RESULT=STOP_R20QUB1_R04_PUBLICATION_CONTINUATION
STOP_PHASE=independent_extract
STOP_LINE=216
STOP_RC=1
STOP_MACHINE_OWNER=VM130_PUBLICATION_CONTINUATION
STOP_COMMAND=python3 - "$BUNDLE_ZIP" "$FINAL_EXTRACT" "$STEP_ID" <<'PY'
from pathlib import Path,PurePosixPath
import zipfile,sys,stat,os
zpath=Path(sys.argv[1])
dst=Path(sys.argv[2]).resolve()
expected=sys.argv[3]
with zipfile.ZipFile(zpath) as z:
    roots=set()
    safe=[]
    for member in z.infolist():
        name=PurePosixPath(member.filename)
        parts=name.parts
        if not parts or name.is_absolute() or '..' in parts or ':' in parts[0]:
            raise SystemExit('unsafe member')
        roots.add(parts[0])
        target=(dst/Path(*parts)).resolve()
        if target!=dst and dst not in target.parents:
            raise SystemExit('escape')
        mode=(member.external_attr>>16)&0xffff
        if mode and stat.S_ISLNK(mode):
            raise SystemExit('symlink')
        if mode and stat.S_IMODE(mode)&0o7000:
            raise SystemExit('special bits')
        safe.append((member,target,mode))
    if roots!={expected}:
        raise SystemExit(f'roots {roots}')
    z.extractall(dst)
    for member,target,mode in safe:
        if mode:
            os.chmod(target,stat.S_IMODE(mode))
PY

CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
ROLLBACK_STATUS=not_applicable_read_only_continuation
SNAPSHOT_NAME=r20qub1-pre-0731-214833
SNAPSHOT_CREATED_IN_CONTINUATION=false
RUN_DIR=/opt/router-ops/state/detached-step-runs/STEP_050M07R20QUB1_R04_VM101_BOOT_HANDOFF_PUBLICATION_CONTINUATION/runs/20260731-220318-648815-4314
REBOOT_EXECUTED=false
ZERO_HEALTHY_REPEATED=false
NEXT_DIAGNOSTIC_ACTION=inspect_published_evidence_and_continue_from_first_unfinished_publication_phase