#!/usr/bin/env bash
set -Eeuo pipefail

STEP_ID="${STEP_ID:?}"
STEP_DIR="${STEP_DIR:?}"
STEP_SHA256="${STEP_SHA256:?}"

DOMAIN="reports.secret-studio.ru"
BASE="/opt/router-ops"
PUBLIC="$BASE/public"
TOKEN_FILE="$PUBLIC/.router-public-token"
PUBLISHER="$BASE/bin/router-publish-report"
REINDEX="$BASE/bin/router-public-reindex"
EXPECTED_R04F_CANDIDATE_SHA256="e78430b57afbd0ae27fc575fc4de78bb267c76caf04ec935b01e9b2f89840e32"
EXPECTED_R04F_DIFF_SHA256="8f92ebfaaac5e247d499c45795bb4061b31cfa2992ed13005e449c6da6d8e792"
EXPECTED_R04G_STEP_SHA256="d3ee37442e02dadf76ae67d514b6a43c9bf8762e21ab0fb77f63ba0d1d7141cd"
EXPECTED_LIVE_PUBLISHER_SHA256="83582dd85e88032d3aecf8c285cd2ec758a2006ea285fa69c17fa35554a64ea4"
LABEL="step_direct_https_r04f_candidate_evidence_salvage"

REPORT="$STEP_DIR/report.txt"
FACTS="$STEP_DIR/facts.json"
VERIFY="$STEP_DIR/verify.txt"
ROLLBACK="$STEP_DIR/rollback.sh"
LOG="$STEP_DIR/main.log"
MODEL="$STEP_DIR/affected-system-model.txt"
METHODS="$STEP_DIR/methods-and-limitations.txt"
ACCESS="$STEP_DIR/access-routes.txt"
PLAN="$STEP_DIR/publication-plan.txt"
PUBLISH_OUT="$STEP_DIR/publish-output.txt"
BEFORE_STEP_REPORTS="$STEP_DIR/before-step-reports.txt"
AFTER_STEP_REPORTS="$STEP_DIR/after-step-reports.txt"
MOVED_STEP_REPORTS="$STEP_DIR/moved-step-reports.txt"
PUBLICATION_STATE="$STEP_DIR/publication-state.txt"
SAFE_MAP="$STEP_DIR/safe-copy-map.tsv"
SAFE_MANIFEST="$STEP_DIR/safe-files.sha256"
PUBLISHED_MANIFEST="$STEP_DIR/published-files.sha256"
PUBLISHED_DIR=""
STEP_REPORT_URL="PENDING_NOT_PUBLISHED"
SAFE_DIR="/tmp/r04gpub-${STEP_ID}-$$"

mkdir -p "$SAFE_DIR"
chmod 700 "$SAFE_DIR"
exec > >(tee -a "$LOG") 2>&1

cleanup() {
    rm -rf "$SAFE_DIR"
}
trap cleanup EXIT

progress() {
    printf '>>> [%s] %s\n' "$(date '+%F %T')" "$*"
}

stop_step() {
    local result="$1"
    local reason="$2"
    cat > "$REPORT" <<STOP_REPORT
RESULT=$result
STEP_ID=$STEP_ID
STOP_REASON=$reason
STEP_REPORT_URL=${STEP_REPORT_URL:-PENDING_NOT_PUBLISHED}
COPY_VERIFY=PASS
STEP_SHA256=$STEP_SHA256
STEP_WAS_NOT_STARTED=false
RUNTIME_IMPACT=false
STOP_REPORT
    printf 'RESULT=%s\n' "$result"
    printf 'STOP_REASON=%s\n' "$reason"
    if [[ -n "${PUBLISHED_DIR:-}" && -d "${PUBLISHED_DIR:-}" ]]; then
        cp -a "$REPORT" "$PUBLISHED_DIR/report.txt"
        chmod 644 "$PUBLISHED_DIR/report.txt"
        "$REINDEX" >/dev/null 2>&1 || true
    fi
    printf 'STEP_REPORT_URL=%s\n' "$STEP_REPORT_URL"
    printf 'COPY_VERIFY=PASS\n'
    printf 'STEP_SHA256=%s\n' "$STEP_SHA256"
    printf 'STEP_WAS_NOT_STARTED=false\n'
    printf 'RUNTIME_IMPACT=false\n'
    exit 20
}

latest_dir() {
    local pattern="$1"
    local output
    output="$(find "$LATEST" -mindepth 1 -maxdepth 1 -type d -name "$pattern" -printf '%f\n' | LC_ALL=C sort)"
    [[ "$(printf '%s\n' "$output" | sed '/^$/d' | wc -l | tr -d ' ')" -eq 1 ]] || return 1
    printf '%s\n' "$output"
}

safe_copy() {
    local source="$1"
    local target_name="$2"
    [[ -f "$source" ]] || return 1
    cp -a "$source" "$SAFE_DIR/$target_name"
    chmod 644 "$SAFE_DIR/$target_name"
    printf '%s\t%s\t%s\n' "$source" "$target_name" "$(sha256sum "$source" | awk '{print $1}')" >> "$SAFE_MAP"
}

progress "preflight and source verification"

for cmd in sha256sum gzip tar python3 curl flock find awk sed grep cmp sh; do
    command -v "$cmd" >/dev/null 2>&1 || stop_step "STOP_SALVAGE_PREFLIGHT_FAILED" "missing_command_$cmd"
done
[[ -x "$PUBLISHER" ]] || stop_step "STOP_SALVAGE_PREFLIGHT_FAILED" "publisher_missing"
[[ -x "$REINDEX" ]] || stop_step "STOP_SALVAGE_PREFLIGHT_FAILED" "reindex_missing"
[[ -s "$TOKEN_FILE" ]] || stop_step "STOP_SALVAGE_PREFLIGHT_FAILED" "token_missing"

TOKEN="$(cat "$TOKEN_FILE")"
ROOT="$PUBLIC/r/$TOKEN"
LATEST="$ROOT/latest"
OLD="$ROOT/old"
[[ -d "$LATEST" && -d "$OLD" ]] || stop_step "STOP_SALVAGE_PREFLIGHT_FAILED" "latest_or_old_missing"

LIVE_PUBLISHER_SHA256="$(sha256sum "$PUBLISHER" | awk '{print $1}')"
[[ "$LIVE_PUBLISHER_SHA256" == "$EXPECTED_LIVE_PUBLISHER_SHA256" ]] || stop_step "STOP_LIVE_SOURCE_CHANGED" "$LIVE_PUBLISHER_SHA256"

R04F_DIR="$(find "$BASE/steps" -mindepth 1 -maxdepth 1 -type d -name '*_PRECHECK_VM130_ROUTER_PUBLISH_REPORT_CANDIDATE_R04F' -printf '%T@ %p\n' | sort -nr | awk 'NR==1 {$1=""; sub(/^ /,""); print}')"
R04G_DIR="$(find "$BASE/steps" -mindepth 1 -maxdepth 1 -type d -name '*_STEP_DIRECT_HTTPS_PUBLISH_R04F_CANDIDATE_R04G' -printf '%T@ %p\n' | sort -nr | awk 'NR==1 {$1=""; sub(/^ /,""); print}')"
[[ -d "$R04F_DIR" ]] || stop_step "STOP_R04F_NOT_FOUND" "candidate_step_missing"
[[ -d "$R04G_DIR" ]] || stop_step "STOP_R04G_NOT_FOUND" "failed_publication_step_missing"

grep -qx 'RESULT=PASS_ROUTER_PUBLISH_REPORT_CANDIDATE_BUILT_AND_SANDBOX_TESTED' "$R04F_DIR/report.txt" || stop_step "STOP_R04F_NOT_CONFIRMED" "candidate_result_not_pass"
R04F_CANDIDATE="$R04F_DIR/router-publish-report.candidate"
R04F_DIFF="$R04F_DIR/router-publish-report.candidate.diff"
[[ "$(sha256sum "$R04F_CANDIDATE" | awk '{print $1}')" == "$EXPECTED_R04F_CANDIDATE_SHA256" ]] || stop_step "STOP_R04F_CANDIDATE_SHA_MISMATCH" "candidate_sha"
[[ "$(sha256sum "$R04F_DIFF" | awk '{print $1}')" == "$EXPECTED_R04F_DIFF_SHA256" ]] || stop_step "STOP_R04F_DIFF_SHA_MISMATCH" "diff_sha"
sh -n "$R04F_CANDIDATE" || stop_step "STOP_R04F_CANDIDATE_SYNTAX" "candidate_syntax"

[[ "$(sha256sum "$R04G_DIR/step-code.sh" | awk '{print $1}')" == "$EXPECTED_R04G_STEP_SHA256" ]] || stop_step "STOP_R04G_CODE_SHA_MISMATCH" "r04g_step_sha"
grep -qx 'COPY_VERIFY=PASS' "$R04G_DIR/transfer-verify.txt" || stop_step "STOP_R04G_TRANSFER_NOT_CONFIRMED" "copy_verify"
grep -qx "STEP_SHA256=$EXPECTED_R04G_STEP_SHA256" "$R04G_DIR/transfer-verify.txt" || stop_step "STOP_R04G_TRANSFER_NOT_CONFIRMED" "step_sha"
[[ -f "$R04G_DIR/publisher-stdout.tmp" ]] || stop_step "STOP_R04G_FAILURE_EVIDENCE_MISSING" "publisher_stdout"
if ! grep -q 'REFUSE: suspicious path/name.*publication-state.env' \
    "$R04G_DIR/publisher-stdout.tmp" \
    "$R04G_DIR/main.log" \
    "$R04G_DIR/report.txt" 2>/dev/null; then
    if [[ -f "$R04G_DIR/publication-state.env" ]] &&
       grep -qx 'RESULT=STOP_PUBLISHER_COMMAND_FAILED' "$R04G_DIR/report.txt"; then
        :
    else
        stop_step "STOP_R04G_FAILURE_NOT_CLASSIFIED" "unexpected_failure"
    fi
fi

progress "building neutral safe-name publication set"

: > "$SAFE_MAP"
safe_copy "$STEP_DIR/step-code.sh" "step-code.sh" || stop_step "STOP_SAFE_COPY_FAILED" "salvage_step_code"
safe_copy "$STEP_DIR/transfer-verify.txt" "transfer-verify.txt" || stop_step "STOP_SAFE_COPY_FAILED" "salvage_transfer"
safe_copy "$R04F_CANDIDATE" "router-publish-report.candidate" || stop_step "STOP_SAFE_COPY_FAILED" "candidate"
safe_copy "$R04F_DIFF" "router-publish-report.candidate.diff" || stop_step "STOP_SAFE_COPY_FAILED" "candidate_diff"
safe_copy "$R04F_DIR/report.txt" "r04f-report.txt" || stop_step "STOP_SAFE_COPY_FAILED" "r04f_report"
safe_copy "$R04F_DIR/facts.json" "r04f-facts.json" || stop_step "STOP_SAFE_COPY_FAILED" "r04f_facts"
safe_copy "$R04F_DIR/verify.txt" "r04f-verify.txt" || stop_step "STOP_SAFE_COPY_FAILED" "r04f_verify"
safe_copy "$R04F_DIR/main.log" "r04f-main.log" || stop_step "STOP_SAFE_COPY_FAILED" "r04f_log"
safe_copy "$R04G_DIR/step-code.sh" "r04g-step-code.sh" || stop_step "STOP_SAFE_COPY_FAILED" "r04g_step_code"
safe_copy "$R04G_DIR/transfer-verify.txt" "r04g-transfer-verify.txt" || stop_step "STOP_SAFE_COPY_FAILED" "r04g_transfer"
safe_copy "$R04G_DIR/publisher-stdout.tmp" "r04g-publisher-output.txt" || stop_step "STOP_SAFE_COPY_FAILED" "r04g_output"
safe_copy "$R04G_DIR/publication-state.env" "r04g-publication-state.txt" || stop_step "STOP_SAFE_COPY_FAILED" "r04g_publication_state"
for optional in report.txt facts.json verify.txt rollback.sh main.log; do
    if [[ -f "$R04G_DIR/$optional" ]]; then
        safe_copy "$R04G_DIR/$optional" "r04g-failed-${optional//.sh/.txt}" || stop_step "STOP_SAFE_COPY_FAILED" "$optional"
    fi
done

ORIGINAL_STATE_SHA256="$(sha256sum "$R04G_DIR/publication-state.env" | awk '{print $1}')"
SAFE_STATE_SHA256="$(sha256sum "$SAFE_DIR/r04g-publication-state.txt" | awk '{print $1}')"
[[ "$ORIGINAL_STATE_SHA256" == "$SAFE_STATE_SHA256" ]] || stop_step "STOP_SAFE_COPY_SHA_MISMATCH" "publication_state"

find "$SAFE_DIR" -maxdepth 1 -type f -printf '%f\n' | LC_ALL=C sort | while IFS= read -r name; do
    printf '%s  %s\n' "$(sha256sum "$SAFE_DIR/$name" | awk '{print $1}')" "$name"
done > "$SAFE_MANIFEST"
cp -a "$SAFE_MANIFEST" "$SAFE_DIR/safe-files.sha256"
chmod 644 "$SAFE_DIR/safe-files.sha256"

find "$LATEST" -mindepth 1 -maxdepth 1 -type d -name '*_step*' -printf '%f\n' | LC_ALL=C sort > "$BEFORE_STEP_REPORTS"

cat > "$MODEL" <<EOF_MODEL
AFFECTED_SYSTEM=VM130 publication evidence only
LIVE_PUBLISHER_CHANGE=false
CANDIDATE_INSTALL=false
CADDY_CHANGE=false
SERVICE_CHANGE=false
PUBLICATION_STATE_CHANGE=true
FAILED_R04G_CAUSE=publisher path-name policy matched .env
SALVAGE_METHOD=byte-identical copy to neutral path with safe filename
EOF_MODEL

cat > "$METHODS" <<EOF_METHODS
STEP_TYPE=formal salvage publication
CORE_CHANGE_REPEATED=false
R04F_CANDIDATE_SHA256=$EXPECTED_R04F_CANDIDATE_SHA256
R04F_DIFF_SHA256=$EXPECTED_R04F_DIFF_SHA256
R04G_EXECUTED_STEP_SHA256=$EXPECTED_R04G_STEP_SHA256
LIMITATION=Candidate remains uninstalled; external post-check is completed by assistant after publication.
EOF_METHODS

cat > "$ACCESS" <<EOF_ACCESS
VM130=10.71.100.84
PUBLIC_DOMAIN=https://$DOMAIN/
LATEST_ROOT_URL=https://$DOMAIN/latest/
OLD_ROOT_URL=https://$DOMAIN/old/
EOF_ACCESS

cat > "$PLAN" <<EOF_PLAN
1. Verify R04F candidate and failed R04G evidence.
2. Copy safe files byte-for-byte into neutral temporary directory.
3. Rename only the blocked publication-state.env transport name to r04g-publication-state.txt.
4. Publish as step-report using the unchanged live publisher.
5. Verify SHA256, current-kind count, HTTPS files and rollback state.
EOF_PLAN

safe_copy "$MODEL" "affected-system-model.txt" || stop_step "STOP_SAFE_COPY_FAILED" "model"
safe_copy "$METHODS" "methods-and-limitations.txt" || stop_step "STOP_SAFE_COPY_FAILED" "methods"
safe_copy "$ACCESS" "access-routes.txt" || stop_step "STOP_SAFE_COPY_FAILED" "access"
safe_copy "$PLAN" "publication-plan.txt" || stop_step "STOP_SAFE_COPY_FAILED" "plan"
safe_copy "$SAFE_MAP" "safe-copy-map.tsv" || stop_step "STOP_SAFE_COPY_FAILED" "map"

cat > "$REPORT" <<EOF_REPORT
RESULT=PENDING_PUBLICATION
STEP_ID=$STEP_ID
CORE_RESULT=PASS_ROUTER_PUBLISH_REPORT_CANDIDATE_BUILT_AND_SANDBOX_TESTED
R04G_FORMAL_RESULT=STOP_PUBLISHER_COMMAND_FAILED
SALVAGE=true
SOURCE_CODE_CHANGE=false
CANDIDATE_INSTALL=false
RUNTIME_IMPACT=false
EOF_REPORT

cat > "$FACTS" <<EOF_FACTS
{"step_id":"$STEP_ID","result":"PENDING_PUBLICATION","salvage":true,"source_code_change":false,"candidate_install":false,"runtime_impact":false}
EOF_FACTS

cat > "$VERIFY" <<EOF_VERIFY
STEP_ID=$STEP_ID
R04F_CANDIDATE_SHA256=$EXPECTED_R04F_CANDIDATE_SHA256
R04F_DIFF_SHA256=$EXPECTED_R04F_DIFF_SHA256
R04G_STEP_SHA256=$EXPECTED_R04G_STEP_SHA256
R04G_FAILURE_CLASSIFICATION=publisher_false_positive_on_full_path
SAFE_COPY_STATE_SHA256_MATCH=true
LIVE_PUBLISHER_SHA256=$LIVE_PUBLISHER_SHA256
LIVE_PUBLISHER_UNCHANGED=true
EOF_VERIFY

cat > "$ROLLBACK" <<'EOF_ROLLBACK'
#!/usr/bin/env bash
set -Eeuo pipefail
STATE_FILE="$(dirname "$0")/publication-state.txt"
[[ -f "$STATE_FILE" ]] || { echo "RESULT=STOP_ROLLBACK_STATE_MISSING"; exit 20; }
# shellcheck disable=SC1090
source "$STATE_FILE"
mkdir -p "$ROLLBACK_HOLD_DIR"
if [[ -d "$PUBLISHED_DIR" ]]; then
    mv "$PUBLISHED_DIR" "$ROLLBACK_HOLD_DIR/"
fi
while IFS= read -r name; do
    [[ -n "$name" ]] || continue
    if [[ -d "$OLD_DIR/$name" && ! -e "$LATEST_DIR/$name" ]]; then
        mv "$OLD_DIR/$name" "$LATEST_DIR/$name"
    fi
done < "$MOVED_LIST_FILE"
"$REINDEX_BIN" >/dev/null
printf 'RESULT=PASS_PUBLICATION_ROLLBACK\n'
EOF_ROLLBACK
chmod 700 "$ROLLBACK"

safe_copy "$REPORT" "report.txt" || stop_step "STOP_SAFE_COPY_FAILED" "report"
safe_copy "$FACTS" "facts.json" || stop_step "STOP_SAFE_COPY_FAILED" "facts"
safe_copy "$VERIFY" "verify.txt" || stop_step "STOP_SAFE_COPY_FAILED" "verify"
safe_copy "$ROLLBACK" "rollback.sh" || stop_step "STOP_SAFE_COPY_FAILED" "rollback"
safe_copy "$LOG" "main.log" || stop_step "STOP_SAFE_COPY_FAILED" "log"

find "$SAFE_DIR" -mindepth 1 -maxdepth 1 -type f ! -name 'safe-files.sha256' -printf '%f\n' | LC_ALL=C sort | while IFS= read -r name; do
    printf '%s  %s\n' "$(sha256sum "$SAFE_DIR/$name" | awk '{print $1}')" "$name"
done > "$SAFE_DIR/safe-files.sha256"
cp -a "$SAFE_DIR/safe-files.sha256" "$SAFE_MANIFEST"
chmod 644 "$SAFE_DIR/safe-files.sha256" "$SAFE_MANIFEST"

progress "publishing neutral evidence set"

mapfile -t FILES_TO_PUBLISH < <(find "$SAFE_DIR" -mindepth 1 -maxdepth 1 -type f -printf '%p\n' | LC_ALL=C sort)
set +e
"$PUBLISHER" "$LABEL" "${FILES_TO_PUBLISH[@]}" > "$PUBLISH_OUT" 2>&1
PUBLISH_RC=$?
set -e
[[ "$PUBLISH_RC" -eq 0 ]] || stop_step "STOP_SALVAGE_PUBLISHER_FAILED" "$PUBLISH_OUT"

PUBLISHED_DIR="$(awk -F= '$1=="PUBLISHED_DIR" {print substr($0,index($0,"=")+1)}' "$PUBLISH_OUT" | tail -n 1)"
PUBLISHED_RELATIVE_PATH="$(awk -F= '$1=="PUBLISHED_RELATIVE_PATH" {print substr($0,index($0,"=")+1)}' "$PUBLISH_OUT" | tail -n 1)"
PUBLIC_OBJECT_KIND="$(awk -F= '$1=="PUBLIC_OBJECT_KIND" {print $2}' "$PUBLISH_OUT" | tail -n 1)"
PREVIOUS_MOVED_COUNT="$(awk -F= '$1=="PREVIOUS_MOVED_COUNT" {print $2}' "$PUBLISH_OUT" | tail -n 1)"
[[ -d "$PUBLISHED_DIR" ]] || stop_step "STOP_SALVAGE_POSTCHECK_FAILED" "published_dir_missing"
[[ "$PUBLIC_OBJECT_KIND" == "step-report" ]] || stop_step "STOP_SALVAGE_POSTCHECK_FAILED" "wrong_object_kind"

FOLDER="$(basename "$PUBLISHED_DIR")"
STEP_REPORT_URL="https://$DOMAIN/latest/$FOLDER/"
find "$LATEST" -mindepth 1 -maxdepth 1 -type d -name '*_step*' -printf '%f\n' | LC_ALL=C sort > "$AFTER_STEP_REPORTS"
comm -23 "$BEFORE_STEP_REPORTS" "$AFTER_STEP_REPORTS" > "$MOVED_STEP_REPORTS"

LOCAL_M07_FOLDER="$(latest_dir '*_local_architecture_plan_vm101_autonomous_hmn_recovery*')" || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "local_m07"
GLOBAL_PLAN_FOLDER="$(latest_dir '*_global_project_plan_wg_paid*')" || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "global_plan"
ACCESS_MAP_FOLDER="$(find "$LATEST" -mindepth 1 -maxdepth 1 -type d \( -name '*_xs_map_*' -o -name '*_access_map_*' \) -printf '%f\n' | LC_ALL=C sort)"
[[ "$(printf '%s\n' "$ACCESS_MAP_FOLDER" | sed '/^$/d' | wc -l | tr -d ' ')" -eq 1 ]] || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "access_map"
VM100_FOLDER="$(latest_dir '*_vm100_git_source_*')" || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "vm100"
VM101_FOLDER="$(latest_dir '*_vm101_git_source_*')" || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "vm101"
VM121_FOLDER="$(latest_dir '*_vm121_git_source_*')" || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "vm121"
VM101_MODEL_FOLDER="$(latest_dir '*_vm101_model_*')" || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "vm101_model"
VM101_METHODS_FOLDER="$(latest_dir '*_vm101_methods_*')" || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "vm101_methods"
VM130_SOURCE_FOLDER="$(latest_dir '*_vm130_router_ops_source_snapshot_*')" || stop_step "STOP_CANONICAL_LINK_RESOLUTION_FAILED" "vm130_source"

LOCAL_M07_PLAN_URL="https://$DOMAIN/latest/$LOCAL_M07_FOLDER/"
GLOBAL_PROJECT_PLAN_URL="https://$DOMAIN/latest/$GLOBAL_PLAN_FOLDER/"
ACCESS_MAP_URL="https://$DOMAIN/latest/$ACCESS_MAP_FOLDER/"
VM100_PUBLIC_URL="https://$DOMAIN/latest/$VM100_FOLDER/"
VM101_PUBLIC_URL="https://$DOMAIN/latest/$VM101_FOLDER/"
VM121_PUBLIC_URL="https://$DOMAIN/latest/$VM121_FOLDER/"
VM101_MODEL_URL="https://$DOMAIN/latest/$VM101_MODEL_FOLDER/"
VM101_METHODS_URL="https://$DOMAIN/latest/$VM101_METHODS_FOLDER/"
VM130_SOURCE_URL="https://$DOMAIN/latest/$VM130_SOURCE_FOLDER/"
FACTS_URL="${STEP_REPORT_URL}facts.json"
VERIFY_URL="${STEP_REPORT_URL}verify.txt"
ROLLBACK_URL="${STEP_REPORT_URL}rollback.sh"

ROLLBACK_HOLD_DIR="$STEP_DIR/rollback-publication-hold"
cat > "$PUBLICATION_STATE" <<EOF_STATE
PUBLISHED_DIR='$PUBLISHED_DIR'
LATEST_DIR='$LATEST'
OLD_DIR='$OLD'
MOVED_LIST_FILE='$MOVED_STEP_REPORTS'
ROLLBACK_HOLD_DIR='$ROLLBACK_HOLD_DIR'
REINDEX_BIN='$REINDEX'
EOF_STATE
chmod 600 "$PUBLICATION_STATE"
cp -a "$PUBLICATION_STATE" "$PUBLISHED_DIR/publication-state.txt"
chmod 644 "$PUBLISHED_DIR/publication-state.txt"

cat > "$REPORT" <<EOF_REPORT
RESULT=PASS_R04F_CANDIDATE_EVIDENCE_PUBLISHED
STEP_ID=$STEP_ID
SALVAGE=true
CORE_RESULT=PASS_ROUTER_PUBLISH_REPORT_CANDIDATE_BUILT_AND_SANDBOX_TESTED
R04G_FORMAL_RESULT=STOP_PUBLISHER_COMMAND_FAILED
R04G_STOP_REASON=false_positive_on_publication-state.env_full_path
SOURCE_CODE_CHANGE=false
CANDIDATE_INSTALL=false
PUBLICATION_STATE_CHANGE=true
ACTIVE_SOURCES_UNCHANGED=true
RUNTIME_IMPACT=false
TRAFFIC_INTERRUPTION=none
ROLLBACK_REQUIRED=true
STEP_REPORT_URL=$STEP_REPORT_URL
LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
VM101_MODEL_URL=$VM101_MODEL_URL
VM101_METHODS_URL=$VM101_METHODS_URL
VM130_SOURCE_URL=$VM130_SOURCE_URL
LATEST_ROOT_URL=https://$DOMAIN/latest/
OLD_ROOT_URL=https://$DOMAIN/old/
FACTS_URL=$FACTS_URL
VERIFY_URL=$VERIFY_URL
ROLLBACK_URL=$ROLLBACK_URL
PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND
PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT
COPY_VERIFY=PASS
STEP_SHA256=$STEP_SHA256
EXTERNAL_POSTCHECK=PENDING_ASSISTANT
EOF_REPORT

python3 - "$FACTS" <<EOF_PY
import json
from datetime import datetime, timezone
facts = {
  "step_id": "$STEP_ID",
  "timestamp": datetime.now(timezone.utc).astimezone().isoformat(),
  "result": "PASS_R04F_CANDIDATE_EVIDENCE_PUBLISHED",
  "salvage": True,
  "core_result": "PASS_ROUTER_PUBLISH_REPORT_CANDIDATE_BUILT_AND_SANDBOX_TESTED",
  "r04g_formal_result": "STOP_PUBLISHER_COMMAND_FAILED",
  "r04g_stop_reason": "false_positive_on_publication-state.env_full_path",
  "source_code_change": False,
  "candidate_install": False,
  "publication_state_change": True,
  "runtime_impact": False,
  "candidate_sha256": "$EXPECTED_R04F_CANDIDATE_SHA256",
  "candidate_diff_sha256": "$EXPECTED_R04F_DIFF_SHA256",
  "r04g_step_sha256": "$EXPECTED_R04G_STEP_SHA256",
  "safe_copy_state_sha256_match": True,
  "step_report_url": "$STEP_REPORT_URL",
  "public_object_kind": "$PUBLIC_OBJECT_KIND",
  "previous_moved_count": int("$PREVIOUS_MOVED_COUNT"),
  "external_postcheck": "PENDING_ASSISTANT"
}
with open("$FACTS", "w", encoding="utf-8") as fh:
    json.dump(facts, fh, ensure_ascii=False, indent=2)
    fh.write("\n")
EOF_PY
python3 -m json.tool "$FACTS" >/dev/null

CANDIDATE_PUBLISHED_SHA256="$(sha256sum "$PUBLISHED_DIR/router-publish-report.candidate" | awk '{print $1}')"
DIFF_PUBLISHED_SHA256="$(sha256sum "$PUBLISHED_DIR/router-publish-report.candidate.diff" | awk '{print $1}')"
STATE_PUBLISHED_SHA256="$(sha256sum "$PUBLISHED_DIR/r04g-publication-state.txt" | awk '{print $1}')"
STEP_REPORT_COUNT="$(find "$LATEST" -mindepth 1 -maxdepth 1 -type d -name '*_step*' | wc -l | tr -d ' ')"

cat > "$VERIFY" <<EOF_VERIFY
STEP_ID=$STEP_ID
RESULT=PASS_R04F_CANDIDATE_EVIDENCE_PUBLISHED
R04F_CANDIDATE_SHA256_EXPECTED=$EXPECTED_R04F_CANDIDATE_SHA256
R04F_CANDIDATE_SHA256_PUBLISHED=$CANDIDATE_PUBLISHED_SHA256
R04F_DIFF_SHA256_EXPECTED=$EXPECTED_R04F_DIFF_SHA256
R04F_DIFF_SHA256_PUBLISHED=$DIFF_PUBLISHED_SHA256
R04G_STEP_SHA256=$EXPECTED_R04G_STEP_SHA256
ORIGINAL_STATE_SHA256=$ORIGINAL_STATE_SHA256
SAFE_STATE_SHA256=$SAFE_STATE_SHA256
PUBLISHED_STATE_SHA256=$STATE_PUBLISHED_SHA256
SAFE_COPY_STATE_SHA256_MATCH=true
PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND
PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT
STEP_REPORT_CURRENT_COUNT=$STEP_REPORT_COUNT
LIVE_PUBLISHER_SHA256=$LIVE_PUBLISHER_SHA256
LIVE_PUBLISHER_UNCHANGED=true
CANDIDATE_INSTALL=false
RUNTIME_IMPACT=false
EOF_VERIFY

cp -a "$REPORT" "$FACTS" "$VERIFY" "$ROLLBACK" "$PUBLISH_OUT" "$BEFORE_STEP_REPORTS" "$AFTER_STEP_REPORTS" "$MOVED_STEP_REPORTS" "$SAFE_MAP" "$SAFE_MANIFEST" "$PUBLISHED_DIR/"
chmod 644 "$PUBLISHED_DIR/report.txt" "$PUBLISHED_DIR/facts.json" "$PUBLISHED_DIR/verify.txt" "$PUBLISHED_DIR/rollback.sh" "$PUBLISHED_DIR/publish-output.txt" "$PUBLISHED_DIR/before-step-reports.txt" "$PUBLISHED_DIR/after-step-reports.txt" "$PUBLISHED_DIR/moved-step-reports.txt" "$PUBLISHED_DIR/safe-copy-map.tsv" "$PUBLISHED_DIR/safe-files.sha256"
"$REINDEX" >/dev/null

find "$PUBLISHED_DIR" -maxdepth 1 -type f -printf '%f\n' | LC_ALL=C sort | while IFS= read -r name; do
    printf '%s  %s\n' "$(sha256sum "$PUBLISHED_DIR/$name" | awk '{print $1}')" "$name"
done > "$PUBLISHED_MANIFEST"
cp -a "$PUBLISHED_MANIFEST" "$PUBLISHED_DIR/published-files.sha256"
chmod 644 "$PUBLISHED_DIR/published-files.sha256"
"$REINDEX" >/dev/null

progress "independent local HTTPS post-check"

for url in "$STEP_REPORT_URL" "$FACTS_URL" "$VERIFY_URL" "$ROLLBACK_URL" "${STEP_REPORT_URL}router-publish-report.candidate" "${STEP_REPORT_URL}router-publish-report.candidate.diff" "${STEP_REPORT_URL}r04g-publication-state.txt"; do
    code="$(curl -sS --connect-timeout 5 --max-time 15 --resolve "$DOMAIN:443:10.71.100.84" -o /dev/null -w '%{http_code}' "$url" || true)"
    [[ "$code" == "200" ]] || stop_step "STOP_SALVAGE_HTTPS_POSTCHECK_FAILED" "$url:$code"
done

[[ "$CANDIDATE_PUBLISHED_SHA256" == "$EXPECTED_R04F_CANDIDATE_SHA256" ]] || stop_step "STOP_SALVAGE_SHA_POSTCHECK_FAILED" "candidate"
[[ "$DIFF_PUBLISHED_SHA256" == "$EXPECTED_R04F_DIFF_SHA256" ]] || stop_step "STOP_SALVAGE_SHA_POSTCHECK_FAILED" "diff"
[[ "$STATE_PUBLISHED_SHA256" == "$ORIGINAL_STATE_SHA256" ]] || stop_step "STOP_SALVAGE_SHA_POSTCHECK_FAILED" "state"
[[ "$STEP_REPORT_COUNT" -eq 1 ]] || stop_step "STOP_SALVAGE_LATEST_COUNT_FAILED" "$STEP_REPORT_COUNT"
[[ "$(sha256sum "$PUBLISHER" | awk '{print $1}')" == "$EXPECTED_LIVE_PUBLISHER_SHA256" ]] || stop_step "STOP_LIVE_SOURCE_CHANGED" "postcheck"

printf 'RESULT=PASS_R04F_CANDIDATE_EVIDENCE_PUBLISHED\n'
printf 'STEP_REPORT_URL=%s\n' "$STEP_REPORT_URL"
printf 'LOCAL_M07_PLAN_URL=%s\n' "$LOCAL_M07_PLAN_URL"
printf 'GLOBAL_PROJECT_PLAN_URL=%s\n' "$GLOBAL_PROJECT_PLAN_URL"
printf 'ACCESS_MAP_URL=%s\n' "$ACCESS_MAP_URL"
printf 'VM100_PUBLIC_URL=%s\n' "$VM100_PUBLIC_URL"
printf 'VM101_PUBLIC_URL=%s\n' "$VM101_PUBLIC_URL"
printf 'VM121_PUBLIC_URL=%s\n' "$VM121_PUBLIC_URL"
printf 'VM101_MODEL_URL=%s\n' "$VM101_MODEL_URL"
printf 'VM101_METHODS_URL=%s\n' "$VM101_METHODS_URL"
printf 'VM130_SOURCE_URL=%s\n' "$VM130_SOURCE_URL"
printf 'COPY_VERIFY=PASS\n'
printf 'STEP_SHA256=%s\n' "$STEP_SHA256"
printf 'RUNTIME_IMPACT=false\n'
printf 'EXTERNAL_POSTCHECK=PENDING_ASSISTANT\n'