#!/usr/bin/env bash
set -u
umask 077

STEP="STEP_050M07R09_INSTALL_REFRESH_POOL_SAFE_WITH_ROLLBACK"

TOKEN="e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4"
ROOT="/opt/router-ops"
STATE="$ROOT/state"
PUBROOT="$ROOT/public/r/$TOKEN"
PUBLIC_BASE="https://helena-background-beam-harry.trycloudflare.com/r/$TOKEN"

WORKFLOW_STATE="$STATE/current-m07-workflow.env"

TS="$(date -u +%Y%m%d-%H%M%S)"
REPORT_SLUG="${TS}_step050m07r09_install_refresh_pool_safe_with_rollback"
REPORT_DIR="$PUBROOT/$REPORT_SLUG"

TRYCF_REPORT="$PUBLIC_BASE/$REPORT_SLUG/"
REPORT_TXT="${TRYCF_REPORT}report.txt"
FACTS_JSON="${TRYCF_REPORT}facts.json"

VM101_REFERENCE="$PUBLIC_BASE/vm101-reference/current/"
VM101_CANONICAL="$PUBLIC_BASE/vm101-canonical/current/"

REMOTE_ARCHIVE="/tmp/m07-refresh-pool-safe-${TS}.tar.gz"
REMOTE_SCRIPT="/tmp/m07-r09-install-${TS}.sh"

REMOTE_RESULT="$REPORT_DIR/vm101-install.env"
UPLOAD_STDERR="$REPORT_DIR/upload.stderr"
INSTALL_STDERR="$REPORT_DIR/install-transport.stderr"

BUNDLE="UNRESOLVED"
ARCHIVE="UNRESOLVED"
BUNDLE_NAME="UNRESOLVED"

SOURCE_SHA="UNRESOLVED"
CANDIDATE_SHA="UNRESOLVED"
RUNTIME_SHA="UNRESOLVED"
ARCHIVE_SHA="UNRESOLVED"

LOCAL_OK=false
UPLOAD_OK=false
TRANSPORT_OK=false
REMOTE_PASS=false
INSTALL_COMMITTED=false
ROLLBACK_ATTEMPTED=false
ROLLBACK_PASS=false
WORKFLOW_UPDATED=false

UPLOAD_RC=255
TRANSPORT_RC=255
FAILURE_REASON="NONE"
BACKUP_DIR="NONE"

mkdir -p "$REPORT_DIR"

cp -a "$0" "$REPORT_DIR/step.sh"
chmod 600 "$REPORT_DIR/step.sh"

value() {
  sed -n "s/^${2}=//p" "$1" |
    tail -n1
}

bool_value() {
  sed -n "s/^${2}=//p" "$1" |
    tail -n1
}

write_report() {
  if [ "$REMOTE_PASS" = "true" ]; then
    DECISION="PASS_${STEP}"
    EXECUTION="PASS"
    OPERATION="REFRESH_POOL_SAFE_INSTALLED_AND_VERIFIED"
    ALL_OK=true
    NEXT_STEP="BUILD_AND_TEST_CODE_TEST_ONLY"
  else
    DECISION="STOP_${STEP}_${FAILURE_REASON}"
    EXECUTION="STOP"
    OPERATION="REFRESH_POOL_SAFE_INSTALL_NOT_COMMITTED"
    ALL_OK=false
    NEXT_STEP="AUDIT_REFRESH_POOL_SAFE_INSTALL_OR_ROLLBACK"
  fi

  python3 - \
    "$REPORT_DIR/facts.json" \
    "$REMOTE_RESULT" \
    "$STEP" \
    "$DECISION" \
    "$EXECUTION" \
    "$OPERATION" \
    "$FAILURE_REASON" \
    "$BUNDLE" \
    "$ARCHIVE" \
    "$SOURCE_SHA" \
    "$CANDIDATE_SHA" \
    "$RUNTIME_SHA" \
    "$ARCHIVE_SHA" \
    "$LOCAL_OK" \
    "$UPLOAD_OK" \
    "$TRANSPORT_OK" \
    "$UPLOAD_RC" \
    "$TRANSPORT_RC" \
    "$REMOTE_PASS" \
    "$INSTALL_COMMITTED" \
    "$ROLLBACK_ATTEMPTED" \
    "$ROLLBACK_PASS" \
    "$BACKUP_DIR" \
    "$ALL_OK" \
    "$NEXT_STEP" \
    "$TRYCF_REPORT" \
    "$REPORT_TXT" \
    "$FACTS_JSON" <<'PY'
import json
import sys
from pathlib import Path

(
    output,
    remote_file,
    step,
    decision,
    execution,
    operation,
    failure_reason,
    bundle,
    archive,
    source_sha,
    candidate_sha,
    runtime_sha,
    archive_sha,
    local_ok,
    upload_ok,
    transport_ok,
    upload_rc,
    transport_rc,
    remote_pass,
    install_committed,
    rollback_attempted,
    rollback_pass,
    backup_dir,
    all_ok,
    next_step,
    report,
    report_txt,
    facts_json,
) = sys.argv[1:]

remote = {}
path = Path(remote_file)

if path.is_file():
    for line in path.read_text(
        encoding="utf-8",
        errors="replace",
    ).splitlines():
        if "=" not in line:
            continue

        key, value = line.split("=", 1)

        if value == "true":
            value = True
        elif value == "false":
            value = False
        elif value.isdigit():
            value = int(value)

        remote[key] = value

data = {
    "schema": "router-step-facts-v1",
    "step": step,
    "assessment": {
        "decision": decision,
        "step_execution": execution,
        "operation_result": operation,
        "production_health": (
            "HEALTHY_5_OF_5"
            if remote.get("after_healthy_count") == 5
            else (
                "ROLLED_BACK_HEALTHY_5_OF_5"
                if remote.get("rollback_healthy_count") == 5
                else "NOT_CONFIRMED"
            )
        ),
        "milestone_status": "M07_IN_PROGRESS",
        "all_ok": all_ok == "true",
        "failure_reason": (
            None
            if execution == "PASS"
            else failure_reason
        ),
    },
    "bundle": {
        "path": bundle,
        "archive": archive,
        "source_sha256": source_sha,
        "candidate_sha256": candidate_sha,
        "runtime_library_sha256": runtime_sha,
        "archive_sha256": archive_sha,
        "local_validation_passed":
            local_ok == "true",
    },
    "transport": {
        "path": "router-ops -> pve-mgts -> VM101",
        "upload_rc": int(upload_rc),
        "upload_ok": upload_ok == "true",
        "execution_rc": int(transport_rc),
        "execution_transport_ok":
            transport_ok == "true",
    },
    "installation": {
        "committed":
            install_committed == "true",
        "backup_dir": backup_dir,
        "rollback_attempted":
            rollback_attempted == "true",
        "rollback_passed":
            rollback_pass == "true",
        "remote": remote,
    },
    "safety": {
        "single_target": True,
        "vm101_contacted":
            transport_ok == "true",
        "refresh_ran": False,
        "rebalance_ran": False,
        "services_restarted": False,
        "canonical_current_modified": False,
    },
    "next_step": next_step,
    "publish": {
        "trycf_report": report,
        "report_txt": report_txt,
        "facts_json": facts_json,
    },
}

Path(output).write_text(
    json.dumps(
        data,
        ensure_ascii=False,
        indent=2,
    ) + "\n",
    encoding="utf-8",
)
PY

  cat > "$REPORT_DIR/report.txt" <<EOF
=== ${STEP} RESULT ===
step=${STEP}
decision=${DECISION}
step_execution=${EXECUTION}
operation_result=${OPERATION}
milestone_status=M07_IN_PROGRESS
all_ok=${ALL_OK}
failure_reason=${FAILURE_REASON}

bundle:
  path=${BUNDLE}
  archive=${ARCHIVE}
  source_sha256=${SOURCE_SHA}
  candidate_sha256=${CANDIDATE_SHA}
  runtime_library_sha256=${RUNTIME_SHA}
  archive_sha256=${ARCHIVE_SHA}
  local_validation_passed=${LOCAL_OK}

transport:
  path=router-ops -> pve-mgts -> VM101
  upload_rc=${UPLOAD_RC}
  upload_ok=${UPLOAD_OK}
  execution_rc=${TRANSPORT_RC}
  execution_transport_ok=${TRANSPORT_OK}

installation:
  committed=${INSTALL_COMMITTED}
  backup_dir=${BACKUP_DIR}
  rollback_attempted=${ROLLBACK_ATTEMPTED}
  rollback_passed=${ROLLBACK_PASS}

vm101:
$(sed 's/^/  /' "$REMOTE_RESULT" 2>/dev/null || true)

safety:
  single_target=true
  refresh_ran=false
  rebalance_ran=false
  services_restarted=false
  canonical_current_modified=false

next_step=${NEXT_STEP}

TRYCF_REPORT=${TRYCF_REPORT}
REPORT_TXT=${REPORT_TXT}
FACTS_JSON=${FACTS_JSON}
VM101_REFERENCE=${VM101_REFERENCE}
VM101_CANONICAL=${VM101_CANONICAL}
EOF

  cat > "$REPORT_DIR/index.html" <<EOF
<!doctype html>
<html lang="ru">
<head>
<meta charset="utf-8">
<title>${STEP}</title>
</head>
<body style="font-family:system-ui;max-width:1050px;margin:40px auto">
<h1>${STEP}</h1>
<ul>
<li><a href="report.txt">report.txt</a></li>
<li><a href="facts.json">facts.json</a></li>
<li><a href="vm101-install.env">vm101-install.env</a></li>
<li><a href="upload.stderr">upload.stderr</a></li>
<li><a href="install-transport.stderr">install-transport.stderr</a></li>
<li><a href="bundle-sha256-check.txt">bundle-sha256-check.txt</a></li>
<li><a href="step.sh">step.sh</a></li>
</ul>
</body>
</html>
EOF

  find "$REPORT_DIR" \
    -type f \
    ! -name SHA256SUMS \
    -print0 |
    sort -z |
    xargs -0 sha256sum \
    > "$REPORT_DIR/SHA256SUMS"

  chmod -R a+rX "$REPORT_DIR"

  echo
  echo "decision=$DECISION"
  echo "operation_result=$OPERATION"
  echo "install_committed=$INSTALL_COMMITTED"
  echo "backup_dir=$BACKUP_DIR"
  echo "rollback_attempted=$ROLLBACK_ATTEMPTED"
  echo "rollback_pass=$ROLLBACK_PASS"
  echo "failure_reason=$FAILURE_REASON"

  echo
  echo "TRYCF_REPORT=$TRYCF_REPORT"
  echo "REPORT_TXT=$REPORT_TXT"
  echo "FACTS_JSON=$FACTS_JSON"
  echo "VM101_REFERENCE=$VM101_REFERENCE"
  echo "VM101_CANONICAL=$VM101_CANONICAL"
}

if [ "$(id -un)" != "ops" ]; then
  FAILURE_REASON="WRONG_USER"

elif [ ! -s "$WORKFLOW_STATE" ]; then
  FAILURE_REASON="WORKFLOW_STATE_MISSING"

else
  STATUS="$(
    value \
      "$WORKFLOW_STATE" \
      M07_REFRESH_POOL_SAFE_STATUS
  )"

  BUNDLE="$(
    value \
      "$WORKFLOW_STATE" \
      M07_REFRESH_POOL_SAFE_BUNDLE
  )"

  ARCHIVE="$(
    value \
      "$WORKFLOW_STATE" \
      M07_REFRESH_POOL_SAFE_ARCHIVE
  )"

  SOURCE_SHA="$(
    value \
      "$WORKFLOW_STATE" \
      M07_REFRESH_POOL_SAFE_SOURCE_SHA256
  )"

  CANDIDATE_SHA="$(
    value \
      "$WORKFLOW_STATE" \
      M07_REFRESH_POOL_SAFE_CANDIDATE_SHA256
  )"

  ARCHIVE_SHA="$(
    value \
      "$WORKFLOW_STATE" \
      M07_REFRESH_POOL_SAFE_ARCHIVE_SHA256
  )"

  if [ "$STATUS" != "VM101_READ_ONLY_PREFLIGHT_PASSED" ]; then
    FAILURE_REASON="PREFLIGHT_STATUS_INVALID"

  elif [ ! -d "$BUNDLE" ] ||
       [ ! -s "$ARCHIVE" ] ||
       [ ! -s "$BUNDLE/manifest.tsv" ] ||
       [ ! -s "$BUNDLE/SHA256SUMS" ]; then
    FAILURE_REASON="INSTALL_BUNDLE_INCOMPLETE"

  else
    BUNDLE_NAME="$(basename "$BUNDLE")"

    RUNTIME_SHA="$(
      awk -F '\t' \
        '$1 == "/usr/local/lib/router-egress-vm101-runtime.sh" {
          print $3
        }' \
        "$BUNDLE/manifest.tsv"
    )"

    ACTUAL_ARCHIVE_SHA="$(
      sha256sum "$ARCHIVE" |
        cut -d' ' -f1
    )"

    if [ "$ACTUAL_ARCHIVE_SHA" != "$ARCHIVE_SHA" ]; then
      FAILURE_REASON="ARCHIVE_SHA_MISMATCH"

    elif ! (
      cd "$BUNDLE" &&
      sha256sum -c SHA256SUMS
    ) > "$REPORT_DIR/bundle-sha256-check.txt" 2>&1; then
      FAILURE_REASON="BUNDLE_SHA256_FAILED"

    else
      LOCAL_OK=true
    fi
  fi
fi

cat > "$REMOTE_SCRIPT" <<'REMOTE'
#!/bin/sh
set -u

ARCHIVE="$1"
BUNDLE_NAME="$2"
EXPECTED_SOURCE="$3"
EXPECTED_CANDIDATE="$4"
EXPECTED_RUNTIME="$5"
EXPECTED_ARCHIVE="$6"

TARGET="/root/hmn/hmn-refresh-pool-safe.sh"
LIB="/usr/local/lib/router-egress-vm101-runtime.sh"

WORK="/tmp/m07-refresh-install-$$"
BUNDLE="$WORK/$BUNDLE_NAME"

overall_pass=false
installation_committed=false
rollback_attempted=false
rollback_pass=false
backup_dir="NONE"
failure_reason="NONE"

hash_file() {
  if command -v sha256sum >/dev/null 2>&1
  then
    sha256sum "$1" |
      awk '{print $1}'
  else
    busybox sha256sum "$1" |
      awk '{print $1}'
  fi
}

health_count() {
  healthy=0
  routes=0
  slot=1

  while [ "$slot" -le 5 ]
  do
    iface="vpn$slot"
    table="$((200 + slot))"

    if ip route show table "$table" 2>/dev/null |
       grep -E "^default .*dev ${iface}([[:space:]]|$)" \
       >/dev/null
    then
      routes="$((routes + 1))"
    fi

    if ping -I "$iface" -c 1 -W 2 1.1.1 \
         >/dev/null 2>&1
    then
      healthy="$((healthy + 1))"
    fi

    slot="$((slot + 1))"
  done

  printf '%s %s\n' "$healthy" "$routes"
}

cleanup() {
  rm -rf "$WORK"
  rm -f "$ARCHIVE"
}

echo "host=$(cat /proc/sys/kernel/hostname 2>/dev/null || true)"
echo "user=$(id -un)"
echo "refresh_ran=false"
echo "rebalance_ran=false"
echo "services_restarted=false"

if ps w 2>/dev/null |
   grep -E \
     '[h]mn-refresh-pool-safe|[r]outer-egress-emergency-refresh|[r]ebalance-top5-apply' \
     >/dev/null
then
  failure_reason="CONFLICTING_PROCESS"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
fi

if [ ! -s "$ARCHIVE" ]; then
  failure_reason="REMOTE_ARCHIVE_MISSING"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
fi

REMOTE_ARCHIVE_SHA="$(hash_file "$ARCHIVE" 2>/dev/null || true)"
echo "remote_archive_sha256=$REMOTE_ARCHIVE_SHA"

if [ "$REMOTE_ARCHIVE_SHA" != "$EXPECTED_ARCHIVE" ]; then
  failure_reason="REMOTE_ARCHIVE_SHA_MISMATCH"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
fi

mkdir -p "$WORK" || {
  failure_reason="REMOTE_WORKDIR_CREATE_FAILED"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
}

tar -xzf "$ARCHIVE" -C "$WORK" || {
  failure_reason="REMOTE_ARCHIVE_EXTRACT_FAILED"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
}

if [ ! -d "$BUNDLE" ]; then
  failure_reason="REMOTE_BUNDLE_DIRECTORY_MISSING"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
fi

if ! (
  cd "$BUNDLE" &&
  sha256sum -c SHA256SUMS
) >/dev/null 2>&1
then
  failure_reason="REMOTE_BUNDLE_SHA256_FAILED"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
fi

BEFORE_TARGET_HASH="$(hash_file "$TARGET" 2>/dev/null || true)"

if [ -e "$LIB" ]; then
  BEFORE_LIB_STATE="PRESENT"
  BEFORE_LIB_HASH="$(hash_file "$LIB" 2>/dev/null || true)"
else
  BEFORE_LIB_STATE="ABSENT"
  BEFORE_LIB_HASH="ABSENT"
fi

set -- $(health_count)
BEFORE_HEALTHY="$1"
BEFORE_ROUTES="$2"

echo "before_target_sha256=$BEFORE_TARGET_HASH"
echo "before_library_state=$BEFORE_LIB_STATE"
echo "before_library_sha256=$BEFORE_LIB_HASH"
echo "before_healthy_count=$BEFORE_HEALTHY"
echo "before_route_count=$BEFORE_ROUTES"

if [ "$BEFORE_TARGET_HASH" != "$EXPECTED_SOURCE" ]; then
  failure_reason="LIVE_SOURCE_HASH_CHANGED"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
fi

if [ "$BEFORE_HEALTHY" -ne 5 ] ||
   [ "$BEFORE_ROUTES" -ne 5 ]; then
  failure_reason="PREINSTALL_HEALTH_NOT_5_OF_5"
  echo "failure_reason=$failure_reason"
  echo "overall_pass=false"
  cleanup
  exit 0
fi

INSTALL_OUT="$WORK/install.out"
INSTALL_ERR="$WORK/install.err"

sh "$BUNDLE/install.sh" \
  --apply \
  CONFIRM_REFRESH_POOL_SAFE_R06B \
  > "$INSTALL_OUT" \
  2> "$INSTALL_ERR"

INSTALL_RC=$?

cat "$INSTALL_OUT"
sed 's/^/installer_stderr=/' "$INSTALL_ERR"

backup_dir="$(
  sed -n 's/^backup_dir=//p' "$INSTALL_OUT" |
    tail -n1
)"

[ -n "$backup_dir" ] ||
  backup_dir="NONE"

echo "installer_rc=$INSTALL_RC"
echo "backup_dir=$backup_dir"

if [ "$INSTALL_RC" -ne 0 ]; then
  failure_reason="INSTALLER_RETURNED_NONZERO"

  AFTER_FAILED_TARGET="$(
    hash_file "$TARGET" 2>/dev/null ||
    true
  )"

  if [ -e "$LIB" ]; then
    AFTER_FAILED_LIB="$(
      hash_file "$LIB" 2>/dev/null ||
      true
    )"
  else
    AFTER_FAILED_LIB="ABSENT"
  fi

  if [ "$AFTER_FAILED_TARGET" = "$EXPECTED_SOURCE" ] &&
     {
       [ "$BEFORE_LIB_STATE" = "ABSENT" ] &&
       [ "$AFTER_FAILED_LIB" = "ABSENT" ] ||
       [ "$BEFORE_LIB_STATE" = "PRESENT" ] &&
       [ "$AFTER_FAILED_LIB" = "$BEFORE_LIB_HASH" ]
     }
  then
    rollback_pass=true
  fi

  echo "failure_reason=$failure_reason"
  echo "installation_committed=false"
  echo "rollback_attempted=false"
  echo "rollback_pass=$rollback_pass"
  echo "overall_pass=false"

  cleanup
  exit 0
fi

VERIFY_OUT="$WORK/verify.out"

sh "$BUNDLE/verify.sh" \
  > "$VERIFY_OUT" \
  2>&1

VERIFY_RC=$?

cat "$VERIFY_OUT"
echo "verify_rc=$VERIFY_RC"

AFTER_TARGET_HASH="$(
  hash_file "$TARGET" 2>/dev/null ||
  true
)"

AFTER_LIB_HASH="$(
  hash_file "$LIB" 2>/dev/null ||
  true
)"

set -- $(health_count)
AFTER_HEALTHY="$1"
AFTER_ROUTES="$2"

echo "after_target_sha256=$AFTER_TARGET_HASH"
echo "after_library_sha256=$AFTER_LIB_HASH"
echo "after_healthy_count=$AFTER_HEALTHY"
echo "after_route_count=$AFTER_ROUTES"

if [ "$VERIFY_RC" -eq 0 ] &&
   [ "$AFTER_TARGET_HASH" = "$EXPECTED_CANDIDATE" ] &&
   [ "$AFTER_LIB_HASH" = "$EXPECTED_RUNTIME" ] &&
   [ "$AFTER_HEALTHY" -eq 5 ] &&
   [ "$AFTER_ROUTES" -eq 5 ]
then
  installation_committed=true
  overall_pass=true
  failure_reason="NONE"
else
  failure_reason="POSTINSTALL_VERIFY_OR_HEALTH_FAILED"
  rollback_attempted=true

  if [ "$backup_dir" != "NONE" ]; then
    sh "$BUNDLE/rollback.sh" \
      --backup "$backup_dir" \
      CONFIRM_REFRESH_POOL_SAFE_ROLLBACK \
      > "$WORK/rollback.out" \
      2> "$WORK/rollback.err"

    ROLLBACK_RC=$?

    cat "$WORK/rollback.out"
    sed 's/^/rollback_stderr=/' "$WORK/rollback.err"
  else
    ROLLBACK_RC=98
  fi

  ROLLBACK_TARGET_HASH="$(
    hash_file "$TARGET" 2>/dev/null ||
    true
  )"

  if [ -e "$LIB" ]; then
    ROLLBACK_LIB_HASH="$(
      hash_file "$LIB" 2>/dev/null ||
      true
    )"
  else
    ROLLBACK_LIB_HASH="ABSENT"
  fi

  set -- $(health_count)
  ROLLBACK_HEALTHY="$1"
  ROLLBACK_ROUTES="$2"

  echo "rollback_rc=$ROLLBACK_RC"
  echo "rollback_target_sha256=$ROLLBACK_TARGET_HASH"
  echo "rollback_library_sha256=$ROLLBACK_LIB_HASH"
  echo "rollback_healthy_count=$ROLLBACK_HEALTHY"
  echo "rollback_route_count=$ROLLBACK_ROUTES"

  if [ "$ROLLBACK_RC" -eq 0 ] &&
     [ "$ROLLBACK_TARGET_HASH" = "$EXPECTED_SOURCE" ] &&
     [ "$ROLLBACK_HEALTHY" -eq 5 ] &&
     [ "$ROLLBACK_ROUTES" -eq 5 ]
  then
    if [ "$BEFORE_LIB_STATE" = "ABSENT" ] &&
       [ "$ROLLBACK_LIB_HASH" = "ABSENT" ]
    then
      rollback_pass=true
    elif [ "$BEFORE_LIB_STATE" = "PRESENT" ] &&
         [ "$ROLLBACK_LIB_HASH" = "$BEFORE_LIB_HASH" ]
    then
      rollback_pass=true
    fi
  fi
fi

echo "failure_reason=$failure_reason"
echo "installation_committed=$installation_committed"
echo "rollback_attempted=$rollback_attempted"
echo "rollback_pass=$rollback_pass"
echo "overall_pass=$overall_pass"

cleanup
exit 0
REMOTE

chmod 600 "$REMOTE_SCRIPT"

if [ "$LOCAL_OK" = "true" ]; then
  ssh -T \
    -o BatchMode=yes \
    -o ConnectTimeout=10 \
    pve-mgts \
    "ssh -T \
      -o BatchMode=yes \
      -o ConnectTimeout=10 \
      -o StrictHostKeyChecking=yes \
      -i /root/.ssh/pve_to_openwrt_mgts_ed25519 \
      root@10.71.100.2 \
      'cat > $REMOTE_ARCHIVE'" \
    < "$ARCHIVE" \
    > /dev/null \
    2> "$UPLOAD_STDERR"

  UPLOAD_RC=$?

  if [ "$UPLOAD_RC" -eq 0 ]; then
    UPLOAD_OK=true

    ssh -T \
      -o BatchMode=yes \
      -o ConnectTimeout=10 \
      pve-mgts \
      "ssh -T \
        -o BatchMode=yes \
        -o ConnectTimeout=10 \
        -o StrictHostKeyChecking=yes \
        -i /root/.ssh/pve_to_openwrt_mgts_ed25519 \
        root@10.71.100.2 \
        'sh -s -- \
          $REMOTE_ARCHIVE \
          $BUNDLE_NAME \
          $SOURCE_SHA \
          $CANDIDATE_SHA \
          $RUNTIME_SHA \
          $ARCHIVE_SHA'" \
      < "$REMOTE_SCRIPT" \
      > "$REMOTE_RESULT" \
      2> "$INSTALL_STDERR"

    TRANSPORT_RC=$?

    if [ "$TRANSPORT_RC" -eq 0 ]; then
      TRANSPORT_OK=true

      REMOTE_PASS="$(
        bool_value \
          "$REMOTE_RESULT" \
          overall_pass
      )"

      INSTALL_COMMITTED="$(
        bool_value \
          "$REMOTE_RESULT" \
          installation_committed
      )"

      ROLLBACK_ATTEMPTED="$(
        bool_value \
          "$REMOTE_RESULT" \
          rollback_attempted
      )"

      ROLLBACK_PASS="$(
        bool_value \
          "$REMOTE_RESULT" \
          rollback_pass
      )"

      BACKUP_DIR="$(
        value \
          "$REMOTE_RESULT" \
          backup_dir
      )"

      REMOTE_FAILURE="$(
        value \
          "$REMOTE_RESULT" \
          failure_reason
      )"

      [ -n "$REMOTE_PASS" ] ||
        REMOTE_PASS=false

      [ -n "$INSTALL_COMMITTED" ] ||
        INSTALL_COMMITTED=false

      [ -n "$ROLLBACK_ATTEMPTED" ] ||
        ROLLBACK_ATTEMPTED=false

      [ -n "$ROLLBACK_PASS" ] ||
        ROLLBACK_PASS=false

      [ -n "$BACKUP_DIR" ] ||
        BACKUP_DIR="NONE"

      if [ "$REMOTE_PASS" != "true" ]; then
        FAILURE_REASON="${REMOTE_FAILURE:-REMOTE_INSTALL_FAILED}"
      fi
    else
      FAILURE_REASON="INSTALL_TRANSPORT_FAILED"
    fi
  else
    FAILURE_REASON="ARCHIVE_UPLOAD_FAILED"
  fi
fi

if [ "$LOCAL_OK" != "true" ] &&
   [ "$FAILURE_REASON" = "NONE" ]
then
  FAILURE_REASON="LOCAL_BUNDLE_VALIDATION_FAILED"
fi

if [ "$REMOTE_PASS" = "true" ]; then
  python3 - \
    "$WORKFLOW_STATE" \
    "$TRYCF_REPORT" \
    "$BACKUP_DIR" \
    "$CANDIDATE_SHA" \
    "$RUNTIME_SHA" <<'PY'
import sys
from pathlib import Path

path = Path(sys.argv[1])
report = sys.argv[2]
backup = sys.argv[3]
candidate_sha = sys.argv[4]
runtime_sha = sys.argv[5]

updates = {
    "M07_REFRESH_POOL_SAFE_STATUS":
        "INSTALLED_VERIFIED_NO_REFRESH",
    "M07_REFRESH_POOL_SAFE_INSTALL_REPORT":
        report,
    "M07_REFRESH_POOL_SAFE_BACKUP_DIR":
        backup,
    "M07_REFRESH_POOL_SAFE_INSTALLED_SHA256":
        candidate_sha,
    "M07_RUNTIME_LIBRARY_INSTALLED_SHA256":
        runtime_sha,
    "M07_NEXT_TARGET":
        "code_test",
    "M07_NEXT_STEP":
        "BUILD_AND_TEST_CODE_TEST_ONLY",
}

lines = path.read_text(
    encoding="utf-8",
    errors="replace",
).splitlines()

result = []
seen = set()

for line in lines:
    if "=" not in line:
        result.append(line)
        continue

    key, _ = line.split("=", 1)

    if key in updates:
        result.append(f"{key}={updates[key]}")
        seen.add(key)
    else:
        result.append(line)

for key, value in updates.items():
    if key not in seen:
        result.append(f"{key}={value}")

path.write_text(
    "\n".join(result) + "\n",
    encoding="utf-8",
)
PY

  chmod 600 "$WORKFLOW_STATE"
  WORKFLOW_UPDATED=true
fi

write_report

echo "workflow_updated=$WORKFLOW_UPDATED"
echo "refresh_ran=false"
echo "rebalance_ran=false"
echo "services_restarted=false"

exit 0