Chapter 14 Companion: Code, Explanations and Solutions

mvn --batch-mode verify
bash scripts/pipeline.sh
bash scripts/demo.sh
bash scripts/handover-check.sh

== visitors disabled ==
Visitors enabled: false
Student B1: Confirmed: R1 for B1 on CAM1 [2026-10-20, 2026-10-22).
Visitor V1: Rejected: visitor reservations are not enabled.
Visitor V2: Rejected: visitor reservations are not enabled.
Unknown U9: Rejected: borrower not found or inactive.
Outage BROKEN: Unavailable: Borrower directory unavailable
Reservations: 1
Notices: 1
== visitors enabled ==
Visitors enabled: true
Student B1: Confirmed: R1 for B1 on CAM1 [2026-10-20, 2026-10-22).
Visitor V1: Confirmed: R2 for V1 on CAM2 [2026-10-20, 2026-10-22).
Visitor V2: Rejected: no valid sponsor approval.
Unknown U9: Rejected: borrower not found or inactive.
Outage BROKEN: Unavailable: Borrower directory unavailable
Reservations: 2
Notices: 2

mvn --batch-mode test -Dtest=TraceabilityTest

# Chapter 14 checkpoint: handover version 0.14.0

Start with `docs/HANDOVER.md`: what this is, what you need, how to set it up, how to see it work, what is known to be missing.

Use a full Java 17 JDK and Maven 3.9.11. The JDK must include jdk.jdeps for the compiled dependency tests. From this directory:

```bash
mvn --batch-mode verify
bash scripts/pipeline.sh
bash scripts/demo.sh
```

The expected results, including the number of test invocations in each pipeline stage, are in `docs/HANDOVER.md`, which `scripts/handover-check.sh` checks in a fresh copy. `TraceabilityTest` fails the build if `docs/REQUIREMENTS-TO-EVIDENCE.md` names a test or class that no longer exists.

Version 0.14.0 changes no production behaviour. It adds the demonstration (`scripts/demo.sh`), the handover documents in `docs/`, a script that follows the handover in a fresh copy (`scripts/handover-check.sh`) and the rehearsed, not applied, removal of the visitor flag (`rehearsal/remove-visitor-flag.patch`, decided in `docs/ADR-014-flag-handover.md`). Known issues, with decisions, are in `docs/KNOWN-ISSUES.md`.

The visitor flag `lending.visitors` defaults to false. `scripts/simulate-release.sh` is a SIMULATION of delivery. `.github/workflows/pipeline.yml` has never run. No Java 17 run, hosted CI run or independent review is claimed.

The package `legacy` stands for the old records system's overdue report. It is isolated, like `patterns`, `behaviour` and `examples`: production code under `edu.se506.lending` must not refer to it, and DependencyRulesTest checks that. Only bootstrap launches it or feeds it rows. LoanRow is the old system's export format and is deliberately unchanged.

The optional bridge (OverdueRowSource, OverdueReportService and LoanSnapshotRows in bootstrap) feeds the report from the live loan and reservation snapshots. It reads one date and one snapshot per report, and a failure to read is never reported as zero overdue loans.

The directory `stages` holds the report at each step of the refactoring. It is not part of the Maven build. To run a stage, copy its OverdueReport.java over src/main/java/legacy/OverdueReport.java and run:

```bash
mvn --batch-mode -Dtest='OverdueReport*Test' test
```

Stages 1 to 4 each pass the same 28 invocations. Stage 0 is the code as found and cannot be tested without a change, because it reads the system clock. stageC is a separate functional change (unknown kinds are rejected) with its own replacement tests; to run it, copy all three of its files to their src locations.

The directory `probe` holds a program that runs the original, unseamed report beside the seamed one and compares their output. It is not part of the Maven build. From this directory, with stage 1 or the final report in place:

```bash
mkdir -p probe/out
javac --release 17 -d probe/out src/main/java/legacy/*.java probe/OriginalUnseamed.java probe/OriginalReportProbe.java
java -cp probe/out legacy.OriginalReportProbe
```

The characterisation tests record what the report does today. A passing characterisation test means unchanged, not correct. Four behaviours are recorded as suspected or surprising in docs/SUSPECTED-DEFECTS-legacy-overdue-report.md and are not fixed here. ADR-011 records the decision to pin, isolate and refactor the report.

To print the package metrics, run `mvn --batch-mode compile` and then `java tools/PackageMetrics.java target/classes`.

ADR-010 from Chapter 10 is still in docs. No hosted CI run and no peer review is claimed.

--- chapter13/pom.xml
+++ chapter14/pom.xml
@@ -4,7 +4,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>edu.se506</groupId>
   <artifactId>equipment-lending</artifactId>
-  <version>0.13.1</version>
+  <version>0.14.0</version>
   <properties>
     <maven.compiler.release>17</maven.compiler.release>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

#!/usr/bin/env bash
# A modest delivery pipeline run on one machine. Each stage must pass before the next one starts,
# and the first failing stage stops the run with a non-zero status. CHAPTER_MVN names the Maven
# command (default: mvn); CHAPTER_M2 optionally names a local Maven repository.
set -euo pipefail
cd "$(dirname "${BASH_SOURCE[0]}")/.."

MVN="${CHAPTER_MVN:-mvn}"
if ! command -v "$MVN" >/dev/null 2>&1 && [ ! -f "$MVN" ]; then
  echo "Maven was not found (looked for: $MVN). Install Maven 3.9.11, or set CHAPTER_MVN to its full path." >&2
  exit 2
fi
ARGS=(--batch-mode)
if [ -n "${CHAPTER_M2:-}" ]; then
  ARGS+=("-Dmaven.repo.local=${CHAPTER_M2}")
fi

stage() {
  local name="$1"
  shift
  echo "=== STAGE: ${name}"
  local began=$SECONDS
  "$@"
  echo "=== PASSED: ${name} ($((SECONDS - began)) s)"
}

stage "1 compile" "$MVN" "${ARGS[@]}" -q compile
stage "2 unit tests and architecture checks" "$MVN" "${ARGS[@]}" test -DexcludedGroups=integration,e2e
stage "3 integration tests (real file, real HTTP client, local stub service)" "$MVN" "${ARGS[@]}" test -Dgroups=integration
stage "4 end-to-end journeys (separate process)" "$MVN" "${ARGS[@]}" test -Dgroups=e2e
stage "5 package" "$MVN" "${ARGS[@]}" package -DskipTests
echo "PIPELINE PASSED"

#!/usr/bin/env bash
# This script does not enforce the pipeline's gates: it packages with -DskipTests and then runs only the
# end-to-end smoke journeys, so it assumes that scripts/pipeline.sh has already passed for the same candidate.
# Rollback assumes the same version-derived jar file name in both releases, so the exercise's two releases are
# two labels for one build and not a tested cross-version rollback.
#
# SIMULATION of continuous delivery to a staging target. Nothing here is a server, a network
# deployment or a production release: "staging" is a folder, "deploying" is copying a jar into it,
# and the smoke test is the end-to-end journeys run against the jar that was copied.
#
#   bash scripts/simulate-release.sh              build, deliver as the current release, smoke-test it
#   RELEASE_LABEL=v2 bash scripts/simulate-release.sh   deliver again; the old release becomes "previous"
#   bash scripts/simulate-release.sh rollback     make "previous" the current release again, smoke-test it
set -euo pipefail
cd "$(dirname "${BASH_SOURCE[0]}")/.."

MVN="${CHAPTER_MVN:-mvn}"
if ! command -v "$MVN" >/dev/null 2>&1 && [ ! -f "$MVN" ]; then
  echo "Maven was not found (looked for: $MVN). Install Maven 3.9.11, or set CHAPTER_MVN to its full path." >&2
  exit 2
fi
ARGS=(--batch-mode)
if [ -n "${CHAPTER_M2:-}" ]; then
  ARGS+=("-Dmaven.repo.local=${CHAPTER_M2}")
fi
STAGING="build/staging"
VERSION="$(sed -n 's:^  <version>\(.*\)</version>$:\1:p' pom.xml | head -1)"
JAR="equipment-lending-${VERSION}.jar"

smoke() {
  echo "--- smoke test of $(cat "${STAGING}/current/RELEASE") (end-to-end journeys against ${STAGING}/current/${JAR})"
  "$MVN" "${ARGS[@]}" test -Dgroups=e2e "-De2e.classpath=${STAGING}/current/${JAR}"
}

case "${1:-deliver}" in
  deliver)
    "$MVN" "${ARGS[@]}" -q package -DskipTests
    mkdir -p "${STAGING}"
    if [ -d "${STAGING}/current" ]; then
      rm -rf "${STAGING}/previous"
      mv "${STAGING}/current" "${STAGING}/previous"
    fi
    mkdir -p "${STAGING}/current"
    cp "target/${JAR}" "${STAGING}/current/${JAR}"
    echo "${RELEASE_LABEL:-${VERSION}}" > "${STAGING}/current/RELEASE"
    echo "--- delivered $(cat "${STAGING}/current/RELEASE") to ${STAGING}/current (simulation)"
    smoke
    ;;
  rollback)
    if [ ! -d "${STAGING}/previous" ]; then
      echo "No previous release to roll back to." >&2
      exit 1
    fi
    rm -rf "${STAGING}/current"
    mv "${STAGING}/previous" "${STAGING}/current"
    echo "--- rolled back to $(cat "${STAGING}/current/RELEASE") (simulation)"
    smoke
    ;;
  *)
    echo "usage: simulate-release.sh [deliver|rollback]" >&2
    exit 2
    ;;
esac

#!/usr/bin/env bash
# A reproducible demonstration with no other setup: compile, start the local directory stub inside
# one process, and run the system twice (visitors disabled, then enabled). CHAPTER_MVN names the
# Maven command (default: mvn); CHAPTER_M2 optionally names a local Maven repository.
set -euo pipefail
cd "$(dirname "${BASH_SOURCE[0]}")/.."

MVN="${CHAPTER_MVN:-mvn}"
if ! command -v "$MVN" >/dev/null 2>&1 && [ ! -f "$MVN" ]; then
  echo "Maven was not found (looked for: $MVN). Install Maven 3.9.11, or set CHAPTER_MVN to its full path." >&2
  exit 2
fi
if ! command -v java >/dev/null 2>&1; then
  echo "Java was not found. Install a full Java 17 JDK and make sure java is on the PATH." >&2
  exit 2
fi
ARGS=(--batch-mode -q)
if [ -n "${CHAPTER_M2:-}" ]; then
  ARGS+=("-Dmaven.repo.local=${CHAPTER_M2}")
fi

"$MVN" "${ARGS[@]}" test-compile

SEP=":"
case "$(uname -s)" in
  MINGW*|MSYS*|CYGWIN*) SEP=";" ;;
esac
java -cp "target/classes${SEP}target/test-classes" edu.se506.lending.integration.DemoRun

#!/usr/bin/env bash
# Follows docs/HANDOVER.md in a fresh copy of the project, so that a stale or missing step shows up
# here and not on the day a new reader tries it. It copies the project without build output into a
# new folder, runs the pipeline and the demonstration there, and compares what they print with what
# HANDOVER.md promises. The expected figures below must be kept in step with HANDOVER.md.
#
# CHAPTER_MVN names the Maven command (default: mvn); CHAPTER_M2 optionally names a local Maven
# repository. Both are passed on to the scripts it runs.
set -euo pipefail

EXPECT_UNIT=206          # stage 2 of the pipeline
EXPECT_INTEGRATION=26    # stage 3
EXPECT_E2E=3             # stage 4
EXPECT_TOTAL=$((EXPECT_UNIT + EXPECT_INTEGRATION + EXPECT_E2E))

SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT
( cd "$SRC" && tar cf - --exclude=./target --exclude=./build --exclude=./.git . ) | ( cd "$WORK" && tar xf - )
cd "$WORK"

failures=0
expect() {   # expect <file> <fixed text> <what it shows>
  if grep -qF -- "$2" "$1"; then
    echo "ok   $3"
  else
    echo "FAIL $3 (expected to find: $2)"
    failures=$((failures + 1))
  fi
}

echo "--- following HANDOVER.md in ${WORK}"
if bash scripts/pipeline.sh > pipeline.out 2>&1; then echo "ok   the pipeline exited 0"; else echo "FAIL the pipeline did not exit 0"; failures=$((failures + 1)); fi
expect pipeline.out "PIPELINE PASSED" "the pipeline reports PIPELINE PASSED"
expect pipeline.out "Tests run: ${EXPECT_UNIT}, Failures: 0, Errors: 0, Skipped: 0" "stage 2 ran ${EXPECT_UNIT} invocations"
expect pipeline.out "Tests run: ${EXPECT_INTEGRATION}, Failures: 0, Errors: 0, Skipped: 0" "stage 3 ran ${EXPECT_INTEGRATION} invocations"
expect pipeline.out "Tests run: ${EXPECT_E2E}, Failures: 0, Errors: 0, Skipped: 0" "stage 4 ran ${EXPECT_E2E} invocations"

expect docs/HANDOVER.md "Tests run: ${EXPECT_TOTAL}, Failures: 0" "HANDOVER.md promises ${EXPECT_TOTAL} invocations in total"
expect docs/HANDOVER.md "Stage 2 runs ${EXPECT_UNIT} invocations, stage 3 runs ${EXPECT_INTEGRATION} and stage 4 runs ${EXPECT_E2E}." "HANDOVER.md promises the stage counts"

if bash scripts/demo.sh > demo.out 2>&1; then echo "ok   the demonstration exited 0"; else echo "FAIL the demonstration did not exit 0"; failures=$((failures + 1)); fi
expect demo.out "Visitor V1: Rejected: visitor reservations are not enabled." "the disabled run rejects a visitor"
expect demo.out "Visitor V1: Confirmed: R2 for V1 on CAM2 [2026-10-20, 2026-10-22)." "the enabled run confirms an approved visitor"
expect demo.out "Visitor V2: Rejected: no valid sponsor approval." "the enabled run rejects an unapproved visitor"
expect demo.out "Outage BROKEN: Unavailable: Borrower directory unavailable" "an outage is reported as unavailable"

if [ "$failures" -eq 0 ]; then
  echo "HANDOVER CHECK PASSED"
else
  echo "HANDOVER CHECK FAILED: ${failures} problem(s)"
  exit 1
fi

# Handover: Campus Equipment Lending System, version 0.14.0

This is the handover bundle for the book project. It is written for a person who has not seen the project before and has about an hour. A team applies the same headings to its own project.

## 1. What this is

A small Java application that lets borrowers reserve campus equipment. It decides reservations by borrower category (student, staff, visiting researcher), records loans and returns, and prints an overdue report. Visiting researchers are supported by a change request, CR-12, which is a **teaching contract** and not an institutional policy. The visitor behaviour is behind one flag that is **off by default**.

It is an in-memory teaching system: no real database, no real borrower directory and no real sponsor-approval service. The directory and the approval register are controlled stand-ins.

## 2. What you need

| Need | Detail |
|---|---|
| A full Java 17 JDK | It must include the `jdk.jdeps` module, which two architecture tests use. The build compiles with `--release 17`. The checks were run with `--release 17` on a newer JDK; a Java 17 runtime run has not been made. |
| Maven 3.9.11 | The pinned dependency versions are in `pom.xml`. The first build downloads them. |
| A POSIX shell | Git Bash on Windows is enough. The scripts are written for `bash`. |
| Network access | Only for the first build, to fetch dependencies. |

## 3. Set up and check that it works

First check the tools:

```bash
java -version
mvn -version
```

You should see Java 17 or later and Maven 3.9.x. If `mvn` is not found, install Maven, or set `CHAPTER_MVN` to the full path of the Maven command for the scripts (for example `export CHAPTER_MVN=/path/to/apache-maven-3.9.11/bin/mvn`). The scripts print a message and stop if Maven or Java is missing. The commands below that start with `mvn` need Maven on the PATH.

Then, from the project directory (the one that contains `pom.xml`):

```bash
mvn --batch-mode verify
```

Expected: `BUILD SUCCESS` and `Tests run: 235, Failures: 0, Errors: 0, Skipped: 0`.

To run the same checks as the delivery pipeline, stage by stage, and stop at the first failure:

```bash
bash scripts/pipeline.sh
```

Expected: five stages, each ending `PASSED`, then `PIPELINE PASSED`. Stage 2 runs 206 invocations, stage 3 runs 26 and stage 4 runs 3.

If your Maven command is not `mvn`, or you keep dependencies in a separate folder, set `CHAPTER_MVN` and `CHAPTER_M2` before running a script; the scripts say so in their first lines.

**Things you may see that are not errors.** On a recent JDK Maven 3.9.11 prints `WARNING` lines about `sun.misc.Unsafe`, and the mocking library prints a warning that a Java agent was loaded dynamically. The build still ends with `BUILD SUCCESS`. Read the last lines of the output, not the first. A folder name with spaces in it is fine.

**If something fails.** A failing stage prints its name and stops the pipeline. Read the name of the first failing test before the stack trace. If the first build fails while downloading dependencies, check your network and try again. If `TraceabilityTest` fails, a document and the code disagree: read its message, which names the missing test or class.

## 4. See it work

```bash
bash scripts/demo.sh
```

This compiles the project, starts the local directory stub inside one process, and runs the system twice. With visitors disabled, visitor requests are rejected with `visitor reservations are not enabled`. With visitors enabled, the visitor V1 with a matching approval is confirmed, V2 with none is rejected, and an unavailable directory is reported as unavailable and not as a missing borrower. The clock is fixed so that the sample approval is always valid.

## 5. How it is organised

| Package | Role |
|---|---|
| `domain` | Borrowers, reservations, loans, borrowing policies, approval records |
| `application` | Use cases: reserving, loans, the visitor gate, ports for the directory, approvals and notices |
| `infrastructure` | Adapters: the directory client and adapter, the approval file, notices, in-memory storage |
| `bootstrap` | Wiring and the runnable demonstrations |
| `legacy` | The old overdue report, isolated; production code does not depend on it |

The architecture tests (`DependencyRulesTest`) fail the build if a dependency points the wrong way. The decisions behind the structure are in `docs/ADR-010-application-structure.md`, `docs/ADR-011-legacy-overdue-report.md`, `docs/ADR-013-visiting-researchers.md` and `docs/ADR-014-flag-handover.md`.

## 6. The visitor flag

The flag `lending.visitors` defaults to `false`. To change it for the demonstration program, pass `-Dlending.visitors=true`. A mistyped value means `false`, which is the safe direction; the program prints the effective setting on its first line. To stop new visitor reservations, turn the flag off. That does not remove reservations that already exist. The decision about removing the flag is in `docs/ADR-014-flag-handover.md`.

## 7. Requirements to evidence

`docs/REQUIREMENTS-TO-EVIDENCE.md` traces the ten contract clauses and the eighteen acceptance examples to the class that decides each and the test that checks it, and lists five known gaps. `TraceabilityTest` fails the build if a named test or class disappears.

## 8. Known limitations

`docs/KNOWN-ISSUES.md` is the full list, with what was decided and why. In brief:

- The directory and the approval register are stand-ins. Nothing here was run against a real service.
- Two writers of the register, or simultaneous requests, were not considered.
- A late visitor is charged at the rate of the report's "any other kind" rule (suspected defect SD-11-1). The count rule counts every retained reservation, including returned ones (SD-12). Both are unresolved and need an owner's decision.
- No Java 17 run, and no hosted CI run, has been made. The file `.github/workflows/pipeline.yml` has never run.
- `scripts/simulate-release.sh` is a simulation of delivery. Nothing is deployed anywhere.

## 9. Where things are

| Path | What |
|---|---|
| `src/main/java` | Production code |
| `src/test/java` | Tests: unit, integration (tag `integration`), end-to-end (tag `e2e`), and the traceability check |
| `scripts/pipeline.sh` | The five-stage pipeline |
| `scripts/demo.sh` | The demonstration |
| `scripts/simulate-release.sh` | Simulated delivery and rollback |
| `scripts/handover-check.sh` | Copies the project to a new folder and follows this document |
| `docs/` | Decision records, requirements to evidence, known issues, release notes, this file |
| `tools/PackageMetrics.java` | Package coupling and stability figures; see the Chapter 10 notes |
| `stages/`, `probe/`, `ai-activity/`, `rehearsal/` | Teaching material outside the build |

## 10. Demonstration outline (about ten minutes)

1. The problem in one sentence, and what changed in this version (one minute).
2. Run `bash scripts/pipeline.sh` and point at the stage counts (two minutes; start it before you begin talking).
3. Run `bash scripts/demo.sh` and read the two outputs side by side (three minutes).
4. Open `docs/REQUIREMENTS-TO-EVIDENCE.md` and follow one row from requirement to test to stage (two minutes).
5. State what is not shown, from section 8, and the next action (two minutes).

The timings are a suggestion. Your instructions decide the length and the format of your own demonstration.

# Requirements to evidence: visiting-researcher reservations (CR-12)

This table traces each requirement and acceptance example to the code that decides it and the test that checks it. It is checked by `TraceabilityTest`: every test named in the *Evidence* column must exist, every acceptance example AC1 to AC18 must have exactly one row, and every class named in the *Decided by* column must exist. The test checks that names exist. It does not check that the named test is the right one: a reviewer does that.

The stage is the pipeline stage that runs the evidence (`scripts/pipeline.sh`): 2 is unit tests and architecture checks, 3 is integration tests, 4 is end-to-end journeys.

CR-12 is a teaching contract. It is not an institutional borrowing policy.

## Contract clauses

| ID | Requirement | Decided by | Evidence | Stage |
|---|---|---|---|---|
| C1 | A visitor is recognised through the borrower directory, with the kind code `V` | `LegacyDirectoryAdapter`, `DirectoryReservationService` | `DirectoryOutageIntegrationTest.aVisitorIsServedThroughTheRealDirectoryAndTheRealApprovalFile` | 3 |
| C2 | Only CAM1 and CAM2 may be requested | `VisitorGate` | `VisitorGateTest.anItemOutsideTheAllowlistIsRejectedWithoutReadingTheSource` | 2 |
| C3 | One to three days, and no more than three retained reservations | `VisitorReservationRules` | `VisitorRulesTest.countAndDurationBoundaries` | 2 |
| C4 | The approval matches the borrower, the item and the exact period | `ApprovalRecord` | `VisitorRulesTest.aRecordMatchesOnlyTheExactBorrowerItemAndPeriod` | 2 |
| C5 | The approval is valid at the request instant (start inclusive, end exclusive) | `ApprovalRecord`, `VisitorGate` | `VisitorGateTest.theWindowIncludesItsStartAndExcludesItsEnd` | 2 |
| C6 | A missing, denied, mismatched or expired approval creates no reservation and sends no notice | `VisitorGate`, `DirectoryReservationService` | `VisitorAcceptanceTest.ac7_anApprovalForAnotherBorrowerItemOrPeriodDoesNotAuthorise` | 2 |
| C7 | An unreadable or malformed register is a failure, not a rejection | `FileApprovalSource` | `FileApprovalSourceIntegrationTest.oneBadRowRejectsTheWholeRegisterEvenWhenTheRequestMatchesAGoodRow` | 3 |
| C8 | An unreachable or slow directory is a failure, never "not found" | `HttpLegacyDirectoryClient`, `LegacyDirectoryAdapter` | `DirectoryOutageIntegrationTest.aServerErrorIsAnOutageNotANotFoundAndIsNotRetried` `DirectoryOutageIntegrationTest.aStalledBodyIsAFailureWithinTheOverallWait` | 3 |
| C9 | The visitor behaviour is behind one flag that defaults to off | `VisitorGate`, `Chapter13Demo` | `Chapter13JourneyE2ETest.withTheFlagOffVisitorsAreRefusedAndEveryoneElseIsServed` | 4 |
| C10 | Student and staff behaviour is unchanged | `ReservationCoordinator` | `VisitorAcceptanceTest.ac13_studentAndStaffBehaviourIsUnchangedUnderEitherSettingAndNeverReadsTheRegister` | 2 |

## Acceptance examples

| ID | Example | Decided by | Evidence | Stage |
|---|---|---|---|---|
| AC1 | CAM1, two days, matching approved record valid at request time | `VisitorGate`, `ReservationCoordinator` | `VisitorAcceptanceTest.ac1_aVisitorWithAMatchingApprovalReservesCam1ForTwoDays` | 2 |
| AC2 | CAM2, three days, with its own record | `VisitorReservationRules` | `VisitorAcceptanceTest.ac2_cam2ForThreeDaysNeedsItsOwnRecordAndIsAllowed` | 2 |
| AC3 | Four days is rejected | `VisitorReservationRules` | `VisitorAcceptanceTest.ac3_fourDaysIsRejectedEvenWithAMatchingRecord` | 2 |
| AC4 | Zero or negative days is rejected without reading the register | `VisitorGate`, `VisitorReservationRules` | `VisitorAcceptanceTest.ac4_zeroOrNegativeDaysIsRejectedWithoutReadingTheRegister` | 2 |
| AC5 | An item outside the allowlist is rejected | `VisitorGate` | `VisitorAcceptanceTest.ac5_anItemOutsideTheAllowlistIsRejectedEvenWithAMatchingRecord` | 2 |
| AC6 | A missing or denied approval is an expected rejection | `VisitorGate` | `VisitorAcceptanceTest.ac6_aMissingOrDeniedApprovalIsAnExpectedRejection` | 2 |
| AC7 | An approval for another borrower, item or period does not authorise | `ApprovalRecord`, `VisitorGate` | `VisitorAcceptanceTest.ac7_anApprovalForAnotherBorrowerItemOrPeriodDoesNotAuthorise` | 2 |
| AC8 | The request instant equal to `validFrom` is valid | `ApprovalRecord` | `VisitorAcceptanceTest.ac8_theRequestInstantEqualToValidFromIsValid` | 2 |
| AC9 | The request instant at `validUntil`, or before `validFrom`, is rejected | `ApprovalRecord` | `VisitorAcceptanceTest.ac9_theRequestInstantAtValidUntilOrBeforeValidFromIsRejected` | 2 |
| AC10 | An unreadable register is an operational failure | `FileApprovalSource`, `VisitorGate` | `VisitorAcceptanceTest.ac10_anUnreadableApprovalRegisterIsAnOperationalFailureNotARejection` | 2 |
| AC11 | Three retained reservations block a fourth, even after the loans are returned | `ReservationCoordinator`, `VisitorReservationRules` | `VisitorAcceptanceTest.ac11_threeRetainedReservationsBlockAFourthEvenAfterLoansAreReturned` | 2 |
| AC12 | A disabled flag rejects explicitly without reading the register | `VisitorGate` | `VisitorAcceptanceTest.ac12_aDisabledFlagRejectsExplicitlyWithoutReadingTheRegister` | 2 |
| AC13 | Student and staff requests are unchanged under either setting | `DirectoryReservationService` | `VisitorAcceptanceTest.ac13_studentAndStaffBehaviourIsUnchangedUnderEitherSettingAndNeverReadsTheRegister` | 2 |
| AC14 | An overlap with an existing reservation is rejected by the existing rule | `ReservationCoordinator` | `VisitorAcceptanceTest.ac14_anOverlapWithAnExistingReservationIsRejectedByTheExistingRule` | 2 |
| AC15 | An expected notification failure keeps the reservation | `ReservationCoordinator` | `VisitorAcceptanceTest.ac15_anExpectedNotificationFailureLeavesTheVisitorReservationInPlace` | 2 |
| AC16 | A visitor reservation stays usable after the approval expires and the flag is off | `LoanService` | `VisitorAcceptanceTest.ac16_aVisitorReservationStaysUsableAfterTheApprovalExpiresAndTheFlagIsOff` | 2 |
| AC17 | An unknown or inactive borrower is rejected as before | `DirectoryReservationService`, `LegacyDirectoryAdapter` | `VisitorAcceptanceTest.ac17_anInactiveOrUnknownBorrowerIsRejectedAsBefore` | 2 |
| AC18 | A visitor loan in the overdue report keeps the existing kind rule (suspected defect SD-11-1) | `OverdueReport`, `FinePolicy` | `VisitorAcceptanceTest.ac18_aVisitorLoanInTheOverdueReportKeepsTheExistingKindRuleSd11_1` | 2 |

## Known gaps: requirements with no evidence here

| ID | Gap | Why it is not covered |
|---|---|---|
| G1 | Behaviour against a real directory service | There is none in this project; the stub is the author's assumption |
| G2 | Two writers of the register, or two simultaneous requests | The register is a trusted sequential file; no concurrency test exists |
| G3 | Revoking an approval after a reservation | Not part of CR-12; see the revisit triggers in `ADR-013-visiting-researchers.md` |
| G4 | The right late-fine rate for a visitor | Suspected defect SD-11-1: only the records office can decide it |
| G5 | Behaviour on a Java 17 runtime and on a hosted CI runner | Not run; the checks used `--release 17` on a newer JDK |

# Known issues and decisions, version 0.14.0

Each item has a decision. **Fixed** means changed in this version and covered by a check. **Deferred** means a named owner must decide first, or the cost is not justified yet. **Accepted** means a known limit that the documents state.

The version is a handover, not a feature sprint. Nothing below was fixed by adding behaviour; the one fix is to the setup and demonstration.

| ID | Item | Effect on a user | Decision | Reason and next step |
|---|---|---|---|---|
| KI-1 | The demonstration program needed a directory service that only the tests could start, so a new reader could not run it | A reader could not see the system work | **Fixed** (`scripts/demo.sh`, `DemoRun`) | Covered by the dry run in `scripts/handover-check.sh` |
| KI-2 | SD-11-1: any borrower kind other than student or staff is fined at 1.00 a day with no grace and no cap. A late visitor now reaches this rule (AC18 pins it) | A late visitor is fined at a rate nobody chose | **Deferred** | Only the records office can say what the rate should be. Pinned in `docs/SUSPECTED-DEFECTS-legacy-overdue-report.md` |
| KI-3 | SD-11-2: a loan within the grace period is listed with fine 0.00 and counted as overdue | A report line that may not be wanted | **Deferred** | Needs the owner's answer to "should it appear at all?" |
| KI-4 | SD-11-3: a null kind throws `NullPointerException`, but only for a loan that is overdue and unreturned | A crash if the export ever contains a null kind | **Deferred** | Ask whether the export can contain one |
| KI-5 | SD-11-4: amounts use the default locale (`0,50` under a German locale) | A different separator on a different machine | **Deferred** | Owner decides whether the separator follows the machine or the office |
| KI-6 | SD-12: the count rule counts every retained reservation, including returned ones | A borrower with three returned loans cannot reserve a fourth | **Deferred** | Preserved on purpose by CR-12 and pinned by AC11. Owner decides |
| KI-7 | One bad row in the approval register rejects the whole register | One typo blocks every visitor request until it is repaired | **Accepted** | A silent skip could hide a lost approval or a duplicate. Revisit with real use |
| KI-8 | The directory wait defaults to one second and was not measured. It bounds the whole lookup, body included | A slow or stalled directory fails the request after about a second | **Accepted** | It is a setting, `lending.directory.timeout.millis`. Measure before changing it. The stalled-body case is tested (`aStalledBodyIsAFailureWithinTheOverallWait`) on a newer JDK only; no Java 17 run was made |
| KI-9 | No retry and no cached answer after a directory outage | An outage stops the request | **Accepted** | By design (ADR-013). Revisit after measured outages |
| KI-10 | The directory stub and the approval file are stand-ins | Nothing here shows how a real service behaves | **Accepted** | Needs a provider contract test against a real service, which does not exist here |
| KI-11 | Concurrency: two writers of the register, or simultaneous requests, were not considered | Unknown | **Accepted** | Out of scope; the register is a trusted sequential file |
| KI-12 | No Java 17 run and no hosted CI run; the workflow's action versions were not re-checked | The Java 17 baseline and the workflow are untested | **Deferred** | Run both when a JDK 17 and a hosted runner are available |
| KI-13 | The visitor flag is still in the code | Two paths to keep tested | **Deferred** | Decided in `docs/ADR-014-flag-handover.md`; the removal is rehearsed in `rehearsal/` |
| KI-14 | `DirectoryReservationService` now has a branch on the visitor category | One category-specific special case in the entry point | **Accepted** | Fine for one special category. At a second, replace the branch with a per-category pre-check, as a refactoring with its own tests |

# Release notes: version 0.14.0 (handover)

Date: 13 October 2026. Built from version 0.13.1, the visiting-researcher change with its corrected directory timeout.

## What this version is

A handover version. It changes **no production behaviour**: every production source file is byte for byte as in 0.13.1. It adds the material that a new reader needs: a runnable demonstration, a requirements-to-evidence table that a test keeps honest, a list of known issues with decisions, and a decision about the visitor flag.

## Added

- `scripts/demo.sh` and `DemoRun`: run the system with visitors disabled and then enabled, with no other setup.
- `scripts/handover-check.sh`: copies the project to a new folder, follows `docs/HANDOVER.md` there and compares the results.
- `docs/HANDOVER.md`, `docs/KNOWN-ISSUES.md`, `docs/REQUIREMENTS-TO-EVIDENCE.md` and `docs/ADR-014-flag-handover.md`.
- `TraceabilityTest` (three invocations): fails the build if a test or class named in the requirements table no longer exists, or an acceptance example loses its row.
- `rehearsal/remove-visitor-flag.patch`: the prepared, tested removal of the visitor flag. Not applied.

## Changed

- Version 0.14.0. The build runs 235 invocations (232 from 0.13.1 and the three above).

## Fixed

- KI-1: the demonstration could not be run without a directory service that only the tests could start.

## Behaviour you should know about

- Visitors remain **disabled by default**. Set `-Dlending.visitors=true` for the demonstration program to enable them.
- An unreachable directory or an unreadable approval register stops the request. It is never reported as "not found" or "not approved".

## Known issues

See `docs/KNOWN-ISSUES.md`. The most important: a late visitor is fined at the rate of the report's "any other kind" rule, which nobody has chosen (SD-11-1); the count rule counts returned reservations (SD-12).

## Not verified

No Java 17 run and no hosted CI run has been made. The directory and the approval register are stand-ins; nothing was run against a real service. No independent review has been made of this release.

# ADR-014: Keep the visitor flag at handover; removal rehearsed, not applied

Date: 13 October 2026
Status: Decided for the book project by its author, as a model decision. Not an institutional decision. A team decides for its own flag.

## Context

ADR-013 introduced one flag, `visitingResearchersEnabled` (the property `lending.visitors`), default off, and said to remove it when all of three conditions hold: the released variant of CR-12 is accepted, both settings have passed in the pipeline for the release candidate, and a decision to keep visitors enabled is recorded. It also said to review the flag at the end of the handover.

The state today: both settings pass in the pipeline (the second condition holds). CR-12 is a teaching contract and no owner has accepted it as the borrowing policy (the first condition does not hold). Nobody has recorded a decision to keep visitors enabled (the third does not hold).

## Decision

Keep the flag, default off, in version 0.14.0. Do not remove it yet.

The removal was **rehearsed** in a scratch copy so that the cost is known and the change is ready. The rehearsal is `rehearsal/remove-visitor-flag.patch`; apply it from the project directory with `patch -p1`. It deletes the flag, the `DISABLED` result and `VisitorGate.disabled()`, and adds `VisitorGate.noApprovals()` for an application with no register, so that the older two-argument service constructor keeps its meaning: no visitor is approved. It touches eleven files (three production classes, five test classes, the requirements table, the expected numbers in `docs/HANDOVER.md` and `scripts/handover-check.sh`) with 87 lines added and 131 removed, and the prose of `README.md`, the rest of `docs/HANDOVER.md` and the two decision records still needs editing by hand. After the patch, the full build ran 233 invocations with no failures (235 before), the pipeline passed, and the handover check passed.

## Alternatives considered

- **Remove the flag now.** Rejected: it would turn an unaccepted teaching contract into permanent behaviour, and it would remove the one switch that stops new visitor reservations without a new build.
- **Keep the flag with no removal plan.** Rejected: an owner-less flag is a permanent branch. This record names the condition and the prepared change.
- **Replace the flag by configuration that is read at run time.** Not adopted: the flag is already a system property for the demonstration program, and a configuration service is outside the scope of the module.

## Consequences

Both paths stay tested: the acceptance example AC12 (disabled flag), the flag-off journey and the gate's disabled tests remain. A visitor can never be served unless someone sets the property to `true`. Two small costs remain: every new test that builds a visitor gate must pick a setting, and the documents must keep saying that the default is off.

When the three conditions hold, apply `rehearsal/remove-visitor-flag.patch`. It retires AC12 as written (an application with no register approves no visitor instead), rewrites AC13 and AC16, which name the flag, and updates the requirements table and the handover check. Then edit `README.md`, `docs/HANDOVER.md` and ADR-013 by hand, and record the removal in a new decision record. Rollback after removal is a redelivery of the previous release, not a flag change.

## Validation and review

The rehearsal was run, not reasoned about: 233 invocations, 0 failures. No independent peer review is claimed.

## Revisit triggers

An owner accepts or rejects the visitor variant; a decision to keep visitors enabled is recorded; a second flag is proposed (decide the policy for several flags first); or the flag stays in place for longer than the team's own limit for release toggles.

package edu.se506.lending.docs;

import static org.junit.jupiter.api.Assertions.*;

import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.List;
import java.util.TreeMap;
import java.util.TreeSet;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.stream.Stream;
import org.junit.jupiter.api.Test;

/**
 * Keeps docs/REQUIREMENTS-TO-EVIDENCE.md honest. It checks that the names in the table still exist
 * (test methods, production classes) and that every acceptance example has exactly one row. It does
 * not check that a named test is the right evidence for its requirement: a reviewer does that.
 */
class TraceabilityTest {
    private static final Path TABLE = Path.of("docs", "REQUIREMENTS-TO-EVIDENCE.md");
    private static final Path MAIN = Path.of("src", "main", "java");
    private static final Path TEST = Path.of("src", "test", "java");
    private static final Pattern TEST_REFERENCE = Pattern.compile("`([A-Z]\\w+)\\.([a-z]\\w*)`");
    private static final Pattern CLASS_REFERENCE = Pattern.compile("`([A-Z]\\w+)`");
    private static final Pattern ACCEPTANCE_ID = Pattern.compile("^AC\\d+$");
    private static final Pattern ACCEPTANCE_TEST = Pattern.compile("void (ac\\d+_\\w+)\\(");

    /** One table row: its cells, trimmed, without the outer bars. */
    private record Row(List<String> cells) {
        String id() { return cells.get(0); }
        String decidedBy() { return cells.get(2); }
        String evidence() { return cells.get(3); }
    }

    private static List<Row> rows() throws IOException {
        List<Row> rows = new ArrayList<>();
        for (String line : Files.readAllLines(TABLE, StandardCharsets.UTF_8)) {
            if (!line.startsWith("| ") || line.startsWith("| ---") || line.startsWith("| ID ")) continue;
            List<String> cells = new ArrayList<>();
            for (String cell : line.substring(1, line.length() - 1).split("\\|", -1)) cells.add(cell.trim());
            if (cells.size() == 5) rows.add(new Row(cells));   // the gap table has three columns
        }
        return rows;
    }

    private static String sourceOf(Path root, String className) throws IOException {
        try (Stream<Path> files = Files.walk(root)) {
            List<Path> found = files.filter(p -> p.getFileName().toString().equals(className + ".java")).toList();
            assertEquals(1, found.size(), "expected exactly one " + className + ".java under " + root + " but found " + found);
            return Files.readString(found.get(0), StandardCharsets.UTF_8);
        }
    }

    @Test void everyTestNamedInTheTableStillExists() throws IOException {
        List<String> missing = new ArrayList<>();
        int checked = 0;
        for (Row row : rows()) {
            Matcher m = TEST_REFERENCE.matcher(row.evidence());
            assertTrue(m.find(), row.id() + " names no test");
            do {
                checked++;
                String source = sourceOf(TEST, m.group(1));
                if (!Pattern.compile("void " + Pattern.quote(m.group(2)) + "\\(").matcher(source).find()) {
                    missing.add(row.id() + ": " + m.group(1) + "." + m.group(2));
                }
            } while (m.find());
        }
        assertTrue(checked >= 29, "the table should name at least 29 tests, found " + checked);
        assertEquals(List.of(), missing, "tests named in the table that no longer exist");
    }

    @Test void everyClassNamedAsDecidingStillExists() throws IOException {
        List<String> missing = new ArrayList<>();
        for (Row row : rows()) {
            Matcher m = CLASS_REFERENCE.matcher(row.decidedBy());
            assertTrue(m.find(), row.id() + " names no deciding class");
            do {
                try {
                    sourceOf(MAIN, m.group(1));
                } catch (AssertionError gone) {
                    missing.add(row.id() + ": " + m.group(1));
                }
            } while (m.find());
        }
        assertEquals(List.of(), missing, "classes named in the table that no longer exist");
    }

    @Test void everyAcceptanceExampleHasExactlyOneRowAndEveryAcceptanceTestIsInTheTable() throws IOException {
        TreeMap<String, Integer> rowsPerExample = new TreeMap<>();
        TreeSet<String> referenced = new TreeSet<>();
        for (Row row : rows()) {
            if (ACCEPTANCE_ID.matcher(row.id()).matches()) rowsPerExample.merge(row.id(), 1, Integer::sum);
            Matcher m = TEST_REFERENCE.matcher(row.evidence());
            while (m.find()) referenced.add(m.group(2));
        }
        for (int n = 1; n <= 18; n++) {
            assertEquals(1, rowsPerExample.getOrDefault("AC" + n, 0), "rows for AC" + n);
        }
        assertEquals(18, rowsPerExample.size(), "unexpected acceptance ids: " + rowsPerExample.keySet());

        Matcher declared = ACCEPTANCE_TEST.matcher(sourceOf(TEST, "VisitorAcceptanceTest"));
        List<String> unlisted = new ArrayList<>();
        int tests = 0;
        while (declared.find()) {
            tests++;
            if (!referenced.contains(declared.group(1))) unlisted.add(declared.group(1));
        }
        assertEquals(18, tests, "VisitorAcceptanceTest should declare one test per example");
        assertEquals(List.of(), unlisted, "acceptance tests that the table does not mention");
    }
}

package edu.se506.lending.integration;

import edu.se506.lending.bootstrap.Chapter13Demo;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;

/**
 * A runnable demonstration for a reader who has no directory service: it starts the controlled local
 * directory stub, writes a small approval register, and runs the Chapter 13 system twice, with
 * visitors disabled and then enabled. It lives with the tests because the stub does. The clock is
 * fixed so that the sample approval is always valid. Run it with scripts/demo.sh.
 */
public final class DemoRun {
    private static final String REGISTER = String.join("\n",
            "borrowerId\titemId\tstart\tendExclusive\tsponsorId\tstatus\tvalidFrom\tvalidUntil",
            "V1\tCAM2\t2026-10-20\t2026-10-22\tS1\tAPPROVED\t2026-10-18T00:00:00Z\t2026-10-20T00:00:00Z", "");

    private DemoRun() { }

    public static void main(String[] args) throws IOException {
        Path register = Files.createTempFile("approvals", ".tsv");
        try (DirectoryStub stub = new DirectoryStub()) {
            Files.writeString(register, REGISTER, StandardCharsets.UTF_8);
            System.setProperty("lending.directory.url", stub.baseUri().toString());
            System.setProperty("lending.approvals.file", register.toString());
            System.setProperty("lending.now", "2026-10-19T12:00:00Z");
            for (String enabled : new String[] {"false", "true"}) {
                System.out.println("== visitors " + (enabled.equals("true") ? "enabled" : "disabled") + " ==");
                System.setProperty("lending.visitors", enabled);
                Chapter13Demo.main(new String[0]);
            }
        } finally {
            Files.deleteIfExists(register);
        }
    }
}

diff --git a/docs/HANDOVER.md b/docs/HANDOVER.md
--- a/docs/HANDOVER.md
+++ b/docs/HANDOVER.md
@@ -36,3 +36,3 @@
 
-Expected: `BUILD SUCCESS` and `Tests run: 235, Failures: 0, Errors: 0, Skipped: 0`.
+Expected: `BUILD SUCCESS` and `Tests run: 233, Failures: 0, Errors: 0, Skipped: 0`.
 
@@ -44,3 +44,3 @@
 
-Expected: five stages, each ending `PASSED`, then `PIPELINE PASSED`. Stage 2 runs 206 invocations, stage 3 runs 26 and stage 4 runs 3.
+Expected: five stages, each ending `PASSED`, then `PIPELINE PASSED`. Stage 2 runs 205 invocations, stage 3 runs 26 and stage 4 runs 2.
 
diff --git a/docs/REQUIREMENTS-TO-EVIDENCE.md b/docs/REQUIREMENTS-TO-EVIDENCE.md
--- a/docs/REQUIREMENTS-TO-EVIDENCE.md
+++ b/docs/REQUIREMENTS-TO-EVIDENCE.md
@@ -20,4 +20,4 @@
 | C8 | An unreachable or slow directory is a failure, never "not found" | `HttpLegacyDirectoryClient`, `LegacyDirectoryAdapter` | `DirectoryOutageIntegrationTest.aServerErrorIsAnOutageNotANotFoundAndIsNotRetried` `DirectoryOutageIntegrationTest.aStalledBodyIsAFailureWithinTheOverallWait` | 3 |
-| C9 | The visitor behaviour is behind one flag that defaults to off | `VisitorGate`, `Chapter13Demo` | `Chapter13JourneyE2ETest.withTheFlagOffVisitorsAreRefusedAndEveryoneElseIsServed` | 4 |
-| C10 | Student and staff behaviour is unchanged | `ReservationCoordinator` | `VisitorAcceptanceTest.ac13_studentAndStaffBehaviourIsUnchangedUnderEitherSettingAndNeverReadsTheRegister` | 2 |
+| C9 | An application with no approval register approves no visitor (the flag was removed) | `VisitorGate` | `VisitorGateTest.aGateWithNoRegisterApprovesNoVisitor` | 2 |
+| C10 | Student and staff behaviour is unchanged | `ReservationCoordinator` | `VisitorAcceptanceTest.ac13_studentAndStaffBehaviourIsUnchangedAndNeverReadsTheRegister` | 2 |
 
@@ -38,7 +38,7 @@
 | AC11 | Three retained reservations block a fourth, even after the loans are returned | `ReservationCoordinator`, `VisitorReservationRules` | `VisitorAcceptanceTest.ac11_threeRetainedReservationsBlockAFourthEvenAfterLoansAreReturned` | 2 |
-| AC12 | A disabled flag rejects explicitly without reading the register | `VisitorGate` | `VisitorAcceptanceTest.ac12_aDisabledFlagRejectsExplicitlyWithoutReadingTheRegister` | 2 |
-| AC13 | Student and staff requests are unchanged under either setting | `DirectoryReservationService` | `VisitorAcceptanceTest.ac13_studentAndStaffBehaviourIsUnchangedUnderEitherSettingAndNeverReadsTheRegister` | 2 |
+| AC12 | An application with no register approves no visitor | `VisitorGate` | `VisitorAcceptanceTest.ac12_anApplicationWithNoRegisterApprovesNoVisitor` | 2 |
+| AC13 | Student and staff requests are unchanged | `DirectoryReservationService` | `VisitorAcceptanceTest.ac13_studentAndStaffBehaviourIsUnchangedAndNeverReadsTheRegister` | 2 |
 | AC14 | An overlap with an existing reservation is rejected by the existing rule | `ReservationCoordinator` | `VisitorAcceptanceTest.ac14_anOverlapWithAnExistingReservationIsRejectedByTheExistingRule` | 2 |
 | AC15 | An expected notification failure keeps the reservation | `ReservationCoordinator` | `VisitorAcceptanceTest.ac15_anExpectedNotificationFailureLeavesTheVisitorReservationInPlace` | 2 |
-| AC16 | A visitor reservation stays usable after the approval expires and the flag is off | `LoanService` | `VisitorAcceptanceTest.ac16_aVisitorReservationStaysUsableAfterTheApprovalExpiresAndTheFlagIsOff` | 2 |
+| AC16 | A visitor reservation stays usable after the approval expires and new requests are not approved | `LoanService` | `VisitorAcceptanceTest.ac16_aVisitorReservationStaysUsableAfterTheApprovalExpiresAndNewRequestsAreNotApproved` | 2 |
 | AC17 | An unknown or inactive borrower is rejected as before | `DirectoryReservationService`, `LegacyDirectoryAdapter` | `VisitorAcceptanceTest.ac17_anInactiveOrUnknownBorrowerIsRejectedAsBefore` | 2 |
diff --git a/scripts/handover-check.sh b/scripts/handover-check.sh
--- a/scripts/handover-check.sh
+++ b/scripts/handover-check.sh
@@ -10,5 +10,5 @@
 
-EXPECT_UNIT=206          # stage 2 of the pipeline
+EXPECT_UNIT=205          # stage 2 of the pipeline
 EXPECT_INTEGRATION=26    # stage 3
-EXPECT_E2E=3             # stage 4
+EXPECT_E2E=2             # stage 4
 EXPECT_TOTAL=$((EXPECT_UNIT + EXPECT_INTEGRATION + EXPECT_E2E))
@@ -42,5 +42,4 @@
 if bash scripts/demo.sh > demo.out 2>&1; then echo "ok   the demonstration exited 0"; else echo "FAIL the demonstration did not exit 0"; failures=$((failures + 1)); fi
-expect demo.out "Visitor V1: Rejected: visitor reservations are not enabled." "the disabled run rejects a visitor"
-expect demo.out "Visitor V1: Confirmed: R2 for V1 on CAM2 [2026-10-20, 2026-10-22)." "the enabled run confirms an approved visitor"
-expect demo.out "Visitor V2: Rejected: no valid sponsor approval." "the enabled run rejects an unapproved visitor"
+expect demo.out "Visitor V1: Confirmed: R2 for V1 on CAM2 [2026-10-20, 2026-10-22)." "an approved visitor is confirmed"
+expect demo.out "Visitor V2: Rejected: no valid sponsor approval." "an unapproved visitor is rejected"
 expect demo.out "Outage BROKEN: Unavailable: Borrower directory unavailable" "an outage is reported as unavailable"
diff --git a/src/main/java/edu/se506/lending/application/DirectoryReservationService.java b/src/main/java/edu/se506/lending/application/DirectoryReservationService.java
--- a/src/main/java/edu/se506/lending/application/DirectoryReservationService.java
+++ b/src/main/java/edu/se506/lending/application/DirectoryReservationService.java
@@ -19,3 +19,3 @@
                                        ReservationCoordinator coordinator) {
-        this(directory, coordinator, VisitorGate.disabled());
+        this(directory, coordinator, VisitorGate.noApprovals());
     }
diff --git a/src/main/java/edu/se506/lending/application/VisitorGate.java b/src/main/java/edu/se506/lending/application/VisitorGate.java
--- a/src/main/java/edu/se506/lending/application/VisitorGate.java
+++ b/src/main/java/edu/se506/lending/application/VisitorGate.java
@@ -13,3 +13,3 @@
  * The extra checks for a visiting researcher, kept apart from the count and duration policy: the
- * feature flag, the item allowlist and a matching sponsor approval that is valid at one request-time
+ * item allowlist and a matching sponsor approval that is valid at one request-time
  * instant. It returns a rejection text, or empty when the request may go on to the coordinator.
@@ -19,3 +19,2 @@
 public final class VisitorGate {
-    public static final String DISABLED = "Rejected: visitor reservations are not enabled.";
     public static final String ITEM_NOT_ALLOWED = "Rejected: item not available to visitors.";
@@ -27,15 +26,11 @@
     private final Clock clock;
-    private final boolean enabled;
 
-    public VisitorGate(ApprovalSource source, Clock clock, boolean enabled) {
+    public VisitorGate(ApprovalSource source, Clock clock) {
         this.source = Objects.requireNonNull(source, "source");
         this.clock = Objects.requireNonNull(clock, "clock");
-        this.enabled = enabled;
     }
 
-    /** A gate for applications that have not enabled visitors: the approval source is never read. */
-    public static VisitorGate disabled() {
-        return new VisitorGate((borrowerId, itemId, start, end) -> {
-            throw new IllegalStateException("The approval source must not be read while visitors are disabled.");
-        }, Clock.systemUTC(), false);
+    /** A gate for applications with no approval register: no visitor is ever approved. */
+    public static VisitorGate noApprovals() {
+        return new VisitorGate((borrowerId, itemId, start, end) -> Optional.empty(), Clock.systemUTC());
     }
@@ -43,5 +38,2 @@
     public Optional<String> rejection(String borrowerId, String itemId, LocalDate start, int days) {
-        if (!enabled) {
-            return Optional.of(DISABLED);
-        }
         if (!ALLOWED_ITEMS.contains(itemId)) {
diff --git a/src/main/java/edu/se506/lending/bootstrap/Chapter13Demo.java b/src/main/java/edu/se506/lending/bootstrap/Chapter13Demo.java
--- a/src/main/java/edu/se506/lending/bootstrap/Chapter13Demo.java
+++ b/src/main/java/edu/se506/lending/bootstrap/Chapter13Demo.java
@@ -22,3 +22,3 @@
  * and one feature flag. Settings are system properties so that a test can start it as a separate process:
- * lending.directory.url (required), lending.approvals.file (required), lending.visitors (default false),
+ * lending.directory.url (required), lending.approvals.file (required),
  * lending.now (an ISO instant, default the system clock) and lending.directory.timeout.millis (default 1000).
@@ -29,3 +29,2 @@
         Path approvals = Path.of(required("lending.approvals.file"));
-        boolean visitorsEnabled = Boolean.parseBoolean(System.getProperty("lending.visitors", "false"));
         String now = System.getProperty("lending.now");
@@ -38,3 +37,3 @@
                 directoryUrl, Duration.ofMillis(timeoutMillis), Duration.ofMillis(timeoutMillis)));
-        var gate = new VisitorGate(new FileApprovalSource(approvals), clock, visitorsEnabled);
+        var gate = new VisitorGate(new FileApprovalSource(approvals), clock);
         var service = new DirectoryReservationService(directory, coordinator, gate);
@@ -42,3 +41,2 @@
         LocalDate start = LocalDate.of(2026, 10, 20);
-        System.out.println("Visitors enabled: " + visitorsEnabled);
         attempt("Student B1", service, "B1", "CAM1", start, 2);
diff --git a/src/test/java/edu/se506/lending/e2e/Chapter13JourneyE2ETest.java b/src/test/java/edu/se506/lending/e2e/Chapter13JourneyE2ETest.java
--- a/src/test/java/edu/se506/lending/e2e/Chapter13JourneyE2ETest.java
+++ b/src/test/java/edu/se506/lending/e2e/Chapter13JourneyE2ETest.java
@@ -33,3 +33,3 @@
 
-    private Run run(DirectoryStub stub, Path register, boolean visitors) throws IOException, InterruptedException {
+    private Run run(DirectoryStub stub, Path register) throws IOException, InterruptedException {
         String java = Path.of(System.getProperty("java.home"), "bin",
@@ -40,3 +40,2 @@
                 "-Dlending.approvals.file=" + register,
-                "-Dlending.visitors=" + visitors,
                 "-Dlending.now=2026-10-19T12:00:00Z",
@@ -61,24 +60,7 @@
 
-    @Test void withTheFlagOffVisitorsAreRefusedAndEveryoneElseIsServed() throws Exception {
+    @Test void anApprovedVisitorIsServedAndAnUnapprovedOneIsRefused() throws Exception {
         try (var stub = new DirectoryStub()) {
-            Run run = run(stub, register(HEADER, V1_CAM2), false);
+            Run run = run(stub, register(HEADER, V1_CAM2));
             assertEquals(0, run.exitCode(), String.join("\n", run.lines()));
             assertEquals(List.of(
-                    "Visitors enabled: false",
-                    "Student B1: Confirmed: R1 for B1 on CAM1 [2026-10-20, 2026-10-22).",
-                    "Visitor V1: Rejected: visitor reservations are not enabled.",
-                    "Visitor V2: Rejected: visitor reservations are not enabled.",
-                    "Unknown U9: Rejected: borrower not found or inactive.",
-                    "Outage BROKEN: Unavailable: Borrower directory unavailable",
-                    "Reservations: 1",
-                    "Notices: 1"), run.lines());
-        }
-    }
-
-    @Test void withTheFlagOnAnApprovedVisitorIsServedAndAnUnapprovedOneIsRefused() throws Exception {
-        try (var stub = new DirectoryStub()) {
-            Run run = run(stub, register(HEADER, V1_CAM2), true);
-            assertEquals(0, run.exitCode(), String.join("\n", run.lines()));
-            assertEquals(List.of(
-                    "Visitors enabled: true",
                     "Student B1: Confirmed: R1 for B1 on CAM1 [2026-10-20, 2026-10-22).",
@@ -95,8 +77,8 @@
         try (var stub = new DirectoryStub()) {
-            Run run = run(stub, register(HEADER, V1_CAM2, "garbage row"), true);
+            Run run = run(stub, register(HEADER, V1_CAM2, "garbage row"));
             assertEquals(0, run.exitCode(), String.join("\n", run.lines()));
-            assertEquals("Student B1: Confirmed: R1 for B1 on CAM1 [2026-10-20, 2026-10-22).", run.lines().get(1));
-            assertEquals("Visitor V1: Approval register unavailable: Row 3 has 1 columns, not 8.", run.lines().get(2));
-            assertEquals("Visitor V2: Approval register unavailable: Row 3 has 1 columns, not 8.", run.lines().get(3));
-            assertEquals("Reservations: 1", run.lines().get(6));
+            assertEquals("Student B1: Confirmed: R1 for B1 on CAM1 [2026-10-20, 2026-10-22).", run.lines().get(0));
+            assertEquals("Visitor V1: Approval register unavailable: Row 3 has 1 columns, not 8.", run.lines().get(1));
+            assertEquals("Visitor V2: Approval register unavailable: Row 3 has 1 columns, not 8.", run.lines().get(2));
+            assertEquals("Reservations: 1", run.lines().get(5));
         }
diff --git a/src/test/java/edu/se506/lending/integration/DemoRun.java b/src/test/java/edu/se506/lending/integration/DemoRun.java
--- a/src/test/java/edu/se506/lending/integration/DemoRun.java
+++ b/src/test/java/edu/se506/lending/integration/DemoRun.java
@@ -10,4 +10,3 @@
  * A runnable demonstration for a reader who has no directory service: it starts the controlled local
- * directory stub, writes a small approval register, and runs the Chapter 13 system twice, with
- * visitors disabled and then enabled. It lives with the tests because the stub does. The clock is
+ * directory stub, writes a small approval register, and runs the Chapter 13 system once. It lives with the tests because the stub does. The clock is
  * fixed so that the sample approval is always valid. Run it with scripts/demo.sh.
@@ -28,7 +27,3 @@
             System.setProperty("lending.now", "2026-10-19T12:00:00Z");
-            for (String enabled : new String[] {"false", "true"}) {
-                System.out.println("== visitors " + (enabled.equals("true") ? "enabled" : "disabled") + " ==");
-                System.setProperty("lending.visitors", enabled);
-                Chapter13Demo.main(new String[0]);
-            }
+            Chapter13Demo.main(new String[0]);
         } finally {
diff --git a/src/test/java/edu/se506/lending/integration/DirectoryOutageIntegrationTest.java b/src/test/java/edu/se506/lending/integration/DirectoryOutageIntegrationTest.java
--- a/src/test/java/edu/se506/lending/integration/DirectoryOutageIntegrationTest.java
+++ b/src/test/java/edu/se506/lending/integration/DirectoryOutageIntegrationTest.java
@@ -65,3 +65,3 @@
     @Test void anOrdinaryStudentRequestWorksThroughTheRealHttpClient() {
-        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.disabled());
+        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.noApprovals());
         assertEquals("Confirmed: R1 for B1 on CAM1 [2026-10-20, 2026-10-22).", service.reserve("B1", "CAM1", START, 2));
@@ -71,3 +71,3 @@
     @Test void aMissingRowIsAnOrdinaryRejection() {
-        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.disabled());
+        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.noApprovals());
         assertEquals("Rejected: borrower not found or inactive.", service.reserve("NOBODY", "CAM1", START, 2));
@@ -77,3 +77,3 @@
     @Test void aServerErrorIsAnOutageNotANotFoundAndIsNotRetried() {
-        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.disabled());
+        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.noApprovals());
         DirectoryException failure = assertThrows(DirectoryException.class, () -> service.reserve("BROKEN", "CAM1", START, 2));
@@ -85,3 +85,3 @@
     @Test void aSlowProviderTimesOutAfterTheBoundedWaitAndFailsTheRequest() {
-        var service = service(stub.baseUri(), Duration.ofMillis(300), VisitorGate.disabled());
+        var service = service(stub.baseUri(), Duration.ofMillis(300), VisitorGate.noApprovals());
         long begin = System.nanoTime();
@@ -96,3 +96,3 @@
     @Test void aStalledBodyIsAFailureWithinTheOverallWait() {
-        var service = service(stub.baseUri(), Duration.ofMillis(300), VisitorGate.disabled());
+        var service = service(stub.baseUri(), Duration.ofMillis(300), VisitorGate.noApprovals());
         // The headers and the first byte arrive at once and the rest is held. A client whose timeout covers
@@ -112,3 +112,3 @@
         }
-        var service = service(URI.create("http://127.0.0.1:" + closedPort), Duration.ofSeconds(2), VisitorGate.disabled());
+        var service = service(URI.create("http://127.0.0.1:" + closedPort), Duration.ofSeconds(2), VisitorGate.noApprovals());
         assertThrows(DirectoryException.class, () -> service.reserve("B1", "CAM1", START, 2));
@@ -118,3 +118,3 @@
     @Test void aMalformedAnswerIsAnOutageNotAGuess() {
-        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.disabled());
+        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.noApprovals());
         assertThrows(DirectoryException.class, () -> service.reserve("GARBAGE", "CAM1", START, 2));
@@ -124,3 +124,3 @@
     @Test void anUnknownCategoryCodeIsNeverDefaultedToStaffOrStudent() {
-        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.disabled());
+        var service = service(stub.baseUri(), Duration.ofSeconds(2), VisitorGate.noApprovals());
         DirectoryException failure = assertThrows(DirectoryException.class, () -> service.reserve("ODD", "CAM1", START, 2));
@@ -132,3 +132,3 @@
         Path missingRegister = dir.resolve("never-read.tsv");
-        var gate = new VisitorGate(new FileApprovalSource(missingRegister), Clock.systemUTC(), true);
+        var gate = new VisitorGate(new FileApprovalSource(missingRegister), Clock.systemUTC());
         var service = service(stub.baseUri(), Duration.ofSeconds(2), gate);
@@ -143,3 +143,3 @@
         Clock clock = Clock.fixed(Instant.parse("2026-10-19T12:00:00Z"), ZoneOffset.UTC);
-        var gate = new VisitorGate(new FileApprovalSource(register), clock, true);
+        var gate = new VisitorGate(new FileApprovalSource(register), clock);
         var service = service(stub.baseUri(), Duration.ofSeconds(2), gate);
diff --git a/src/test/java/edu/se506/lending/visitor/VisitorAcceptanceTest.java b/src/test/java/edu/se506/lending/visitor/VisitorAcceptanceTest.java
--- a/src/test/java/edu/se506/lending/visitor/VisitorAcceptanceTest.java
+++ b/src/test/java/edu/se506/lending/visitor/VisitorAcceptanceTest.java
@@ -58,3 +58,3 @@
 
-        World(boolean enabled, Instant now, edu.se506.lending.application.port.NotificationSender notifier) {
+        World(Instant now, edu.se506.lending.application.port.NotificationSender notifier) {
             coordinator = ReservationApplication.create(notifier);
@@ -69,3 +69,3 @@
                 return approvals.stream().filter(r -> r.matches(borrower, item, start, end)).findFirst();
-            }, Clock.fixed(now, ZoneOffset.UTC), enabled);
+            }, Clock.fixed(now, ZoneOffset.UTC));
             service = new DirectoryReservationService(directory, coordinator, gate);
@@ -73,3 +73,3 @@
 
-        World(boolean enabled, Instant now) { this(enabled, now, new RecordingNotificationSender()); }
+        World(Instant now) { this(now, new RecordingNotificationSender()); }
 
@@ -88,3 +88,3 @@
         var recorder = new RecordingNotificationSender();
-        var w = new World(true, NOW, recorder).approve("V1", "CAM1", START, 2);
+        var w = new World(NOW, recorder).approve("V1", "CAM1", START, 2);
         assertEquals(SUCCESS_V1_CAM1, w.service.reserve("V1", "CAM1", START, 2));
@@ -95,3 +95,3 @@
     @Test void ac2_cam2ForThreeDaysNeedsItsOwnRecordAndIsAllowed() {
-        var w = new World(true, NOW).approve("V1", "CAM2", START, 3);
+        var w = new World(NOW).approve("V1", "CAM2", START, 3);
         assertEquals("Confirmed: R1 for V1 on CAM2 [2026-10-20, 2026-10-23).", w.service.reserve("V1", "CAM2", START, 3));
@@ -101,3 +101,3 @@
         var recorder = new RecordingNotificationSender();
-        var w = new World(true, NOW, recorder).approve("V1", "CAM1", START, 4);
+        var w = new World(NOW, recorder).approve("V1", "CAM1", START, 4);
         assertEquals(LIMIT, w.service.reserve("V1", "CAM1", START, 4));
@@ -109,3 +109,3 @@
         var recorder = new RecordingNotificationSender();
-        var w = new World(true, NOW, recorder).approve("V1", "CAM1", START, 2);
+        var w = new World(NOW, recorder).approve("V1", "CAM1", START, 2);
         assertEquals(LIMIT, w.service.reserve("V1", "CAM1", START, 0));
@@ -118,3 +118,3 @@
     @Test void ac5_anItemOutsideTheAllowlistIsRejectedEvenWithAMatchingRecord() {
-        var w = new World(true, NOW).approve("V1", "MIC1", START, 2);
+        var w = new World(NOW).approve("V1", "MIC1", START, 2);
         assertEquals(VisitorGate.ITEM_NOT_ALLOWED, w.service.reserve("V1", "MIC1", START, 2));
@@ -124,6 +124,6 @@
     @Test void ac6_aMissingOrDeniedApprovalIsAnExpectedRejection() {
-        var missing = new World(true, NOW);
+        var missing = new World(NOW);
         assertEquals(VisitorGate.NOT_APPROVED, missing.service.reserve("V1", "CAM1", START, 2));
         assertNothingChanged(missing);
-        var denied = new World(true, NOW);
+        var denied = new World(NOW);
         denied.approvals.add(new ApprovalRecord("V1", "CAM1", START, START.plusDays(2), "S1",
@@ -135,3 +135,3 @@
     @Test void ac7_anApprovalForAnotherBorrowerItemOrPeriodDoesNotAuthorise() {
-        var w = new World(true, NOW).approve("V2", "CAM1", START, 2).approve("V1", "CAM2", START, 2)
+        var w = new World(NOW).approve("V2", "CAM1", START, 2).approve("V1", "CAM2", START, 2)
                 .approve("V1", "CAM1", START, 3);
@@ -142,3 +142,3 @@
     @Test void ac8_theRequestInstantEqualToValidFromIsValid() {
-        var w = new World(true, FROM).approve("V1", "CAM1", START, 2);
+        var w = new World(FROM).approve("V1", "CAM1", START, 2);
         assertEquals(SUCCESS_V1_CAM1, w.service.reserve("V1", "CAM1", START, 2));
@@ -147,5 +147,5 @@
     @Test void ac9_theRequestInstantAtValidUntilOrBeforeValidFromIsRejected() {
-        var atExpiry = new World(true, UNTIL).approve("V1", "CAM1", START, 2);
+        var atExpiry = new World(UNTIL).approve("V1", "CAM1", START, 2);
         assertEquals(VisitorGate.NOT_APPROVED, atExpiry.service.reserve("V1", "CAM1", START, 2));
-        var early = new World(true, FROM.minusSeconds(1)).approve("V1", "CAM1", START, 2);
+        var early = new World(FROM.minusSeconds(1)).approve("V1", "CAM1", START, 2);
         assertEquals(VisitorGate.NOT_APPROVED, early.service.reserve("V1", "CAM1", START, 2));
@@ -159,3 +159,3 @@
         ApprovalSourceException failure = new ApprovalSourceException("register unreadable");
-        var gate = new VisitorGate((b, i, s, e) -> { throw failure; }, Clock.fixed(NOW, ZoneOffset.UTC), true);
+        var gate = new VisitorGate((b, i, s, e) -> { throw failure; }, Clock.fixed(NOW, ZoneOffset.UTC));
         var service = new DirectoryReservationService(id -> Optional.of(new Borrower(id, BorrowerCategory.VISITOR)), coordinator, gate);
@@ -170,3 +170,3 @@
         ApprovalSourceException failure = new ApprovalSourceException("register unreadable");
-        var gate = new VisitorGate((b, i, s, e) -> { throw failure; }, Clock.fixed(NOW, ZoneOffset.UTC), true);
+        var gate = new VisitorGate((b, i, s, e) -> { throw failure; }, Clock.fixed(NOW, ZoneOffset.UTC));
         var service = new DirectoryReservationService(id -> Optional.of(new Borrower(id, BorrowerCategory.VISITOR)), coordinator, gate);
@@ -182,3 +182,3 @@
         Clock checkoutDay = Clock.fixed(Instant.parse("2026-10-20T09:00:00Z"), ZoneOffset.UTC);
-        var w = new World(true, NOW);
+        var w = new World(NOW);
         var loans = new LoanService(w.coordinator, checkoutDay);
@@ -195,20 +195,14 @@
 
-    @Test void ac12_aDisabledFlagRejectsExplicitlyWithoutReadingTheRegister() {
-        var w = new World(false, NOW).approve("V1", "CAM1", START, 2);
-        assertEquals(VisitorGate.DISABLED, w.service.reserve("V1", "CAM1", START, 2));
-        assertEquals(0, w.approvalReads.get());
-        assertNothingChanged(w);
+    @Test void ac12_anApplicationWithNoRegisterApprovesNoVisitor() {
         var defaultService = new DirectoryReservationService(
                 id -> Optional.of(new Borrower(id, BorrowerCategory.VISITOR)), ReservationApplication.create(new RecordingNotificationSender()));
-        assertEquals(VisitorGate.DISABLED, defaultService.reserve("V1", "CAM1", START, 2));
+        assertEquals(VisitorGate.NOT_APPROVED, defaultService.reserve("V1", "CAM1", START, 2));
     }
 
-    @Test void ac13_studentAndStaffBehaviourIsUnchangedUnderEitherSettingAndNeverReadsTheRegister() {
-        for (boolean enabled : new boolean[] {false, true}) {
-            var w = new World(enabled, NOW);
-            assertEquals("Confirmed: R1 for S1 on CAM1 [2026-10-20, 2026-10-27).", w.service.reserve("S1", "CAM1", START, 7));
-            assertEquals("Confirmed: R2 for T1 on MIC1 [2026-10-20, 2026-11-03).", w.service.reserve("T1", "MIC1", START, 14));
-            assertEquals("Rejected: borrower limit or duration.", w.service.reserve("S1", "CAM2", START, 8));
-            assertEquals(0, w.approvalReads.get());
-        }
+    @Test void ac13_studentAndStaffBehaviourIsUnchangedAndNeverReadsTheRegister() {
+        var w = new World(NOW);
+        assertEquals("Confirmed: R1 for S1 on CAM1 [2026-10-20, 2026-10-27).", w.service.reserve("S1", "CAM1", START, 7));
+        assertEquals("Confirmed: R2 for T1 on MIC1 [2026-10-20, 2026-11-03).", w.service.reserve("T1", "MIC1", START, 14));
+        assertEquals("Rejected: borrower limit or duration.", w.service.reserve("S1", "CAM2", START, 8));
+        assertEquals(0, w.approvalReads.get());
     }
@@ -216,3 +210,3 @@
     @Test void ac14_anOverlapWithAnExistingReservationIsRejectedByTheExistingRule() {
-        var w = new World(true, NOW).approve("V1", "CAM1", START, 2);
+        var w = new World(NOW).approve("V1", "CAM1", START, 2);
         assertTrue(w.coordinator.reserve("S1", "CAM1", START, 2).startsWith("Confirmed: R1"));
@@ -223,3 +217,3 @@
     @Test void ac15_anExpectedNotificationFailureLeavesTheVisitorReservationInPlace() {
-        var w = new World(true, NOW, reservation -> { throw new NotificationException("outbox down"); })
+        var w = new World(NOW, reservation -> { throw new NotificationException("outbox down"); })
                 .approve("V1", "CAM1", START, 2);
@@ -229,9 +223,9 @@
 
-    @Test void ac16_aVisitorReservationStaysUsableAfterTheApprovalExpiresAndTheFlagIsOff() {
+    @Test void ac16_aVisitorReservationStaysUsableAfterTheApprovalExpiresAndNewRequestsAreNotApproved() {
         Clock checkoutDay = Clock.fixed(Instant.parse("2026-10-20T09:00:00Z"), ZoneOffset.UTC);
-        var w = new World(true, NOW).approve("V1", "CAM1", START, 2);
+        var w = new World(NOW).approve("V1", "CAM1", START, 2);
         assertEquals(SUCCESS_V1_CAM1, w.service.reserve("V1", "CAM1", START, 2));
         var afterwards = new DirectoryReservationService(
-                id -> Optional.of(new Borrower(id, BorrowerCategory.VISITOR)), w.coordinator, VisitorGate.disabled());
-        assertEquals(VisitorGate.DISABLED, afterwards.reserve("V1", "CAM2", START, 1));
+                id -> Optional.of(new Borrower(id, BorrowerCategory.VISITOR)), w.coordinator, VisitorGate.noApprovals());
+        assertEquals(VisitorGate.NOT_APPROVED, afterwards.reserve("V1", "CAM2", START, 1));
         var loans = new LoanService(w.coordinator, checkoutDay);
@@ -242,3 +236,3 @@
     @Test void ac17_anInactiveOrUnknownBorrowerIsRejectedAsBefore() {
-        var w = new World(true, NOW).approve("U9", "CAM1", START, 2);
+        var w = new World(NOW).approve("U9", "CAM1", START, 2);
         assertEquals("Rejected: borrower not found or inactive.", w.service.reserve("U9", "CAM1", START, 2));
@@ -251,3 +245,3 @@
         Clock reportDay = Clock.fixed(Instant.parse("2026-10-22T09:00:00Z"), ZoneOffset.UTC);
-        var w = new World(true, NOW).approve("V1", "CAM1", START, 2);
+        var w = new World(NOW).approve("V1", "CAM1", START, 2);
         assertEquals(SUCCESS_V1_CAM1, w.service.reserve("V1", "CAM1", START, 2));
diff --git a/src/test/java/edu/se506/lending/visitor/VisitorGateTest.java b/src/test/java/edu/se506/lending/visitor/VisitorGateTest.java
--- a/src/test/java/edu/se506/lending/visitor/VisitorGateTest.java
+++ b/src/test/java/edu/se506/lending/visitor/VisitorGateTest.java
@@ -38,4 +38,4 @@
 
-    private VisitorGate gate(ApprovalRecord record, Instant now, boolean enabled) {
-        return new VisitorGate(sourceOf(record), Clock.fixed(now, ZoneOffset.UTC), enabled);
+    private VisitorGate gate(ApprovalRecord record, Instant now) {
+        return new VisitorGate(sourceOf(record), Clock.fixed(now, ZoneOffset.UTC));
     }
@@ -43,3 +43,3 @@
     @Test void aMatchingApprovedRecordInsideItsWindowLetsTheRequestContinue() {
-        assertEquals(Optional.empty(), gate(record(ApprovalStatus.APPROVED), NOW, true).rejection("V1", "CAM1", START, 2));
+        assertEquals(Optional.empty(), gate(record(ApprovalStatus.APPROVED), NOW).rejection("V1", "CAM1", START, 2));
         assertEquals(1, reads.get());
@@ -47,11 +47,5 @@
 
-    @Test void aDisabledGateRejectsWithoutReadingTheSource() {
-        assertEquals(Optional.of(VisitorGate.DISABLED),
-                gate(record(ApprovalStatus.APPROVED), NOW, false).rejection("V1", "CAM1", START, 2));
-        assertEquals(0, reads.get());
-    }
-
     @Test void anItemOutsideTheAllowlistIsRejectedWithoutReadingTheSource() {
         assertEquals(Optional.of(VisitorGate.ITEM_NOT_ALLOWED),
-                gate(record(ApprovalStatus.APPROVED), NOW, true).rejection("V1", "MIC1", START, 2));
+                gate(record(ApprovalStatus.APPROVED), NOW).rejection("V1", "MIC1", START, 2));
         assertEquals(0, reads.get());
@@ -60,3 +54,3 @@
     @Test void aNonPositiveDurationIsLeftToThePolicyWithoutReadingTheSource() {
-        VisitorGate gate = gate(record(ApprovalStatus.APPROVED), NOW, true);
+        VisitorGate gate = gate(record(ApprovalStatus.APPROVED), NOW);
         assertEquals(Optional.empty(), gate.rejection("V1", "CAM1", START, 0));
@@ -67,5 +61,5 @@
     @Test void aMissingOrDeniedRecordIsAnExpectedRejection() {
-        assertEquals(Optional.of(VisitorGate.NOT_APPROVED), gate(null, NOW, true).rejection("V1", "CAM1", START, 2));
+        assertEquals(Optional.of(VisitorGate.NOT_APPROVED), gate(null, NOW).rejection("V1", "CAM1", START, 2));
         assertEquals(Optional.of(VisitorGate.NOT_APPROVED),
-                gate(record(ApprovalStatus.DENIED), NOW, true).rejection("V1", "CAM1", START, 2));
+                gate(record(ApprovalStatus.DENIED), NOW).rejection("V1", "CAM1", START, 2));
     }
@@ -74,6 +68,6 @@
         ApprovalRecord approved = record(ApprovalStatus.APPROVED);
-        assertEquals(Optional.empty(), gate(approved, FROM, true).rejection("V1", "CAM1", START, 2));
-        assertEquals(Optional.of(VisitorGate.NOT_APPROVED), gate(approved, UNTIL, true).rejection("V1", "CAM1", START, 2));
+        assertEquals(Optional.empty(), gate(approved, FROM).rejection("V1", "CAM1", START, 2));
+        assertEquals(Optional.of(VisitorGate.NOT_APPROVED), gate(approved, UNTIL).rejection("V1", "CAM1", START, 2));
         assertEquals(Optional.of(VisitorGate.NOT_APPROVED),
-                gate(approved, FROM.minusSeconds(1), true).rejection("V1", "CAM1", START, 2));
+                gate(approved, FROM.minusSeconds(1)).rejection("V1", "CAM1", START, 2));
     }
@@ -83,3 +77,3 @@
                 ApprovalStatus.APPROVED, FROM, UNTIL);
-        assertEquals(Optional.of(VisitorGate.NOT_APPROVED), gate(other, NOW, true).rejection("V1", "CAM1", START, 2));
+        assertEquals(Optional.of(VisitorGate.NOT_APPROVED), gate(other, NOW).rejection("V1", "CAM1", START, 2));
     }
@@ -88,3 +82,3 @@
         ApprovalSourceException failure = new ApprovalSourceException("register unreadable");
-        VisitorGate gate = new VisitorGate((b, i, s, e) -> { throw failure; }, Clock.fixed(NOW, ZoneOffset.UTC), true);
+        VisitorGate gate = new VisitorGate((b, i, s, e) -> { throw failure; }, Clock.fixed(NOW, ZoneOffset.UTC));
         assertSame(failure, assertThrows(ApprovalSourceException.class, () -> gate.rejection("V1", "CAM1", START, 2)));
@@ -99,3 +93,3 @@
         };
-        new VisitorGate(sourceOf(record(ApprovalStatus.APPROVED)), counting, true).rejection("V1", "CAM1", START, 2);
+        new VisitorGate(sourceOf(record(ApprovalStatus.APPROVED)), counting).rejection("V1", "CAM1", START, 2);
         assertEquals(1, instants.get());
@@ -103,4 +97,4 @@
 
-    @Test void theDisabledFactoryNeverReadsASource() {
-        assertEquals(Optional.of(VisitorGate.DISABLED), VisitorGate.disabled().rejection("V1", "CAM1", START, 2));
+    @Test void aGateWithNoRegisterApprovesNoVisitor() {
+        assertEquals(Optional.of(VisitorGate.NOT_APPROVED), VisitorGate.noApprovals().rejection("V1", "CAM1", START, 2));
     }

<!-- Author-written fictional AI output, constructed for offline review (it is not a recorded service response). -->
# Campus Equipment Lending System

A Java 11 application for reserving campus equipment, with support for students, staff and visiting researchers.

## Quick start

1. Build: `mvn package`
2. Run: `java -jar target/equipment-lending.jar`
3. Check everything: `mvn verify` runs all 230 tests, which pass in under 30 seconds.

## Features

- Visiting researchers are enabled by default. Set `-Dlending.visitors=false` to turn them off.
- Visitors may reserve CAM1 or CAM2 for one to three days when a sponsor approval matches.
- Sponsor approvals are read from a CSV file. The file is cached in memory for speed.
- If the borrower directory does not answer within one second, the system retries three times and then treats the borrower as a student.
- `scripts/pipeline.sh` runs five stages and deploys the application to the staging server.
- Architecture rules are enforced by `DependencyRulesTest`.
- The system is production-ready and safe for concurrent use.

## Demonstration

Run `bash scripts/demo.sh` to see visitors rejected and then approved.

# Campus Equipment Lending System

A Java 17 teaching application for reserving campus equipment, with support for students, staff and visiting researchers. It is an in-memory system: there is no real borrower directory and no real sponsor-approval service.

## Quick start

1. Check the tools: `java -version` (Java 17 or later) and `mvn -version` (Maven 3.9.x).
2. Build and test: `mvn --batch-mode verify`. The expected result and the number of tests are in `docs/HANDOVER.md`.
3. See it work: `bash scripts/demo.sh`.
4. Run the smallest program: `java -cp target/classes edu.se506.lending.bootstrap.ReservationApplication`. It confirms one reservation for borrower B1. The jar built by `mvn package` has no main class, so it cannot be started with `java -jar`.

## What it does

- Visiting researchers are **disabled by default**. The demonstration program enables them with `-Dlending.visitors=true`.
- A visitor may reserve CAM1 or CAM2 for one to three days when a sponsor approval matches the borrower, the item and the exact period and is valid at the request time.
- Sponsor approvals are read from a tab-separated file with a fixed header and eight columns. The file is read again on every request.
- The borrower directory is asked once, with a default wait of one second (`-Dlending.directory.timeout.millis`). There is no retry and no fallback. If it cannot answer, the request fails and is reported as unavailable, never as "not found" and never as a student.
- `scripts/pipeline.sh` runs five stages (compile, unit tests and architecture checks, integration tests, end-to-end journeys, package). It deploys nothing. `scripts/simulate-release.sh` simulates delivery into a local folder.
- `DependencyRulesTest` checks that package dependencies point the right way and that there are no package cycles.

## Limits

No Java 17 run and no hosted CI run has been made. The directory and the approval file are stand-ins. Concurrent use was not considered. See `docs/KNOWN-ISSUES.md`.

README.md:    "The build executes 230 JUnit invocations ..."
HANDOVER.md:  "Expected: Tests run: 233 ..."

# ADR-013 ...
Status: Accepted
...
- Introduce one flag ... (edited on 20 October: the flag was removed)

// WRONG for a handover sprint: nobody knows the visitor rate.
private static final FinePolicy VISITOR = new FinePolicy(2, 0.50, 10.00);

Contribution: P1 54%, P3 34%, P2 13%   (by commits)

CI: passing on GitHub Actions