::NotificationKind::ItemUpdate
                    })).collect::<Vec<_>>(),
                    "email_enabled": true, "mattermost_enabled": false, "mattermost_direct": false,
                },
                "unread_notifications": 3,
            })),
        );
        assert!(html.contains("tc_pat_secret"));
        assert!(
            html.contains("action=\"/account/preferred-cad\"")
                && html.contains("value=\"nx\"")
                && html.contains("Siemens NX"),
            "preferred CAD program choice"
        );
        assert!(
            html.contains("“ci” (read-only)")
                && html.contains("MCP only")
                && html.contains("name=\"scope\""),
            "token scopes"
        );
        assert!(
            html.contains("value=\"review_requested\" checked")
                && html.contains("value=\"item_update\" >")
                && html.contains("max@example.org")
                && html.contains("Mattermost is not configured"),
            "notification settings"
        );
        assert!(
            html.contains("class=\"bell has-unread\"")
                && html.contains("<span class=\"bell-count\">3</span>"),
            "bell with the unread count"
        );
        let notes = render(
            &env,
            "notifications.html",
            with_common(json!({
                "notifications": [
                    { "id": ME, "kind": "review_requested", "title": "Review requested: CHG-000004 <x>",
                      "body": "Erika asks you to review PRT-000003/B.", "link": "/changes/1", "subject_type": "change",
                      "subject_ref": "CHG-000004", "actor_name": "Erika", "created_at": TS, "read_at": null,
                      "email_state": "sent", "chat_state": "failed", "chat_error": "Mattermost user \"x\" not found" },
                    { "id": OTHER, "kind": "impact", "title": "Check needed: ASM-000001", "body": "",
                      "link": "/revisions/1", "subject_type": "revision", "subject_ref": "ASM-000001/A",
                      "actor_name": "Rolf", "created_at": TS, "read_at": TS, "email_state": "none", "chat_state": "none" }],
                "watched": [{ "entity_type": "item", "entity_id": ME, "number": "PRT-000003", "name": "Bracket",
                              "state": "released", "link": "/revisions/1", "revision_code": "B" },
                            { "entity_type": "change", "entity_id": OTHER, "number": "CHG-000004", "name": "Wall",
                              "state": "in_review", "link": "/changes/1", "revision_code": null }],
                "email_enabled": true, "mattermost_enabled": true, "unread_notifications": 1,
            })),
        );
        for expected in [
            "Review requested: CHG-000004 &lt;x&gt;",
            "class=\"unread\"",
            "e-mailed",
            "Mattermost failed",
            &format!("/notifications/{ME}/open"),
            "Mark all as read",
            &format!("/items/{ME}/watch"),
            &format!("/changes/{OTHER}/watch"),
        ] {
            assert!(
                notes.contains(expected),
                "notifications page shows {expected}"
            );
        }

        let upload = render(
            &env,
            "imports/upload.html",
            with_common(json!({
                "target": null,
                "projects": [{ "id": ME, "code": "ROCKET", "name": "Rocket <stage>" }],
                "max_mib": 20,
            })),
        );
        assert!(
            upload.contains("enctype=\"multipart/form-data\"")
                && upload.contains("Rocket &lt;stage&gt;")
                && upload.contains("name=\"match_existing_sent\"")
                && upload.contains("name=\"project_id\""),
            "import upload form"
        );
        let into = render(
            &env,
            "imports/upload.html",
            with_common(json!({
                "target": { "id": ME, "item_number": "ASM-000001", "code": "A", "name": "Pump",
                            "project_code": "ROCKET" },
                "projects": [], "max_mib": 20,
            })),
        );
        assert!(
            into.contains(&format!("name=\"into\" value=\"{ME}\""))
                && !into.contains("name=\"project_id\""),
            "import into a checked-out revision"
        );
        let preview = render(
            &env,
            "imports/preview.html",
            with_common(json!({
                "id": OTHER,
                "plan": {
                    "filename": "pump <bom>.csv", "target": null, "root_label": "Pump",
                    "root_number": "ASM-PUMP", "root_name": "Pump", "project_code": "ROCKET",
                    "new_items": 2, "existing_items": 1, "lines": [{}, {}, {}],
                    "warnings": ["Row 4: <screw> appears again"],
                    "columns": [{ "header": "Part Number", "field": "number", "label": "Part number" }],
                    "attribute_columns": [{ "header": "Lieferant", "key": "vendor", "label": "Vendor" }],
                    "unused_columns": ["Cost <Center>"],
                },
                "rows": [
                    { "row": 2, "level": 1, "indent": "", "find_number": 1, "file_number": "HOUSING",
                      "number": "HOUSING", "existing": null, "type": "Assembly", "name": "Housing",
                      "quantity": 1.0, "unit": "each", "material": "AlMg3", "mass_kg": 0.8 },
                    { "row": 3, "level": 2, "indent": "indent-2", "find_number": 10,
                      "file_number": "ISO 4762 M6", "number": null, "existing": null, "type": "Part",
                      "name": "Screw", "quantity": 6.0, "unit": "each", "material": "", "mass_kg": null,
                      "classification": "Standard part", "attributes": [{ "key": "vendor", "label": "Vendor", "value": "Würth <GmbH>" }] },
                    { "row": 5, "level": 1, "indent": "", "find_number": 2, "file_number": "PRT-000001",
                      "number": "PRT-000001", "existing": "PRT-000001/B", "type": "Part",
                      "name": "Bracket", "quantity": 2.0, "unit": "each", "material": "", "mass_kg": null },
                ],
            })),
        );
        for expected in [
            "pump &lt;bom&gt;.csv",
            "<span class=\"mono\">ASM-PUMP</span>",
            &format!("/import/{OTHER}/run"),
            &format!("/import/{OTHER}/discard"),
            "Row 4: &lt;screw&gt; appears again",
            "indent-2",
            "new assembly",
            "generated",
            "PRT-000001&#x2f;B",
            "badge-released\">existing",
            "Attribute “Vendor”",
            "Cost &lt;Center&gt;",
            "standard part</span>",
            "Vendor: Würth &lt;GmbH&gt;",
            "<td>Part number</td>",
        ] {
            assert!(
                preview.contains(expected),
                "import preview shows {expected}"
            );
        }
        assert!(html.contains("<html lang=\"en\" data-skin=\"arch\">"));
        assert!(
            html.contains("data-skin=\"ubuntu\""),
            "skin picker lists every skin"
        );
        assert!(
            html.contains("skin-card selected"),
            "current skin is marked"
        );

        // the assistant: dashboard quick action, change briefing, answer page
        let dashboard = |enabled: bool| {
            let mut data = with_common(json!({
                "stats": { "items": 0, "revisions_in_work": 0, "revisions_in_review": 0, "revisions_released": 0,
                           "open_changes": 0, "files": 0, "stored_bytes": 0 },
                "checkouts": [], "reviews": [], "my_changes": [], "activity": [], "impact_groups": [],
            }));
            data["assistant_enabled"] = json!(enabled);
            render(&env, "dashboard.html", data)
        };
        let html = dashboard(true);
        for expected in [
            "id=\"assistant-toggle\"",
            "aria-controls=\"assistant-drawer\"",
            "id=\"assistant-drawer\"",
            "data-module=\"/static/shared/v/",
            "/js/assistant.js\"",
            "/static/shared/css/assistant.css?v=",
            "data-can-edit=\"1\"",
            "data-tc-kind=\"dashboard\"",
        ] {
            assert!(html.contains(expected), "the sidebar markup has {expected}");
        }
        let disabled = dashboard(false);
        assert!(
            !disabled.contains("assistant-drawer")
                && !disabled.contains("assistant-toggle")
                && !disabled.contains("assistant.css"),
            "hidden when disabled"
        );
        assert!(
            disabled.contains("data-tc-kind=\"dashboard\""),
            "the page context is declared either way"
        );

        let mut data = with_common(json!({
            "change": change("in_review"), "status_label": "In review", "items": [], "reviews": [],
            "candidates": [], "history": [], "priorities": ["low"], "impact": [], "hidden_dependents": 0,
            "can": { "modify": false, "edit_text": false, "submit": false, "withdraw": false, "reopen": false,
                     "cancel": false, "review": true },
        }));
        data["assistant_enabled"] = json!(true);
        let html = render(&env, "changes/show.html", data);
        assert!(
            html.contains("data-tc-kind=\"change\"")
                && html.contains("data-tc-change=\"CHG-000001\""),
            "a change order declares its number"
        );

        let answer = crate::assistant::render_markdown("## Scope\n- PRT-000001 <b>");
        // "Open 3D preview" links: checked by open_links, label escaped
        let links = crate::assistant::open_links(
            &[
                json!({ "url": "http://localhost:8080/files/0b9c3a3e-5d1f-4c9a-9e8b-1234567890ab/preview",
                        "item": "PRT-000001", "revision": "A", "file": "<script>x</script>.stl" }),
                json!({ "url": "https://evil.example/files/0b9c3a3e-5d1f-4c9a-9e8b-1234567890ab/preview",
                        "item": "PRT-000002", "revision": "A", "file": "evil.stl" }),
            ],
            "http://localhost:8080",
        );
        assert_eq!(links.len(), 1);
        let html = render(
            &env,
            "assistant.html",
            with_common(json!({
                "actions": [["review_brief", "Brief me for this review"]],
                "form": { "question": "Is it <ready>?", "item": "", "revision": "", "change": "CHG-000001" },
                "back": "/changes/x", "error": null,
                "run": { "label": "Brief me for this review", "html": answer, "text": "x", "truncated": true,
                         "tools": [{ "name": "get_change", "ok": true }, { "name": "bom_health", "ok": false }],
                         "steps": 3, "model": "claude-opus-5-5", "allow_drafts": false,
                         "links": links },
            })),
        );
        assert!(
            !html.contains("<script>x") && !html.contains("evil"),
            "the link is escaped and only to this server"
        );
        for expected in [
            "<a class=\"button small view-3d\" href=\"&#x2f;files&#x2f;0b9c3a3e-5d1f-4c9a-9e8b-1234567890ab&#x2f;preview\">Open 3D preview: PRT-000001&#x2f;A · &lt;script&gt;x&lt;&#x2f;script&gt;.stl</a>",
            "<h3>Scope</h3>",
            "<a href=\"/i/PRT-000001\">PRT-000001</a> &lt;b&gt;",
            "Is it &lt;ready&gt;?",
            "get_change",
            "badge badge-rejected",
            "3 steps",
            "read-only",
            "cut off",
            "changes&#x2f;x\" data-back>Back</a>",
        ] {
            assert!(html.contains(expected), "assistant page shows {expected}");
        }
        let html = render(
            &env,
            "assistant.html",
            with_common(json!({
                "actions": [["attention", "What needs my attention"]],
                "form": { "question": "", "item": "", "revision": "", "change": "" },
                "back": "/", "error": "Type a question first.", "run": null,
            })),
        );
        assert!(
            html.contains("Type a question first.") && html.contains("What needs my attention")
        );
    }

    fn units() -> Value {
        json!(crate::domain::COMMON_UNITS)
    }

    /// Every link to an embedded asset carries the asset version, so browsers
    /// never keep an outdated stylesheet, script or logo after an update:
    /// `?v=` or, for shared scripts, the versioned path (src/assets.rs).
    #[test]
    fn static_links_carry_the_asset_version() {
        for (name, source) in TEMPLATES {
            for (i, _) in source.match_indices("\"/static/") {
                let link = &source[i + 1..];
                let link = &link[..link.find('"').unwrap_or(link.len())];
                let versioned = link.starts_with("/static/shared/v/{{ assets }}/js/");
                assert!(
                    link.contains("?v={{ assets }}") || versioned,
                    "{name}: {link} has no ?v={{{{ assets }}}}"
                );
            }
        }
    }

    #[test]
    fn filters() {
        assert_eq!(
            filter_dt(Some("2026-11-03T14:05:59.123Z".into())),
            "2026-11-03 14:05 UTC"
        );
        assert_eq!(filter_dt(None), "—");
        assert_eq!(filter_num(Some(1.23456), None), "1.235");
        assert_eq!(filter_num(Some(2.0), Some(2)), "2");
        assert_eq!(filter_num(None, None), "—");
        assert_eq!(filter_sig(Some(12.345678)), "12.3457");
        assert_eq!(filter_sig(Some(0.0425)), "0.0425");
        assert_eq!(filter_sig(Some(-1234.5)), "-1234.5");
        assert_eq!(filter_sig(Some(2.5e-7)), "2.50000e-7");
        assert_eq!(filter_sig(Some(0.0)), "0");
        assert_eq!(filter_sig(Some(f64::NAN)), "—");
        assert_eq!(filter_sig(None), "—");
        assert_eq!(filter_fixed(Some(41.0), None), "41.00");
        assert_eq!(filter_fixed(Some(0.2), Some(3)), "0.200");
        assert_eq!(filter_fixed(None, Some(3)), "—");
        assert_eq!(filter_label(Some("in_work".into())), "WIP");
        assert_eq!(filter_label(Some("in_review".into())), "In Review");
        assert_eq!(filter_label(Some("released".into())), "Released");
    }
}