# GTR015 — format="input" → format_source (runtime-gated)

**Contract:** behaviour-preserving (provable subset).
## Claim
Rewriting `format="input"` to `format_source="<name>"` preserves behaviour when
the tool has exactly one data input, top-level **or** conditional/section-nested.

## Proof
- Galaxy keys `input_datasets` by **prefixed (qualified) name**
  (`tools/actions/__init__.py:222`; prefixed keying back to `release_16.04`);
  `determine_output_format` looks `format_source` up in exactly that map
  (`:1283-1286`). Conditional/section ancestors contribute `name|`; `<when>`
  contributes nothing (`visit_input_values`). Qualified references are
  upstream-tested (`test/functional/tools/format_source_in_conditional.xml`).
- **Absent-at-runtime corner** (unselected branch / empty optional): pre-16.04
  `format="input"` resolved to `"data"` (no datasets walked); a missing
  `format_source` key falls through to the parsed format default — also
  `"data"` (`parser/xml.py:1453`). Galaxy's own conditional test tool exercises
  this fallthrough.

## Scope boundary (construction-unprovable)
Multi-input (Galaxy resolves bare `format="input"` to a **random** input's ext
— its own `TODO`-marked nondeterminism: no deterministic behaviour exists);
zero-input; repeat-nested (instance-indexed prefix `r_0|` — no static address);
outputs already carrying `format_source` (inert `format="input"`; §24 guard).

## History
Top-level-only → qualified-nested widening, codemod §40 (0 corpus tools — the
1 nested corpus tool is repeat-nested; novel-tool insurance).