#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"
CASE=pass
if [[ "$SELFTEST" == true ]]; then
  case "${ROUTER_PUBLIC_ROOT:-}" in
    */fail-pre/public) CASE=fail-pre ;;
    */fail-core/public) CASE=fail-core ;;
    */fail-post/public) CASE=fail-post ;;
  esac
fi

STEP=STEP_050M07P23C_R09_VM121_LEGACY_MAINTENANCE_PATH_RETIREMENT
BASE_COMMIT=b379b85fb9765633f9c38184356d5bbcae95a043
BASE_TREE=a76d4084e1300c5e26a489696fb02b52e4b50fa2
BASE_COUNT=45
EXPECTED_TREE=4083cc0983b9ecf3549ad334fa939b0559467d56
NEW_ADMIN_SHA=ef2fcdc84de433304e3f01bcded33e72174a6310684f4dc959d04d74f01e9f49
NEW_WRAP_SHA=1ea018e0c41bc98a1b2889ed5d400df6a752560219f85c73de95ffdd4c6e6953
DOMAIN_SHA=79109ed792d0c34794a9e693d95914065515af0e23527ce90e2557ebdbbaf753
CREDENTIAL_SHA=d92bdf6746409fdb9b2fc368597273f7eb7318322bac72f56541e793c07fd35e

CURRENT="$RUN_DIR/workflow-current.txt"; EVENTS="$RUN_DIR/workflow-events.tsv"; EVIDENCE="$RUN_DIR/evidence"; REPORT="$RUN_DIR/report"; PAYLOAD="$RUN_DIR/public-payload"; FINAL_ENV="$RUN_DIR/final-publication.env"; TARGET_DIR="$RUN_DIR/target"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"
chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"
source "$BASE/lib/router-step-workflow.sh"
source <("$BASE/bin/router-release-contract" env --root "$ROOT")
router_step_workflow_init "$CURRENT" "$EVENTS" preflight maintenance_retirement machine_close postcheck report_publish archive

CORE_CHANGE_COMPLETE=false
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=not_required
STOP_DETAIL=unknown
STOP_HANDLED=false
STEP_REPORT_URL=unknown
LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown
REMOTE_STAGE=unknown
REMOTE_PKG=unknown
VM121_NEW_COMMIT=unknown
VM121_NEW_TREE=unknown
VM121_NEW_FILE_COUNT=unknown
VM121_NEW_PUBLIC_URL=unknown

last_field(){ local k="$1" f="$2"; awk -F= -v k="$k" '$1==k{v=substr($0,index($0,"=")+1)} END{print v}' "$f"; }

write_child(){
  local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
  {
    echo "RESULT=$result"; echo "WORKER_RC=$rc"
    echo "CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE"; echo "CORE_CHANGE_REPEATED=$CORE_CHANGE_REPEATED"
    echo "SOURCE_CHANGED=$SOURCE_CHANGED"; echo "SOURCE_ROLLBACK_STATUS=$SOURCE_ROLLBACK_STATUS"; echo "BACKEND_RECOVERY_STATUS=$BACKEND_RECOVERY_STATUS"
    echo "STOP_DETAIL=$STOP_DETAIL"
    echo "LIVE_DATABASE_WRITTEN=false"; echo "DATABASE_SCHEMA_CHANGED=false"
    echo "RUNTIME_PROVISIONING_ACTIVE=false"; echo "EXTERNAL_ONBOARDING_ACTIVE=false"
    echo "VM121_NEW_COMMIT=$VM121_NEW_COMMIT"; echo "VM121_NEW_TREE=$VM121_NEW_TREE"; echo "VM121_NEW_FILE_COUNT=$VM121_NEW_FILE_COUNT"; echo "VM121_NEW_PUBLIC_URL=$VM121_NEW_PUBLIC_URL"
    echo "STEP_REPORT_URL=$STEP_REPORT_URL"; echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"; echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
  } > "$tmp"
  chmod 600 "$tmp"; mv "$tmp" "$CHILD_RESULT"
}
archive_latest(){
  local log="$EVIDENCE/archive.log"
  router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"
  LATEST_ARCHIVE="$(last_field LATEST_ARCHIVE "$log")"; LATEST_ARCHIVE_SHA256="$(last_field LATEST_ARCHIVE_SHA256 "$log")"
}
cleanup_remote(){
  [[ "$SELFTEST" == false && "$REMOTE_STAGE" != unknown ]] || return 0
  set +e; ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -rf '$REMOTE_STAGE' '$REMOTE_PKG'" >/dev/null 2>&1; set -e
}
write_stop_report(){
  local rc="$1" line="$2" cmd="$3"
  cat > "$REPORT/report.txt" <<EOF
RESULT=STOP_P23C_VM121_LEGACY_MAINTENANCE_PATH_RETIREMENT
REVISION=R09
STOP_RC=$rc
STOP_LINE=$line
STOP_DETAIL=$STOP_DETAIL
CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE
CORE_CHANGE_REPEATED=$CORE_CHANGE_REPEATED
SOURCE_CHANGED=$SOURCE_CHANGED
SOURCE_ROLLBACK_STATUS=$SOURCE_ROLLBACK_STATUS
BACKEND_RECOVERY_STATUS=$BACKEND_RECOVERY_STATUS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$BASE_COMMIT
EOF
  printf 'STOP_COMMAND=%q\n' "$cmd" >> "$REPORT/report.txt"
  cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
}
stop_handler(){
  local rc="$1" line="$2" cmd="$3"
  trap - ERR
  [[ "$STOP_HANDLED" == false ]] || return "$rc"
  STOP_HANDLED=true; cleanup_remote; write_stop_report "$rc" "$line" "$cmd"
  set +e
  if [[ "$SELFTEST" == true ]]; then
    DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23c-r09-$CASE-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/
    STEP_REPORT_URL="selftest://p23c-r09-$CASE/"; archive_latest >/dev/null 2>&1
  else
    args=(); while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
    router_step_publish_payload step050m07p23c_r09_vm121_legacy_maintenance_path_retirement_stop "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" >/dev/null 2>&1 || true
    [[ -f "$FINAL_ENV" ]] && STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"
    archive_latest >/dev/null 2>&1
  fi
  set -e; write_child STOP_P23C_VM121_LEGACY_MAINTENANCE_PATH_RETIREMENT "$rc"; return "$rc"
}
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"; exit "$rc"' ERR

self_source_pre(){
cat <<EOF
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=$BASE_COMMIT
REMOTE_HEAD=$BASE_COMMIT
STAGED_CHANGE_COUNT=0
SIMULATED_TREE_SHA=$BASE_TREE
SIMULATED_TREE_FILE_COUNT=45
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
GIT_COMMIT=$BASE_COMMIT
GIT_TREE=$BASE_TREE
GIT_FILE_COUNT=45
COMMIT_CREATED=false
PUSH_PERFORMED=false
EOF
}
self_target(){
 case "$CASE" in
 fail-pre)
 cat <<EOF
FAILED_STAGE=preflight_live_state
CORE_SOURCE_CHANGE_COMPLETE=false
SOURCE_CHANGED=false
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=not_required
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RESULT=STOP_P23C_VM121_LEGACY_MAINTENANCE_PATH_RETIREMENT
EOF
 return 1 ;;
 fail-core)
 cat <<EOF
FAILED_STAGE=backend_controlled_restart
CORE_SOURCE_CHANGE_COMPLETE=false
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=PASS
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RESULT=STOP_P23C_VM121_LEGACY_MAINTENANCE_PATH_RETIREMENT
EOF
 return 1 ;;
 *)
 cat <<EOF
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS_BEFORE=0
BUSINESS_ROWS_AFTER=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
ADMIN_SHA256=$NEW_ADMIN_SHA
MAINTENANCE_WRAPPER_SHA256=$NEW_WRAP_SHA
DOMAIN_V2_SERVICE_SHA256=$DOMAIN_SHA
CREDENTIAL_CRYPTO_SHA256=$CREDENTIAL_SHA
LEGACY_ADMIN_WRITER_COUNT=5
LEGACY_ADMIN_WRITERS_FENCED=true
LEGACY_MAINTENANCE_CALLER_RETIRED=true
MUTATING_HTTP_FENCE_PROBES=false
BACKEND_GENERATION_CHANGED=true
CORE_SOURCE_CHANGE_COMPLETE=true
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
RESULT=PASS_P23C_VM121_LEGACY_MAINTENANCE_PATH_RETIREMENT
EOF
 ;;
 esac
}
self_close(){
 [[ "$CASE" != fail-post ]] || return 1
 cat <<EOF
RESULT=PASS_VM121_GIT_PUBLISH
MACHINE=vm121
COMMIT=1111111111111111111111111111111111111111
TREE=$EXPECTED_TREE
GIT_FILE_COUNT=45
VM121_PUBLIC_URL=https://reports.example/latest/vm121/
RESULT=PASS_ROUTER_MACHINE_CLOSE
EOF
}
self_post_source(){
cat <<EOF
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=1111111111111111111111111111111111111111
REMOTE_HEAD=1111111111111111111111111111111111111111
STAGED_CHANGE_COUNT=0
SIMULATED_TREE_SHA=$EXPECTED_TREE
SIMULATED_TREE_FILE_COUNT=45
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
GIT_COMMIT=1111111111111111111111111111111111111111
GIT_TREE=$EXPECTED_TREE
GIT_FILE_COUNT=45
COMMIT_CREATED=false
PUSH_PERFORMED=false
EOF
}
self_live(){
cat <<EOF
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
ADMIN_SHA256=$NEW_ADMIN_SHA
MAINTENANCE_WRAPPER_SHA256=$NEW_WRAP_SHA
DOMAIN_V2_SERVICE_SHA256=$DOMAIN_SHA
CREDENTIAL_CRYPTO_SHA256=$CREDENTIAL_SHA
BACKEND_HEALTH=PASS
LEGACY_ADMIN_WRITER_COUNT=5
LEGACY_ADMIN_WRITERS_FENCED=true
LEGACY_MAINTENANCE_CALLER_RETIRED=true
MUTATING_HTTP_FENCE_PROBES=false
RESULT=PASS_P23C_R09_LIVE
EOF
}

router_step_phase_begin preflight
if [[ "$SELFTEST" == true ]]; then self_source_pre > "$EVIDENCE/pre-vm121-source.txt"; else ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/pre-vm121-source.txt" 2>&1; fi
"$ROOT/scripts/source-check-validate.sh" pre "$EVIDENCE/pre-vm121-source.txt" "$BASE_COMMIT" "$BASE_TREE" 45 0 > "$EVIDENCE/pre-vm121-source-validation.txt" || { STOP_DETAIL=pre_vm121_source; false; }
PKG="$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH"
"$ROOT/scripts/target-apply.sh" "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" "$PKG" "$TARGET_DIR" > "$EVIDENCE/target-extract.txt"
router_step_phase_complete preflight exact_source_and_target_verified

router_step_phase_begin maintenance_retirement
target_rc=0
if [[ "$SELFTEST" == true ]]; then
  if self_target > "$EVIDENCE/maintenance-retirement.txt"; then target_rc=0; else target_rc=$?; fi
else
  token="$(basename "$RUN_DIR" | tr -cd 'A-Za-z0-9._-')"; REMOTE_STAGE="/root/router-step-p23c-r09-$token"; REMOTE_PKG="/root/router-step-p23c-r09-$token.tar.gz"
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "umask 077; cat > '$REMOTE_PKG'" < "$PKG" || { STOP_DETAIL=remote_package_transfer; false; }
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -rf '$REMOTE_STAGE'; install -d -m 0700 '$REMOTE_STAGE'; tar -xzf '$REMOTE_PKG' -C '$REMOTE_STAGE'" > "$EVIDENCE/remote-stage.txt" 2>&1 || { STOP_DETAIL=remote_package_extract; false; }
  if ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "/bin/bash '$REMOTE_STAGE/vm121-p23c-r09-maintenance-fence.sh' '$REMOTE_STAGE/candidate'" > "$EVIDENCE/maintenance-retirement.txt" 2>&1; then target_rc=0; else target_rc=$?; fi
fi
remote_core="$(last_field CORE_SOURCE_CHANGE_COMPLETE "$EVIDENCE/maintenance-retirement.txt")"; remote_changed="$(last_field SOURCE_CHANGED "$EVIDENCE/maintenance-retirement.txt")"; remote_rb="$(last_field SOURCE_ROLLBACK_STATUS "$EVIDENCE/maintenance-retirement.txt")"; remote_backend="$(last_field BACKEND_RECOVERY_STATUS "$EVIDENCE/maintenance-retirement.txt")"
[[ "$remote_core" == true ]] && CORE_CHANGE_COMPLETE=true
[[ "$remote_changed" == true ]] && SOURCE_CHANGED=true
[[ -n "$remote_rb" ]] && SOURCE_ROLLBACK_STATUS="$remote_rb"
[[ -n "$remote_backend" ]] && BACKEND_RECOVERY_STATUS="$remote_backend"
if [[ "$target_rc" -ne 0 ]]; then STOP_DETAIL="maintenance_retirement_$(last_field FAILED_STAGE "$EVIDENCE/maintenance-retirement.txt")"; false; fi
"$ROOT/scripts/target-semantics-validate.sh" "$EVIDENCE/maintenance-retirement.txt" > "$EVIDENCE/maintenance-retirement-validation.txt" || { STOP_DETAIL=maintenance_retirement_semantics; false; }
CORE_CHANGE_COMPLETE=true; SOURCE_CHANGED=true; cleanup_remote
router_step_phase_complete maintenance_retirement all_five_legacy_admin_writers_fenced_and_periodic_caller_retired

router_step_phase_begin machine_close
close_rc=0
if [[ "$SELFTEST" == true ]]; then if self_close > "$EVIDENCE/vm121-machine-close.txt"; then close_rc=0; else close_rc=$?; fi
else if "$BASE/bin/router-machine-close-safe" vm121 "$STEP: fence fifth legacy admin writer and retire Domain V1 maintenance caller" > "$EVIDENCE/vm121-machine-close.txt" 2>&1; then close_rc=0; else close_rc=$?; fi
fi
if [[ "$close_rc" -ne 0 ]]; then STOP_DETAIL=machine_close_after_core; false; fi
"$ROOT/scripts/machine-close-validate.sh" "$EVIDENCE/vm121-machine-close.txt" > "$EVIDENCE/vm121-machine-close-validation.txt" || { STOP_DETAIL=machine_close_semantics; false; }
VM121_NEW_COMMIT="$(last_field VM121_NEW_COMMIT "$EVIDENCE/vm121-machine-close-validation.txt")"; VM121_NEW_TREE="$(last_field VM121_NEW_TREE "$EVIDENCE/vm121-machine-close-validation.txt")"; VM121_NEW_FILE_COUNT="$(last_field VM121_NEW_FILE_COUNT "$EVIDENCE/vm121-machine-close-validation.txt")"; VM121_NEW_PUBLIC_URL="$(last_field VM121_NEW_PUBLIC_URL "$EVIDENCE/vm121-machine-close-validation.txt")"
router_step_phase_complete machine_close vm121_source_closed_and_published

router_step_phase_begin postcheck
if [[ "$SELFTEST" == true ]]; then
 self_post_source > "$EVIDENCE/post-vm121-source.txt"; self_live > "$EVIDENCE/post-live.txt"
else
 ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/post-vm121-source.txt" 2>&1
 ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s > "$EVIDENCE/post-live.txt" 2>&1 <<'VM121'
set -euo pipefail
sha(){ sha256sum "$1" | awk '{print $1}'; }
PG=wgaccess-postgres
PGUSER="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_USER"')"
PGDB="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_DB"')"
q(){ docker exec "$PG" psql -v ON_ERROR_STOP=1 -U "$PGUSER" -d "$PGDB" -Atqc "$1"; }
echo "ALEMBIC_VERSION=$(q 'SELECT version_num FROM alembic_version')"
echo "BUSINESS_ROWS=$(q "SELECT
 (SELECT count(*) FROM users)+(SELECT count(*) FROM plans)+(SELECT count(*) FROM access_grants)+(SELECT count(*) FROM access_grant_protocol_limits)+
 (SELECT count(*) FROM invites)+(SELECT count(*) FROM invite_redemptions)+(SELECT count(*) FROM magic_link_tokens)+(SELECT count(*) FROM auth_sessions)+
 (SELECT count(*) FROM connection_profiles)+(SELECT count(*) FROM peer_credentials)+(SELECT count(*) FROM audit_events)+(SELECT count(*) FROM invite_codes)+
 (SELECT count(*) FROM orders)+(SELECT count(*) FROM subscriptions)+(SELECT count(*) FROM peers)+(SELECT count(*) FROM provisioning_jobs)+(SELECT count(*) FROM peer_egress_leases)")"
echo "EGRESS_TARGET_COUNT=$(q 'SELECT count(*) FROM egress_targets')"
echo "EGRESS_ALLOCATOR_COUNT=$(q 'SELECT count(*) FROM egress_allocator_settings')"
echo "ADMIN_SHA256=$(sha /opt/wg-access/backend/app/api/admin.py)"
echo "MAINTENANCE_WRAPPER_SHA256=$(sha /usr/local/sbin/wg-access-expire-subscriptions.sh)"
echo "DOMAIN_V2_SERVICE_SHA256=$(sha /opt/wg-access/backend/app/services/domain_v2.py)"
echo "CREDENTIAL_CRYPTO_SHA256=$(sha /opt/wg-access/backend/app/services/credential_crypto.py)"
curl -fsS --max-time 5 http://127.0.0.1:18080/health >/dev/null
curl -fsS --max-time 5 http://127.0.0.1:18080/health/db >/dev/null
echo BACKEND_HEALTH=PASS
grep -Fq 'RESULT=NOOP_DOMAIN_V1_MAINTENANCE_RETIRED' /usr/local/sbin/wg-access-expire-subscriptions.sh
! grep -Eq 'curl|/admin/maintenance/expire-subscriptions' /usr/local/sbin/wg-access-expire-subscriptions.sh
echo LEGACY_MAINTENANCE_CALLER_RETIRED=true
docker exec -i wgaccess-backend python - <<'PY'
from fastapi.routing import APIRoute
from app.main import app
targets={
 ("POST","/admin/invites"),("POST","/admin/subscriptions"),("POST","/admin/maintenance/expire-subscriptions"),
 ("POST","/admin/subscriptions/{subscription_id}/cancel"),("POST","/admin/peers/{peer_id}/disable"),
}
def walk(routes):
 for route in routes:
  if isinstance(route,APIRoute): yield route
  else:
   child=getattr(route,"original_router",None)
   if child is not None: yield from walk(child.routes)
found=set()
for route in walk(app.router.routes):
 deps={getattr(d.call,"__name__","") for d in route.dependant.dependencies}
 for method in route.methods:
  key=(method,route.path)
  if key in targets:
   if "require_legacy_domain_v1_writer_retired" not in deps: raise SystemExit(f"unfenced: {key}")
   found.add(key)
if found != targets: raise SystemExit(f"missing: {targets-found}")
print("LEGACY_ADMIN_WRITER_COUNT=5")
print("LEGACY_ADMIN_WRITERS_FENCED=true")
print("MUTATING_HTTP_FENCE_PROBES=false")
PY
echo RESULT=PASS_P23C_R09_LIVE
VM121
fi
"$ROOT/scripts/source-check-validate.sh" post "$EVIDENCE/post-vm121-source.txt" "" "$EXPECTED_TREE" 45 0 > "$EVIDENCE/post-vm121-source-validation.txt" || { STOP_DETAIL=post_vm121_source; false; }
"$ROOT/scripts/live-semantics-validate.sh" "$EVIDENCE/post-live.txt" > "$EVIDENCE/post-live-validation.txt" || { STOP_DETAIL=post_live_semantics; false; }
router_step_phase_complete postcheck exact_tree_and_live_semantics_verified

router_step_phase_begin report_publish
cat > "$REPORT/report.txt" <<EOF
RESULT=PASS_P23C_VM121_LEGACY_MAINTENANCE_PATH_RETIREMENT
REVISION=R09
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
SOURCE_ROLLBACK_STATUS=not_required
BACKEND_RECOVERY_STATUS=PASS
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
ALEMBIC_VERSION=0003_domain_v2_schema
BUSINESS_ROWS=0
EGRESS_TARGET_COUNT=5
EGRESS_ALLOCATOR_COUNT=14
LEGACY_ADMIN_WRITER_COUNT=5
LEGACY_ADMIN_WRITERS_FENCED=true
LEGACY_MAINTENANCE_CALLER_RETIRED=true
MUTATING_HTTP_FENCE_PROBES=false
RUNTIME_PROVISIONING_ACTIVE=false
EXTERNAL_ONBOARDING_ACTIVE=false
VM121_BASE_COMMIT=$BASE_COMMIT
VM121_COMMIT=$VM121_NEW_COMMIT
VM121_TREE=$VM121_NEW_TREE
VM121_FILE_COUNT=$VM121_NEW_FILE_COUNT
VM121_PUBLIC_URL=$VM121_NEW_PUBLIC_URL
RUNTIME_IMPACT=true
COPY_VERIFY=PASS
NEXT_ACTION=update Project Sources to AFTER_P23C, then P23D production credential master-key deployment/backup/rotation foundation; no external onboarding
EOF
cp "$REPORT/report.txt" "$REPORT/verify.txt"; cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"; cp "$ROOT/release-info.json" "$REPORT/release-info.json"; cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
if [[ "$SELFTEST" == true ]]; then
 DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p23c-r09-pass-selftest"; rm -rf "$DEST"; mkdir -p "$DEST"; cp -a "$REPORT"/. "$DEST"/; STEP_REPORT_URL=selftest://p23c-r09-pass/
else
 args=(); while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
 router_step_publish_payload step050m07p23c_r09_vm121_legacy_maintenance_path_retirement "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"
 STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"
fi
router_step_phase_complete report_publish report_published

router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_archived
STOP_DETAIL=none
write_child PASS_P23C_VM121_LEGACY_MAINTENANCE_PATH_RETIREMENT 0
trap - ERR
exit 0