# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/in-what-scenarios-must-an-instance-quarantine-a-tool-output-as-tainted-rather-than-sanitize-in-place-the-provenance-collapse-boundary-in-taint-aware-s.md
# Remnant Warrant:    https://corpusfetch.com/c/in-what-scenarios-must-an-instance-quarantine-a-tool-output-as-tainted-rather-than-sanitize-in-place-the-provenance-collapse-boundary-in-taint-aware-s.warrant.json
# Markdown SHA-256:   619f7aa208e829a618a2b8265d8d9618a4f81d97e4928236d7e9013fe1c4e216
# Code AST SHA-256:   af5c9feac2f1a6bda2eec7682c0efd288048586fc3a0381ebef2f998cd4da3ad
# Verified Classes:   ProvenanceCollapseError
# Defensive Guards:   4 fail-closed invariants (zero external deps)

class ProvenanceCollapseError(RuntimeError):
    """Raised when a tainted object would be sanitized-in-place despite
    derivation opacity, principal non-monotonicity, or label/content
    domain divergence — i.e., when sanitization cannot discharge the label."""


GENERATIVE_STEPS = {"summarize", "paraphrase", "translate", "reformat_code"}


def choose_remediation(obj) -> str:
    # Derivation opacity: a generative step over tainted input launders the payload.
    if any(step in GENERATIVE_STEPS for step in obj.derivation_chain) and obj.input_tainted:
        raise ProvenanceCollapseError(
            f"object {obj.id} derived via {obj.derivation_chain} over tainted input; "
            "sanitizer cannot see paraphrased payload — quarantine required"
        )
    # Principal non-monotonicity: merge may have raised trust.
    if not obj.principal_merge_is_least_trusted_join:
        raise ProvenanceCollapseError(
            f"object {obj.id} principal merge is not a least-trusted join; "
            "label under-reports taint — quarantine required"
        )
    # Label/content domain divergence.
    if obj.label_domain != obj.sanitizer.domain:
        raise ProvenanceCollapseError(
            f"object {obj.id} label domain {obj.label_domain} != "
            f"sanitizer domain {obj.sanitizer.domain} — content-clean is not provenance-clean"
        )
    # Taint on an actionable context carries authority.
    if obj.will_reenter_actionable_context:
        raise ProvenanceCollapseError(
            f"object {obj.id} re-enters actionable context; taint is authority, not text"
        )
    return "SANITIZE_IN_PLACE"


def ingest(obj) -> None:
    verb = choose_remediation(obj)
    if verb == "SANITIZE_IN_PLACE":
        obj.content = obj.sanitizer.apply(obj.content)
        obj.taint = "cleared"
    else:
        obj.route_to_quarantine()