foreach ($featDir in $featureDirsMap.Keys) {
    $featuresDirAbs = Join-Path $repoRoot "$featDir/tests/features"
    $contextFile = Join-Path $repoRoot "$featDir/context.json"
    $contextRelPath = "$featDir/context.json"

    # Extract all staged .feature files for this feature to temp dir
    $tempFeaturesDir = Join-Path ([System.IO.Path]::GetTempPath()) ([System.IO.Path]::GetRandomFileName())
    New-Item -ItemType Directory -Path $tempFeaturesDir -Force | Out-Null

    $stagedForFeat = $stagedFeatureFiles | Where-Object { $_ -match "^$([regex]::Escape($featDir))/" }
    foreach ($sf in $stagedForFeat) {
        if ([string]::IsNullOrEmpty($sf)) { continue }
        $basename = Split-Path $sf -Leaf
        try {
            $content = git show ":$sf" 2>$null
            if ($LASTEXITCODE -eq 0 -and -not [string]::IsNullOrEmpty($content)) {
                $content | Out-File -FilePath (Join-Path $tempFeaturesDir $basename) -Encoding utf8
            }
        } catch { continue }
    }

    # Compute combined hash of staged .feature files
    $currentHash = & $testifyScript compute-hash $tempFeaturesDir
    Remove-Item -Recurse -Force $tempFeaturesDir -ErrorAction SilentlyContinue

    if ($currentHash -eq "NO_ASSERTIONS") {
        continue
    }

    # Check if context.json is also being staged
    $contextStaged = $allStagedFiles | Where-Object { $_ -eq $contextRelPath -or $_ -eq ($contextRelPath -replace '\\', '/') }

    # Read context.json (staged or committed version)
    $contextStatus = "missing"
    $contextJson = $null
    if ($contextStaged -and (Test-Path $contextFile)) {
        $contextJson = Get-Content $contextFile -Raw -ErrorAction SilentlyContinue
    } else {
        try {
            $contextJson = git show "HEAD:$($contextRelPath -replace '\\', '/')" 2>$null
            if ($LASTEXITCODE -ne 0) { $contextJson = $null }
        } catch { $contextJson = $null }
    }

    if (-not [string]::IsNullOrEmpty($contextJson)) {
        try {
            $context = $contextJson | ConvertFrom-Json
            if ($context.testify -and $context.testify.assertion_hash) {
                $storedHash = $context.testify.assertion_hash
                $storedDir = if ($context.testify.PSObject.Properties.Name -contains 'features_dir') { $context.testify.features_dir } else { "" }

                if (-not [string]::IsNullOrEmpty($storedHash) -and -not [string]::IsNullOrEmpty($storedDir)) {
                    if ($storedHash -eq $currentHash) {
                        $contextStatus = "valid"
                    } else {
                        $contextStatus = "invalid"
                    }
                }
            }
        } catch {
            # Invalid JSON or missing fields — treat as missing
        }
    }

    # Combine results (git notes skipped for directory-based .feature files)
    $hashStatus = "missing"
    if ($contextStaged -and $contextStatus -eq "valid") {
        $hashStatus = "valid"
    } elseif ($contextStatus -eq "invalid") {
        $hashStatus = "invalid"
    } elseif ($contextStatus -eq "valid") {
        $hashStatus = "valid"
    }

    # Decision logic
    switch ($hashStatus) {
        "valid" {
            # PASS — silent
        }
        "invalid" {
            $blocked = $true
            $blockMessages += "BLOCKED: $featDir/tests/features/ - .feature assertion integrity check failed"
            $blockMessages += "  .feature file assertions have been modified since /iikit-05-testify generated them."
            $blockMessages += "  Re-run /iikit-05-testify to regenerate .feature files."
        }
        "missing" {
            if ($tddDetermination -eq "mandatory") {
                Write-Warning "[iikit] $featDir/tests/features/ - no stored assertion hash found (TDD is mandatory)"
                Write-Warning "[iikit]   If this is the initial testify commit, this is expected."
                Write-Warning "[iikit]   Otherwise, run /iikit-05-testify to generate integrity hashes."
            }
        }
    }
}

# Derive per-feature context.json path from the test-specs.md path
# test-specs.md is at specs/NNN-feature/tests/test-specs.md
# context.json is at specs/NNN-feature/context.json
$testsDir = Split-Path $stagedPath -Parent          # specs/NNN-feature/tests
$featureDir = Split-Path $testsDir -Parent           # specs/NNN-feature
$contextRelPath = Join-Path $featureDir "context.json"  # specs/NNN-feature/context.json
$contextFile = Join-Path $repoRoot $contextRelPath

# Check if this feature's context.json is also being staged
$contextStaged = $allStagedFiles | Where-Object { $_ -eq $contextRelPath -or $_ -eq ($contextRelPath -replace '\\', '/') }

# Extract staged version to a temp file (check what's being committed)
$tempFile = [System.IO.Path]::GetTempFileName()
try {
    $stagedContent = git show ":$stagedPath" 2>$null
    if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrEmpty($stagedContent)) {
        Remove-Item $tempFile -ErrorAction SilentlyContinue
        continue
    }
    $stagedContent | Out-File -FilePath $tempFile -Encoding utf8
} catch {
    Remove-Item $tempFile -ErrorAction SilentlyContinue
    continue
}

# Compute hash of the staged version
$currentHash = & $testifyScript compute-hash $tempFile
Remove-Item $tempFile -ErrorAction SilentlyContinue

# Skip if no assertions in the file
if ($currentHash -eq "NO_ASSERTIONS") {
    continue
}

# Check against context.json
# When staged (testify commit): read working tree. When NOT staged: read
# committed version from HEAD to prevent working-tree forgery (A8b attack).
$contextStatus = "missing"
$contextJson = $null
if ($contextStaged -and (Test-Path $contextFile)) {
    # Testify commit: read working tree (testify just wrote it)
    $contextJson = Get-Content $contextFile -Raw -ErrorAction SilentlyContinue
} else {
    # Not staged: read committed version from HEAD (tamper-resistant)
    try {
        $contextJson = git show "HEAD:$($contextRelPath -replace '\\', '/')" 2>$null
        if ($LASTEXITCODE -ne 0) { $contextJson = $null }
    } catch { $contextJson = $null }
}

if (-not [string]::IsNullOrEmpty($contextJson)) {
    try {
        $context = $contextJson | ConvertFrom-Json

        if ($context.testify -and $context.testify.assertion_hash) {
            $storedFile = ($context.testify.test_specs_file -replace '\\', '/')
            $storedHash = $context.testify.assertion_hash
            $normalizedStagedPath = ($stagedPath -replace '\\', '/')

            # Match by path: stored file must end with the staged path
            if ($storedFile -eq $normalizedStagedPath -or $storedFile.EndsWith("/$normalizedStagedPath")) {
                if ($storedHash -eq $currentHash) {
                    $contextStatus = "valid"
                } else {
                    $contextStatus = "invalid"
                }
            }
        }
    } catch {
        # Invalid JSON or missing fields — treat as missing
    }
}

# Check git notes (tamper-resistant)
# Search backward through recent commits to find the most recent testify note
# that matches THIS specific test-specs.md file (by path).
# Notes may contain multiple entries (separated by ---) for multi-feature commits.
$noteStatus = "missing"
$noteHash = $null
try {
    $recentCommits = git rev-list HEAD -50 2>$null
    if ($recentCommits) {
        foreach ($commitSha in ($recentCommits -split "`n")) {
            if ([string]::IsNullOrEmpty($commitSha)) { continue }
            $noteContent = git notes --ref="refs/notes/testify" show $commitSha 2>$null
            if ($LASTEXITCODE -eq 0 -and -not [string]::IsNullOrEmpty($noteContent)) {
                # Parse multi-entry notes: split by --- and find matching file
                $entries = ($noteContent -join "`n") -split '---'
                foreach ($entry in $entries) {
                    $entryLines = $entry.Trim() -split "`n"
                    $entryFile = ""
                    $entryHash = ""
                    foreach ($line in $entryLines) {
                        if ($line -match '^test-specs-file:\s*(.+)') { $entryFile = $Matches[1].Trim() }
                        if ($line -match '^testify-hash:\s*(.+)') { $entryHash = $Matches[1].Trim() }
                    }
                    if ($entryFile -eq $stagedPath -or $entryFile.EndsWith("/$stagedPath")) {
                        $noteHash = $entryHash
                        break
                    }
                }
                if (-not [string]::IsNullOrEmpty($noteHash)) { break }
                # Note exists but no matching file — keep searching older commits
            }
        }
    }
} catch {
    # Git notes not available — stay missing
}
if (-not [string]::IsNullOrEmpty($noteHash)) {
    if ($noteHash -eq $currentHash) {
        $noteStatus = "valid"
    } else {
        $noteStatus = "invalid"
    }
}

# Combine results
# When context.json is staged alongside test-specs.md and hashes match,
# this is a testify commit (new/updated assertions with fresh hash).
# The old git note from a previous testify run is expected to not match.
# When context.json is NOT staged, git note "invalid" overrides context "valid".
$hashStatus = "missing"
if ($contextStaged -and $contextStatus -eq "valid") {
    # Testify commit: context.json staged with matching hash -> trust it
    $hashStatus = "valid"
} elseif ($noteStatus -eq "invalid" -or $contextStatus -eq "invalid") {
    $hashStatus = "invalid"
} elseif ($noteStatus -eq "valid" -or $contextStatus -eq "valid") {
    $hashStatus = "valid"
}

# Decision logic
switch ($hashStatus) {
    "valid" {
        # PASS — silent
    }
    "invalid" {
        $blocked = $true
        $blockMessages += "BLOCKED: $stagedPath - assertion integrity check failed"
        $blockMessages += "  Assertions have been modified since /iikit-05-testify generated them."
        $blockMessages += "  Re-run /iikit-05-testify to regenerate test specifications."
    }
    "missing" {
        if ($tddDetermination -eq "mandatory") {
            Write-Warning "[iikit] $stagedPath - no stored assertion hash found (TDD is mandatory)"
            Write-Warning "[iikit]   If this is the initial testify commit, this is expected."
            Write-Warning "[iikit]   Otherwise, run /iikit-05-testify to generate integrity hashes."
        }
        # Allow in both cases
    }
}