#!/usr/bin/env python3
"""stability_check.py -- byte-identical saves must produce identical roots.

Groups the given saves by file sha256 and checks that every file in a group
gets the same root digest, and that every file's coverage audit passes.  This
is the direct machine check of the determinism-oracle claim, one level up from
sha256: it also proves the *parse* is deterministic, not just the bytes.

    uv run python3 stability_check.py SAVE...
"""
from __future__ import annotations

import hashlib
import os
import sys

_HERE = os.path.dirname(os.path.abspath(__file__))
if _HERE not in sys.path:
    sys.path.insert(0, _HERE)

import state_checksum as sc  # noqa: E402


def main(argv=None) -> int:
    argv = list(sys.argv[1:] if argv is None else argv)
    if not argv:
        print("usage: stability_check.py SAVE...", file=sys.stderr)
        return 2
    groups: dict = {}
    for p in argv:
        with open(p, "rb") as f:
            groups.setdefault(hashlib.sha256(f.read()).hexdigest()[:16], []).append(p)
    print(f"reader fingerprint: {sc.READER_FINGERPRINT}")
    print(f"{len(argv)} file(s), {len(groups)} distinct content(s)")
    print()
    bad = 0
    for h, paths in sorted(groups.items()):
        roots: dict = {}
        cov_fail = []
        for p in paths:
            ck = sc.checksum_save(p)
            roots.setdefault(ck.digest, []).append(os.path.basename(p))
            if not ck.coverage["ok"]:
                cov_fail.append((os.path.basename(p), ck.coverage["firstDiff"]))
        ok = len(roots) == 1 and not cov_fail
        bad += not ok
        print(f"sha256:{h}  {len(paths)} file(s)  "
              f"{'STABLE + COVERED' if ok else 'PROBLEM'}")
        for r, names in roots.items():
            print(f"    root {r}  {', '.join(sorted(names))}")
        for name, off in cov_fail:
            print(f"    !! coverage failed for {name} at inflated offset {off}")
    print()
    print("VERDICT:", "all stable and fully covered" if not bad
          else f"{bad} group(s) unstable or uncovered")
    return 1 if bad else 0


if __name__ == "__main__":
    sys.exit(main())