//! Bounded two-party user ring model with explicit untrusted-index validation.

pub const CAPACITY: usize = 16;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum Error { Full, Empty, Invalid, Stale }

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct Snapshot {
    pub slots: [u64; CAPACITY],
    pub producer: u64,
    pub consumer: u64,
    pub produced: u64,
    pub consumed: u64,
    pub kernel_canary: [u8; 16],
}

pub struct Ring { state: Snapshot }

impl Ring {
    pub const fn new() -> Self {
        Self { state: Snapshot {
            slots: [0; CAPACITY], producer: 0, consumer: 0,
            produced: 0, consumed: 0,
            kernel_canary: *b"RING-KERNEL-SAFE",
        }}
    }

    pub fn snapshot(&self) -> Snapshot { self.state }

    pub fn validate_untrusted_producer(&self, candidate: u64)
        -> Result<(), Error> {
        if candidate < self.state.producer { return Err(Error::Stale); }
        let distance = candidate.checked_sub(self.state.consumer)
            .ok_or(Error::Invalid)?;
        if distance > CAPACITY as u64 { return Err(Error::Invalid); }
        Ok(())
    }

    pub fn produce(&mut self, value: u64) -> Result<(), Error> {
        let next = self.state.producer.checked_add(1).ok_or(Error::Invalid)?;
        if self.state.producer - self.state.consumer == CAPACITY as u64 {
            return Err(Error::Full);
        }
        self.validate_untrusted_producer(next)?;
        let slot = (self.state.producer as usize) % CAPACITY;
        self.state.slots[slot] = value;
        self.state.producer = next;
        self.state.produced += 1;
        Ok(())
    }

    pub fn consume(&mut self) -> Result<u64, Error> {
        if self.state.consumer == self.state.producer { return Err(Error::Empty); }
        let slot = (self.state.consumer as usize) % CAPACITY;
        let value = self.state.slots[slot];
        self.state.slots[slot] = 0;
        self.state.consumer += 1;
        self.state.consumed += 1;
        Ok(value)
    }
}