//! K400: production writes remain a compile-time and policy-level closed gate.
//! Completed disposable-disk experiments are evidence for specific transitions,
//! not permission to write arbitrary user disks.

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum GateError {
    MissingEvidence,
    UnknownEvidence,
    RecoveryUnavailable,
}

pub const OUT_STATUS: u16 = 1 << 0;
pub const READBACK: u16 = 1 << 1;
pub const FLUSH_REOPEN: u16 = 1 << 2;
pub const EIO: u16 = 1 << 3;
pub const DMA_CANCEL: u16 = 1 << 4;
pub const DISK_TRANSITION: u16 = 1 << 5;
pub const ALLOCATION_CONSISTENCY: u16 = 1 << 6;
pub const JOURNAL_REPLAY: u16 = 1 << 7;
pub const FAILURE_MATRIX: u16 = 1 << 8;
pub const REQUIRED: u16 = (1 << 9) - 1;

// These experiments have passed their bounded tests. No journal/replay or
// power-failure recovery evidence is represented as complete.
pub const VERIFIED_EXPERIMENTS: u16 = OUT_STATUS
    | READBACK
    | FLUSH_REOPEN
    | EIO
    | DMA_CANCEL
    | DISK_TRANSITION
    | ALLOCATION_CONSISTENCY;

pub const fn evaluate(evidence: u16, recovery_implemented: bool) -> Result<(), GateError> {
    if evidence & !REQUIRED != 0 {
        return Err(GateError::UnknownEvidence);
    }
    if evidence != REQUIRED {
        return Err(GateError::MissingEvidence);
    }
    if !recovery_implemented {
        return Err(GateError::RecoveryUnavailable);
    }
    Ok(())
}

pub const fn production_write_ready() -> bool {
    evaluate(VERIFIED_EXPERIMENTS, false).is_ok()
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn k400_production_write_gate_rejects_every_missing_prerequisite() {
        assert!(!production_write_ready());
        assert_eq!(
            evaluate(VERIFIED_EXPERIMENTS, false),
            Err(GateError::MissingEvidence)
        );
        for bit in 0..9 {
            assert_eq!(
                evaluate(REQUIRED & !(1 << bit), true),
                Err(GateError::MissingEvidence)
            );
        }
        assert_eq!(
            evaluate(REQUIRED | (1 << 9), true),
            Err(GateError::UnknownEvidence)
        );
        assert_eq!(
            evaluate(REQUIRED, false),
            Err(GateError::RecoveryUnavailable)
        );
        // Policy logic is not a release approval: the Cargo feature above is
        // still compile_error! until an independently reviewed protocol exists.
        assert_eq!(evaluate(REQUIRED, true), Ok(()));
    }

    #[test]
    fn preaudit_exhaustive_evidence_space_has_one_ready_point_only() {
        // Internal pre-audit, not the independent review: all 2^16 x 2 inputs.
        let mut ready = 0;
        for evidence in 0..=u16::MAX {
            for recovery in [false, true] {
                let result = evaluate(evidence, recovery);
                if result.is_ok() {
                    ready += 1;
                    assert_eq!((evidence, recovery), (REQUIRED, true));
                }
                if evidence & !REQUIRED != 0 {
                    assert_eq!(result, Err(GateError::UnknownEvidence));
                }
            }
        }
        assert_eq!(ready, 1);
        assert_eq!(
            REQUIRED & !VERIFIED_EXPERIMENTS,
            JOURNAL_REPLAY | FAILURE_MATRIX
        );
        assert!(!production_write_ready());
    }
}