//! Shared deterministic `ort::Session` loader, used by both the neural
//! decode path and the semantic (perceptual) path.
//!
//! Single intra-op + inter-op thread and a fixed graph-optimization level so
//! float ONNX inference is reproducible run-to-run and machine-to-machine —
//! determinism is load-bearing for any conformance claim (see
//! `neural/runtime.rs`). Throughput is traded for reproducibility on purpose.

use std::path::Path;
use ort::session::{builder::GraphOptimizationLevel, Session};

/// Load an ONNX model into a deterministic CPU session. Returns the raw ort
/// error as a `String`; callers wrap it into their own error type.
pub(crate) fn load_deterministic(path: &Path) -> Result<Session, String> {
    Session::builder()
        .map_err(|e| format!("session builder: {e}"))?
        .with_intra_threads(1)
        .map_err(|e| format!("intra-threads: {e}"))?
        .with_inter_threads(1)
        .map_err(|e| format!("inter-threads: {e}"))?
        .with_optimization_level(GraphOptimizationLevel::Level3)
        .map_err(|e| format!("optimization level: {e}"))?
        .commit_from_file(path)
        .map_err(|e| format!("load {} failed: {e}", path.display()))
}

/// [`load_deterministic`] over model bytes already in memory — the bytes a pin
/// verified, so the session runs exactly what was hashed. A model that keeps
/// tensors in external files would have the runtime read them from outside those
/// bytes; the pinned decode refuses such a model before calling this
/// (`neural::params`).
#[cfg(feature = "neural")]
pub(crate) fn load_deterministic_from_memory(bytes: &[u8]) -> Result<Session, String> {
    Session::builder()
        .map_err(|e| format!("session builder: {e}"))?
        .with_intra_threads(1)
        .map_err(|e| format!("intra-threads: {e}"))?
        .with_inter_threads(1)
        .map_err(|e| format!("inter-threads: {e}"))?
        .with_optimization_level(GraphOptimizationLevel::Level3)
        .map_err(|e| format!("optimization level: {e}"))?
        .commit_from_memory(bytes)
        .map_err(|e| format!("load from verified bytes failed: {e}"))
}