import: remediate review findings — ledger gate, docs, message split

Delegates the refuse-gate to ledgerDegraded(), lifts its console message into a
pure testable fold, fixes stale doc line citations and an inaccurate outcome-enum
comment, and splits the rename counter into collision-vs-sanitize.

tests/test_import_landing.cpp

@@ -372,7 +372,9 @@ static void testReimportingIntoTheSourceProjectLandsBesideAnUntouchedOriginal()
     CHECK(third.landing.outcome == ImportOutcome::Landed);
     CHECK(book.bank("bank-b3")->displayName == "B 3");
     CHECK(*book.index("bank-b") == originalB);
-    // Six distinct files: the original two plus two per re-import, never overwritten.
+    // Four distinct files: two per re-import, never overwritten. Bank "B"'s own two
+    // entries were seeded index-only above (book.index("bank-b")->add), never written
+    // to disk, so they don't add to this count.
     CHECK(scratch.bankFiles().size() == 4);
 }
 

tests/test_import_plan.cpp

@@ -202,7 +202,8 @@ static void testAFreeBankLegalNameIsKept() {
                                        {"unrelated.wav"}, kTag);
     CHECK(landed(plan, 0).destFileName == "kick.wav");
     CHECK(!landed(plan, 0).renamed);
-    CHECK(plan.renameCount == 0);
+    CHECK(plan.collisionRenameCount == 0);
+    CHECK(plan.sanitizeRenameCount == 0);
     CHECK(landed(plan, 0).sample.relativePath == "reasampler_bank/kick.wav");
 }
 
@@ -212,7 +213,9 @@ static void testATakenNameIsMintedFreshAndNeverOverwritten() {
                                        {"kick.wav"}, kTag);
     CHECK(landed(plan, 0).destFileName != "kick.wav");
     CHECK(landed(plan, 0).renamed);
-    CHECK(plan.renameCount == 1);
+    // A genuine folder-name collision, not a spelling mint.
+    CHECK(plan.collisionRenameCount == 1);
+    CHECK(plan.sanitizeRenameCount == 0);
     CHECK(landed(plan, 0).sample.relativePath ==
           "reasampler_bank/" + landed(plan, 0).destFileName);
 }
@@ -224,6 +227,9 @@ static void testTheFolderNameCheckFoldsAsciiCase() {
                                        {"KICK.WAV"}, kTag);
     CHECK(landed(plan, 0).destFileName != "kick.wav");
     CHECK(landed(plan, 0).renamed);
+    // The case-fold hit is still a collision, not a spelling mint.
+    CHECK(plan.collisionRenameCount == 1);
+    CHECK(plan.sanitizeRenameCount == 0);
 }
 
 static void testTwoEntriesNeverLandOnOneName() {
@@ -242,6 +248,9 @@ static void testAnUnsanitaryNameIsMintedRatherThanLandedVerbatim() {
                    bookWithBanks({}), kProjectDir, {}, kTag);
     CHECK(landed(plan, 0).destFileName.find(' ') == std::string::npos);
     CHECK(landed(plan, 0).renamed);
+    // No collision here (the bank folder is empty) — this is a sanitize mint.
+    CHECK(plan.sanitizeRenameCount == 1);
+    CHECK(plan.collisionRenameCount == 0);
 }
 
 // --- content hash (collision class 3) ----------------------------------------
@@ -334,6 +343,46 @@ static void testAnUndecodableUsageKeyBlocksPruneButNotImport() {
     CHECK(importLedgerRefusal(tracking::LedgerStatus::Loaded) == LedgerRefusal::None);
 }
 
+// Pins the delegation itself: importLedgerRefusal must refuse EXACTLY the statuses
+// ledgerDegraded() calls degraded, over every value the enum has today. A gate that
+// re-derived its own notion of "degraded" could silently diverge from this the moment
+// either side changes without the other.
+static void testImportLedgerRefusalDelegatesToLedgerDegraded() {
+    const tracking::LedgerStatus all[] = {
+        tracking::LedgerStatus::Fresh,
+        tracking::LedgerStatus::Loaded,
+        tracking::LedgerStatus::Unreadable,
+        tracking::LedgerStatus::FutureVersion,
+    };
+    for (tracking::LedgerStatus s : all)
+        CHECK((importLedgerRefusal(s) != LedgerRefusal::None) == tracking::ledgerDegraded(s));
+}
+
+// --- the ledger-refusal message (pure, so both channels are assertable without a DAW) --
+
+static void testLedgerRefusalMessageIsEmptyForNone() {
+    CHECK(ledgerRefusalMessage(LedgerRefusal::None, "reasampler").empty());
+}
+
+static void testLedgerRefusalMessageNamesTheChannelCorrectNamespace() {
+    // The two real namespaces (app_version.h): stable "reasampler", beta "reasampler_beta".
+    const std::string stable = ledgerRefusalMessage(LedgerRefusal::Malformed, "reasampler");
+    CHECK(stable.find("\"reasampler\"") != std::string::npos);
+    CHECK(stable.find("reasampler_beta") == std::string::npos);
+
+    const std::string beta = ledgerRefusalMessage(LedgerRefusal::Malformed, "reasampler_beta");
+    CHECK(beta.find("\"reasampler_beta\"") != std::string::npos);
+}
+
+static void testLedgerRefusalMessageDistinguishesMalformedFromFutureVersion() {
+    const std::string malformed = ledgerRefusalMessage(LedgerRefusal::Malformed, "reasampler");
+    const std::string futureVersion =
+        ledgerRefusalMessage(LedgerRefusal::FutureVersion, "reasampler");
+    CHECK(malformed != futureVersion);
+    CHECK(malformed.find("malformed") != std::string::npos);
+    CHECK(futureVersion.find("NEWER version") != std::string::npos);
+}
+
 int main() {
     testFreeSeedIsKeptVerbatim();
     testFoldedCollisionTakesTheFirstSuffix();
@@ -364,6 +413,11 @@ int main() {
 
     testDegradedLedgerStatusesRefuseAndTheUsableOnesDoNot();
     testAnUndecodableUsageKeyBlocksPruneButNotImport();
+    testImportLedgerRefusalDelegatesToLedgerDegraded();
+
+    testLedgerRefusalMessageIsEmptyForNone();
+    testLedgerRefusalMessageNamesTheChannelCorrectNamespace();
+    testLedgerRefusalMessageDistinguishesMalformedFromFutureVersion();
 
     if (g_fail == 0) std::printf("import_plan: all tests passed\n");
     return g_fail == 0 ? 0 : 1;