"""Read only preserved evidence. Does not import or execute historical helpers."""
from pathlib import Path
import hashlib
import json

BASE = Path(__file__).resolve().parent
def sha(path):
    return hashlib.sha256(path.read_bytes()).hexdigest()
def read(name):
    return json.loads((BASE / name).read_text(encoding='utf-8'))
def require(condition, message):
    if not condition:
        raise SystemExit('FAIL: ' + message)

manifest = read('MANIFEST.json')
expected = {item['path'] for item in manifest['files']}
actual = {p.relative_to(BASE).as_posix() for p in BASE.rglob('*') if p.is_file()} - {'MANIFEST.json'}
require(actual == expected, 'archive file set')
for item in manifest['files']:
    p = BASE / item['path']
    require(p.resolve().is_relative_to(BASE), 'path containment')
    require(p.stat().st_size == item['bytes'] and sha(p) == item['sha256'], item['path'])
require(sha(BASE/'ORIGINALS.json') == 'ef655a81362a661d9ffe0d534b760c6d9b395b5aa05f5b0b4d9194ac645743fa', 'original whitelist pin')
originals = read('ORIGINALS.json')['files']
require(len(originals) == 58, 'original count')
for item in originals:
    p = BASE/item['path']
    require(p.stat().st_size == item['bytes'] and sha(p) == item['sha256'], 'original '+item['path'])
prefix = 'payload/trial/'
binding = read('payload/binding.json')
require(sha(BASE/'payload/binding.json') == read(prefix+'admission.json')['binding_sha256'], 'admission binding')
require(binding['archive_sha256'] == 'd7228c542f162663933ea002739a78c722bcca41e437df63b7c868ea2af201f1' and binding['archive_bytes'] == 32971712, 'ZIP binding')
before = read(prefix+'package-before.json')
require(len(before) == 559, 'package map count')
for name in ['navigation-final-saved-package.json', 'navigation-final-saved-after-oracle-package.json', 'after-close-readonly-package.json']:
    receipt = read(prefix+name)
    require(receipt['files'] == before and receipt['archive_sha256'] == binding['archive_sha256'], name)
checkpoint = prefix+'checkpoints/navigation-final-saved/'
sources = read(checkpoint+'sources.json')
require(len(sources) == 4 and sources == read(prefix+'source-before.json'), 'source map baseline')
for name, digest in sources.items():
    require(sha(BASE/checkpoint/'sources'/name) == digest, 'source '+name)
oracle = read(checkpoint+'result.json')
require(oracle['exitCode'] == 0 and oracle['oracle_sha256'] == '967d9ba3c6fb3a7efb410833903ec94556ca2d48a67d5072c8bb160f40a00f9c', 'recorded oracle')
require('PASS exact model/identity/4 reachable sources; 4 exact disk files' in (BASE/checkpoint/'stdout.log').read_text(), 'oracle output')
modules = read(prefix+'loaded-modules.json')
require(modules['status'] == 'PASS' and len(modules['modules']) == 126 and all(m['windowsPath'] or m['packagePath'] for m in modules['modules']), 'recorded module scope')
closed = read(prefix+'closed-readonly.json')
process = read(prefix+'closed-readonly-process.json')
require(closed['status'] == 'PASS' and closed['completePackageUnchanged'], 'closure receipt')
require(sha(BASE/prefix/'closed-readonly-process.json') == closed['process_receipt_sha256'] and sha(BASE/prefix/'after-close-readonly-package.json') == closed['package_receipt_sha256'], 'closure links')
require(process['pid'] == read(prefix+'launch.json')['pid'] == 1348 and process['originalCreationFiletime'] == process['currentCreationFiletime'] == read(prefix+'process-identity.json')['creation_filetime'] == 134336355202397809 and process['exitCodeQueried'] == 0 and process['originalProcessAbsent'], 'terminal process identity')
require(sha(BASE/'payload/close_readonly.py') == '16921ad616344132c4f1a7cd8fc49276dbbb8ee32415432d5b1604eb73fae43c', 'root-reviewed closure helper')
require(read('payload/original-close-observation.json')['original_win32_error'] is None and not (BASE/prefix/'closed.json').exists(), 'original failure preserved')
shots = BASE/prefix/'screenshots'
require(len(list(shots.glob('*.jpg'))) == len(list(shots.glob('*.json'))) == 11, 'capture counts')
for p in shots.glob('*.json'):
    meta = json.loads(p.read_text(encoding='utf-8'))
    require(len(meta['screenshots']) == 1, 'single capture')
    capture = meta['screenshots'][0]
    require(capture['width'] == 1442 and capture['height'] == 932 and (shots/capture['filename']).is_file(), 'capture metadata')
print('PASS preserved native archive: 58 original files; 11 captures; 559-file maps; 4 exact sources; recorded oracle/modules/terminal closure relationships. No runtime checks rerun.')