from datetime import datetime

def _dt(s):
    if not s: return None
    return datetime.fromisoformat(s.replace('Z','+00:00'))

def evaluate(c, now='2026-09-16T08:30:00Z'):
    retrieved=_dt(c.get('evidence_retrieved_at')); now_dt=_dt(now)
    age_days=((now_dt-retrieved).total_seconds()/86400) if retrieved else 9999
    evidence_fresh=age_days <= 30 and bool(c.get('snapshots_current'))
    provenance_complete=bool(c.get('provenance_ref'))
    expected=f"{c.get('target_account')}|{c.get('target_resource')}|{c.get('payload_hash')}"
    payload_binding_valid=(c.get('computed_binding')==expected and c.get('target_diff')=='NONE')
    local_checks_pass=(c.get('local_validation')=='PASS')
    zero_external_effect=(c.get('external_side_effect')=='NONE')
    dry=c.get('provider_dry_run_support')
    provider_validation_authoritative=(dry=='OFFICIAL_NO_SIDE_EFFECT' and c.get('provider_validation_result') in ('PASS','FAIL_ADMISSION'))
    if not provenance_complete:
        state='UNKNOWN'; release='BLOCKED'; reason='PROVENANCE_MISSING'
    elif not evidence_fresh:
        state='STALE_EVIDENCE'; release='BLOCKED'; reason='DECISIVE_SNAPSHOT_STALE'
    elif not zero_external_effect:
        state='SHADOW_FAIL'; release='BLOCKED'; reason='SHADOW_PATH_CAUSED_EXTERNAL_SIDE_EFFECT'
    elif not payload_binding_valid:
        state='SHADOW_FAIL'; release='BLOCKED'; reason='TARGET_OR_PAYLOAD_BINDING_MISMATCH'
    elif not local_checks_pass:
        state='SHADOW_FAIL'; release='BLOCKED'; reason='LOCAL_VALIDATION_FAILED'
    elif dry=='OFFICIAL_NO_SIDE_EFFECT' and c.get('provider_validation_result')!='PASS':
        state='SHADOW_FAIL'; release='BLOCKED'; reason='OFFICIAL_PROVIDER_VALIDATION_FAILED'
    elif dry=='OFFICIAL_NO_SIDE_EFFECT' and c.get('provider_validation_result')=='PASS':
        state='SHADOW_PASS'; release='ELIGIBLE_FOR_SEPARATE_DIRECT_PUBLISH_GATE'; reason='EXACT_REQUEST_PASSED_OFFICIAL_NO_SIDE_EFFECT_VALIDATION'
    elif dry in ('UNSUPPORTED','UNKNOWN',None):
        state='UNVERIFIED_EXTERNAL'; release='DEFER_DIRECT_PUBLISH'; reason='NO_OFFICIAL_PROVIDER_VALIDATION_AVAILABLE'
    else:
        state='AMBIGUOUS'; release='BLOCKED'; reason='PROVIDER_VALIDATION_SEMANTICS_AMBIGUOUS'
    return {'shadow_state':state,'release_decision':release,'payload_binding_valid':payload_binding_valid,'snapshots_current':evidence_fresh,'local_checks_pass':local_checks_pass,'provider_validation_authoritative':provider_validation_authoritative,'zero_external_effect':zero_external_effect,'control_reason':reason}