#!/usr/bin/env bash
set -Eeuo pipefail

STEP_ID="STEP_050M07R15A2_LOCAL_PLAN_FULL_SPEC_PIN_R01"
EXPECTED_SHORT_SHA="5122c3f4189658866acd6f4237b11bccf8d0eb17c5ac04b6f973b9fe6748af90"
EXPECTED_FULL_SHA="d5127b5b617bc043c9a631f0853e750f8173166c619d02f51249a67d95976075"
EXPECTED_PUBLISHER_SHA="e78430b57afbd0ae27fc575fc4de78bb267c76caf04ec935b01e9b2f89840e32"

PUBLISHER="/opt/router-ops/bin/router-publish-report"
RESOLVE="reports.secret-studio.ru:443:10.71.100.84"
PERMANENT_ROOT="https://reports.secret-studio.ru"

BUNDLE_ROOT="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
BUNDLE_ZIP="${BUNDLE_ZIP:?BUNDLE_ZIP required}"
EXPECTED_BUNDLE_SHA256="${EXPECTED_BUNDLE_SHA256:?EXPECTED_BUNDLE_SHA256 required}"
EXPECTED_INSTALLER_SHA256="${EXPECTED_INSTALLER_SHA256:?EXPECTED_INSTALLER_SHA256 required}"

LOCAL_M07_PLAN_PREVIOUS_URL="https://reports.secret-studio.ru/latest/20260716-133906_local_architecture_plan_vm101_autonomous_hmn_recovery_r15a/"
GLOBAL_PROJECT_PLAN_URL="https://reports.secret-studio.ru/latest/20260711-123348_global_project_plan_wg_paid/"
ACCESS_MAP_URL="https://reports.secret-studio.ru/latest/20260715-210236_access_map_canonical_current/"
VM100_PUBLIC_URL="https://reports.secret-studio.ru/latest/20260715-190653_vm100_git_source_1958200ccc1b/"
VM101_PUBLIC_URL="https://reports.secret-studio.ru/latest/20260716-133906_vm101_git_source_c737f6b40fbf/"
VM121_PUBLIC_URL="https://reports.secret-studio.ru/latest/20260713-182700_vm121_git_source_93e0e5a31f09/"
VM101_MODEL_URL="https://reports.secret-studio.ru/latest/20260716-133906_vm101_model_legacy_freeze_clean_foundation_r15a/"
VM101_METHODS_URL="https://reports.secret-studio.ru/latest/20260716-133906_vm101_methods_legacy_freeze_clean_foundation_r15a/"
VM130_SOURCE_URL="https://reports.secret-studio.ru/latest/20260716-064558_vm130_router_ops_source_snapshot_r14b2/"
LATEST_ROOT_URL="https://reports.secret-studio.ru/latest/"
OLD_ROOT_URL="https://reports.secret-studio.ru/old/"

STAMP="$(date -u +%Y%m%d-%H%M%S)"
STEP_DIR="/opt/router-ops/steps/${STAMP}_${STEP_ID}"
mkdir -p "$STEP_DIR"
LOG="$STEP_DIR/main.log"
exec > >(tee -a "$LOG") 2>&1

RESULT="STOP_UNHANDLED_LOCAL_PLAN_PIN_ERROR"
LOCAL_M07_PLAN_URL=""
STEP_REPORT_URL=""
FACTS_URL=""
VERIFY_URL=""
ROLLBACK_URL=""
PUBLIC_OBJECT_KIND=""
PREVIOUS_MOVED_COUNT=""
RUNTIME_IMPACT=false
COPY_VERIFY=PASS

progress() {
    printf '>>> [%s] %s\n' "$(date -u +%H:%M:%S)" "$*"
}

value() {
    local key="$1" file="$2"
    awk -F= -v k="$key" '$1==k {v=substr($0,index($0,"=")+1)} END{print v}' "$file"
}

url_from_log() {
    local key="$1" file="$2" url rel dir
    url="$(value "$key" "$file")"
    [[ -n "$url" ]] || url="$(value PUBLIC_URL "$file")"
    if [[ -z "$url" ]]; then
        rel="$(value PUBLISHED_RELATIVE_PATH "$file")"
        [[ -n "$rel" ]] && url="${PERMANENT_ROOT}/${rel}/"
    fi
    if [[ -z "$url" ]]; then
        dir="$(value PUBLISHED_DIR "$file")"
        [[ -n "$dir" ]] && url="${PERMANENT_ROOT}/latest/$(basename "$dir")/"
    fi
    printf '%s\n' "$url"
}

publish_files() {
    local label="$1" log="$2"
    shift 2
    "$PUBLISHER" "$label" "$@" >"$log" 2>&1
}

http_fetch() {
    curl --fail --silent --show-error --location         --resolve "$RESOLVE"         --connect-timeout 5 --max-time 30         "$1" -o "$2"
}

step_sha() {
    sha256sum "$STEP_DIR/step-code.sh" | awk '{print $1}'
}

finish() {
    printf '%s\n'         "RESULT=$RESULT"         "STEP_REPORT_URL=$STEP_REPORT_URL"         "LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL"         "GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL"         "ACCESS_MAP_URL=$ACCESS_MAP_URL"         "VM100_PUBLIC_URL=$VM100_PUBLIC_URL"         "VM101_PUBLIC_URL=$VM101_PUBLIC_URL"         "VM121_PUBLIC_URL=$VM121_PUBLIC_URL"         "VM101_MODEL_URL=$VM101_MODEL_URL"         "VM101_METHODS_URL=$VM101_METHODS_URL"         "VM130_SOURCE_URL=$VM130_SOURCE_URL"         "LATEST_ROOT_URL=$LATEST_ROOT_URL"         "OLD_ROOT_URL=$OLD_ROOT_URL"         "FACTS_URL=$FACTS_URL"         "VERIFY_URL=$VERIFY_URL"         "ROLLBACK_URL=$ROLLBACK_URL"         "PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND"         "PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT"         "COPY_VERIFY=$COPY_VERIFY"         "STEP_SHA256=$(step_sha)"         "RUNTIME_IMPACT=$RUNTIME_IMPACT"
}

fail() {
    RESULT="$1"
    finish
    exit 1
}

progress "verify exact transferred ZIP, code, plans and approved publisher"
cp "$0" "$STEP_DIR/step-code.sh"
cp "$BUNDLE_ZIP" "$STEP_DIR/"
cp "$BUNDLE_ROOT/manifest.sha256" "$STEP_DIR/bundle-manifest.sha256"

ACTUAL_BUNDLE_SHA="$(sha256sum "$BUNDLE_ZIP" | awk '{print $1}')"
ACTUAL_INSTALLER_SHA="$(sha256sum "$BUNDLE_ROOT/install.sh" | awk '{print $1}')"

cat >"$STEP_DIR/transfer-verify.txt" <<EOF
EXPECTED_BUNDLE_SHA256=$EXPECTED_BUNDLE_SHA256
ACTUAL_BUNDLE_SHA256=$ACTUAL_BUNDLE_SHA
EXPECTED_INSTALLER_SHA256=$EXPECTED_INSTALLER_SHA256
ACTUAL_INSTALLER_SHA256=$ACTUAL_INSTALLER_SHA
EOF

[[ "$ACTUAL_BUNDLE_SHA" == "$EXPECTED_BUNDLE_SHA256" ]] || {
    COPY_VERIFY=FAIL
    fail STOP_COPY_OR_TRANSFER_ERROR
}
[[ "$ACTUAL_INSTALLER_SHA" == "$EXPECTED_INSTALLER_SHA256" ]] || {
    COPY_VERIFY=FAIL
    fail STOP_COPY_OR_TRANSFER_ERROR
}
(
    cd "$BUNDLE_ROOT"
    sha256sum -c manifest.sha256
) >>"$STEP_DIR/transfer-verify.txt" 2>&1 || {
    COPY_VERIFY=FAIL
    fail STOP_COPY_OR_TRANSFER_ERROR
}

bash -n "$STEP_DIR/step-code.sh"
[[ "$(sha256sum "$PUBLISHER" | awk '{print $1}')" == "$EXPECTED_PUBLISHER_SHA" ]] ||
    fail STOP_PUBLISHER_SHA256_MISMATCH
[[ "$(sha256sum "$BUNDLE_ROOT/canonical-m07-plan.md" | awk '{print $1}')" == "$EXPECTED_SHORT_SHA" ]] ||
    fail STOP_SHORT_PLAN_SHA256_MISMATCH
[[ "$(sha256sum "$BUNDLE_ROOT/canonical-plan.md" | awk '{print $1}')" == "$EXPECTED_FULL_SHA" ]] ||
    fail STOP_FULL_PLAN_SHA256_MISMATCH

echo "COPY_VERIFY=PASS" >>"$STEP_DIR/transfer-verify.txt"
echo "STEP_SHA256=$(step_sha)" >>"$STEP_DIR/transfer-verify.txt"

cp "$BUNDLE_ROOT/canonical-m07-plan.md" "$STEP_DIR/"
cp "$BUNDLE_ROOT/canonical-plan.md" "$STEP_DIR/"
cp "$BUNDLE_ROOT/local-plan-contract.md" "$STEP_DIR/"
cp "$BUNDLE_ROOT/next-implementation-sequence.md" "$STEP_DIR/"
cp "$BUNDLE_ROOT/README.md" "$STEP_DIR/"
cp "$BUNDLE_ROOT/release-info.json" "$STEP_DIR/"

(
    cd "$STEP_DIR"
    sha256sum         canonical-m07-plan.md         canonical-plan.md         local-plan-contract.md         next-implementation-sequence.md         >plan-content.sha256
)

progress "publish one canonical local M07 plan containing both mandatory plans"
publish_files     "local_architecture_plan_vm101_autonomous_hmn_recovery_r15a_full_spec_pinned"     "$STEP_DIR/plan-publish.log"     "$STEP_DIR/canonical-m07-plan.md"     "$STEP_DIR/canonical-plan.md"     "$STEP_DIR/local-plan-contract.md"     "$STEP_DIR/next-implementation-sequence.md"     "$STEP_DIR/README.md"     "$STEP_DIR/release-info.json"     "$STEP_DIR/plan-content.sha256"

LOCAL_M07_PLAN_URL="$(url_from_log LOCAL_M07_PLAN_URL "$STEP_DIR/plan-publish.log")"
[[ "$LOCAL_M07_PLAN_URL" == "${PERMANENT_ROOT}/latest/"*/ ]] ||
    fail STOP_LOCAL_M07_PLAN_URL_INVALID

PLAN_KIND="$(value PUBLIC_OBJECT_KIND "$STEP_DIR/plan-publish.log")"
PLAN_PREVIOUS_MOVED_COUNT="$(value PREVIOUS_MOVED_COUNT "$STEP_DIR/plan-publish.log")"
PLAN_PUBLISHED_DIR="$(value PUBLISHED_DIR "$STEP_DIR/plan-publish.log")"
[[ -d "$PLAN_PUBLISHED_DIR" ]] || fail STOP_LOCAL_PLAN_PUBLISHED_DIR_MISSING

progress "verify both plans byte-for-byte over permanent HTTPS"
http_fetch "${LOCAL_M07_PLAN_URL}canonical-m07-plan.md" "$STEP_DIR/http-canonical-m07-plan.md"
http_fetch "${LOCAL_M07_PLAN_URL}canonical-plan.md" "$STEP_DIR/http-canonical-plan.md"
http_fetch "${LOCAL_M07_PLAN_URL}local-plan-contract.md" "$STEP_DIR/http-local-plan-contract.md"
http_fetch "${LOCAL_M07_PLAN_URL}next-implementation-sequence.md" "$STEP_DIR/http-next-implementation-sequence.md"

cmp "$STEP_DIR/canonical-m07-plan.md" "$STEP_DIR/http-canonical-m07-plan.md" ||
    fail STOP_SHORT_PLAN_HTTP_COMPARE_FAILED
cmp "$STEP_DIR/canonical-plan.md" "$STEP_DIR/http-canonical-plan.md" ||
    fail STOP_FULL_PLAN_HTTP_COMPARE_FAILED
cmp "$STEP_DIR/local-plan-contract.md" "$STEP_DIR/http-local-plan-contract.md" ||
    fail STOP_PLAN_CONTRACT_HTTP_COMPARE_FAILED

TOKEN="$(cat /opt/router-ops/public/.router-public-token)"
LATEST_DIR="/opt/router-ops/public/r/$TOKEN/latest"
OLD_DIR="/opt/router-ops/public/r/$TOKEN/old"

CURRENT_PLAN_COUNT="$(
    find "$LATEST_DIR" -mindepth 1 -maxdepth 1 -type d         -name '*_local_architecture_plan_vm101_autonomous_hmn_recovery*' |
    wc -l | tr -d ' '
)"
[[ "$CURRENT_PLAN_COUNT" == 1 ]] || fail STOP_LOCAL_PLAN_LATEST_DUPLICATE

OLD_PREVIOUS_COUNT="$(
    find "$OLD_DIR" -mindepth 1 -maxdepth 1 -type d         -name '20260716-133906_local_architecture_plan_vm101_autonomous_hmn_recovery_r15a' |
    wc -l | tr -d ' '
)"
[[ "$OLD_PREVIOUS_COUNT" == 1 ]] || fail STOP_PREVIOUS_LOCAL_PLAN_NOT_ARCHIVED

cat >"$STEP_DIR/system-model.txt" <<EOF
VM101_RUNTIME_CHANGED=false
VM101_SOURCE_CHANGED=false
VM130_INFRASTRUCTURE_CHANGED=false
CANONICAL_LOCAL_PLAN_CURRENT=$LOCAL_M07_PLAN_URL
MANDATORY_PLAN_FILE_1=canonical-m07-plan.md
MANDATORY_PLAN_FILE_1_SHA256=$EXPECTED_SHORT_SHA
MANDATORY_PLAN_FILE_2=canonical-plan.md
MANDATORY_PLAN_FILE_2_SHA256=$EXPECTED_FULL_SHA
CURRENT_PLAN_COUNT=$CURRENT_PLAN_COUNT
PREVIOUS_PLAN_ARCHIVED_COUNT=$OLD_PREVIOUS_COUNT
EOF

cat >"$STEP_DIR/methods-limitations.txt" <<EOF
METHOD=Publication-only canonical plan replacement through approved router-publish-report.
PUBLISHER_INTERFACE=label plus explicit files.
RUNTIME_IMPACT=false
VM101_ACCESS_USED=false
VM101_MACHINE_GIT_CHANGED=false
VM130_INFRASTRUCTURE_CHANGED=false
LIMITATION=The publisher preserves old canonical folders, but future plan-generating STEP code must obey local-plan-contract.md and carry both mandatory files forward.
EOF

cat >"$STEP_DIR/access-routes.txt" <<EOF
ACCESS_MAP_CHANGED=false
VM101_ROUTE_UNCHANGED=ops@router-ops -> pve-mgts -> root@10.71.100.2
PUBLIC_HTTP_ROUTE=reports.secret-studio.ru resolved internally to 10.71.100.84
EOF

cat >"$STEP_DIR/rollback.sh" <<'ROLLBACK'
#!/usr/bin/env bash
set -Eeuo pipefail

[[ "${APPROVE_ROLLBACK:-NO}" == YES ]] || {
    echo "RESULT=STOP_MANUAL_APPROVAL_REQUIRED"
    exit 1
}

PUBLISHER="/opt/router-ops/bin/router-publish-report"
EXPECTED_PUBLISHER_SHA="e78430b57afbd0ae27fc575fc4de78bb267c76caf04ec935b01e9b2f89840e32"
[[ "$(sha256sum "$PUBLISHER" | awk '{print $1}')" == "$EXPECTED_PUBLISHER_SHA" ]]

TOKEN="$(cat /opt/router-ops/public/.router-public-token)"
PREVIOUS="/opt/router-ops/public/r/$TOKEN/old/20260716-133906_local_architecture_plan_vm101_autonomous_hmn_recovery_r15a"
[[ -d "$PREVIOUS" ]]

mapfile -d '' FILES < <(
    find "$PREVIOUS" -mindepth 1 -maxdepth 1 -type f         ! -name manifest.sha256 -print0 |
    sort -z
)
[[ "${#FILES[@]}" -gt 0 ]]

"$PUBLISHER"     "local_architecture_plan_vm101_autonomous_hmn_recovery_r15a_rollback"     "${FILES[@]}"

echo "RESULT=PASS_LOCAL_M07_PLAN_PUBLICATION_ROLLED_BACK"
echo "RUNTIME_IMPACT=false"
ROLLBACK
chmod 700 "$STEP_DIR/rollback.sh"

RESULT="PASS_LOCAL_M07_PLAN_FULL_SPEC_PINNED"

cat >"$STEP_DIR/facts.json" <<EOF
{
  "step_id": "$STEP_ID",
  "result": "$RESULT",
  "runtime_impact": false,
  "vm101_changed": false,
  "vm101_source_changed": false,
  "vm130_infrastructure_changed": false,
  "access_map_changed": false,
  "local_m07_plan_url": "$LOCAL_M07_PLAN_URL",
  "short_plan": {
    "filename": "canonical-m07-plan.md",
    "sha256": "$EXPECTED_SHORT_SHA"
  },
  "full_plan": {
    "filename": "canonical-plan.md",
    "sha256": "$EXPECTED_FULL_SHA"
  },
  "both_plans_http_compare": "PASS",
  "current_plan_count": $CURRENT_PLAN_COUNT,
  "previous_plan_archived_count": $OLD_PREVIOUS_COUNT,
  "plan_public_object_kind": "$PLAN_KIND",
  "plan_previous_moved_count": "$PLAN_PREVIOUS_MOVED_COUNT"
}
EOF

cat >"$STEP_DIR/verify.txt" <<EOF
RESULT=$RESULT
COPY_VERIFY=PASS
STEP_SHA256=$(step_sha)
PUBLISHER_SHA256=$(sha256sum "$PUBLISHER" | awk '{print $1}')
SHORT_PLAN_SHA256=$EXPECTED_SHORT_SHA
FULL_PLAN_SHA256=$EXPECTED_FULL_SHA
SHORT_PLAN_HTTP_COMPARE=PASS
FULL_PLAN_HTTP_COMPARE=PASS
PLAN_CONTRACT_HTTP_COMPARE=PASS
LATEST_LOCAL_PLAN_COUNT=$CURRENT_PLAN_COUNT
PREVIOUS_LOCAL_PLAN_IN_OLD_COUNT=$OLD_PREVIOUS_COUNT
RUNTIME_IMPACT=false
EOF

cat >"$STEP_DIR/report.txt" <<EOF
STEP_ID=$STEP_ID
RESULT=$RESULT
PURPOSE=Publish the short current M07 plan and the complete VM101 autonomous recovery state-machine plan together in one canonical local-plan folder.
BEFORE_LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_PREVIOUS_URL
AFTER_LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
EXPECTED=Both canonical-m07-plan.md and canonical-plan.md exist together in the one current local M07 plan folder.
ACTUAL=Both files published and independently compared byte-for-byte over permanent HTTPS.
SHORT_PLAN_SHA256=$EXPECTED_SHORT_SHA
FULL_PLAN_SHA256=$EXPECTED_FULL_SHA
CURRENT_LOCAL_PLAN_COUNT=$CURRENT_PLAN_COUNT
PREVIOUS_LOCAL_PLAN_ARCHIVED_COUNT=$OLD_PREVIOUS_COUNT
INDEPENDENT_HTTP_CHECK=PASS
VM101_CHANGED=false
VM101_SOURCE_CHANGED=false
VM130_INFRASTRUCTURE_CHANGED=false
ACCESS_MAP_CHANGED=false
RUNTIME_IMPACT=false
ROLLBACK=Republish the prior canonical plan from old/ with APPROVE_ROLLBACK=YES.
LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
VM101_MODEL_URL=$VM101_MODEL_URL
VM101_METHODS_URL=$VM101_METHODS_URL
VM130_SOURCE_URL=$VM130_SOURCE_URL
COPY_VERIFY=PASS
STEP_SHA256=$(step_sha)
EOF

progress "publish formal STEP report"
publish_files     "step050m07r15a2_local_plan_full_spec_pin"     "$STEP_DIR/step-publish.log"     "$STEP_DIR/step-code.sh"     "$STEP_DIR/report.txt"     "$STEP_DIR/facts.json"     "$STEP_DIR/verify.txt"     "$STEP_DIR/rollback.sh"     "$STEP_DIR/system-model.txt"     "$STEP_DIR/methods-limitations.txt"     "$STEP_DIR/access-routes.txt"     "$STEP_DIR/transfer-verify.txt"     "$STEP_DIR/main.log"     "$STEP_DIR/canonical-m07-plan.md"     "$STEP_DIR/canonical-plan.md"     "$STEP_DIR/local-plan-contract.md"     "$STEP_DIR/next-implementation-sequence.md"     "$STEP_DIR/plan-content.sha256"     "$STEP_DIR/plan-publish.log"

STEP_REPORT_URL="$(url_from_log STEP_REPORT_URL "$STEP_DIR/step-publish.log")"
PUBLIC_OBJECT_KIND="$(value PUBLIC_OBJECT_KIND "$STEP_DIR/step-publish.log")"
PREVIOUS_MOVED_COUNT="$(value PREVIOUS_MOVED_COUNT "$STEP_DIR/step-publish.log")"
STEP_PUBLISHED_DIR="$(value PUBLISHED_DIR "$STEP_DIR/step-publish.log")"

[[ "$STEP_REPORT_URL" == "${PERMANENT_ROOT}/latest/"*/ ]] ||
    fail STOP_STEP_REPORT_URL_INVALID
[[ -d "$STEP_PUBLISHED_DIR" ]] || fail STOP_STEP_REPORT_PUBLISHED_DIR_MISSING

FACTS_URL="${STEP_REPORT_URL}facts.json"
VERIFY_URL="${STEP_REPORT_URL}verify.txt"
ROLLBACK_URL="${STEP_REPORT_URL}rollback.sh"

cat >>"$STEP_DIR/report.txt" <<EOF
STEP_REPORT_URL=$STEP_REPORT_URL
FACTS_URL=$FACTS_URL
VERIFY_URL=$VERIFY_URL
ROLLBACK_URL=$ROLLBACK_URL
LATEST_ROOT_URL=$LATEST_ROOT_URL
OLD_ROOT_URL=$OLD_ROOT_URL
PUBLIC_OBJECT_KIND=$PUBLIC_OBJECT_KIND
PREVIOUS_MOVED_COUNT=$PREVIOUS_MOVED_COUNT
EOF

cp "$STEP_DIR/report.txt" "$STEP_PUBLISHED_DIR/report.txt"
(
    cd "$STEP_PUBLISHED_DIR"
    find . -type f ! -name manifest.sha256 -print0 |
        sort -z |
        xargs -0 sha256sum >manifest.sha256
)

progress "verify published STEP artifacts over HTTPS"
http_fetch "$FACTS_URL" "$STEP_DIR/http-facts.json"
http_fetch "$VERIFY_URL" "$STEP_DIR/http-verify.txt"
http_fetch "$ROLLBACK_URL" "$STEP_DIR/http-rollback.sh"
http_fetch "${STEP_REPORT_URL}canonical-plan.md" "$STEP_DIR/http-step-canonical-plan.md"

cmp "$STEP_DIR/facts.json" "$STEP_DIR/http-facts.json" ||
    fail STOP_FACTS_HTTP_COMPARE_FAILED
cmp "$STEP_DIR/verify.txt" "$STEP_DIR/http-verify.txt" ||
    fail STOP_VERIFY_HTTP_COMPARE_FAILED
cmp "$STEP_DIR/rollback.sh" "$STEP_DIR/http-rollback.sh" ||
    fail STOP_ROLLBACK_HTTP_COMPARE_FAILED
cmp "$STEP_DIR/canonical-plan.md" "$STEP_DIR/http-step-canonical-plan.md" ||
    fail STOP_STEP_FULL_PLAN_HTTP_COMPARE_FAILED

finish