The refund path that failed once a week

import java.util.*;
import java.util.stream.*;

/**
 * Solution: the refund path that failed once a week.
 *
 * Four defects. Two of them made the gate resolve the wrong version, and two
 * made it stay quiet about conflicts it was built to catch — which is why it
 * had been green for months while the classpath was wrong the whole time.
 */
public class Solution {

    record Dep(String artifact, String version, int depth, String via) {}
    record Requirement(String artifact, String neededBy) {}

    /* ── the gate, fixed ────────────────────────────────────────────────── */

    /*
     * Defect 1. String.compareTo put 2.9.0 above 2.17.1, because '9' sorts
     * after '1'. Every version that reached double digits resolved backwards,
     * and the gate reported success while downgrading the library.
     *
     * Compare numeric components, padding the shorter one with zeros so
     * 2.17 and 2.17.0 compare equal rather than by length.
     */
    static int compareVersions(String a, String b) {
        List<Integer> x = numericParts(a), y = numericParts(b);
        for (int i = 0; i < Math.max(x.size(), y.size()); i++) {
            int c = Integer.compare(i < x.size() ? x.get(i) : 0, i < y.size() ? y.get(i) : 0);
            if (c != 0) return c;
        }
        return 0;
    }

    /** "2.17.1-RELEASE" -> [2, 17, 1]. Qualifiers are dropped, not compared. */
    static List<Integer> numericParts(String version) {
        var out = new ArrayList<Integer>();
        for (String p : version.split("[.\\-]")) {
            var digits = p.replaceAll("\\D", "");
            if (!digits.isEmpty()) out.add(Integer.parseInt(digits));
        }
        return out;
    }

    /*
     * Defect 2. `managed` was accepted and never read, so every pin written in
     * dependencyManagement did nothing — including the ones added to fix
     * earlier incidents. A pin has to override the graph entirely: that is the
     * whole reason it is the right tool for this, since depth can move when an
     * unrelated dependency is added and a pin cannot.
     */
    static Dep resolve(List<Dep> candidates, Map<String, String> managed) {
        String artifact = candidates.get(0).artifact();
        String pinned = managed.get(artifact);
        if (pinned != null) {
            return new Dep(artifact, pinned, 0, "dependencyManagement");
        }
        return candidates.stream()
            .max((x, y) -> compareVersions(x.version(), y.version()))
            .orElseThrow();
    }

    /*
     * Defect 3. This returned an empty list, so the gate never failed a build.
     * Resolving a conflict silently is the default behaviour it was written to
     * replace — the point of the gate is to make disagreement visible while
     * someone can still choose deliberately.
     */
    static List<String> convergenceViolations(List<Dep> all) {
        Map<String, Set<String>> byArtifact = new TreeMap<>();
        for (Dep d : all)
            byArtifact.computeIfAbsent(d.artifact(), k -> new TreeSet<>()).add(d.version());

        return byArtifact.entrySet().stream()
            .filter(e -> e.getValue().size() > 1)
            .map(e -> {
                String paths = all.stream()
                    .filter(d -> d.artifact().equals(e.getKey()))
                    .map(d -> d.version() + " via " + d.via())
                    .collect(Collectors.joining("; "));
                return e.getKey() + " has " + e.getValue().size() + " versions: " + paths;
            })
            .toList();
    }

    /*
     * Defect 4. Exclusions were applied and nothing checked whether anything
     * still needed the artifact. That is how a version conflict gets "fixed"
     * into a NoClassDefFoundError — a strictly worse failure, because there is
     * no longer a version to compare against.
     *
     * An exclusion is a claim that a path does not need a dependency. This
     * verifies the claim instead of trusting it.
     */
    static List<String> applyExclusions(List<Dep> all, Set<String> excluded,
                                        List<Requirement> requirements) {
        all.removeIf(d -> excluded.contains(d.artifact()));
        Set<String> remaining = all.stream().map(Dep::artifact).collect(Collectors.toSet());

        return requirements.stream()
            .filter(r -> !remaining.contains(r.artifact()))
            .map(r -> r.neededBy() + " still needs " + r.artifact()
                    + ", which an exclusion removed from the classpath")
            .toList();
    }

    /* ── checks (unchanged from the starter) ────────────────────────────── */

    public static void main(String[] args) {
        List<String> failures = new ArrayList<>();

        {
            var candidates = List.of(
                new Dep("jackson-databind", "2.9.0",  2, "legacy-api"),
                new Dep("jackson-databind", "2.17.1", 3, "spring-boot-starter-web"));
            var picked = resolve(new ArrayList<>(candidates), Map.of());
            if (!picked.version().equals("2.17.1"))
                failures.add("1. highest-wins picked " + picked.version()
                           + " over 2.17.1 — versions are being compared as strings");
        }

        {
            var candidates = List.of(
                new Dep("commons-lang3", "3.4",  2, "report-service"),
                new Dep("commons-lang3", "3.12", 3, "audit-client -> http-toolkit"));
            var picked = resolve(new ArrayList<>(candidates), Map.of("commons-lang3", "3.8.1"));
            if (!picked.version().equals("3.8.1"))
                failures.add("2. dependencyManagement pinned 3.8.1 and the gate resolved "
                           + picked.version() + " — the pin is being ignored");
        }

        {
            var all = new ArrayList<>(List.of(
                new Dep("commons-lang3", "3.4",  2, "report-service"),
                new Dep("commons-lang3", "3.12", 3, "audit-client"),
                new Dep("guava",         "32.1", 2, "billing-client"),
                new Dep("slf4j-api",     "2.0.7",  2, "http-client"),
                new Dep("slf4j-api",     "2.0.13", 3, "metrics-agent")));
            var violations = convergenceViolations(all);
            boolean sawLang = violations.stream().anyMatch(v -> v.contains("commons-lang3"));
            boolean sawSlf4j = violations.stream().anyMatch(v -> v.contains("slf4j-api"));
            boolean sawGuava = violations.stream().anyMatch(v -> v.contains("guava"));
            if (!sawLang || !sawSlf4j)
                failures.add("3. convergence check reported " + violations.size()
                           + " violations; commons-lang3 and slf4j-api both have two versions");
            else if (sawGuava)
                failures.add("3. convergence check flagged guava, which only has one version");
        }

        {
            var all = new ArrayList<>(List.of(
                new Dep("commons-lang3", "3.4",  2, "report-service"),
                new Dep("commons-lang3", "3.12", 3, "audit-client")));
            var requirements = List.of(
                new Requirement("commons-lang3", "report-service"),
                new Requirement("commons-lang3", "audit-client"));
            var orphaned = applyExclusions(all, Set.of("commons-lang3"), requirements);
            if (orphaned.size() != 2)
                failures.add("4. excluding commons-lang3 left " + orphaned.size()
                           + " unmet requirements reported; two paths still need it");
        }

        if (failures.isEmpty()) {
            System.out.println("PASS");
        } else {
            failures.forEach(f -> System.out.println("  " + f));
            System.out.println("FAIL");
        }
    }
}