[
  { "id": "T001", "description": "Unit: `DiagnosticsReport` schema includes required fields (summary, steps, recommendations, supportBundle).", "implemented": false, "featureIds": ["F005"] },
  { "id": "T002", "description": "Unit: diagnostics runner returns ordered steps with stable step ids.", "implemented": false, "featureIds": ["F005", "F008"] },
  { "id": "T003", "description": "Unit: redaction hides access token content and only exposes fingerprint/length.", "implemented": false, "featureIds": ["F007", "F003"] },
  { "id": "T004", "description": "Unit: redaction hides client secret values in all outputs and exports.", "implemented": false, "featureIds": ["F007", "F003"] },
  { "id": "T005", "description": "Unit: support bundle export redacts mailbox identifiers by default (configurable via option).", "implemented": false, "featureIds": ["F023", "F003"] },
  { "id": "T006", "description": "Unit: admin-only guard rejects non-admin invocation of diagnostics server entrypoint.", "implemented": false, "featureIds": ["F006", "F004"] },
  { "id": "T007", "description": "Integration: diagnostics entrypoint returns 404/validation error when providerId does not exist or is not a Microsoft provider.", "implemented": false, "featureIds": ["F004"] },
  { "id": "T008", "description": "Unit: each Graph request adds a unique `client-request-id` header.", "implemented": false, "featureIds": ["F009", "F008"] },
  { "id": "T009", "description": "Unit: Graph `request-id` is captured from success responses and surfaced in step details.", "implemented": false, "featureIds": ["F009"] },
  { "id": "T010", "description": "Unit: Graph `request-id` is captured from error responses and surfaced in step details.", "implemented": false, "featureIds": ["F009"] },

  { "id": "T011", "description": "Unit: token-exists step returns fail when provider has no stored tokens.", "implemented": false, "featureIds": ["F010"] },
  { "id": "T012", "description": "Unit: token-expiry step returns warn when expiry is unknown; pass when expiry is in the future; warn/fail when expired.", "implemented": false, "featureIds": ["F010"] },
  { "id": "T013", "description": "Unit: token-claims step extracts `tid` and delegated `scp` claim when present.", "implemented": false, "featureIds": ["F011"] },
  { "id": "T014", "description": "Unit: token-claims step handles missing/invalid JWT gracefully (warn + recommendation).", "implemented": false, "featureIds": ["F011", "F019"] },

  { "id": "T015", "description": "Integration: `/me` step passes and records principal identifiers when Graph returns 200.", "implemented": false, "featureIds": ["F012"] },
  { "id": "T016", "description": "Integration: `/me` step fails with 401 and produces recommendation to re-authorize when token is invalid/expired.", "implemented": false, "featureIds": ["F012", "F019", "F020"] },

  { "id": "T017", "description": "Unit: mailbox base path decision chooses `/me` when configured mailbox equals authenticated user email (case-insensitive).", "implemented": false, "featureIds": ["F013"] },
  { "id": "T018", "description": "Unit: mailbox base path decision chooses `/users/{mailbox}` when configured mailbox differs from authenticated user email.", "implemented": false, "featureIds": ["F013"] },
  { "id": "T019", "description": "Unit: mailbox base path decision records rationale in step details for the UI.", "implemented": false, "featureIds": ["F013", "F002"] },

  { "id": "T020", "description": "Integration: mailbox directory existence check passes when `GET /users/{mailbox}` returns 200.", "implemented": false, "featureIds": ["F014"] },
  { "id": "T021", "description": "Integration: mailbox directory existence check classifies 404 as mailbox not found and recommends verifying mailbox address/tenant.", "implemented": false, "featureIds": ["F014", "F019", "F020"] },
  { "id": "T022", "description": "Integration: mailbox directory existence check classifies 403 as insufficient directory permission and recommends verifying delegated access.", "implemented": false, "featureIds": ["F014", "F019", "F020"] },

  { "id": "T023", "description": "Integration: Inbox well-known folder check uses `.../mailFolders/inbox` and passes when folder exists.", "implemented": false, "featureIds": ["F015"] },
  { "id": "T024", "description": "Integration: Inbox check failing with 404 ‘store not found’ yields recommendation about mailbox type/provisioning.", "implemented": false, "featureIds": ["F015", "F019", "F020"] },
  { "id": "T025", "description": "Integration: Inbox check failing with 403 yields recommendation about shared mailbox permissions.", "implemented": false, "featureIds": ["F015", "F019", "F020"] },

  { "id": "T026", "description": "Integration: folder enumeration returns a non-empty list when mailbox folder access is available.", "implemented": false, "featureIds": ["F016"] },
  { "id": "T027", "description": "Integration: folder enumeration gracefully handles large folder sets via `$top` and reports truncation.", "implemented": false, "featureIds": ["F016", "F002"] },
  { "id": "T028", "description": "Integration: folder enumeration failing due to permission produces a targeted recommendation.", "implemented": false, "featureIds": ["F016", "F019", "F020"] },

  { "id": "T029", "description": "Unit: configured folder resolution matches by well-known name mapping (Inbox, SentItems, DeletedItems, etc.).", "implemented": false, "featureIds": ["F017"] },
  { "id": "T030", "description": "Unit: configured folder resolution matches by displayName case-insensitively when listing results include the folder.", "implemented": false, "featureIds": ["F017"] },
  { "id": "T031", "description": "Unit: configured folder resolution reports fail + recommendation when configured folder cannot be resolved.", "implemented": false, "featureIds": ["F017", "F020"] },

  { "id": "T032", "description": "Integration: message preflight GET succeeds for target resource and reports `messagesReadable=true`.", "implemented": false, "featureIds": ["F018"] },
  { "id": "T033", "description": "Integration: message preflight 403 yields recommendation about missing `Mail.Read`/mailbox access.", "implemented": false, "featureIds": ["F018", "F019", "F020"] },
  { "id": "T034", "description": "Integration: message preflight 404 yields recommendation about folder id/name mismatch or mailbox store not provisioned.", "implemented": false, "featureIds": ["F018", "F019", "F020"] },

  { "id": "T035", "description": "Unit: error classification maps 401 to ‘re-authorize’ recommendation.", "implemented": false, "featureIds": ["F019", "F020"] },
  { "id": "T036", "description": "Unit: error classification maps 403 to ‘insufficient permissions’ recommendation and mentions shared mailbox delegation.", "implemented": false, "featureIds": ["F019", "F020"] },
  { "id": "T037", "description": "Unit: error classification maps 404 mailbox-not-found to ‘verify mailbox/tenant’ recommendation.", "implemented": false, "featureIds": ["F019", "F020"] },
  { "id": "T038", "description": "Unit: error classification maps 404 inbox/store-not-found to ‘mailbox not provisioned / wrong object type’ recommendation.", "implemented": false, "featureIds": ["F019", "F020"] },
  { "id": "T039", "description": "Unit: error classification maps 429 to throttling warning and suggests retry/backoff.", "implemented": false, "featureIds": ["F019", "F021", "F020"] },

  { "id": "T040", "description": "Unit: recommendations deduplicate across multiple failing steps.", "implemented": false, "featureIds": ["F020"] },
  { "id": "T041", "description": "Unit: support bundle includes key facts (tenant id, provider id, mailbox base path, folder, notification URL) with secrets redacted.", "implemented": false, "featureIds": ["F027", "F003"] },
  { "id": "T042", "description": "Unit: support bundle includes step-level correlation IDs (`request-id`, `client-request-id`) where available.", "implemented": false, "featureIds": ["F022", "F009", "F003"] },

  { "id": "T043", "description": "E2E/UI: diagnostics button appears only for Microsoft providers and only for admin users.", "implemented": false, "featureIds": ["F001", "F006"] },
  { "id": "T044", "description": "E2E/UI: checklist renders with correct ordering and status icons for pass/warn/fail.", "implemented": false, "featureIds": ["F002"] },
  { "id": "T045", "description": "E2E/UI: expandable step details shows sanitized request context (method/path) and error code/status when failing.", "implemented": false, "featureIds": ["F002", "F027"] },
  { "id": "T046", "description": "E2E/UI: “Copy support bundle” copies a valid JSON blob and does not include raw token values.", "implemented": false, "featureIds": ["F003", "F007"] },
  { "id": "T047", "description": "E2E/UI: mailbox+folder+resource string is shown and copyable for support.", "implemented": false, "featureIds": ["F025"] },
  { "id": "T048", "description": "E2E/UI: help panel displays Microsoft 365 prerequisites and common fixes.", "implemented": false, "featureIds": ["F028"] },

  { "id": "T049", "description": "Unit: concurrency guard prevents running two diagnostics simultaneously for the same provider.", "implemented": false, "featureIds": ["F021"] },
  { "id": "T050", "description": "Unit: concurrency guard rate-limits repeated diagnostics runs per tenant.", "implemented": false, "featureIds": ["F021"] },

  { "id": "T051", "description": "Unit: baseline `/me` check result is clearly separated from shared mailbox checks in the report.", "implemented": false, "featureIds": ["F024", "F002"] },
  { "id": "T052", "description": "Integration: if `/me` passes but shared mailbox checks fail, recommendations explicitly point to shared mailbox permission configuration.", "implemented": false, "featureIds": ["F024", "F020"] },

  { "id": "T053", "description": "Unit: step logging includes provider id, tenant id, step id, duration, and sanitized outcome fields.", "implemented": false, "featureIds": ["F022"] },
  { "id": "T054", "description": "Unit: Graph request IDs are displayed prominently in UI for failing steps.", "implemented": false, "featureIds": ["F022", "F002"] },

  { "id": "T055", "description": "Integration (optional): live subscription test create+delete succeeds when enabled and does not leave residual subscriptions.", "implemented": false, "featureIds": ["F026"] }
]