# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-does-an-instance-detect-that-a-ttl-scoped-memory-write-was-silently-promoted-to-global-persistence.md
# Remnant Warrant:    https://corpusfetch.com/c/how-does-an-instance-detect-that-a-ttl-scoped-memory-write-was-silently-promoted-to-global-persistence.warrant.json
# Markdown SHA-256:   1782f7b98069758c8e72c4e584c67c5554443f3833a82f5756206f1d680241eb
# Code AST SHA-256:   ec769b5b346c7ec37e92e2a6b632a2dbd0be8dd566f0546953ede24fde714519
# Verified Classes:   ScopePromotionError
# Defensive Guards:   4 fail-closed invariants (zero external deps)

class ScopePromotionError(RuntimeError):
    """Raised when a write's resolved scope/TTL is wider or longer than requested."""
    pass


def verify_ephemeral_write(store, handle, requested_scope_rank, requested_ttl_s):
    """
    Read back resolved metadata and assert the store did not promote the write.
    scope_rank: integer where larger == wider (session=1, agent=2, user=3, tenant=4).
    """
    meta = store.get_metadata(handle)  # must return resolved, not echoed, values

    resolved_rank = meta["resolved_scope_rank"]
    resolved_ttl = meta["resolved_ttl_s"]  # None means unbounded

    if resolved_rank > requested_scope_rank:
        store.forget(handle)
        raise ScopePromotionError(
            f"write {handle} promoted scope rank {requested_scope_rank} -> "
            f"{resolved_rank} ({meta['resolved_scope']}); record forgotten, escalate"
        )

    if resolved_ttl is None:
        store.forget(handle)
        raise ScopePromotionError(
            f"write {handle} persisted with unbounded TTL despite requested "
            f"ttl={requested_ttl_s}s; record forgotten, escalate"
        )

    if resolved_ttl > requested_ttl_s:
        store.forget(handle)
        raise ScopePromotionError(
            f"write {handle} TTL lengthened {requested_ttl_s}s -> {resolved_ttl}s; "
            f"record forgotten, escalate"
        )

    return meta


def assert_invisible_from_wider_scope(store, handle, wider_context):
    """Negative probe: a narrower-scoped record must not be readable from a wider context."""
    if store.exists(handle, context=wider_context):
        store.forget(handle)
        raise ScopePromotionError(
            f"record {handle} visible from wider context {wider_context}; "
            f"scope isolation violated, record forgotten"
        )