#!/usr/bin/env python3
"""Root audit of new Activity fixture; original failed evidence remains immutable."""
import hashlib
import json
from pathlib import Path
import stat
import subprocess
import sys
import integrate_20261010 as tool
from integrate_20261011_batches46_48 import item

BASE = tool.STORE + 'parallel-store-activity-crud4-20261011/'
NEW = BASE + 'repaired-new-fixture/'

def sealed(base, expected, count):
    private = tool.ROOT / base / 'private'
    manifest = private / 'manifest.json'
    assert hashlib.sha256(manifest.read_bytes()).hexdigest() == expected
    records = json.loads(manifest.read_text())['files']
    assert len(records) == count
    assert stat.S_IMODE(private.stat().st_mode) == 0o700
    for record in records:
        relative = Path(record['path'])
        assert not relative.is_absolute() and '..' not in relative.parts
        path = private / relative
        assert not path.is_symlink() and path.is_file()
        raw = path.read_bytes()
        assert len(raw) == record['bytes']
        assert hashlib.sha256(raw).hexdigest() == record['sha256']
        assert oct(stat.S_IMODE(path.stat().st_mode)) == record['mode']

def verify():
    sealed(BASE, 'ff05c34aa2b924972ed09d93af8f1d655b8d14e8358a3a628f8bcbb8ec5908da', 173)
    sealed(NEW, '4096d362755ced8135ce4a4c721c5657192a563f99889096800c1ffc5fa4fd16', 172)
    result = subprocess.run([sys.executable, '-B', str(tool.ROOT / NEW / 'verify.py')],
        check=True, capture_output=True, text=True)
    evidence = json.loads(result.stdout)
    assert evidence['checks'] == 594 and evidence['cross_full_DTO_pairs'] == 11
    assert evidence['strict_type_mutations_rejected'] == 7
    for lane, reads in [('B', 347), ('C', 401)]:
        facts = evidence['lanes'][lane]
        assert facts['HTTP'] == 11 and facts['native_INSERT'] == facts['native_DELETE'] == 1
        assert facts['native_UPDATE_attempts'] == 3 and facts['canonical_repeat_affected'] == 0
        assert facts['canonical_repeat_code'] == 1 and facts['final_all_state_exact']
        assert facts['unified_readonly_total'] == reads and facts['resource_include_records'] == 844
        receipt = tool.load(NEW + 'private/' + lane + '/resource-proof.json')
        assert receipt['source_mapping_sha256'] == 'f26f6dd15e86f3b34e23cde8413b660683cc5656f542b85973581c441c747738'
    pin = tool.load('work/2026-09-28-smart-canteen-dm8-poc/matrix-integration/STORE_APPLICATION_20261011_1034.json')
    assert len(pin) == 959
    for relative, digest in pin.items():
        assert hashlib.sha256((tool.ROOT.parent / 'zhctproject/store/application' / relative).read_bytes()).hexdigest() == digest

def targets():
    return [item('store', 'POST', '/p/activity/' + action, NEW,
        risk='owned-future-activity-native-CRUD-and-complete-typed-response',
        request_type='application/json',
        parity='partial-evidence-eleven-complete-DTO-pairs-equal-four-proven-environment-fields-mapped',
        success_case='partial-evidence-new-fixture-native-INSERT-UPDATE-DELETE-and-full-typed-readback',
        duplicate_retry=('partial-evidence-canonical-repeat-hide-both-affected0-original-code1'
            if action == 'able' else 'not-tested'),
        boundary_empty_min_max='partial-evidence-owned-nonempty-final-empty-and-valid-zero-fraction-dates-only',
        cleanup='new-owned-row-deleted-whole-baseline-restored-workers-tokens-cache-source-copies-released')
        for action in ['add', 'update', 'able', 'delete', 'info', 'lists']]

if __name__ == '__main__':
    audit = Path(__file__).with_name('integration-20261011-batch84.json')
    assert not audit.exists(), 'Preserve one-time transition audit'
    tool.main(targets(), audit, verify)