#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUNDLE_ROOT="${BUNDLE_ROOT:-$(cd "$SCRIPT_DIR/.." && pwd)}";export BUNDLE_ROOT
BASE='/opt/router-ops';INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
source "$BASE/lib/router-step-workflow.sh"
release_env="$("$BASE/bin/router-release-contract" env --root "$BUNDLE_ROOT")";eval "$release_env"
STEP_ID="$ROUTER_RELEASE_STEP_ID"
[[ "$(id -un)" == ops && "${ROUTER_OPS_BASE:-/opt/router-ops}" == /opt/router-ops ]]
export ROUTER_HTTP_HOST='reports.secret-studio.ru'
export ROUTER_HTTP_RESOLVE_IP='10.71.100.86'
RUN_ID="$(date -u +%Y%m%d-%H%M%S)-$$"
RUN_DIR="$BASE/state/step-runs/$STEP_ID/$RUN_ID"
EVIDENCE_DIR="$RUN_DIR/evidence";REPORT_DIR="$RUN_DIR/report";PUBLIC_PAYLOAD="$RUN_DIR/public-payload"
CURRENT_FILE="$RUN_DIR/workflow-current.txt";EVENTS_FILE="$RUN_DIR/workflow-events.tsv";FINAL_ENV="$RUN_DIR/finalize.txt"
LATEST_ARCHIVE=not_created; CURRENT_PHASE=preflight
mkdir -p "$EVIDENCE_DIR" "$REPORT_DIR" "$BASE/state/locks"
exec 9>"$BASE/state/locks/${STEP_ID}.lock"
flock -n 9 || { echo RESULT=STOP_B5D_R02_ALREADY_RUNNING;exit 75; }
router_step_workflow_init "$CURRENT_FILE" "$EVENTS_FILE" preflight continuation mirror_sync postcheck report_build finalization latest
build_report(){ python3 "$BUNDLE_ROOT/scripts/build-report.py" --bundle "$BUNDLE_ROOT" --run-dir "$RUN_DIR" --result "$1" --phase "$2" --rc "$3" --line "$4"; }
publish_report(){
  local args=() f
  for f in report.txt facts.json facts-public.html verify-public.html rollback-public.html release-info.json installer.sha256 bundle-manifest.sha256 executed-step.sh executed-worker.sh workflow-current.txt workflow-events.tsv;do [[ ! -f "$REPORT_DIR/$f" ]] || args+=("$REPORT_DIR/$f" "$f");done
  for f in preflight continuation mirror-sync postcheck;do [[ ! -f "$REPORT_DIR/$f.txt" ]] || args+=("$REPORT_DIR/$f.txt" "$f.txt");done
  "$BASE/bin/router-public-safe-payload" "$PUBLIC_PAYLOAD" "${args[@]}"
  "$BASE/bin/router-step-finalize" --label step_vm100_b5d_pbr_source_close_r02_continuation --payload-dir "$PUBLIC_PAYLOAD" --workflow-current "$CURRENT_FILE" --workflow-events "$EVENTS_FILE" --output-env "$FINAL_ENV" --expect-kind step-report
}
archive_latest(){
 router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" > "$EVIDENCE_DIR/latest.txt" 2>&1
 cat "$EVIDENCE_DIR/latest.txt"
 grep -Fqx RESULT=PASS_ROUTER_STEP_ARCHIVE_LATEST "$EVIDENCE_DIR/latest.txt"
 LATEST_ARCHIVE="$(awk -F= '$1=="LATEST_ARCHIVE"{print substr($0,index($0,"=")+1)}' "$EVIDENCE_DIR/latest.txt"|tail -n1)"
 [[ -n "$LATEST_ARCHIVE" ]]
}
stop(){
 local line="$1" rc="$2" command="$3" phase="$CURRENT_PHASE"
 trap - ERR HUP INT TERM;set +e
 router_step_phase_fail "$phase" "line=$line rc=$rc" >/dev/null 2>&1
 if router_step_should_publish_stop;then
   if build_report STOP "$phase" "$rc" "$line";then publish_report || echo STOP_REPORT_FINALIZATION=FAILED;else echo STOP_REPORT_BUILD=FAILED;fi
 else echo NO_SECOND_STOP_REPORT=true;fi
 archive_latest || echo STOP_LATEST_ARCHIVE=FAILED
 router_step_emit_stop_evidence STOP_B5D_R02_CONTINUATION "$phase" "$line" "$rc" "$command" VM130 true prohibited_preserve_accepted_source "$LATEST_ARCHIVE" inspect_first_incomplete_phase_no_rerun
 echo CONTINUATION_REQUIRED=true
 exit "$rc"
}
trap 'stop "$LINENO" "$?" "$BASH_COMMAND"' ERR
trap 'stop "$LINENO" 129 "signal HUP"' HUP
trap 'stop "$LINENO" 130 "signal INT"' INT
trap 'stop "$LINENO" 143 "signal TERM"' TERM
CURRENT_PHASE=preflight;router_step_phase_begin preflight
"$BUNDLE_ROOT/scripts/preflight.sh" > "$EVIDENCE_DIR/preflight.txt" 2>&1
cat "$EVIDENCE_DIR/preflight.txt"
grep -Fqx RESULT=PASS_B5D_R02_PREFLIGHT "$EVIDENCE_DIR/preflight.txt"
router_step_phase_complete preflight original_committed_publication_and_live_vm100_verified
CURRENT_PHASE=continuation;router_step_phase_begin continuation
# The one-shot backend override is explicitly supported by router-machine-close.
# Canonical machine-close reuses existing publication; DOES NOT rerun source publisher.
ROUTER_MACHINE_CLOSE_BACKEND_OVERRIDE="$BUNDLE_ROOT/scripts/continuation-backend.sh" \
 "$BASE/bin/router-machine-close-safe" vm100 \
 "$STEP_ID continuation of R01 after verified VM103 HTTPS; reuse commit 216ccfaa0ea7; no source republish" \
 > "$EVIDENCE_DIR/continuation.txt" 2>&1
cat "$EVIDENCE_DIR/continuation.txt"
grep -Fqx 'RESULT=PASS_ROUTER_MACHINE_CLOSE' "$EVIDENCE_DIR/continuation.txt"
grep -Fqx 'TREE=2089a3611d9d0a5a9d3547f8a15881e5851490e2' "$EVIDENCE_DIR/continuation.txt"
grep -Fqx 'COMMIT=216ccfaa0ea7a5280fb1449501cad1d01e2f0ab8' "$EVIDENCE_DIR/continuation.txt"
grep -Fqx 'SOURCE_CONTINUATION_ONLY=true' "$EVIDENCE_DIR/continuation.txt"
router_step_phase_complete continuation source_state_and_machine_close_completed_without_republish
CURRENT_PHASE=mirror_sync;router_step_phase_begin mirror_sync
"$BASE/bin/router-public-mirror-vm103" > "$EVIDENCE_DIR/mirror-sync.txt" 2>&1
cat "$EVIDENCE_DIR/mirror-sync.txt"
grep -Fqx 'RESULT=PASS_ROUTER_PUBLIC_MIRROR_VM103' "$EVIDENCE_DIR/mirror-sync.txt"
grep -Fqx 'MIRROR_EXACT=true' "$EVIDENCE_DIR/mirror-sync.txt"
router_step_phase_complete mirror_sync canonical_vm130_to_vm103_mirror_exact
CURRENT_PHASE=postcheck;router_step_phase_begin postcheck
"$BUNDLE_ROOT/scripts/postcheck.sh" > "$EVIDENCE_DIR/postcheck.txt" 2>&1
cat "$EVIDENCE_DIR/postcheck.txt"
grep -Fqx RESULT=PASS_B5D_R02_POSTCHECK "$EVIDENCE_DIR/postcheck.txt"
router_step_phase_complete postcheck source_and_runtime_unchanged_http_and_state_verified
CURRENT_PHASE=report_build;router_step_phase_begin report_build
build_report PASS none 0 0
router_step_phase_complete report_build verified_continuation_report_built
CURRENT_PHASE=finalization;router_step_phase_begin finalization
publish_report
router_step_phase_complete finalization canonical_step_report_verified_via_vm103
CURRENT_PHASE=latest;router_step_phase_begin latest
archive_latest
router_step_phase_complete latest fresh_latest_contains_correct_new_vm100_source
router_step_workflow_mark_complete
trap - ERR HUP INT TERM
cat "$FINAL_ENV"; cat "$REPORT_DIR/report.txt"
echo RESULT=PASS_B5D_R02_VM100_PBR_SOURCE_CLOSE_CONTINUATION
echo "RUN_DIR=$RUN_DIR"
echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"