"""Finite original digest-NUL diagnostic contract; never alter native/raw results."""
from pathlib import Path
import hashlib, json, re
HERE = Path(__file__).resolve().parent
def sha(p): return hashlib.sha256(Path(p).read_bytes()).hexdigest()
def require(ok, label):
    if not ok: raise AssertionError(label)
def contract(): return json.loads((HERE / 'unicode-diagnostic-contract.json').read_bytes())
def review_streams(native, streams, suite, source_path=None):
    """Exact321 original attempts in stderr and logger, stdout0; every other error0.

    Marker counts are separate. A positive completion cannot whitelist a
    diagnostic. This function never deletes/changes any line or DTO field.
    """
    require(set(streams) == {'stdout', 'stderr', 'native_file'}, 'all actual diagnostic transports required')
    known = contract(); unicode = {}; other = {}; terminated = {}
    for transport, text in streams.items():
        require(type(text) is str, 'strict UTF8-decoded diagnostic transport')
        lines = text.splitlines(keepends=True)
        unicode[transport] = [l.rstrip('\r\n') for l in lines if 'Unicode parsing error' in l]
        terminated[transport] = all(l.endswith('\n') for l in lines if 'Unicode parsing error' in l)
        other[transport] = [l.rstrip('\r\n') for l in lines
            if any(t in l for t in ['ERROR:', 'SCRIPT ERROR:', 'Parse Error:'])
            or re.match(r'^\s*(?:FAIL:|FAILED:|FAIL )', l)
            or native.KNOWN_EXIT_LEAK.fullmatch(l.rstrip('\r\n'))]
    require(not any(other.values()), 'native ERROR/FAIL/ObjectDB/resource diagnostics never allowed')
    observed = {n: len(v) for n, v in unicode.items()}
    allowed = False
    if suite == known['test']:
        require(source_path is not None and sha(source_path) == known['source_sha256'], 'exact original NUL producer source required')
        require(observed == known['allowed_stream_distribution'], 'all original321 attempts and actual logger transport must agree')
        require(all(terminated.values()) and all(l == known['exact_line'] for lines in unicode.values() for l in lines),
                'exact terminated original NUL diagnostic only')
        require(unicode['stderr'] == unicode['native_file'], 'literal complete diagnostic sequence stderr/native logger equality')
        allowed = True
    else:
        require(not any(unicode.values()), 'Unicode outside exact original digest fixture is not allowed')
    return {'verified': True, 'original_NUL_fixture_contract_applied': allowed,
        'producer_source_sha256': known['source_sha256'] if allowed else None,
        'actual_transport_counts': observed, 'actual_complete_diagnostic_sequences': unicode,
        'unknown_or_error_or_leak_lines': other, 'raw_lines_deleted_or_rewritten': 0,
        'contract_sha256': sha(HERE / 'unicode-diagnostic-contract.json'),
        'allowed_e31_error_lines': known['allowed_immutable_e31_error_lines'] if allowed else []}

def diagnostic_result_gate(result, review):
    require(review['verified'] is True, 'actual finite diagnostic review required')
    expected = review['allowed_e31_error_lines']
    require(result['error_lines'] == expected, 'immutable e31 errors differ from exact finite diagnostic contract')
    raw = result['strict_native_diagnostics']
    require(raw['errors'] == expected and raw['banner_count'] == 1
        and raw['known_unicode_diagnostic_count'] == 0
        and raw['unrecognized_unicode_diagnostic_count'] == (321 if review['original_NUL_fixture_contract_applied'] else 0)
        and raw['exit_leak_diagnostic_lines'] == [], 'original e31 unmodified diagnostic report literal cardinality')
    return True