<?php

declare(strict_types=1);

it('passes shared canonical control references through tenant review composition', function (): void {
    [$user, $tenant] = createUserWithTenant(role: 'owner');
    $snapshot = seedTenantReviewEvidence($tenant, findingCount: 0, driftCount: 1);

    $review = composeTenantReviewForTest($tenant, $user, $snapshot);
    $openRisks = $review->sections->firstWhere('section_key', 'open_risks');
    $executiveSummary = $review->sections->firstWhere('section_key', 'executive_summary');

    expect($review->canonicalControlReferences())->toHaveCount(1)
        ->and($review->canonicalControlReferences()[0]['control_key'])->toBe('endpoint_hardening_compliance')
        ->and($executiveSummary->summary_payload['canonical_control_count'])->toBe(1)
        ->and($executiveSummary->summary_payload['canonical_controls'][0]['control_key'])->toBe('endpoint_hardening_compliance')
        ->and($openRisks->summary_payload['canonical_controls'])->toBe([]);
});