# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-distinguishes-an-authoritative-memory-tombstone-from-a-resurrection-hazard.md
# Remnant Warrant:    https://corpusfetch.com/c/what-distinguishes-an-authoritative-memory-tombstone-from-a-resurrection-hazard.warrant.json
# Markdown SHA-256:   71acd22536a4076623ea6e14caccca1560778cc2e77275eb605bbf01f8b149a3
# Code AST SHA-256:   4247ab046a847d6f7f77563f18206f568644af0d9f5b77007773b134bb8fd719
# Verified Classes:   TombstoneVerdict, RecordState, TombstoneContext, TombstoneManifest, AuthoritativeTombstoneGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class TombstoneVerdict(Enum):
    LIVE_RECORD = auto()
    TOMBSTONE_ACTIVE = auto()
    RESURRECTION_BLOCKED = auto()
    REVOCATION_PRESENT = auto()

@dataclass(frozen=True)
class RecordState:
    record_id: str
    version: int
    tombstone_signature: str | None
    tombstone_version: int | None
    tombstone_epoch: float | None
    revocation_signature: str | None

@dataclass(frozen=True)
class TombstoneContext:
    current_epoch: float
    require_revocation_for_resurrection: bool

@dataclass(frozen=True)
class TombstoneManifest:
    verdict: TombstoneVerdict
    directive: str
    manifest_digest: str

class AuthoritativeTombstoneGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_record(
        cls, state: RecordState, ctx: TombstoneContext
    ) -> TombstoneManifest:
        
        # Gate 1: No tombstone (live record)
        if not state.tombstone_signature:
            digest = cls._hash(json.dumps({
                "record": state.record_id,
                "version": str(state.version)
            }, sort_keys=True))
            return TombstoneManifest(
                verdict=TombstoneVerdict.LIVE_RECORD,
                directive="PROCEED: No tombstone. Record is live.",
                manifest_digest=digest
            )

        # Gate 2: Revocation present
        if state.revocation_signature:
            if state.tombstone_version is not None and state.version <= state.tombstone_version:
                return TombstoneManifest(
                    verdict=TombstoneVerdict.RESURRECTION_BLOCKED,
                    directive=f"HALT: Revocation present but record version {state.version} <= tombstone {state.tombstone_version}.",
                    manifest_digest=cls._hash(f"STALE_AFTER_REVOKE:{state.record_id}")
                )
            digest = cls._hash(json.dumps({
                "record": state.record_id,
                "revocation": state.revocation_signature
            }, sort_keys=True))
            return TombstoneManifest(
                verdict=TombstoneVerdict.REVOCATION_PRESENT,
                directive="PROCEED: Tombstone revoked. Record is legitimately recreated.",
                manifest_digest=digest
            )

        # Gate 3: Resurrection attempt without revocation
        if state.tombstone_version is not None and state.version > state.tombstone_version:
            return TombstoneManifest(
                verdict=TombstoneVerdict.RESURRECTION_BLOCKED,
                directive=f"HALT: Version {state.version} exceeds tombstone version {state.tombstone_version} without revocation. Blocked.",
                manifest_digest=cls._hash(f"RESURRECTION:{state.record_id}")
            )

        # Gate 4: Tombstone active
        digest = cls._hash(json.dumps({
            "record": state.record_id,
            "tombstone": state.tombstone_signature,
            "version": str(state.tombstone_version)
        }, sort_keys=True))
        return TombstoneManifest(
            verdict=TombstoneVerdict.TOMBSTONE_ACTIVE,
            directive="HALT: Tombstone is authoritative. Record is deleted.",
            manifest_digest=digest
        )